Edit tour

Windows Analysis Report
25hBQ7XDkh.exe

Overview

General Information

Sample Name:	25hBQ7XDkh.exe
Analysis ID:	563159
MD5:	669c9c7805726ead633b2539c0885ee9
SHA1:	744ecd691023e99f2391abe346efa243619b9add
SHA256:	895be5d5816339f3f7100cfa36463d9652048babe690920fc195e4a39d7ab6c5
Tags:	BitRATexe
Infos:

Detection

BitRAT Xmrig

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Yara detected BitRAT

Multi AV Scanner detection for submitted file

Yara detected Xmrig cryptocurrency miner

Malicious sample detected (through community Yara rule)

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Hides threads from debuggers

Found API chain indicative of debugger detection

Machine Learning detection for sample

May check the online IP address of the machine

C2 URLs / IPs found in malware configuration

May use the Tor software to hide its network traffic

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Yara signature match

Antivirus or Machine Learning detection for unpacked file

Contains functionality to check if a debugger is running (IsDebuggerPresent)

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Found evasive API chain (date check)

PE file contains sections with non-standard names

Sleep loop found (likely to delay execution)

Detected potential crypto function

Contains functionality to query CPU information (cpuid)

Sample execution stops while process was sleeping (likely an evasion)

Contains functionality to dynamically determine API calls

PE file contains executable resources (Code or Archives)

Enables debug privileges

Creates a DirectInput object (often for capturing keystrokes)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Sample file is different than original file name gathered from version info

Drops PE files

Contains functionality to read the PEB

Installs a global mouse hook

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Found large amount of non-executed APIs

Creates a process in suspended mode (likely to inject code)

Classification

Process Tree

System is w10x64

25hBQ7XDkh.exe (PID: 796 cmdline: "C:\Users\user\Desktop\25hBQ7XDkh.exe" MD5: 669C9C7805726EAD633B2539C0885EE9)

windowsconnect.exe (PID: 1364 cmdline: "C:\Users\user\AppData\Local\ea242c1c\tor\windowsconnect.exe" -f torrc MD5: 5CFE61FF895C7DAA889708665EF05D7B)

windowsconnect.exe (PID: 6892 cmdline: "C:\Users\user\AppData\Local\ea242c1c\tor\windowsconnect.exe" -f torrc MD5: 5CFE61FF895C7DAA889708665EF05D7B)

windowsconnect.exe (PID: 7072 cmdline: "C:\Users\user\AppData\Local\ea242c1c\tor\windowsconnect.exe" -f torrc MD5: 5CFE61FF895C7DAA889708665EF05D7B)

windowsconnect.exe (PID: 6152 cmdline: "C:\Users\user\AppData\Local\ea242c1c\tor\windowsconnect.exe" -f torrc MD5: 5CFE61FF895C7DAA889708665EF05D7B)

windowsconnect.exe (PID: 5504 cmdline: "C:\Users\user\AppData\Local\ea242c1c\tor\windowsconnect.exe" -f torrc MD5: 5CFE61FF895C7DAA889708665EF05D7B)

windowsconnect.exe (PID: 6432 cmdline: "C:\Users\user\AppData\Local\ea242c1c\tor\windowsconnect.exe" -f torrc MD5: 5CFE61FF895C7DAA889708665EF05D7B)

windowsconnect.exe (PID: 6304 cmdline: "C:\Users\user\AppData\Local\ea242c1c\tor\windowsconnect.exe" -f torrc MD5: 5CFE61FF895C7DAA889708665EF05D7B)

cleanup

Malware Configuration

Threatname: BitRat

{"Host": "coows4drmxtsbjfj47tkoiguo2lzozkvw3sd47tcyv2zsgk6ysrcprid.onion", "Port": "0", "Tor Port": "80", "Install Dir": "0", "Install File": "0", "Communication Password": "87eb85e211d7780d996d77e12a0ba96d", "Tor Process Name": "windowsconnect"}

Yara Overview

Initial Sample

Source	Rule	Description	Author	Strings
25hBQ7XDkh.exe	JoeSecurity_BitRAT	Yara detected BitRAT	Joe Security
25hBQ7XDkh.exe	MALWARE_Win_BitRAT	Detects BitRAT RAT	ditekSHen	0x33548c:$s1: \plg\ 0x3355f0:$s3: files_delete 0x334648:$s9: ddos_stop 0x33546c:$s10: socks5_srv_start 0x33562c:$s16: klg\| 0x3354dc:$s18: Bot ID: 0x335a80:$t1: <sz>N/A</sz> 0x335a90:$t2: <silent>N/A</silent>

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: 25hBQ7XDkh.exe PID: 796	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
Process Memory Space: 25hBQ7XDkh.exe PID: 796	JoeSecurity_BitRAT	Yara detected BitRAT	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
0.0.25hBQ7XDkh.exe.400000.0.unpack	JoeSecurity_BitRAT	Yara detected BitRAT	Joe Security
0.0.25hBQ7XDkh.exe.400000.0.unpack	MALWARE_Win_BitRAT	Detects BitRAT RAT	ditekSHen	0x33608c:$s1: \plg\ 0x3361f0:$s3: files_delete 0x335248:$s9: ddos_stop 0x33606c:$s10: socks5_srv_start 0x33622c:$s16: klg\| 0x3360dc:$s18: Bot ID: 0x336680:$t1: <sz>N/A</sz> 0x336690:$t2: <silent>N/A</silent>
0.2.25hBQ7XDkh.exe.400000.0.unpack	JoeSecurity_BitRAT	Yara detected BitRAT	Joe Security
0.2.25hBQ7XDkh.exe.400000.0.unpack	MALWARE_Win_BitRAT	Detects BitRAT RAT	ditekSHen	0x33608c:$s1: \plg\ 0x3361f0:$s3: files_delete 0x335248:$s9: ddos_stop 0x33606c:$s10: socks5_srv_start 0x33622c:$s16: klg\| 0x3360dc:$s18: Bot ID: 0x336680:$t1: <sz>N/A</sz> 0x336690:$t2: <silent>N/A</silent>

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 0.2.25hBQ7XDkh.exe.400000.0.unpack

Malware Configuration Extractor: BitRat {"Host": "coows4drmxtsbjfj47tkoiguo2lzozkvw3sd47tcyv2zsgk6ysrcprid.onion", "Port": "0", "Tor Port": "80", "Install Dir": "0", "Install File": "0", "Communication Password": "87eb85e211d7780d996d77e12a0ba96d", "Tor Process Name": "windowsconnect"}

Multi AV Scanner detection for submitted file

Source: 25hBQ7XDkh.exe	Virustotal: Detection: 66%	Perma Link
Source: 25hBQ7XDkh.exe	Metadefender: Detection: 51%	Perma Link
Source: 25hBQ7XDkh.exe	ReversingLabs: Detection: 72%

Antivirus / Scanner detection for submitted sample

Source: 25hBQ7XDkh.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\ea242c1c\tor\windowsconnect.exe

Avira: detection malicious, Label: TR/Redcap.cskpb

Machine Learning detection for sample

Source: 25hBQ7XDkh.exe

Joe Sandbox ML: detected

Source: 0.2.25hBQ7XDkh.exe.400000.0.unpack	Avira: Label: TR/Redcap.cskpb
Source: 0.0.25hBQ7XDkh.exe.400000.0.unpack	Avira: Label: TR/Redcap.cskpb

Source: 25hBQ7XDkh.exe, 00000000.00000000.662383319.00000000006DB000.00000002.00000001.01000000.00000003.sdmp

Binary or memory string: -----BEGIN PUBLIC KEY-----

Bitcoin Miner

Yara detected Xmrig cryptocurrency miner

Source: Yara match

File source: Process Memory Space: 25hBQ7XDkh.exe PID: 796, type: MEMORYSTR

Source: 25hBQ7XDkh.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, RELOCS_STRIPPED

Source: unknown

HTTPS traffic detected: 34.117.59.81:443 -> 192.168.2.4:49796 version: TLS 1.2

Networking

May check the online IP address of the machine

Source: C:\Users\user\Desktop\25hBQ7XDkh.exe

DNS query: name: myexternalip.com

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: coows4drmxtsbjfj47tkoiguo2lzozkvw3sd47tcyv2zsgk6ysrcprid.onion

Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49854 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443

Source: unknown	TCP traffic detected without corresponding DNS query: 199.249.230.64
Source: unknown	TCP traffic detected without corresponding DNS query: 199.249.230.64
Source: unknown	TCP traffic detected without corresponding DNS query: 199.249.230.64
Source: unknown	TCP traffic detected without corresponding DNS query: 199.249.230.64
Source: unknown	TCP traffic detected without corresponding DNS query: 199.249.230.64
Source: unknown	TCP traffic detected without corresponding DNS query: 199.249.230.64
Source: unknown	TCP traffic detected without corresponding DNS query: 199.249.230.64
Source: unknown	TCP traffic detected without corresponding DNS query: 62.141.38.69
Source: unknown	TCP traffic detected without corresponding DNS query: 62.141.38.69
Source: unknown	TCP traffic detected without corresponding DNS query: 62.141.38.69
Source: unknown	TCP traffic detected without corresponding DNS query: 62.141.38.69
Source: unknown	TCP traffic detected without corresponding DNS query: 62.141.38.69
Source: unknown	TCP traffic detected without corresponding DNS query: 185.225.17.3
Source: unknown	TCP traffic detected without corresponding DNS query: 185.225.17.3
Source: unknown	TCP traffic detected without corresponding DNS query: 185.225.17.3
Source: unknown	TCP traffic detected without corresponding DNS query: 50.7.74.170
Source: unknown	TCP traffic detected without corresponding DNS query: 50.7.74.170
Source: unknown	TCP traffic detected without corresponding DNS query: 50.7.74.170
Source: unknown	TCP traffic detected without corresponding DNS query: 199.249.230.64
Source: unknown	TCP traffic detected without corresponding DNS query: 50.7.74.170
Source: unknown	TCP traffic detected without corresponding DNS query: 185.225.17.3
Source: unknown	TCP traffic detected without corresponding DNS query: 199.249.230.83
Source: unknown	TCP traffic detected without corresponding DNS query: 199.249.230.83
Source: unknown	TCP traffic detected without corresponding DNS query: 199.249.230.83
Source: unknown	TCP traffic detected without corresponding DNS query: 185.13.39.197
Source: unknown	TCP traffic detected without corresponding DNS query: 185.13.39.197
Source: unknown	TCP traffic detected without corresponding DNS query: 185.13.39.197
Source: unknown	TCP traffic detected without corresponding DNS query: 199.249.230.83
Source: unknown	TCP traffic detected without corresponding DNS query: 199.249.230.83
Source: unknown	TCP traffic detected without corresponding DNS query: 199.249.230.83
Source: unknown	TCP traffic detected without corresponding DNS query: 199.249.230.83
Source: unknown	TCP traffic detected without corresponding DNS query: 81.7.16.182
Source: unknown	TCP traffic detected without corresponding DNS query: 81.7.16.182
Source: unknown	TCP traffic detected without corresponding DNS query: 81.7.16.182
Source: unknown	TCP traffic detected without corresponding DNS query: 81.7.16.182
Source: unknown	TCP traffic detected without corresponding DNS query: 81.7.16.182
Source: unknown	TCP traffic detected without corresponding DNS query: 81.7.16.182
Source: unknown	TCP traffic detected without corresponding DNS query: 81.7.16.182
Source: unknown	TCP traffic detected without corresponding DNS query: 50.7.74.174
Source: unknown	TCP traffic detected without corresponding DNS query: 50.7.74.174
Source: unknown	TCP traffic detected without corresponding DNS query: 86.59.21.38
Source: unknown	TCP traffic detected without corresponding DNS query: 86.59.21.38
Source: unknown	TCP traffic detected without corresponding DNS query: 50.7.74.174
Source: unknown	TCP traffic detected without corresponding DNS query: 86.59.21.38
Source: unknown	TCP traffic detected without corresponding DNS query: 86.59.21.38
Source: unknown	TCP traffic detected without corresponding DNS query: 86.59.21.38
Source: unknown	TCP traffic detected without corresponding DNS query: 86.59.21.38
Source: unknown	TCP traffic detected without corresponding DNS query: 86.59.21.38
Source: unknown	TCP traffic detected without corresponding DNS query: 199.249.230.83
Source: unknown	TCP traffic detected without corresponding DNS query: 50.7.74.174

Source: windowsconnect.exe, windowsconnect.exe, 0000000D.00000002.864215174.0000000000BD1000.00000040.00000001.01000000.00000004.sdmp	String found in binary or memory: www.google.com,www.mit.edu,www.yahoo.com,www.slashdot.org equals www.yahoo.com (Yahoo)
Source: windowsconnect.exe, 00000004.00000002.787266583.0000000002EC0000.00000004.00000800.00020000.00000000.sdmp, windowsconnect.exe, 0000000C.00000003.788159651.00000000036CB000.00000004.00000800.00020000.00000000.sdmp, windowsconnect.exe, 0000000C.00000003.788213659.00000000036CC000.00000004.00000800.00020000.00000000.sdmp, windowsconnect.exe, 0000000C.00000002.791379729.00000000036CC000.00000004.00000800.00020000.00000000.sdmp, windowsconnect.exe, 0000000C.00000003.787860127.00000000036C3000.00000004.00000800.00020000.00000000.sdmp, windowsconnect.exe, 0000000C.00000003.788103508.00000000036C6000.00000004.00000800.00020000.00000000.sdmp, windowsconnect.exe, 0000000C.00000003.788045630.00000000036C6000.00000004.00000800.00020000.00000000.sdmp, windowsconnect.exe, 00000011.00000003.867894842.000000000349B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: www.yahoo.com equals www.yahoo.com (Yahoo)

Source: 25hBQ7XDkh.exe, 00000000.00000002.932105143.0000000002BC0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://bot.whatismyipaddress.com
Source: 25hBQ7XDkh.exe, 00000000.00000003.802952428.00000000041FA000.00000004.00000800.00020000.00000000.sdmp, 25hBQ7XDkh.exe, 00000000.00000003.873134543.00000000041FC000.00000004.00000800.00020000.00000000.sdmp, 25hBQ7XDkh.exe, 00000000.00000003.863148111.00000000041FC000.00000004.00000001.00020000.00000000.sdmp, 25hBQ7XDkh.exe, 00000000.00000003.922302472.00000000041FC000.00000004.00000800.00020000.00000000.sdmp, 25hBQ7XDkh.exe, 00000000.00000002.932539381.00000000041FC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: windowsconnect.exe, windowsconnect.exe, 0000000D.00000002.864215174.0000000000BD1000.00000040.00000001.01000000.00000004.sdmp	String found in binary or memory: http://freehaven.net/anonbib/#hs-attack06
Source: 25hBQ7XDkh.exe, 00000000.00000002.932105143.0000000002BC0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ip.anysrc.net/plain/clientip
Source: 25hBQ7XDkh.exe, 00000000.00000002.932105143.0000000002BC0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ip.anysrc.net/plain/clientipiases
Source: 25hBQ7XDkh.exe, 00000000.00000003.675893017.0000000002BC1000.00000004.00000800.00020000.00000000.sdmp, 25hBQ7XDkh.exe, 00000000.00000003.675830288.0000000002BF0000.00000004.00000800.00020000.00000000.sdmp, 25hBQ7XDkh.exe, 00000000.00000000.662481108.00000000007A3000.00000002.00000001.01000000.00000003.sdmp, windowsconnect.exe, 00000004.00000002.787482411.000000006DDE6000.00000004.00000001.01000000.0000000A.sdmp, windowsconnect.exe, 0000000C.00000002.791555966.000000006DDE6000.00000004.00000001.01000000.0000000A.sdmp, windowsconnect.exe, 00000015.00000002.928336648.000000006D5C6000.00000004.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://mingw-w64.sourceforge.net/X
Source: 25hBQ7XDkh.exe, 00000000.00000002.932105143.0000000002BC0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tools.feron.it/php/ip.php
Source: 25hBQ7XDkh.exe, 00000000.00000003.677190872.0000000002BC1000.00000004.00000800.00020000.00000000.sdmp, 25hBQ7XDkh.exe, 00000000.00000000.662481108.00000000007A3000.00000002.00000001.01000000.00000003.sdmp, windowsconnect.exe, 00000004.00000002.790214953.000000006EB83000.00000004.00000001.01000000.0000000B.sdmp, windowsconnect.exe, 0000000C.00000002.792789313.000000006EB83000.00000004.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://www.zlib.net/D
Source: windowsconnect.exe, windowsconnect.exe, 0000000D.00000002.864215174.0000000000BD1000.00000040.00000001.01000000.00000004.sdmp	String found in binary or memory: https://blog.torproject.org/blog/lifecycle-of-a-new-relay
Source: windowsconnect.exe, 00000004.00000002.785855420.0000000000BD1000.00000040.00000001.01000000.00000004.sdmp, windowsconnect.exe, 0000000C.00000002.788401086.0000000000BD1000.00000040.00000001.01000000.00000004.sdmp, windowsconnect.exe, 0000000D.00000002.864215174.0000000000BD1000.00000040.00000001.01000000.00000004.sdmp	String found in binary or memory: https://blog.torproject.org/blog/lifecycle-of-a-new-relayCan
Source: 25hBQ7XDkh.exe, 00000000.00000000.662383319.00000000006DB000.00000002.00000001.01000000.00000003.sdmp, 25hBQ7XDkh.exe, 00000000.00000002.931184608.00000000006DB000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://curl.haxx.se/docs/http-cookies.html
Source: 25hBQ7XDkh.exe, 00000000.00000002.932105143.0000000002BC0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myexternalip.com/
Source: 25hBQ7XDkh.exe, 00000000.00000002.931770904.0000000000F0A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://myexternalip.com/raw
Source: windowsconnect.exe, windowsconnect.exe, 0000000D.00000002.864215174.0000000000BD1000.00000040.00000001.01000000.00000004.sdmp	String found in binary or memory: https://trac.torproject.org/8742
Source: windowsconnect.exe	String found in binary or memory: https://trac.torproject.org/proj
Source: windowsconnect.exe, 00000004.00000002.785855420.0000000000BD1000.00000040.00000001.01000000.00000004.sdmp, windowsconnect.exe, 0000000C.00000002.788401086.0000000000BD1000.00000040.00000001.01000000.00000004.sdmp, windowsconnect.exe, 0000000D.00000002.864215174.0000000000BD1000.00000040.00000001.01000000.00000004.sdmp	String found in binary or memory: https://trac.torproject.org/projects/tor/ticket/14917.
Source: windowsconnect.exe, windowsconnect.exe, 0000000D.00000002.864215174.0000000000BD1000.00000040.00000001.01000000.00000004.sdmp	String found in binary or memory: https://trac.torproject.org/projects/tor/ticket/21155.
Source: windowsconnect.exe	String found in binary or memory: https://wiki.torprojec
Source: windowsconnect.exe, 00000004.00000002.785855420.0000000000BD1000.00000040.00000001.01000000.00000004.sdmp, windowsconnect.exe, 0000000C.00000002.788401086.0000000000BD1000.00000040.00000001.01000000.00000004.sdmp, windowsconnect.exe, 0000000D.00000002.864215174.0000000000BD1000.00000040.00000001.01000000.00000004.sdmp	String found in binary or memory: https://wiki.torproject.org/TheOnionRouter/TorFAQ#SOCKSAndDNS.%s
Source: windowsconnect.exe, 00000004.00000002.785855420.0000000000BD1000.00000040.00000001.01000000.00000004.sdmp, windowsconnect.exe, 0000000C.00000002.788401086.0000000000BD1000.00000040.00000001.01000000.00000004.sdmp, windowsconnect.exe, 0000000D.00000002.864215174.0000000000BD1000.00000040.00000001.01000000.00000004.sdmp	String found in binary or memory: https://wiki.torproject.org/TheOnionRouter/TorFAQ#SOCKSAndDNS.%sDANGEROUS_SOCKS
Source: 25hBQ7XDkh.exe, 00000000.00000003.802952428.00000000041FA000.00000004.00000800.00020000.00000000.sdmp, 25hBQ7XDkh.exe, 00000000.00000003.873134543.00000000041FC000.00000004.00000800.00020000.00000000.sdmp, 25hBQ7XDkh.exe, 00000000.00000003.922574296.000000000420D000.00000004.00000800.00020000.00000000.sdmp, 25hBQ7XDkh.exe, 00000000.00000000.662481108.00000000007A3000.00000002.00000001.01000000.00000003.sdmp, 25hBQ7XDkh.exe, 00000000.00000003.922200584.0000000004172000.00000004.00000800.00020000.00000000.sdmp, 25hBQ7XDkh.exe, 00000000.00000003.873061121.0000000004172000.00000004.00000800.00020000.00000000.sdmp, 25hBQ7XDkh.exe, 00000000.00000003.674747006.0000000002BC1000.00000004.00000800.00020000.00000000.sdmp, 25hBQ7XDkh.exe, 00000000.00000003.784899897.0000000002BFC000.00000004.00000800.00020000.00000000.sdmp, 25hBQ7XDkh.exe, 00000000.00000003.863148111.00000000041FC000.00000004.00000001.00020000.00000000.sdmp, 25hBQ7XDkh.exe, 00000000.00000003.674640542.0000000002C2E000.00000004.00000800.00020000.00000000.sdmp, 25hBQ7XDkh.exe, 00000000.00000003.863909581.000000000420D000.00000004.00000800.00020000.00000000.sdmp, 25hBQ7XDkh.exe, 00000000.00000003.922302472.00000000041FC000.00000004.00000800.00020000.00000000.sdmp, 25hBQ7XDkh.exe, 00000000.00000003.803150206.0000000002BFC000.00000004.00000800.00020000.00000000.sdmp, 25hBQ7XDkh.exe, 00000000.00000003.804396742.000000000427B000.00000004.00000800.00020000.00000000.sdmp, 25hBQ7XDkh.exe, 00000000.00000003.804504656.000000000420D000.00000004.00000001.00020000.00000000.sdmp, 25hBQ7XDkh.exe, 00000000.00000003.863061739.0000000004172000.00000004.00000001.00020000.00000000.sdmp, 25hBQ7XDkh.exe, 00000000.00000003.802886046.0000000004179000.00000004.00000800.00020000.00000000.sdmp, windowsconnect.exe, 00000004.00000002.788323540.000000006E019000.00000004.00000001.01000000.00000007.sdmp, windowsconnect.exe, 00000004.00000002.789636645.000000006E39E000.00000004.00000001.01000000.00000005.sdmp, windowsconnect.exe, 0000000C.00000002.792076515.000000006E019000.00000004.00000001.01000000.00000007.sdmp, windowsconnect.exe, 0000000C.00000002.792612302.000000006E39E000.00000004.00000001.01000000.00000005.sdmp	String found in binary or memory: https://www.openssl.org/H
Source: windowsconnect.exe	String found in binary or memory: https://www.torproject.o
Source: windowsconnect.exe, 0000000D.00000002.864215174.0000000000BD1000.00000040.00000001.01000000.00000004.sdmp	String found in binary or memory: https://www.torproject.org/
Source: windowsconnect.exe, windowsconnect.exe, 0000000D.00000002.864215174.0000000000BD1000.00000040.00000001.01000000.00000004.sdmp	String found in binary or memory: https://www.torproject.org/docs/faq.html#BestOSForRelay
Source: windowsconnect.exe, 0000000D.00000002.864215174.0000000000BD1000.00000040.00000001.01000000.00000004.sdmp	String found in binary or memory: https://www.torproject.org/documentation.html
Source: windowsconnect.exe, windowsconnect.exe, 0000000D.00000002.864215174.0000000000BD1000.00000040.00000001.01000000.00000004.sdmp	String found in binary or memory: https://www.torproject.org/download/download#warning
Source: windowsconnect.exe, 00000004.00000002.785855420.0000000000BD1000.00000040.00000001.01000000.00000004.sdmp, windowsconnect.exe, 0000000C.00000002.788401086.0000000000BD1000.00000040.00000001.01000000.00000004.sdmp, windowsconnect.exe, 0000000D.00000002.864215174.0000000000BD1000.00000040.00000001.01000000.00000004.sdmp	String found in binary or memory: https://www.torproject.org/download/download#warningalphabetaThis

Source: unknown

DNS traffic detected: queries for: myexternalip.com

Source: global traffic

HTTP traffic detected: GET /raw HTTP/1.1User-Agent: CaRlRYX64HuI7K7sZXtCvMVCe8LGo1bPHost: myexternalip.comCache-Control: no-cache

Source: unknown

HTTPS traffic detected: 34.117.59.81:443 -> 192.168.2.4:49796 version: TLS 1.2

Source: 25hBQ7XDkh.exe, 00000000.00000002.931770904.0000000000F0A000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

Source: C:\Users\user\Desktop\25hBQ7XDkh.exe

Windows user hook set: 0 mouse low level NULL

Jump to behavior

System Summary

Malicious sample detected (through community Yara rule)

Source: 25hBQ7XDkh.exe, type: SAMPLE	Matched rule: Detects BitRAT RAT Author: ditekSHen
Source: 0.0.25hBQ7XDkh.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects BitRAT RAT Author: ditekSHen
Source: 0.2.25hBQ7XDkh.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects BitRAT RAT Author: ditekSHen

Source: 25hBQ7XDkh.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, RELOCS_STRIPPED

Source: 25hBQ7XDkh.exe, type: SAMPLE	Matched rule: MALWARE_Win_BitRAT author = ditekSHen, description = Detects BitRAT RAT, clamav_sig = MALWARE.Win.Trojan.BitRAT
Source: 0.0.25hBQ7XDkh.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_BitRAT author = ditekSHen, description = Detects BitRAT RAT, clamav_sig = MALWARE.Win.Trojan.BitRAT
Source: 0.2.25hBQ7XDkh.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_BitRAT author = ditekSHen, description = Detects BitRAT RAT, clamav_sig = MALWARE.Win.Trojan.BitRAT

Source: C:\Users\user\AppData\Local\ea242c1c\tor\windowsconnect.exe	Code function: 4_2_6DD68C00	4_2_6DD68C00
Source: C:\Users\user\AppData\Local\ea242c1c\tor\windowsconnect.exe	Code function: 12_2_6DE045C1	12_2_6DE045C1
Source: C:\Users\user\AppData\Local\ea242c1c\tor\windowsconnect.exe	Code function: 12_2_6DE00150	12_2_6DE00150
Source: C:\Users\user\AppData\Local\ea242c1c\tor\windowsconnect.exe	Code function: 12_2_6DDFC8E7	12_2_6DDFC8E7
Source: C:\Users\user\AppData\Local\ea242c1c\tor\windowsconnect.exe	Code function: 12_2_6DDFFCE0	12_2_6DDFFCE0
Source: C:\Users\user\AppData\Local\ea242c1c\tor\windowsconnect.exe	Code function: 12_2_6DDFF4E0	12_2_6DDFF4E0
Source: C:\Users\user\AppData\Local\ea242c1c\tor\windowsconnect.exe	Code function: 12_2_6DE01CB0	12_2_6DE01CB0
Source: C:\Users\user\AppData\Local\ea242c1c\tor\windowsconnect.exe	Code function: 12_2_6DDFD4A1	12_2_6DDFD4A1
Source: C:\Users\user\AppData\Local\ea242c1c\tor\windowsconnect.exe	Code function: 12_2_6DDF6870	12_2_6DDF6870
Source: C:\Users\user\AppData\Local\ea242c1c\tor\windowsconnect.exe	Code function: 12_2_6DE00C10	12_2_6DE00C10
Source: C:\Users\user\AppData\Local\ea242c1c\tor\windowsconnect.exe	Code function: 12_2_6DDFB420	12_2_6DDFB420
Source: C:\Users\user\AppData\Local\ea242c1c\tor\windowsconnect.exe	Code function: 12_2_6DDF6FC0	12_2_6DDF6FC0
Source: C:\Users\user\AppData\Local\ea242c1c\tor\windowsconnect.exe	Code function: 12_2_6DDFCBB3	12_2_6DDFCBB3
Source: C:\Users\user\AppData\Local\ea242c1c\tor\windowsconnect.exe	Code function: 12_2_6DDFFFA0	12_2_6DDFFFA0
Source: C:\Users\user\AppData\Local\ea242c1c\tor\windowsconnect.exe	Code function: 12_2_6DDF7F49	12_2_6DDF7F49
Source: C:\Users\user\AppData\Local\ea242c1c\tor\windowsconnect.exe	Code function: 12_2_6DDFC740	12_2_6DDFC740
Source: C:\Users\user\AppData\Local\ea242c1c\tor\windowsconnect.exe	Code function: 12_2_6DDF6B60	12_2_6DDF6B60
Source: C:\Users\user\AppData\Local\ea242c1c\tor\windowsconnect.exe	Code function: 12_2_6DDF9B06	12_2_6DDF9B06
Source: C:\Users\user\AppData\Local\ea242c1c\tor\windowsconnect.exe	Code function: 12_2_6DDF72C0	12_2_6DDF72C0
Source: C:\Users\user\AppData\Local\ea242c1c\tor\windowsconnect.exe	Code function: 12_2_6DDF7691	12_2_6DDF7691
Source: C:\Users\user\AppData\Local\ea242c1c\tor\windowsconnect.exe	Code function: 12_2_6DDFFA90	12_2_6DDFFA90
Source: C:\Users\user\AppData\Local\ea242c1c\tor\windowsconnect.exe	Code function: 12_2_6DDFF280	12_2_6DDFF280
Source: C:\Users\user\AppData\Local\ea242c1c\tor\windowsconnect.exe	Code function: 12_2_6DDF96A0	12_2_6DDF96A0
Source: C:\Users\user\AppData\Local\ea242c1c\tor\windowsconnect.exe	Code function: 12_2_6DDFB64C	12_2_6DDFB64C
Source: C:\Users\user\AppData\Local\ea242c1c\tor\windowsconnect.exe	Code function: 12_2_6DE00650	12_2_6DE00650
Source: C:\Users\user\AppData\Local\ea242c1c\tor\windowsconnect.exe	Code function: 13_2_6D512152	13_2_6D512152
Source: C:\Users\user\AppData\Local\ea242c1c\tor\windowsconnect.exe	Code function: 13_2_6D511D43	13_2_6D511D43
Source: C:\Users\user\AppData\Local\ea242c1c\tor\windowsconnect.exe	Code function: 13_2_6D511D30	13_2_6D511D30
Source: C:\Users\user\AppData\Local\ea242c1c\tor\windowsconnect.exe	Code function: 13_2_6D51B9C8	13_2_6D51B9C8
Source: C:\Users\user\AppData\Local\ea242c1c\tor\windowsconnect.exe	Code function: 13_2_6D51C75B	13_2_6D51C75B
Source: C:\Users\user\AppData\Local\ea242c1c\tor\windowsconnect.exe	Code function: 13_2_6D512F73	13_2_6D512F73
Source: C:\Users\user\AppData\Local\ea242c1c\tor\windowsconnect.exe	Code function: 13_2_6D51EB60	13_2_6D51EB60
Source: C:\Users\user\AppData\Local\ea242c1c\tor\windowsconnect.exe	Code function: 13_2_6D513A60	13_2_6D513A60
Source: C:\Users\user\AppData\Local\ea242c1c\tor\windowsconnect.exe	Code function: 13_2_6D519680	13_2_6D519680

Source: 25hBQ7XDkh.exe	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (console) Intel 80386, for MS Windows, UPX compressed
Source: 25hBQ7XDkh.exe	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Source: 25hBQ7XDkh.exe	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (console) Intel 80386, for MS Windows, UPX compressed
Source: 25hBQ7XDkh.exe	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (console) Intel 80386, for MS Windows, UPX compressed
Source: 25hBQ7XDkh.exe	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (console) Intel 80386, for MS Windows, UPX compressed
Source: 25hBQ7XDkh.exe	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (console) Intel 80386, for MS Windows, UPX compressed
Source: 25hBQ7XDkh.exe	Static PE information: Resource name: RT_RCDATA type: PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
Source: 25hBQ7XDkh.exe	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed

Source: 25hBQ7XDkh.exe, 00000000.00000003.802952428.00000000041FA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamelibsslH vs 25hBQ7XDkh.exe
Source: 25hBQ7XDkh.exe, 00000000.00000003.677190872.0000000002BC1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamezlib1.dll* vs 25hBQ7XDkh.exe
Source: 25hBQ7XDkh.exe, 00000000.00000003.873134543.00000000041FC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamelibsslH vs 25hBQ7XDkh.exe
Source: 25hBQ7XDkh.exe, 00000000.00000003.922574296.000000000420D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamelibsslH vs 25hBQ7XDkh.exe
Source: 25hBQ7XDkh.exe, 00000000.00000003.675893017.0000000002BC1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameWinPthreadGCp( vs 25hBQ7XDkh.exe
Source: 25hBQ7XDkh.exe, 00000000.00000003.675830288.0000000002BF0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameWinPthreadGCp( vs 25hBQ7XDkh.exe
Source: 25hBQ7XDkh.exe, 00000000.00000000.662481108.00000000007A3000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamelibcryptoH vs 25hBQ7XDkh.exe
Source: 25hBQ7XDkh.exe, 00000000.00000000.662481108.00000000007A3000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamelibsslH vs 25hBQ7XDkh.exe
Source: 25hBQ7XDkh.exe, 00000000.00000000.662481108.00000000007A3000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameWinPthreadGCp( vs 25hBQ7XDkh.exe
Source: 25hBQ7XDkh.exe, 00000000.00000000.662481108.00000000007A3000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamezlib1.dll* vs 25hBQ7XDkh.exe
Source: 25hBQ7XDkh.exe, 00000000.00000003.922200584.0000000004172000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamelibsslH vs 25hBQ7XDkh.exe
Source: 25hBQ7XDkh.exe, 00000000.00000003.873061121.0000000004172000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamelibsslH vs 25hBQ7XDkh.exe
Source: 25hBQ7XDkh.exe, 00000000.00000003.674747006.0000000002BC1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamelibsslH vs 25hBQ7XDkh.exe
Source: 25hBQ7XDkh.exe, 00000000.00000003.784899897.0000000002BFC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamelibsslH vs 25hBQ7XDkh.exe
Source: 25hBQ7XDkh.exe, 00000000.00000003.863148111.00000000041FC000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamelibsslH vs 25hBQ7XDkh.exe
Source: 25hBQ7XDkh.exe, 00000000.00000003.674640542.0000000002C2E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamelibsslH vs 25hBQ7XDkh.exe
Source: 25hBQ7XDkh.exe, 00000000.00000003.863909581.000000000420D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamelibsslH vs 25hBQ7XDkh.exe
Source: 25hBQ7XDkh.exe, 00000000.00000003.922302472.00000000041FC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamelibsslH vs 25hBQ7XDkh.exe
Source: 25hBQ7XDkh.exe, 00000000.00000003.803150206.0000000002BFC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamelibsslH vs 25hBQ7XDkh.exe
Source: 25hBQ7XDkh.exe, 00000000.00000003.804396742.000000000427B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamelibsslH vs 25hBQ7XDkh.exe
Source: 25hBQ7XDkh.exe, 00000000.00000003.804504656.000000000420D000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamelibsslH vs 25hBQ7XDkh.exe
Source: 25hBQ7XDkh.exe, 00000000.00000003.863061739.0000000004172000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamelibsslH vs 25hBQ7XDkh.exe
Source: 25hBQ7XDkh.exe, 00000000.00000003.802886046.0000000004179000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamelibsslH vs 25hBQ7XDkh.exe

Source: 25hBQ7XDkh.exe	Virustotal: Detection: 66%
Source: 25hBQ7XDkh.exe	Metadefender: Detection: 51%
Source: 25hBQ7XDkh.exe	ReversingLabs: Detection: 72%

Source: 25hBQ7XDkh.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\25hBQ7XDkh.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\25hBQ7XDkh.exe "C:\Users\user\Desktop\25hBQ7XDkh.exe"
Source: C:\Users\user\Desktop\25hBQ7XDkh.exe	Process created: C:\Users\user\AppData\Local\ea242c1c\tor\windowsconnect.exe "C:\Users\user\AppData\Local\ea242c1c\tor\windowsconnect.exe" -f torrc
Source: C:\Users\user\Desktop\25hBQ7XDkh.exe	Process created: C:\Users\user\AppData\Local\ea242c1c\tor\windowsconnect.exe "C:\Users\user\AppData\Local\ea242c1c\tor\windowsconnect.exe" -f torrc
Source: C:\Users\user\Desktop\25hBQ7XDkh.exe	Process created: C:\Users\user\AppData\Local\ea242c1c\tor\windowsconnect.exe "C:\Users\user\AppData\Local\ea242c1c\tor\windowsconnect.exe" -f torrc
Source: C:\Users\user\Desktop\25hBQ7XDkh.exe	Process created: C:\Users\user\AppData\Local\ea242c1c\tor\windowsconnect.exe "C:\Users\user\AppData\Local\ea242c1c\tor\windowsconnect.exe" -f torrc
Source: C:\Users\user\Desktop\25hBQ7XDkh.exe	Process created: C:\Users\user\AppData\Local\ea242c1c\tor\windowsconnect.exe "C:\Users\user\AppData\Local\ea242c1c\tor\windowsconnect.exe" -f torrc
Source: C:\Users\user\Desktop\25hBQ7XDkh.exe	Process created: C:\Users\user\AppData\Local\ea242c1c\tor\windowsconnect.exe "C:\Users\user\AppData\Local\ea242c1c\tor\windowsconnect.exe" -f torrc
Source: C:\Users\user\Desktop\25hBQ7XDkh.exe	Process created: C:\Users\user\AppData\Local\ea242c1c\tor\windowsconnect.exe "C:\Users\user\AppData\Local\ea242c1c\tor\windowsconnect.exe" -f torrc
Source: C:\Users\user\Desktop\25hBQ7XDkh.exe	Process created: C:\Users\user\AppData\Local\ea242c1c\tor\windowsconnect.exe "C:\Users\user\AppData\Local\ea242c1c\tor\windowsconnect.exe" -f torrc	Jump to behavior
Source: C:\Users\user\Desktop\25hBQ7XDkh.exe	Process created: C:\Users\user\AppData\Local\ea242c1c\tor\windowsconnect.exe "C:\Users\user\AppData\Local\ea242c1c\tor\windowsconnect.exe" -f torrc	Jump to behavior
Source: C:\Users\user\Desktop\25hBQ7XDkh.exe	Process created: C:\Users\user\AppData\Local\ea242c1c\tor\windowsconnect.exe "C:\Users\user\AppData\Local\ea242c1c\tor\windowsconnect.exe" -f torrc	Jump to behavior
Source: C:\Users\user\Desktop\25hBQ7XDkh.exe	Process created: C:\Users\user\AppData\Local\ea242c1c\tor\windowsconnect.exe "C:\Users\user\AppData\Local\ea242c1c\tor\windowsconnect.exe" -f torrc	Jump to behavior
Source: C:\Users\user\Desktop\25hBQ7XDkh.exe	Process created: C:\Users\user\AppData\Local\ea242c1c\tor\windowsconnect.exe "C:\Users\user\AppData\Local\ea242c1c\tor\windowsconnect.exe" -f torrc	Jump to behavior
Source: C:\Users\user\Desktop\25hBQ7XDkh.exe	Process created: C:\Users\user\AppData\Local\ea242c1c\tor\windowsconnect.exe "C:\Users\user\AppData\Local\ea242c1c\tor\windowsconnect.exe" -f torrc	Jump to behavior
Source: C:\Users\user\Desktop\25hBQ7XDkh.exe	Process created: C:\Users\user\AppData\Local\ea242c1c\tor\windowsconnect.exe "C:\Users\user\AppData\Local\ea242c1c\tor\windowsconnect.exe" -f torrc	Jump to behavior

Source: C:\Users\user\Desktop\25hBQ7XDkh.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E436EBB3-524F-11CE-9F53-0020AF0BA770}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\25hBQ7XDkh.exe

File created: C:\Users\user\AppData\Local\ea242c1c\

Jump to behavior

Source: classification engine

Classification label: mal100.troj.evad.mine.winEXE@15/13@1/14

Source: C:\Users\user\Desktop\25hBQ7XDkh.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\25hBQ7XDkh.exe

Mutant created: \Sessions\1\BaseNamedObjects\4aed7f11d798850139fd827897d52c89

Source: windowsconnect.exe	String found in binary or memory: ./src/lib/net/address.h
Source: windowsconnect.exe	String found in binary or memory: 333333?./src/lib/net/address.h
Source: windowsconnect.exe	String found in binary or memory: X-Your-Address-Is: %s
Source: windowsconnect.exe	String found in binary or memory: or-address
Source: windowsconnect.exe	String found in binary or memory: Malformed X-Your-Address-Is header %s. Ignoring.
Source: windowsconnect.exe	String found in binary or memory: Got X-Your-Address-Is: %s.
Source: windowsconnect.exe	String found in binary or memory: My or-address line is <%s>
Source: windowsconnect.exe	String found in binary or memory: or-address %s:%d
Source: windowsconnect.exe	String found in binary or memory: signed_body+(end-start_of_annotations) == router->cache_info.signed_descriptor_body+len
Source: windowsconnect.exe	String found in binary or memory: dir-address
Source: windowsconnect.exe	String found in binary or memory: Couldn't parse dir-address in certificate
Source: windowsconnect.exe	String found in binary or memory: Can't start/stop being a server while Sandbox is active
Source: windowsconnect.exe	String found in binary or memory: Can't start/stop being a server while Sandbox is active
Source: windowsconnect.exe	String found in binary or memory: src/feature/client/addressmap.c
Source: windowsconnect.exe	String found in binary or memory: X-Your-Address-Is:
Source: windowsconnect.exe	String found in binary or memory: accounting/interval-start
Source: windowsconnect.exe	String found in binary or memory: Configuration line does not consist of "onion-address authorization-cookie [service-name]": '%s'
Source: windowsconnect.exe	String found in binary or memory: --install
Source: windowsconnect.exe	String found in binary or memory: -install
Source: windowsconnect.exe	String found in binary or memory: introduction-point %s ip-address %s onion-port %d onion-key %sservice-key %s
Source: windowsconnect.exe	String found in binary or memory: src/feature/keymgt/loadkey.c
Source: windowsconnect.exe	String found in binary or memory: Attempt to connect to a .in-addr.arpa address "%s"; sending error.
Source: windowsconnect.exe	String found in binary or memory: Bad .in-addr.arpa address "%s"; sending error.
Source: windowsconnect.exe	String found in binary or memory: --help
Source: windowsconnect.exe	String found in binary or memory: --help
Source: windowsconnect.exe	String found in binary or memory: Somehow a malformed in-addr.arpa address reached here.
Source: windowsconnect.exe	String found in binary or memory: ip-address
Source: windowsconnect.exe	String found in binary or memory: ./src/lib/net/address.h
Source: windowsconnect.exe	String found in binary or memory: 333333?./src/lib/net/address.h
Source: windowsconnect.exe	String found in binary or memory: X-Your-Address-Is: %s
Source: windowsconnect.exe	String found in binary or memory: or-address
Source: windowsconnect.exe	String found in binary or memory: Malformed X-Your-Address-Is header %s. Ignoring.
Source: windowsconnect.exe	String found in binary or memory: Got X-Your-Address-Is: %s.
Source: windowsconnect.exe	String found in binary or memory: My or-address line is <%s>
Source: windowsconnect.exe	String found in binary or memory: or-address %s:%d
Source: windowsconnect.exe	String found in binary or memory: signed_body+(end-start_of_annotations) == router->cache_info.signed_descriptor_body+len
Source: windowsconnect.exe	String found in binary or memory: dir-address
Source: windowsconnect.exe	String found in binary or memory: Couldn't parse dir-address in certificate
Source: windowsconnect.exe	String found in binary or memory: Can't start/stop being a server while Sandbox is active
Source: windowsconnect.exe	String found in binary or memory: Can't start/stop being a server while Sandbox is active
Source: windowsconnect.exe	String found in binary or memory: src/feature/client/addressmap.c
Source: windowsconnect.exe	String found in binary or memory: X-Your-Address-Is:
Source: windowsconnect.exe	String found in binary or memory: accounting/interval-start
Source: windowsconnect.exe	String found in binary or memory: Configuration line does not consist of "onion-address authorization-cookie [service-name]": '%s'
Source: windowsconnect.exe	String found in binary or memory: --install
Source: windowsconnect.exe	String found in binary or memory: -install
Source: windowsconnect.exe	String found in binary or memory: introduction-point %s ip-address %s onion-port %d onion-key %sservice-key %s
Source: windowsconnect.exe	String found in binary or memory: src/feature/keymgt/loadkey.c
Source: windowsconnect.exe	String found in binary or memory: Attempt to connect to a .in-addr.arpa address "%s"; sending error.
Source: windowsconnect.exe	String found in binary or memory: Bad .in-addr.arpa address "%s"; sending error.
Source: windowsconnect.exe	String found in binary or memory: --help
Source: windowsconnect.exe	String found in binary or memory: --help
Source: windowsconnect.exe	String found in binary or memory: Somehow a malformed in-addr.arpa address reached here.
Source: windowsconnect.exe	String found in binary or memory: ip-address
Source: windowsconnect.exe	String found in binary or memory: ../../gcc-9.2.0/libgcc/soft-fp/addtf3.c
Source: windowsconnect.exe	String found in binary or memory: ./src/lib/net/address.h
Source: windowsconnect.exe	String found in binary or memory: 333333?./src/lib/net/address.h
Source: windowsconnect.exe	String found in binary or memory: X-Your-Address-Is: %s
Source: windowsconnect.exe	String found in binary or memory: or-address
Source: windowsconnect.exe	String found in binary or memory: Malformed X-Your-Address-Is header %s. Ignoring.
Source: windowsconnect.exe	String found in binary or memory: Got X-Your-Address-Is: %s.
Source: windowsconnect.exe	String found in binary or memory: My or-address line is <%s>
Source: windowsconnect.exe	String found in binary or memory: or-address %s:%d
Source: windowsconnect.exe	String found in binary or memory: signed_body+(end-start_of_annotations) == router->cache_info.signed_descriptor_body+len
Source: windowsconnect.exe	String found in binary or memory: dir-address
Source: windowsconnect.exe	String found in binary or memory: Couldn't parse dir-address in certificate
Source: windowsconnect.exe	String found in binary or memory: Can't start/stop being a server while Sandbox is active
Source: windowsconnect.exe	String found in binary or memory: Can't start/stop being a server while Sandbox is active
Source: windowsconnect.exe	String found in binary or memory: src/feature/client/addressmap.c
Source: windowsconnect.exe	String found in binary or memory: X-Your-Address-Is:
Source: windowsconnect.exe	String found in binary or memory: accounting/interval-start
Source: windowsconnect.exe	String found in binary or memory: Configuration line does not consist of "onion-address authorization-cookie [service-name]": '%s'
Source: windowsconnect.exe	String found in binary or memory: --install
Source: windowsconnect.exe	String found in binary or memory: -install
Source: windowsconnect.exe	String found in binary or memory: introduction-point %s ip-address %s onion-port %d onion-key %sservice-key %s
Source: windowsconnect.exe	String found in binary or memory: src/feature/keymgt/loadkey.c
Source: windowsconnect.exe	String found in binary or memory: Attempt to connect to a .in-addr.arpa address "%s"; sending error.
Source: windowsconnect.exe	String found in binary or memory: Bad .in-addr.arpa address "%s"; sending error.
Source: windowsconnect.exe	String found in binary or memory: --help
Source: windowsconnect.exe	String found in binary or memory: --help
Source: windowsconnect.exe	String found in binary or memory: Somehow a malformed in-addr.arpa address reached here.
Source: windowsconnect.exe	String found in binary or memory: ip-address

Source: C:\Users\user\Desktop\25hBQ7XDkh.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Users\user\Desktop\25hBQ7XDkh.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Source: 25hBQ7XDkh.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: 25hBQ7XDkh.exe

Static file information: File size 8151557 > 1048576

Source: 25hBQ7XDkh.exe	Static PE information: Raw size of .text is bigger than: 0x100000 < 0x2d9800
Source: 25hBQ7XDkh.exe	Static PE information: Raw size of .rsrc is bigger than: 0x100000 < 0x409e00

Source: 25hBQ7XDkh.exe

Static PE information: More than 200 imports for KERNEL32.DLL

Source: C:\Users\user\Desktop\25hBQ7XDkh.exe	Code function: 0_2_00687056 push ecx; ret	0_2_00687069
Source: C:\Users\user\AppData\Local\ea242c1c\tor\windowsconnect.exe	Code function: 4_2_6DD65AD0 push eax; mov dword ptr [esp], esi	4_2_6DD65B48
Source: C:\Users\user\AppData\Local\ea242c1c\tor\windowsconnect.exe	Code function: 4_2_6DD68A5A push dword ptr [eax+04h]; ret	4_2_6DD68A89
Source: C:\Users\user\AppData\Local\ea242c1c\tor\windowsconnect.exe	Code function: 12_2_6DDF1440 push dword ptr [eax+04h]; ret	12_2_6DDF146F
Source: C:\Users\user\AppData\Local\ea242c1c\tor\windowsconnect.exe	Code function: 13_2_6D52517C push cs; iretd	13_2_6D525252
Source: C:\Users\user\AppData\Local\ea242c1c\tor\windowsconnect.exe	Code function: 13_2_6D52542E push ebx; ret	13_2_6D52542F
Source: C:\Users\user\AppData\Local\ea242c1c\tor\windowsconnect.exe	Code function: 13_2_6D53136E push eax; ret	13_2_6D53139A
Source: C:\Users\user\AppData\Local\ea242c1c\tor\windowsconnect.exe	Code function: 13_2_6D52527E push cs; iretd	13_2_6D525252

Source: windowsconnect.exe.0.dr	Static PE information: section name: UPX2
Source: libevent-2-1-6.dll.0.dr	Static PE information: section name: UPX2
Source: libgcc_s_sjlj-1.dll.0.dr	Static PE information: section name: UPX2
Source: libssp-0.dll.0.dr	Static PE information: section name: UPX2

Source: C:\Users\user\AppData\Local\ea242c1c\tor\windowsconnect.exe

Code function: 12_2_6DEF8CA0 EntryPoint,LoadLibraryA,GetProcAddress,VirtualProtect,VirtualProtect,VirtualProtect,

12_2_6DEF8CA0

Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1

Source: C:\Users\user\Desktop\25hBQ7XDkh.exe	File created: C:\Users\user\AppData\Local\ea242c1c\tor\zlib1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\25hBQ7XDkh.exe	File created: C:\Users\user\AppData\Local\ea242c1c\tor\libevent-2-1-6.dll	Jump to dropped file
Source: C:\Users\user\Desktop\25hBQ7XDkh.exe	File created: C:\Users\user\AppData\Local\ea242c1c\tor\libssl-1_1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\25hBQ7XDkh.exe	File created: C:\Users\user\AppData\Local\ea242c1c\tor\windowsconnect.exe	Jump to dropped file
Source: C:\Users\user\Desktop\25hBQ7XDkh.exe	File created: C:\Users\user\AppData\Local\ea242c1c\tor\libwinpthread-1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\25hBQ7XDkh.exe	File created: C:\Users\user\AppData\Local\ea242c1c\tor\libcrypto-1_1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\25hBQ7XDkh.exe	File created: C:\Users\user\AppData\Local\ea242c1c\tor\libgcc_s_sjlj-1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\25hBQ7XDkh.exe	File created: C:\Users\user\AppData\Local\ea242c1c\tor\libssp-0.dll	Jump to dropped file

Hooking and other Techniques for Hiding and Protection

May use the Tor software to hide its network traffic

Source: windowsconnect.exe, windowsconnect.exe, 0000000D.00000002.864215174.0000000000BD1000.00000040.00000001.01000000.00000004.sdmp

Binary or memory string: onion-port

Source: C:\Users\user\Desktop\25hBQ7XDkh.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Jump to behavior

Source: C:\Users\user\Desktop\25hBQ7XDkh.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Source: C:\Users\user\Desktop\25hBQ7XDkh.exe TID: 1072	Thread sleep count: 31 > 30	Jump to behavior
Source: C:\Users\user\Desktop\25hBQ7XDkh.exe TID: 6384	Thread sleep count: 4073 > 30	Jump to behavior
Source: C:\Users\user\Desktop\25hBQ7XDkh.exe TID: 6384	Thread sleep time: -40730s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\25hBQ7XDkh.exe TID: 1072	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Users\user\AppData\Local\ea242c1c\tor\windowsconnect.exe

Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes

graph_4-5151

Source: C:\Users\user\Desktop\25hBQ7XDkh.exe

Thread sleep count: Count: 4073 delay: -10

Jump to behavior

Source: C:\Users\user\Desktop\25hBQ7XDkh.exe	Last function: Thread delayed
Source: C:\Users\user\Desktop\25hBQ7XDkh.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\25hBQ7XDkh.exe

Window / User API: threadDelayed 4073

Jump to behavior

Source: C:\Users\user\AppData\Local\ea242c1c\tor\windowsconnect.exe	API coverage: 0.1 %
Source: C:\Users\user\AppData\Local\ea242c1c\tor\windowsconnect.exe	API coverage: 0.4 %
Source: C:\Users\user\AppData\Local\ea242c1c\tor\windowsconnect.exe	API coverage: 0.2 %

Source: 25hBQ7XDkh.exe, 00000000.00000002.932508923.0000000004162000.00000004.00000001.00020000.00000000.sdmp, 25hBQ7XDkh.exe, 00000000.00000002.931770904.0000000000F0A000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\25hBQ7XDkh.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\25hBQ7XDkh.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\25hBQ7XDkh.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\25hBQ7XDkh.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\25hBQ7XDkh.exe	Thread information set: HideFromDebugger	Jump to behavior

Found API chain indicative of debugger detection

Source: C:\Users\user\AppData\Local\ea242c1c\tor\windowsconnect.exe

Debugger detection routine: QueryPerformanceCounter, DebugActiveProcess, DecisionNodes, ExitProcess or Sleep

graph_4-4898

Source: C:\Users\user\Desktop\25hBQ7XDkh.exe

Code function: 0_2_00690682 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00690682

