:core >> CoreDll: DllRegisterServer called, lpMem base=00150000
:core >> memseek: lpMem=00400000
:core >> memseek: dwSize=00070FFC
:core >> memseek: result=00000000
:core >> memseek: lpMem=00400001
:core >> memseek: dwSize=00070FFC
:core >> memseek: result=00000000
:core >> memseek: lpMem=00400002
:core >> memseek: dwSize=00070FFC
:core >> memseek: result=00000000
:core >> memseek: lpMem=00400003
:core >> memseek: dwSize=00070FFC
:core >> memseek: result=00000000
:core >> IAT_ScanFirstModuleForDWORD: result=0
:core >> CoreDll: av-check passed
:core >> CoreDll: DllRegisterServer: plugins data found at 001583EB
:core >> LoadPlugins: parse data at addr 001583EB
:core >> LoadPlugins: dwShellcodeLen==2010
:core >> LoadPlugins: lpShellcode==00150000
:core >> LoadPlugins: URLs, size=33
:core >> LoadPlugins: plugin, size=8704
:core >> RunPlugin: lpDll=0015841C
:core >> RunPlugin: dwDllSize=8704
:core >> RunPlugin: mem allocated at 003F0000
:core >> RunPlugin: hash value=6DE026C4
:core >> NB: single-thread decr in static buff used=.dll
:core >> RunPlugin: about to call shellcode (dump is done)
:core >> RunPlugin: shellcode finished, eax=003F0000
:core >> RunPlugin: finished--
:core >> LoadPlugins: plugin, size=23040
:core >> RunPlugin: lpDll=0015A620
:core >> RunPlugin: dwDllSize=23040
:core >> RunPlugin: mem allocated at 00960000
:core >> RunPlugin: hash value=596C4D74
:core >> NB: single-thread decr in static buff used=.dll
:core >> RunPlugin: about to call shellcode (dump is done)
:core >> RunPlugin: shellcode finished, eax=00960000
:core >> RunPlugin: finished--
:core >> LoadPlugins: plugin, size=20480
:core >> RunPlugin: lpDll=00160024
:core >> RunPlugin: dwDllSize=20480
:core >> RunPlugin: mem allocated at 00980000
:core >> RunPlugin: hash value=91BB557D
:core >> NB: single-thread decr in static buff used=.dll
:core >> RunPlugin: about to call shellcode (dump is done)
:core >> RunPlugin: shellcode finished, eax=00980000
:core >> RunPlugin: finished--
:core >> CoreDll:IsDataToSendExist called
:core >> CoreDll:IsDataToSendExist: about to call callback
:core >> CoreDll:IsDataToSendExist result=0
:core >> GetFlag == value found
:core >> IsUpdateNeeded: found day val=29
:core >> IsUpdateNeeded: current day val=25
:core >> WARN: All decrypt threads destroyed
:core >> IsUpdateNeeded: dwResult=1
:core >> CoreDll: DllRegisterServer finished