Source: C:\Users\user\AppData\Local\ea242c1c\tor\windowsconnect.exe

Code function: 12_2_6DEF8CA0 EntryPoint,LoadLibraryA,GetProcAddress,VirtualProtect,VirtualProtect,VirtualProtect,

12_2_6DEF8CA0

Source: C:\Users\user\Desktop\25hBQ7XDkh.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\25hBQ7XDkh.exe

Code function: 0_2_006A043C mov eax, dword ptr fs:[00000030h]

0_2_006A043C

Source: C:\Users\user\Desktop\25hBQ7XDkh.exe	Code function: 0_2_006863BA SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_006863BA
Source: C:\Users\user\Desktop\25hBQ7XDkh.exe	Code function: 0_2_00690682 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00690682
Source: C:\Users\user\AppData\Local\ea242c1c\tor\windowsconnect.exe	Code function: 4_2_6DD64D60 TlsGetValue,CloseHandle,CloseHandle,CloseHandle,pthread_mutex_destroy,TlsSetValue,RtlRemoveVectoredExceptionHandler,RtlAddVectoredExceptionHandler,CloseHandle,CloseHandle,pthread_mutex_destroy,CloseHandle,pthread_mutex_destroy,pthread_mutex_destroy,	4_2_6DD64D60
Source: C:\Users\user\AppData\Local\ea242c1c\tor\windowsconnect.exe	Code function: 4_2_6DD67E5C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,abort,	4_2_6DD67E5C
Source: C:\Users\user\AppData\Local\ea242c1c\tor\windowsconnect.exe	Code function: 4_2_6DD67E60 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,abort,	4_2_6DD67E60
Source: C:\Users\user\AppData\Local\ea242c1c\tor\windowsconnect.exe	Code function: 4_2_6DD64E68 RtlAddVectoredExceptionHandler,	4_2_6DD64E68
Source: C:\Users\user\AppData\Local\ea242c1c\tor\windowsconnect.exe	Code function: 12_2_6DE0354C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,abort,	12_2_6DE0354C
Source: C:\Users\user\AppData\Local\ea242c1c\tor\windowsconnect.exe	Code function: 12_2_6DE03550 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,abort,	12_2_6DE03550
Source: C:\Users\user\AppData\Local\ea242c1c\tor\windowsconnect.exe	Code function: 13_2_6D521F90 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,abort,	13_2_6D521F90
Source: C:\Users\user\AppData\Local\ea242c1c\tor\windowsconnect.exe	Code function: 13_2_6D521F8C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,abort,	13_2_6D521F8C

Source: C:\Users\user\Desktop\25hBQ7XDkh.exe	Process created: C:\Users\user\AppData\Local\ea242c1c\tor\windowsconnect.exe "C:\Users\user\AppData\Local\ea242c1c\tor\windowsconnect.exe" -f torrc	Jump to behavior
Source: C:\Users\user\Desktop\25hBQ7XDkh.exe	Process created: C:\Users\user\AppData\Local\ea242c1c\tor\windowsconnect.exe "C:\Users\user\AppData\Local\ea242c1c\tor\windowsconnect.exe" -f torrc	Jump to behavior
Source: C:\Users\user\Desktop\25hBQ7XDkh.exe	Process created: C:\Users\user\AppData\Local\ea242c1c\tor\windowsconnect.exe "C:\Users\user\AppData\Local\ea242c1c\tor\windowsconnect.exe" -f torrc	Jump to behavior
Source: C:\Users\user\Desktop\25hBQ7XDkh.exe	Process created: C:\Users\user\AppData\Local\ea242c1c\tor\windowsconnect.exe "C:\Users\user\AppData\Local\ea242c1c\tor\windowsconnect.exe" -f torrc	Jump to behavior
Source: C:\Users\user\Desktop\25hBQ7XDkh.exe	Process created: C:\Users\user\AppData\Local\ea242c1c\tor\windowsconnect.exe "C:\Users\user\AppData\Local\ea242c1c\tor\windowsconnect.exe" -f torrc	Jump to behavior
Source: C:\Users\user\Desktop\25hBQ7XDkh.exe	Process created: C:\Users\user\AppData\Local\ea242c1c\tor\windowsconnect.exe "C:\Users\user\AppData\Local\ea242c1c\tor\windowsconnect.exe" -f torrc	Jump to behavior
Source: C:\Users\user\Desktop\25hBQ7XDkh.exe	Process created: C:\Users\user\AppData\Local\ea242c1c\tor\windowsconnect.exe "C:\Users\user\AppData\Local\ea242c1c\tor\windowsconnect.exe" -f torrc	Jump to behavior

Source: 25hBQ7XDkh.exe, 00000000.00000003.802952428.00000000041FA000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: Program Manager

Source: C:\Users\user\AppData\Local\ea242c1c\tor\windowsconnect.exe	Queries volume information: C:\Users\user\AppData\Local\ea242c1c\tor\torrc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\ea242c1c\tor\windowsconnect.exe	Queries volume information: C:\Users\user\AppData\Local\ea242c1c\tor\torrc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\ea242c1c\tor\windowsconnect.exe	Queries volume information: C:\Users\user\AppData\Local\ea242c1c\tor\torrc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\ea242c1c\tor\windowsconnect.exe	Queries volume information: C:\Users\user\AppData\Local\ea242c1c\tor\data\state VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\ea242c1c\tor\windowsconnect.exe	Queries volume information: C:\Users\user\AppData\Local\ea242c1c\tor\torrc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\ea242c1c\tor\windowsconnect.exe	Queries volume information: C:\Users\user\AppData\Local\ea242c1c\tor\torrc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\ea242c1c\tor\windowsconnect.exe	Queries volume information: C:\Users\user\AppData\Local\ea242c1c\tor\torrc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\ea242c1c\tor\windowsconnect.exe	Queries volume information: C:\Users\user\AppData\Local\ea242c1c\tor\data\state VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\ea242c1c\tor\windowsconnect.exe	Queries volume information: C:\Users\user\AppData\Local\ea242c1c\tor\torrc VolumeInformation	Jump to behavior

Source: C:\Users\user\AppData\Local\ea242c1c\tor\windowsconnect.exe

Code function: 12_2_6DDF18D0 cpuid

12_2_6DDF18D0

Source: C:\Users\user\AppData\Local\ea242c1c\tor\windowsconnect.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\user\Desktop\25hBQ7XDkh.exe

Code function: 0_2_00687385 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00687385

Stealing of Sensitive Information

Yara detected BitRAT

Source: Yara match	File source: 25hBQ7XDkh.exe, type: SAMPLE
Source: Yara match	File source: 0.0.25hBQ7XDkh.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.25hBQ7XDkh.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: Process Memory Space: 25hBQ7XDkh.exe PID: 796, type: MEMORYSTR

Remote Access Functionality

Yara detected BitRAT

Source: Yara match	File source: 25hBQ7XDkh.exe, type: SAMPLE
Source: Yara match	File source: 0.0.25hBQ7XDkh.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.25hBQ7XDkh.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: Process Memory Space: 25hBQ7XDkh.exe PID: 796, type: MEMORYSTR

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	2 Command and Scripting Interpreter	Path Interception	12 Process Injection	1 Masquerading	2 Input Capture	1 System Time Discovery	Remote Services	2 Input Capture	Exfiltration Over Other Network Medium	11 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	2 Native API	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	22 Virtualization/Sandbox Evasion	LSASS Memory	1 Query Registry	Remote Desktop Protocol	11 Archive Collected Data	Exfiltration Over Bluetooth	1 Ingress Tool Transfer	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	12 Process Injection	Security Account Manager	211 Security Software Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	1 Multi-hop Proxy	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	11 Obfuscated Files or Information	NTDS	22 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	Scheduled Transfer	2 Non-Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	11 Software Packing	LSA Secrets	1 Process Discovery	SSH	Keylogging	Data Transfer Size Limits	13 Application Layer Protocol	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Steganography	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	1 Proxy	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Compile After Delivery	DCSync	1 Remote System Discovery	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	1 System Network Configuration Discovery	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	Masquerading	/etc/passwd and /etc/shadow	1 File and Directory Discovery	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction
Supply Chain Compromise	AppleScript	At (Windows)	At (Windows)	Invalid Code Signature	Network Sniffing	23 System Information Discovery	Taint Shared Content	Local Data Staging	Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	File Transfer Protocols			Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
25hBQ7XDkh.exe	67%	Virustotal		Browse
25hBQ7XDkh.exe	51%	Metadefender		Browse
25hBQ7XDkh.exe	72%	ReversingLabs	Win32.Trojan.Graftor
25hBQ7XDkh.exe	100%	Avira	TR/Redcap.cskpb
25hBQ7XDkh.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\ea242c1c\tor\windowsconnect.exe	100%	Avira	TR/Redcap.cskpb
C:\Users\user\AppData\Local\ea242c1c\tor\libcrypto-1_1.dll	0%	Metadefender		Browse
C:\Users\user\AppData\Local\ea242c1c\tor\libcrypto-1_1.dll	4%	ReversingLabs
C:\Users\user\AppData\Local\ea242c1c\tor\libevent-2-1-6.dll	3%	Metadefender		Browse
C:\Users\user\AppData\Local\ea242c1c\tor\libevent-2-1-6.dll	7%	ReversingLabs
C:\Users\user\AppData\Local\ea242c1c\tor\libgcc_s_sjlj-1.dll	0%	Metadefender		Browse
C:\Users\user\AppData\Local\ea242c1c\tor\libgcc_s_sjlj-1.dll	4%	ReversingLabs
C:\Users\user\AppData\Local\ea242c1c\tor\libssl-1_1.dll	0%	Metadefender		Browse
C:\Users\user\AppData\Local\ea242c1c\tor\libssl-1_1.dll	7%	ReversingLabs
C:\Users\user\AppData\Local\ea242c1c\tor\libssp-0.dll	0%	Metadefender		Browse
C:\Users\user\AppData\Local\ea242c1c\tor\libssp-0.dll	3%	ReversingLabs
C:\Users\user\AppData\Local\ea242c1c\tor\libwinpthread-1.dll	0%	Metadefender		Browse
C:\Users\user\AppData\Local\ea242c1c\tor\libwinpthread-1.dll	4%	ReversingLabs

Unpacked PE Files

Source	Detection	Scanner	Label	Download
14.2.windowsconnect.exe.6d800000.6.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
17.2.windowsconnect.exe.bd0000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
14.2.windowsconnect.exe.6d5d0000.3.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
0.2.25hBQ7XDkh.exe.400000.0.unpack	100%	Avira	TR/Redcap.cskpb	Download File
4.2.windowsconnect.exe.6ddf0000.2.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
21.2.windowsconnect.exe.bd0000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
21.2.windowsconnect.exe.6d6e0000.4.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
19.2.windowsconnect.exe.6d5d0000.3.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
12.2.windowsconnect.exe.bd0000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
0.0.25hBQ7XDkh.exe.400000.0.unpack	100%	Avira	TR/Redcap.cskpb	Download File
4.2.windowsconnect.exe.bd0000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
4.2.windowsconnect.exe.6e020000.5.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
21.2.windowsconnect.exe.6d5d0000.3.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
14.2.windowsconnect.exe.bd0000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
21.2.windowsconnect.exe.6d800000.6.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
14.2.windowsconnect.exe.6d6e0000.4.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
13.2.windowsconnect.exe.6d6e0000.4.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
17.2.windowsconnect.exe.6d800000.6.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
13.2.windowsconnect.exe.6d5d0000.3.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
13.2.windowsconnect.exe.bd0000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
12.2.windowsconnect.exe.6ddf0000.2.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
4.2.windowsconnect.exe.6df00000.3.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
19.2.windowsconnect.exe.6d800000.6.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
13.2.windowsconnect.exe.6d800000.6.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
19.2.windowsconnect.exe.bd0000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
12.2.windowsconnect.exe.6df00000.3.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
12.2.windowsconnect.exe.6e020000.5.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
19.2.windowsconnect.exe.6d6e0000.4.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
17.2.windowsconnect.exe.6d6e0000.4.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
17.2.windowsconnect.exe.6d5d0000.3.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
http://ip.anysrc.net/plain/clientipiases	0%	Avira URL Cloud	safe
https://wiki.torprojec	0%	Avira URL Cloud	safe
http://freehaven.net/anonbib/#hs-attack06	0%	URL Reputation	safe
http://tools.feron.it/php/ip.php	4%	Virustotal		Browse
http://tools.feron.it/php/ip.php	0%	Avira URL Cloud	safe
http://ip.anysrc.net/plain/clientip	3%	Virustotal		Browse
http://ip.anysrc.net/plain/clientip	0%	Avira URL Cloud	safe
https://www.torproject.o	0%	Avira URL Cloud	safe
coows4drmxtsbjfj47tkoiguo2lzozkvw3sd47tcyv2zsgk6ysrcprid.onion	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
myexternalip.com	34.117.59.81	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://myexternalip.com/raw	false		high
coows4drmxtsbjfj47tkoiguo2lzozkvw3sd47tcyv2zsgk6ysrcprid.onion	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://ip.anysrc.net/plain/clientipiases	25hBQ7XDkh.exe, 00000000.00000002.932105143.0000000002BC0000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://wiki.torproject.org/TheOnionRouter/TorFAQ#SOCKSAndDNS.%s	windowsconnect.exe, 00000004.00000002.785855420.0000000000BD1000.00000040.00000001.01000000.00000004.sdmp, windowsconnect.exe, 0000000C.00000002.788401086.0000000000BD1000.00000040.00000001.01000000.00000004.sdmp, windowsconnect.exe, 0000000D.00000002.864215174.0000000000BD1000.00000040.00000001.01000000.00000004.sdmp	false		high
https://wiki.torprojec	windowsconnect.exe	false	Avira URL Cloud: safe	unknown
https://www.torproject.org/	windowsconnect.exe, 0000000D.00000002.864215174.0000000000BD1000.00000040.00000001.01000000.00000004.sdmp	false		high
https://trac.torproject.org/8742	windowsconnect.exe, windowsconnect.exe, 0000000D.00000002.864215174.0000000000BD1000.00000040.00000001.01000000.00000004.sdmp	false		high
http://freehaven.net/anonbib/#hs-attack06	windowsconnect.exe, windowsconnect.exe, 0000000D.00000002.864215174.0000000000BD1000.00000040.00000001.01000000.00000004.sdmp	false	URL Reputation: safe	unknown
https://curl.haxx.se/docs/http-cookies.html	25hBQ7XDkh.exe, 00000000.00000000.662383319.00000000006DB000.00000002.00000001.01000000.00000003.sdmp, 25hBQ7XDkh.exe, 00000000.00000002.931184608.00000000006DB000.00000002.00000001.01000000.00000003.sdmp	false		high
https://blog.torproject.org/blog/lifecycle-of-a-new-relay	windowsconnect.exe, windowsconnect.exe, 0000000D.00000002.864215174.0000000000BD1000.00000040.00000001.01000000.00000004.sdmp	false		high
https://www.torproject.org/download/download#warningalphabetaThis	windowsconnect.exe, 00000004.00000002.785855420.0000000000BD1000.00000040.00000001.01000000.00000004.sdmp, windowsconnect.exe, 0000000C.00000002.788401086.0000000000BD1000.00000040.00000001.01000000.00000004.sdmp, windowsconnect.exe, 0000000D.00000002.864215174.0000000000BD1000.00000040.00000001.01000000.00000004.sdmp	false		high
http://mingw-w64.sourceforge.net/X	25hBQ7XDkh.exe, 00000000.00000003.675893017.0000000002BC1000.00000004.00000800.00020000.00000000.sdmp, 25hBQ7XDkh.exe, 00000000.00000003.675830288.0000000002BF0000.00000004.00000800.00020000.00000000.sdmp, 25hBQ7XDkh.exe, 00000000.00000000.662481108.00000000007A3000.00000002.00000001.01000000.00000003.sdmp, windowsconnect.exe, 00000004.00000002.787482411.000000006DDE6000.00000004.00000001.01000000.0000000A.sdmp, windowsconnect.exe, 0000000C.00000002.791555966.000000006DDE6000.00000004.00000001.01000000.0000000A.sdmp, windowsconnect.exe, 00000015.00000002.928336648.000000006D5C6000.00000004.00000001.01000000.0000000A.sdmp	false		high
http://www.zlib.net/D	25hBQ7XDkh.exe, 00000000.00000003.677190872.0000000002BC1000.00000004.00000800.00020000.00000000.sdmp, 25hBQ7XDkh.exe, 00000000.00000000.662481108.00000000007A3000.00000002.00000001.01000000.00000003.sdmp, windowsconnect.exe, 00000004.00000002.790214953.000000006EB83000.00000004.00000001.01000000.0000000B.sdmp, windowsconnect.exe, 0000000C.00000002.792789313.000000006EB83000.00000004.00000001.01000000.0000000B.sdmp	false		high
https://blog.torproject.org/blog/lifecycle-of-a-new-relayCan	windowsconnect.exe, 00000004.00000002.785855420.0000000000BD1000.00000040.00000001.01000000.00000004.sdmp, windowsconnect.exe, 0000000C.00000002.788401086.0000000000BD1000.00000040.00000001.01000000.00000004.sdmp, windowsconnect.exe, 0000000D.00000002.864215174.0000000000BD1000.00000040.00000001.01000000.00000004.sdmp	false		high
https://trac.torproject.org/proj	windowsconnect.exe	false		high
https://wiki.torproject.org/TheOnionRouter/TorFAQ#SOCKSAndDNS.%sDANGEROUS_SOCKS	windowsconnect.exe, 00000004.00000002.785855420.0000000000BD1000.00000040.00000001.01000000.00000004.sdmp, windowsconnect.exe, 0000000C.00000002.788401086.0000000000BD1000.00000040.00000001.01000000.00000004.sdmp, windowsconnect.exe, 0000000D.00000002.864215174.0000000000BD1000.00000040.00000001.01000000.00000004.sdmp	false		high
https://www.torproject.org/documentation.html	windowsconnect.exe, 0000000D.00000002.864215174.0000000000BD1000.00000040.00000001.01000000.00000004.sdmp	false		high
http://tools.feron.it/php/ip.php	25hBQ7XDkh.exe, 00000000.00000002.932105143.0000000002BC0000.00000004.00000800.00020000.00000000.sdmp	false	4%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.openssl.org/H	25hBQ7XDkh.exe, 00000000.00000003.802952428.00000000041FA000.00000004.00000800.00020000.00000000.sdmp, 25hBQ7XDkh.exe, 00000000.00000003.873134543.00000000041FC000.00000004.00000800.00020000.00000000.sdmp, 25hBQ7XDkh.exe, 00000000.00000003.922574296.000000000420D000.00000004.00000800.00020000.00000000.sdmp, 25hBQ7XDkh.exe, 00000000.00000000.662481108.00000000007A3000.00000002.00000001.01000000.00000003.sdmp, 25hBQ7XDkh.exe, 00000000.00000003.922200584.0000000004172000.00000004.00000800.00020000.00000000.sdmp, 25hBQ7XDkh.exe, 00000000.00000003.873061121.0000000004172000.00000004.00000800.00020000.00000000.sdmp, 25hBQ7XDkh.exe, 00000000.00000003.674747006.0000000002BC1000.00000004.00000800.00020000.00000000.sdmp, 25hBQ7XDkh.exe, 00000000.00000003.784899897.0000000002BFC000.00000004.00000800.00020000.00000000.sdmp, 25hBQ7XDkh.exe, 00000000.00000003.863148111.00000000041FC000.00000004.00000001.00020000.00000000.sdmp, 25hBQ7XDkh.exe, 00000000.00000003.674640542.0000000002C2E000.00000004.00000800.00020000.00000000.sdmp, 25hBQ7XDkh.exe, 00000000.00000003.863909581.000000000420D000.00000004.00000800.00020000.00000000.sdmp, 25hBQ7XDkh.exe, 00000000.00000003.922302472.00000000041FC000.00000004.00000800.00020000.00000000.sdmp, 25hBQ7XDkh.exe, 00000000.00000003.803150206.0000000002BFC000.00000004.00000800.00020000.00000000.sdmp, 25hBQ7XDkh.exe, 00000000.00000003.804396742.000000000427B000.00000004.00000800.00020000.00000000.sdmp, 25hBQ7XDkh.exe, 00000000.00000003.804504656.000000000420D000.00000004.00000001.00020000.00000000.sdmp, 25hBQ7XDkh.exe, 00000000.00000003.863061739.0000000004172000.00000004.00000001.00020000.00000000.sdmp, 25hBQ7XDkh.exe, 00000000.00000003.802886046.0000000004179000.00000004.00000800.00020000.00000000.sdmp, windowsconnect.exe, 00000004.00000002.788323540.000000006E019000.00000004.00000001.01000000.00000007.sdmp, windowsconnect.exe, 00000004.00000002.789636645.000000006E39E000.00000004.00000001.01000000.00000005.sdmp, windowsconnect.exe, 0000000C.00000002.792076515.000000006E019000.00000004.00000001.01000000.00000007.sdmp, windowsconnect.exe, 0000000C.00000002.792612302.000000006E39E000.00000004.00000001.01000000.00000005.sdmp	false		high
https://trac.torproject.org/projects/tor/ticket/21155.	windowsconnect.exe, windowsconnect.exe, 0000000D.00000002.864215174.0000000000BD1000.00000040.00000001.01000000.00000004.sdmp	false		high
http://ip.anysrc.net/plain/clientip	25hBQ7XDkh.exe, 00000000.00000002.932105143.0000000002BC0000.00000004.00000800.00020000.00000000.sdmp	false	3%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.torproject.org/download/download#warning	windowsconnect.exe, windowsconnect.exe, 0000000D.00000002.864215174.0000000000BD1000.00000040.00000001.01000000.00000004.sdmp	false		high
http://bot.whatismyipaddress.com	25hBQ7XDkh.exe, 00000000.00000002.932105143.0000000002BC0000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.torproject.o	windowsconnect.exe	false	Avira URL Cloud: safe	unknown
https://myexternalip.com/	25hBQ7XDkh.exe, 00000000.00000002.932105143.0000000002BC0000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.torproject.org/docs/faq.html#BestOSForRelay	windowsconnect.exe, windowsconnect.exe, 0000000D.00000002.864215174.0000000000BD1000.00000040.00000001.01000000.00000004.sdmp	false		high
https://trac.torproject.org/projects/tor/ticket/14917.	windowsconnect.exe, 00000004.00000002.785855420.0000000000BD1000.00000040.00000001.01000000.00000004.sdmp, windowsconnect.exe, 0000000C.00000002.788401086.0000000000BD1000.00000040.00000001.01000000.00000004.sdmp, windowsconnect.exe, 0000000D.00000002.864215174.0000000000BD1000.00000040.00000001.01000000.00000004.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
31.185.104.19	unknown	Germany	43847	NBISERV-ASDE	false
81.7.16.182	unknown	Germany	35366	ISPPRO-ASISPPRO-AScoversthenetworksofISPproDE	false
34.117.59.81	myexternalip.com	United States	139070	GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	false
5.45.111.149	unknown	Germany	197540	NETCUP-ASnetcupGmbHDE	false
199.249.230.64	unknown	United States	62744	QUINTEXUS	false
185.225.17.3	unknown	Romania	39798	MIVOCLOUDMD	false
50.7.74.174	unknown	United States	174	COGENT-174US	false
86.59.21.38	unknown	Austria	8437	UTA-ASAT	false
199.249.230.83	unknown	United States	62744	QUINTEXUS	false
50.7.74.170	unknown	United States	174	COGENT-174US	false
178.33.183.251	unknown	France	16276	OVHFR	false
185.13.39.197	unknown	France	197922	FIRSTHEBERGFR	false
62.141.38.69	unknown	Germany	24961	MYLOC-ASIPBackboneofmyLocmanagedITAGDE	false

Private

IP
127.0.0.1

General Information

Joe Sandbox Version:	34.0.0 Boulder Opal
Analysis ID:	563159
Start date:	31.01.2022
Start time:	09:36:08
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 13m 22s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	25hBQ7XDkh.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	22
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.evad.mine.winEXE@15/13@1/14
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 13% (good quality ratio 9.5%) Quality average: 54% Quality standard deviation: 40.3%
HCA Information:	Failed
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): BackgroundTransferHost.exe, backgroundTaskHost.exe, svchost.exe, wuapihost.exe
Excluded IPs from analysis (whitelisted): 204.79.197.222
Excluded domains from analysis (whitelisted): ris.api.iris.microsoft.com, fp.msedge.net, a-0019.a-msedge.net, store-images.s-microsoft.com, a-0019.standard.a-msedge.net, 1.perf.msedge.net, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, arc.msn.com
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
09:37:17	API Interceptor	928x Sleep call for process: 25hBQ7XDkh.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
31.185.104.19	24Faktura-2018_10_03_PDF.exe	Get hash	malicious	Browse	31.185.104.19/tor/server/fp/47e49319dd67784f1e65b5793371be467365979e
31.185.104.19	invoice notification 2019.doc	Get hash	malicious	Browse	31.185.104.19/tor/server/fp/9e9c5494b70738fe10311fa999872da6ebe9938d

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
myexternalip.com	6a2lAgUffh.exe	Get hash	malicious	Browse	34.117.59.81
	Qyv3Iv0iuqZmMdbtNMUdMdsZlwNGTLQSn5nxUWI.dll	Get hash	malicious	Browse	34.117.59.81
	293QdZJ0Ea.msi	Get hash	malicious	Browse	34.117.59.81
	A8ibgLBZ6i.exe	Get hash	malicious	Browse	34.117.59.81
	Se23ydIlT7.dll	Get hash	malicious	Browse	34.117.59.81
	TTK1Z03876CML-version_1.0.5.js	Get hash	malicious	Browse	34.117.59.81
	WLBu7dTvsC.dll	Get hash	malicious	Browse	34.117.59.81
	SecuriteInfo.com.Trojan.GenericKDZ.80412.21668.dll	Get hash	malicious	Browse	34.117.59.81
	Fuutbqvhmc.dll	Get hash	malicious	Browse	34.117.59.81
	nextNextLike.dll	Get hash	malicious	Browse	34.117.59.81
	nWKik9o8eY.exe	Get hash	malicious	Browse	34.117.59.81
	kANwTlkiJp.dll	Get hash	malicious	Browse	34.117.59.81
	powTubeDoor.dll	Get hash	malicious	Browse	34.117.59.81
	a2uwmCMy25.exe	Get hash	malicious	Browse	34.117.59.81
	esmallruby.exe	Get hash	malicious	Browse	34.117.59.81
	vWNA5H5BTr.exe	Get hash	malicious	Browse	34.117.59.81
	WGEcMZQA.dll	Get hash	malicious	Browse	34.117.59.81
	zq8o6y1z60.dll	Get hash	malicious	Browse	34.117.59.81
	CPsCTGtjW2.exe	Get hash	malicious	Browse	34.117.59.81
	1s2X5qQkGz.exe	Get hash	malicious	Browse	34.117.59.81

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
NBISERV-ASDE	tinynuke.exe	Get hash	malicious	Browse	31.185.104.21
	UP34reqgZq.dll	Get hash	malicious	Browse	31.185.104.19
	VCJQWUG1iY.exe	Get hash	malicious	Browse	31.185.104.20
	deepRats.exe	Get hash	malicious	Browse	46.182.21.248
	New Order TL2733234533.pdf.exe	Get hash	malicious	Browse	91.198.123.38
	New Order TL273313533.pdf.exe	Get hash	malicious	Browse	91.198.123.38
	New Order TL2735313533.pdf.exe	Get hash	malicious	Browse	91.198.123.38
	New Order TL273313533.pdf.exe	Get hash	malicious	Browse	91.198.123.38
	New Order TL2735313233.pdf.exe	Get hash	malicious	Browse	91.198.123.38
	New Order TL2763323533.pdf.exe	Get hash	malicious	Browse	91.198.123.38
	New Order TL2731323533.pdf.exe	Get hash	malicious	Browse	91.198.123.38
	New Order TL27333234533.pdf.exe	Get hash	malicious	Browse	91.198.123.38
	RFQ#U00a0.exe	Get hash	malicious	Browse	91.198.123.38
	New Order TL27372134533.pdf.exe	Get hash	malicious	Browse	91.198.123.38
	ejHZ3HUs6E.exe	Get hash	malicious	Browse	31.185.104.21
	vImxbOZ37i.exe	Get hash	malicious	Browse	31.185.104.21
	zSPIyck1p9.exe	Get hash	malicious	Browse	31.185.104.19
	454.exe	Get hash	malicious	Browse	31.185.104.19
	Order_Details.exe	Get hash	malicious	Browse	31.185.104.20
	24Faktura-2018_10_03_PDF.exe	Get hash	malicious	Browse	31.185.104.19

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

C:\Users\user\AppData\Local\ea242c1c\tor\data\state (copy)

Download File

Process:	C:\Users\user\AppData\Local\ea242c1c\tor\windowsconnect.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	232
Entropy (8bit):	4.868045123356923
Encrypted:	false
SSDEEP:	6:SbdWwxXW8BnXr87+QVe2vwR/Ep5fM8IrQBP:bwxXWQXr87HVBvwNCCsV
MD5:	A770AA8146898CB10B06C4614E10CF3E
SHA1:	BC056412391A0BA876FA741D6588FAA81263FD2B
SHA-256:	64F3F8F6D94D8DF4AAE12406274355CCEFC614FD0BB19F5042F0BEE7DA535C53
SHA-512:	01DEAF24895715C5286E7A3BBB376A313FCF340EEE964DA2F133DA95A44A58ADD50A4450973176F2EED4A4AAC51AE6FF249AE50A1A11B1E2D1BF5D986ECB0ED7
Malicious:	false
Reputation:	unknown
Preview:	# Tor state file last generated on 2022-01-31 09:38:45 local time..# Other times below are in UTC..# You do not need to edit this file.....Dormant 0..LastWritten 2022-01-31 08:38:45..TorVersion Tor 0.4.2.5 (git-bede4ea1008920d8)..

C:\Users\user\AppData\Local\ea242c1c\tor\data\state.tmp

Download File

Process:	C:\Users\user\AppData\Local\ea242c1c\tor\windowsconnect.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	232
Entropy (8bit):	4.868045123356923
Encrypted:	false
SSDEEP:	6:SbdWwxXW8BnXr87+QVe2vwR/Ep5fM8IrQBP:bwxXWQXr87HVBvwNCCsV
MD5:	A770AA8146898CB10B06C4614E10CF3E
SHA1:	BC056412391A0BA876FA741D6588FAA81263FD2B
SHA-256:	64F3F8F6D94D8DF4AAE12406274355CCEFC614FD0BB19F5042F0BEE7DA535C53
SHA-512:	01DEAF24895715C5286E7A3BBB376A313FCF340EEE964DA2F133DA95A44A58ADD50A4450973176F2EED4A4AAC51AE6FF249AE50A1A11B1E2D1BF5D986ECB0ED7
Malicious:	false
Reputation:	unknown
Preview:	# Tor state file last generated on 2022-01-31 09:38:45 local time..# Other times below are in UTC..# You do not need to edit this file.....Dormant 0..LastWritten 2022-01-31 08:38:45..TorVersion Tor 0.4.2.5 (git-bede4ea1008920d8)..

C:\Users\user\AppData\Local\ea242c1c\tor\libcrypto-1_1.dll

Download File

Process:	C:\Users\user\Desktop\25hBQ7XDkh.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	1781914
Entropy (8bit):	7.158347735645916
Encrypted:	false
SSDEEP:	49152:uKyA6xLkn84KAFa0ROvosyG/iRO1CPwDv3uFZjhUg2EeJUO9WLQ0u:u86xwnhKAFhovosyo31CPwDv3uFZjhUh
MD5:	2384A02C4A1F7EC481ADDE3A020607D3
SHA1:	7E848D35A10BF9296C8FA41956A3DAA777F86365
SHA-256:	C8DB0FF0F7047ED91B057005E86AD3A23EAE616253313AA047C560D9EB398369
SHA-512:	1AC74DD2D863ACD7415EF8B9490A5342865462FBABDAD0645DA22424B0D56F5E9C389A3D7C41386F2414D6C4715C79A6DDECB6E6CFF29E98319E1FD1060F4503
Malicious:	false
Antivirus:	Antivirus: Metadefender, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 4%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L........X).RT.....!.....0......................@k..........................,...........@... .....................0..D......x..........................t.,. ..................................................................................UPX0....................................UPX1.....0.......$..................@....rsrc...............&..............@...3.96.UPX!....IV..+<.1.......\2.$..i}........$."....,......&........WVSD..D$$..ur..R...~W.......1...B.'.._...({..M.$..r......5B. ...............[........s...[^_.....T...w...d....=..X.1....t<..F9...........1........f0l.5.......K.!..Dt..T$(..............$............bsm>.'6..f..-....;h...;Q....V....v..'J.S.....j!...0{............,fY.bO.;Y......O......7...UW..V..S..R.....?(ui.....BHp.\|.\|4.M4....$&..<B-.\%.6X....)\.(....J.1.:......k....].~..C.m....]...t..>z.............l[.mEp.].v..-

C:\Users\user\AppData\Local\ea242c1c\tor\libevent-2-1-6.dll

Download File

Process:	C:\Users\user\Desktop\25hBQ7XDkh.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	375453
Entropy (8bit):	6.942455142300998
Encrypted:	false
SSDEEP:	6144:7+wL9BBhoJgaEr2Y8SIe3V8JNkN7hOXsgZzKm:7z9vwhErYaVeNkN70cgwm
MD5:	099983C13BADE9554A3C17484E5481F1
SHA1:	A84E69AD9722F999252D59D0ED9A99901A60E564
SHA-256:	B65F9AA0C7912AF64BD9B05E9322E994339A11B0C8907E6A6166D7B814BDA838
SHA-512:	89F1A963DE77873296395662D4150E3EFF7A2D297FB9EC54EC06AA2E40D41E5F4FC4611E9BC34126D760C9134F2907FEA3BEBDF2FBBD7EADDAD99F8E4BE1F5E2
Malicious:	false
Antivirus:	Antivirus: Metadefender, Detection: 3%, Browse Antivirus: ReversingLabs, Detection: 7%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L........ .........!.....0...`............... ....<b......................................@... ......................"...X... ...............................z......................................................................................UPX0....................................UPX1.....0.......&..................@...UPX2.....`... ...\...(..............@...3.96.UPX!........o.o.....v"...V..&...}........$.......R......&........WVSD..D$$..ur..R...~W.......1...B.'.._...(...N..r......5......o..........[...Q.....f.[^_.....T........d....=..X.1....t..Z.F9.......w..S..1.....}.N.0l.5........*...Dt..T$(......k..... ..$....`.T...bs....m..f......;h...;Q....a..v..'....\|.S .....a..".........q,....O.;YUD:.........{..UW..V.....S..R...cHui.3\|k..BHp..\|.\|4...M4$..lB-.\..r3%\.)\.._\.(J.1.:...?.G...].~..Cig...m]...=Z..t......<8...Z.l...n!].v..`%.[-\06..)

C:\Users\user\AppData\Local\ea242c1c\tor\libgcc_s_sjlj-1.dll

Download File

Process:	C:\Users\user\Desktop\25hBQ7XDkh.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	292880
Entropy (8bit):	7.08760501332915
Encrypted:	false
SSDEEP:	6144:1Tlx3jVbWfC7HVtQKCuxvYPRqAxDIoTS2:1Tb3jVb4fuJCz3
MD5:	B0D98F7157D972190FE0759D4368D320
SHA1:	5715A533621A2B642AAD9616E603C6907D80EFC4
SHA-256:	2922193133DABAB5B82088D4E87484E2FAC75E9E0C765DACAF22EB5F4F18B0C5
SHA-512:	41CE56C428158533BF8B8FFE0A71875B5A3ABC549B88D7D3E69ACC6080653ABEA344D6D66FFF39C04BF019FCAA295768D620377D85A933DDAF17F3D90DF29496
Malicious:	false
Antivirus:	Antivirus: Metadefender, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 4%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..................!.....@.......@.......P.........m......................................@... .....................................................................................................................................................UPX0.....@..............................UPX1.....@...P...@..................@...UPX2.................B..............@...3.96.UPX!........-....i...<......&...m........$..p....1......&........WVS"..D$$..ur..)...~W.c...-...!..../...vL.....09......5.w.o.s..A........-.{?w..z..L..[^_..w.m....*....d...m..o.=W.X.1....t#9.I..4.w.s..q.....1.sH..c....3[6.......{...V."t..T$(......n{.... ..$..e...ag1..........Kxf.\2...m.r.Cp.b.(...r.M8.v....O)..........W......R.C.8.'7Y.....,.O..........'a.UW..V..S..).5....@.ui..!H}...8(\|.\|.p&4$....L,!..\..Z......v....1.\........@].?_.C.6;.......?t.k..C..U.1.Br...l..d.....v......2.

C:\Users\user\AppData\Local\ea242c1c\tor\libssl-1_1.dll

Download File

Process:	C:\Users\user\Desktop\25hBQ7XDkh.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	450373
Entropy (8bit):	6.9077953346074
Encrypted:	false
SSDEEP:	12288:15D04uko/Sxg3MWFccpVpfVmy3ocIdNyxtw3iFFrS6XL:8fkeh33FccpVp9jxtw3iFFrS6XL
MD5:	C88826AC4BB879622E43EAD5BDB95AEB
SHA1:	87D29853649A86F0463BFD9AD887B85EEDC21723
SHA-256:	C4D898B1A4285A45153AF9ED88D79AA2A073DCB7225961B6B276B532B4D18B6F
SHA-512:	F733041EF35B9B8058FBCF98FAA0D1FEA5C0858FEA941ECEBBE9F083CD73E3E66323AFFFD8D734097FCDD5E6E59DB4D94F51FCA5874EDBCD2A382D9BA6CD97B3
Malicious:	false
Antivirus:	Antivirus: Metadefender, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 7%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L........x.........!.........P.....................j......................................@... ........................4@..........................................................................................................................UPX0....................................UPX1................................@....rsrc....P.......F..................@...3.96.UPX!.........Wa(h......Ey..&...}........$..............&........WVSD..D$$..ur..R...~W.......1...B.'.._...(...O.o.r......5....;;..........[............[^_.....T......~d....=..X.1....tF9.........{.m?..1.....0.7.4l.5.......o_..Dt..T$(......f.... ..$.......6....bsm...>.'f........0....r.;Q.:..e..v..'..S .......".....`].c...q.O.$]d........".{......UW..V..S..R.5\|.\...Hui..BH..3.p...\|4.M4$&r3...B-.\%._\...)\.(J.1.G..:.......?.].~..C.m]..ig...t....=Z.......B....[.]...".v..-..a.J

C:\Users\user\AppData\Local\ea242c1c\tor\libssp-0.dll

Download File

Process:	C:\Users\user\Desktop\25hBQ7XDkh.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	90333
Entropy (8bit):	6.919951469409257
Encrypted:	false
SSDEEP:	1536:5lZ0qS+fl4CFzLCNfcnleimT+RqMGAI1SWA8yCM0NX2wu:5lzbfpChcPEM8e8yCDX2N
MD5:	2C916456F503075F746C6EA649CF9539
SHA1:	FA1AFC1F3D728C89B2E90E14CA7D88B599580A9D
SHA-256:	CBB5236D923D4F4BAF2F0D2797C72A2CBAE42EF7AC0ACCE786DAF5FDC5B456E6
SHA-512:	1C1995E1AA7C33C597C64122395275861D9219E46D45277D4F1768A2E06227B353D5D77D6B7CB655082DC6FB9736AD6F7CFCC0C90E02776E27D50857E792E3FD
Malicious:	false
Antivirus:	Antivirus: Metadefender, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 3%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..................!................@{.............h......................................@... ........................l...................................H...............................@}......................................................UPX0....................................UPX1................................@...UPX2................................@...3.96.UPX!.....0U.....2W..'.......&..ym........$..@...........&........WVS"..D$$..ur..)...~W.......1...!..../L.......aP9......5....}C...A.........-......z..L..[^_.....o.......d....=l...W.X.1....t#9.I.ww....s..q.1..s.`s..c...]f.6.......n..d.0."t..T$(....B....... ..$..ev.s.............f.\...m.n,...(...r..>v....O)..}......p.W....p.R3a..8.'..&...,...&.O.........UW..V..S....4t).. ui..!..H8.\|.\|.&.....4$l\!..\.0/..L....;..n..1.\......c..@].?_.C.6..}.....?t...!.k.U.1!9....l...@.~..v....X..L.L.m

C:\Users\user\AppData\Local\ea242c1c\tor\libwinpthread-1.dll

Download File

Process:	C:\Users\user\Desktop\25hBQ7XDkh.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	192765
Entropy (8bit):	7.258269000752376
Encrypted:	false
SSDEEP:	3072:Vb2IhqYh6ZwXqIXsJHAFXkwbtotutg+UISEyZ0ENrbhESggAEim3YnsVwTivFo:3iIqI+HAvbtjtplhyT41Kim3Y0wTivFo
MD5:	D407CC6D79A08039A6F4B50539E560B8
SHA1:	21171ADBC176DC19AAA5E595CD2CD4BD1DFD0C71
SHA-256:	92CFD0277C8781A15A0F17B7AEE6CFF69631B9606A001101631F04B3381EFC4E
SHA-512:	378A10FED915591445D97C6D04E82D28008D8EA65E0E40C142B8EE59867035D561D4E103495C8F0D9C19B51597706CE0B450C25516AA0F1744579FFCD097AE0C
Malicious:	false
Antivirus:	Antivirus: Metadefender, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 4%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L........z.........!.....0... ... ..PR...0...`.....d......................................@... ......................d......Td.......`..T....................u..............................PT......................................................UPX0..... ..............................UPX1.....0...0...&..................@....rsrc.... ...`.......(..............@...3.96.UPX!...../......W;..8".....&..+m........$........<.....&........WVS"..D$$..ur..)...~W.......1...!..../L........$9......5....}...A........-......z4.L..[^_.....o.......d....=l...W.X.1....t#9.I.ww....s..q.1.Z..fsH..c..mw..6............."t..T$(.......w.... ..$..e.....;.........u_.f.\.,.1...r......(...rv.n6...O).;v{.......W..R...&.C,8.'\|.\|.....O.&_@.........UW..V..S..).].{...,ui..!H8q.Y.\|.p&4$...V~..!..\..7.........1..n{.\.....@...].?_.C.6.N.>....?t.k....U.1......m\|....v.Y s....oC

C:\Users\user\AppData\Local\ea242c1c\tor\torrc

Download File

Process:	C:\Users\user\Desktop\25hBQ7XDkh.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	139
Entropy (8bit):	4.932519643489788
Encrypted:	false
SSDEEP:	3:0rMRxjOMtUuzaAvov+9RwWZCvqRq+uyhERRAiIDt+kiE2J5A+RXG8sREn:CMRIM/aQovqRZCvq3cAiIwkn23AuXSin
MD5:	B85568034F04FA0E29B8FC8BAE09F046
SHA1:	4C8D8C2F810C53DEEF72D15967CFA95C715F4BAD
SHA-256:	64F82E962E15F3C39A83B4B60FD03E7993134FFC58A1F91B740A2BBD4959A10D
SHA-512:	231AE8245D92AA5EA598CEBC3D966B8F77237F4C729EE4A423BFCD7B67390920FB0635C74CC548626C38842A7FDC194FEF66BE501A4DB673B70EBBBE6A46D921
Malicious:	false
Reputation:	unknown
Preview:	SOCKSPort 45808..FascistFirewall 1..DirCache 0..ClientUseIPv6 0..ClientOnly 1..DataDirectory C:\Users\user\AppData\Local\ea242c1c\tor\data

C:\Users\user\AppData\Local\ea242c1c\tor\windowsconnect.exe

Download File

Process:	C:\Users\user\Desktop\25hBQ7XDkh.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	996352
Entropy (8bit):	7.912146678547723
Encrypted:	false
SSDEEP:	24576:V82yLnYQN5FlyjIJO1UPrb6uFeCyL145gYaw0ZfbFeRkCrqKEV5D:VvuYQNPlNJxOuF1730ZfbUkr
MD5:	5CFE61FF895C7DAA889708665EF05D7B
SHA1:	5E58EFE30406243FBD58D4968B0492DDEEF145F2
SHA-256:	F9C1D18B50CE7484BF212CB61A9035602CFB90EBDFE66A077B9F6DF73196A9F5
SHA-512:	43B6F10391A863A21F70E05CEE41900729C7543750E118FF5D74C0CAC3D1383F10BCB73EADE2A28B555A393CADA4795E204246129B01AD9177D1167827DD68DA
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L........................0........0..@...1..0@...@..........................@@...........@... ..............................0@..............................2@..............................,@.....................................................UPX0......0.............................UPX1.....0....1.....................@...UPX2.........0@......0..............@...3.96.UPX!.....W...\..@.\|....>.&7........&......1.f.=....MZ..!....<.l.0.hd..^9..u...b<..oPE......tP.Dp..bt..u2..$]o?..7/.$.,l4......\|.M...=./.L.tK....2t....yb...f...Q.<....~.J=..u....@.v.....v...........~........m./.yt...^.....m.&....7.\..o..,{`.D$.........".................[<.,.^...m.L2....q.U..WV.U.S..Q.......x.57......?...d..0+..x.1....9.......>......v......=...l......^...R.9.f..0.y.Up...}O-I....X.94...].t.......y7........!v..f..p.\|(!..c.=.K..lJ.\.d.....s41..F..M..tD.....+z'..

C:\Users\user\AppData\Local\ea242c1c\tor\zlib1.dll

Download File

Process:	C:\Users\user\Desktop\25hBQ7XDkh.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	53760
Entropy (8bit):	7.819616972153237
Encrypted:	false
SSDEEP:	768:9dfKEwqfuHtTeSgJZ+d4BlJthH1zs4/rqjc8J7RvrAsUU05Yr7QHN1/poPU:9dCjqvZ+d4Vthx/2cA7RU1Vo2NBpwU
MD5:	ADD33041AF894B67FE34E1DC819B7EB6
SHA1:	6DB46EB021855A587C95479422ADCC774A272EEB
SHA-256:	8688BD7CA55DCC0C23C429762776A0A43FE5B0332DFD5B79EF74E55D4BBC1183
SHA-512:	BAFC441198D03F0E7FE804BAB89283C389D38884D0F87D81B11950A9B79FCBF7B32BE4BB16F4FCD9179B66F865C563C172A46B4514A6087EF0AF64425A4B2CFA
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..................#.............P.......`...0.....c.........................@............@... .....................p4..\|....3.......0.......................;.. ............................!......................................................UPX0.....P..............................UPX1.........`......................@....rsrc........0......................@...3.96.UPX!.......<................&...m........$........l.....&........WVS"..D$$..ur..)...~W.......1...!..../L........T9......5....}....A.........-......z\.L..[^_.....o...*....d....=l...W.X.1....t#9.I.ww....s..q.1..s.`s..c...]f.6.......n..d.vh"t..T$(....{....... ..$..e......b.......}..f.\.\..m......(...rv.n6...O).;v{.......W..R...73CT8.'{.....,.O...........0.UW..V..S..)5..... ui..!H.<..8...\|.&.4$......!..\..y..........w.1.\.......+l@].?_.C.6.d.C....?t.k.....U.D...g...........v....f.d..

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.076024117926356
TrID:	Win32 Executable (generic) a (10002005/4) 99.66% UPX compressed Win32 Executable (30571/9) 0.30% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	25hBQ7XDkh.exe
File size:	8151557
MD5:	669c9c7805726ead633b2539c0885ee9
SHA1:	744ecd691023e99f2391abe346efa243619b9add
SHA256:	895be5d5816339f3f7100cfa36463d9652048babe690920fc195e4a39d7ab6c5
SHA512:	17353f5f6780d5d495a76c5532ebc3e96ff17c3ef0dcfe3a57576d1fc4875eb4d6801469d98e986ffdfdc6356f1f16ae0cfa8aaab3cd19c00a6b41fbd21e25d8
SSDEEP:	196608:3HyHu9V2LhRxwhzav1yo31CPwDv3uFZjeg2EeJUO9WLQUDxtw3iFFrS6XOfTV73s:3SO92RxwZ6v1CPwDv3uFteg2EeJUO9W/
File Content Preview:	MZ......................@...................................8...........!..L.!This program cannot be run in DOS mode....$.......................Jh......Jh..9...Jh......`T,.............i.......i.......i.......#.;.....#.:.....#. .....................#.%....

File Icon


Icon Hash:	00828e8e8686b000

Static PE Info

General

Entrypoint:	0x686058
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE, RELOCS_STRIPPED
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x5FF88D11 [Fri Jan 8 16:49:21 2021 UTC]
TLS Callbacks:	0x5ca200
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2b817dc1b1849c6a436f0647be7673e0

Entrypoint Preview

Instruction
call 00007F485D34870Dh
jmp 00007F485D347273h
cmp ecx, dword ptr [00788BC8h]
jne 00007F485D3473E5h
ret
jmp 00007F485D347755h
jmp dword ptr [006DB3D8h]
mov ecx, dword ptr [ebp-0Ch]
mov dword ptr fs:[00000000h], ecx
pop ecx
pop edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
push ecx
ret
mov ecx, dword ptr [ebp-10h]
xor ecx, ebp
call 00007F485D3473AFh
jmp 00007F485D3473C0h
mov ecx, dword ptr [ebp-14h]
xor ecx, ebp
call 00007F485D34739Eh
jmp 00007F485D3473AFh
push eax
push dword ptr fs:[00000000h]
lea eax, dword ptr [esp+0Ch]
sub esp, dword ptr [esp+0Ch]
push ebx
push esi
push edi
mov dword ptr [eax], ebp
mov ebp, eax
mov eax, dword ptr [00788BC8h]
xor eax, ebp
push eax
push dword ptr [ebp-04h]
mov dword ptr [ebp-04h], FFFFFFFFh
lea eax, dword ptr [ebp-0Ch]
mov dword ptr fs:[00000000h], eax
ret
push eax
push dword ptr fs:[00000000h]
lea eax, dword ptr [esp+0Ch]
sub esp, dword ptr [esp+0Ch]
push ebx
push esi
push edi
mov dword ptr [eax], ebp
mov ebp, eax
mov eax, dword ptr [00788BC8h]
xor eax, ebp
push eax
mov dword ptr [ebp-10h], eax
push dword ptr [ebp-04h]
mov dword ptr [ebp-04h], FFFFFFFFh
lea eax, dword ptr [ebp-0Ch]
mov dword ptr fs:[00000000h], eax
ret
push eax
push dword ptr fs:[00000000h]

Rich Headers

Programming Language:

[C++] VS2015 UPD3.1 build 24215
[ C ] VS2015 UPD3.1 build 24215

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x384530	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x3a3000	0x409c28	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x3444cc	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x325120	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x382924	0x280	.rdata
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x2d96d4	0x2d9800	unknown	unknown	unknown	unknown	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rdata	0x2db000	0xaabc2	0xaac00	False	0.409499965684	data	5.39131832102	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x386000	0x19c04	0x12200	False	0.134859913793	data	4.99173297126	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.gfids	0x3a0000	0x11f8	0x1200	False	0.390190972222	data	4.14154064622	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.tls	0x3a2000	0x9	0x200	False	0.033203125	data	0.0203931352361	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rsrc	0x3a3000	0x409c28	0x409e00	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x7ad000	0x244c4	0x24600	False	0.00112086554983	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_RCDATA	0x3a31b0	0x1b309a	PE32 executable (DLL) (console) Intel 80386, for MS Windows, UPX compressed	English	United States
RT_RCDATA	0x556250	0x5ba9d	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed	English	United States
RT_RCDATA	0x5b1cf0	0x47810	PE32 executable (DLL) (console) Intel 80386, for MS Windows, UPX compressed	English	United States
RT_RCDATA	0x5f9500	0x6df45	PE32 executable (DLL) (console) Intel 80386, for MS Windows, UPX compressed	English	United States
RT_RCDATA	0x667448	0x160dd	PE32 executable (DLL) (console) Intel 80386, for MS Windows, UPX compressed	English	United States
RT_RCDATA	0x67d528	0x2f0fd	PE32 executable (DLL) (console) Intel 80386, for MS Windows, UPX compressed	English	United States
RT_RCDATA	0x6ac628	0xf3400	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed	English	United States
RT_RCDATA	0x79fa28	0xd200	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed	English	United States

Imports

DLL

Import

KERNEL32.DLL

HeapFree, EnterCriticalSection, LeaveCriticalSection, InitializeCriticalSectionEx, HeapSize, PostQueuedCompletionStatus, FormatMessageW, GetLastError, SetEvent, TlsAlloc, HeapReAlloc, CloseHandle, RaiseException, HeapAlloc, DecodePointer, HeapDestroy, LocalFree, DeleteCriticalSection, GetProcessHeap, WideCharToMultiByte, TlsFree, FormatMessageA, CreateEventA, GetCurrentProcess, GetSystemTimes, GetTickCount64, GetProcessTimes, SetWaitableTimer, TlsSetValue, SetLastError, CreateWaitableTimerW, WaitForMultipleObjects, InitializeCriticalSectionAndSpinCount, GetQueuedCompletionStatus, WaitForSingleObject, GetModuleHandleA, CreateEventW, MultiByteToWideChar, TerminateThread, QueueUserAPC, GetProcAddress, VerSetConditionMask, SleepEx, VerifyVersionInfoW, TlsGetValue, GetSystemTimeAsFileTime, CreateIoCompletionPort, CreateDirectoryW, ReadFile, SizeofResource, QueryDosDeviceW, GetVolumeInformationW, FindFirstFileW, WriteProcessMemory, FindFirstFileExW, SetPriorityClass, VirtualFree, GetFullPathNameW, FindNextFileW, lstrlenW, WriteFile, Wow64DisableWow64FsRedirection, GetSystemDefaultUILanguage, GetDiskFreeSpaceW, VirtualAlloc, TerminateProcess, GetDriveTypeA, GetModuleFileNameW, GetUserDefaultLocaleName, GetProcessId, K32GetModuleFileNameExW, GetProductInfo, Thread32Next, GetTempPathW, CreateMutexW, Thread32First, FindClose, GetLocaleInfoW, CreateFileW, GetFileAttributesW, GetCurrentThreadId, GetVersionExW, K32GetProcessImageFileNameW, SuspendThread, GetSystemDirectoryW, ResumeThread, lstrcatA, OpenProcess, SetFileAttributesW, GetLogicalDriveStringsW, CreateToolhelp32Snapshot, Sleep, CopyFileA, Process32NextW, K32GetProcessMemoryInfo, CreateFileA, GetCurrentThread, LoadLibraryA, LockResource, GlobalAlloc, Process32FirstW, GlobalFree, GetNativeSystemInfo, GetSystemInfo, LoadLibraryW, FindResourceExW, LoadResource, FindResourceW, SetFileAttributesA, GetThreadContext, GetPriorityClass, GlobalLock, VirtualAllocEx, MoveFileExW, GetFileSize, ExitProcess, ReadProcessMemory, GetComputerNameW, FindFirstStreamW, GetCurrentProcessId, SystemTimeToFileTime, GlobalMemoryStatusEx, CreateProcessW, GetModuleHandleW, WinExec, CreateRemoteThread, QueryFullProcessImageNameW, CreateProcessA, DebugBreak, SetThreadContext, FindNextStreamW, GetTickCount, GlobalUnlock, GetDriveTypeW, GetFileTime, OpenThread, GetExitCodeProcess, Beep, CreatePipe, PeekNamedPipe, GetStartupInfoA, lstrcpyA, CreateThread, CreateTimerQueueTimer, VirtualProtect, GetCommandLineW, DeviceIoControl, GetEnvironmentVariableW, GetExitCodeThread, FreeLibrary, IsDebuggerPresent, CreateTimerQueue, EncodePointer, TryEnterCriticalSection, DuplicateHandle, WaitForSingleObjectEx, QueryPerformanceCounter, QueryPerformanceFrequency, GetFileAttributesExW, GetFileInformationByHandle, SetEndOfFile, SetFilePointerEx, AreFileApisANSI, GetStringTypeW, GetCPInfo, CompareStringW, LCMapStringW, OutputDebugStringW, InitializeCriticalSection, GetSystemDirectoryA, VerifyVersionInfoA, ExpandEnvironmentStringsA, GetStdHandle, GetFileType, ResetEvent, ReleaseSemaphore, OpenEventA, GetLogicalProcessorInformation, GetCurrentDirectoryW, DeleteFileW, RemoveDirectoryW, CreateDirectoryExW, GetFileSizeEx, SwitchToFiber, DeleteFiber, CreateFiber, ConvertFiberToThread, ConvertThreadToFiber, GetConsoleMode, SetConsoleMode, ReadConsoleA, ReadConsoleW, GetSystemTime, InitializeSListHead, InterlockedPopEntrySList, InterlockedPushEntrySList, InterlockedFlushSList, QueryDepthSList, UnregisterWaitEx, RegisterWaitForSingleObject, GetThreadTimes, FreeLibraryAndExitThread, LoadLibraryExW, SignalObjectAndWait, SwitchToThread, SetThreadPriority, GetThreadPriority, ChangeTimerQueueTimer, DeleteTimerQueueTimer, GetNumaHighestNodeNumber, GetProcessAffinityMask, SetThreadAffinityMask, UnregisterWait, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsProcessorFeaturePresent, GetStartupInfoW, RtlUnwind, SetConsoleCtrlHandler, ExitThread, GetModuleHandleExW, SystemTimeToTzSpecificLocalTime, FileTimeToSystemTime, GetModuleFileNameA, WriteConsoleW, SetEnvironmentVariableA, GetACP, GetConsoleCP, GetDateFormatW, GetTimeFormatW, IsValidLocale, GetUserDefaultLCID, EnumSystemLocalesW, FlushFileBuffers, SetStdHandle, GetTimeZoneInformation, FindFirstFileExA, FindNextFileA, IsValidCodePage, GetOEMCP, GetCommandLineA, GetEnvironmentStringsW, FreeEnvironmentStringsW, VirtualQuery, LoadLibraryExA

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 31, 2022 09:37:14.837025881 CET	49761	443	192.168.2.4	199.249.230.64
Jan 31, 2022 09:37:14.837090015 CET	443	49761	199.249.230.64	192.168.2.4
Jan 31, 2022 09:37:14.837186098 CET	49761	443	192.168.2.4	199.249.230.64
Jan 31, 2022 09:37:14.872176886 CET	49761	443	192.168.2.4	199.249.230.64
Jan 31, 2022 09:37:14.872224092 CET	443	49761	199.249.230.64	192.168.2.4
Jan 31, 2022 09:37:15.415211916 CET	443	49761	199.249.230.64	192.168.2.4
Jan 31, 2022 09:37:15.415359020 CET	49761	443	192.168.2.4	199.249.230.64
Jan 31, 2022 09:37:15.418318033 CET	49761	443	192.168.2.4	199.249.230.64
Jan 31, 2022 09:37:15.418328047 CET	443	49761	199.249.230.64	192.168.2.4
Jan 31, 2022 09:37:15.418452024 CET	443	49761	199.249.230.64	192.168.2.4
Jan 31, 2022 09:37:15.419097900 CET	49761	443	192.168.2.4	199.249.230.64
Jan 31, 2022 09:37:15.419111967 CET	443	49761	199.249.230.64	192.168.2.4
Jan 31, 2022 09:37:15.535969973 CET	49761	443	192.168.2.4	199.249.230.64
Jan 31, 2022 09:37:15.849636078 CET	49762	443	192.168.2.4	62.141.38.69
Jan 31, 2022 09:37:15.849683046 CET	443	49762	62.141.38.69	192.168.2.4
Jan 31, 2022 09:37:15.849761963 CET	49762	443	192.168.2.4	62.141.38.69
Jan 31, 2022 09:37:15.852082014 CET	49762	443	192.168.2.4	62.141.38.69
Jan 31, 2022 09:37:15.852097034 CET	443	49762	62.141.38.69	192.168.2.4
Jan 31, 2022 09:37:15.950691938 CET	443	49762	62.141.38.69	192.168.2.4
Jan 31, 2022 09:37:15.950779915 CET	443	49762	62.141.38.69	192.168.2.4
Jan 31, 2022 09:37:15.950834990 CET	49762	443	192.168.2.4	62.141.38.69
Jan 31, 2022 09:37:15.950949907 CET	49762	443	192.168.2.4	62.141.38.69
Jan 31, 2022 09:37:17.866297960 CET	49763	443	192.168.2.4	185.225.17.3
Jan 31, 2022 09:37:17.866348982 CET	443	49763	185.225.17.3	192.168.2.4
Jan 31, 2022 09:37:17.866440058 CET	49763	443	192.168.2.4	185.225.17.3
Jan 31, 2022 09:37:17.881438971 CET	49763	443	192.168.2.4	185.225.17.3
Jan 31, 2022 09:37:17.881465912 CET	443	49763	185.225.17.3	192.168.2.4
Jan 31, 2022 09:37:20.066009998 CET	49765	443	192.168.2.4	50.7.74.170
Jan 31, 2022 09:37:20.066054106 CET	443	49765	50.7.74.170	192.168.2.4
Jan 31, 2022 09:37:20.066153049 CET	49765	443	192.168.2.4	50.7.74.170
Jan 31, 2022 09:37:20.067132950 CET	49765	443	192.168.2.4	50.7.74.170
Jan 31, 2022 09:37:20.067148924 CET	443	49765	50.7.74.170	192.168.2.4
Jan 31, 2022 09:38:04.023655891 CET	49761	443	192.168.2.4	199.249.230.64
Jan 31, 2022 09:38:04.023854017 CET	49765	443	192.168.2.4	50.7.74.170
Jan 31, 2022 09:38:04.023854971 CET	49763	443	192.168.2.4	185.225.17.3
Jan 31, 2022 09:38:08.892594099 CET	49796	443	192.168.2.4	34.117.59.81
Jan 31, 2022 09:38:08.892648935 CET	443	49796	34.117.59.81	192.168.2.4
Jan 31, 2022 09:38:08.892748117 CET	49796	443	192.168.2.4	34.117.59.81
Jan 31, 2022 09:38:09.096311092 CET	49796	443	192.168.2.4	34.117.59.81
Jan 31, 2022 09:38:09.096330881 CET	443	49796	34.117.59.81	192.168.2.4
Jan 31, 2022 09:38:09.140306950 CET	443	49796	34.117.59.81	192.168.2.4
Jan 31, 2022 09:38:09.140383959 CET	49796	443	192.168.2.4	34.117.59.81
Jan 31, 2022 09:38:09.355667114 CET	49796	443	192.168.2.4	34.117.59.81
Jan 31, 2022 09:38:09.355703115 CET	443	49796	34.117.59.81	192.168.2.4
Jan 31, 2022 09:38:09.355927944 CET	443	49796	34.117.59.81	192.168.2.4
Jan 31, 2022 09:38:09.355995893 CET	49796	443	192.168.2.4	34.117.59.81
Jan 31, 2022 09:38:09.359544039 CET	49796	443	192.168.2.4	34.117.59.81
Jan 31, 2022 09:38:09.401870966 CET	443	49796	34.117.59.81	192.168.2.4
Jan 31, 2022 09:38:09.488527060 CET	443	49796	34.117.59.81	192.168.2.4
Jan 31, 2022 09:38:09.488579988 CET	443	49796	34.117.59.81	192.168.2.4
Jan 31, 2022 09:38:09.488601923 CET	49796	443	192.168.2.4	34.117.59.81
Jan 31, 2022 09:38:09.488632917 CET	49796	443	192.168.2.4	34.117.59.81
Jan 31, 2022 09:38:09.489790916 CET	49796	443	192.168.2.4	34.117.59.81
Jan 31, 2022 09:38:09.489813089 CET	443	49796	34.117.59.81	192.168.2.4
Jan 31, 2022 09:38:13.897356033 CET	49812	443	192.168.2.4	199.249.230.83
Jan 31, 2022 09:38:13.897437096 CET	443	49812	199.249.230.83	192.168.2.4
Jan 31, 2022 09:38:13.897521019 CET	49812	443	192.168.2.4	199.249.230.83
Jan 31, 2022 09:38:13.930105925 CET	49812	443	192.168.2.4	199.249.230.83
Jan 31, 2022 09:38:13.930146933 CET	443	49812	199.249.230.83	192.168.2.4
Jan 31, 2022 09:38:14.026504993 CET	49813	443	192.168.2.4	185.13.39.197
Jan 31, 2022 09:38:14.026554108 CET	443	49813	185.13.39.197	192.168.2.4
Jan 31, 2022 09:38:14.026633024 CET	49813	443	192.168.2.4	185.13.39.197
Jan 31, 2022 09:38:14.028580904 CET	49813	443	192.168.2.4	185.13.39.197
Jan 31, 2022 09:38:14.028606892 CET	443	49813	185.13.39.197	192.168.2.4
Jan 31, 2022 09:38:14.058933973 CET	443	49813	185.13.39.197	192.168.2.4
Jan 31, 2022 09:38:14.483735085 CET	443	49812	199.249.230.83	192.168.2.4
Jan 31, 2022 09:38:14.483845949 CET	49812	443	192.168.2.4	199.249.230.83
Jan 31, 2022 09:38:14.486583948 CET	49812	443	192.168.2.4	199.249.230.83
Jan 31, 2022 09:38:14.486598969 CET	443	49812	199.249.230.83	192.168.2.4
Jan 31, 2022 09:38:14.486785889 CET	443	49812	199.249.230.83	192.168.2.4
Jan 31, 2022 09:38:14.541044950 CET	49812	443	192.168.2.4	199.249.230.83
Jan 31, 2022 09:38:14.541066885 CET	443	49812	199.249.230.83	192.168.2.4
Jan 31, 2022 09:38:14.588943005 CET	49812	443	192.168.2.4	199.249.230.83
Jan 31, 2022 09:38:14.633866072 CET	443	49812	199.249.230.83	192.168.2.4
Jan 31, 2022 09:38:16.193941116 CET	49815	443	192.168.2.4	81.7.16.182
Jan 31, 2022 09:38:16.194005966 CET	443	49815	81.7.16.182	192.168.2.4
Jan 31, 2022 09:38:16.194153070 CET	49815	443	192.168.2.4	81.7.16.182
Jan 31, 2022 09:38:16.213618040 CET	49815	443	192.168.2.4	81.7.16.182
Jan 31, 2022 09:38:16.213661909 CET	443	49815	81.7.16.182	192.168.2.4
Jan 31, 2022 09:38:16.502630949 CET	443	49815	81.7.16.182	192.168.2.4
Jan 31, 2022 09:38:16.502728939 CET	49815	443	192.168.2.4	81.7.16.182
Jan 31, 2022 09:38:16.505120039 CET	49815	443	192.168.2.4	81.7.16.182
Jan 31, 2022 09:38:16.505137920 CET	443	49815	81.7.16.182	192.168.2.4
Jan 31, 2022 09:38:16.505256891 CET	443	49815	81.7.16.182	192.168.2.4
Jan 31, 2022 09:38:16.505386114 CET	49815	443	192.168.2.4	81.7.16.182
Jan 31, 2022 09:38:16.545867920 CET	443	49815	81.7.16.182	192.168.2.4
Jan 31, 2022 09:38:16.709867954 CET	443	49815	81.7.16.182	192.168.2.4
Jan 31, 2022 09:38:16.712085009 CET	49815	443	192.168.2.4	81.7.16.182
Jan 31, 2022 09:38:18.784090996 CET	49817	443	192.168.2.4	50.7.74.174
Jan 31, 2022 09:38:18.784149885 CET	443	49817	50.7.74.174	192.168.2.4
Jan 31, 2022 09:38:18.784224987 CET	49817	443	192.168.2.4	50.7.74.174
Jan 31, 2022 09:38:18.854948044 CET	49818	443	192.168.2.4	86.59.21.38
Jan 31, 2022 09:38:18.855005026 CET	443	49818	86.59.21.38	192.168.2.4
Jan 31, 2022 09:38:18.855082035 CET	49818	443	192.168.2.4	86.59.21.38
Jan 31, 2022 09:38:18.856056929 CET	49817	443	192.168.2.4	50.7.74.174
Jan 31, 2022 09:38:18.856091976 CET	443	49817	50.7.74.174	192.168.2.4
Jan 31, 2022 09:38:18.856916904 CET	49818	443	192.168.2.4	86.59.21.38
Jan 31, 2022 09:38:18.856936932 CET	443	49818	86.59.21.38	192.168.2.4
Jan 31, 2022 09:38:18.943260908 CET	443	49818	86.59.21.38	192.168.2.4
Jan 31, 2022 09:38:18.943350077 CET	49818	443	192.168.2.4	86.59.21.38
Jan 31, 2022 09:38:18.945930958 CET	49818	443	192.168.2.4	86.59.21.38
Jan 31, 2022 09:38:18.945949078 CET	443	49818	86.59.21.38	192.168.2.4
Jan 31, 2022 09:38:18.946072102 CET	443	49818	86.59.21.38	192.168.2.4
Jan 31, 2022 09:38:18.946216106 CET	49818	443	192.168.2.4	86.59.21.38
Jan 31, 2022 09:38:18.946237087 CET	443	49818	86.59.21.38	192.168.2.4
Jan 31, 2022 09:38:19.041301012 CET	49818	443	192.168.2.4	86.59.21.38
Jan 31, 2022 09:38:40.708116055 CET	49812	443	192.168.2.4	199.249.230.83
Jan 31, 2022 09:38:40.708173037 CET	49817	443	192.168.2.4	50.7.74.174
Jan 31, 2022 09:38:40.708266020 CET	49815	443	192.168.2.4	81.7.16.182
Jan 31, 2022 09:38:40.708296061 CET	49818	443	192.168.2.4	86.59.21.38
Jan 31, 2022 09:38:46.464920044 CET	49852	443	192.168.2.4	31.185.104.19
Jan 31, 2022 09:38:46.465004921 CET	443	49852	31.185.104.19	192.168.2.4
Jan 31, 2022 09:38:46.465133905 CET	49852	443	192.168.2.4	31.185.104.19
Jan 31, 2022 09:38:46.500283957 CET	49852	443	192.168.2.4	31.185.104.19
Jan 31, 2022 09:38:46.500341892 CET	443	49852	31.185.104.19	192.168.2.4
Jan 31, 2022 09:38:47.328659058 CET	49853	443	192.168.2.4	178.33.183.251
Jan 31, 2022 09:38:47.328731060 CET	443	49853	178.33.183.251	192.168.2.4
Jan 31, 2022 09:38:47.328921080 CET	49853	443	192.168.2.4	178.33.183.251
Jan 31, 2022 09:38:47.332000971 CET	49853	443	192.168.2.4	178.33.183.251
Jan 31, 2022 09:38:47.332032919 CET	443	49853	178.33.183.251	192.168.2.4
Jan 31, 2022 09:38:47.431303978 CET	443	49853	178.33.183.251	192.168.2.4
Jan 31, 2022 09:38:47.431401968 CET	49853	443	192.168.2.4	178.33.183.251
Jan 31, 2022 09:38:47.434954882 CET	49853	443	192.168.2.4	178.33.183.251
Jan 31, 2022 09:38:47.434983015 CET	443	49853	178.33.183.251	192.168.2.4
Jan 31, 2022 09:38:47.435153961 CET	443	49853	178.33.183.251	192.168.2.4
Jan 31, 2022 09:38:47.435303926 CET	49853	443	192.168.2.4	178.33.183.251
Jan 31, 2022 09:38:47.477878094 CET	443	49853	178.33.183.251	192.168.2.4
Jan 31, 2022 09:38:47.481235027 CET	49853	443	192.168.2.4	178.33.183.251
Jan 31, 2022 09:38:47.481259108 CET	443	49853	178.33.183.251	192.168.2.4
Jan 31, 2022 09:38:47.528139114 CET	49853	443	192.168.2.4	178.33.183.251
Jan 31, 2022 09:38:49.357774973 CET	49854	443	192.168.2.4	5.45.111.149
Jan 31, 2022 09:38:49.357882023 CET	443	49854	5.45.111.149	192.168.2.4
Jan 31, 2022 09:38:49.357975960 CET	49854	443	192.168.2.4	5.45.111.149
Jan 31, 2022 09:38:49.372744083 CET	49854	443	192.168.2.4	5.45.111.149
Jan 31, 2022 09:38:49.372791052 CET	443	49854	5.45.111.149	192.168.2.4
Jan 31, 2022 09:38:49.465971947 CET	443	49854	5.45.111.149	192.168.2.4
Jan 31, 2022 09:38:49.466094971 CET	49854	443	192.168.2.4	5.45.111.149
Jan 31, 2022 09:38:49.468466997 CET	49854	443	192.168.2.4	5.45.111.149
Jan 31, 2022 09:38:49.468498945 CET	443	49854	5.45.111.149	192.168.2.4
Jan 31, 2022 09:38:49.468669891 CET	443	49854	5.45.111.149	192.168.2.4
Jan 31, 2022 09:38:49.468698025 CET	49854	443	192.168.2.4	5.45.111.149
Jan 31, 2022 09:38:49.509881973 CET	443	49854	5.45.111.149	192.168.2.4
Jan 31, 2022 09:38:49.512609959 CET	49854	443	192.168.2.4	5.45.111.149
Jan 31, 2022 09:38:49.512653112 CET	443	49854	5.45.111.149	192.168.2.4
Jan 31, 2022 09:38:49.559520006 CET	49854	443	192.168.2.4	5.45.111.149
Jan 31, 2022 09:39:07.760787964 CET	49852	443	192.168.2.4	31.185.104.19
Jan 31, 2022 09:39:07.760914087 CET	49854	443	192.168.2.4	5.45.111.149
Jan 31, 2022 09:39:07.760946989 CET	49853	443	192.168.2.4	178.33.183.251

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 31, 2022 09:38:08.859209061 CET	49257	53	192.168.2.4	8.8.8.8
Jan 31, 2022 09:38:08.878196001 CET	53	49257	8.8.8.8	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Jan 31, 2022 09:38:08.859209061 CET	192.168.2.4	8.8.8.8	0x8e42	Standard query (0)	myexternalip.com	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Jan 31, 2022 09:37:22.876281023 CET	8.8.8.8	192.168.2.4	0x52b2	No error (0)	a-0019.a.dns.azurefd.net	a-0019.standard.a-msedge.net		CNAME (Canonical name)	IN (0x0001)
Jan 31, 2022 09:38:08.878196001 CET	8.8.8.8	192.168.2.4	0x8e42	No error (0)	myexternalip.com		34.117.59.81	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

myexternalip.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.4	49796	34.117.59.81	443	C:\Users\user\Desktop\25hBQ7XDkh.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	62.141.38.69	443	192.168.2.4	49762	C:\Users\user\AppData\Local\ea242c1c\tor\windowsconnect.exe

Timestamp	kBytes transferred	Direction	Data
Jan 31, 2022 09:37:15.950691938 CET	1194	IN	HTTP/1.1 400 Bad Request Date: Mon, 31 Jan 2022 08:37:15 GMT Server: Apache Content-Length: 317 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 64 72 65 61 6d 79 2d 6d 6f 6e 74 61 6c 63 69 6e 69 2e 38 31 2d 33 30 2d 31 35 39 2d 33 38 2e 70 6c 65 73 6b 2e 70 61 67 65 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p><hr><address>Apache Server at dreamy-montalcini.81-30-159-38.plesk.page Port 80</address></body></html>

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.4	49796	34.117.59.81	443	C:\Users\user\Desktop\25hBQ7XDkh.exe

Timestamp	Direction	Data
2022-01-31 08:38:09 UTC	OUT	GET /raw HTTP/1.1 User-Agent: CaRlRYX64HuI7K7sZXtCvMVCe8LGo1bP Host: myexternalip.com Cache-Control: no-cache
2022-01-31 08:38:09 UTC	IN	HTTP/1.1 200 OK x-cloud-trace-context: 11da27eda4de0ea0e8129154f587b8b6/4511654265942718365 access-control-allow-origin: * content-type: text/html; charset=utf-8 content-length: 14 date: Mon, 31 Jan 2022 08:38:09 GMT x-envoy-upstream-service-time: 4 Via: 1.1 google Alt-Svc: clear Connection: close
2022-01-31 08:38:09 UTC	IN	Data Raw: 31 30 32 2e 31 32 39 2e 31 34 33 2e 36 31 Data Ascii: 102.129.143.61

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: 25hBQ7XDkh.exePID: 796, Parent PID: 5224

General

Target ID:	0
Start time:	09:37:03
Start date:	31/01/2022
Path:	C:\Users\user\Desktop\25hBQ7XDkh.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\25hBQ7XDkh.exe"
Imagebase:	0x400000
File size:	8151557 bytes
MD5 hash:	669C9C7805726EAD633B2539C0885EE9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: windowsconnect.exePID: 1364, Parent PID: 796

General

Target ID:	4
Start time:	09:37:11
Start date:	31/01/2022
Path:	C:\Users\user\AppData\Local\ea242c1c\tor\windowsconnect.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\ea242c1c\tor\windowsconnect.exe" -f torrc
Imagebase:	0xbd0000
File size:	996352 bytes
MD5 hash:	5CFE61FF895C7DAA889708665EF05D7B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira
Reputation:	moderate

Show Windows behavior

Chronological Activities

Analysis Process: windowsconnect.exePID: 6892, Parent PID: 796

General

Target ID:	12
Start time:	09:38:01
Start date:	31/01/2022
Path:	C:\Users\user\AppData\Local\ea242c1c\tor\windowsconnect.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\ea242c1c\tor\windowsconnect.exe" -f torrc
Imagebase:	0xbd0000
File size:	996352 bytes
MD5 hash:	5CFE61FF895C7DAA889708665EF05D7B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Show Windows behavior

Chronological Activities

Analysis Process: windowsconnect.exePID: 7072, Parent PID: 796

General

Target ID:	13
Start time:	09:38:10
Start date:	31/01/2022
Path:	C:\Users\user\AppData\Local\ea242c1c\tor\windowsconnect.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\ea242c1c\tor\windowsconnect.exe" -f torrc
Imagebase:	0xbd0000
File size:	996352 bytes
MD5 hash:	5CFE61FF895C7DAA889708665EF05D7B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Show Windows behavior

Chronological Activities

Analysis Process: windowsconnect.exePID: 6152, Parent PID: 796

General

Target ID:	14
Start time:	09:38:11
Start date:	31/01/2022
Path:	C:\Users\user\AppData\Local\ea242c1c\tor\windowsconnect.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\ea242c1c\tor\windowsconnect.exe" -f torrc
Imagebase:	0xbd0000
File size:	996352 bytes
MD5 hash:	5CFE61FF895C7DAA889708665EF05D7B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Show Windows behavior

Chronological Activities

Analysis Process: windowsconnect.exePID: 5504, Parent PID: 796

General

Target ID:	17
Start time:	09:38:38
Start date:	31/01/2022
Path:	C:\Users\user\AppData\Local\ea242c1c\tor\windowsconnect.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\ea242c1c\tor\windowsconnect.exe" -f torrc
Imagebase:	0xbd0000
File size:	996352 bytes
MD5 hash:	5CFE61FF895C7DAA889708665EF05D7B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Show Windows behavior

Chronological Activities

Analysis Process: windowsconnect.exePID: 6432, Parent PID: 796

General

Target ID:	19
Start time:	09:38:43
Start date:	31/01/2022
Path:	C:\Users\user\AppData\Local\ea242c1c\tor\windowsconnect.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\ea242c1c\tor\windowsconnect.exe" -f torrc
Imagebase:	0xbd0000
File size:	996352 bytes
MD5 hash:	5CFE61FF895C7DAA889708665EF05D7B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Show Windows behavior

Chronological Activities

Analysis Process: windowsconnect.exePID: 6304, Parent PID: 796

General

Target ID:	21
Start time:	09:39:05
Start date:	31/01/2022
Path:	C:\Users\user\AppData\Local\ea242c1c\tor\windowsconnect.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\ea242c1c\tor\windowsconnect.exe" -f torrc
Imagebase:	0xbd0000
File size:	996352 bytes
MD5 hash:	5CFE61FF895C7DAA889708665EF05D7B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Analysis Process: 25hBQ7XDkh.exePID: 796, Parent PID: 5224COMMON

Execution Graph

Execution Coverage:	12%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	4.8%
Total number of Nodes:	394
Total number of Limit Nodes:	8

Executed Functions

Function 006909DF Relevance: 7.6, APIs: 5, Instructions: 62
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 70%

			E006909DF(void* __ecx, long _a4) {
				intOrPtr _v0;
				void* _v9;
				long _t12;
				void* _t13;
				struct HINSTANCE__* _t14;
				void* _t24;
				intOrPtr _t26;
				intOrPtr _t27;
				intOrPtr* _t28;

				_t24 = __ecx;
				_t12 = E006A5B61(__ecx);
				if(_t12 == 0) {
					L1:
					_push(_a4);
					_t12 = RtlExitUserThread();
				}
				_t27 =  *((intOrPtr*)(_t12 + 0x360));
				if(_t27 == 0) {
					goto L1;
				}
				_t35 =  *((char*)(_t27 + 0x10));
				if( *((char*)(_t27 + 0x10)) != 0) {
					E006A76CB(_t24, _t35);
				}
				_t13 =  *(_t27 + 8);
				if(_t13 != 0xffffffff && _t13 != 0) {
					CloseHandle(_t13);
				}
				_t14 =  *(_t27 + 0xc);
				if(_t14 == 0xffffffff || _t14 == 0) {
					goto L1;
				}
				FreeLibraryAndExitThread(_t14, _a4); // executed
				asm("int3");
				_push(_t24);
				_push(_t27);
				_t28 = E0069C2D2(_t24, 1, 0x14);
				E0069C32F(0);
				if(_t28 != 0) {
					_t26 = _v0;
					 *(_t28 + 4) = _a4;
					_t10 = _t28 + 0xc; // 0xc
					 *_t28 = _t26;
					 *0x6db370(4, _t26, _t10);
				}
				E006909A8(0);
				return _t28;
			}

0x006909df
0x006909e5
0x006909ec
0x006909ee
0x006909ee
0x006909f1
0x006909f1
0x006909f7
0x006909ff
0x00000000
0x00000000
0x00690a01
0x00690a05
0x00690a07
0x00690a07
0x00690a0c
0x00690a12
0x00690a19
0x00690a19
0x00690a1f
0x00690a25
0x00000000
0x00000000
0x00690a2f
0x00690a35
0x00690a3b
0x00690a3c
0x00690a48
0x00690a4a
0x00690a54
0x00690a59
0x00690a5c
0x00690a5f
0x00690a66
0x00690a68
0x00690a68
0x00690a73
0x00690a7e

APIs

Part of subcall function 006A5B61: GetLastError.KERNEL32(?,?,?,00697CE2,0069C324,?,006A5B0B,00000001,00000364,?,00690950,007815A8,00000010), ref: 006A5B66
Part of subcall function 006A5B61: _free.LIBCMT ref: 006A5B9B
Part of subcall function 006A5B61: SetLastError.KERNEL32(00000000), ref: 006A5BCF

RtlExitUserThread.KERNEL32(?,?,?,00690B9D,?,?,00690988,00000000), ref: 006909F1
CloseHandle.KERNEL32(?,?,?,00690B9D,?,?,00690988,00000000), ref: 00690A19
FreeLibraryAndExitThread.KERNEL32(?,?,?,?,00690B9D,?,?,00690988,00000000), ref: 00690A2F
_free.LIBCMT ref: 00690A4A
GetModuleHandleExW.KERNEL32(00000004,?,0000000C), ref: 00690A68

Memory Dump Source

Source File: 00000000.00000002.930900807.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.930881205.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.931184608.00000000006DB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.931264527.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.931270586.0000000000787000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.931275812.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.931281713.000000000078B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.931290749.0000000000797000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.931301227.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.931306896.00000000007A3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_25hBQ7XDkh.jbxd

Similarity

API ID: ErrorExitHandleLastThread_free$CloseFreeLibraryModuleUser
String ID:
API String ID: 3471310335-0
Opcode ID: 77535378c1adb5f8772da14540c27299861219e818654b8a322aa21e1f2fd943
Instruction ID: f49a125cd38ed49b8e15b69da28c82297ee64ef35b6c8b08bc5d25d91c352ab3
Opcode Fuzzy Hash: 77535378c1adb5f8772da14540c27299861219e818654b8a322aa21e1f2fd943
Instruction Fuzzy Hash: 45118231900708AFEF209B64CC0ABAA779EAF01720F055619FD5997B92DB71ED4086D0

Uniqueness

Uniqueness Score: -1.00%

Function 006A47A0 Relevance: 4.7, APIs: 3, Instructions: 186
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 97%

			E006A47A0(void* __fp0, signed int _a4, void* _a8, signed int _a12) {
				signed int _v8;
				long _v12;
				struct _OVERLAPPED* _v16;
				long _v20;
				char _v24;
				signed int _v28;
				signed int _v32;
				intOrPtr _v36;
				signed int _v40;
				signed int _v44;
				intOrPtr _v48;
				void* _v52;
				void* __ebx;
				signed int _t62;
				intOrPtr _t66;
				signed char _t68;
				signed int _t69;
				signed int _t71;
				signed int _t73;
				signed int _t74;
				signed int _t75;
				signed int _t76;
				intOrPtr _t78;
				signed int _t80;
				signed int _t84;
				signed int _t87;
				signed int _t101;
				signed int _t102;
				signed int _t105;
				intOrPtr _t107;
				signed int _t112;
				signed int _t114;
				void* _t116;
				signed int _t120;
				signed int _t123;
				signed int _t125;
				void* _t126;
				void* _t131;

				_t131 = __fp0;
				_t62 =  *0x788bc8; // 0xf9aee04f
				_v8 = _t62 ^ _t125;
				_t105 = _a12;
				_v12 = _t105;
				_t120 = _a4;
				_t116 = _a8;
				_v52 = _t116;
				if(_t105 != 0) {
					__eflags = _t116;
					if(_t116 != 0) {
						_t101 = _t120 >> 6;
						_t114 = (_t120 & 0x0000003f) * 0x30;
						_v32 = _t101;
						_t66 =  *((intOrPtr*)(0x799c58 + _t101 * 4));
						_v48 = _t66;
						_v28 = _t114;
						_t102 =  *((intOrPtr*)(_t66 + _t114 + 0x29));
						__eflags = _t102 - 2;
						if(_t102 == 2) {
							L6:
							_t68 =  !_t105;
							__eflags = _t68 & 0x00000001;
							if((_t68 & 0x00000001) != 0) {
								_t66 = _v48;
								L9:
								__eflags =  *(_t66 + _t114 + 0x28) & 0x00000020;
								if(__eflags != 0) {
									E006A0182(_t120, 0, 0, 2);
									_t126 = _t126 + 0x10;
								}
								_t69 = E006A4345(_t102, _t114, __eflags, _t131, _t120);
								__eflags = _t69;
								if(_t69 == 0) {
									_t107 =  *((intOrPtr*)(0x799c58 + _v32 * 4));
									_t71 = _v28;
									__eflags =  *(_t107 + _t71 + 0x28) & 0x00000080;
									if(( *(_t107 + _t71 + 0x28) & 0x00000080) == 0) {
										_v24 = 0;
										_v20 = 0;
										_v16 = 0;
										_t73 = WriteFile( *(_t107 + _t71 + 0x18), _t116, _v12,  &_v20, 0); // executed
										__eflags = _t73;
										if(_t73 == 0) {
											_v24 = GetLastError();
										}
										goto L28;
									}
									_t84 = _t102;
									__eflags = _t84;
									if(_t84 == 0) {
										E006A43BB( &_v24, _t120, _t116, _v12);
										goto L17;
									}
									_t87 = _t84 - 1;
									__eflags = _t87;
									if(_t87 == 0) {
										_t86 = E006A4588( &_v24, _t120, _t116, _v12);
										goto L17;
									}
									__eflags = _t87 != 1;
									if(_t87 != 1) {
										goto L34;
									}
									_t86 = E006A449A( &_v24, _t120, _t116, _v12);
									goto L17;
								} else {
									__eflags = _t102;
									if(_t102 == 0) {
										_t86 = E006A4125(_t131,  &_v24, _t120, _t116, _v12);
										L17:
										L15:
										L28:
										asm("movsd");
										asm("movsd");
										asm("movsd");
										_t74 = _v40;
										__eflags = _t74;
										if(_t74 != 0) {
											_t75 = _t74 - _v36;
											__eflags = _t75;
											L40:
											L41:
											E00686062();
											return _t75;
										}
										_t76 = _v44;
										__eflags = _t76;
										if(_t76 == 0) {
											_t116 = _v52;
											L34:
											_t112 = _v28;
											_t78 =  *((intOrPtr*)(0x799c58 + _v32 * 4));
											__eflags =  *(_t78 + _t112 + 0x28) & 0x00000040;
											if(( *(_t78 + _t112 + 0x28) & 0x00000040) == 0) {
												L37:
												 *((intOrPtr*)(E00697CDD())) = 0x1c;
												_t80 = E00697CCA();
												 *_t80 =  *_t80 & 0x00000000;
												__eflags =  *_t80;
												L38:
												_t75 = _t80 | 0xffffffff;
												goto L40;
											}
											__eflags =  *_t116 - 0x1a;
											if( *_t116 != 0x1a) {
												goto L37;
											}
											_t75 = 0;
											goto L40;
										}
										_t123 = 5;
										__eflags = _t76 - _t123;
										if(_t76 != _t123) {
											_t80 = E00697CA7(_t76);
										} else {
											 *((intOrPtr*)(E00697CDD())) = 9;
											_t80 = E00697CCA();
											 *_t80 = _t123;
										}
										goto L38;
									}
									__eflags = _t102 - 1 - 1;
									if(_t102 - 1 > 1) {
										goto L34;
									}
									E006A42D8( &_v24, _t116, _v12);
									goto L15;
								}
							}
							 *(E00697CCA()) =  *_t94 & 0x00000000;
							 *((intOrPtr*)(E00697CDD())) = 0x16;
							_t80 = E0069084C();
							goto L38;
						}
						__eflags = _t102 - 1;
						if(_t102 != 1) {
							goto L9;
						}
						goto L6;
					}
					 *(E00697CCA()) =  *_t96 & _t116;
					 *((intOrPtr*)(E00697CDD())) = 0x16;
					_t75 = E0069084C() | 0xffffffff;
					goto L41;
				}
				_t75 = 0;
				goto L41;
			}

0x006a47a0
0x006a47a8
0x006a47af
0x006a47b2
0x006a47b5
0x006a47b9
0x006a47bd
0x006a47c0
0x006a47c5
0x006a47ce
0x006a47d0
0x006a47f6
0x006a47fc
0x006a47ff
0x006a4802
0x006a4809
0x006a480c
0x006a480f
0x006a4813
0x006a4816
0x006a481d
0x006a481f
0x006a4821
0x006a4823
0x006a4842
0x006a4845
0x006a4845
0x006a484a
0x006a4853
0x006a4858
0x006a4858
0x006a485c
0x006a4862
0x006a4864
0x006a48a2
0x006a48a9
0x006a48ac
0x006a48b1
0x006a4900
0x006a4903
0x006a4906
0x006a4912
0x006a4918
0x006a491a
0x006a4922
0x006a4922
0x00000000
0x006a4925
0x006a48b6
0x006a48b6
0x006a48b9
0x006a48f2
0x00000000
0x006a48f2
0x006a48bb
0x006a48bb
0x006a48be
0x006a48e2
0x00000000
0x006a48e2
0x006a48c0
0x006a48c3
0x00000000
0x00000000
0x006a48d2
0x00000000
0x006a4866
0x006a4866
0x006a4868
0x006a4895
0x006a489a
0x006a4885
0x006a4928
0x006a492b
0x006a492c
0x006a492d
0x006a492e
0x006a4931
0x006a4933
0x006a4998
0x006a4998
0x006a499b
0x006a499c
0x006a49a3
0x006a49ab
0x006a49ab
0x006a4935
0x006a4938
0x006a493a
0x006a4960
0x006a4963
0x006a4966
0x006a4969
0x006a4970
0x006a4975
0x006a4980
0x006a4985
0x006a498b
0x006a4990
0x006a4990
0x006a4993
0x006a4993
0x00000000
0x006a4993
0x006a4977
0x006a497a
0x00000000
0x00000000
0x006a497c
0x00000000
0x006a497c
0x006a493e
0x006a493f
0x006a4941
0x006a4958
0x006a4943
0x006a4948
0x006a494e
0x006a4953
0x006a4953
0x00000000
0x006a4941
0x006a486c
0x006a486f
0x00000000
0x00000000
0x006a487d
0x00000000
0x006a4882
0x006a4864
0x006a482a
0x006a4832
0x006a4838
0x00000000
0x006a4838
0x006a4818
0x006a481b
0x00000000
0x00000000
0x00000000
0x006a481b
0x006a47d7
0x006a47de
0x006a47e9
0x00000000
0x006a47e9
0x006a47c7
0x00000000

Memory Dump Source

Source File: 00000000.00000002.930900807.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.930881205.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.931184608.00000000006DB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.931264527.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.931270586.0000000000787000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.931275812.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.931281713.000000000078B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.931290749.0000000000797000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.931301227.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.931306896.00000000007A3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_25hBQ7XDkh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e718c2708cf8c8421ff9b6e8454bd2a024a603b108787cce1ed059c5b326079d
Instruction ID: 84e563a00275b53ebe347e9eef9e0593ec25320f8a6e1321107d192fdaca9350
Opcode Fuzzy Hash: e718c2708cf8c8421ff9b6e8454bd2a024a603b108787cce1ed059c5b326079d
Instruction Fuzzy Hash: 0651A071D04249EEDF14AFA8DC45BEF7BBAAF86310F14015AE400A7292DBB59D01CF65

Uniqueness

Uniqueness Score: -1.00%

Function 0069092B Relevance: 3.0, APIs: 2, Instructions: 38
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 51%

			E0069092B(void* __ebx, void* __ecx, void* __edx, void* __edi, void* __fp0) {
				void* _t11;
				void* _t13;
				signed int _t18;
				void* _t24;
				void* _t29;
				intOrPtr* _t31;
				void* _t33;
				void* _t38;

				_t38 = __fp0;
				_t29 = __edx;
				_t24 = __ecx;
				_t23 = __ebx;
				E006B5660(__ebx, __edi, 0x7815a8, 0x10);
				_t31 =  *((intOrPtr*)(_t33 + 8));
				if(_t31 == 0) {
					_push(GetLastError());
					RtlExitUserThread();
				}
				 *((intOrPtr*)(E006A5ADD(_t23, _t24, _t29, _t38) + 0x360)) = _t31;
				_t11 = E006A7884(_t24);
				_t35 = _t11;
				if(_t11 != 0) {
					_t18 = E006A7679(_t24, _t35, 1);
					asm("sbb al, al");
					 *((char*)(_t31 + 0x10)) =  ~_t18 + 1;
				}
				 *(_t33 - 4) =  *(_t33 - 4) & 0x00000000;
				 *0x6db3d8( *((intOrPtr*)(_t31 + 4))); // executed
				_t13 =  *((intOrPtr*)( *_t31))(); // executed
				_push(_t13); // executed
				E00690B90( *_t31); // executed
				 *((intOrPtr*)(_t33 - 0x20)) =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t33 - 0x14))))));
				return E006A0E30( *((intOrPtr*)(_t33 - 0x14)),  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t33 - 0x14)))))),  *((intOrPtr*)(_t33 - 0x14)));
			}

0x0069092b
0x0069092b
0x0069092b
0x0069092b
0x00690932
0x00690937
0x0069093c
0x00690944
0x00690945
0x00690945
0x00690950
0x00690956
0x0069095b
0x0069095d
0x00690961
0x00690968
0x0069096c
0x0069096c
0x0069096f
0x0069097a
0x00690980
0x00690982
0x00690983
0x0069098f
0x0069099b

APIs

GetLastError.KERNEL32(007815A8,00000010), ref: 0069093E
RtlExitUserThread.KERNEL32(00000000), ref: 00690945

Memory Dump Source

Source File: 00000000.00000002.930900807.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.930881205.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.931184608.00000000006DB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.931264527.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.931270586.0000000000787000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.931275812.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.931281713.000000000078B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.931290749.0000000000797000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.931301227.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.931306896.00000000007A3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_25hBQ7XDkh.jbxd

Similarity

API ID: ErrorExitLastThreadUser
String ID:
API String ID: 1750398979-0
Opcode ID: 2ff7f028939124450d498acea009615c6551a1c05505b39584808749029460e1
Instruction ID: c5e2f8ddf86750065777fd284bdf99bf4d2d09e9a71842b10c5adf959f3477e2
Opcode Fuzzy Hash: 2ff7f028939124450d498acea009615c6551a1c05505b39584808749029460e1
Instruction Fuzzy Hash: 6FF0AF71940604AFEB04BFB0C80ABAE3BA6FF45750F151549F4165B2A2CB756C01DBA5

Uniqueness

Uniqueness Score: -1.00%

Function 0069C2D2 Relevance: 1.5, APIs: 1, Instructions: 39
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 95%

			E0069C2D2(void* __ecx, signed int _a4, signed int _a8) {
				void* _t8;
				void* _t12;
				signed int _t13;
				void* _t15;
				signed int _t18;
				long _t19;

				_t15 = __ecx;
				_t18 = _a4;
				if(_t18 == 0) {
					L2:
					_t19 = _t18 * _a8;
					if(_t19 == 0) {
						_t19 = _t19 + 1;
					}
					while(1) {
						_t8 = RtlAllocateHeap( *0x79a010, 8, _t19); // executed
						if(_t8 != 0) {
							break;
						}
						__eflags = E006A2EB8();
						if(__eflags == 0) {
							L8:
							 *((intOrPtr*)(E00697CDD())) = 0xc;
							__eflags = 0;
							return 0;
						}
						_t12 = E006A0D9A(_t15, __eflags, _t19);
						_pop(_t15);
						__eflags = _t12;
						if(_t12 == 0) {
							goto L8;
						}
					}
					return _t8;
				}
				_t13 = 0xffffffe0;
				if(_t13 / _t18 < _a8) {
					goto L8;
				}
				goto L2;
			}

0x0069c2d2
0x0069c2d8
0x0069c2dd
0x0069c2eb
0x0069c2eb
0x0069c2f1
0x0069c2f3
0x0069c2f3
0x0069c30a
0x0069c313
0x0069c31b
0x00000000
0x00000000
0x0069c2fb
0x0069c2fd
0x0069c31f
0x0069c324
0x0069c32a
0x00000000
0x0069c32a
0x0069c300
0x0069c305
0x0069c306
0x0069c308
0x00000000
0x00000000
0x0069c308
0x00000000
0x0069c30a
0x0069c2e3
0x0069c2e9
0x00000000
0x00000000
0x00000000

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,006A5B0B,00000001,00000364,?,00690950,007815A8,00000010), ref: 0069C313

Memory Dump Source

Source File: 00000000.00000002.930900807.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.930881205.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.931184608.00000000006DB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.931264527.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.931270586.0000000000787000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.931275812.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.931281713.000000000078B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.931290749.0000000000797000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.931301227.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.931306896.00000000007A3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_25hBQ7XDkh.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: f566925bbe1211c351f591495fe76d0652ae26772affd0bf4a7b215b627921e9
Instruction ID: c5b0fd8e28296b8d1645b96dedcf41a46205053b2525d41a0e0d36f36cc41a39
Opcode Fuzzy Hash: f566925bbe1211c351f591495fe76d0652ae26772affd0bf4a7b215b627921e9
Instruction Fuzzy Hash: 88F0E932655224ABDF21AB799C05B9B374FBF417B0B14C016E914EAA90CA30ED0186E4

Uniqueness

Uniqueness Score: -1.00%

Function 0069CC9E Relevance: 1.5, APIs: 1, Instructions: 32
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 94%

			E0069CC9E(void* __ecx, long _a4) {
				void* _t4;
				void* _t6;
				void* _t7;
				long _t8;

				_t7 = __ecx;
				_t8 = _a4;
				if(_t8 > 0xffffffe0) {
					L7:
					 *((intOrPtr*)(E00697CDD())) = 0xc;
					__eflags = 0;
					return 0;
				}
				if(_t8 == 0) {
					_t8 = _t8 + 1;
				}
				while(1) {
					_t4 = RtlAllocateHeap( *0x79a010, 0, _t8); // executed
					if(_t4 != 0) {
						break;
					}
					__eflags = E006A2EB8();
					if(__eflags == 0) {
						goto L7;
					}
					_t6 = E006A0D9A(_t7, __eflags, _t8);
					_pop(_t7);
					__eflags = _t6;
					if(_t6 == 0) {
						goto L7;
					}
				}
				return _t4;
			}

0x0069cc9e
0x0069cca4
0x0069ccaa
0x0069ccdc
0x0069cce1
0x0069cce7
0x00000000
0x0069cce7
0x0069ccae
0x0069ccb0
0x0069ccb0
0x0069ccc7
0x0069ccd0
0x0069ccd8
0x00000000
0x00000000
0x0069ccb8
0x0069ccba
0x00000000
0x00000000
0x0069ccbd
0x0069ccc2
0x0069ccc3
0x0069ccc5
0x00000000
0x00000000
0x0069ccc5
0x00000000

APIs

RtlAllocateHeap.NTDLL(00000000,00000003,00000003,?,006A699C,00001000,00000000,?,?,?,0069C43B,00000000,00000000,00000000,?,?), ref: 0069CCD0

Memory Dump Source

Source File: 00000000.00000002.930900807.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.930881205.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.931184608.00000000006DB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.931264527.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.931270586.0000000000787000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.931275812.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.931281713.000000000078B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.931290749.0000000000797000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.931301227.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.931306896.00000000007A3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_25hBQ7XDkh.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 2ae3762194045be305def23794c437faad688501062de1195c208568a169b3b8
Instruction ID: 872e74f3bec45d61efc3d855af82d43ec76cb71cb7be990554a0f85176d2b86a
Opcode Fuzzy Hash: 2ae3762194045be305def23794c437faad688501062de1195c208568a169b3b8
Instruction Fuzzy Hash: D4E0A0221C1611DADF203A655D00B9B2F4EAB023B1F050112A81C9AE81DB208C0182A4

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00690682 Relevance: 4.6, APIs: 3, Instructions: 78
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 84%

			E00690682(intOrPtr __ebx, intOrPtr __edx, intOrPtr __esi, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				char _v0;
				signed int _v8;
				intOrPtr _v524;
				intOrPtr _v528;
				void* _v532;
				intOrPtr _v536;
				char _v540;
				intOrPtr _v544;
				intOrPtr _v548;
				intOrPtr _v552;
				intOrPtr _v556;
				intOrPtr _v560;
				intOrPtr _v564;
				intOrPtr _v568;
				intOrPtr _v572;
				intOrPtr _v576;
				intOrPtr _v580;
				intOrPtr _v584;
				char _v724;
				intOrPtr _v792;
				intOrPtr _v800;
				char _v804;
				struct _EXCEPTION_POINTERS _v812;
				signed int _t40;
				char* _t47;
				char* _t49;
				long _t57;
				intOrPtr _t59;
				intOrPtr _t60;
				intOrPtr _t64;
				intOrPtr _t65;
				int _t66;
				intOrPtr _t68;
				signed int _t70;
				signed int _t72;

				_t68 = __esi;
				_t64 = __edx;
				_t59 = __ebx;
				_t70 = _t72;
				_t40 =  *0x788bc8; // 0xf9aee04f
				_t41 = _t40 ^ _t70;
				_v8 = _t40 ^ _t70;
				_push(_t65);
				if(_a4 != 0xffffffff) {
					_push(_a4);
					E0068737D(_t41);
					_pop(_t60);
				}
				E005019AD( &_v804, 0, 0x50);
				E005019AD( &_v724, 0, 0x2cc);
				_v812.ExceptionRecord =  &_v804;
				_t47 =  &_v724;
				_v812.ContextRecord = _t47;
				_v548 = _t47;
				_v552 = _t60;
				_v556 = _t64;
				_v560 = _t59;
				_v564 = _t68;
				_v568 = _t65;
				_v524 = ss;
				_v536 = cs;
				_v572 = ds;
				_v576 = es;
				_v580 = fs;
				_v584 = gs;
				asm("pushfd");
				_pop( *_t22);
				_v540 = _v0;
				_t49 =  &_v0;
				_v528 = _t49;
				_v724 = 0x10001;
				_v544 =  *((intOrPtr*)(_t49 - 4));
				_v804 = _a8;
				_v800 = _a12;
				_v792 = _v0;
				_t66 = IsDebuggerPresent();
				SetUnhandledExceptionFilter(0);
				_t57 = UnhandledExceptionFilter( &_v812);
				if(_t57 == 0 && _t66 == 0 && _a4 != 0xffffffff) {
					_push(_a4);
					_t57 = E0068737D(_t57);
				}
				E00686062();
				return _t57;
			}

0x00690682
0x00690682
0x00690682
0x00690685
0x0069068d
0x00690692
0x00690694
0x0069069b
0x0069069c
0x0069069e
0x006906a1
0x006906a6
0x006906a6
0x006906b2
0x006906c5
0x006906d3
0x006906d9
0x006906df
0x006906e5
0x006906eb
0x006906f1
0x006906f7
0x006906fd
0x00690703
0x00690709
0x00690710
0x00690717
0x0069071e
0x00690725
0x0069072c
0x00690733
0x00690734
0x0069073d
0x00690743
0x00690746
0x0069074c
0x00690759
0x00690762
0x0069076b
0x00690774
0x00690782
0x00690784
0x00690791
0x00690799
0x006907a5
0x006907a8
0x006907ad
0x006907b4
0x006907bc

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,00000000), ref: 0069077A
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 00690784
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,00000000), ref: 00690791

Memory Dump Source

Source File: 00000000.00000002.930900807.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.930881205.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.931184608.00000000006DB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.931264527.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.931270586.0000000000787000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.931275812.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.931281713.000000000078B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.931290749.0000000000797000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.931301227.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.931306896.00000000007A3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_25hBQ7XDkh.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 0bf472ad658144c51ca73cca23dde1ff2b2cea6b56bd1563d41c152cd061f5ec
Instruction ID: ebeffb25e89b0ce2d90b3cf457a5d483e7a2c3651c39d3f849ff7e0d414397bf
Opcode Fuzzy Hash: 0bf472ad658144c51ca73cca23dde1ff2b2cea6b56bd1563d41c152cd061f5ec
Instruction Fuzzy Hash: 7F31D774901218DBCB21DF64DD897DCBBB9BF08310F5041EAE41CA6250E7709F858F45

Uniqueness

Uniqueness Score: -1.00%

Function 006A043C Relevance: 4.5, APIs: 3, Instructions: 20
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E006A043C(int _a4) {
				void* _t14;

				if(E006A7884(_t14) != 0 && ( *( *[fs:0x30] + 0x68) >> 0x00000008 & 0x00000001) == 0) {
					TerminateProcess(GetCurrentProcess(), _a4);
				}
				E006A047D(_t14, _a4);
				ExitProcess(_a4);
			}

0x006a0448
0x006a0464
0x006a0464
0x006a046d
0x006a0476

APIs

GetCurrentProcess.KERNEL32(00000003,?,006A0412,00000003,007818B0,0000000C,006A0525,00000003,00000002,00000000,?,0069C3AB,00000003), ref: 006A045D
TerminateProcess.KERNEL32(00000000,?,006A0412,00000003,007818B0,0000000C,006A0525,00000003,00000002,00000000,?,0069C3AB,00000003), ref: 006A0464
ExitProcess.KERNEL32 ref: 006A0476

Memory Dump Source

Source File: 00000000.00000002.930900807.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.930881205.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.931184608.00000000006DB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.931264527.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.931270586.0000000000787000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.931275812.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.931281713.000000000078B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.931290749.0000000000797000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.931301227.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.931306896.00000000007A3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_25hBQ7XDkh.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 4f63a3f5062e44b5ade328b1f19986cfb78a32154f3751422d0d3639337fa15e
Instruction ID: 5547713d0354ed74c9620ac27845cfe83d0f45a0124aaf7458bd3287cac14602
Opcode Fuzzy Hash: 4f63a3f5062e44b5ade328b1f19986cfb78a32154f3751422d0d3639337fa15e
Instruction Fuzzy Hash: 87E04631401608EBDF117F60DD08A883BABFF46781F019024FA058A232CB35DC52DE80

Uniqueness

Uniqueness Score: -1.00%

Function 006AF18E Relevance: 19.6, APIs: 13, Instructions: 114
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E006AF18E(intOrPtr _a4) {
				intOrPtr _v8;
				intOrPtr _t25;
				intOrPtr* _t26;
				intOrPtr _t28;
				intOrPtr* _t29;
				intOrPtr* _t31;
				intOrPtr* _t45;
				intOrPtr* _t46;
				intOrPtr* _t47;
				intOrPtr* _t55;
				intOrPtr* _t70;
				intOrPtr _t74;

				_t74 = _a4;
				_t25 =  *((intOrPtr*)(_t74 + 0x88));
				if(_t25 != 0 && _t25 != 0x788ce8) {
					_t45 =  *((intOrPtr*)(_t74 + 0x7c));
					if(_t45 != 0 &&  *_t45 == 0) {
						_t46 =  *((intOrPtr*)(_t74 + 0x84));
						if(_t46 != 0 &&  *_t46 == 0) {
							E0069C32F(_t46);
							E006AE52C( *((intOrPtr*)(_t74 + 0x88)));
						}
						_t47 =  *((intOrPtr*)(_t74 + 0x80));
						if(_t47 != 0 &&  *_t47 == 0) {
							E0069C32F(_t47);
							E006AE9E6( *((intOrPtr*)(_t74 + 0x88)));
						}
						E0069C32F( *((intOrPtr*)(_t74 + 0x7c)));
						E0069C32F( *((intOrPtr*)(_t74 + 0x88)));
					}
				}
				_t26 =  *((intOrPtr*)(_t74 + 0x8c));
				if(_t26 != 0 &&  *_t26 == 0) {
					E0069C32F( *((intOrPtr*)(_t74 + 0x90)) - 0xfe);
					E0069C32F( *((intOrPtr*)(_t74 + 0x94)) - 0x80);
					E0069C32F( *((intOrPtr*)(_t74 + 0x98)) - 0x80);
					E0069C32F( *((intOrPtr*)(_t74 + 0x8c)));
				}
				E006AF301( *((intOrPtr*)(_t74 + 0x9c)));
				_t28 = 6;
				_t55 = _t74 + 0xa0;
				_v8 = _t28;
				_t70 = _t74 + 0x28;
				do {
					if( *((intOrPtr*)(_t70 - 8)) != 0x788f30) {
						_t31 =  *_t70;
						if(_t31 != 0 &&  *_t31 == 0) {
							E0069C32F(_t31);
							E0069C32F( *_t55);
						}
						_t28 = _v8;
					}
					if( *((intOrPtr*)(_t70 - 0xc)) != 0) {
						_t29 =  *((intOrPtr*)(_t70 - 4));
						if(_t29 != 0 &&  *_t29 == 0) {
							E0069C32F(_t29);
						}
						_t28 = _v8;
					}
					_t55 = _t55 + 4;
					_t70 = _t70 + 0x10;
					_t28 = _t28 - 1;
					_v8 = _t28;
				} while (_t28 != 0);
				return E0069C32F(_t74);
			}

0x006af196
0x006af19a
0x006af1a2
0x006af1ab
0x006af1b0
0x006af1b7
0x006af1bf
0x006af1c7
0x006af1d2
0x006af1d8
0x006af1d9
0x006af1e1
0x006af1e9
0x006af1f4
0x006af1fa
0x006af1fe
0x006af209
0x006af20f
0x006af1b0
0x006af210
0x006af218
0x006af22b
0x006af23e
0x006af24c
0x006af257
0x006af25c
0x006af265
0x006af26d
0x006af26e
0x006af274
0x006af277
0x006af27a
0x006af281
0x006af283
0x006af287
0x006af28f
0x006af296
0x006af29c
0x006af29d
0x006af29d
0x006af2a4
0x006af2a6
0x006af2ab
0x006af2b3
0x006af2b8
0x006af2b9
0x006af2b9
0x006af2bc
0x006af2bf
0x006af2c2
0x006af2c5
0x006af2c5
0x006af2d7

APIs

___free_lconv_mon.LIBCMT ref: 006AF1D2

Part of subcall function 006AE52C: _free.LIBCMT ref: 006AE549
Part of subcall function 006AE52C: _free.LIBCMT ref: 006AE55B
Part of subcall function 006AE52C: _free.LIBCMT ref: 006AE56D
Part of subcall function 006AE52C: _free.LIBCMT ref: 006AE57F
Part of subcall function 006AE52C: _free.LIBCMT ref: 006AE591
Part of subcall function 006AE52C: _free.LIBCMT ref: 006AE5A3
Part of subcall function 006AE52C: _free.LIBCMT ref: 006AE5B5
Part of subcall function 006AE52C: _free.LIBCMT ref: 006AE5C7
Part of subcall function 006AE52C: _free.LIBCMT ref: 006AE5D9
Part of subcall function 006AE52C: _free.LIBCMT ref: 006AE5EB
Part of subcall function 006AE52C: _free.LIBCMT ref: 006AE5FD
Part of subcall function 006AE52C: _free.LIBCMT ref: 006AE60F
Part of subcall function 006AE52C: _free.LIBCMT ref: 006AE621

_free.LIBCMT ref: 006AF1C7

Part of subcall function 0069C32F: RtlFreeHeap.NTDLL(00000000,00000000,?,006AEC99,?,00000000,?,00000000,?,006AEF3D,?,00000007,?,?,006AF326,?), ref: 0069C345
Part of subcall function 0069C32F: GetLastError.KERNEL32(?,?,006AEC99,?,00000000,?,00000000,?,006AEF3D,?,00000007,?,?,006AF326,?,?), ref: 0069C357

_free.LIBCMT ref: 006AF1E9
_free.LIBCMT ref: 006AF1FE
_free.LIBCMT ref: 006AF209
_free.LIBCMT ref: 006AF22B
_free.LIBCMT ref: 006AF23E
_free.LIBCMT ref: 006AF24C
_free.LIBCMT ref: 006AF257
_free.LIBCMT ref: 006AF28F
_free.LIBCMT ref: 006AF296
_free.LIBCMT ref: 006AF2B3
_free.LIBCMT ref: 006AF2CB

Memory Dump Source

Source File: 00000000.00000002.930900807.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.930881205.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.931184608.00000000006DB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.931264527.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.931270586.0000000000787000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.931275812.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.931281713.000000000078B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.931290749.0000000000797000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.931301227.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.931306896.00000000007A3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_25hBQ7XDkh.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: c11867f1d9ef1479f02bc49b316acceb8425677f44e0271c2be54e949aac5cc6
Instruction ID: ecfac639a77cff9c7eb786c87c3c3b996f68a0256b85ad1fe28179ceaf184909
Opcode Fuzzy Hash: c11867f1d9ef1479f02bc49b316acceb8425677f44e0271c2be54e949aac5cc6
Instruction Fuzzy Hash: 4D317C316003019FEF60BBB9D845B9A73EBEF06320F50982EE448D7661DE31AD418F69

Uniqueness

Uniqueness Score: -1.00%

Function 006A4125 Relevance: 10.7, APIs: 7, Instructions: 152
fileCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 77%

			E006A4125(void* __fp0, intOrPtr* _a4, signed int _a8, signed char* _a12, intOrPtr _a16) {
				signed int _v8;
				signed char _v15;
				char _v16;
				void _v24;
				short _v28;
				char _v31;
				void _v32;
				long _v36;
				intOrPtr _v40;
				void* _v44;
				signed int _v48;
				signed char* _v52;
				long _v56;
				int _v60;
				void* __ebx;
				signed int _t78;
				signed int _t80;
				int _t86;
				void* _t93;
				long _t96;
				void _t104;
				void* _t111;
				signed int _t115;
				signed int _t118;
				signed char _t123;
				signed char _t128;
				intOrPtr _t129;
				signed int _t131;
				signed char* _t133;
				intOrPtr* _t136;
				signed int _t138;
				void* _t139;
				void* _t152;

				_t152 = __fp0;
				_t78 =  *0x788bc8; // 0xf9aee04f
				_v8 = _t78 ^ _t138;
				_t80 = _a8;
				_t118 = _t80 >> 6;
				_t115 = (_t80 & 0x0000003f) * 0x30;
				_t133 = _a12;
				_v52 = _t133;
				_v48 = _t118;
				_v44 =  *((intOrPtr*)( *((intOrPtr*)(0x799c58 + _t118 * 4)) + _t115 + 0x18));
				_v40 = _a16 + _t133;
				_t86 = GetConsoleCP();
				_t136 = _a4;
				_v60 = _t86;
				 *_t136 = 0;
				 *((intOrPtr*)(_t136 + 4)) = 0;
				 *((intOrPtr*)(_t136 + 8)) = 0;
				while(_t133 < _v40) {
					_v28 = 0;
					_v31 =  *_t133;
					_t129 =  *((intOrPtr*)(0x799c58 + _v48 * 4));
					_t123 =  *(_t129 + _t115 + 0x2d);
					if((_t123 & 0x00000004) == 0) {
						if(( *(E0069D0FE(_t115, _t129, _t152) + ( *_t133 & 0x000000ff) * 2) & 0x00008000) == 0) {
							_push(1);
							_push(_t133);
							goto L8;
						} else {
							if(_t133 >= _v40) {
								_t131 = _v48;
								 *((char*)( *((intOrPtr*)(0x799c58 + _t131 * 4)) + _t115 + 0x2e)) =  *_t133;
								 *( *((intOrPtr*)(0x799c58 + _t131 * 4)) + _t115 + 0x2d) =  *( *((intOrPtr*)(0x799c58 + _t131 * 4)) + _t115 + 0x2d) | 0x00000004;
								 *((intOrPtr*)(_t136 + 4)) =  *((intOrPtr*)(_t136 + 4)) + 1;
							} else {
								_t111 = E006A5D80( &_v28, _t133, 2);
								_t139 = _t139 + 0xc;
								if(_t111 != 0xffffffff) {
									_t133 =  &(_t133[1]);
									goto L9;
								}
							}
						}
					} else {
						_t128 = _t123 & 0x000000fb;
						_v16 =  *((intOrPtr*)(_t129 + _t115 + 0x2e));
						_push(2);
						_v15 = _t128;
						 *(_t129 + _t115 + 0x2d) = _t128;
						_push( &_v16);
						L8:
						_push( &_v28);
						_t93 = E006A5D80();
						_t139 = _t139 + 0xc;
						if(_t93 != 0xffffffff) {
							L9:
							_t133 =  &(_t133[1]);
							_t96 = WideCharToMultiByte(_v60, 0,  &_v28, 1,  &_v24, 5, 0, 0);
							_v56 = _t96;
							if(_t96 != 0) {
								if(WriteFile(_v44,  &_v24, _t96,  &_v36, 0) == 0) {
									L19:
									 *_t136 = GetLastError();
								} else {
									 *((intOrPtr*)(_t136 + 4)) =  *((intOrPtr*)(_t136 + 8)) - _v52 + _t133;
									if(_v36 >= _v56) {
										if(_v31 != 0xa) {
											goto L16;
										} else {
											_t104 = 0xd;
											_v32 = _t104;
											if(WriteFile(_v44,  &_v32, 1,  &_v36, 0) == 0) {
												goto L19;
											} else {
												if(_v36 >= 1) {
													 *((intOrPtr*)(_t136 + 8)) =  *((intOrPtr*)(_t136 + 8)) + 1;
													 *((intOrPtr*)(_t136 + 4)) =  *((intOrPtr*)(_t136 + 4)) + 1;
													goto L16;
												}
											}
										}
									}
								}
							}
						}
					}
					goto L20;
					L16:
				}
				L20:
				E00686062();
				return _t136;
			}

0x006a4125
0x006a412d
0x006a4134
0x006a4137
0x006a413f
0x006a4143
0x006a414f
0x006a4152
0x006a4155
0x006a415c
0x006a4164
0x006a4167
0x006a416d
0x006a4173
0x006a4178
0x006a417a
0x006a417d
0x006a4182
0x006a418c
0x006a4193
0x006a4196
0x006a419d
0x006a41a4
0x006a41d0
0x006a41f6
0x006a41f8
0x00000000
0x006a41d2
0x006a41d5
0x006a429c
0x006a42a8
0x006a42b3
0x006a42b8
0x006a41db
0x006a41e2
0x006a41e7
0x006a41ed
0x006a41f3
0x00000000
0x006a41f3
0x006a41ed
0x006a41d5
0x006a41a6
0x006a41aa
0x006a41ad
0x006a41b3
0x006a41b5
0x006a41b8
0x006a41bc
0x006a41f9
0x006a41fc
0x006a41fd
0x006a4202
0x006a4208
0x006a420e
0x006a421d
0x006a4223
0x006a4229
0x006a422e
0x006a424a
0x006a42bd
0x006a42c3
0x006a424c
0x006a4254
0x006a425d
0x006a4263
0x00000000
0x006a4265
0x006a4267
0x006a426a
0x006a4283
0x00000000
0x006a4285
0x006a4289
0x006a428b
0x006a428e
0x00000000
0x006a428e
0x006a4289
0x006a4283
0x006a4263
0x006a425d
0x006a424a
0x006a422e
0x006a4208
0x00000000
0x006a4291
0x006a4291
0x006a42c5
0x006a42cf
0x006a42d7

APIs

GetConsoleCP.KERNEL32(00000000,?,?,?,?,?,?,?,?,006A489A,00000003,?,00000000,?,00000003,0000000C), ref: 006A4167
__fassign.LIBCMT ref: 006A41E2
__fassign.LIBCMT ref: 006A41FD
WideCharToMultiByte.KERNEL32(?,00000000,?,00000001,00000000,00000005,00000000,00000000), ref: 006A4223
WriteFile.KERNEL32(?,00000000,00000000,006A489A,00000000,?,?,?,?,?,?,?,?,?,006A489A,00000003), ref: 006A4242
WriteFile.KERNEL32(?,00000003,00000001,006A489A,00000000,?,?,?,?,?,?,?,?,?,006A489A,00000003), ref: 006A427B

Memory Dump Source

Source File: 00000000.00000002.930900807.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.930881205.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.931184608.00000000006DB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.931264527.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.931270586.0000000000787000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.931275812.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.931281713.000000000078B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.931290749.0000000000797000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.931301227.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.931306896.00000000007A3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_25hBQ7XDkh.jbxd

Similarity

API ID: FileWrite__fassign$ByteCharConsoleMultiWide
String ID:
API String ID: 1324828854-0
Opcode ID: d5f85ff5edc04ad0b86ee98422d2593a44407b3ce5af3745dc13a4d76ef1d8f1
Instruction ID: 121c7447a0a8c5cb6c64f1c72f744ca3932620e6615f30c3252e1095281b2407
Opcode Fuzzy Hash: d5f85ff5edc04ad0b86ee98422d2593a44407b3ce5af3745dc13a4d76ef1d8f1
Instruction Fuzzy Hash: AB518F709002499FDB10DFA8DC45BEEBBFAAF4A300F14415AE551E7251EB70EA41CF65

Uniqueness

Uniqueness Score: -1.00%

Function 006AEF24 Relevance: 10.6, APIs: 7, Instructions: 65
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E006AEF24(intOrPtr _a4) {
				void* _t18;

				_t45 = _a4;
				if(_a4 != 0) {
					E006AEC6B(_t45, 7);
					E006AEC6B(_t45 + 0x1c, 7);
					E006AEC6B(_t45 + 0x38, 0xc);
					E006AEC6B(_t45 + 0x68, 0xc);
					E006AEC6B(_t45 + 0x98, 2);
					E0069C32F( *((intOrPtr*)(_t45 + 0xa0)));
					E0069C32F( *((intOrPtr*)(_t45 + 0xa4)));
					E0069C32F( *((intOrPtr*)(_t45 + 0xa8)));
					E006AEC6B(_t45 + 0xb4, 7);
					E006AEC6B(_t45 + 0xd0, 7);
					E006AEC6B(_t45 + 0xec, 0xc);
					E006AEC6B(_t45 + 0x11c, 0xc);
					E006AEC6B(_t45 + 0x14c, 2);
					E0069C32F( *((intOrPtr*)(_t45 + 0x154)));
					E0069C32F( *((intOrPtr*)(_t45 + 0x158)));
					E0069C32F( *((intOrPtr*)(_t45 + 0x15c)));
					return E0069C32F( *((intOrPtr*)(_t45 + 0x160)));
				}
				return _t18;
			}

0x006aef2a
0x006aef2f
0x006aef38
0x006aef43
0x006aef4e
0x006aef59
0x006aef67
0x006aef72
0x006aef7d
0x006aef88
0x006aef96
0x006aefa4
0x006aefb5
0x006aefc3
0x006aefd1
0x006aefdc
0x006aefe7
0x006aeff2
0x00000000
0x006af002
0x006af007

APIs

Part of subcall function 006AEC6B: _free.LIBCMT ref: 006AEC94

_free.LIBCMT ref: 006AEF72

Part of subcall function 0069C32F: RtlFreeHeap.NTDLL(00000000,00000000,?,006AEC99,?,00000000,?,00000000,?,006AEF3D,?,00000007,?,?,006AF326,?), ref: 0069C345
Part of subcall function 0069C32F: GetLastError.KERNEL32(?,?,006AEC99,?,00000000,?,00000000,?,006AEF3D,?,00000007,?,?,006AF326,?,?), ref: 0069C357

_free.LIBCMT ref: 006AEF7D
_free.LIBCMT ref: 006AEF88
_free.LIBCMT ref: 006AEFDC
_free.LIBCMT ref: 006AEFE7
_free.LIBCMT ref: 006AEFF2
_free.LIBCMT ref: 006AEFFD

Memory Dump Source

Source File: 00000000.00000002.930900807.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.930881205.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.931184608.00000000006DB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.931264527.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.931270586.0000000000787000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.931275812.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.931281713.000000000078B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.931290749.0000000000797000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.931301227.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.931306896.00000000007A3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_25hBQ7XDkh.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 266550f61abf3bb421d9f19f12441894574d97e5a4d269c90e1de478592edc22
Instruction ID: 7d0b210a30c8b05a35e29e7be66ed51c26fedf587c70a0ac3211c03e7b797bed
Opcode Fuzzy Hash: 266550f61abf3bb421d9f19f12441894574d97e5a4d269c90e1de478592edc22
Instruction Fuzzy Hash: 62118431540B04F6DD60B7B0CC47FDB779E9F0D710F80481CB2AA66093D666B9054A58

Uniqueness

Uniqueness Score: -1.00%

Function 006A5ADD Relevance: 9.0, APIs: 6, Instructions: 50
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 75%

			E006A5ADD(void* __ebx, void* __ecx, void* __edx, void* __fp0) {
				void* __edi;
				void* __esi;
				intOrPtr _t2;
				void* _t3;
				void* _t4;
				intOrPtr _t9;
				void* _t11;
				void* _t20;
				void* _t21;
				void* _t23;
				void* _t25;
				void* _t27;
				void* _t29;
				void* _t31;
				void* _t32;
				long _t36;
				long _t37;
				void* _t40;
				void* _t48;

				_t48 = __fp0;
				_t29 = __edx;
				_t23 = __ecx;
				_t20 = __ebx;
				_t36 = GetLastError();
				_t2 =  *0x788e68; // 0x2
				_t42 = _t2 - 0xffffffff;
				if(_t2 == 0xffffffff) {
					L2:
					_t3 = E0069C2D2(_t23, 1, 0x364);
					_t31 = _t3;
					_pop(_t25);
					if(_t31 != 0) {
						_t4 = E006A7148(_t25, __eflags,  *0x788e68, _t31);
						__eflags = _t4;
						if(_t4 != 0) {
							E006A594F(_t25, _t31, 0x799c48);
							E0069C32F(0);
							_t40 = _t40 + 0xc;
							__eflags = _t31;
							if(_t31 == 0) {
								goto L9;
							} else {
								goto L8;
							}
						} else {
							_push(_t31);
							goto L4;
						}
					} else {
						_push(_t3);
						L4:
						E0069C32F();
						_pop(_t25);
						L9:
						SetLastError(_t36);
						E0069C369(_t20, _t29, _t31, _t36, _t48);
						asm("int3");
						_push(_t20);
						_push(_t36);
						_push(_t31);
						_t37 = GetLastError();
						_t21 = 0;
						_t9 =  *0x788e68; // 0x2
						_t45 = _t9 - 0xffffffff;
						if(_t9 == 0xffffffff) {
							L12:
							_t32 = E0069C2D2(_t25, 1, 0x364);
							_pop(_t27);
							if(_t32 != 0) {
								_t11 = E006A7148(_t27, __eflags,  *0x788e68, _t32);
								__eflags = _t11;
								if(_t11 != 0) {
									E006A594F(_t27, _t32, 0x799c48);
									E0069C32F(_t21);
									__eflags = _t32;
									if(_t32 != 0) {
										goto L19;
									} else {
										goto L18;
									}
								} else {
									_push(_t32);
									goto L14;
								}
							} else {
								_push(_t21);
								L14:
								E0069C32F();
								L18:
								SetLastError(_t37);
							}
						} else {
							_t32 = E006A70F2(_t25, _t45, _t9);
							if(_t32 != 0) {
								L19:
								SetLastError(_t37);
								_t21 = _t32;
							} else {
								goto L12;
							}
						}
						return _t21;
					}
				} else {
					_t31 = E006A70F2(_t23, _t42, _t2);
					if(_t31 != 0) {
						L8:
						SetLastError(_t36);
						return _t31;
					} else {
						goto L2;
					}
				}
			}

0x006a5add
0x006a5add
0x006a5add
0x006a5add
0x006a5ae7
0x006a5ae9
0x006a5aee
0x006a5af1
0x006a5aff
0x006a5b06
0x006a5b0b
0x006a5b0e
0x006a5b11
0x006a5b23
0x006a5b28
0x006a5b2a
0x006a5b35
0x006a5b3c
0x006a5b41
0x006a5b44
0x006a5b46
0x00000000
0x00000000
0x00000000
0x00000000
0x006a5b2c
0x006a5b2c
0x00000000
0x006a5b2c
0x006a5b13
0x006a5b13
0x006a5b14
0x006a5b14
0x006a5b19
0x006a5b54
0x006a5b55
0x006a5b5b
0x006a5b60
0x006a5b63
0x006a5b64
0x006a5b65
0x006a5b6c
0x006a5b6e
0x006a5b70
0x006a5b75
0x006a5b78
0x006a5b86
0x006a5b92
0x006a5b95
0x006a5b98
0x006a5baa
0x006a5baf
0x006a5bb1
0x006a5bbc
0x006a5bc2
0x006a5bca
0x006a5bcc
0x00000000
0x00000000
0x00000000
0x00000000
0x006a5bb3
0x006a5bb3
0x00000000
0x006a5bb3
0x006a5b9a
0x006a5b9a
0x006a5b9b
0x006a5b9b
0x006a5bce
0x006a5bcf
0x006a5bcf
0x006a5b7a
0x006a5b80
0x006a5b84
0x006a5bd7
0x006a5bd8
0x006a5bde
0x00000000
0x00000000
0x00000000
0x006a5b84
0x006a5be5
0x006a5be5
0x006a5af3
0x006a5af9
0x006a5afd
0x006a5b48
0x006a5b49
0x006a5b53
0x00000000
0x00000000
0x00000000
0x006a5afd

APIs

GetLastError.KERNEL32(?,?,00690950,007815A8,00000010), ref: 006A5AE1
_free.LIBCMT ref: 006A5B14
_free.LIBCMT ref: 006A5B3C
SetLastError.KERNEL32(00000000), ref: 006A5B49
SetLastError.KERNEL32(00000000), ref: 006A5B55
_abort.LIBCMT ref: 006A5B5B

Memory Dump Source

Source File: 00000000.00000002.930900807.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.930881205.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.931184608.00000000006DB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.931264527.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.931270586.0000000000787000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.931275812.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.931281713.000000000078B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.931290749.0000000000797000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.931301227.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.931306896.00000000007A3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_25hBQ7XDkh.jbxd

Similarity

API ID: ErrorLast$_free$_abort
String ID:
API String ID: 3160817290-0
Opcode ID: 25dbb986d777542eeb75463a07d0224848d30e337c115cf0a2315fc7e314ba5c
Instruction ID: accbba42e427c86690eb9559f16981bccd91fef16c4dba57f7a4039519a96628
Opcode Fuzzy Hash: 25dbb986d777542eeb75463a07d0224848d30e337c115cf0a2315fc7e314ba5c
Instruction Fuzzy Hash: 0CF02D32644D10A6D755B3346C16E9F226F9FC3772B25011DF526D6295EF608C028A74

Uniqueness

Uniqueness Score: -1.00%

Function 006A047D Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 37%

			E006A047D(void* __ecx, intOrPtr _a4) {
				signed int _v8;
				signed int _v12;
				signed int _t10;
				int _t13;
				int _t20;
				signed int _t22;

				_t10 =  *0x788bc8; // 0xf9aee04f
				_v8 = _t10 ^ _t22;
				_v12 = _v12 & 0x00000000;
				_t13 =  *0x6db370(0, L"mscoree.dll",  &_v12, __ecx, __ecx);
				if(_t13 != 0) {
					_t13 = GetProcAddress(_v12, "CorExitProcess");
					_t20 = _t13;
					if(_t20 != 0) {
						 *0x6db3d8(_a4);
						_t13 =  *_t20();
					}
				}
				if(_v12 != 0) {
					_t13 = FreeLibrary(_v12);
				}
				E00686062();
				return _t13;
			}

0x006a0484
0x006a048b
0x006a048e
0x006a049d
0x006a04a5
0x006a04b0
0x006a04b6
0x006a04ba
0x006a04c1
0x006a04c7
0x006a04c7
0x006a04c9
0x006a04ce
0x006a04d3
0x006a04d3
0x006a04de
0x006a04e6

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,006A0472,00000003,?,006A0412,00000003,007818B0,0000000C,006A0525,00000003,00000002), ref: 006A049D
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 006A04B0
FreeLibrary.KERNEL32(00000000,?,?,?,006A0472,00000003,?,006A0412,00000003,007818B0,0000000C,006A0525,00000003,00000002,00000000), ref: 006A04D3

Strings

mscoree.dll, xrefs: 006A0496
CorExitProcess, xrefs: 006A04A8

Memory Dump Source

Source File: 00000000.00000002.930900807.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.930881205.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.931184608.00000000006DB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.931264527.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.931270586.0000000000787000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.931275812.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.931281713.000000000078B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.931290749.0000000000797000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.931301227.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.931306896.00000000007A3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_25hBQ7XDkh.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: ca4a6b5108f34f744cc9a9df75fd3cd043c7f8183294d219371f20de6ead8f6e
Instruction ID: 3fd732ae58dbbb91c846f0448c7d73f8d3351829afd3da5700a3d2a8a8e6d4e3
Opcode Fuzzy Hash: ca4a6b5108f34f744cc9a9df75fd3cd043c7f8183294d219371f20de6ead8f6e
Instruction Fuzzy Hash: 32F08170901208FBDB106F54DC09BEDBFE6FF44711F014059F905A2290DB745D85CA90

Uniqueness

Uniqueness Score: -1.00%

Function 006A5B61 Relevance: 7.6, APIs: 5, Instructions: 53
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 81%

			E006A5B61(void* __ecx) {
				intOrPtr _t2;
				void* _t4;
				void* _t10;
				void* _t11;
				void* _t13;
				void* _t15;
				long _t16;

				_t11 = __ecx;
				_t16 = GetLastError();
				_t10 = 0;
				_t2 =  *0x788e68; // 0x2
				_t19 = _t2 - 0xffffffff;
				if(_t2 == 0xffffffff) {
					L2:
					_t15 = E0069C2D2(_t11, 1, 0x364);
					_pop(_t13);
					if(_t15 != 0) {
						_t4 = E006A7148(_t13, __eflags,  *0x788e68, _t15);
						__eflags = _t4;
						if(_t4 != 0) {
							E006A594F(_t13, _t15, 0x799c48);
							E0069C32F(_t10);
							__eflags = _t15;
							if(_t15 != 0) {
								goto L9;
							} else {
								goto L8;
							}
						} else {
							_push(_t15);
							goto L4;
						}
					} else {
						_push(_t10);
						L4:
						E0069C32F();
						L8:
						SetLastError(_t16);
					}
				} else {
					_t15 = E006A70F2(_t11, _t19, _t2);
					if(_t15 != 0) {
						L9:
						SetLastError(_t16);
						_t10 = _t15;
					} else {
						goto L2;
					}
				}
				return _t10;
			}

0x006a5b61
0x006a5b6c
0x006a5b6e
0x006a5b70
0x006a5b75
0x006a5b78
0x006a5b86
0x006a5b92
0x006a5b95
0x006a5b98
0x006a5baa
0x006a5baf
0x006a5bb1
0x006a5bbc
0x006a5bc2
0x006a5bca
0x006a5bcc
0x00000000
0x00000000
0x00000000
0x00000000
0x006a5bb3
0x006a5bb3
0x00000000
0x006a5bb3
0x006a5b9a
0x006a5b9a
0x006a5b9b
0x006a5b9b
0x006a5bce
0x006a5bcf
0x006a5bcf
0x006a5b7a
0x006a5b80
0x006a5b84
0x006a5bd7
0x006a5bd8
0x006a5bde
0x00000000
0x00000000
0x00000000
0x006a5b84
0x006a5be5

APIs

GetLastError.KERNEL32(?,?,?,00697CE2,0069C324,?,006A5B0B,00000001,00000364,?,00690950,007815A8,00000010), ref: 006A5B66
_free.LIBCMT ref: 006A5B9B
_free.LIBCMT ref: 006A5BC2
SetLastError.KERNEL32(00000000), ref: 006A5BCF
SetLastError.KERNEL32(00000000), ref: 006A5BD8

Memory Dump Source

Source File: 00000000.00000002.930900807.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.930881205.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.931184608.00000000006DB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.931264527.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.931270586.0000000000787000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.931275812.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.931281713.000000000078B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.931290749.0000000000797000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.931301227.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.931306896.00000000007A3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_25hBQ7XDkh.jbxd

Similarity

API ID: ErrorLast$_free
String ID:
API String ID: 3170660625-0
Opcode ID: d11d13684f650f5ad7a4008042b50f35607b2ffea6abb17dd2d4ed8c7d13f1d9
Instruction ID: 0d93009fcde85e50cdb0b3d4958c1a53d8a62fdec5d4060e88f781eb2d295aa9
Opcode Fuzzy Hash: d11d13684f650f5ad7a4008042b50f35607b2ffea6abb17dd2d4ed8c7d13f1d9
Instruction Fuzzy Hash: FD014932645A00ABC722F7346CA5DAB225FDBC37B2735111DF92292241EF708C028938

Uniqueness

Uniqueness Score: -1.00%

Function 006AE9E6 Relevance: 7.5, APIs: 5, Instructions: 40
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E006AE9E6(intOrPtr* _a4) {
				intOrPtr _t6;
				intOrPtr* _t21;
				void* _t23;
				void* _t24;
				void* _t25;
				void* _t26;
				void* _t27;

				_t21 = _a4;
				if(_t21 != 0) {
					_t23 =  *_t21 -  *0x788ce8; // 0x788ce0
					if(_t23 != 0) {
						E0069C32F(_t7);
					}
					_t24 =  *((intOrPtr*)(_t21 + 4)) -  *0x788cec; // 0x79999c
					if(_t24 != 0) {
						E0069C32F(_t8);
					}
					_t25 =  *((intOrPtr*)(_t21 + 8)) -  *0x788cf0; // 0x79999c
					if(_t25 != 0) {
						E0069C32F(_t9);
					}
					_t26 =  *((intOrPtr*)(_t21 + 0x30)) -  *0x788d18; // 0x788ce4
					if(_t26 != 0) {
						E0069C32F(_t10);
					}
					_t6 =  *((intOrPtr*)(_t21 + 0x34));
					_t27 = _t6 -  *0x788d1c; // 0x7999a0
					if(_t27 != 0) {
						return E0069C32F(_t6);
					}
				}
				return _t6;
			}

0x006ae9ec
0x006ae9f1
0x006ae9f5
0x006ae9fb
0x006ae9fe
0x006aea03
0x006aea07
0x006aea0d
0x006aea10
0x006aea15
0x006aea19
0x006aea1f
0x006aea22
0x006aea27
0x006aea2b
0x006aea31
0x006aea34
0x006aea39
0x006aea3a
0x006aea3d
0x006aea43
0x00000000
0x006aea4b
0x006aea43
0x006aea4e

APIs

_free.LIBCMT ref: 006AE9FE

Part of subcall function 0069C32F: RtlFreeHeap.NTDLL(00000000,00000000,?,006AEC99,?,00000000,?,00000000,?,006AEF3D,?,00000007,?,?,006AF326,?), ref: 0069C345
Part of subcall function 0069C32F: GetLastError.KERNEL32(?,?,006AEC99,?,00000000,?,00000000,?,006AEF3D,?,00000007,?,?,006AF326,?,?), ref: 0069C357

_free.LIBCMT ref: 006AEA10
_free.LIBCMT ref: 006AEA22
_free.LIBCMT ref: 006AEA34
_free.LIBCMT ref: 006AEA46

Memory Dump Source

Source File: 00000000.00000002.930900807.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.930881205.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.931184608.00000000006DB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.931264527.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.931270586.0000000000787000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.931275812.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.931281713.000000000078B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.931290749.0000000000797000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.931301227.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.931306896.00000000007A3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_25hBQ7XDkh.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 4ea8d153af7b3440e3ff465002c534327a1787adfd9c0dca542b5a977cbd98ff
Instruction ID: 02b0aa2a7e11496829a2910c066ccf1a4fc87befe2ebf23dca87afa77ffc0f8f
Opcode Fuzzy Hash: 4ea8d153af7b3440e3ff465002c534327a1787adfd9c0dca542b5a977cbd98ff
Instruction Fuzzy Hash: F9F0FF325452106BCAA0EB68E485C5673DEFA097207A4984AF108D7A51CF35FC814BB9

Uniqueness

Uniqueness Score: -1.00%

Function 006909A8 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 21
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E006909A8(char _a4) {
				void* _t6;
				intOrPtr _t11;

				_t1 =  &_a4; // 0x690a78
				_t11 =  *_t1;
				if(_t11 != 0) {
					if( *(_t11 + 8) != 0) {
						CloseHandle( *(_t11 + 8));
					}
					if( *(_t11 + 0xc) != 0) {
						FreeLibrary( *(_t11 + 0xc));
					}
					return E0069C32F(_t11);
				}
				return _t6;
			}

0x006909ae
0x006909ae
0x006909b3
0x006909b9
0x006909be
0x006909be
0x006909c8
0x006909cd
0x006909cd
0x00000000
0x006909d9
0x006909dc

APIs

CloseHandle.KERNEL32(00000000,00000000,?,00690A78,00000000), ref: 006909BE
FreeLibrary.KERNEL32(00000000,00000000,?,00690A78,00000000), ref: 006909CD
_free.LIBCMT ref: 006909D4

Strings

xi, xrefs: 006909AE, 006909D3

Memory Dump Source

Source File: 00000000.00000002.930900807.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.930881205.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.931184608.00000000006DB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.931264527.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.931270586.0000000000787000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.931275812.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.931281713.000000000078B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.931290749.0000000000797000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.931301227.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.931306896.00000000007A3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_25hBQ7XDkh.jbxd

Similarity

API ID: CloseFreeHandleLibrary_free
String ID: xi
API String ID: 621396759-1797443980
Opcode ID: 926f14ed7cc8eb09ef5fee05c86a357d6c1deec87fa5e7a50c9ba4a58bf45542
Instruction ID: e837218b11e8b5a451a274a32cfccf2e63288f0a29c5b4b4b5c119951d70d4cb
Opcode Fuzzy Hash: 926f14ed7cc8eb09ef5fee05c86a357d6c1deec87fa5e7a50c9ba4a58bf45542
Instruction Fuzzy Hash: 61E04F32401620EFEB311B45E808BABB7AEDF40721F15E01BF459119658775AC94DB94

Uniqueness

Uniqueness Score: -1.00%

Function 006A6E9C Relevance: 6.1, APIs: 4, Instructions: 52
libraryCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 95%

			E006A6E9C(signed int _a4) {
				signed int _t9;
				void* _t13;
				signed int _t15;
				WCHAR* _t22;
				signed int _t24;
				signed int* _t25;
				void* _t27;

				_t9 = _a4;
				_t25 = 0x799e60 + _t9 * 4;
				_t24 =  *_t25;
				if(_t24 == 0) {
					_t22 =  *(0x71a068 + _t9 * 4);
					_t27 = LoadLibraryExW(_t22, 0, 0x800);
					if(_t27 != 0) {
						L8:
						 *_t25 = _t27;
						if( *_t25 != 0) {
							FreeLibrary(_t27);
						}
						_t13 = _t27;
						L11:
						return _t13;
					}
					_t15 = GetLastError();
					if(_t15 != 0x57) {
						_t27 = 0;
					} else {
						_t15 = LoadLibraryExW(_t22, _t27, _t27);
						_t27 = _t15;
					}
					if(_t27 != 0) {
						goto L8;
					} else {
						 *_t25 = _t15 | 0xffffffff;
						_t13 = 0;
						goto L11;
					}
				}
				_t4 = _t24 + 1; // 0xf9aee050
				asm("sbb eax, eax");
				return  ~_t4 & _t24;
			}

0x006a6ea1
0x006a6ea5
0x006a6eac
0x006a6eb0
0x006a6ebe
0x006a6ed4
0x006a6ed8
0x006a6f01
0x006a6f03
0x006a6f07
0x006a6f0a
0x006a6f0a
0x006a6f10
0x006a6f12
0x00000000
0x006a6f13
0x006a6eda
0x006a6ee3
0x006a6ef2
0x006a6ee5
0x006a6ee8
0x006a6eee
0x006a6eee
0x006a6ef6
0x00000000
0x006a6ef8
0x006a6efb
0x006a6efd
0x00000000
0x006a6efd
0x006a6ef6
0x006a6eb2
0x006a6eb7
0x00000000

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,00000000,00000000,?,006A6E43,?,00000000,00000000,00000000,?,006A716F,00000006,FlsSetValue), ref: 006A6ECE
GetLastError.KERNEL32(?,006A6E43,?,00000000,00000000,00000000,?,006A716F,00000006,FlsSetValue,0071A558,0071A560,00000000,00000364,?,006A5BAF), ref: 006A6EDA
LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,006A6E43,?,00000000,00000000,00000000,?,006A716F,00000006,FlsSetValue,0071A558,0071A560,00000000), ref: 006A6EE8

Memory Dump Source

Source File: 00000000.00000002.930900807.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.930881205.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.931184608.00000000006DB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.931264527.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.931270586.0000000000787000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.931275812.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.931281713.000000000078B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.931290749.0000000000797000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.931301227.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.931306896.00000000007A3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_25hBQ7XDkh.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID:
API String ID: 3177248105-0
Opcode ID: 6fda77d5ca3d0126bb2a7b5ab523611e3d1e839c49eecbf012d9ef4dd9776c54
Instruction ID: 2042cccc1c670b6ac16f20eeb4c3366dc85031cd7b6168171b0d0ca2b5caf0f8
Opcode Fuzzy Hash: 6fda77d5ca3d0126bb2a7b5ab523611e3d1e839c49eecbf012d9ef4dd9776c54
Instruction Fuzzy Hash: 9201FC36606322DFC7315B68EC449A6779BAF46BA171A4521F905D7281DB21DC01CEE0

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: windowsconnect.exePID: 1364, Parent PID: 796COMMON

Execution Graph

Execution Coverage:	0.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	1799
Total number of Limit Nodes:	0

Executed Functions

Function 6DD64D60 Relevance: 19.6, APIs: 13, Instructions: 130
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 31%

			E6DD64D60(void* __ebp, intOrPtr _a8, intOrPtr _a12) {
				intOrPtr _v24;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t30;
				intOrPtr _t31;
				intOrPtr _t34;
				void* _t35;
				intOrPtr _t36;
				intOrPtr _t46;
				intOrPtr _t48;
				intOrPtr _t58;
				intOrPtr _t62;
				intOrPtr _t65;
				void* _t67;
				intOrPtr _t70;
				intOrPtr _t71;
				void* _t73;
				intOrPtr* _t74;

				_t74 = _t73 - 0x10;
				_t30 = _a8;
				if(_t30 != 0) {
					if(_t30 == 1) {
						_v24 = E6DD64370;
						 *_t74 = 1; // executed
						_t31 =  *0x6dd6f180(); // executed
						 *0x6dd6c02c = _t31;
						return 1;
					} else {
						if(_t30 == 3) {
							_t34 =  *0x6dd6a020;
							if(_t34 != 0xffffffff) {
								 *_t74 = _t34;
								_t35 = TlsGetValue(??);
								_t74 = _t74 - 4;
								_t67 = _t35;
								if(_t35 != 0) {
									if(( *(_t35 + 0x20) & 0x00000030) == 0) {
										_t36 =  *((intOrPtr*)(_t35 + 0x18));
										if( *((intOrPtr*)(_t67 + 0x68)) != 0) {
											if(_t36 != 0) {
												 *_t74 = _t36;
												CloseHandle(??);
												_t74 = _t74 - 4;
											}
											_t27 = _t67 + 0x1c; // 0x1c
											 *((intOrPtr*)(_t67 + 0x18)) = 0;
											 *_t74 = _t27;
											E6DD63470();
											_t29 = _t67 + 0x38; // 0x38
											E6DD64A20(_t29, _t67, _t70, _t71);
										} else {
											if(_t36 != 0) {
												 *_t74 = _t36;
												CloseHandle(??);
												_t74 = _t74 - 4;
											}
											_t42 =  *((intOrPtr*)(_t67 + 0xb4));
											 *((intOrPtr*)(_t67 + 0x18)) = 0;
											 *((intOrPtr*)(_t67 + 0x68)) = 1;
											if( *((intOrPtr*)(_t67 + 0xb4)) != 0) {
												E6DD64C60(_t42);
											}
											_t20 = _t67 + 0x1c; // 0x1c
											_t70 = _t20;
											_t21 = _t67 + 0x38; // 0x38
											_t71 = _t21;
											if(( *(_t67 + 0x24) & 0x00000004) == 0) {
												 *_t74 = _t70;
												E6DD63470();
												E6DD64A20(_t71, _t67, _t70, _t71);
											} else {
												_t46 =  *((intOrPtr*)(_t67 + 0x14));
												 *_t67 = 0xdeadbeef;
												if(_t46 != 0) {
													 *_t74 = _t46;
													CloseHandle(??);
													_t74 = _t74 - 4;
												}
												 *((intOrPtr*)(_t67 + 0x14)) = 0;
												 *_t74 = _t70;
												E6DD63470();
												_t48 = _t71;
												goto L15;
											}
										}
									} else {
										_t57 =  *((intOrPtr*)(_t35 + 0xb4));
										if( *((intOrPtr*)(_t35 + 0xb4)) != 0) {
											E6DD64C60(_t57);
										}
										_t58 =  *((intOrPtr*)(_t67 + 0x14));
										if(_t58 != 0) {
											 *_t74 = _t58;
											_t71 =  *0x6dd6f184;
											CloseHandle(??);
											_t62 =  *((intOrPtr*)(_t67 + 0x18));
											_t74 = _t74 - 4;
											if(_t62 != 0) {
												 *_t74 = _t62;
												CloseHandle(??);
												_t74 = _t74 - 4;
											}
											 *((intOrPtr*)(_t67 + 0x18)) = 0;
											 *((intOrPtr*)(_t67 + 0x14)) = 0;
										}
										_t11 = _t67 + 0x1c; // 0x1c
										 *_t74 = _t11;
										E6DD63470();
										_t12 = _t67 + 0x38; // 0x38
										_t48 = _t12;
										L15:
										E6DD64A20(_t48, _t67, _t70, _t71);
										E6DD64650(_t67);
										_v24 = 0;
										 *_t74 =  *0x6dd6a020;
										TlsSetValue(??, ??);
										_t74 = _t74 - 8;
									}
								}
							}
						}
						goto L2;
					}
				} else {
					if(_a12 == 0) {
						_t65 =  *0x6dd6c02c;
						if(_t65 != 0) {
							 *_t74 = _t65;
							 *0x6dd6f1fc();
							 *0x6dd6c02c = 0;
							_t74 = _t74 - 4;
						}
					}
					L2:
					return 1;
				}
			}

0x6dd64d63
0x6dd64d66
0x6dd64d6c
0x6dd64d93
0x6dd64e70
0x6dd64e78
0x6dd64e7f
0x6dd64e88
0x6dd64e98
0x6dd64d99
0x6dd64d9c
0x6dd64d9e
0x6dd64da6
0x6dd64da8
0x6dd64dab
0x6dd64db1
0x6dd64db4
0x6dd64db8
0x6dd64dbe
0x6dd64ea3
0x6dd64ea8
0x6dd64f1a
0x6dd64f1c
0x6dd64f1f
0x6dd64f25
0x6dd64f25
0x6dd64f28
0x6dd64f2b
0x6dd64f32
0x6dd64f35
0x6dd64f3a
0x6dd64f3d
0x6dd64eaa
0x6dd64eac
0x6dd64eae
0x6dd64eb1
0x6dd64eb7
0x6dd64eb7
0x6dd64eba
0x6dd64ec0
0x6dd64ec7
0x6dd64ed0
0x6dd64ed2
0x6dd64ed2
0x6dd64ed7
0x6dd64ed7
0x6dd64eda
0x6dd64eda
0x6dd64ee1
0x6dd64f50
0x6dd64f53
0x6dd64f5a
0x6dd64ee3
0x6dd64ee3
0x6dd64ee6
0x6dd64eee
0x6dd64ef0
0x6dd64ef3
0x6dd64ef9
0x6dd64ef9
0x6dd64efc
0x6dd64f03
0x6dd64f06
0x6dd64f0b
0x00000000
0x6dd64f0b
0x6dd64ee1
0x6dd64dc4
0x6dd64dc4
0x6dd64dcc
0x6dd64dce
0x6dd64dce
0x6dd64dd3
0x6dd64dd8
0x6dd64dda
0x6dd64ddd
0x6dd64de3
0x6dd64de5
0x6dd64de8
0x6dd64ded
0x6dd64def
0x6dd64df2
0x6dd64df4
0x6dd64df4
0x6dd64df7
0x6dd64dfe
0x6dd64dfe
0x6dd64e05
0x6dd64e08
0x6dd64e0b
0x6dd64e10
0x6dd64e10
0x6dd64e13
0x6dd64e13
0x6dd64e1a
0x6dd64e24
0x6dd64e2c
0x6dd64e2f
0x6dd64e35
0x6dd64e35
0x6dd64dbe
0x6dd64db8
0x6dd64da6
0x00000000
0x6dd64d9c
0x6dd64d6e
0x6dd64d74
0x6dd64e40
0x6dd64e47
0x6dd64e4d
0x6dd64e50
0x6dd64e56
0x6dd64e60
0x6dd64e60
0x6dd64e47
0x6dd64d7a
0x6dd64d85
0x6dd64d85

APIs

TlsGetValue.KERNEL32 ref: 6DD64DAB
CloseHandle.KERNEL32 ref: 6DD64DE3
CloseHandle.KERNEL32 ref: 6DD64DF2
pthread_mutex_destroy.LIBWINPTHREAD-1 ref: 6DD64E0B
TlsSetValue.KERNEL32 ref: 6DD64E2F
RtlRemoveVectoredExceptionHandler.NTDLL ref: 6DD64E50

Memory Dump Source

Source File: 00000004.00000002.787395814.000000006DD61000.00000040.00000001.01000000.0000000A.sdmp, Offset: 6DD60000, based on PE: true

Associated: 00000004.00000002.787383138.000000006DD60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787413037.000000006DD6B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787415936.000000006DD6F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787437708.000000006DD74000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787474619.000000006DDD6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787482411.000000006DDE6000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6dd60000_windowsconnect.jbxd

Similarity

API ID: CloseHandleValue$ExceptionHandlerRemoveVectoredpthread_mutex_destroy
String ID:
API String ID: 277988988-0
Opcode ID: 96c4fdeaf201c5f375e228de67b48094a4e3824ca818823e05e5571ee54be5ca
Instruction ID: 38bb3c257919b60fbf07ccb2a6a7a6b04b3b45eda4037cd23f50f4537b003440
Opcode Fuzzy Hash: 96c4fdeaf201c5f375e228de67b48094a4e3824ca818823e05e5571ee54be5ca
Instruction Fuzzy Hash: 8D41EAB1A086818BEB00FF78D5A872A7BF4AF0A344F014569F9918B256E734D455CBF2

Uniqueness

Uniqueness Score: -1.00%

Function 6DD64E68 Relevance: 1.5, APIs: 1, Instructions: 13
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAddVectoredExceptionHandler.NTDLL ref: 6DD64E7F

Memory Dump Source

Source File: 00000004.00000002.787395814.000000006DD61000.00000040.00000001.01000000.0000000A.sdmp, Offset: 6DD60000, based on PE: true

Associated: 00000004.00000002.787383138.000000006DD60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787413037.000000006DD6B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787415936.000000006DD6F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787437708.000000006DD74000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787474619.000000006DDD6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787482411.000000006DDE6000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6dd60000_windowsconnect.jbxd

Similarity

API ID: ExceptionHandlerVectored
String ID:
API String ID: 3310709589-0
Opcode ID: 297dbe93d7a694585dec3a13574c884d6816213b10ffece9d74abdb7364af9d8
Instruction ID: bc073bfda0768e05ac95097140c47735a9e78dbb41dce4cf4b5df058299009dd
Opcode Fuzzy Hash: 297dbe93d7a694585dec3a13574c884d6816213b10ffece9d74abdb7364af9d8
Instruction Fuzzy Hash: D1D0A7728042008FE700BF3CE40435EBBB0F706312F40481DD08853200D33504508BE6

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 6DD67E60 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32 ref: 6DD67EAF
UnhandledExceptionFilter.KERNEL32 ref: 6DD67EBF
GetCurrentProcess.KERNEL32 ref: 6DD67EC8
TerminateProcess.KERNEL32 ref: 6DD67ED9
abort.MSVCRT ref: 6DD67EE2

Memory Dump Source

Source File: 00000004.00000002.787395814.000000006DD61000.00000040.00000001.01000000.0000000A.sdmp, Offset: 6DD60000, based on PE: true

Associated: 00000004.00000002.787383138.000000006DD60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787413037.000000006DD6B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787415936.000000006DD6F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787437708.000000006DD74000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787474619.000000006DDD6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787482411.000000006DDE6000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6dd60000_windowsconnect.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentTerminateabort
String ID:
API String ID: 520269711-0
Opcode ID: e145dd8f4740536fe8e2cf3a9b388bf26f09e25e6cbd0bb365a238463daa160e
Instruction ID: c0ddee8c535861b1ad8c365be8a44f829cda7d8110e2bd60b642cd8313bf1e86
Opcode Fuzzy Hash: e145dd8f4740536fe8e2cf3a9b388bf26f09e25e6cbd0bb365a238463daa160e
Instruction Fuzzy Hash: 371193B5904685DFEB00FF7DC145B2ABBF0BB5A304F418929E98887304E77899548FE2

Uniqueness

Uniqueness Score: -1.00%

Function 6DD67E5C Relevance: 7.5, APIs: 5, Instructions: 47COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32 ref: 6DD67EAF
UnhandledExceptionFilter.KERNEL32 ref: 6DD67EBF
GetCurrentProcess.KERNEL32 ref: 6DD67EC8
TerminateProcess.KERNEL32 ref: 6DD67ED9
abort.MSVCRT ref: 6DD67EE2

Memory Dump Source

Source File: 00000004.00000002.787395814.000000006DD61000.00000040.00000001.01000000.0000000A.sdmp, Offset: 6DD60000, based on PE: true

Associated: 00000004.00000002.787383138.000000006DD60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787413037.000000006DD6B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787415936.000000006DD6F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787437708.000000006DD74000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787474619.000000006DDD6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787482411.000000006DDE6000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6dd60000_windowsconnect.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentTerminateabort
String ID:
API String ID: 520269711-0
Opcode ID: 158144bcfe02fd5e9ede01939915e1ef59e23afd6e677b5f795cd2438c4827f1
Instruction ID: 47c8df9047f916e996559aed44d27ac57c8e517562fda1b40892dd3c17af1010
Opcode Fuzzy Hash: 158144bcfe02fd5e9ede01939915e1ef59e23afd6e677b5f795cd2438c4827f1
Instruction Fuzzy Hash: 4711B7B5904285DFEB00FF7DD149B297BF0BB0A304F418929E94487204E77895588FE2

Uniqueness

Uniqueness Score: -1.00%

Function 6DD68C00 Relevance: .3, Instructions: 331COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.787395814.000000006DD61000.00000040.00000001.01000000.0000000A.sdmp, Offset: 6DD60000, based on PE: true

Associated: 00000004.00000002.787383138.000000006DD60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787413037.000000006DD6B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787415936.000000006DD6F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787437708.000000006DD74000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787474619.000000006DDD6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787482411.000000006DDE6000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6dd60000_windowsconnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab1facdd321baea8124d230eca737251028679386b3dda81de0d8224d0fb469f
Instruction ID: 0ef9f6d1c727961ab542bf077e6194eb6f3042d54b33d51656958f293a00aa7c
Opcode Fuzzy Hash: ab1facdd321baea8124d230eca737251028679386b3dda81de0d8224d0fb469f
Instruction Fuzzy Hash: 41C18971A083628BD714DF2AC44022AB7E2FFD9714F15CA2DF98897395E735D805CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 6DD64F70 Relevance: 28.6, APIs: 19, Instructions: 115
sleepthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

pthread_mutex_lock.LIBWINPTHREAD-1 ref: 6DD64F95
pthread_mutex_lock.LIBWINPTHREAD-1 ref: 6DD64F9D
TlsSetValue.KERNEL32 ref: 6DD64FBF
GetCurrentThreadId.KERNEL32 ref: 6DD64FC7
pthread_mutex_unlock.LIBWINPTHREAD-1 ref: 6DD64FD3
_setjmp3.MSVCRT ref: 6DD64FE6
pthread_mutex_lock.LIBWINPTHREAD-1 ref: 6DD64FFA
pthread_mutex_lock.LIBWINPTHREAD-1 ref: 6DD65008
CloseHandle.KERNEL32 ref: 6DD6501C
pthread_mutex_unlock.LIBWINPTHREAD-1 ref: 6DD6503A
pthread_mutex_destroy.LIBWINPTHREAD-1 ref: 6DD65042
pthread_mutex_unlock.LIBWINPTHREAD-1 ref: 6DD65065
Sleep.KERNEL32(00000000), ref: 6DD65079
pthread_mutex_unlock.LIBWINPTHREAD-1 ref: 6DD65085
pthread_mutex_lock.LIBWINPTHREAD-1 ref: 6DD650A5
pthread_mutex_unlock.LIBWINPTHREAD-1 ref: 6DD650DB
pthread_mutex_destroy.LIBWINPTHREAD-1 ref: 6DD650E3
TlsSetValue.KERNEL32 ref: 6DD650FF
_endthreadex.MSVCRT ref: 6DD6510F

Part of subcall function 6DD64990: pthread_mutex_lock.LIBWINPTHREAD-1(?,Error cleaning up spin_keys for thread ,?,6DD64AE5), ref: 6DD649A8
Part of subcall function 6DD64990: pthread_tls_init.LIBWINPTHREAD-1(?,Error cleaning up spin_keys for thread ,?,6DD64AE5), ref: 6DD649B7
Part of subcall function 6DD64990: pthread_mutex_unlock.LIBWINPTHREAD-1(?,Error cleaning up spin_keys for thread ,?,6DD64AE5), ref: 6DD649C9

Memory Dump Source

Source File: 00000004.00000002.787395814.000000006DD61000.00000040.00000001.01000000.0000000A.sdmp, Offset: 6DD60000, based on PE: true

Associated: 00000004.00000002.787383138.000000006DD60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787413037.000000006DD6B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787415936.000000006DD6F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787437708.000000006DD74000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787474619.000000006DDD6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787482411.000000006DDE6000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6dd60000_windowsconnect.jbxd

Similarity

API ID: pthread_mutex_lockpthread_mutex_unlock$Valuepthread_mutex_destroy$CloseCurrentHandleSleepThread_endthreadex_setjmp3pthread_tls_init
String ID:
API String ID: 3376602310-0
Opcode ID: f4544f10b9915ff39ffdcf669ae8b4a51fd1f3efe2b844a4dbd1bf881ce98f41
Instruction ID: a7b4ef634791cfecdb7504b6d10dfc2b7b5807afe70d27adfdede886b8082c2d
Opcode Fuzzy Hash: f4544f10b9915ff39ffdcf669ae8b4a51fd1f3efe2b844a4dbd1bf881ce98f41
Instruction Fuzzy Hash: F341E5B09487818FDB10BF65C484A6ABBF4BF49308F02891DE5959B245D735E885CBF2

Uniqueness

Uniqueness Score: -1.00%

Function 6DD65CA0 Relevance: 24.1, APIs: 16, Instructions: 145
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__pth_gpointer_locked.LIBWINPTHREAD-1 ref: 6DD65CB4

Part of subcall function 6DD64C20: pthread_mutex_lock.LIBWINPTHREAD-1(?,?,00000000,?,6DD64C6F,?,?,?,?,?,?,00000000,?,?,?,6DD658D2), ref: 6DD64C36
Part of subcall function 6DD64C20: pthread_mutex_unlock.LIBWINPTHREAD-1(?,?,00000000,?,6DD64C6F,?,?,?,?,?,?,00000000,?,?,?,6DD658D2), ref: 6DD64C4B

GetHandleInformation.KERNEL32 ref: 6DD65CDD
pthread_mutex_lock.LIBWINPTHREAD-1 ref: 6DD65CF4

Part of subcall function 6DD64AD0: TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,6DD65ADA,?,?,?,?,6DD66ADD), ref: 6DD64AED

SetEvent.KERNEL32 ref: 6DD65D42
pthread_mutex_unlock.LIBWINPTHREAD-1 ref: 6DD65D4E
pthread_mutex_unlock.LIBWINPTHREAD-1 ref: 6DD65DDB

Memory Dump Source

Source File: 00000004.00000002.787395814.000000006DD61000.00000040.00000001.01000000.0000000A.sdmp, Offset: 6DD60000, based on PE: true

Associated: 00000004.00000002.787383138.000000006DD60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787413037.000000006DD6B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787415936.000000006DD6F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787437708.000000006DD74000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787474619.000000006DDD6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787482411.000000006DDE6000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6dd60000_windowsconnect.jbxd

Similarity

API ID: pthread_mutex_unlock$pthread_mutex_lock$EventHandleInformationValue__pth_gpointer_locked
String ID:
API String ID: 1371553515-0
Opcode ID: e2f11c19ee7d7ef31db9c7f495b7556aa95a8a681847a1e3ecb0f123124ce30f
Instruction ID: 55ff8629862a1fd70bbae44487c7bdc4d7b2b83f9ae3dcdf3e833b284b5488c2
Opcode Fuzzy Hash: e2f11c19ee7d7ef31db9c7f495b7556aa95a8a681847a1e3ecb0f123124ce30f
Instruction Fuzzy Hash: 9A5188B15086C18BDB00BF78D58867A7FF0AF45324F150669ECA48B286D734D499CBF2

Uniqueness

Uniqueness Score: -1.00%

Function 6DD65AD0 Relevance: 19.6, APIs: 13, Instructions: 105
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 71%

			E6DD65AD0(void* __ecx, void* __edi, void* __ebp, void* __eflags) {
				signed int _v24;
				signed int _v52;
				void* __ebx;
				void* __esi;
				intOrPtr _t19;
				signed int _t21;
				signed int _t25;
				signed int _t28;
				void* _t36;
				signed int _t38;
				void* _t45;
				intOrPtr _t46;
				signed int _t47;
				signed int _t50;
				void* _t53;
				signed int _t54;
				void* _t56;
				void* _t57;
				void* _t58;
				signed int* _t59;
				signed int* _t62;

				_t57 = __ebp;
				_t52 = __edi;
				_t59 = _t58 - 0x14;
				_t19 = E6DD64AD0(_t45, __ecx, __edi, _t53);
				if(_t19 == 0) {
					L3:
					return _t19;
				} else {
					_t46 = _t19;
					if(( *(_t19 + 0x20) & 0x0000000c) != 0) {
						goto L3;
					} else {
						_t19 =  *0x6dd6c058;
						if(_t19 != 0) {
							_t4 = _t46 + 0x1c; // 0x1c
							_t54 = _t4;
							 *_t59 = _t54;
							E6DD62F90();
							_t21 =  *(_t46 + 0x20) & 0x000000ff;
							__eflags = _t21 & 0x00000003;
							if((_t21 & 0x00000003) == 0) {
								L7:
								 *_t59 = _t54;
								return E6DD632E0();
							} else {
								_t50 =  *(_t46 + 0x24);
								__eflags = _t50 & 0x00000001;
								if((_t50 & 0x00000001) == 0) {
									goto L7;
								} else {
									_t49 =  *(_t46 + 0x10);
									__eflags =  *(_t46 + 0x10);
									if( *(_t46 + 0x10) <= 0) {
										 *(_t46 + 0x24) = _t50 & 0xfffffffe;
										 *(_t46 + 0x20) = _t21 & 0xfffffff3 | 0x00000004;
										_t25 =  *(_t46 + 0x18);
										__eflags = _t25;
										if(_t25 != 0) {
											 *_t59 = _t25;
											_push(ResetEvent(??));
										}
										 *_t59 = _t54;
										E6DD632E0();
										L6DD65A10(_t49, _t52, _t54, _t57, __eflags);
										_push(_t54);
										_push(_t46);
										_t62 = _t59 - 0x14;
										_t28 = _v24;
										__eflags = _t28;
										if(_t28 == 0) {
											E6DD64AD0(_t46, _t49, _t52, _t54);
											goto L18;
										} else {
											 *_t62 = _t28;
											_t47 = E6DD62CB0();
											__eflags = 0xfffffffe - _t47;
											asm("sbb eax, edx");
											if(0xfffffffe < _t47) {
												_t36 = E6DD64AD0(_t47, _t49, _t52, _t54);
												_t47 = 0xffffffff;
												E6DD65AD0(_t49, _t52, _t57, __eflags);
												_t38 =  *(_t36 + 0x18);
												__eflags = _t38;
												if(__eflags != 0) {
													goto L15;
												} else {
													goto L21;
												}
												goto L16;
											} else {
												_t56 = E6DD64AD0(_t47, _t49, _t52, _t54);
												__eflags = _t47;
												if(__eflags == 0) {
													L18:
													E6DD65AD0(_t49, _t52, _t57, __eflags);
													 *_t62 = 0;
													Sleep(??);
													E6DD65AD0(_t49, _t52, _t57, __eflags);
													__eflags = 0;
													return 0;
												} else {
													E6DD65AD0(_t49, _t52, _t57, __eflags);
													_t38 =  *(_t56 + 0x18);
													__eflags = _t38;
													if(__eflags == 0) {
														L21:
														 *_t62 = _t47;
														Sleep(??);
														_t62 = _t62 - 4;
													} else {
														L15:
														_v52 = _t47;
														 *_t62 = _t38;
														E6DD62DC0();
													}
													L16:
													E6DD65AD0(_t49, _t52, _t57, __eflags);
													__eflags = 0;
													return 0;
												}
											}
										}
									} else {
										goto L7;
									}
								}
							}
						} else {
							goto L3;
						}
					}
				}
			}

0x6dd65ad0
0x6dd65ad0
0x6dd65ad2
0x6dd65ad5
0x6dd65adc
0x6dd65aef
0x6dd65af4
0x6dd65ade
0x6dd65ade
0x6dd65ae4
0x00000000
0x6dd65ae6
0x6dd65ae6
0x6dd65aed
0x6dd65af8
0x6dd65af8
0x6dd65afb
0x6dd65afe
0x6dd65b03
0x6dd65b07
0x6dd65b09
0x6dd65b1a
0x6dd65b1a
0x6dd65b27
0x6dd65b0b
0x6dd65b0b
0x6dd65b0e
0x6dd65b11
0x00000000
0x6dd65b13
0x6dd65b13
0x6dd65b16
0x6dd65b18
0x6dd65b31
0x6dd65b34
0x6dd65b37
0x6dd65b3a
0x6dd65b3c
0x6dd65b3e
0x6dd65b47
0x6dd65b47
0x6dd65b48
0x6dd65b4b
0x6dd65b50
0x6dd65b60
0x6dd65b61
0x6dd65b62
0x6dd65b65
0x6dd65b69
0x6dd65b6b
0x6dd65bc0
0x00000000
0x6dd65b6d
0x6dd65b6d
0x6dd65b75
0x6dd65b7c
0x6dd65b83
0x6dd65b85
0x6dd65bf0
0x6dd65bf5
0x6dd65bfc
0x6dd65c01
0x6dd65c04
0x6dd65c06
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6dd65b87
0x6dd65b8c
0x6dd65b8e
0x6dd65b90
0x6dd65bc5
0x6dd65bc5
0x6dd65bca
0x6dd65bd1
0x6dd65bda
0x6dd65be2
0x6dd65be6
0x6dd65b92
0x6dd65b92
0x6dd65b97
0x6dd65b9a
0x6dd65b9c
0x6dd65c10
0x6dd65c10
0x6dd65c13
0x6dd65c19
0x6dd65b9e
0x6dd65b9e
0x6dd65b9e
0x6dd65ba2
0x6dd65ba5
0x6dd65ba5
0x6dd65baa
0x6dd65baa
0x6dd65bb2
0x6dd65bb6
0x6dd65bb6
0x6dd65b90
0x6dd65b85
0x00000000
0x00000000
0x00000000
0x6dd65b18
0x6dd65b11
0x00000000
0x00000000
0x00000000
0x6dd65aed
0x6dd65ae4

APIs

Part of subcall function 6DD64AD0: TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,6DD65ADA,?,?,?,?,6DD66ADD), ref: 6DD64AED

pthread_mutex_lock.LIBWINPTHREAD-1(?,?,?,?,6DD66ADD), ref: 6DD65AFE
pthread_mutex_unlock.LIBWINPTHREAD-1(?,?,?,?,6DD66ADD), ref: 6DD65B1D

Memory Dump Source

Source File: 00000004.00000002.787395814.000000006DD61000.00000040.00000001.01000000.0000000A.sdmp, Offset: 6DD60000, based on PE: true

Associated: 00000004.00000002.787383138.000000006DD60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787413037.000000006DD6B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787415936.000000006DD6F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787437708.000000006DD74000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787474619.000000006DDD6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787482411.000000006DDE6000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6dd60000_windowsconnect.jbxd

Similarity

API ID: Valuepthread_mutex_lockpthread_mutex_unlock
String ID:
API String ID: 2393744784-0
Opcode ID: b3997d9facde34e1c5b0bbf59146b5d722dc3e7e07b3f2ee04d938943ba3fd01
Instruction ID: bd319b76a3fe45afa99c7757247a2e1aeb59d50874478ae71be4fd9867e39370
Opcode Fuzzy Hash: b3997d9facde34e1c5b0bbf59146b5d722dc3e7e07b3f2ee04d938943ba3fd01
Instruction Fuzzy Hash: AE3165B16086818BDB10BF79988077A7BA4BF15358F460668F99587183E730E48587F2

Uniqueness

Uniqueness Score: -1.00%

Function 6DD67FF0 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 124
filememoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

fwrite.MSVCRT ref: 6DD6801F
vfprintf.MSVCRT ref: 6DD6803F
abort.MSVCRT ref: 6DD68044
VirtualQuery.KERNEL32 ref: 6DD680D7
VirtualProtect.KERNEL32 ref: 6DD6812D
GetLastError.KERNEL32 ref: 6DD6813A

Strings

Mingw-w64 runtime failure:, xrefs: 6DD68018
Address %p has no image-section, xrefs: 6DD6817B
VirtualQuery failed for %d bytes at address %p, xrefs: 6DD68167
@, xrefs: 6DD6811E
VirtualProtect failed with code 0x%x, xrefs: 6DD68140

Memory Dump Source

Source File: 00000004.00000002.787395814.000000006DD61000.00000040.00000001.01000000.0000000A.sdmp, Offset: 6DD60000, based on PE: true

Associated: 00000004.00000002.787383138.000000006DD60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787413037.000000006DD6B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787415936.000000006DD6F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787437708.000000006DD74000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787474619.000000006DDD6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787482411.000000006DDE6000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6dd60000_windowsconnect.jbxd

Similarity

API ID: Virtual$ErrorLastProtectQueryabortfwritevfprintf
String ID: VirtualProtect failed with code 0x%x$ VirtualQuery failed for %d bytes at address %p$@$Address %p has no image-section$Mingw-w64 runtime failure:
API String ID: 1616349570-4164700141
Opcode ID: 9c0bf37e0b0ed075cce7d6d96a6bb70b1785e268d3eda1f440a01844efd09598
Instruction ID: 767f1dc8d9872e9c7c777e673c1816927ba8f174abb0de83a9af229e1f625182
Opcode Fuzzy Hash: 9c0bf37e0b0ed075cce7d6d96a6bb70b1785e268d3eda1f440a01844efd09598
Instruction Fuzzy Hash: EF4137B19083819BDB00FF29C584A6ABBF4FF86714F41891EE99887295E734D4448BF2

Uniqueness

Uniqueness Score: -1.00%

Function 6DD64AD0 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 97
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 19%

			E6DD64AD0(void* __ebx, signed char __ecx, void* __edi, void* __esi) {
				void* _t76;
				void* _t81;
				void* _t86;
				signed int _t87;
				signed char _t90;
				signed char _t91;
				signed int _t93;
				signed int _t97;
				signed char _t98;
				signed char _t102;
				int _t106;
				int _t111;
				void* _t115;
				void* _t117;
				signed char _t122;
				void* _t123;
				signed char _t124;
				signed int* _t127;
				void* _t128;
				signed int _t131;
				void* _t134;
				signed int _t136;
				void* _t141;
				intOrPtr* _t142;
				signed char** _t143;
				void** _t145;
				signed int _t146;
				intOrPtr* _t147;

				_t125 = __edi;
				_t122 = __ecx;
				_push(_t134);
				_push(__edi);
				_t142 = _t141 - 0x2c;
				_t149 =  *0x6dd6c050 - 1;
				if( *0x6dd6c050 != 1) {
					E6DD64990(__ecx, _t123, _t134, _t149);
				}
				 *_t142 =  *0x6dd6a020;
				_t76 = TlsGetValue(??);
				_t143 = _t142 - 4;
				_t115 = _t76;
				if(_t76 == 0) {
					_t131 = E6DD648D0(__eflags);
					__eflags =  *0x6dd70020;
					if( *0x6dd70020 == 0) {
						goto L3;
					} else {
						__eflags = _t131;
						if(_t131 == 0) {
							goto L3;
						} else {
							 *(_t131 + 0x24) = 1;
							 *((intOrPtr*)(_t131 + 0x3c)) = GetCurrentThreadId();
							_t143[3] = 0;
							_t143[2] = 0;
							_t143[1] = 1;
							 *_t143 = 0;
							_t81 = CreateEventA(??, ??, ??, ??);
							 *((intOrPtr*)(_t131 + 0x1c)) = 0xffffffff;
							 *(_t131 + 0x18) = _t81;
							_t145 = _t143 - 0x10;
							_t8 = _t131 + 0x38; // 0x38
							E6DD64A20(_t8, _t115, _t125, _t131);
							_t136 =  *0x6dd6f1a0;
							 *(_t131 + 0x64) = 0;
							 *(_t131 + 0x14) = 0;
							_t127 = GetCurrentProcess();
							_t117 = GetCurrentThread();
							_t86 = GetCurrentProcess();
							_t11 = _t131 + 0x14; // 0x14
							_t124 = _t11;
							_t145[2] = _t127;
							_t145[6] = 2;
							_t145[5] = 0;
							_t145[4] = 0;
							_t145[3] = _t124;
							_t145[1] = _t117;
							 *_t145 = _t86;
							_t87 = DuplicateHandle(??, ??, ??, ??, ??, ??, ??);
							_t146 = _t145 - 0x1c;
							__eflags = _t87;
							if(_t87 == 0) {
								L9:
								abort();
								asm("ud2");
								 *0 =  *(_t146 + 0x1c);
								asm("ud2");
								_t90 = _t146 + 0x14;
								 *0 = _t90;
								asm("ud2");
								asm("invalid");
								asm("invalid");
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								asm("invalid");
								asm("invalid");
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								 *_t90 =  *_t90 + _t90;
								__eflags =  *_t90;
								asm("das");
								if(__eflags <= 0) {
									L28:
									asm("bound esp, [ecx+0x72]");
									if(__eflags < 0) {
										goto L50;
									} else {
										goto L29;
									}
								} else {
									if(__eflags < 0) {
										L17:
										asm("popad");
										if(__eflags < 0) {
											goto L38;
										} else {
											if (__eflags >= 0) goto L29;
											goto L19;
										}
									} else {
										if(__eflags == 0) {
											L31:
											__eflags = _t91 - 0x494c203d;
											goto L32;
										} else {
											if(__eflags < 0) {
												L19:
												if(__eflags >= 0) {
													L29:
													if(__eflags < 0) {
														goto L36;
													} else {
														_t91 = _t90 - 0x6c61763e;
														_t146 =  *(_t91 + 0x3d) * 0x494c203d;
														__eflags = _t146;
														goto L31;
													}
												} else {
													if(__eflags > 0) {
														if(__eflags >= 0) {
															 *[gs:0x6c202c73] =  *[gs:0x6c202c73] & _t90;
															__eflags =  *[gs:0x6c202c73];
															goto L49;
														} else {
															 *[ds:eax] =  *[ds:eax] & _t124;
															 *_t90 =  *_t90 - _t90;
															_t122 =  &(1[_t122]);
															__eflags = _t122;
															if(__eflags >= 0) {
																goto L63;
															} else {
																if(__eflags < 0) {
																	goto L64;
																} else {
																	_t136 = _t127[0x1b] * 0x69616620;
																	__eflags = _t136;
																	goto L43;
																}
															}
														}
													} else {
														asm("outsb");
														if(__eflags < 0) {
															L43:
															asm("outsd");
															asm("outsb");
															goto L44;
														} else {
															_push(0x64616572);
															if(__eflags >= 0) {
																L32:
																__eflags = _t91 - 0x46494c20;
																_t136 =  &(1[_t136]);
																_pop(_t127);
																_t124 =  &(1[_t124]);
																_t122 =  &(1[_t122]);
																__eflags = _t122;
																_push(_t124);
																_push(_t124);
																goto L33;
															} else {
																if(__eflags >= 0) {
																	L46:
																	__eflags = _t90 -  *[fs:eax];
																	 *0x202c2973 =  *0x202c2973 - _t90;
																	__eflags =  *0x202c2973;
																} else {
																	asm("arpl [edi], bp");
																	asm("bound esp, [ecx+0x72]");
																	if(__eflags < 0) {
																		L45:
																		_t136 =  *(_t136 + 0x64) * 0x2528203a;
																		__eflags = _t136;
																		goto L46;
																	} else {
																		if(__eflags < 0) {
																			L33:
																			_t122 = _t122 - 1;
																			_t136 =  &(1[_t136]);
																			_push(_t124);
																			 *_t91 =  *_t91 - _t146;
																			 *[es:eax] =  *[es:eax] & _t122;
																			 *_t91 =  *_t91 - _t122;
																			__eflags =  *_t91;
																			asm("bound esp, [ecx+0x72]");
																			if(__eflags < 0) {
																				goto L54;
																			} else {
																				if(__eflags < 0) {
																					goto L53;
																				} else {
																					if(__eflags == 0) {
																						L44:
																						_t38 = _t131 + 0x61;
																						 *_t38 =  *(_t131 + 0x61) & _t90;
																						__eflags =  *_t38;
																						goto L45;
																					} else {
																						L36:
																						_t122 = _t122 -  *_t122;
																						_t91 = _t90 -  *(_t124 + 0x61);
																						__eflags = _t91;
																						if(__eflags < 0) {
																							goto L60;
																						} else {
																							_t146 =  *(_t136 + 0x72) * 0x623e2d29;
																							__eflags = _t146;
																							L38:
																							_t90 = _t91 - 0x7375623e;
																							__eflags = _t90;
																						}
																					}
																				}
																			}
																		} else {
																			asm("arpl [eax], ax");
																			 *_t90 =  *_t90 - _t122;
																			_t31 = _t124 + 0x61;
																			 *_t31 =  *(_t124 + 0x61) - _t90;
																			__eflags =  *_t31;
																			if( *_t31 < 0) {
																				L49:
																				asm("insb");
																				_t136 =  *(_t131 + 0x65) * 0xa642520;
																				__eflags = _t136;
																				L50:
																				_t91 = _t90 & 0x00000a64;
																				_t43 = _t117 + 0x25;
																				 *_t43 =  *(_t117 + 0x25) + _t91;
																				__eflags =  *_t43;
																				if(__eflags < 0) {
																					L55:
																					asm("das");
																					if(__eflags <= 0) {
																						goto L81;
																					} else {
																						if(__eflags < 0) {
																							goto L68;
																						} else {
																							if(__eflags == 0) {
																								goto L85;
																							} else {
																								goto L58;
																							}
																						}
																					}
																				} else {
																					_t117 = _t117 + 1;
																					_t91 = (_t91 & 0x73252064 |  *(_t91 & 0x73252064)) & 0x64252070;
																					_t45 = _t131 + 0x3d;
																					 *_t45 =  *(_t131 + 0x3d) & _t124;
																					__eflags =  *_t45;
																					__eflags = _t91 - 0x20583025;
																					if(__eflags > 0) {
																						L67:
																						if (__eflags < 0) goto L90;
																						L68:
																						asm("popad");
																					} else {
																						L53:
																						_t91 = _t91 & 0x2520646c;
																						__eflags = _t91;
																						if(__eflags >= 0) {
																							L58:
																							if(__eflags < 0) {
																								if(__eflags >= 0) {
																									goto L83;
																								} else {
																									if(__eflags > 0) {
																										goto L93;
																									} else {
																										asm("outsb");
																										if(__eflags < 0) {
																											goto L98;
																										} else {
																											_push(0x64616572);
																											if(__eflags >= 0) {
																												goto L86;
																											} else {
																												if(__eflags >= 0) {
																													_t91 = _t91 - 0x20;
																													__eflags = _t91;
																													goto L100;
																												} else {
																													asm("arpl [edi], bp");
																													if(__eflags < 0) {
																														goto L101;
																													} else {
																														asm("insb");
																														goto L78;
																													}
																												}
																											}
																										}
																									}
																								}
																							} else {
																								asm("bound esi, [ebp+0x69]");
																								asm("insb");
																								asm("das");
																								asm("insd");
																								_t136 =  *(_t131 + 0x67) * 0x36772d77;
																								__eflags = _t136;
																								L60:
																								asm("a16 ja 0x30");
																								if(__eflags > 0) {
																									L78:
																									asm("outsd");
																									asm("arpl [ebx+0x2e], bp");
																									asm("arpl [eax], ax");
																									 *_t91 =  *_t91 + _t122;
																									 *_t91 =  *_t91 - _t122;
																									__eflags =  *_t91;
																									if(__eflags < 0) {
																										goto L103;
																									} else {
																										goto L79;
																									}
																								} else {
																									_t98 = _t91 ^ 0x0000002d;
																									_t48 = _t122 + 0x31;
																									 *_t48 =  *(_t122 + 0x31) ^ _t98;
																									__eflags =  *_t48;
																									_t91 = _t98 ^ 0x6438370d;
																									__eflags =  *_t127 - _t122;
																									L63:
																									asm("insd");
																									_t136 =  *(_t131 + 0x67) * 0x36772d77;
																									__eflags = _t136;
																									L64:
																									if(__eflags > 0) {
																										L79:
																										asm("insb");
																										asm("outsd");
																										asm("arpl [ebx+0x5f], bp");
																										if(__eflags == 0) {
																											goto L87;
																										} else {
																											_t122 = _t122 -  *_t122;
																											_t124 = _t124 -  *((intOrPtr*)(_t124 + 0x77));
																											__eflags = _t124;
																											goto L81;
																										}
																									} else {
																										if(__eflags > 0) {
																											L81:
																											if(__eflags > 0) {
																												L104:
																												if(__eflags >= 0) {
																													 *((intOrPtr*)(_t124 + 0x57)) =  *((intOrPtr*)(_t124 + 0x57)) + _t124;
																													_t146 = _t146 - 1;
																													_t97 = (_t91 & 0x73252064 |  *(_t91 & 0x73252064)) & 0x64252070;
																													__eflags = _t97;
																													 *[fs:esi+0x3d] =  *[fs:esi+0x3d] & _t124;
																													_t91 = _t97 & 0x42205830;
																													_t91 - 0x72206425 = _t91 - 0x20646c25;
																												}
																												 *[fs:edi+0x3d] =  *[fs:edi+0x3d] & _t124;
																												__eflags =  *[fs:edi+0x3d];
																											} else {
																												 *0x6c61763e =  *0x6c61763e - _t136;
																												__eflags =  *0x6c61763e;
																												L83:
																												if(__eflags <= 0) {
																													L102:
																													_t91 = _t91 |  *_t91;
																													__eflags = _t91;
																													_push(_t124);
																													_push(_t127);
																													L103:
																													_t146 = _t146 - 1;
																													_t91 = _t91 & 0x64252070;
																													__eflags = _t91;
																													goto L104;
																												} else {
																													asm("insb");
																													_t146 =  *(_t91 + 0x3d) * 0x494c203d;
																													__eflags = _t146;
																													L85:
																													_t131 =  &(1[_t131]);
																													__eflags = _t131;
																													L86:
																													_t136 =  &(1[_t136]);
																													_pop(_t128);
																													_push(_t124);
																													_push(_t128);
																													_t146 = _t146 - 1;
																													_t127 = _t128 - 1;
																													 *_t91 =  *_t91 - _t146;
																													 *[es:eax] =  *[es:eax] & _t122;
																													__eflags =  *[es:eax];
																													L87:
																													 *[es:eax] =  *[es:eax] & _t122;
																													 *_t91 =  *_t91 - _t122;
																													__eflags =  *_t91;
																													if(__eflags < 0) {
																														_t93 = _t91 & 0x73252070 |  *(_t91 & 0x73252070);
																														__eflags = _t93;
																													} else {
																														asm("insb");
																														asm("outsd");
																														asm("arpl [ebx+0x5f], bp");
																														if(__eflags == 0) {
																															L97:
																															asm("popa");
																															_t136 =  *(_t136 + 0x64) * 0x2528203a;
																															__eflags = _t136;
																															L98:
																															__eflags = _t91 -  *[fs:eax];
																															 *0x202c2973 =  *0x202c2973 - _t91;
																															__eflags =  *0x202c2973;
																														} else {
																															_t122 = _t122 -  *_t122;
																															_t124 = _t124 -  *((intOrPtr*)(_t124 + 0x77));
																															asm("insb");
																															 *0x7375623e =  *0x7375623e - _t136;
																															__eflags =  *0x7375623e;
																															asm("bound esi, [ds:ebp+0x73]");
																															if(__eflags >= 0) {
																																L100:
																																__eflags =  *(_t136 + 0x20) * 0x7325;
																																L101:
																																_t91 = _t91 - 0x20;
																																asm("insb");
																																_t136 =  *(_t131 + 0x65) * 0xa642520;
																																__eflags = _t136;
																																goto L102;
																															} else {
																																 *[ds:eax] =  *[ds:eax] & _t124;
																																 *_t91 =  *_t91 - _t91;
																																__eflags =  *_t91;
																																 *_t91 =  *_t91 + _t91;
																																 *_t91 =  *_t91 + _t91;
																																_t122 =  &(1[_t122]);
																																__eflags = _t122;
																																L93:
																																if(__eflags >= 0) {
																																	_t127[0x1b] = _t127[0x1b] & _t122;
																																	asm("arpl [ebp+0x20], sp");
																																	goto L116;
																																} else {
																																	if (__eflags < 0) goto L116;
																																	if(__eflags < 0) {
																																		L116:
																																		 *[gs:0x73692070] =  *[gs:0x73692070] & _t91;
																																		 *0xa64 =  *0xa64 & _t91;
																																		_t65 = _t136 + 0x72;
																																		 *_t65 =  *(_t136 + 0x72) + _t91;
																																		__eflags =  *_t65;
																																		if (__eflags < 0) goto L130;
																																		asm("outsd");
																																	} else {
																																		_t136 = _t127[0x1b] * 0x69616620;
																																		__eflags = _t136;
																																		goto L97;
																																	}
																																}
																															}
																														}
																													}
																												}
																											}
																										} else {
																											_t91 = _t91 ^ 0x0000002d;
																											asm("insb");
																											_t146 =  *(_t124 + 0x72) * 0x65697261;
																											__eflags = _t146;
																											goto L67;
																										}
																									}
																								}
																							}
																						} else {
																							L54:
																							 *_t91 =  *_t91 + _t91;
																							 *_t127 =  *_t127 + _t122;
																							__eflags =  *_t127;
																							goto L55;
																						}
																					}
																				}
																			} else {
																				_t146 =  *(_t136 + 0x72) * 0x2a20745f;
																				 *_t124 =  *_t124 - _t136;
																				__eflags =  *_t124;
																				goto L28;
																			}
																		}
																	}
																}
															}
														}
													}
												}
											} else {
												asm("bound esi, [ebp+0x69]");
												asm("insb");
												asm("das");
												asm("insd");
												_t102 = _t90 ^ 0x0000002d;
												 *(_t122 + 0x31) =  *(_t122 + 0x31) ^ _t102;
												__eflags =  *_t127 - _t122;
												asm("insd");
												_t136 =  *(_t131 + 0x67) * 0x36772d77;
												_t91 = _t102 ^ 0x64383720;
												asm("insb");
												_t146 =  *(_t124 + 0x72) * 0x65697261;
												__eflags = _t146;
												goto L17;
											}
										}
									}
								}
							} else {
								 *_t146 =  *(_t131 + 0x14);
								_t106 = GetThreadPriority(??);
								 *(_t131 + 0x68) = 0;
								 *(_t131 + 0x6c) = _t106;
								_t147 = _t146 - 4;
								 *(_t131 + 0x20) =  *(_t131 + 0x20) & 0xcf | 0x00000010;
								 *(_t147 + 4) = _t131;
								 *_t147 =  *0x6dd6a020;
								_t111 = TlsSetValue(??, ??);
								_t146 = _t147 - 8;
								__eflags = _t111;
								if(_t111 == 0) {
									goto L9;
								} else {
									return _t131;
								}
							}
						}
					}
				} else {
					L3:
					return _t115;
				}
			}

0x6dd64ad0
0x6dd64ad0
0x6dd64ad0
0x6dd64ad1
0x6dd64ad4
0x6dd64ad7
0x6dd64ade
0x6dd64ae0
0x6dd64ae0
0x6dd64aea
0x6dd64aed
0x6dd64af3
0x6dd64af6
0x6dd64afa
0x6dd64b15
0x6dd64b1c
0x6dd64b1e
0x00000000
0x6dd64b20
0x6dd64b20
0x6dd64b22
0x00000000
0x6dd64b24
0x6dd64b24
0x6dd64b31
0x6dd64b34
0x6dd64b3c
0x6dd64b44
0x6dd64b4c
0x6dd64b53
0x6dd64b59
0x6dd64b60
0x6dd64b63
0x6dd64b66
0x6dd64b69
0x6dd64b6e
0x6dd64b74
0x6dd64b7b
0x6dd64b84
0x6dd64b8c
0x6dd64b8e
0x6dd64b90
0x6dd64b90
0x6dd64b93
0x6dd64b97
0x6dd64b9f
0x6dd64ba7
0x6dd64baf
0x6dd64bb3
0x6dd64bb7
0x6dd64bba
0x6dd64bc0
0x6dd64bc3
0x6dd64bc5
0x6dd695c5
0x6dd695c5
0x6dd695cf
0x6dd695d5
0x6dd695da
0x6dd695dc
0x6dd695e0
0x6dd695e5
0x6dd695e8
0x6dd695ea
0x6dd695ec
0x6dd695ee
0x6dd695f0
0x6dd695f2
0x6dd695f4
0x6dd695f6
0x6dd695f8
0x6dd695fa
0x6dd695fc
0x6dd695fe
0x6dd69600
0x6dd69602
0x6dd69604
0x6dd69606
0x6dd69608
0x6dd6960a
0x6dd6960c
0x6dd6960e
0x6dd69610
0x6dd69612
0x6dd69614
0x6dd69616
0x6dd69618
0x6dd6961a
0x6dd6961c
0x6dd6961e
0x6dd69620
0x6dd69622
0x6dd69624
0x6dd69626
0x6dd69628
0x6dd6962a
0x6dd6962c
0x6dd6962e
0x6dd69630
0x6dd69632
0x6dd69634
0x6dd69636
0x6dd69638
0x6dd6963a
0x6dd6963c
0x6dd6963e
0x6dd69640
0x6dd69642
0x6dd69644
0x6dd69646
0x6dd69648
0x6dd6964a
0x6dd6964c
0x6dd6964e
0x6dd69650
0x6dd69652
0x6dd69654
0x6dd69656
0x6dd69658
0x6dd6965a
0x6dd6965c
0x6dd6965e
0x6dd69660
0x6dd69662
0x6dd69664
0x6dd69666
0x6dd69668
0x6dd6966a
0x6dd6966c
0x6dd6966e
0x6dd69670
0x6dd69672
0x6dd69674
0x6dd69676
0x6dd69678
0x6dd6967a
0x6dd6967c
0x6dd6967e
0x6dd69680
0x6dd69682
0x6dd69684
0x6dd69686
0x6dd69688
0x6dd6968a
0x6dd6968c
0x6dd6968e
0x6dd69690
0x6dd69692
0x6dd69694
0x6dd69696
0x6dd69698
0x6dd6969a
0x6dd6969c
0x6dd6969e
0x6dd696a0
0x6dd696a2
0x6dd696a4
0x6dd696a6
0x6dd696a8
0x6dd696aa
0x6dd696ac
0x6dd696ae
0x6dd696b0
0x6dd696b2
0x6dd696b4
0x6dd696b6
0x6dd696b8
0x6dd696ba
0x6dd696bc
0x6dd696be
0x6dd696c0
0x6dd696c2
0x6dd696c4
0x6dd696c6
0x6dd696c8
0x6dd696ca
0x6dd696cc
0x6dd696ce
0x6dd696d0
0x6dd696d2
0x6dd696d4
0x6dd696d6
0x6dd696d8
0x6dd696da
0x6dd696dc
0x6dd696de
0x6dd696e0
0x6dd696e2
0x6dd696e4
0x6dd696e6
0x6dd696e8
0x6dd696ea
0x6dd696ec
0x6dd696ee
0x6dd696f0
0x6dd696f2
0x6dd696f4
0x6dd696f6
0x6dd696f8
0x6dd696fa
0x6dd696fc
0x6dd696fe
0x6dd69700
0x6dd69702
0x6dd69704
0x6dd69706
0x6dd69708
0x6dd6970a
0x6dd6970c
0x6dd6970e
0x6dd69710
0x6dd69712
0x6dd69714
0x6dd69716
0x6dd69718
0x6dd6971a
0x6dd6971c
0x6dd6971e
0x6dd69720
0x6dd69722
0x6dd69724
0x6dd69726
0x6dd69728
0x6dd6972a
0x6dd6972c
0x6dd6972e
0x6dd69730
0x6dd69732
0x6dd69734
0x6dd69736
0x6dd69738
0x6dd6973a
0x6dd6973c
0x6dd6973e
0x6dd69740
0x6dd69742
0x6dd69744
0x6dd69746
0x6dd69748
0x6dd6974a
0x6dd6974c
0x6dd6974e
0x6dd69750
0x6dd69752
0x6dd69754
0x6dd69756
0x6dd69758
0x6dd6975a
0x6dd6975c
0x6dd6975e
0x6dd69760
0x6dd69762
0x6dd69764
0x6dd69766
0x6dd69768
0x6dd6976a
0x6dd6976c
0x6dd6976e
0x6dd69770
0x6dd69772
0x6dd69774
0x6dd69776
0x6dd69778
0x6dd6977a
0x6dd6977c
0x6dd6977e
0x6dd69780
0x6dd69782
0x6dd69784
0x6dd69786
0x6dd69788
0x6dd6978a
0x6dd6978c
0x6dd6978e
0x6dd69790
0x6dd69792
0x6dd69794
0x6dd69796
0x6dd69798
0x6dd6979a
0x6dd6979c
0x6dd6979e
0x6dd697a0
0x6dd697a2
0x6dd697a4
0x6dd697a6
0x6dd697a8
0x6dd697aa
0x6dd697ac
0x6dd697ae
0x6dd697b0
0x6dd697b2
0x6dd697b4
0x6dd697b6
0x6dd697b8
0x6dd697ba
0x6dd697bc
0x6dd697be
0x6dd697c0
0x6dd697c2
0x6dd697c4
0x6dd697c6
0x6dd697c8
0x6dd697ca
0x6dd697cc
0x6dd697ce
0x6dd697d0
0x6dd697d2
0x6dd697d4
0x6dd697d6
0x6dd697d8
0x6dd697da
0x6dd697dc
0x6dd697de
0x6dd697e0
0x6dd697e2
0x6dd697e4
0x6dd697e6
0x6dd697e8
0x6dd697ea
0x6dd697ec
0x6dd697ee
0x6dd697f0
0x6dd697f2
0x6dd697f4
0x6dd697f6
0x6dd697f8
0x6dd697fa
0x6dd697fc
0x6dd697fe
0x6dd69800
0x6dd69802
0x6dd69804
0x6dd69806
0x6dd69808
0x6dd6980a
0x6dd6980c
0x6dd6980e
0x6dd69810
0x6dd69812
0x6dd69814
0x6dd69816
0x6dd69818
0x6dd6981a
0x6dd6981c
0x6dd6981e
0x6dd69820
0x6dd69822
0x6dd69824
0x6dd69826
0x6dd69828
0x6dd6982a
0x6dd6982c
0x6dd6982e
0x6dd69830
0x6dd69832
0x6dd69834
0x6dd69836
0x6dd69838
0x6dd6983a
0x6dd6983c
0x6dd6983e
0x6dd69840
0x6dd69842
0x6dd69844
0x6dd69846
0x6dd69848
0x6dd6984a
0x6dd6984c
0x6dd6984e
0x6dd69850
0x6dd69852
0x6dd69854
0x6dd69856
0x6dd69858
0x6dd6985a
0x6dd6985c
0x6dd6985e
0x6dd69860
0x6dd69862
0x6dd69864
0x6dd69866
0x6dd69868
0x6dd6986a
0x6dd6986c
0x6dd6986e
0x6dd69870
0x6dd69872
0x6dd69874
0x6dd69876
0x6dd69878
0x6dd6987a
0x6dd6987c
0x6dd6987e
0x6dd69880
0x6dd69882
0x6dd69884
0x6dd69886
0x6dd69888
0x6dd6988a
0x6dd6988c
0x6dd6988e
0x6dd69890
0x6dd69892
0x6dd69894
0x6dd69896
0x6dd69898
0x6dd6989a
0x6dd6989c
0x6dd6989e
0x6dd698a0
0x6dd698a2
0x6dd698a4
0x6dd698a6
0x6dd698a8
0x6dd698aa
0x6dd698ac
0x6dd698ae
0x6dd698b0
0x6dd698b2
0x6dd698b4
0x6dd698b6
0x6dd698b8
0x6dd698ba
0x6dd698bc
0x6dd698be
0x6dd698c0
0x6dd698c2
0x6dd698c4
0x6dd698c6
0x6dd698c8
0x6dd698ca
0x6dd698cc
0x6dd698ce
0x6dd698d0
0x6dd698d2
0x6dd698d4
0x6dd698d6
0x6dd698d8
0x6dd698da
0x6dd698dc
0x6dd698de
0x6dd698e0
0x6dd698e2
0x6dd698e4
0x6dd698e6
0x6dd698e8
0x6dd698ea
0x6dd698ec
0x6dd698ee
0x6dd698f0
0x6dd698f2
0x6dd698f4
0x6dd698f6
0x6dd698f8
0x6dd698fa
0x6dd698fc
0x6dd698fe
0x6dd69900
0x6dd69902
0x6dd69904
0x6dd69906
0x6dd69908
0x6dd6990a
0x6dd6990c
0x6dd6990e
0x6dd69910
0x6dd69912
0x6dd69914
0x6dd69916
0x6dd69918
0x6dd6991a
0x6dd6991c
0x6dd6991e
0x6dd69920
0x6dd69922
0x6dd69924
0x6dd69926
0x6dd69928
0x6dd6992a
0x6dd6992c
0x6dd6992e
0x6dd69930
0x6dd69932
0x6dd69934
0x6dd69936
0x6dd69938
0x6dd6993a
0x6dd6993c
0x6dd6993e
0x6dd69940
0x6dd69942
0x6dd69944
0x6dd69946
0x6dd69948
0x6dd6994a
0x6dd6994c
0x6dd6994e
0x6dd69950
0x6dd69952
0x6dd69954
0x6dd69956
0x6dd69958
0x6dd6995a
0x6dd6995c
0x6dd6995e
0x6dd69960
0x6dd69962
0x6dd69964
0x6dd69966
0x6dd69968
0x6dd6996a
0x6dd6996c
0x6dd6996e
0x6dd69970
0x6dd69972
0x6dd69974
0x6dd69976
0x6dd69978
0x6dd6997a
0x6dd6997c
0x6dd6997e
0x6dd69980
0x6dd69982
0x6dd69984
0x6dd69986
0x6dd69988
0x6dd6998a
0x6dd6998c
0x6dd6998e
0x6dd69990
0x6dd69992
0x6dd69994
0x6dd69996
0x6dd69998
0x6dd6999a
0x6dd6999c
0x6dd6999e
0x6dd699a0
0x6dd699a2
0x6dd699a4
0x6dd699a6
0x6dd699a8
0x6dd699aa
0x6dd699ac
0x6dd699ae
0x6dd699b0
0x6dd699b2
0x6dd699b4
0x6dd699b6
0x6dd699b8
0x6dd699ba
0x6dd699bc
0x6dd699be
0x6dd699c0
0x6dd699c2
0x6dd699c4
0x6dd699c6
0x6dd699c8
0x6dd699ca
0x6dd699cc
0x6dd699ce
0x6dd699d0
0x6dd699d2
0x6dd699d4
0x6dd699d6
0x6dd699d8
0x6dd699da
0x6dd699dc
0x6dd699de
0x6dd699e0
0x6dd699e2
0x6dd699e4
0x6dd699e6
0x6dd699e8
0x6dd699ea
0x6dd699ec
0x6dd699ee
0x6dd699f0
0x6dd699f2
0x6dd699f4
0x6dd699f6
0x6dd699f8
0x6dd699fa
0x6dd699fc
0x6dd699fe
0x6dd69a00
0x6dd69a02
0x6dd69a04
0x6dd69a06
0x6dd69a08
0x6dd69a0a
0x6dd69a0c
0x6dd69a0e
0x6dd69a10
0x6dd69a12
0x6dd69a14
0x6dd69a16
0x6dd69a18
0x6dd69a1a
0x6dd69a1c
0x6dd69a1e
0x6dd69a20
0x6dd69a22
0x6dd69a24
0x6dd69a26
0x6dd69a28
0x6dd69a2a
0x6dd69a2c
0x6dd69a2e
0x6dd69a30
0x6dd69a32
0x6dd69a34
0x6dd69a36
0x6dd69a38
0x6dd69a3a
0x6dd69a3c
0x6dd69a3e
0x6dd69a40
0x6dd69a42
0x6dd69a44
0x6dd69a46
0x6dd69a48
0x6dd69a4a
0x6dd69a4c
0x6dd69a4e
0x6dd69a50
0x6dd69a52
0x6dd69a54
0x6dd69a56
0x6dd69a58
0x6dd69a5a
0x6dd69a5c
0x6dd69a5e
0x6dd69a60
0x6dd69a62
0x6dd69a64
0x6dd69a66
0x6dd69a68
0x6dd69a6a
0x6dd69a6c
0x6dd69a6e
0x6dd69a70
0x6dd69a72
0x6dd69a74
0x6dd69a76
0x6dd69a78
0x6dd69a7a
0x6dd69a7c
0x6dd69a7e
0x6dd69a80
0x6dd69a82
0x6dd69a84
0x6dd69a86
0x6dd69a88
0x6dd69a8a
0x6dd69a8c
0x6dd69a8e
0x6dd69a90
0x6dd69a92
0x6dd69a94
0x6dd69a96
0x6dd69a98
0x6dd69a9a
0x6dd69a9c
0x6dd69a9e
0x6dd69aa0
0x6dd69aa2
0x6dd69aa4
0x6dd69aa6
0x6dd69aa8
0x6dd69aaa
0x6dd69aac
0x6dd69aae
0x6dd69ab0
0x6dd69ab2
0x6dd69ab4
0x6dd69ab6
0x6dd69ab8
0x6dd69aba
0x6dd69abc
0x6dd69abe
0x6dd69ac0
0x6dd69ac2
0x6dd69ac4
0x6dd69ac6
0x6dd69ac8
0x6dd69aca
0x6dd69acc
0x6dd69ace
0x6dd69ad0
0x6dd69ad2
0x6dd69ad4
0x6dd69ad6
0x6dd69ad8
0x6dd69ada
0x6dd69adc
0x6dd69ade
0x6dd69ae0
0x6dd69ae2
0x6dd69ae4
0x6dd69ae6
0x6dd69ae8
0x6dd69aea
0x6dd69aec
0x6dd69aee
0x6dd69af0
0x6dd69af2
0x6dd69af4
0x6dd69af6
0x6dd69af8
0x6dd69afa
0x6dd69afc
0x6dd69afe
0x6dd69b00
0x6dd69b02
0x6dd69b04
0x6dd69b06
0x6dd69b08
0x6dd69b0a
0x6dd69b0c
0x6dd69b0e
0x6dd69b10
0x6dd69b12
0x6dd69b14
0x6dd69b16
0x6dd69b18
0x6dd69b1a
0x6dd69b1c
0x6dd69b1e
0x6dd69b20
0x6dd69b22
0x6dd69b24
0x6dd69b26
0x6dd69b28
0x6dd69b2a
0x6dd69b2c
0x6dd69b2e
0x6dd69b30
0x6dd69b32
0x6dd69b34
0x6dd69b36
0x6dd69b38
0x6dd69b3a
0x6dd69b3c
0x6dd69b3e
0x6dd69b40
0x6dd69b42
0x6dd69b44
0x6dd69b46
0x6dd69b48
0x6dd69b4a
0x6dd69b4c
0x6dd69b4e
0x6dd69b50
0x6dd69b52
0x6dd69b54
0x6dd69b56
0x6dd69b58
0x6dd69b5a
0x6dd69b5c
0x6dd69b5e
0x6dd69b60
0x6dd69b62
0x6dd69b64
0x6dd69b66
0x6dd69b68
0x6dd69b6a
0x6dd69b6c
0x6dd69b6e
0x6dd69b70
0x6dd69b72
0x6dd69b74
0x6dd69b76
0x6dd69b78
0x6dd69b7a
0x6dd69b7c
0x6dd69b7e
0x6dd69b80
0x6dd69b82
0x6dd69b84
0x6dd69b86
0x6dd69b88
0x6dd69b8a
0x6dd69b8c
0x6dd69b8e
0x6dd69b90
0x6dd69b92
0x6dd69b94
0x6dd69b96
0x6dd69b98
0x6dd69b9a
0x6dd69b9c
0x6dd69b9e
0x6dd69ba0
0x6dd69ba2
0x6dd69ba4
0x6dd69ba6
0x6dd69ba8
0x6dd69baa
0x6dd69bac
0x6dd69bae
0x6dd69bb0
0x6dd69bb2
0x6dd69bb4
0x6dd69bb6
0x6dd69bb8
0x6dd69bba
0x6dd69bbc
0x6dd69bbe
0x6dd69bc0
0x6dd69bc2
0x6dd69bc4
0x6dd69bc6
0x6dd69bc8
0x6dd69bca
0x6dd69bcc
0x6dd69bce
0x6dd69bd0
0x6dd69bd2
0x6dd69bd4
0x6dd69bd6
0x6dd69bd8
0x6dd69bda
0x6dd69bdc
0x6dd69bde
0x6dd69be0
0x6dd69be2
0x6dd69be4
0x6dd69be6
0x6dd69be8
0x6dd69bea
0x6dd69bec
0x6dd69bee
0x6dd69bf0
0x6dd69bf2
0x6dd69bf4
0x6dd69bf6
0x6dd69bf8
0x6dd69bfa
0x6dd69bfc
0x6dd69bfe
0x6dd69c00
0x6dd69c02
0x6dd69c04
0x6dd69c06
0x6dd69c08
0x6dd69c0a
0x6dd69c0c
0x6dd69c0e
0x6dd69c10
0x6dd69c12
0x6dd69c14
0x6dd69c16
0x6dd69c18
0x6dd69c1a
0x6dd69c1c
0x6dd69c1e
0x6dd69c20
0x6dd69c22
0x6dd69c24
0x6dd69c26
0x6dd69c28
0x6dd69c2a
0x6dd69c2c
0x6dd69c2e
0x6dd69c30
0x6dd69c32
0x6dd69c34
0x6dd69c36
0x6dd69c38
0x6dd69c3a
0x6dd69c3c
0x6dd69c3e
0x6dd69c40
0x6dd69c42
0x6dd69c44
0x6dd69c46
0x6dd69c48
0x6dd69c4a
0x6dd69c4c
0x6dd69c4e
0x6dd69c50
0x6dd69c52
0x6dd69c54
0x6dd69c56
0x6dd69c58
0x6dd69c5a
0x6dd69c5c
0x6dd69c5e
0x6dd69c60
0x6dd69c62
0x6dd69c64
0x6dd69c66
0x6dd69c68
0x6dd69c6a
0x6dd69c6c
0x6dd69c6e
0x6dd69c70
0x6dd69c72
0x6dd69c74
0x6dd69c76
0x6dd69c78
0x6dd69c7a
0x6dd69c7c
0x6dd69c7e
0x6dd69c80
0x6dd69c82
0x6dd69c84
0x6dd69c86
0x6dd69c88
0x6dd69c8a
0x6dd69c8c
0x6dd69c8e
0x6dd69c90
0x6dd69c92
0x6dd69c94
0x6dd69c96
0x6dd69c98
0x6dd69c9a
0x6dd69c9c
0x6dd69c9e
0x6dd69ca0
0x6dd69ca2
0x6dd69ca4
0x6dd69ca6
0x6dd69ca8
0x6dd69caa
0x6dd69cac
0x6dd69cae
0x6dd69cb0
0x6dd69cb2
0x6dd69cb4
0x6dd69cb6
0x6dd69cb8
0x6dd69cba
0x6dd69cbc
0x6dd69cbe
0x6dd69cc0
0x6dd69cc2
0x6dd69cc4
0x6dd69cc6
0x6dd69cc8
0x6dd69cca
0x6dd69ccc
0x6dd69cce
0x6dd69cd0
0x6dd69cd2
0x6dd69cd4
0x6dd69cd6
0x6dd69cd8
0x6dd69cda
0x6dd69cdc
0x6dd69cde
0x6dd69ce0
0x6dd69ce2
0x6dd69ce4
0x6dd69ce6
0x6dd69ce8
0x6dd69cea
0x6dd69cec
0x6dd69cee
0x6dd69cf0
0x6dd69cf2
0x6dd69cf4
0x6dd69cf6
0x6dd69cf8
0x6dd69cfa
0x6dd69cfc
0x6dd69cfe
0x6dd69d00
0x6dd69d02
0x6dd69d04
0x6dd69d06
0x6dd69d08
0x6dd69d0a
0x6dd69d0c
0x6dd69d0e
0x6dd69d10
0x6dd69d12
0x6dd69d14
0x6dd69d16
0x6dd69d18
0x6dd69d1a
0x6dd69d1c
0x6dd69d1e
0x6dd69d20
0x6dd69d22
0x6dd69d24
0x6dd69d26
0x6dd69d28
0x6dd69d2a
0x6dd69d2c
0x6dd69d2e
0x6dd69d30
0x6dd69d32
0x6dd69d34
0x6dd69d36
0x6dd69d38
0x6dd69d3a
0x6dd69d3c
0x6dd69d3e
0x6dd69d40
0x6dd69d42
0x6dd69d44
0x6dd69d46
0x6dd69d48
0x6dd69d4a
0x6dd69d4c
0x6dd69d4e
0x6dd69d50
0x6dd69d52
0x6dd69d54
0x6dd69d56
0x6dd69d58
0x6dd69d5a
0x6dd69d5c
0x6dd69d5e
0x6dd69d60
0x6dd69d62
0x6dd69d64
0x6dd69d66
0x6dd69d68
0x6dd69d6a
0x6dd69d6c
0x6dd69d6e
0x6dd69d70
0x6dd69d72
0x6dd69d74
0x6dd69d76
0x6dd69d78
0x6dd69d7a
0x6dd69d7c
0x6dd69d7e
0x6dd69d80
0x6dd69d82
0x6dd69d84
0x6dd69d86
0x6dd69d88
0x6dd69d8a
0x6dd69d8c
0x6dd69d8e
0x6dd69d90
0x6dd69d92
0x6dd69d94
0x6dd69d96
0x6dd69d98
0x6dd69d9a
0x6dd69d9c
0x6dd69d9e
0x6dd69da0
0x6dd69da2
0x6dd69da4
0x6dd69da6
0x6dd69da8
0x6dd69daa
0x6dd69dac
0x6dd69dae
0x6dd69db0
0x6dd69db2
0x6dd69db4
0x6dd69db6
0x6dd69db8
0x6dd69dba
0x6dd69dbc
0x6dd69dbe
0x6dd69dc0
0x6dd69dc2
0x6dd69dc4
0x6dd69dc6
0x6dd69dc8
0x6dd69dca
0x6dd69dcc
0x6dd69dce
0x6dd69dd0
0x6dd69dd2
0x6dd69dd4
0x6dd69dd6
0x6dd69dd8
0x6dd69dda
0x6dd69ddc
0x6dd69dde
0x6dd69de0
0x6dd69de2
0x6dd69de4
0x6dd69de6
0x6dd69de8
0x6dd69dea
0x6dd69dec
0x6dd69dee
0x6dd69df0
0x6dd69df2
0x6dd69df4
0x6dd69df6
0x6dd69df8
0x6dd69dfa
0x6dd69dfc
0x6dd69dfe
0x6dd69e00
0x6dd69e02
0x6dd69e04
0x6dd69e06
0x6dd69e08
0x6dd69e0a
0x6dd69e0c
0x6dd69e0e
0x6dd69e10
0x6dd69e12
0x6dd69e14
0x6dd69e16
0x6dd69e18
0x6dd69e1a
0x6dd69e1c
0x6dd69e1e
0x6dd69e20
0x6dd69e22
0x6dd69e24
0x6dd69e26
0x6dd69e28
0x6dd69e2a
0x6dd69e2c
0x6dd69e2e
0x6dd69e30
0x6dd69e32
0x6dd69e34
0x6dd69e36
0x6dd69e38
0x6dd69e3a
0x6dd69e3c
0x6dd69e3e
0x6dd69e40
0x6dd69e42
0x6dd69e44
0x6dd69e46
0x6dd69e48
0x6dd69e4a
0x6dd69e4c
0x6dd69e4e
0x6dd69e50
0x6dd69e52
0x6dd69e54
0x6dd69e56
0x6dd69e58
0x6dd69e5a
0x6dd69e5c
0x6dd69e5e
0x6dd69e60
0x6dd69e62
0x6dd69e64
0x6dd69e66
0x6dd69e68
0x6dd69e6a
0x6dd69e6c
0x6dd69e6e
0x6dd69e70
0x6dd69e72
0x6dd69e74
0x6dd69e76
0x6dd69e78
0x6dd69e7a
0x6dd69e7c
0x6dd69e7e
0x6dd69e80
0x6dd69e82
0x6dd69e84
0x6dd69e86
0x6dd69e88
0x6dd69e8a
0x6dd69e8c
0x6dd69e8e
0x6dd69e90
0x6dd69e92
0x6dd69e94
0x6dd69e96
0x6dd69e98
0x6dd69e9a
0x6dd69e9c
0x6dd69e9e
0x6dd69ea0
0x6dd69ea2
0x6dd69ea4
0x6dd69ea6
0x6dd69ea8
0x6dd69eaa
0x6dd69eac
0x6dd69eae
0x6dd69eb0
0x6dd69eb2
0x6dd69eb4
0x6dd69eb6
0x6dd69eb8
0x6dd69eba
0x6dd69ebc
0x6dd69ebe
0x6dd69ec0
0x6dd69ec2
0x6dd69ec4
0x6dd69ec6
0x6dd69ec8
0x6dd69eca
0x6dd69ecc
0x6dd69ece
0x6dd69ed0
0x6dd69ed2
0x6dd69ed4
0x6dd69ed6
0x6dd69ed8
0x6dd69eda
0x6dd69edc
0x6dd69ede
0x6dd69ee0
0x6dd69ee2
0x6dd69ee4
0x6dd69ee6
0x6dd69ee8
0x6dd69eea
0x6dd69eec
0x6dd69eee
0x6dd69ef0
0x6dd69ef2
0x6dd69ef4
0x6dd69ef6
0x6dd69ef8
0x6dd69efa
0x6dd69efc
0x6dd69efe
0x6dd69f00
0x6dd69f02
0x6dd69f04
0x6dd69f06
0x6dd69f08
0x6dd69f0a
0x6dd69f0c
0x6dd69f0e
0x6dd69f10
0x6dd69f12
0x6dd69f14
0x6dd69f16
0x6dd69f18
0x6dd69f1a
0x6dd69f1c
0x6dd69f1e
0x6dd69f20
0x6dd69f22
0x6dd69f24
0x6dd69f26
0x6dd69f28
0x6dd69f2a
0x6dd69f2c
0x6dd69f2e
0x6dd69f30
0x6dd69f32
0x6dd69f34
0x6dd69f36
0x6dd69f38
0x6dd69f3a
0x6dd69f3c
0x6dd69f3e
0x6dd69f40
0x6dd69f42
0x6dd69f44
0x6dd69f46
0x6dd69f48
0x6dd69f4a
0x6dd69f4c
0x6dd69f4e
0x6dd69f50
0x6dd69f52
0x6dd69f54
0x6dd69f56
0x6dd69f58
0x6dd69f5a
0x6dd69f5c
0x6dd69f5e
0x6dd69f60
0x6dd69f62
0x6dd69f64
0x6dd69f66
0x6dd69f68
0x6dd69f6a
0x6dd69f6c
0x6dd69f6e
0x6dd69f70
0x6dd69f72
0x6dd69f74
0x6dd69f76
0x6dd69f78
0x6dd69f7a
0x6dd69f7c
0x6dd69f7e
0x6dd69f80
0x6dd69f82
0x6dd69f84
0x6dd69f86
0x6dd69f88
0x6dd69f8a
0x6dd69f8c
0x6dd69f8e
0x6dd69f90
0x6dd69f92
0x6dd69f94
0x6dd69f96
0x6dd69f98
0x6dd69f9a
0x6dd69f9c
0x6dd69f9e
0x6dd69fa0
0x6dd69fa2
0x6dd69fa4
0x6dd69fa6
0x6dd69fa8
0x6dd69faa
0x6dd69fac
0x6dd69fae
0x6dd69fb0
0x6dd69fb2
0x6dd69fb4
0x6dd69fb6
0x6dd69fb8
0x6dd69fba
0x6dd69fbc
0x6dd69fbe
0x6dd69fc0
0x6dd69fc2
0x6dd69fc4
0x6dd69fc6
0x6dd69fc8
0x6dd69fca
0x6dd69fcc
0x6dd69fce
0x6dd69fd0
0x6dd69fd2
0x6dd69fd4
0x6dd69fd6
0x6dd69fd8
0x6dd69fda
0x6dd69fdc
0x6dd69fde
0x6dd69fe0
0x6dd69fe2
0x6dd69fe4
0x6dd69fe6
0x6dd69fe8
0x6dd69fea
0x6dd69fec
0x6dd69fee
0x6dd69ff0
0x6dd69ff2
0x6dd69ff4
0x6dd69ff6
0x6dd69ff8
0x6dd69ffa
0x6dd69ffc
0x6dd69ffe
0x6dd6a000
0x6dd6a002
0x6dd6a004
0x6dd6a006
0x6dd6a008
0x6dd6a00a
0x6dd6a00c
0x6dd6a00e
0x6dd6a010
0x6dd6a012
0x6dd6a014
0x6dd6a016
0x6dd6a018
0x6dd6a01a
0x6dd6a01c
0x6dd6a01e
0x6dd6a020
0x6dd6a022
0x6dd6a024
0x6dd6a026
0x6dd6a028
0x6dd6a02a
0x6dd6a02c
0x6dd6a02e
0x6dd6a030
0x6dd6a032
0x6dd6a034
0x6dd6a036
0x6dd6a038
0x6dd6a03a
0x6dd6a03c
0x6dd6a03e
0x6dd6a040
0x6dd6a042
0x6dd6a044
0x6dd6a046
0x6dd6a048
0x6dd6a04a
0x6dd6a04c
0x6dd6a04e
0x6dd6a050
0x6dd6a052
0x6dd6a054
0x6dd6a056
0x6dd6a058
0x6dd6a05a
0x6dd6a05c
0x6dd6a05e
0x6dd6a060
0x6dd6a062
0x6dd6a064
0x6dd6a066
0x6dd6a068
0x6dd6a06a
0x6dd6a06c
0x6dd6a06e
0x6dd6a070
0x6dd6a072
0x6dd6a074
0x6dd6a076
0x6dd6a078
0x6dd6a07a
0x6dd6a07c
0x6dd6a07e
0x6dd6a080
0x6dd6a082
0x6dd6a084
0x6dd6a086
0x6dd6a088
0x6dd6a08a
0x6dd6a08c
0x6dd6a08e
0x6dd6a090
0x6dd6a092
0x6dd6a094
0x6dd6a096
0x6dd6a098
0x6dd6a09a
0x6dd6a09c
0x6dd6a09e
0x6dd6a0a0
0x6dd6a0a2
0x6dd6a0a4
0x6dd6a0a6
0x6dd6a0a8
0x6dd6a0aa
0x6dd6a0ac
0x6dd6a0ae
0x6dd6a0b0
0x6dd6a0b2
0x6dd6a0b4
0x6dd6a0b6
0x6dd6a0b8
0x6dd6a0ba
0x6dd6a0bc
0x6dd6a0be
0x6dd6a0c0
0x6dd6a0c2
0x6dd6a0c4
0x6dd6a0c6
0x6dd6a0c8
0x6dd6a0ca
0x6dd6a0cc
0x6dd6a0ce
0x6dd6a0d0
0x6dd6a0d2
0x6dd6a0d4
0x6dd6a0d6
0x6dd6a0d8
0x6dd6a0da
0x6dd6a0dc
0x6dd6a0de
0x6dd6a0e0
0x6dd6a0e2
0x6dd6a0e4
0x6dd6a0e6
0x6dd6a0e8
0x6dd6a0ea
0x6dd6a0ec
0x6dd6a0ee
0x6dd6a0f0
0x6dd6a0f2
0x6dd6a0f4
0x6dd6a0f6
0x6dd6a0f8
0x6dd6a0fa
0x6dd6a0fc
0x6dd6a0fe
0x6dd6a100
0x6dd6a102
0x6dd6a104
0x6dd6a106
0x6dd6a108
0x6dd6a10a
0x6dd6a10c
0x6dd6a10e
0x6dd6a110
0x6dd6a112
0x6dd6a114
0x6dd6a116
0x6dd6a118
0x6dd6a11a
0x6dd6a11c
0x6dd6a11e
0x6dd6a120
0x6dd6a122
0x6dd6a124
0x6dd6a126
0x6dd6a128
0x6dd6a12a
0x6dd6a12c
0x6dd6a12e
0x6dd6a130
0x6dd6a132
0x6dd6a134
0x6dd6a136
0x6dd6a138
0x6dd6a13a
0x6dd6a13c
0x6dd6a13e
0x6dd6a140
0x6dd6a142
0x6dd6a144
0x6dd6a146
0x6dd6a148
0x6dd6a14a
0x6dd6a14c
0x6dd6a14e
0x6dd6a150
0x6dd6a152
0x6dd6a154
0x6dd6a156
0x6dd6a158
0x6dd6a15a
0x6dd6a15c
0x6dd6a15e
0x6dd6a160
0x6dd6a162
0x6dd6a164
0x6dd6a166
0x6dd6a168
0x6dd6a16a
0x6dd6a16c
0x6dd6a16e
0x6dd6a170
0x6dd6a172
0x6dd6a174
0x6dd6a176
0x6dd6a178
0x6dd6a17a
0x6dd6a17c
0x6dd6a17e
0x6dd6a180
0x6dd6a182
0x6dd6a184
0x6dd6a186
0x6dd6a188
0x6dd6a18a
0x6dd6a18c
0x6dd6a18e
0x6dd6a190
0x6dd6a192
0x6dd6a194
0x6dd6a196
0x6dd6a198
0x6dd6a19a
0x6dd6a19c
0x6dd6a19e
0x6dd6a1a0
0x6dd6a1a2
0x6dd6a1a4
0x6dd6a1a6
0x6dd6a1a8
0x6dd6a1aa
0x6dd6a1ac
0x6dd6a1ae
0x6dd6a1b0
0x6dd6a1b2
0x6dd6a1b4
0x6dd6a1b6
0x6dd6a1b8
0x6dd6a1ba
0x6dd6a1bc
0x6dd6a1be
0x6dd6a1c0
0x6dd6a1c2
0x6dd6a1c4
0x6dd6a1c6
0x6dd6a1c8
0x6dd6a1ca
0x6dd6a1cc
0x6dd6a1ce
0x6dd6a1d0
0x6dd6a1d2
0x6dd6a1d4
0x6dd6a1d6
0x6dd6a1d8
0x6dd6a1da
0x6dd6a1dc
0x6dd6a1de
0x6dd6a1e0
0x6dd6a1e2
0x6dd6a1e4
0x6dd6a1e6
0x6dd6a1e8
0x6dd6a1ea
0x6dd6a1ec
0x6dd6a1ee
0x6dd6a1f0
0x6dd6a1f2
0x6dd6a1f4
0x6dd6a1f6
0x6dd6a1f8
0x6dd6a1fa
0x6dd6a1fc
0x6dd6a1fe
0x6dd6a200
0x6dd6a202
0x6dd6a204
0x6dd6a206
0x6dd6a208
0x6dd6a20a
0x6dd6a20c
0x6dd6a20e
0x6dd6a210
0x6dd6a212
0x6dd6a214
0x6dd6a216
0x6dd6a218
0x6dd6a21a
0x6dd6a21c
0x6dd6a21e
0x6dd6a220
0x6dd6a222
0x6dd6a224
0x6dd6a226
0x6dd6a228
0x6dd6a22a
0x6dd6a22c
0x6dd6a22e
0x6dd6a230
0x6dd6a232
0x6dd6a234
0x6dd6a236
0x6dd6a238
0x6dd6a23a
0x6dd6a23c
0x6dd6a23e
0x6dd6a240
0x6dd6a242
0x6dd6a244
0x6dd6a246
0x6dd6a248
0x6dd6a24a
0x6dd6a24c
0x6dd6a24e
0x6dd6a250
0x6dd6a252
0x6dd6a254
0x6dd6a256
0x6dd6a258
0x6dd6a25a
0x6dd6a25c
0x6dd6a25e
0x6dd6a260
0x6dd6a262
0x6dd6a264
0x6dd6a266
0x6dd6a268
0x6dd6a26a
0x6dd6a26c
0x6dd6a26e
0x6dd6a270
0x6dd6a272
0x6dd6a274
0x6dd6a276
0x6dd6a278
0x6dd6a27a
0x6dd6a27c
0x6dd6a27e
0x6dd6a280
0x6dd6a282
0x6dd6a284
0x6dd6a286
0x6dd6a288
0x6dd6a28a
0x6dd6a28c
0x6dd6a28e
0x6dd6a290
0x6dd6a292
0x6dd6a294
0x6dd6a296
0x6dd6a298
0x6dd6a29a
0x6dd6a29c
0x6dd6a29e
0x6dd6a2a0
0x6dd6a2a2
0x6dd6a2a4
0x6dd6a2a6
0x6dd6a2a8
0x6dd6a2aa
0x6dd6a2ac
0x6dd6a2ae
0x6dd6a2b0
0x6dd6a2b2
0x6dd6a2b4
0x6dd6a2b6
0x6dd6a2b8
0x6dd6a2ba
0x6dd6a2bc
0x6dd6a2be
0x6dd6a2c0
0x6dd6a2c2
0x6dd6a2c4
0x6dd6a2c6
0x6dd6a2c8
0x6dd6a2ca
0x6dd6a2cc
0x6dd6a2ce
0x6dd6a2d0
0x6dd6a2d2
0x6dd6a2d4
0x6dd6a2d6
0x6dd6a2d8
0x6dd6a2da
0x6dd6a2dc
0x6dd6a2de
0x6dd6a2e0
0x6dd6a2e2
0x6dd6a2e4
0x6dd6a2e6
0x6dd6a2e8
0x6dd6a2ea
0x6dd6a2ec
0x6dd6a2ee
0x6dd6a2f0
0x6dd6a2f2
0x6dd6a2f4
0x6dd6a2f6
0x6dd6a2f8
0x6dd6a2fa
0x6dd6a2fc
0x6dd6a2fe
0x6dd6a300
0x6dd6a302
0x6dd6a304
0x6dd6a306
0x6dd6a308
0x6dd6a30a
0x6dd6a30c
0x6dd6a30e
0x6dd6a310
0x6dd6a312
0x6dd6a314
0x6dd6a316
0x6dd6a318
0x6dd6a31a
0x6dd6a31c
0x6dd6a31e
0x6dd6a320
0x6dd6a322
0x6dd6a324
0x6dd6a326
0x6dd6a328
0x6dd6a32a
0x6dd6a32c
0x6dd6a32e
0x6dd6a330
0x6dd6a332
0x6dd6a334
0x6dd6a336
0x6dd6a338
0x6dd6a33a
0x6dd6a33c
0x6dd6a33e
0x6dd6a340
0x6dd6a342
0x6dd6a344
0x6dd6a346
0x6dd6a348
0x6dd6a34a
0x6dd6a34c
0x6dd6a34e
0x6dd6a350
0x6dd6a352
0x6dd6a354
0x6dd6a356
0x6dd6a358
0x6dd6a35a
0x6dd6a35c
0x6dd6a35e
0x6dd6a360
0x6dd6a362
0x6dd6a364
0x6dd6a366
0x6dd6a368
0x6dd6a36a
0x6dd6a36c
0x6dd6a36e
0x6dd6a370
0x6dd6a372
0x6dd6a374
0x6dd6a376
0x6dd6a378
0x6dd6a37a
0x6dd6a37c
0x6dd6a37e
0x6dd6a380
0x6dd6a382
0x6dd6a384
0x6dd6a386
0x6dd6a388
0x6dd6a38a
0x6dd6a38c
0x6dd6a38e
0x6dd6a390
0x6dd6a392
0x6dd6a394
0x6dd6a396
0x6dd6a398
0x6dd6a39a
0x6dd6a39c
0x6dd6a39e
0x6dd6a3a0
0x6dd6a3a2
0x6dd6a3a4
0x6dd6a3a6
0x6dd6a3a8
0x6dd6a3aa
0x6dd6a3ac
0x6dd6a3ae
0x6dd6a3b0
0x6dd6a3b2
0x6dd6a3b4
0x6dd6a3b6
0x6dd6a3b8
0x6dd6a3ba
0x6dd6a3bc
0x6dd6a3be
0x6dd6a3c0
0x6dd6a3c2
0x6dd6a3c4
0x6dd6a3c6
0x6dd6a3c8
0x6dd6a3ca
0x6dd6a3cc
0x6dd6a3ce
0x6dd6a3d0
0x6dd6a3d2
0x6dd6a3d4
0x6dd6a3d6
0x6dd6a3d8
0x6dd6a3da
0x6dd6a3dc
0x6dd6a3de
0x6dd6a3e0
0x6dd6a3e2
0x6dd6a3e4
0x6dd6a3e6
0x6dd6a3e8
0x6dd6a3ea
0x6dd6a3ec
0x6dd6a3ee
0x6dd6a3f0
0x6dd6a3f2
0x6dd6a3f4
0x6dd6a3f6
0x6dd6a3f8
0x6dd6a3fa
0x6dd6a3fc
0x6dd6a3fe
0x6dd6a400
0x6dd6a402
0x6dd6a404
0x6dd6a406
0x6dd6a408
0x6dd6a40a
0x6dd6a40c
0x6dd6a40e
0x6dd6a410
0x6dd6a412
0x6dd6a414
0x6dd6a416
0x6dd6a418
0x6dd6a41a
0x6dd6a41c
0x6dd6a41e
0x6dd6a420
0x6dd6a422
0x6dd6a424
0x6dd6a426
0x6dd6a428
0x6dd6a42a
0x6dd6a42c
0x6dd6a42e
0x6dd6a430
0x6dd6a432
0x6dd6a434
0x6dd6a436
0x6dd6a438
0x6dd6a43a
0x6dd6a43c
0x6dd6a43e
0x6dd6a440
0x6dd6a442
0x6dd6a444
0x6dd6a446
0x6dd6a448
0x6dd6a44a
0x6dd6a44c
0x6dd6a44e
0x6dd6a450
0x6dd6a452
0x6dd6a454
0x6dd6a456
0x6dd6a458
0x6dd6a45a
0x6dd6a45c
0x6dd6a45e
0x6dd6a460
0x6dd6a462
0x6dd6a464
0x6dd6a466
0x6dd6a468
0x6dd6a46a
0x6dd6a46c
0x6dd6a46e
0x6dd6a470
0x6dd6a472
0x6dd6a474
0x6dd6a476
0x6dd6a478
0x6dd6a47a
0x6dd6a47c
0x6dd6a47e
0x6dd6a480
0x6dd6a482
0x6dd6a484
0x6dd6a486
0x6dd6a488
0x6dd6a48a
0x6dd6a48c
0x6dd6a48e
0x6dd6a490
0x6dd6a492
0x6dd6a494
0x6dd6a496
0x6dd6a498
0x6dd6a49a
0x6dd6a49c
0x6dd6a49e
0x6dd6a4a0
0x6dd6a4a2
0x6dd6a4a4
0x6dd6a4a6
0x6dd6a4a8
0x6dd6a4aa
0x6dd6a4ac
0x6dd6a4ae
0x6dd6a4b0
0x6dd6a4b2
0x6dd6a4b4
0x6dd6a4b6
0x6dd6a4b8
0x6dd6a4ba
0x6dd6a4bc
0x6dd6a4be
0x6dd6a4c0
0x6dd6a4c2
0x6dd6a4c4
0x6dd6a4c6
0x6dd6a4c8
0x6dd6a4ca
0x6dd6a4cc
0x6dd6a4ce
0x6dd6a4d0
0x6dd6a4d2
0x6dd6a4d4
0x6dd6a4d6
0x6dd6a4d8
0x6dd6a4da
0x6dd6a4dc
0x6dd6a4de
0x6dd6a4e0
0x6dd6a4e2
0x6dd6a4e4
0x6dd6a4e6
0x6dd6a4e8
0x6dd6a4ea
0x6dd6a4ec
0x6dd6a4ee
0x6dd6a4f0
0x6dd6a4f2
0x6dd6a4f4
0x6dd6a4f6
0x6dd6a4f8
0x6dd6a4fa
0x6dd6a4fc
0x6dd6a4fe
0x6dd6a500
0x6dd6a502
0x6dd6a504
0x6dd6a506
0x6dd6a508
0x6dd6a50a
0x6dd6a50c
0x6dd6a50e
0x6dd6a510
0x6dd6a512
0x6dd6a514
0x6dd6a516
0x6dd6a518
0x6dd6a51a
0x6dd6a51c
0x6dd6a51e
0x6dd6a520
0x6dd6a522
0x6dd6a524
0x6dd6a526
0x6dd6a528
0x6dd6a52a
0x6dd6a52c
0x6dd6a52e
0x6dd6a530
0x6dd6a532
0x6dd6a534
0x6dd6a536
0x6dd6a538
0x6dd6a53a
0x6dd6a53c
0x6dd6a53e
0x6dd6a540
0x6dd6a542
0x6dd6a544
0x6dd6a546
0x6dd6a548
0x6dd6a54a
0x6dd6a54c
0x6dd6a54e
0x6dd6a550
0x6dd6a552
0x6dd6a554
0x6dd6a556
0x6dd6a558
0x6dd6a55a
0x6dd6a55c
0x6dd6a55e
0x6dd6a560
0x6dd6a562
0x6dd6a564
0x6dd6a566
0x6dd6a568
0x6dd6a56a
0x6dd6a56c
0x6dd6a56e
0x6dd6a570
0x6dd6a572
0x6dd6a574
0x6dd6a576
0x6dd6a578
0x6dd6a57a
0x6dd6a57c
0x6dd6a57e
0x6dd6a580
0x6dd6a582
0x6dd6a584
0x6dd6a586
0x6dd6a588
0x6dd6a58a
0x6dd6a58c
0x6dd6a58e
0x6dd6a590
0x6dd6a592
0x6dd6a594
0x6dd6a596
0x6dd6a598
0x6dd6a59a
0x6dd6a59c
0x6dd6a59e
0x6dd6a5a0
0x6dd6a5a2
0x6dd6a5a4
0x6dd6a5a6
0x6dd6a5a8
0x6dd6a5aa
0x6dd6a5ac
0x6dd6a5ae
0x6dd6a5b0
0x6dd6a5b2
0x6dd6a5b4
0x6dd6a5b6
0x6dd6a5b8
0x6dd6a5ba
0x6dd6a5bc
0x6dd6a5be
0x6dd6a5c0
0x6dd6a5c2
0x6dd6a5c4
0x6dd6a5c6
0x6dd6a5c8
0x6dd6a5ca
0x6dd6a5cc
0x6dd6a5ce
0x6dd6a5d0
0x6dd6a5d2
0x6dd6a5d4
0x6dd6a5d6
0x6dd6a5d8
0x6dd6a5da
0x6dd6a5dc
0x6dd6a5de
0x6dd6a5e0
0x6dd6a5e2
0x6dd6a5e4
0x6dd6a5e6
0x6dd6a5e8
0x6dd6a5ea
0x6dd6a5ec
0x6dd6a5ee
0x6dd6a5f0
0x6dd6a5f2
0x6dd6a5f4
0x6dd6a5f6
0x6dd6a5f8
0x6dd6a5fa
0x6dd6a5fc
0x6dd6a5fe
0x6dd6a600
0x6dd6a602
0x6dd6a604
0x6dd6a606
0x6dd6a608
0x6dd6a60a
0x6dd6a60c
0x6dd6a60e
0x6dd6a610
0x6dd6a612
0x6dd6a614
0x6dd6a616
0x6dd6a618
0x6dd6a61a
0x6dd6a61c
0x6dd6a61e
0x6dd6a620
0x6dd6a622
0x6dd6a624
0x6dd6a626
0x6dd6a628
0x6dd6a62a
0x6dd6a62c
0x6dd6a62e
0x6dd6a630
0x6dd6a632
0x6dd6a634
0x6dd6a636
0x6dd6a638
0x6dd6a63a
0x6dd6a63c
0x6dd6a63e
0x6dd6a640
0x6dd6a642
0x6dd6a644
0x6dd6a646
0x6dd6a648
0x6dd6a64a
0x6dd6a64c
0x6dd6a64e
0x6dd6a650
0x6dd6a652
0x6dd6a654
0x6dd6a656
0x6dd6a658
0x6dd6a65a
0x6dd6a65c
0x6dd6a65e
0x6dd6a660
0x6dd6a662
0x6dd6a664
0x6dd6a666
0x6dd6a668
0x6dd6a66a
0x6dd6a66c
0x6dd6a66e
0x6dd6a670
0x6dd6a672
0x6dd6a674
0x6dd6a676
0x6dd6a678
0x6dd6a67a
0x6dd6a67c
0x6dd6a67e
0x6dd6a680
0x6dd6a682
0x6dd6a684
0x6dd6a686
0x6dd6a688
0x6dd6a68a
0x6dd6a68c
0x6dd6a68e
0x6dd6a690
0x6dd6a692
0x6dd6a694
0x6dd6a696
0x6dd6a698
0x6dd6a69a
0x6dd6a69c
0x6dd6a69e
0x6dd6a6a0
0x6dd6a6a2
0x6dd6a6a4
0x6dd6a6a6
0x6dd6a6a8
0x6dd6a6aa
0x6dd6a6ac
0x6dd6a6ae
0x6dd6a6b0
0x6dd6a6b2
0x6dd6a6b4
0x6dd6a6b6
0x6dd6a6b8
0x6dd6a6ba
0x6dd6a6bc
0x6dd6a6be
0x6dd6a6c0
0x6dd6a6c2
0x6dd6a6c4
0x6dd6a6c6
0x6dd6a6c8
0x6dd6a6ca
0x6dd6a6cc
0x6dd6a6ce
0x6dd6a6d0
0x6dd6a6d2
0x6dd6a6d4
0x6dd6a6d6
0x6dd6a6d8
0x6dd6a6da
0x6dd6a6dc
0x6dd6a6de
0x6dd6a6e0
0x6dd6a6e2
0x6dd6a6e4
0x6dd6a6e6
0x6dd6a6e8
0x6dd6a6ea
0x6dd6a6ec
0x6dd6a6ee
0x6dd6a6f0
0x6dd6a6f2
0x6dd6a6f4
0x6dd6a6f6
0x6dd6a6f8
0x6dd6a6fa
0x6dd6a6fc
0x6dd6a6fe
0x6dd6a700
0x6dd6a702
0x6dd6a704
0x6dd6a706
0x6dd6a708
0x6dd6a70a
0x6dd6a70c
0x6dd6a70e
0x6dd6a710
0x6dd6a712
0x6dd6a714
0x6dd6a716
0x6dd6a718
0x6dd6a71a
0x6dd6a71c
0x6dd6a71e
0x6dd6a720
0x6dd6a722
0x6dd6a724
0x6dd6a726
0x6dd6a728
0x6dd6a72a
0x6dd6a72c
0x6dd6a72e
0x6dd6a730
0x6dd6a732
0x6dd6a734
0x6dd6a736
0x6dd6a738
0x6dd6a73a
0x6dd6a73c
0x6dd6a73e
0x6dd6a740
0x6dd6a742
0x6dd6a744
0x6dd6a746
0x6dd6a748
0x6dd6a74a
0x6dd6a74c
0x6dd6a74e
0x6dd6a750
0x6dd6a752
0x6dd6a754
0x6dd6a756
0x6dd6a758
0x6dd6a75a
0x6dd6a75c
0x6dd6a75e
0x6dd6a760
0x6dd6a762
0x6dd6a764
0x6dd6a766
0x6dd6a768
0x6dd6a76a
0x6dd6a76c
0x6dd6a76e
0x6dd6a770
0x6dd6a772
0x6dd6a774
0x6dd6a776
0x6dd6a778
0x6dd6a77a
0x6dd6a77c
0x6dd6a77e
0x6dd6a780
0x6dd6a782
0x6dd6a784
0x6dd6a786
0x6dd6a788
0x6dd6a78a
0x6dd6a78c
0x6dd6a78e
0x6dd6a790
0x6dd6a792
0x6dd6a794
0x6dd6a796
0x6dd6a798
0x6dd6a79a
0x6dd6a79c
0x6dd6a79e
0x6dd6a7a0
0x6dd6a7a2
0x6dd6a7a4
0x6dd6a7a6
0x6dd6a7a8
0x6dd6a7aa
0x6dd6a7ac
0x6dd6a7ae
0x6dd6a7b0
0x6dd6a7b2
0x6dd6a7b4
0x6dd6a7b6
0x6dd6a7b8
0x6dd6a7ba
0x6dd6a7bc
0x6dd6a7be
0x6dd6a7c0
0x6dd6a7c2
0x6dd6a7c4
0x6dd6a7c6
0x6dd6a7c8
0x6dd6a7ca
0x6dd6a7cc
0x6dd6a7ce
0x6dd6a7d0
0x6dd6a7d2
0x6dd6a7d4
0x6dd6a7d6
0x6dd6a7d8
0x6dd6a7da
0x6dd6a7dc
0x6dd6a7de
0x6dd6a7e0
0x6dd6a7e2
0x6dd6a7e4
0x6dd6a7e6
0x6dd6a7e8
0x6dd6a7ea
0x6dd6a7ec
0x6dd6a7ee
0x6dd6a7f0
0x6dd6a7f2
0x6dd6a7f4
0x6dd6a7f6
0x6dd6a7f8
0x6dd6a7fa
0x6dd6a7fc
0x6dd6a7fe
0x6dd6a800
0x6dd6a802
0x6dd6a804
0x6dd6a806
0x6dd6a808
0x6dd6a80a
0x6dd6a80c
0x6dd6a80e
0x6dd6a810
0x6dd6a812
0x6dd6a814
0x6dd6a816
0x6dd6a818
0x6dd6a81a
0x6dd6a81c
0x6dd6a81e
0x6dd6a820
0x6dd6a822
0x6dd6a824
0x6dd6a826
0x6dd6a828
0x6dd6a82a
0x6dd6a82c
0x6dd6a82e
0x6dd6a830
0x6dd6a832
0x6dd6a834
0x6dd6a836
0x6dd6a838
0x6dd6a83a
0x6dd6a83c
0x6dd6a83e
0x6dd6a840
0x6dd6a842
0x6dd6a844
0x6dd6a846
0x6dd6a848
0x6dd6a84a
0x6dd6a84c
0x6dd6a84e
0x6dd6a850
0x6dd6a852
0x6dd6a854
0x6dd6a856
0x6dd6a858
0x6dd6a85a
0x6dd6a85c
0x6dd6a85e
0x6dd6a860
0x6dd6a862
0x6dd6a864
0x6dd6a866
0x6dd6a868
0x6dd6a86a
0x6dd6a86c
0x6dd6a86e
0x6dd6a870
0x6dd6a872
0x6dd6a874
0x6dd6a876
0x6dd6a878
0x6dd6a87a
0x6dd6a87c
0x6dd6a87e
0x6dd6a880
0x6dd6a882
0x6dd6a884
0x6dd6a886
0x6dd6a888
0x6dd6a88a
0x6dd6a88c
0x6dd6a88e
0x6dd6a890
0x6dd6a892
0x6dd6a894
0x6dd6a896
0x6dd6a898
0x6dd6a89a
0x6dd6a89c
0x6dd6a89e
0x6dd6a8a0
0x6dd6a8a2
0x6dd6a8a4
0x6dd6a8a6
0x6dd6a8a8
0x6dd6a8aa
0x6dd6a8ac
0x6dd6a8ae
0x6dd6a8b0
0x6dd6a8b2
0x6dd6a8b4
0x6dd6a8b6
0x6dd6a8b8
0x6dd6a8ba
0x6dd6a8bc
0x6dd6a8be
0x6dd6a8c0
0x6dd6a8c2
0x6dd6a8c4
0x6dd6a8c6
0x6dd6a8c8
0x6dd6a8ca
0x6dd6a8cc
0x6dd6a8ce
0x6dd6a8d0
0x6dd6a8d2
0x6dd6a8d4
0x6dd6a8d6
0x6dd6a8d8
0x6dd6a8da
0x6dd6a8dc
0x6dd6a8de
0x6dd6a8e0
0x6dd6a8e2
0x6dd6a8e4
0x6dd6a8e6
0x6dd6a8e8
0x6dd6a8ea
0x6dd6a8ec
0x6dd6a8ee
0x6dd6a8f0
0x6dd6a8f2
0x6dd6a8f4
0x6dd6a8f6
0x6dd6a8f8
0x6dd6a8fa
0x6dd6a8fc
0x6dd6a8fe
0x6dd6a900
0x6dd6a902
0x6dd6a904
0x6dd6a906
0x6dd6a908
0x6dd6a90a
0x6dd6a90c
0x6dd6a90e
0x6dd6a910
0x6dd6a912
0x6dd6a914
0x6dd6a916
0x6dd6a918
0x6dd6a91a
0x6dd6a91c
0x6dd6a91e
0x6dd6a920
0x6dd6a922
0x6dd6a924
0x6dd6a926
0x6dd6a928
0x6dd6a92a
0x6dd6a92c
0x6dd6a92e
0x6dd6a930
0x6dd6a932
0x6dd6a934
0x6dd6a936
0x6dd6a938
0x6dd6a93a
0x6dd6a93c
0x6dd6a93e
0x6dd6a940
0x6dd6a942
0x6dd6a944
0x6dd6a946
0x6dd6a948
0x6dd6a94a
0x6dd6a94c
0x6dd6a94e
0x6dd6a950
0x6dd6a952
0x6dd6a954
0x6dd6a956
0x6dd6a958
0x6dd6a95a
0x6dd6a95c
0x6dd6a95e
0x6dd6a960
0x6dd6a962
0x6dd6a964
0x6dd6a966
0x6dd6a968
0x6dd6a96a
0x6dd6a96c
0x6dd6a96e
0x6dd6a970
0x6dd6a972
0x6dd6a974
0x6dd6a976
0x6dd6a978
0x6dd6a97a
0x6dd6a97c
0x6dd6a97e
0x6dd6a980
0x6dd6a982
0x6dd6a984
0x6dd6a986
0x6dd6a988
0x6dd6a98a
0x6dd6a98c
0x6dd6a98e
0x6dd6a990
0x6dd6a992
0x6dd6a994
0x6dd6a996
0x6dd6a998
0x6dd6a99a
0x6dd6a99c
0x6dd6a99e
0x6dd6a9a0
0x6dd6a9a2
0x6dd6a9a4
0x6dd6a9a6
0x6dd6a9a8
0x6dd6a9aa
0x6dd6a9ac
0x6dd6a9ae
0x6dd6a9b0
0x6dd6a9b2
0x6dd6a9b4
0x6dd6a9b6
0x6dd6a9b8
0x6dd6a9ba
0x6dd6a9bc
0x6dd6a9be
0x6dd6a9c0
0x6dd6a9c2
0x6dd6a9c4
0x6dd6a9c6
0x6dd6a9c8
0x6dd6a9ca
0x6dd6a9cc
0x6dd6a9ce
0x6dd6a9d0
0x6dd6a9d2
0x6dd6a9d4
0x6dd6a9d6
0x6dd6a9d8
0x6dd6a9da
0x6dd6a9dc
0x6dd6a9de
0x6dd6a9e0
0x6dd6a9e2
0x6dd6a9e4
0x6dd6a9e6
0x6dd6a9e8
0x6dd6a9ea
0x6dd6a9ec
0x6dd6a9ee
0x6dd6a9f0
0x6dd6a9f2
0x6dd6a9f4
0x6dd6a9f6
0x6dd6a9f8
0x6dd6a9fa
0x6dd6a9fc
0x6dd6a9fe
0x6dd6aa00
0x6dd6aa02
0x6dd6aa04
0x6dd6aa06
0x6dd6aa08
0x6dd6aa0a
0x6dd6aa0c
0x6dd6aa0e
0x6dd6aa10
0x6dd6aa12
0x6dd6aa14
0x6dd6aa16
0x6dd6aa18
0x6dd6aa1a
0x6dd6aa1c
0x6dd6aa1e
0x6dd6aa20
0x6dd6aa22
0x6dd6aa24
0x6dd6aa26
0x6dd6aa28
0x6dd6aa2a
0x6dd6aa2c
0x6dd6aa2e
0x6dd6aa30
0x6dd6aa32
0x6dd6aa34
0x6dd6aa36
0x6dd6aa38
0x6dd6aa3a
0x6dd6aa3c
0x6dd6aa3e
0x6dd6aa40
0x6dd6aa42
0x6dd6aa44
0x6dd6aa46
0x6dd6aa48
0x6dd6aa4a
0x6dd6aa4c
0x6dd6aa4e
0x6dd6aa50
0x6dd6aa52
0x6dd6aa54
0x6dd6aa56
0x6dd6aa58
0x6dd6aa5a
0x6dd6aa5c
0x6dd6aa5e
0x6dd6aa60
0x6dd6aa62
0x6dd6aa64
0x6dd6aa66
0x6dd6aa68
0x6dd6aa6a
0x6dd6aa6c
0x6dd6aa6e
0x6dd6aa70
0x6dd6aa72
0x6dd6aa74
0x6dd6aa76
0x6dd6aa78
0x6dd6aa7a
0x6dd6aa7c
0x6dd6aa7e
0x6dd6aa80
0x6dd6aa82
0x6dd6aa84
0x6dd6aa86
0x6dd6aa88
0x6dd6aa8a
0x6dd6aa8c
0x6dd6aa8e
0x6dd6aa90
0x6dd6aa92
0x6dd6aa94
0x6dd6aa96
0x6dd6aa98
0x6dd6aa9a
0x6dd6aa9c
0x6dd6aa9e
0x6dd6aaa0
0x6dd6aaa2
0x6dd6aaa4
0x6dd6aaa6
0x6dd6aaa8
0x6dd6aaaa
0x6dd6aaac
0x6dd6aaae
0x6dd6aab0
0x6dd6aab2
0x6dd6aab4
0x6dd6aab6
0x6dd6aab8
0x6dd6aaba
0x6dd6aabc
0x6dd6aabe
0x6dd6aac0
0x6dd6aac2
0x6dd6aac4
0x6dd6aac6
0x6dd6aac8
0x6dd6aaca
0x6dd6aacc
0x6dd6aace
0x6dd6aad0
0x6dd6aad2
0x6dd6aad4
0x6dd6aad6
0x6dd6aad8
0x6dd6aada
0x6dd6aadc
0x6dd6aade
0x6dd6aae0
0x6dd6aae2
0x6dd6aae4
0x6dd6aae6
0x6dd6aae8
0x6dd6aaea
0x6dd6aaec
0x6dd6aaee
0x6dd6aaf0
0x6dd6aaf2
0x6dd6aaf4
0x6dd6aaf6
0x6dd6aaf8
0x6dd6aafa
0x6dd6aafc
0x6dd6aafe
0x6dd6ab00
0x6dd6ab02
0x6dd6ab04
0x6dd6ab06
0x6dd6ab08
0x6dd6ab0a
0x6dd6ab0c
0x6dd6ab0e
0x6dd6ab10
0x6dd6ab12
0x6dd6ab14
0x6dd6ab16
0x6dd6ab18
0x6dd6ab1a
0x6dd6ab1c
0x6dd6ab1e
0x6dd6ab20
0x6dd6ab22
0x6dd6ab24
0x6dd6ab26
0x6dd6ab28
0x6dd6ab2a
0x6dd6ab2c
0x6dd6ab2e
0x6dd6ab30
0x6dd6ab32
0x6dd6ab34
0x6dd6ab36
0x6dd6ab38
0x6dd6ab3a
0x6dd6ab3c
0x6dd6ab3e
0x6dd6ab40
0x6dd6ab42
0x6dd6ab44
0x6dd6ab46
0x6dd6ab48
0x6dd6ab4a
0x6dd6ab4c
0x6dd6ab4e
0x6dd6ab50
0x6dd6ab52
0x6dd6ab54
0x6dd6ab56
0x6dd6ab58
0x6dd6ab5a
0x6dd6ab5c
0x6dd6ab5e
0x6dd6ab60
0x6dd6ab62
0x6dd6ab64
0x6dd6ab66
0x6dd6ab68
0x6dd6ab6a
0x6dd6ab6c
0x6dd6ab6e
0x6dd6ab70
0x6dd6ab72
0x6dd6ab74
0x6dd6ab76
0x6dd6ab78
0x6dd6ab7a
0x6dd6ab7c
0x6dd6ab7e
0x6dd6ab80
0x6dd6ab82
0x6dd6ab84
0x6dd6ab86
0x6dd6ab88
0x6dd6ab8a
0x6dd6ab8c
0x6dd6ab8e
0x6dd6ab90
0x6dd6ab92
0x6dd6ab94
0x6dd6ab96
0x6dd6ab98
0x6dd6ab9a
0x6dd6ab9c
0x6dd6ab9e
0x6dd6aba0
0x6dd6aba2
0x6dd6aba4
0x6dd6aba6
0x6dd6aba8
0x6dd6abaa
0x6dd6abac
0x6dd6abae
0x6dd6abb0
0x6dd6abb2
0x6dd6abb4
0x6dd6abb6
0x6dd6abb8
0x6dd6abba
0x6dd6abbc
0x6dd6abbe
0x6dd6abc0
0x6dd6abc2
0x6dd6abc4
0x6dd6abc6
0x6dd6abc8
0x6dd6abca
0x6dd6abcc
0x6dd6abce
0x6dd6abd0
0x6dd6abd2
0x6dd6abd4
0x6dd6abd6
0x6dd6abd8
0x6dd6abda
0x6dd6abdc
0x6dd6abde
0x6dd6abe0
0x6dd6abe2
0x6dd6abe4
0x6dd6abe6
0x6dd6abe8
0x6dd6abea
0x6dd6abec
0x6dd6abee
0x6dd6abf0
0x6dd6abf2
0x6dd6abf4
0x6dd6abf6
0x6dd6abf8
0x6dd6abfa
0x6dd6abfc
0x6dd6abfe
0x6dd6ac00
0x6dd6ac02
0x6dd6ac04
0x6dd6ac06
0x6dd6ac08
0x6dd6ac0a
0x6dd6ac0c
0x6dd6ac0e
0x6dd6ac10
0x6dd6ac12
0x6dd6ac14
0x6dd6ac16
0x6dd6ac18
0x6dd6ac1a
0x6dd6ac1c
0x6dd6ac1e
0x6dd6ac20
0x6dd6ac22
0x6dd6ac24
0x6dd6ac26
0x6dd6ac28
0x6dd6ac2a
0x6dd6ac2c
0x6dd6ac2e
0x6dd6ac30
0x6dd6ac32
0x6dd6ac34
0x6dd6ac36
0x6dd6ac38
0x6dd6ac3a
0x6dd6ac3c
0x6dd6ac3e
0x6dd6ac40
0x6dd6ac42
0x6dd6ac44
0x6dd6ac46
0x6dd6ac48
0x6dd6ac4a
0x6dd6ac4c
0x6dd6ac4e
0x6dd6ac50
0x6dd6ac52
0x6dd6ac54
0x6dd6ac56
0x6dd6ac58
0x6dd6ac5a
0x6dd6ac5c
0x6dd6ac5e
0x6dd6ac60
0x6dd6ac62
0x6dd6ac64
0x6dd6ac66
0x6dd6ac68
0x6dd6ac6a
0x6dd6ac6c
0x6dd6ac6e
0x6dd6ac70
0x6dd6ac72
0x6dd6ac74
0x6dd6ac76
0x6dd6ac78
0x6dd6ac7a
0x6dd6ac7c
0x6dd6ac7e
0x6dd6ac80
0x6dd6ac82
0x6dd6ac84
0x6dd6ac86
0x6dd6ac88
0x6dd6ac8a
0x6dd6ac8c
0x6dd6ac8e
0x6dd6ac90
0x6dd6ac92
0x6dd6ac94
0x6dd6ac96
0x6dd6ac98
0x6dd6ac9a
0x6dd6ac9c
0x6dd6ac9e
0x6dd6aca0
0x6dd6aca2
0x6dd6aca4
0x6dd6aca6
0x6dd6aca8
0x6dd6acaa
0x6dd6acac
0x6dd6acae
0x6dd6acb0
0x6dd6acb2
0x6dd6acb4
0x6dd6acb6
0x6dd6acb8
0x6dd6acba
0x6dd6acbc
0x6dd6acbe
0x6dd6acc0
0x6dd6acc2
0x6dd6acc4
0x6dd6acc6
0x6dd6acc8
0x6dd6acca
0x6dd6accc
0x6dd6acce
0x6dd6acd0
0x6dd6acd2
0x6dd6acd4
0x6dd6acd6
0x6dd6acd8
0x6dd6acda
0x6dd6acdc
0x6dd6acde
0x6dd6ace0
0x6dd6ace2
0x6dd6ace4
0x6dd6ace6
0x6dd6ace8
0x6dd6acea
0x6dd6acec
0x6dd6acee
0x6dd6acf0
0x6dd6acf2
0x6dd6acf4
0x6dd6acf6
0x6dd6acf8
0x6dd6acfa
0x6dd6acfc
0x6dd6acfe
0x6dd6ad00
0x6dd6ad02
0x6dd6ad04
0x6dd6ad06
0x6dd6ad08
0x6dd6ad0a
0x6dd6ad0c
0x6dd6ad0e
0x6dd6ad10
0x6dd6ad12
0x6dd6ad14
0x6dd6ad16
0x6dd6ad18
0x6dd6ad1a
0x6dd6ad1c
0x6dd6ad1e
0x6dd6ad20
0x6dd6ad22
0x6dd6ad24
0x6dd6ad26
0x6dd6ad28
0x6dd6ad2a
0x6dd6ad2c
0x6dd6ad2e
0x6dd6ad30
0x6dd6ad32
0x6dd6ad34
0x6dd6ad36
0x6dd6ad38
0x6dd6ad3a
0x6dd6ad3c
0x6dd6ad3e
0x6dd6ad40
0x6dd6ad42
0x6dd6ad44
0x6dd6ad46
0x6dd6ad48
0x6dd6ad4a
0x6dd6ad4c
0x6dd6ad4e
0x6dd6ad50
0x6dd6ad52
0x6dd6ad54
0x6dd6ad56
0x6dd6ad58
0x6dd6ad5a
0x6dd6ad5c
0x6dd6ad5e
0x6dd6ad60
0x6dd6ad62
0x6dd6ad64
0x6dd6ad66
0x6dd6ad68
0x6dd6ad6a
0x6dd6ad6c
0x6dd6ad6e
0x6dd6ad70
0x6dd6ad72
0x6dd6ad74
0x6dd6ad76
0x6dd6ad78
0x6dd6ad7a
0x6dd6ad7c
0x6dd6ad7e
0x6dd6ad80
0x6dd6ad82
0x6dd6ad84
0x6dd6ad86
0x6dd6ad88
0x6dd6ad8a
0x6dd6ad8c
0x6dd6ad8e
0x6dd6ad90
0x6dd6ad92
0x6dd6ad94
0x6dd6ad96
0x6dd6ad98
0x6dd6ad9a
0x6dd6ad9c
0x6dd6ad9e
0x6dd6ada0
0x6dd6ada2
0x6dd6ada4
0x6dd6ada6
0x6dd6ada8
0x6dd6adaa
0x6dd6adac
0x6dd6adae
0x6dd6adb0
0x6dd6adb2
0x6dd6adb4
0x6dd6adb6
0x6dd6adb8
0x6dd6adba
0x6dd6adbc
0x6dd6adbe
0x6dd6adc0
0x6dd6adc2
0x6dd6adc4
0x6dd6adc6
0x6dd6adc8
0x6dd6adca
0x6dd6adcc
0x6dd6adce
0x6dd6add0
0x6dd6add2
0x6dd6add4
0x6dd6add6
0x6dd6add8
0x6dd6adda
0x6dd6addc
0x6dd6adde
0x6dd6ade0
0x6dd6ade2
0x6dd6ade4
0x6dd6ade6
0x6dd6ade8
0x6dd6adea
0x6dd6adec
0x6dd6adee
0x6dd6adf0
0x6dd6adf2
0x6dd6adf4
0x6dd6adf6
0x6dd6adf8
0x6dd6adfa
0x6dd6adfc
0x6dd6adfe
0x6dd6ae00
0x6dd6ae02
0x6dd6ae04
0x6dd6ae06
0x6dd6ae08
0x6dd6ae0a
0x6dd6ae0c
0x6dd6ae0e
0x6dd6ae10
0x6dd6ae12
0x6dd6ae14
0x6dd6ae16
0x6dd6ae18
0x6dd6ae1a
0x6dd6ae1c
0x6dd6ae1e
0x6dd6ae20
0x6dd6ae22
0x6dd6ae24
0x6dd6ae26
0x6dd6ae28
0x6dd6ae2a
0x6dd6ae2c
0x6dd6ae2e
0x6dd6ae30
0x6dd6ae32
0x6dd6ae34
0x6dd6ae36
0x6dd6ae38
0x6dd6ae3a
0x6dd6ae3c
0x6dd6ae3e
0x6dd6ae40
0x6dd6ae42
0x6dd6ae44
0x6dd6ae46
0x6dd6ae48
0x6dd6ae4a
0x6dd6ae4c
0x6dd6ae4e
0x6dd6ae50
0x6dd6ae52
0x6dd6ae54
0x6dd6ae56
0x6dd6ae58
0x6dd6ae5a
0x6dd6ae5c
0x6dd6ae5e
0x6dd6ae60
0x6dd6ae62
0x6dd6ae64
0x6dd6ae66
0x6dd6ae68
0x6dd6ae6a
0x6dd6ae6c
0x6dd6ae6e
0x6dd6ae70
0x6dd6ae72
0x6dd6ae74
0x6dd6ae76
0x6dd6ae78
0x6dd6ae7a
0x6dd6ae7c
0x6dd6ae7e
0x6dd6ae80
0x6dd6ae82
0x6dd6ae84
0x6dd6ae86
0x6dd6ae88
0x6dd6ae8a
0x6dd6ae8c
0x6dd6ae8e
0x6dd6ae90
0x6dd6ae92
0x6dd6ae94
0x6dd6ae96
0x6dd6ae98
0x6dd6ae9a
0x6dd6ae9c
0x6dd6ae9e
0x6dd6aea0
0x6dd6aea2
0x6dd6aea4
0x6dd6aea6
0x6dd6aea8
0x6dd6aeaa
0x6dd6aeac
0x6dd6aeae
0x6dd6aeb0
0x6dd6aeb2
0x6dd6aeb4
0x6dd6aeb6
0x6dd6aeb8
0x6dd6aeba
0x6dd6aebc
0x6dd6aebe
0x6dd6aec0
0x6dd6aec2
0x6dd6aec4
0x6dd6aec6
0x6dd6aec8
0x6dd6aeca
0x6dd6aecc
0x6dd6aece
0x6dd6aed0
0x6dd6aed2
0x6dd6aed4
0x6dd6aed6
0x6dd6aed8
0x6dd6aeda
0x6dd6aedc
0x6dd6aede
0x6dd6aee0
0x6dd6aee2
0x6dd6aee4
0x6dd6aee6
0x6dd6aee8
0x6dd6aeea
0x6dd6aeec
0x6dd6aeee
0x6dd6aef0
0x6dd6aef2
0x6dd6aef4
0x6dd6aef6
0x6dd6aef8
0x6dd6aefa
0x6dd6aefc
0x6dd6aefe
0x6dd6af00
0x6dd6af02
0x6dd6af04
0x6dd6af06
0x6dd6af08
0x6dd6af0a
0x6dd6af0c
0x6dd6af0e
0x6dd6af10
0x6dd6af12
0x6dd6af14
0x6dd6af16
0x6dd6af18
0x6dd6af1a
0x6dd6af1c
0x6dd6af1e
0x6dd6af20
0x6dd6af22
0x6dd6af24
0x6dd6af26
0x6dd6af28
0x6dd6af2a
0x6dd6af2c
0x6dd6af2e
0x6dd6af30
0x6dd6af32
0x6dd6af34
0x6dd6af36
0x6dd6af38
0x6dd6af3a
0x6dd6af3c
0x6dd6af3e
0x6dd6af40
0x6dd6af42
0x6dd6af44
0x6dd6af46
0x6dd6af48
0x6dd6af4a
0x6dd6af4c
0x6dd6af4e
0x6dd6af50
0x6dd6af52
0x6dd6af54
0x6dd6af56
0x6dd6af58
0x6dd6af5a
0x6dd6af5c
0x6dd6af5e
0x6dd6af60
0x6dd6af62
0x6dd6af64
0x6dd6af66
0x6dd6af68
0x6dd6af6a
0x6dd6af6c
0x6dd6af6e
0x6dd6af70
0x6dd6af72
0x6dd6af74
0x6dd6af76
0x6dd6af78
0x6dd6af7a
0x6dd6af7c
0x6dd6af7e
0x6dd6af80
0x6dd6af82
0x6dd6af84
0x6dd6af86
0x6dd6af88
0x6dd6af8a
0x6dd6af8c
0x6dd6af8e
0x6dd6af90
0x6dd6af92
0x6dd6af94
0x6dd6af96
0x6dd6af98
0x6dd6af9a
0x6dd6af9c
0x6dd6af9e
0x6dd6afa0
0x6dd6afa2
0x6dd6afa4
0x6dd6afa6
0x6dd6afa8
0x6dd6afaa
0x6dd6afac
0x6dd6afae
0x6dd6afb0
0x6dd6afb2
0x6dd6afb4
0x6dd6afb6
0x6dd6afb8
0x6dd6afba
0x6dd6afbc
0x6dd6afbe
0x6dd6afc0
0x6dd6afc2
0x6dd6afc4
0x6dd6afc6
0x6dd6afc8
0x6dd6afca
0x6dd6afcc
0x6dd6afce
0x6dd6afd0
0x6dd6afd2
0x6dd6afd4
0x6dd6afd6
0x6dd6afd8
0x6dd6afda
0x6dd6afdc
0x6dd6afde
0x6dd6afe0
0x6dd6afe2
0x6dd6afe4
0x6dd6afe6
0x6dd6afe8
0x6dd6afea
0x6dd6afec
0x6dd6afee
0x6dd6aff0
0x6dd6aff2
0x6dd6aff4
0x6dd6aff6
0x6dd6aff8
0x6dd6affa
0x6dd6affc
0x6dd6affe
0x6dd6affe
0x6dd6b000
0x6dd6b001
0x6dd6b064
0x6dd6b064
0x6dd6b067
0x00000000
0x00000000
0x00000000
0x00000000
0x6dd6b003
0x6dd6b003
0x6dd6b034
0x6dd6b034
0x6dd6b035
0x00000000
0x6dd6b037
0x6dd6b037
0x00000000
0x6dd6b037
0x6dd6b005
0x6dd6b005
0x6dd6b074
0x6dd6b074
0x00000000
0x6dd6b007
0x6dd6b007
0x6dd6b038
0x6dd6b038
0x6dd6b069
0x6dd6b069
0x00000000
0x6dd6b06c
0x6dd6b06c
0x6dd6b071
0x6dd6b071
0x00000000
0x6dd6b071
0x6dd6b03a
0x6dd6b03a
0x6dd6b0a5
0x6dd6b0c7
0x6dd6b0c7
0x00000000
0x6dd6b0a7
0x6dd6b0a7
0x6dd6b0aa
0x6dd6b0ac
0x6dd6b0ac
0x6dd6b0ad
0x00000000
0x6dd6b0af
0x6dd6b0af
0x00000000
0x6dd6b0b2
0x6dd6b0b2
0x6dd6b0b2
0x00000000
0x6dd6b0b2
0x6dd6b0af
0x6dd6b0ad
0x6dd6b03c
0x6dd6b03c
0x6dd6b03d
0x6dd6b0b3
0x6dd6b0b3
0x6dd6b0b4
0x00000000
0x6dd6b03f
0x6dd6b03f
0x6dd6b044
0x6dd6b075
0x6dd6b075
0x6dd6b07a
0x6dd6b07b
0x6dd6b07c
0x6dd6b07d
0x6dd6b07d
0x6dd6b07e
0x6dd6b07f
0x00000000
0x6dd6b046
0x6dd6b046
0x6dd6b0ba
0x6dd6b0ba
0x6dd6b0be
0x6dd6b0be
0x6dd6b048
0x6dd6b048
0x6dd6b04a
0x6dd6b04d
0x6dd6b0b8
0x6dd6b0b8
0x6dd6b0b8
0x00000000
0x6dd6b04f
0x6dd6b04f
0x6dd6b080
0x6dd6b080
0x6dd6b081
0x6dd6b082
0x6dd6b083
0x6dd6b085
0x6dd6b089
0x6dd6b089
0x6dd6b08b
0x6dd6b08e
0x00000000
0x6dd6b090
0x6dd6b090
0x00000000
0x6dd6b093
0x6dd6b093
0x6dd6b0b5
0x6dd6b0b5
0x6dd6b0b5
0x6dd6b0b5
0x00000000
0x6dd6b095
0x6dd6b095
0x6dd6b095
0x6dd6b097
0x6dd6b097
0x6dd6b09a
0x00000000
0x6dd6b09c
0x6dd6b09c
0x6dd6b09c
0x6dd6b0a0
0x6dd6b0a0
0x6dd6b0a0
0x6dd6b0a0
0x6dd6b09a
0x6dd6b093
0x6dd6b090
0x6dd6b052
0x6dd6b052
0x6dd6b054
0x6dd6b056
0x6dd6b056
0x6dd6b056
0x6dd6b059
0x6dd6b0cd
0x6dd6b0cd
0x6dd6b0ce
0x6dd6b0ce
0x6dd6b0d2
0x6dd6b0d2
0x6dd6b0d7
0x6dd6b0d7
0x6dd6b0d7
0x6dd6b0da
0x6dd6b0fc
0x6dd6b0fc
0x6dd6b0fd
0x00000000
0x6dd6b0ff
0x6dd6b0ff
0x00000000
0x6dd6b101
0x6dd6b101
0x00000000
0x00000000
0x00000000
0x00000000
0x6dd6b101
0x6dd6b0ff
0x6dd6b0dc
0x6dd6b0e3
0x6dd6b0e4
0x6dd6b0e9
0x6dd6b0e9
0x6dd6b0e9
0x6dd6b0eb
0x6dd6b0f0
0x6dd6b12f
0x6dd6b12f
0x6dd6b130
0x6dd6b130
0x6dd6b0f2
0x6dd6b0f2
0x6dd6b0f2
0x6dd6b0f2
0x6dd6b0f7
0x6dd6b103
0x6dd6b103
0x6dd6b134
0x00000000
0x6dd6b136
0x6dd6b136
0x00000000
0x6dd6b138
0x6dd6b138
0x6dd6b139
0x00000000
0x6dd6b13b
0x6dd6b13b
0x6dd6b140
0x00000000
0x6dd6b142
0x6dd6b142
0x6dd6b1b6
0x6dd6b1b6
0x00000000
0x6dd6b144
0x6dd6b144
0x6dd6b146
0x00000000
0x6dd6b148
0x6dd6b148
0x00000000
0x6dd6b148
0x6dd6b146
0x6dd6b142
0x6dd6b140
0x6dd6b139
0x6dd6b136
0x6dd6b105
0x6dd6b105
0x6dd6b108
0x6dd6b109
0x6dd6b10b
0x6dd6b10c
0x6dd6b10c
0x6dd6b10e
0x6dd6b10e
0x6dd6b111
0x6dd6b149
0x6dd6b149
0x6dd6b14a
0x6dd6b14d
0x6dd6b14f
0x6dd6b151
0x6dd6b151
0x6dd6b153
0x00000000
0x00000000
0x00000000
0x00000000
0x6dd6b113
0x6dd6b113
0x6dd6b115
0x6dd6b115
0x6dd6b115
0x6dd6b11b
0x6dd6b120
0x6dd6b122
0x6dd6b122
0x6dd6b123
0x6dd6b123
0x6dd6b126
0x6dd6b126
0x6dd6b155
0x6dd6b155
0x6dd6b156
0x6dd6b157
0x6dd6b15a
0x00000000
0x6dd6b15c
0x6dd6b15c
0x6dd6b15e
0x6dd6b15e
0x00000000
0x6dd6b15e
0x6dd6b128
0x6dd6b128
0x6dd6b160
0x6dd6b160
0x6dd6b1ce
0x6dd6b1ce
0x6dd6b1d7
0x6dd6b1da
0x6dd6b1db
0x6dd6b1db
0x6dd6b1df
0x6dd6b1e3
0x6dd6b1ed
0x6dd6b1ed
0x6dd6b1f0
0x6dd6b1f0
0x6dd6b162
0x6dd6b162
0x6dd6b162
0x6dd6b165
0x6dd6b165
0x6dd6b1c8
0x6dd6b1c8
0x6dd6b1c8
0x6dd6b1ca
0x6dd6b1cb
0x6dd6b1cc
0x6dd6b1cc
0x6dd6b1cd
0x6dd6b1cd
0x00000000
0x6dd6b167
0x6dd6b167
0x6dd6b168
0x6dd6b168
0x6dd6b170
0x6dd6b170
0x6dd6b170
0x6dd6b171
0x6dd6b171
0x6dd6b172
0x6dd6b173
0x6dd6b174
0x6dd6b175
0x6dd6b176
0x6dd6b179
0x6dd6b17b
0x6dd6b17b
0x6dd6b17c
0x6dd6b17c
0x6dd6b17f
0x6dd6b17f
0x6dd6b181
0x6dd6b1ff
0x6dd6b1ff
0x6dd6b183
0x6dd6b183
0x6dd6b184
0x6dd6b185
0x6dd6b188
0x6dd6b1aa
0x6dd6b1aa
0x6dd6b1ac
0x6dd6b1ac
0x6dd6b1af
0x6dd6b1af
0x6dd6b1b2
0x6dd6b1b2
0x6dd6b18a
0x6dd6b18a
0x6dd6b18c
0x6dd6b18f
0x6dd6b190
0x6dd6b190
0x6dd6b192
0x6dd6b196
0x6dd6b1b8
0x6dd6b1b8
0x6dd6b1bf
0x6dd6b1bf
0x6dd6b1c1
0x6dd6b1c2
0x6dd6b1c2
0x00000000
0x6dd6b198
0x6dd6b198
0x6dd6b19b
0x6dd6b19b
0x6dd6b19c
0x6dd6b19e
0x6dd6b1a0
0x6dd6b1a0
0x6dd6b1a1
0x6dd6b1a1
0x6dd6b216
0x6dd6b219
0x00000000
0x6dd6b1a3
0x6dd6b1a3
0x6dd6b1a4
0x6dd6b21a
0x6dd6b21a
0x6dd6b221
0x6dd6b227
0x6dd6b227
0x6dd6b227
0x6dd6b22a
0x6dd6b22b
0x6dd6b1a6
0x6dd6b1a6
0x6dd6b1a6
0x00000000
0x6dd6b1a6
0x6dd6b1a4
0x6dd6b1a1
0x6dd6b196
0x6dd6b188
0x6dd6b181
0x6dd6b165
0x6dd6b12a
0x6dd6b12a
0x6dd6b12c
0x6dd6b12d
0x6dd6b12d
0x00000000
0x6dd6b12d
0x6dd6b128
0x6dd6b126
0x6dd6b111
0x6dd6b0f9
0x6dd6b0f9
0x6dd6b0f9
0x6dd6b0fb
0x6dd6b0fb
0x00000000
0x6dd6b0fb
0x6dd6b0f7
0x6dd6b0f0
0x6dd6b05b
0x6dd6b05b
0x6dd6b062
0x6dd6b062
0x00000000
0x6dd6b062
0x6dd6b059
0x6dd6b04f
0x6dd6b04d
0x6dd6b046
0x6dd6b044
0x6dd6b03d
0x6dd6b03a
0x6dd6b009
0x6dd6b009
0x6dd6b00c
0x6dd6b00d
0x6dd6b00f
0x6dd6b017
0x6dd6b019
0x6dd6b024
0x6dd6b026
0x6dd6b027
0x6dd6b02e
0x6dd6b030
0x6dd6b031
0x6dd6b031
0x00000000
0x6dd6b031
0x6dd6b007
0x6dd6b005
0x6dd6b003
0x6dd64bcb
0x6dd64bce
0x6dd64bd1
0x6dd64bd7
0x6dd64bde
0x6dd64be5
0x6dd64bee
0x6dd64bf6
0x6dd64bfa
0x6dd64bfd
0x6dd64c03
0x6dd64c06
0x6dd64c08
0x00000000
0x6dd64c0e
0x6dd64c19
0x6dd64c19
0x6dd64c08
0x6dd64bc5
0x6dd64b22
0x6dd64afc
0x6dd64afc
0x6dd64b05
0x6dd64b05

APIs

TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,6DD65ADA,?,?,?,?,6DD66ADD), ref: 6DD64AED

Part of subcall function 6DD64990: pthread_mutex_lock.LIBWINPTHREAD-1(?,Error cleaning up spin_keys for thread ,?,6DD64AE5), ref: 6DD649A8
Part of subcall function 6DD64990: pthread_tls_init.LIBWINPTHREAD-1(?,Error cleaning up spin_keys for thread ,?,6DD64AE5), ref: 6DD649B7
Part of subcall function 6DD64990: pthread_mutex_unlock.LIBWINPTHREAD-1(?,Error cleaning up spin_keys for thread ,?,6DD64AE5), ref: 6DD649C9

Strings

Error cleaning up spin_keys for thread , xrefs: 6DD64A57, 6DD64AD2

Memory Dump Source

Source File: 00000004.00000002.787395814.000000006DD61000.00000040.00000001.01000000.0000000A.sdmp, Offset: 6DD60000, based on PE: true

Associated: 00000004.00000002.787383138.000000006DD60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787413037.000000006DD6B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787415936.000000006DD6F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787437708.000000006DD74000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787474619.000000006DDD6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787482411.000000006DDE6000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6dd60000_windowsconnect.jbxd

Similarity

API ID: Valuepthread_mutex_lockpthread_mutex_unlockpthread_tls_init
String ID: Error cleaning up spin_keys for thread
API String ID: 3593121786-2906507043
Opcode ID: 785f74853c6e7bc38fb26d25d034929ad41c840121592dc780143fca0b598e70
Instruction ID: 090e372ebd3f8dce6e181c2323be4d593b2fe2e3f1e9ffad5eed844cb2689d6a
Opcode Fuzzy Hash: 785f74853c6e7bc38fb26d25d034929ad41c840121592dc780143fca0b598e70
Instruction Fuzzy Hash: 9D3117B19087818FE710AF79D55832ABBF4BB49359F004A2DE895C7341E779E408CBE2

Uniqueness

Uniqueness Score: -1.00%

Function 6DD63920 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 90
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

calloc.MSVCRT ref: 6DD63948
pthread_mutex_init.LIBWINPTHREAD-1(?,?,?,?,?,?,?,?,00000000,?,6DD63A87), ref: 6DD63980
pthread_mutex_init.LIBWINPTHREAD-1(?,?,?,?,?,?,?,?,00000000,?,6DD63A87), ref: 6DD63997
pthread_cond_init.LIBWINPTHREAD-1(?,?,?,?,?,?,?,?,00000000,?,6DD63A87), ref: 6DD639AE

Part of subcall function 6DD61DD0: calloc.MSVCRT ref: 6DD61E02
Part of subcall function 6DD61DD0: CreateSemaphoreA.KERNEL32 ref: 6DD61E58
Part of subcall function 6DD61DD0: CreateSemaphoreA.KERNEL32 ref: 6DD61E7F
Part of subcall function 6DD61DD0: RtlInitializeCriticalSection.NTDLL ref: 6DD61E9E
Part of subcall function 6DD61DD0: RtlInitializeCriticalSection.NTDLL ref: 6DD61EA9
Part of subcall function 6DD61DD0: RtlInitializeCriticalSection.NTDLL ref: 6DD61EB4

??3@YAXPAX@Z.MSVCRT ref: 6DD639D7
pthread_mutex_destroy.LIBWINPTHREAD-1(?,?,?,?,?,?,?,?,00000000,?,6DD63A87), ref: 6DD639F7
??3@YAXPAX@Z.MSVCRT ref: 6DD639FF
pthread_mutex_destroy.LIBWINPTHREAD-1(?,?,?,?,?,?,?,?,00000000,?,6DD63A87), ref: 6DD63A37
pthread_mutex_destroy.LIBWINPTHREAD-1(?,?,?,?,?,?,?,?,00000000,?,6DD63A87), ref: 6DD63A3F
??3@YAXPAX@Z.MSVCRT ref: 6DD63A47

Strings

, xrefs: 6DD63939

Memory Dump Source

Source File: 00000004.00000002.787395814.000000006DD61000.00000040.00000001.01000000.0000000A.sdmp, Offset: 6DD60000, based on PE: true

Associated: 00000004.00000002.787383138.000000006DD60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787413037.000000006DD6B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787415936.000000006DD6F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787437708.000000006DD74000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787474619.000000006DDD6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787482411.000000006DDE6000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6dd60000_windowsconnect.jbxd

Similarity

API ID: ??3@CriticalInitializeSectionpthread_mutex_destroy$CreateSemaphorecallocpthread_mutex_init$pthread_cond_init
String ID:
API String ID: 3338094822-3916222277
Opcode ID: 3688def880ccab90dadea789450eb0615040d34b8df0cbcd7f165af587010fb6
Instruction ID: a3077320a6bc99f565f0be0e33cdea913d3131f43a975aef660941a472f9efdc
Opcode Fuzzy Hash: 3688def880ccab90dadea789450eb0615040d34b8df0cbcd7f165af587010fb6
Instruction Fuzzy Hash: EF31DCB16087458FD704AF26D48475BBBE9EF84318F06886EE5888B205D775D849CBF2

Uniqueness

Uniqueness Score: -1.00%

Function 6DD66260 Relevance: 18.2, APIs: 12, Instructions: 166
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 27%

			E6DD66260(void* __eflags, signed int _a4, signed char* _a8, intOrPtr _a12, intOrPtr _a16) {
				signed int _v40;
				intOrPtr _v44;
				signed int _v48;
				signed int _v52;
				signed char _v56;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t52;
				void* _t56;
				signed int _t64;
				signed int _t66;
				signed char _t72;
				signed char _t82;
				signed int _t89;
				signed int _t92;
				signed int _t96;
				intOrPtr _t97;
				signed char _t98;
				signed int _t99;
				void* _t101;
				signed int* _t102;
				signed int* _t104;
				signed int* _t106;
				signed int* _t107;
				signed int* _t108;
				signed int* _t109;

				_t102 = _t101 - 0x2c;
				_t52 = E6DD648D0(__eflags);
				if(_t52 == 0) {
					return 0xb;
				} else {
					_t96 = _t52;
					if(_a4 != 0) {
						 *_a4 =  *((intOrPtr*)(_t52 + 0xb4));
					}
					 *(_t96 + 0x68) = 0;
					_t89 = 0;
					 *(_t96 + 0x24) = 1;
					_t97 =  *0x6dd6f188;
					 *((intOrPtr*)(_t96 + 4)) = _a16;
					 *(_t96 + 0x14) = 0xffffffff;
					 *((intOrPtr*)(_t96 + 8)) = _a12;
					while(1) {
						_v48 = 0;
						_v52 = 0;
						_v56 = 1;
						 *_t102 = 0;
						_t56 = CreateEventA(??, ??, ??, ??);
						 *(_t96 + 0x18) = _t56;
						_t104 = _t102 - 0x10;
						if(_t56 != 0) {
							break;
						}
						if(_t89 == 0) {
							 *_t104 = 0;
							Sleep(??);
							_t102 = _t104 - 4;
							goto L7;
						} else {
							 *_t104 = 0x14;
							Sleep(??);
							_t104 = _t104 - 4;
							if(_t89 != 4) {
								L7:
								_t89 = _t89 + 1;
								continue;
							}
						}
						break;
					}
					 *(_t96 + 0x1c) = 0xffffffff;
					_t16 = _t96 + 0x38; // 0x38
					_t90 = _t16;
					E6DD64A20(_t16, _t16, _t96, _t97);
					_t91 =  *(_t96 + 0x18);
					 *_t96 = 0xbab1f00d;
					 *(_t96 + 0x6c) = 0;
					 *(_t96 + 0x64) = 0;
					__eflags =  *(_t96 + 0x18);
					if( *(_t96 + 0x18) == 0) {
						L25:
						__eflags = _a4;
						if(_a4 != 0) {
							 *_a4 = 0;
						}
						E6DD64650(_t96);
						return 0xb;
					} else {
						_t98 = 0;
						__eflags = _a8;
						if(_a8 != 0) {
							_t82 =  *_a8;
							_t98 = _a8[8];
							 *(_t96 + 0x24) = _t82;
							__eflags = _t82 & 0x00000008;
							if((_t82 & 0x00000008) != 0) {
								 *(_t96 + 0x6c) =  *(E6DD64AD0(_t90, _t91, _t96, _t98) + 0x6c);
							} else {
								 *(_t96 + 0x6c) =  *(_a8 + 0xc);
							}
						}
						_v56 = _t98;
						_v40 = 0;
						_v44 = 4;
						_v48 = _t96;
						_v52 = E6DD64F70;
						 *_t104 = 0;
						_t64 =  *0x6dd6f25c();
						_t99 = _t64;
						__eflags = _t64 - 1 - 0xfffffffd;
						if(_t64 - 1 > 0xfffffffd) {
							_t66 =  *(_t96 + 0x18);
							__eflags = _t66;
							if(_t66 != 0) {
								 *_t104 = _t66;
								CloseHandle(??);
								_t104 = _t104 - 4;
							}
							_t45 = _t96 + 0x1c; // 0x1c
							 *_t104 = _t45;
							E6DD63470();
							E6DD64A20(_t90, _t90, _t96, _t99);
							 *(_t96 + 0x18) = 0;
							 *(_t96 + 0x14) = 0;
							goto L25;
						} else {
							_t92 =  *(_t96 + 0x6c);
							_t72 = 0xfffffff1;
							__eflags = _t92 - 0xfffffff2;
							if(_t92 >= 0xfffffff2) {
								_t72 = 0xfffffffe;
								__eflags = _t92 - 0xffffffff;
								if(_t92 >= 0xffffffff) {
									_t72 = 0xf;
									__eflags = _t92 - 0xe;
									if(_t92 <= 0xe) {
										__eflags = _t92 - 2;
										_t72 =  <=  ? _t92 : 2;
									}
								}
							}
							_v56 = _t72;
							 *_t104 = _t99;
							SetThreadPriority(??, ??);
							_t106 = _t104 - 8;
							 *_t106 =  *(_t96 + 0x18);
							ResetEvent(??);
							_t107 = _t106 - 4;
							__eflags =  *(_t96 + 0x24) & 0x00000004;
							if(( *(_t96 + 0x24) & 0x00000004) != 0) {
								 *(_t96 + 0x14) = 0;
								 *_t107 = _t99;
								ResumeThread(??);
								_t108 = _t107 - 4;
								 *_t108 = _t99;
								CloseHandle(??);
								_t109 = _t108 - 4;
							} else {
								 *(_t96 + 0x14) = _t99;
								 *_t107 = _t99;
								ResumeThread(??);
								_t109 = _t107 - 4;
							}
							 *_t109 = 0;
							Sleep(??);
							__eflags = 0;
							return 0;
						}
					}
				}
			}

0x6dd66264
0x6dd66267
0x6dd6626e
0x6dd664ec
0x6dd66274
0x6dd66278
0x6dd6627c
0x6dd66288
0x6dd66288
0x6dd6628e
0x6dd66295
0x6dd66297
0x6dd6629e
0x6dd662a4
0x6dd662ab
0x6dd662b8
0x6dd662bb
0x6dd662bb
0x6dd662c3
0x6dd662cb
0x6dd662d3
0x6dd662da
0x6dd662dc
0x6dd662df
0x6dd662e4
0x00000000
0x00000000
0x6dd662e8
0x6dd66300
0x6dd66307
0x6dd6630d
0x00000000
0x6dd662ea
0x6dd662ea
0x6dd662f1
0x6dd662f3
0x6dd662f9
0x6dd662fb
0x6dd662fb
0x00000000
0x6dd662fb
0x6dd662f9
0x00000000
0x6dd662e8
0x6dd66318
0x6dd6631f
0x6dd6631f
0x6dd66324
0x6dd66329
0x6dd6632c
0x6dd66332
0x6dd66339
0x6dd66340
0x6dd66342
0x6dd6649b
0x6dd6649f
0x6dd664a1
0x6dd664a7
0x6dd664a7
0x6dd664af
0x6dd664c0
0x6dd66348
0x6dd6634c
0x6dd6634e
0x6dd66350
0x6dd6635a
0x6dd6635c
0x6dd6635f
0x6dd66362
0x6dd66364
0x6dd664d0
0x6dd6636a
0x6dd66371
0x6dd66371
0x6dd66364
0x6dd66374
0x6dd66378
0x6dd66380
0x6dd66388
0x6dd6638c
0x6dd66394
0x6dd6639b
0x6dd663a1
0x6dd663a6
0x6dd663a9
0x6dd66468
0x6dd6646b
0x6dd6646d
0x6dd6646f
0x6dd66472
0x6dd66478
0x6dd66478
0x6dd6647b
0x6dd6647e
0x6dd66481
0x6dd66488
0x6dd6648d
0x6dd66494
0x00000000
0x6dd663af
0x6dd663af
0x6dd663b2
0x6dd663b7
0x6dd663ba
0x6dd66438
0x6dd6643d
0x6dd66440
0x6dd66446
0x6dd6644b
0x6dd6644e
0x6dd66454
0x6dd6645c
0x6dd6645c
0x6dd6644e
0x6dd66440
0x6dd663bc
0x6dd663c0
0x6dd663c3
0x6dd663cc
0x6dd663cf
0x6dd663d2
0x6dd663d8
0x6dd663db
0x6dd663df
0x6dd66410
0x6dd66417
0x6dd6641a
0x6dd66420
0x6dd66423
0x6dd66426
0x6dd6642c
0x6dd663e1
0x6dd663e1
0x6dd663e4
0x6dd663e7
0x6dd663ed
0x6dd663ed
0x6dd663f0
0x6dd663f7
0x6dd663fd
0x6dd66409
0x6dd66409
0x6dd663a9
0x6dd66342

APIs

Part of subcall function 6DD648D0: pthread_mutex_lock.LIBWINPTHREAD-1(?,?,00000000,?,6DD64B15,?,?,?,?,?,?,?,?,?,?,?), ref: 6DD648DC
Part of subcall function 6DD648D0: pthread_mutex_unlock.LIBWINPTHREAD-1 ref: 6DD6491C

CreateEventA.KERNEL32 ref: 6DD662DA
Sleep.KERNEL32 ref: 6DD662F1
Sleep.KERNEL32 ref: 6DD66307

Memory Dump Source

Source File: 00000004.00000002.787395814.000000006DD61000.00000040.00000001.01000000.0000000A.sdmp, Offset: 6DD60000, based on PE: true

Associated: 00000004.00000002.787383138.000000006DD60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787413037.000000006DD6B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787415936.000000006DD6F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787437708.000000006DD74000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787474619.000000006DDD6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787482411.000000006DDE6000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6dd60000_windowsconnect.jbxd

Similarity

API ID: Sleep$CreateEventpthread_mutex_lockpthread_mutex_unlock
String ID:
API String ID: 2615191421-0
Opcode ID: 1ab2695e2c9180083c06909f42eba446dba7db591cec15b94e8cb759577aefde
Instruction ID: a2483adefac1b2d09dc0d393594462817a19776814aa3694a9b99428dedbcb7e
Opcode Fuzzy Hash: 1ab2695e2c9180083c06909f42eba446dba7db591cec15b94e8cb759577aefde
Instruction Fuzzy Hash: 9C6116B5508A429FE700AF28D58872EBBF0FF4A724F004669F99587780D735E854CBE2

Uniqueness

Uniqueness Score: -1.00%

Function 6DD615B0 Relevance: 18.1, APIs: 12, Instructions: 94
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 6DD61410: pthread_spin_lock.LIBWINPTHREAD-1(?,73B76490,?,6DD615DF), ref: 6DD61427
Part of subcall function 6DD61410: pthread_spin_unlock.LIBWINPTHREAD-1(?,73B76490,?,6DD615DF), ref: 6DD6144C

Sleep.KERNEL32 ref: 6DD615CF
pthread_mutex_lock.LIBWINPTHREAD-1 ref: 6DD615FD
sem_destroy.LIBWINPTHREAD-1 ref: 6DD61605

Part of subcall function 6DD66CA0: pthread_mutex_lock.LIBWINPTHREAD-1(?,?,?,?,?,?,6DD6160A), ref: 6DD66CC3
Part of subcall function 6DD66CA0: CloseHandle.KERNEL32(?,?,?,?,?,?,6DD6160A), ref: 6DD66CD8
Part of subcall function 6DD66CA0: pthread_mutex_unlock.LIBWINPTHREAD-1(?,?,?,?,?,?,?,6DD6160A), ref: 6DD66CF5
Part of subcall function 6DD66CA0: Sleep.KERNEL32(?,?,?,?,?,?,?,6DD6160A), ref: 6DD66D07
Part of subcall function 6DD66CA0: pthread_mutex_destroy.LIBWINPTHREAD-1(?,?,?,?,?,?,?,?,6DD6160A), ref: 6DD66D1F
Part of subcall function 6DD66CA0: ??3@YAXPAX@Z.MSVCRT ref: 6DD66D2C

sem_destroy.LIBWINPTHREAD-1 ref: 6DD61618
pthread_mutex_unlock.LIBWINPTHREAD-1 ref: 6DD61628
pthread_mutex_destroy.LIBWINPTHREAD-1 ref: 6DD61630
??3@YAXPAX@Z.MSVCRT ref: 6DD6164A
pthread_mutex_unlock.LIBWINPTHREAD-1 ref: 6DD61669
sem_init.LIBWINPTHREAD-1 ref: 6DD616CF
pthread_mutex_unlock.LIBWINPTHREAD-1 ref: 6DD616DD

Memory Dump Source

Source File: 00000004.00000002.787395814.000000006DD61000.00000040.00000001.01000000.0000000A.sdmp, Offset: 6DD60000, based on PE: true

Associated: 00000004.00000002.787383138.000000006DD60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787413037.000000006DD6B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787415936.000000006DD6F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787437708.000000006DD74000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787474619.000000006DDD6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787482411.000000006DDE6000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6dd60000_windowsconnect.jbxd

Similarity

API ID: pthread_mutex_unlock$??3@Sleeppthread_mutex_destroypthread_mutex_locksem_destroy$CloseHandlepthread_spin_lockpthread_spin_unlocksem_init
String ID:
API String ID: 2848882300-0
Opcode ID: 2f9f332b90e56e133de08d67a8713fcba842c1999797c37d9cc0ae8f7be50fb8
Instruction ID: 58a0094862eadc4fc956f4832aec50dce2991c3d6713900d61e7d8ed69839cd4
Opcode Fuzzy Hash: 2f9f332b90e56e133de08d67a8713fcba842c1999797c37d9cc0ae8f7be50fb8
Instruction Fuzzy Hash: 7A31B4B55087458FD710AF69D48062EBBF4AF89358F028A2EF9D887340E735A4459BE2

Uniqueness

Uniqueness Score: -1.00%

Function 6DD61FA0 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 184
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 25%

			E6DD61FA0(void* __ecx, char _a4, signed int _a8, signed int _a12) {
				intOrPtr _v32;
				char _v36;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				void* __edi;
				void* __ebp;
				signed int _t34;
				signed int _t35;
				intOrPtr _t37;
				signed int _t38;
				signed int _t39;
				signed int _t42;
				signed int _t45;
				signed int _t46;
				signed int _t47;
				signed int _t48;
				signed int _t50;
				signed int _t51;
				signed int _t53;
				signed int _t55;
				signed int _t56;
				signed int _t57;
				signed int _t62;
				void* _t63;
				void* _t64;
				signed int _t66;
				char _t67;
				signed int _t68;
				signed int _t70;
				void* _t71;
				intOrPtr* _t72;
				void* _t78;

				_t63 = __ecx;
				_t72 = _t71 - 0x2c;
				_t76 = _a8 - 1;
				_t67 = _a4;
				_t62 = _a12;
				if(_a8 == 1) {
					_v56 = _t62;
					 *_t72 = _t67;
					_t34 = E6DD62DC0();
					__eflags = _t34 - 0x80;
					if(_t34 == 0x80) {
						L11:
						 *_t72 = _t67;
						_v56 = 0;
						_t35 = WaitForSingleObject(??, ??);
						_t72 = _t72 - 8;
						_t68 = _a8;
						__eflags = _t35;
						if(_t35 == 0) {
							goto L13;
						}
					} else {
						__eflags = _t34 - 0x102;
						if(_t34 != 0x102) {
							_t68 = 0x16;
							__eflags = _t34;
							if(_t34 == 0) {
								goto L13;
							}
						} else {
							_a8 = 0x8a;
							goto L11;
						}
					}
					goto L14;
				} else {
					_v36 = _t67;
					_t37 = E6DD65830(_t76);
					_v32 = _t37;
					if(_t37 == 0) {
						_t70 = 0x14;
						__eflags = _t62 - 0xffffffff;
						if(_t62 == 0xffffffff) {
							while(1) {
								_v56 = 0x28;
								 *_t72 = _t67;
								_t38 = E6DD62DC0();
								__eflags = _t38 - 0x80;
								if(_t38 == 0x80) {
									break;
								}
								__eflags = _t38 - 0x102;
								if(_t38 == 0x102) {
									_t45 = E6DD659A0();
									__eflags = _t45;
									if(_t45 != 0) {
										goto L49;
									} else {
										continue;
									}
								} else {
									__eflags = _t38;
									if(_t38 == 0) {
										goto L13;
									} else {
										_t46 = E6DD659A0();
										__eflags = _t46;
										if(_t46 != 0) {
											L49:
											__eflags = _a8 - 2;
											if(__eflags == 0) {
												goto L33;
											} else {
												goto L50;
											}
										} else {
											goto L33;
										}
									}
								}
								goto L53;
							}
							_t39 = E6DD659A0();
							__eflags = _t39;
							if(_t39 != 0) {
								goto L49;
							} else {
								 *_t72 = _t67;
								_v56 = 0;
								_t42 = WaitForSingleObject(??, ??);
								_t72 = _t72 - 8;
								__eflags = _t42;
								_t68 = (_t42 & 0xffffff00 | _t42 != 0x00000000) & 0x000000ff;
								goto L14;
							}
						} else {
							while(1) {
								__eflags = _t62 - _t70;
								 *_t72 = _t67;
								_t66 =  <=  ? _t62 : _t70;
								_v56 = _t66;
								_t47 = E6DD62DC0();
								__eflags = _t47 - 0x80;
								if(_t47 == 0x80) {
									break;
								}
								__eflags = _t47 - 0x102;
								if(_t47 == 0x102) {
									_t62 = _t62 - _t66;
									__eflags = _t62;
									if(_t62 != 0) {
										_t50 = E6DD659A0();
										__eflags = _t50;
										if(_t50 != 0) {
											goto L33;
										} else {
											_t70 = _t66;
											continue;
										}
									} else {
										_v56 = 0;
										 *_t72 = _t67;
										_t51 = WaitForSingleObject(??, ??);
										_t72 = _t72 - 8;
										__eflags = _t51;
										if(_t51 == 0) {
											goto L13;
										} else {
											_t48 = 1;
											_t68 = 0x8a;
											goto L36;
										}
										goto L14;
									}
								} else {
									_t68 = 0x16;
									__eflags = _t47;
									if(_t47 == 0) {
										_t68 = 0;
										__eflags = 0;
										goto L35;
									} else {
										L25:
										_t48 = 1;
										__eflags = _t62 - _t70;
										if(_t62 <= _t70) {
											L36:
											__eflags = _a8 - 2;
											if(_a8 != 2) {
												__eflags = _t48;
												if(__eflags != 0) {
													E6DD65AD0(_t63, _t66, _t70, __eflags);
												}
											}
											goto L14;
										} else {
											_t47 = E6DD659A0();
											__eflags = _t47;
											if(_t47 != 0) {
												goto L33;
											} else {
												L35:
												__eflags = _t68;
												_t24 = _t68 != 0;
												__eflags = _t24;
												_t48 = _t47 & 0xffffff00 | _t24;
												goto L36;
											}
										}
									}
								}
								goto L53;
							}
							_t68 = 1;
							goto L25;
						}
					} else {
						while(1) {
							_v48 = _t62;
							_v52 = 0;
							_v56 =  &_v36;
							 *_t72 = 2;
							_t53 = E6DD62E60();
							_t78 = _t53 - 0x80;
							if(_t78 == 0) {
								break;
							}
							if(_t78 > 0) {
								_t68 = 0x8a;
								__eflags = _t53 - 0x102;
								if(_t53 != 0x102) {
									goto L47;
								} else {
									L16:
									_v56 = 0;
									 *_t72 = _v36;
									_t55 = WaitForSingleObject(??, ??);
									_t72 = _t72 - 8;
									__eflags = _t55;
									if(_t55 == 0) {
										goto L13;
									} else {
										__eflags = _a8 - 2;
										_t20 = _a8 != 2;
										__eflags = _t20;
										_t56 = _t55 & 0xffffff00 | _t20;
										goto L18;
									}
								}
							} else {
								if(_t53 == 0) {
									L13:
									_t68 = 0;
									__eflags = 0;
									goto L14;
								} else {
									if(_t53 != 1) {
										L47:
										__eflags = _a8 - 2;
										_t68 = 0x16;
										_t56 = _t53 & 0xffffff00 | _a8 != 0x00000002;
										L18:
										__eflags = _t56;
										if(_t56 == 0) {
											goto L14;
										} else {
											_t57 = E6DD659A0();
											__eflags = _t57;
											if(_t57 != 0) {
												L33:
												return 0x16;
											} else {
												return _t68;
											}
										}
									} else {
										 *_t72 = _v32;
										ResetEvent(??);
										_t72 = _t72 - 4;
										_t81 = _a8 - 2;
										if(_a8 != 2) {
											L50:
											E6DD65AD0(_t63, _t64, _t70, __eflags);
											_t68 = 0x16;
											L14:
											return _t68;
										} else {
											E6DD65AD0(_t63, _t64, _t70, _t81);
											continue;
										}
									}
								}
							}
							goto L53;
						}
						_t68 = 1;
						goto L16;
					}
				}
				L53:
			}

0x6dd61fa0
0x6dd61fa4
0x6dd61fa7
0x6dd61fac
0x6dd61fb0
0x6dd61fb4
0x6dd62030
0x6dd62034
0x6dd62037
0x6dd6203c
0x6dd62041
0x6dd62056
0x6dd62056
0x6dd62059
0x6dd62061
0x6dd62067
0x6dd6206a
0x6dd6206e
0x6dd62070
0x00000000
0x00000000
0x6dd62043
0x6dd62043
0x6dd62048
0x6dd62220
0x6dd62225
0x6dd62227
0x00000000
0x6dd6222d
0x6dd6204e
0x6dd6204e
0x00000000
0x6dd6204e
0x6dd62048
0x00000000
0x6dd61fb6
0x6dd61fb6
0x6dd61fba
0x6dd61fbf
0x6dd61fc5
0x6dd620e0
0x6dd620e5
0x6dd620e8
0x6dd6213d
0x6dd6213d
0x6dd62145
0x6dd62148
0x6dd6214d
0x6dd62152
0x00000000
0x00000000
0x6dd62158
0x6dd6215d
0x6dd62130
0x6dd62135
0x6dd62137
0x00000000
0x00000000
0x00000000
0x00000000
0x6dd6215f
0x6dd6215f
0x6dd62161
0x00000000
0x6dd62167
0x6dd62167
0x6dd6216c
0x6dd6216e
0x6dd62260
0x6dd62260
0x6dd62265
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6dd6216e
0x6dd62161
0x00000000
0x6dd6215d
0x6dd621f0
0x6dd621f5
0x6dd621f7
0x00000000
0x6dd621f9
0x6dd621f9
0x6dd621fc
0x6dd62204
0x6dd6220a
0x6dd6220d
0x6dd62215
0x00000000
0x6dd62215
0x6dd620ea
0x6dd620ea
0x6dd620ea
0x6dd620ee
0x6dd620f1
0x6dd620f4
0x6dd620f8
0x6dd620fd
0x6dd62102
0x00000000
0x00000000
0x6dd62108
0x6dd6210d
0x6dd621b0
0x6dd621b0
0x6dd621b2
0x6dd6227a
0x6dd6227f
0x6dd62281
0x00000000
0x6dd62287
0x6dd62287
0x00000000
0x6dd62287
0x6dd621b8
0x6dd621b8
0x6dd621c0
0x6dd621c3
0x6dd621c9
0x6dd621cc
0x6dd621ce
0x00000000
0x6dd621d4
0x6dd621d4
0x6dd621d9
0x00000000
0x6dd621d9
0x00000000
0x6dd621ce
0x6dd62113
0x6dd62113
0x6dd62118
0x6dd6211a
0x6dd62188
0x6dd62188
0x00000000
0x6dd6211c
0x6dd6211c
0x6dd6211c
0x6dd62121
0x6dd62123
0x6dd62190
0x6dd62190
0x6dd62195
0x6dd6219b
0x6dd6219d
0x6dd621a3
0x6dd621a3
0x6dd6219d
0x00000000
0x6dd62125
0x6dd62125
0x6dd6212a
0x6dd6212c
0x00000000
0x6dd6212e
0x6dd6218a
0x6dd6218a
0x6dd6218c
0x6dd6218c
0x6dd6218c
0x00000000
0x6dd6218c
0x6dd6212c
0x6dd62123
0x6dd6211a
0x00000000
0x6dd6210d
0x6dd621e0
0x00000000
0x6dd621e0
0x6dd61fcb
0x6dd61fcb
0x6dd61fcf
0x6dd61fd3
0x6dd61fdb
0x6dd61fdf
0x6dd61fe6
0x6dd61feb
0x6dd61ff0
0x00000000
0x00000000
0x6dd61ff6
0x6dd62088
0x6dd6208d
0x6dd62092
0x00000000
0x6dd62098
0x6dd62098
0x6dd6209c
0x6dd620a4
0x6dd620a7
0x6dd620ad
0x6dd620b0
0x6dd620b2
0x00000000
0x6dd620b4
0x6dd620b4
0x6dd620b9
0x6dd620b9
0x6dd620b9
0x00000000
0x6dd620b9
0x6dd620b2
0x6dd61ffc
0x6dd61ffe
0x6dd62078
0x6dd62078
0x6dd62078
0x00000000
0x6dd62000
0x6dd62003
0x6dd62238
0x6dd62238
0x6dd6223d
0x6dd62242
0x6dd620bc
0x6dd620bc
0x6dd620be
0x00000000
0x6dd620c0
0x6dd620c0
0x6dd620c5
0x6dd620c7
0x6dd62174
0x6dd62182
0x6dd620cd
0x6dd620d6
0x6dd620d6
0x6dd620c7
0x6dd62009
0x6dd6200d
0x6dd62010
0x6dd62016
0x6dd62019
0x6dd6201e
0x6dd6226b
0x6dd6226b
0x6dd62270
0x6dd6207a
0x6dd62083
0x6dd62024
0x6dd62024
0x00000000
0x6dd62024
0x6dd6201e
0x6dd62003
0x6dd61ffe
0x00000000
0x6dd61ff6
0x6dd62250
0x00000000
0x6dd62250
0x6dd61fc5
0x00000000

APIs

pthread_getevent.LIBWINPTHREAD-1 ref: 6DD61FBA
ResetEvent.KERNEL32 ref: 6DD62010
pthread_testcancel.LIBWINPTHREAD-1 ref: 6DD62024
WaitForSingleObject.KERNEL32 ref: 6DD62061
pthread_testcancel.LIBWINPTHREAD-1 ref: 6DD621A3

Part of subcall function 6DD62E60: WaitForMultipleObjects.KERNEL32 ref: 6DD62ECC

WaitForSingleObject.KERNEL32 ref: 6DD620A7
pthread_testcancel.LIBWINPTHREAD-1 ref: 6DD6226B

Strings

(, xrefs: 6DD6213D

Memory Dump Source

Source File: 00000004.00000002.787395814.000000006DD61000.00000040.00000001.01000000.0000000A.sdmp, Offset: 6DD60000, based on PE: true

Associated: 00000004.00000002.787383138.000000006DD60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787413037.000000006DD6B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787415936.000000006DD6F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787437708.000000006DD74000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787474619.000000006DDD6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787482411.000000006DDE6000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6dd60000_windowsconnect.jbxd

Similarity

API ID: Waitpthread_testcancel$ObjectSingle$EventMultipleObjectsResetpthread_getevent
String ID: (
API String ID: 2434277775-3887548279
Opcode ID: 3f77d47d0efb02828eb19c822d91c053984529dd3b96adb24a6cd2be5025a25c
Instruction ID: 5139bedf2951df7363f4469a29b60f387cd967261e7a1f18f11e50eb6b58b064
Opcode Fuzzy Hash: 3f77d47d0efb02828eb19c822d91c053984529dd3b96adb24a6cd2be5025a25c
Instruction Fuzzy Hash: 08515E31A4C392C7E7307F64954432E7EE4AB4579DF51452AFA8486282D73AC889CBF3

Uniqueness

Uniqueness Score: -1.00%

Function 6DD61DD0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 94
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

calloc.MSVCRT ref: 6DD61E02
CreateSemaphoreA.KERNEL32 ref: 6DD61E58
CreateSemaphoreA.KERNEL32 ref: 6DD61E7F
RtlInitializeCriticalSection.NTDLL ref: 6DD61E9E
RtlInitializeCriticalSection.NTDLL ref: 6DD61EA9
RtlInitializeCriticalSection.NTDLL ref: 6DD61EB4

Strings

l, xrefs: 6DD61DF3

Memory Dump Source

Source File: 00000004.00000002.787395814.000000006DD61000.00000040.00000001.01000000.0000000A.sdmp, Offset: 6DD60000, based on PE: true

Associated: 00000004.00000002.787383138.000000006DD60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787413037.000000006DD6B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787415936.000000006DD6F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787437708.000000006DD74000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787474619.000000006DDD6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787482411.000000006DDE6000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6dd60000_windowsconnect.jbxd

Similarity

API ID: CriticalInitializeSection$CreateSemaphore$calloc
String ID: l
API String ID: 2075313795-2517025534
Opcode ID: 7d58acb0c388f0f9fb5a2d575c3e6762dc9501e5ff44bc6912bee5993e1b078b
Instruction ID: 24f9d6fdad1401b230e440095bcc3bb76dd4d18021ccc40e569ceacbfad64488
Opcode Fuzzy Hash: 7d58acb0c388f0f9fb5a2d575c3e6762dc9501e5ff44bc6912bee5993e1b078b
Instruction Fuzzy Hash: 5731FBB15043418FEB00BF79D54876ABBF4EB41354F018A69E8948B286E779D448CBE2

Uniqueness

Uniqueness Score: -1.00%

Function 6DD616F0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 94
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

calloc.MSVCRT ref: 6DD61722
pthread_mutex_init.LIBWINPTHREAD-1 ref: 6DD6176A
sem_init.LIBWINPTHREAD-1 ref: 6DD6178C
sem_init.LIBWINPTHREAD-1 ref: 6DD617AA

Strings

$, xrefs: 6DD61713

Memory Dump Source

Source File: 00000004.00000002.787395814.000000006DD61000.00000040.00000001.01000000.0000000A.sdmp, Offset: 6DD60000, based on PE: true

Associated: 00000004.00000002.787383138.000000006DD60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787413037.000000006DD6B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787415936.000000006DD6F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787437708.000000006DD74000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787474619.000000006DDD6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787482411.000000006DDE6000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6dd60000_windowsconnect.jbxd

Similarity

API ID: sem_init$callocpthread_mutex_init
String ID: $
API String ID: 2903874097-3993045852
Opcode ID: 8ccfbfe84c1fc9c689a4110a86c9ae69be8d04506221a01687fb4f4cbab6dfc5
Instruction ID: 80ceb95ec4ec8444255e011a83c2f63372c15f60fce23c1e8b382ab3132ae8b2
Opcode Fuzzy Hash: 8ccfbfe84c1fc9c689a4110a86c9ae69be8d04506221a01687fb4f4cbab6dfc5
Instruction Fuzzy Hash: 18311AB5608385CBD700AF29D48031AB7E8EB90758F05486DF988CB206D775D8048BF2

Uniqueness

Uniqueness Score: -1.00%

Function 6DD62340 Relevance: 16.6, APIs: 11, Instructions: 127
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlTryEnterCriticalSection.NTDLL ref: 6DD623AA
CloseHandle.KERNEL32 ref: 6DD623EB
CloseHandle.KERNEL32 ref: 6DD623F6
RtlLeaveCriticalSection.NTDLL ref: 6DD62402
RtlDeleteCriticalSection.NTDLL ref: 6DD62414
RtlDeleteCriticalSection.NTDLL ref: 6DD6241C
RtlDeleteCriticalSection.NTDLL ref: 6DD62427
??3@YAXPAX@Z.MSVCRT ref: 6DD6242F
pthread_spin_lock.LIBWINPTHREAD-1 ref: 6DD6247C
pthread_spin_unlock.LIBWINPTHREAD-1 ref: 6DD62499

Part of subcall function 6DD62290: RtlEnterCriticalSection.NTDLL ref: 6DD622B0
Part of subcall function 6DD62290: RtlLeaveCriticalSection.NTDLL ref: 6DD622CC

Memory Dump Source

Source File: 00000004.00000002.787395814.000000006DD61000.00000040.00000001.01000000.0000000A.sdmp, Offset: 6DD60000, based on PE: true

Associated: 00000004.00000002.787383138.000000006DD60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787413037.000000006DD6B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787415936.000000006DD6F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787437708.000000006DD74000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787474619.000000006DDD6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787482411.000000006DDE6000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6dd60000_windowsconnect.jbxd

Similarity

API ID: CriticalSection$Delete$CloseEnterHandleLeave$??3@pthread_spin_lockpthread_spin_unlock
String ID:
API String ID: 1387492096-0
Opcode ID: 1f49e5eb84f83fae04e1eb7234c5462f801feb188f1995d590282a628e8b9ac0
Instruction ID: cbba41ef95afbc90a00525d51beca99f1d2d9867cf4c513c06b004b373f78d35
Opcode Fuzzy Hash: 1f49e5eb84f83fae04e1eb7234c5462f801feb188f1995d590282a628e8b9ac0
Instruction Fuzzy Hash: F6416FB16046448FDB10BF79E48022ABBF4FB85364F01097DE9998B345EB35E855CBE2

Uniqueness

Uniqueness Score: -1.00%

Function 6DD66600 Relevance: 16.6, APIs: 11, Instructions: 101
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 29%

			E6DD66600(void* __ecx, void* __ebp, void* __eflags, intOrPtr _a4, intOrPtr* _a8) {
				char _v16;
				char* _v40;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t21;
				intOrPtr _t24;
				int _t25;
				void* _t28;
				void* _t30;
				intOrPtr _t31;
				intOrPtr _t33;
				long _t44;
				void* _t46;
				void* _t47;
				intOrPtr _t52;
				signed int _t54;
				intOrPtr _t55;
				void* _t57;
				intOrPtr* _t58;

				_t47 = __ecx;
				_t58 = _t57 - 0x20;
				 *_t58 = 0x6dd6a018;
				_t52 = _a4;
				E6DD62F90();
				_t21 = E6DD64460(_t52);
				if(_t21 == 0) {
					L16:
					 *_t58 = 0x6dd6a018;
					E6DD632E0();
					return 3;
				} else {
					_t46 = _t21;
					_t24 =  *((intOrPtr*)(_t21 + 0x14));
					if(_t24 == 0) {
						goto L16;
					} else {
						 *_t58 = _t24;
						_v40 =  &_v16;
						_t25 = GetHandleInformation(??, ??);
						_t58 = _t58 - 8;
						if(_t25 == 0) {
							goto L16;
						} else {
							_t54 =  *(_t46 + 0x24) & 0x00000004;
							if(_t54 != 0) {
								 *_t58 = 0x6dd6a018;
								E6DD632E0();
								return 0x16;
							} else {
								_t28 = E6DD64AD0(_t46, _t47, _t52, _t54);
								if(_t28 != 0) {
									_t54 =  *(_t28 + 0xb4);
								}
								if(_t52 == _t54) {
									 *_t58 = 0x6dd6a018;
									E6DD632E0();
									_t30 = 0x24;
								} else {
									_t31 =  *((intOrPtr*)(_t46 + 0x14));
									if( *((intOrPtr*)(_t46 + 0x68)) != 0) {
										L10:
										 *_t58 = _t31;
										_t55 =  *0x6dd6f184;
										CloseHandle(??);
										_t33 =  *((intOrPtr*)(_t46 + 0x18));
										_t58 = _t58 - 4;
										if(_t33 != 0) {
											 *_t58 = _t33;
											CloseHandle(??);
											_t58 = _t58 - 4;
										}
										 *((intOrPtr*)(_t46 + 0x18)) = 0;
										if(_a8 != 0) {
											 *_a8 =  *((intOrPtr*)(_t46 + 4));
										}
										_t16 = _t46 + 0x1c; // 0x1c
										 *_t58 = _t16;
										E6DD63470();
										_t17 = _t46 + 0x38; // 0x38
										E6DD64A20(_t17, _t46, _t52, _t55);
										E6DD64650(_t46);
										 *_t58 = 0x6dd6a018;
										E6DD632E0();
										_t30 = 0;
									} else {
										_v40 = 0;
										 *_t58 = _t31;
										_t44 = WaitForSingleObject(??, ??);
										_t58 = _t58 - 8;
										if(_t44 != 0) {
											if( *((intOrPtr*)(_t46 + 0x68)) != 0) {
												goto L9;
											} else {
												 *_t58 = 0x6dd6a018;
												E6DD632E0();
												_t30 = 0x10;
											}
										} else {
											L9:
											_t31 =  *((intOrPtr*)(_t46 + 0x14));
											goto L10;
										}
									}
								}
								return _t30;
							}
						}
					}
				}
			}

0x6dd66600
0x6dd66603
0x6dd66606
0x6dd6660d
0x6dd66611
0x6dd66618
0x6dd6661f
0x6dd66700
0x6dd66700
0x6dd66707
0x6dd66717
0x6dd66625
0x6dd66625
0x6dd66627
0x6dd6662c
0x00000000
0x6dd66632
0x6dd66636
0x6dd66639
0x6dd6663d
0x6dd66643
0x6dd66648
0x00000000
0x6dd6664e
0x6dd66651
0x6dd66654
0x6dd66720
0x6dd66727
0x6dd66737
0x6dd6665a
0x6dd6665a
0x6dd66661
0x6dd66663
0x6dd66663
0x6dd6666b
0x6dd66760
0x6dd66767
0x6dd6676c
0x6dd66671
0x6dd66674
0x6dd66679
0x6dd6669a
0x6dd6669a
0x6dd6669d
0x6dd666a3
0x6dd666a5
0x6dd666a8
0x6dd666ad
0x6dd666af
0x6dd666b2
0x6dd666b4
0x6dd666b4
0x6dd666bb
0x6dd666c4
0x6dd666cd
0x6dd666cd
0x6dd666cf
0x6dd666d2
0x6dd666d5
0x6dd666da
0x6dd666dd
0x6dd666e4
0x6dd666e9
0x6dd666f0
0x6dd666f5
0x6dd6667b
0x6dd6667b
0x6dd66683
0x6dd66686
0x6dd6668c
0x6dd66691
0x6dd66745
0x00000000
0x6dd6674b
0x6dd6674b
0x6dd66752
0x6dd66757
0x6dd66757
0x6dd66697
0x6dd66697
0x6dd66697
0x00000000
0x6dd66697
0x6dd66691
0x6dd66679
0x6dd666fd
0x6dd666fd
0x6dd66654
0x6dd66648
0x6dd6662c

APIs

pthread_mutex_lock.LIBWINPTHREAD-1 ref: 6DD66611
GetHandleInformation.KERNEL32 ref: 6DD6663D
WaitForSingleObject.KERNEL32 ref: 6DD66686
CloseHandle.KERNEL32 ref: 6DD666A3
CloseHandle.KERNEL32 ref: 6DD666B2
pthread_mutex_destroy.LIBWINPTHREAD-1 ref: 6DD666D5
pthread_mutex_unlock.LIBWINPTHREAD-1 ref: 6DD666F0
pthread_mutex_unlock.LIBWINPTHREAD-1 ref: 6DD66707
pthread_mutex_unlock.LIBWINPTHREAD-1 ref: 6DD66727

Part of subcall function 6DD64AD0: TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,6DD65ADA,?,?,?,?,6DD66ADD), ref: 6DD64AED

Memory Dump Source

Source File: 00000004.00000002.787395814.000000006DD61000.00000040.00000001.01000000.0000000A.sdmp, Offset: 6DD60000, based on PE: true

Associated: 00000004.00000002.787383138.000000006DD60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787413037.000000006DD6B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787415936.000000006DD6F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787437708.000000006DD74000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787474619.000000006DDD6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787482411.000000006DDE6000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6dd60000_windowsconnect.jbxd

Similarity

API ID: Handlepthread_mutex_unlock$Close$InformationObjectSingleValueWaitpthread_mutex_destroypthread_mutex_lock
String ID:
API String ID: 3125639524-0
Opcode ID: 19533e3e7d4db972d6083bc18919d8df788eaab9eea5c458890f44699d1e807a
Instruction ID: a53c05ec28d27f2f9d31e5bbde3b73a89e4866a18c46beba17fa820cb54ea9c6
Opcode Fuzzy Hash: 19533e3e7d4db972d6083bc18919d8df788eaab9eea5c458890f44699d1e807a
Instruction Fuzzy Hash: 043143716082818BDB00BFB9E585A6E7BE4EF45358F0544A9F9848B309DB31D844CBF3

Uniqueness

Uniqueness Score: -1.00%

Function 6DD65130 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 49threadCOMMON

Download Yara Rule

APIs

__pth_gpointer_locked.LIBWINPTHREAD-1 ref: 6DD65152

Part of subcall function 6DD64C20: pthread_mutex_lock.LIBWINPTHREAD-1(?,?,00000000,?,6DD64C6F,?,?,?,?,?,?,00000000,?,?,?,6DD658D2), ref: 6DD64C36
Part of subcall function 6DD64C20: pthread_mutex_unlock.LIBWINPTHREAD-1(?,?,00000000,?,6DD64C6F,?,?,?,?,?,?,00000000,?,?,?,6DD658D2), ref: 6DD64C4B

__pth_gpointer_locked.LIBWINPTHREAD-1 ref: 6DD65161
GetCurrentThreadId.KERNEL32 ref: 6DD65168
__pth_gpointer_locked.LIBWINPTHREAD-1 ref: 6DD65177
printf.MSVCRT ref: 6DD6519B
GetCurrentThreadId.KERNEL32 ref: 6DD651B0
printf.MSVCRT ref: 6DD651D1

Strings

T%p %d %s, xrefs: 6DD651CA
T%p %d V=%0X H=%p %s, xrefs: 6DD65194

Memory Dump Source

Source File: 00000004.00000002.787395814.000000006DD61000.00000040.00000001.01000000.0000000A.sdmp, Offset: 6DD60000, based on PE: true

Associated: 00000004.00000002.787383138.000000006DD60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787413037.000000006DD6B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787415936.000000006DD6F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787437708.000000006DD74000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787474619.000000006DDD6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787482411.000000006DDE6000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6dd60000_windowsconnect.jbxd

Similarity

API ID: __pth_gpointer_locked$CurrentThreadprintf$pthread_mutex_lockpthread_mutex_unlock
String ID: T%p %d %s$T%p %d V=%0X H=%p %s
API String ID: 2614883391-2059990036
Opcode ID: 651a22cd13117b3a67e515c708cd121824c2881282bb6a7ef7cc7e86e2a2bf84
Instruction ID: 557b72fdcc09f8ea0af8f5e4cc43f82722fc9fb9008d31412715d8d30c245b26
Opcode Fuzzy Hash: 651a22cd13117b3a67e515c708cd121824c2881282bb6a7ef7cc7e86e2a2bf84
Instruction Fuzzy Hash: A911B6B55093419FD740FF69E49492EBBE0BF89650F41981EF59887340D774D8448BA2

Uniqueness

Uniqueness Score: -1.00%

Function 6DD66CA0 Relevance: 15.1, APIs: 10, Instructions: 58sleepCOMMON

Download Yara Rule

APIs

pthread_mutex_lock.LIBWINPTHREAD-1(?,?,?,?,?,?,6DD6160A), ref: 6DD66CC3
CloseHandle.KERNEL32(?,?,?,?,?,?,6DD6160A), ref: 6DD66CD8
pthread_mutex_unlock.LIBWINPTHREAD-1(?,?,?,?,?,?,?,6DD6160A), ref: 6DD66CF5
Sleep.KERNEL32(?,?,?,?,?,?,?,6DD6160A), ref: 6DD66D07
Sleep.KERNEL32(?,?,?,?,?,?,?,?,6DD6160A), ref: 6DD66D17
pthread_mutex_destroy.LIBWINPTHREAD-1(?,?,?,?,?,?,?,?,6DD6160A), ref: 6DD66D1F

Part of subcall function 6DD63470: CloseHandle.KERNEL32(?,?,?,73B76490,6DD66D24,?,?,?,?,?,?,?,?,6DD6160A), ref: 6DD6348D
Part of subcall function 6DD63470: ??3@YAXPAX@Z.MSVCRT ref: 6DD63499

??3@YAXPAX@Z.MSVCRT ref: 6DD66D2C
pthread_mutex_unlock.LIBWINPTHREAD-1(?,?,?,?,?,?,?,6DD6160A), ref: 6DD66D3E
_errno.MSVCRT ref: 6DD66D43
_errno.MSVCRT ref: 6DD66D56

Memory Dump Source

Source File: 00000004.00000002.787395814.000000006DD61000.00000040.00000001.01000000.0000000A.sdmp, Offset: 6DD60000, based on PE: true

Associated: 00000004.00000002.787383138.000000006DD60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787413037.000000006DD6B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787415936.000000006DD6F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787437708.000000006DD74000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787474619.000000006DDD6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787482411.000000006DDE6000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6dd60000_windowsconnect.jbxd

Similarity

API ID: ??3@CloseHandleSleep_errnopthread_mutex_unlock$pthread_mutex_destroypthread_mutex_lock
String ID:
API String ID: 1604885533-0
Opcode ID: 613454f7688051f4c4d630bce15c73f1abc686d76027cc6db74021c41c87f9c4
Instruction ID: 92528b4869a856cd76d30458a0a300744781aaeee72b26ab1968fdca77b48b7f
Opcode Fuzzy Hash: 613454f7688051f4c4d630bce15c73f1abc686d76027cc6db74021c41c87f9c4
Instruction Fuzzy Hash: 2E110DB1408A858BD7107F39C94462EBBB4FF06364F164A6DE8E58B281DB359844CFF2

Uniqueness

Uniqueness Score: -1.00%

Function 6DD637D0 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 38COMMON

Download Yara Rule

APIs

pthread_spin_lock.LIBWINPTHREAD-1(?,?,?,?,?,?,?,?,6DD63FEE), ref: 6DD637E0
pthread_spin_unlock.LIBWINPTHREAD-1(?,?,?,?,?,?,?,?,6DD63FEE), ref: 6DD63805
fprintf.MSVCRT ref: 6DD63842
exit.MSVCRT ref: 6DD6384E

Strings

/var/tmp/build/mingw-w64-0a1d495478d8/mingw-w64-libraries/winpthreads/src/rwlock.c, xrefs: 6DD63827
(, xrefs: 6DD6381F
(((rwlock_t *)*rwl)->valid == LIFE_RWLOCK) && (((rwlock_t *)*rwl)->busy > 0), xrefs: 6DD6382F
Assertion failed: (%s), file %s, line %d, xrefs: 6DD63837

Memory Dump Source

Source File: 00000004.00000002.787395814.000000006DD61000.00000040.00000001.01000000.0000000A.sdmp, Offset: 6DD60000, based on PE: true

Associated: 00000004.00000002.787383138.000000006DD60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787413037.000000006DD6B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787415936.000000006DD6F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787437708.000000006DD74000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787474619.000000006DDD6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787482411.000000006DDE6000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6dd60000_windowsconnect.jbxd

Similarity

API ID: exitfprintfpthread_spin_lockpthread_spin_unlock
String ID: ($(((rwlock_t *)*rwl)->valid == LIFE_RWLOCK) && (((rwlock_t *)*rwl)->busy > 0)$/var/tmp/build/mingw-w64-0a1d495478d8/mingw-w64-libraries/winpthreads/src/rwlock.c$Assertion failed: (%s), file %s, line %d
API String ID: 2153800997-3539959846
Opcode ID: eaac0200f012bedaf6cc82bc90beb7bc7cad85e8148f65030ec6e8c82681c44e
Instruction ID: eacfffec25ec3deb7bd2abd6f12253ad94075e446b17f76df68e67caccb06c2e
Opcode Fuzzy Hash: eaac0200f012bedaf6cc82bc90beb7bc7cad85e8148f65030ec6e8c82681c44e
Instruction Fuzzy Hash: C901E5B06482918FDB00AF68D48975ABBF4FB46314F068858F5888B305C738A8849BF3

Uniqueness

Uniqueness Score: -1.00%

Function 6DD656C0 Relevance: 13.6, APIs: 9, Instructions: 78COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 6DD656CB

Part of subcall function 6DD64AD0: TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,6DD65ADA,?,?,?,?,6DD66ADD), ref: 6DD64AED

pthread_spin_lock.LIBWINPTHREAD-1 ref: 6DD656E2
pthread_spin_unlock.LIBWINPTHREAD-1 ref: 6DD65700
SetLastError.KERNEL32 ref: 6DD6570C
realloc.MSVCRT ref: 6DD65734
realloc.MSVCRT ref: 6DD6574B
memset.MSVCRT ref: 6DD6577C
memset.MSVCRT ref: 6DD6579B

Memory Dump Source

Source File: 00000004.00000002.787395814.000000006DD61000.00000040.00000001.01000000.0000000A.sdmp, Offset: 6DD60000, based on PE: true

Associated: 00000004.00000002.787383138.000000006DD60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787413037.000000006DD6B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787415936.000000006DD6F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787437708.000000006DD74000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787474619.000000006DDD6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787482411.000000006DDE6000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6dd60000_windowsconnect.jbxd

Similarity

API ID: ErrorLastmemsetrealloc$Valuepthread_spin_lockpthread_spin_unlock
String ID:
API String ID: 3506545171-0
Opcode ID: 0420fe020f057d242b75f5c21bf0edff12606a82d55345a8a5a2cbcc141e78a7
Instruction ID: c67bff887ab7a1a166a7328a0188468107a80aeb0fcdfbb68e6bcf71a8eabff9
Opcode Fuzzy Hash: 0420fe020f057d242b75f5c21bf0edff12606a82d55345a8a5a2cbcc141e78a7
Instruction Fuzzy Hash: F131B5B4508345CFCB00EF39D48466ABBE0FF89754F12896DE9858B345E734D985CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 6DD66780 Relevance: 13.6, APIs: 9, Instructions: 69
COMMON

Download Yara Rule

C-Code - Quality: 16%

			E6DD66780(void* __ecx, void* __edi, void* __ebp, void* __eflags, intOrPtr _a4) {
				char _v16;
				char* _v40;
				void* __ebx;
				void* __esi;
				void* _t17;
				intOrPtr _t21;
				int _t22;
				signed int _t23;
				void* _t25;
				intOrPtr _t30;
				void* _t38;
				intOrPtr _t41;
				void* _t42;
				intOrPtr _t43;
				void* _t45;
				intOrPtr* _t46;

				_t42 = __edi;
				_t46 = _t45 - 0x24;
				 *_t46 = _a4;
				_t17 = E6DD64C20();
				 *_t46 = 0x6dd6a018;
				_t38 = _t17;
				E6DD62F90();
				if(_t38 == 0) {
					L11:
					 *_t46 = 0x6dd6a018;
					E6DD632E0();
					return 3;
				} else {
					_t21 =  *((intOrPtr*)(_t38 + 0x14));
					if(_t21 == 0) {
						goto L11;
					} else {
						 *_t46 = _t21;
						_v40 =  &_v16;
						_t22 = GetHandleInformation(??, ??);
						_t46 = _t46 - 8;
						if(_t22 == 0) {
							goto L11;
						} else {
							_t23 =  *(_t38 + 0x24);
							if((_t23 & 0x00000004) != 0) {
								 *_t46 = 0x6dd6a018;
								E6DD632E0();
								_t25 = 0x16;
							} else {
								_t41 =  *((intOrPtr*)(_t38 + 0x14));
								 *((intOrPtr*)(_t38 + 0x14)) = 0;
								 *(_t38 + 0x24) = _t23 | 0x00000004;
								if(_t41 != 0) {
									 *_t46 = _t41;
									_t43 =  *0x6dd6f184;
									CloseHandle(??);
									_t46 = _t46 - 4;
									if( *((intOrPtr*)(_t38 + 0x68)) != 0) {
										_t30 =  *((intOrPtr*)(_t38 + 0x18));
										if(_t30 != 0) {
											 *_t46 = _t30;
											CloseHandle(??);
											_t46 = _t46 - 4;
										}
										_t13 = _t38 + 0x1c; // 0x1c
										 *((intOrPtr*)(_t38 + 0x18)) = 0;
										 *_t46 = _t13;
										E6DD63470();
										_t15 = _t38 + 0x38; // 0x38
										E6DD64A20(_t15, _t38, _t42, _t43);
										E6DD64650(_t38);
									}
								}
								 *_t46 = 0x6dd6a018;
								E6DD632E0();
								_t25 = 0;
							}
							return _t25;
						}
					}
				}
			}

0x6dd66780
0x6dd66782
0x6dd66789
0x6dd6678c
0x6dd66791
0x6dd66798
0x6dd6679a
0x6dd667a1
0x6dd66848
0x6dd66848
0x6dd6684f
0x6dd6685e
0x6dd667a7
0x6dd667a7
0x6dd667ac
0x00000000
0x6dd667b2
0x6dd667b6
0x6dd667b9
0x6dd667bd
0x6dd667c3
0x6dd667c8
0x00000000
0x6dd667ca
0x6dd667ca
0x6dd667cf
0x6dd66860
0x6dd66867
0x6dd6686c
0x6dd667d5
0x6dd667d8
0x6dd667db
0x6dd667e2
0x6dd667e7
0x6dd667e9
0x6dd667ec
0x6dd667f2
0x6dd667f7
0x6dd667fc
0x6dd667fe
0x6dd66803
0x6dd66805
0x6dd66808
0x6dd6680a
0x6dd6680a
0x6dd6680d
0x6dd66810
0x6dd66817
0x6dd6681a
0x6dd6681f
0x6dd66822
0x6dd66829
0x6dd66829
0x6dd667fc
0x6dd6682e
0x6dd66835
0x6dd6683a
0x6dd6683a
0x6dd66841
0x6dd66841
0x6dd667c8
0x6dd667ac

APIs

__pth_gpointer_locked.LIBWINPTHREAD-1 ref: 6DD6678C

Part of subcall function 6DD64C20: pthread_mutex_lock.LIBWINPTHREAD-1(?,?,00000000,?,6DD64C6F,?,?,?,?,?,?,00000000,?,?,?,6DD658D2), ref: 6DD64C36
Part of subcall function 6DD64C20: pthread_mutex_unlock.LIBWINPTHREAD-1(?,?,00000000,?,6DD64C6F,?,?,?,?,?,?,00000000,?,?,?,6DD658D2), ref: 6DD64C4B

pthread_mutex_lock.LIBWINPTHREAD-1 ref: 6DD6679A
GetHandleInformation.KERNEL32 ref: 6DD667BD
CloseHandle.KERNEL32 ref: 6DD667F2
CloseHandle.KERNEL32 ref: 6DD66808
pthread_mutex_destroy.LIBWINPTHREAD-1 ref: 6DD6681A
pthread_mutex_unlock.LIBWINPTHREAD-1 ref: 6DD66835
pthread_mutex_unlock.LIBWINPTHREAD-1 ref: 6DD6684F
pthread_mutex_unlock.LIBWINPTHREAD-1 ref: 6DD66867

Memory Dump Source

Source File: 00000004.00000002.787395814.000000006DD61000.00000040.00000001.01000000.0000000A.sdmp, Offset: 6DD60000, based on PE: true

Associated: 00000004.00000002.787383138.000000006DD60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787413037.000000006DD6B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787415936.000000006DD6F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787437708.000000006DD74000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787474619.000000006DDD6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787482411.000000006DDE6000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6dd60000_windowsconnect.jbxd

Similarity

API ID: pthread_mutex_unlock$Handle$Closepthread_mutex_lock$Information__pth_gpointer_lockedpthread_mutex_destroy
String ID:
API String ID: 3021062890-0
Opcode ID: 79e681051499fb88608a970aba0841317b51b7cc06f892ec0ecc5eaf85cfceaa
Instruction ID: 98c804e5b2003ea46a7590d3e5c0759bd9b46bd4fc790f5baf8a4a25b3cff259
Opcode Fuzzy Hash: 79e681051499fb88608a970aba0841317b51b7cc06f892ec0ecc5eaf85cfceaa
Instruction Fuzzy Hash: BA2130B0A082818BEB00FF79E58566F7BE4EF45204F055869F9948B249D735D898CBF3

Uniqueness

Uniqueness Score: -1.00%

Function 6DD66B90 Relevance: 13.6, APIs: 9, Instructions: 67COMMON

Download Yara Rule

APIs

calloc.MSVCRT ref: 6DD66BCA
pthread_mutex_init.LIBWINPTHREAD-1(?,?,?,?,?,6DD616D4), ref: 6DD66BEA
CreateSemaphoreA.KERNEL32 ref: 6DD66C14
pthread_mutex_destroy.LIBWINPTHREAD-1 ref: 6DD66C39
??3@YAXPAX@Z.MSVCRT ref: 6DD66C48
_errno.MSVCRT ref: 6DD66C4D
_errno.MSVCRT ref: 6DD66C60
_errno.MSVCRT ref: 6DD66C73
_errno.MSVCRT ref: 6DD66C86

Memory Dump Source

Source File: 00000004.00000002.787395814.000000006DD61000.00000040.00000001.01000000.0000000A.sdmp, Offset: 6DD60000, based on PE: true

Associated: 00000004.00000002.787383138.000000006DD60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787413037.000000006DD6B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787415936.000000006DD6F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787437708.000000006DD74000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787474619.000000006DDD6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787482411.000000006DDE6000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6dd60000_windowsconnect.jbxd

Similarity

API ID: _errno$??3@CreateSemaphorecallocpthread_mutex_destroypthread_mutex_init
String ID:
API String ID: 4013580772-0
Opcode ID: d4e58b51f030842db1a7be5ac1e63abf02a2eb3349528914693959b9f50467e0
Instruction ID: a6d7c2a365645c1396189f13a21855d147a3b0aa1159b1274a1a7914d7a4d2aa
Opcode Fuzzy Hash: d4e58b51f030842db1a7be5ac1e63abf02a2eb3349528914693959b9f50467e0
Instruction Fuzzy Hash: AA213870549B81CBE3117F29C94471ABFF4EB42764F0A8698FCA88B2D1D77588008BF2

Uniqueness

Uniqueness Score: -1.00%

Function 6DD64A20 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 73
threadCOMMON

Download Yara Rule

C-Code - Quality: 26%

			E6DD64A20(intOrPtr* __eax, void* __ebx, void* __edi, void* __esi) {
				void* _t89;
				int _t91;
				long _t93;
				void* _t95;
				signed int _t97;
				void* _t102;
				void* _t107;
				signed int _t108;
				signed char _t111;
				signed char _t112;
				signed int _t114;
				signed int _t118;
				signed char _t119;
				signed char _t123;
				int _t127;
				int _t132;
				intOrPtr* _t136;
				void* _t137;
				signed int _t138;
				void* _t140;
				signed char _t149;
				signed char _t151;
				void* _t156;
				void* _t157;
				signed int* _t159;
				void* _t160;
				void* _t164;
				signed int _t165;
				void* _t169;
				signed int _t171;
				void* _t176;
				intOrPtr* _t177;
				void* _t178;
				void** _t179;
				intOrPtr* _t180;
				signed char** _t181;
				void** _t183;
				signed int _t184;
				intOrPtr* _t185;

				if(__eax == 0) {
					return __eax;
				} else {
					_t136 = __eax;
					_t177 = _t176 + 0xffffff80;
					 *_t177 = __eax;
					_t89 = E6DD64300();
					if(_t89 == 1) {
						_t137 = _t177 + 0x15;
						_t164 = "Error cleaning up spin_keys for thread ";
						_t91 = memcpy(_t137, _t164, 0xa << 2);
						_t178 = _t177 + 0xc;
						_t156 = _t178 + 0x3d;
						memset(_t156, _t91, 0x43 << 0);
						_t179 = _t178 + 0xc;
						_t157 = _t156 + 0x43;
						_t149 = 0;
						_t93 = GetCurrentThreadId();
						_t150 =  &(_t179[0xf]);
						_t179[2] = 0xa;
						_t179[1] =  &(_t179[0xf]);
						 *_t179 = _t93;
						 *0x6dd6f278();
						__eflags = _t179[0xf];
						_t95 = 0x27;
						if(_t179[0xf] != 0) {
							while(1) {
								_t95 = _t95 + 1;
								__eflags =  *((char*)(_t137 + _t95));
								if( *((char*)(_t137 + _t95)) == 0) {
									break;
								}
								__eflags = _t95 - 0x6a;
								if(_t95 != 0x6a) {
									continue;
								}
								goto L10;
							}
							__eflags = _t95 - 0x6a;
							if(_t95 != 0x6a) {
								goto L9;
							}
						} else {
							L9:
							 *((char*)(_t179 + _t95 + 0x15)) = 0xa;
							 *((char*)(_t179 + _t95 + 0x16)) = 0;
						}
						L10:
						 *_t179 = _t137;
						OutputDebugStringA(??);
						_push(_t95);
						abort();
						_push(_t169);
						_push(_t157);
						_push(_t164);
						_push(_t137);
						_t180 = _t179 - 0x2c;
						__eflags =  *0x6dd6c050 - 1;
						if(__eflags != 0) {
							E6DD64990(_t149, _t150, _t169, __eflags);
						}
						 *_t180 =  *0x6dd6a020;
						_t97 = TlsGetValue(??);
						_t181 = _t180 - 4;
						_t138 = _t97;
						__eflags = _t97;
						if(__eflags == 0) {
							_t165 = E6DD648D0(__eflags);
							__eflags =  *0x6dd70020;
							if( *0x6dd70020 == 0) {
								goto L14;
							} else {
								__eflags = _t165;
								if(_t165 == 0) {
									goto L14;
								} else {
									 *(_t165 + 0x24) = 1;
									 *((intOrPtr*)(_t165 + 0x3c)) = GetCurrentThreadId();
									_t181[3] = 0;
									_t181[2] = 0;
									_t181[1] = 1;
									 *_t181 = 0;
									_t102 = CreateEventA(??, ??, ??, ??);
									 *((intOrPtr*)(_t165 + 0x1c)) = 0xffffffff;
									 *(_t165 + 0x18) = _t102;
									_t183 = _t181 - 0x10;
									_t21 = _t165 + 0x38; // 0x38
									E6DD64A20(_t21, _t138, _t157, _t165);
									_t171 =  *0x6dd6f1a0;
									 *(_t165 + 0x64) = 0;
									 *(_t165 + 0x14) = 0;
									_t159 = GetCurrentProcess();
									_t140 = GetCurrentThread();
									_t107 = GetCurrentProcess();
									_t24 = _t165 + 0x14; // 0x14
									_t151 = _t24;
									_t183[2] = _t159;
									_t183[6] = 2;
									_t183[5] = 0;
									_t183[4] = 0;
									_t183[3] = _t151;
									_t183[1] = _t140;
									 *_t183 = _t107;
									_t108 = DuplicateHandle(??, ??, ??, ??, ??, ??, ??);
									_t184 = _t183 - 0x1c;
									__eflags = _t108;
									if(_t108 == 0) {
										L20:
										abort();
										asm("ud2");
										 *0 =  *(_t184 + 0x1c);
										asm("ud2");
										_t111 = _t184 + 0x14;
										 *0 = _t111;
										asm("ud2");
										asm("invalid");
										asm("invalid");
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										asm("invalid");
										asm("invalid");
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										 *_t111 =  *_t111 + _t111;
										__eflags =  *_t111;
										asm("das");
										if(__eflags <= 0) {
											L39:
											asm("bound esp, [ecx+0x72]");
											if(__eflags < 0) {
												goto L61;
											} else {
												goto L40;
											}
										} else {
											if(__eflags < 0) {
												L28:
												asm("popad");
												if(__eflags < 0) {
													goto L49;
												} else {
													if (__eflags >= 0) goto L40;
													goto L30;
												}
											} else {
												if(__eflags == 0) {
													L42:
													__eflags = _t112 - 0x494c203d;
													goto L43;
												} else {
													if(__eflags < 0) {
														L30:
														if(__eflags >= 0) {
															L40:
															if(__eflags < 0) {
																goto L47;
															} else {
																_t112 = _t111 - 0x6c61763e;
																_t184 =  *(_t112 + 0x3d) * 0x494c203d;
																__eflags = _t184;
																goto L42;
															}
														} else {
															if(__eflags > 0) {
																if(__eflags >= 0) {
																	 *[gs:0x6c202c73] =  *[gs:0x6c202c73] & _t111;
																	__eflags =  *[gs:0x6c202c73];
																	goto L60;
																} else {
																	 *[ds:eax] =  *[ds:eax] & _t151;
																	 *_t111 =  *_t111 - _t111;
																	_t149 =  &(1[_t149]);
																	__eflags = _t149;
																	if(__eflags >= 0) {
																		goto L74;
																	} else {
																		if(__eflags < 0) {
																			goto L75;
																		} else {
																			_t171 = _t159[0x1b] * 0x69616620;
																			__eflags = _t171;
																			goto L54;
																		}
																	}
																}
															} else {
																asm("outsb");
																if(__eflags < 0) {
																	L54:
																	asm("outsd");
																	asm("outsb");
																	goto L55;
																} else {
																	_push(0x64616572);
																	if(__eflags >= 0) {
																		L43:
																		__eflags = _t112 - 0x46494c20;
																		_t171 =  &(1[_t171]);
																		_pop(_t159);
																		_t151 =  &(1[_t151]);
																		_t149 =  &(1[_t149]);
																		__eflags = _t149;
																		_push(_t151);
																		_push(_t151);
																		goto L44;
																	} else {
																		if(__eflags >= 0) {
																			L57:
																			__eflags = _t111 -  *[fs:eax];
																			 *0x202c2973 =  *0x202c2973 - _t111;
																			__eflags =  *0x202c2973;
																		} else {
																			asm("arpl [edi], bp");
																			asm("bound esp, [ecx+0x72]");
																			if(__eflags < 0) {
																				L56:
																				_t171 =  *(_t171 + 0x64) * 0x2528203a;
																				__eflags = _t171;
																				goto L57;
																			} else {
																				if(__eflags < 0) {
																					L44:
																					_t149 = _t149 - 1;
																					_t171 =  &(1[_t171]);
																					_push(_t151);
																					 *_t112 =  *_t112 - _t184;
																					 *[es:eax] =  *[es:eax] & _t149;
																					 *_t112 =  *_t112 - _t149;
																					__eflags =  *_t112;
																					asm("bound esp, [ecx+0x72]");
																					if(__eflags < 0) {
																						goto L65;
																					} else {
																						if(__eflags < 0) {
																							goto L64;
																						} else {
																							if(__eflags == 0) {
																								L55:
																								_t51 = _t165 + 0x61;
																								 *_t51 =  *(_t165 + 0x61) & _t111;
																								__eflags =  *_t51;
																								goto L56;
																							} else {
																								L47:
																								_t149 = _t149 -  *_t149;
																								_t112 = _t111 -  *(_t151 + 0x61);
																								__eflags = _t112;
																								if(__eflags < 0) {
																									goto L71;
																								} else {
																									_t184 =  *(_t171 + 0x72) * 0x623e2d29;
																									__eflags = _t184;
																									L49:
																									_t111 = _t112 - 0x7375623e;
																									__eflags = _t111;
																								}
																							}
																						}
																					}
																				} else {
																					asm("arpl [eax], ax");
																					 *_t111 =  *_t111 - _t149;
																					_t44 = _t151 + 0x61;
																					 *_t44 =  *(_t151 + 0x61) - _t111;
																					__eflags =  *_t44;
																					if( *_t44 < 0) {
																						L60:
																						asm("insb");
																						_t171 =  *(_t165 + 0x65) * 0xa642520;
																						__eflags = _t171;
																						L61:
																						_t112 = _t111 & 0x00000a64;
																						_t56 = _t140 + 0x25;
																						 *_t56 =  *(_t140 + 0x25) + _t112;
																						__eflags =  *_t56;
																						if(__eflags < 0) {
																							L66:
																							asm("das");
																							if(__eflags <= 0) {
																								goto L92;
																							} else {
																								if(__eflags < 0) {
																									goto L79;
																								} else {
																									if(__eflags == 0) {
																										goto L96;
																									} else {
																										goto L69;
																									}
																								}
																							}
																						} else {
																							_t140 = _t140 + 1;
																							_t112 = (_t112 & 0x73252064 |  *(_t112 & 0x73252064)) & 0x64252070;
																							_t58 = _t165 + 0x3d;
																							 *_t58 =  *(_t165 + 0x3d) & _t151;
																							__eflags =  *_t58;
																							__eflags = _t112 - 0x20583025;
																							if(__eflags > 0) {
																								L78:
																								if (__eflags < 0) goto L101;
																								L79:
																								asm("popad");
																							} else {
																								L64:
																								_t112 = _t112 & 0x2520646c;
																								__eflags = _t112;
																								if(__eflags >= 0) {
																									L69:
																									if(__eflags < 0) {
																										if(__eflags >= 0) {
																											goto L94;
																										} else {
																											if(__eflags > 0) {
																												goto L104;
																											} else {
																												asm("outsb");
																												if(__eflags < 0) {
																													goto L109;
																												} else {
																													_push(0x64616572);
																													if(__eflags >= 0) {
																														goto L97;
																													} else {
																														if(__eflags >= 0) {
																															_t112 = _t112 - 0x20;
																															__eflags = _t112;
																															goto L111;
																														} else {
																															asm("arpl [edi], bp");
																															if(__eflags < 0) {
																																goto L112;
																															} else {
																																asm("insb");
																																goto L89;
																															}
																														}
																													}
																												}
																											}
																										}
																									} else {
																										asm("bound esi, [ebp+0x69]");
																										asm("insb");
																										asm("das");
																										asm("insd");
																										_t171 =  *(_t165 + 0x67) * 0x36772d77;
																										__eflags = _t171;
																										L71:
																										asm("a16 ja 0x30");
																										if(__eflags > 0) {
																											L89:
																											asm("outsd");
																											asm("arpl [ebx+0x2e], bp");
																											asm("arpl [eax], ax");
																											 *_t112 =  *_t112 + _t149;
																											 *_t112 =  *_t112 - _t149;
																											__eflags =  *_t112;
																											if(__eflags < 0) {
																												goto L114;
																											} else {
																												goto L90;
																											}
																										} else {
																											_t119 = _t112 ^ 0x0000002d;
																											_t61 = _t149 + 0x31;
																											 *_t61 =  *(_t149 + 0x31) ^ _t119;
																											__eflags =  *_t61;
																											_t112 = _t119 ^ 0x6438370d;
																											__eflags =  *_t159 - _t149;
																											L74:
																											asm("insd");
																											_t171 =  *(_t165 + 0x67) * 0x36772d77;
																											__eflags = _t171;
																											L75:
																											if(__eflags > 0) {
																												L90:
																												asm("insb");
																												asm("outsd");
																												asm("arpl [ebx+0x5f], bp");
																												if(__eflags == 0) {
																													goto L98;
																												} else {
																													_t149 = _t149 -  *_t149;
																													_t151 = _t151 -  *((intOrPtr*)(_t151 + 0x77));
																													__eflags = _t151;
																													goto L92;
																												}
																											} else {
																												if(__eflags > 0) {
																													L92:
																													if(__eflags > 0) {
																														L115:
																														if(__eflags >= 0) {
																															 *((intOrPtr*)(_t151 + 0x57)) =  *((intOrPtr*)(_t151 + 0x57)) + _t151;
																															_t184 = _t184 - 1;
																															_t118 = (_t112 & 0x73252064 |  *(_t112 & 0x73252064)) & 0x64252070;
																															__eflags = _t118;
																															 *[fs:esi+0x3d] =  *[fs:esi+0x3d] & _t151;
																															_t112 = _t118 & 0x42205830;
																															_t112 - 0x72206425 = _t112 - 0x20646c25;
																														}
																														 *[fs:edi+0x3d] =  *[fs:edi+0x3d] & _t151;
																														__eflags =  *[fs:edi+0x3d];
																													} else {
																														 *0x6c61763e =  *0x6c61763e - _t171;
																														__eflags =  *0x6c61763e;
																														L94:
																														if(__eflags <= 0) {
																															L113:
																															_t112 = _t112 |  *_t112;
																															__eflags = _t112;
																															_push(_t151);
																															_push(_t159);
																															L114:
																															_t184 = _t184 - 1;
																															_t112 = _t112 & 0x64252070;
																															__eflags = _t112;
																															goto L115;
																														} else {
																															asm("insb");
																															_t184 =  *(_t112 + 0x3d) * 0x494c203d;
																															__eflags = _t184;
																															L96:
																															_t165 =  &(1[_t165]);
																															__eflags = _t165;
																															L97:
																															_t171 =  &(1[_t171]);
																															_pop(_t160);
																															_push(_t151);
																															_push(_t160);
																															_t184 = _t184 - 1;
																															_t159 = _t160 - 1;
																															 *_t112 =  *_t112 - _t184;
																															 *[es:eax] =  *[es:eax] & _t149;
																															__eflags =  *[es:eax];
																															L98:
																															 *[es:eax] =  *[es:eax] & _t149;
																															 *_t112 =  *_t112 - _t149;
																															__eflags =  *_t112;
																															if(__eflags < 0) {
																																_t114 = _t112 & 0x73252070 |  *(_t112 & 0x73252070);
																																__eflags = _t114;
																															} else {
																																asm("insb");
																																asm("outsd");
																																asm("arpl [ebx+0x5f], bp");
																																if(__eflags == 0) {
																																	L108:
																																	asm("popa");
																																	_t171 =  *(_t171 + 0x64) * 0x2528203a;
																																	__eflags = _t171;
																																	L109:
																																	__eflags = _t112 -  *[fs:eax];
																																	 *0x202c2973 =  *0x202c2973 - _t112;
																																	__eflags =  *0x202c2973;
																																} else {
																																	_t149 = _t149 -  *_t149;
																																	_t151 = _t151 -  *((intOrPtr*)(_t151 + 0x77));
																																	asm("insb");
																																	 *0x7375623e =  *0x7375623e - _t171;
																																	__eflags =  *0x7375623e;
																																	asm("bound esi, [ds:ebp+0x73]");
																																	if(__eflags >= 0) {
																																		L111:
																																		__eflags =  *(_t171 + 0x20) * 0x7325;
																																		L112:
																																		_t112 = _t112 - 0x20;
																																		asm("insb");
																																		_t171 =  *(_t165 + 0x65) * 0xa642520;
																																		__eflags = _t171;
																																		goto L113;
																																	} else {
																																		 *[ds:eax] =  *[ds:eax] & _t151;
																																		 *_t112 =  *_t112 - _t112;
																																		__eflags =  *_t112;
																																		 *_t112 =  *_t112 + _t112;
																																		 *_t112 =  *_t112 + _t112;
																																		_t149 =  &(1[_t149]);
																																		__eflags = _t149;
																																		L104:
																																		if(__eflags >= 0) {
																																			_t159[0x1b] = _t159[0x1b] & _t149;
																																			asm("arpl [ebp+0x20], sp");
																																			goto L127;
																																		} else {
																																			if (__eflags < 0) goto L127;
																																			if(__eflags < 0) {
																																				L127:
																																				 *[gs:0x73692070] =  *[gs:0x73692070] & _t112;
																																				 *0xa64 =  *0xa64 & _t112;
																																				_t78 = _t171 + 0x72;
																																				 *_t78 =  *(_t171 + 0x72) + _t112;
																																				__eflags =  *_t78;
																																				if (__eflags < 0) goto L141;
																																				asm("outsd");
																																			} else {
																																				_t171 = _t159[0x1b] * 0x69616620;
																																				__eflags = _t171;
																																				goto L108;
																																			}
																																		}
																																	}
																																}
																															}
																														}
																													}
																												} else {
																													_t112 = _t112 ^ 0x0000002d;
																													asm("insb");
																													_t184 =  *(_t151 + 0x72) * 0x65697261;
																													__eflags = _t184;
																													goto L78;
																												}
																											}
																										}
																									}
																								} else {
																									L65:
																									 *_t112 =  *_t112 + _t112;
																									 *_t159 =  *_t159 + _t149;
																									__eflags =  *_t159;
																									goto L66;
																								}
																							}
																						}
																					} else {
																						_t184 =  *(_t171 + 0x72) * 0x2a20745f;
																						 *_t151 =  *_t151 - _t171;
																						__eflags =  *_t151;
																						goto L39;
																					}
																				}
																			}
																		}
																	}
																}
															}
														}
													} else {
														asm("bound esi, [ebp+0x69]");
														asm("insb");
														asm("das");
														asm("insd");
														_t123 = _t111 ^ 0x0000002d;
														 *(_t149 + 0x31) =  *(_t149 + 0x31) ^ _t123;
														__eflags =  *_t159 - _t149;
														asm("insd");
														_t171 =  *(_t165 + 0x67) * 0x36772d77;
														_t112 = _t123 ^ 0x64383720;
														asm("insb");
														_t184 =  *(_t151 + 0x72) * 0x65697261;
														__eflags = _t184;
														goto L28;
													}
												}
											}
										}
									} else {
										 *_t184 =  *(_t165 + 0x14);
										_t127 = GetThreadPriority(??);
										 *(_t165 + 0x68) = 0;
										 *(_t165 + 0x6c) = _t127;
										_t185 = _t184 - 4;
										 *(_t165 + 0x20) =  *(_t165 + 0x20) & 0xcf | 0x00000010;
										 *(_t185 + 4) = _t165;
										 *_t185 =  *0x6dd6a020;
										_t132 = TlsSetValue(??, ??);
										_t184 = _t185 - 8;
										__eflags = _t132;
										if(_t132 == 0) {
											goto L20;
										} else {
											return _t165;
										}
									}
								}
							}
						} else {
							L14:
							return _t138;
						}
					} else {
						 *_t136 = 0xffffffff;
						return _t89;
					}
				}
			}

0x6dd64a22
0x6dd64a50
0x6dd64a24
0x6dd64a27
0x6dd64a29
0x6dd64a2c
0x6dd64a2f
0x6dd64a37
0x6dd64a51
0x6dd64a57
0x6dd64a63
0x6dd64a63
0x6dd64a65
0x6dd64a6e
0x6dd64a6e
0x6dd64a6e
0x6dd64a6e
0x6dd64a70
0x6dd64a76
0x6dd64a7a
0x6dd64a82
0x6dd64a86
0x6dd64a89
0x6dd64a8f
0x6dd64a94
0x6dd64a99
0x6dd64aa5
0x6dd64aa5
0x6dd64aa8
0x6dd64aac
0x00000000
0x00000000
0x6dd64aa0
0x6dd64aa3
0x00000000
0x00000000
0x00000000
0x6dd64aa3
0x6dd64aae
0x6dd64ab1
0x00000000
0x00000000
0x6dd64a9b
0x6dd64ab3
0x6dd64ab3
0x6dd64ab8
0x6dd64ab8
0x6dd64abd
0x6dd64abd
0x6dd64ac0
0x6dd64ac6
0x6dd64ac7
0x6dd64ad0
0x6dd64ad1
0x6dd64ad2
0x6dd64ad3
0x6dd64ad4
0x6dd64ad7
0x6dd64ade
0x6dd64ae0
0x6dd64ae0
0x6dd64aea
0x6dd64aed
0x6dd64af3
0x6dd64af6
0x6dd64af8
0x6dd64afa
0x6dd64b15
0x6dd64b1c
0x6dd64b1e
0x00000000
0x6dd64b20
0x6dd64b20
0x6dd64b22
0x00000000
0x6dd64b24
0x6dd64b24
0x6dd64b31
0x6dd64b34
0x6dd64b3c
0x6dd64b44
0x6dd64b4c
0x6dd64b53
0x6dd64b59
0x6dd64b60
0x6dd64b63
0x6dd64b66
0x6dd64b69
0x6dd64b6e
0x6dd64b74
0x6dd64b7b
0x6dd64b84
0x6dd64b8c
0x6dd64b8e
0x6dd64b90
0x6dd64b90
0x6dd64b93
0x6dd64b97
0x6dd64b9f
0x6dd64ba7
0x6dd64baf
0x6dd64bb3
0x6dd64bb7
0x6dd64bba
0x6dd64bc0
0x6dd64bc3
0x6dd64bc5
0x6dd695c5
0x6dd695c5
0x6dd695cf
0x6dd695d5
0x6dd695da
0x6dd695dc
0x6dd695e0
0x6dd695e5
0x6dd695e8
0x6dd695ea
0x6dd695ec
0x6dd695ee
0x6dd695f0
0x6dd695f2
0x6dd695f4
0x6dd695f6
0x6dd695f8
0x6dd695fa
0x6dd695fc
0x6dd695fe
0x6dd69600
0x6dd69602
0x6dd69604
0x6dd69606
0x6dd69608
0x6dd6960a
0x6dd6960c
0x6dd6960e
0x6dd69610
0x6dd69612
0x6dd69614
0x6dd69616
0x6dd69618
0x6dd6961a
0x6dd6961c
0x6dd6961e
0x6dd69620
0x6dd69622
0x6dd69624
0x6dd69626
0x6dd69628
0x6dd6962a
0x6dd6962c
0x6dd6962e
0x6dd69630
0x6dd69632
0x6dd69634
0x6dd69636
0x6dd69638
0x6dd6963a
0x6dd6963c
0x6dd6963e
0x6dd69640
0x6dd69642
0x6dd69644
0x6dd69646
0x6dd69648
0x6dd6964a
0x6dd6964c
0x6dd6964e
0x6dd69650
0x6dd69652
0x6dd69654
0x6dd69656
0x6dd69658
0x6dd6965a
0x6dd6965c
0x6dd6965e
0x6dd69660
0x6dd69662
0x6dd69664
0x6dd69666
0x6dd69668
0x6dd6966a
0x6dd6966c
0x6dd6966e
0x6dd69670
0x6dd69672
0x6dd69674
0x6dd69676
0x6dd69678
0x6dd6967a
0x6dd6967c
0x6dd6967e
0x6dd69680
0x6dd69682
0x6dd69684
0x6dd69686
0x6dd69688
0x6dd6968a
0x6dd6968c
0x6dd6968e
0x6dd69690
0x6dd69692
0x6dd69694
0x6dd69696
0x6dd69698
0x6dd6969a
0x6dd6969c
0x6dd6969e
0x6dd696a0
0x6dd696a2
0x6dd696a4
0x6dd696a6
0x6dd696a8
0x6dd696aa
0x6dd696ac
0x6dd696ae
0x6dd696b0
0x6dd696b2
0x6dd696b4
0x6dd696b6
0x6dd696b8
0x6dd696ba
0x6dd696bc
0x6dd696be
0x6dd696c0
0x6dd696c2
0x6dd696c4
0x6dd696c6
0x6dd696c8
0x6dd696ca
0x6dd696cc
0x6dd696ce
0x6dd696d0
0x6dd696d2
0x6dd696d4
0x6dd696d6
0x6dd696d8
0x6dd696da
0x6dd696dc
0x6dd696de
0x6dd696e0
0x6dd696e2
0x6dd696e4
0x6dd696e6
0x6dd696e8
0x6dd696ea
0x6dd696ec
0x6dd696ee
0x6dd696f0
0x6dd696f2
0x6dd696f4
0x6dd696f6
0x6dd696f8
0x6dd696fa
0x6dd696fc
0x6dd696fe
0x6dd69700
0x6dd69702
0x6dd69704
0x6dd69706
0x6dd69708
0x6dd6970a
0x6dd6970c
0x6dd6970e
0x6dd69710
0x6dd69712
0x6dd69714
0x6dd69716
0x6dd69718
0x6dd6971a
0x6dd6971c
0x6dd6971e
0x6dd69720
0x6dd69722
0x6dd69724
0x6dd69726
0x6dd69728
0x6dd6972a
0x6dd6972c
0x6dd6972e
0x6dd69730
0x6dd69732
0x6dd69734
0x6dd69736
0x6dd69738
0x6dd6973a
0x6dd6973c
0x6dd6973e
0x6dd69740
0x6dd69742
0x6dd69744
0x6dd69746
0x6dd69748
0x6dd6974a
0x6dd6974c
0x6dd6974e
0x6dd69750
0x6dd69752
0x6dd69754
0x6dd69756
0x6dd69758
0x6dd6975a
0x6dd6975c
0x6dd6975e
0x6dd69760
0x6dd69762
0x6dd69764
0x6dd69766
0x6dd69768
0x6dd6976a
0x6dd6976c
0x6dd6976e
0x6dd69770
0x6dd69772
0x6dd69774
0x6dd69776
0x6dd69778
0x6dd6977a
0x6dd6977c
0x6dd6977e
0x6dd69780
0x6dd69782
0x6dd69784
0x6dd69786
0x6dd69788
0x6dd6978a
0x6dd6978c
0x6dd6978e
0x6dd69790
0x6dd69792
0x6dd69794
0x6dd69796
0x6dd69798
0x6dd6979a
0x6dd6979c
0x6dd6979e
0x6dd697a0
0x6dd697a2
0x6dd697a4
0x6dd697a6
0x6dd697a8
0x6dd697aa
0x6dd697ac
0x6dd697ae
0x6dd697b0
0x6dd697b2
0x6dd697b4
0x6dd697b6
0x6dd697b8
0x6dd697ba
0x6dd697bc
0x6dd697be
0x6dd697c0
0x6dd697c2
0x6dd697c4
0x6dd697c6
0x6dd697c8
0x6dd697ca
0x6dd697cc
0x6dd697ce
0x6dd697d0
0x6dd697d2
0x6dd697d4
0x6dd697d6
0x6dd697d8
0x6dd697da
0x6dd697dc
0x6dd697de
0x6dd697e0
0x6dd697e2
0x6dd697e4
0x6dd697e6
0x6dd697e8
0x6dd697ea
0x6dd697ec
0x6dd697ee
0x6dd697f0
0x6dd697f2
0x6dd697f4
0x6dd697f6
0x6dd697f8
0x6dd697fa
0x6dd697fc
0x6dd697fe
0x6dd69800
0x6dd69802
0x6dd69804
0x6dd69806
0x6dd69808
0x6dd6980a
0x6dd6980c
0x6dd6980e
0x6dd69810
0x6dd69812
0x6dd69814
0x6dd69816
0x6dd69818
0x6dd6981a
0x6dd6981c
0x6dd6981e
0x6dd69820
0x6dd69822
0x6dd69824
0x6dd69826
0x6dd69828
0x6dd6982a
0x6dd6982c
0x6dd6982e
0x6dd69830
0x6dd69832
0x6dd69834
0x6dd69836
0x6dd69838
0x6dd6983a
0x6dd6983c
0x6dd6983e
0x6dd69840
0x6dd69842
0x6dd69844
0x6dd69846
0x6dd69848
0x6dd6984a
0x6dd6984c
0x6dd6984e
0x6dd69850
0x6dd69852
0x6dd69854
0x6dd69856
0x6dd69858
0x6dd6985a
0x6dd6985c
0x6dd6985e
0x6dd69860
0x6dd69862
0x6dd69864
0x6dd69866
0x6dd69868
0x6dd6986a
0x6dd6986c
0x6dd6986e
0x6dd69870
0x6dd69872
0x6dd69874
0x6dd69876
0x6dd69878
0x6dd6987a
0x6dd6987c
0x6dd6987e
0x6dd69880
0x6dd69882
0x6dd69884
0x6dd69886
0x6dd69888
0x6dd6988a
0x6dd6988c
0x6dd6988e
0x6dd69890
0x6dd69892
0x6dd69894
0x6dd69896
0x6dd69898
0x6dd6989a
0x6dd6989c
0x6dd6989e
0x6dd698a0
0x6dd698a2
0x6dd698a4
0x6dd698a6
0x6dd698a8
0x6dd698aa
0x6dd698ac
0x6dd698ae
0x6dd698b0
0x6dd698b2
0x6dd698b4
0x6dd698b6
0x6dd698b8
0x6dd698ba
0x6dd698bc
0x6dd698be
0x6dd698c0
0x6dd698c2
0x6dd698c4
0x6dd698c6
0x6dd698c8
0x6dd698ca
0x6dd698cc
0x6dd698ce
0x6dd698d0
0x6dd698d2
0x6dd698d4
0x6dd698d6
0x6dd698d8
0x6dd698da
0x6dd698dc
0x6dd698de
0x6dd698e0
0x6dd698e2
0x6dd698e4
0x6dd698e6
0x6dd698e8
0x6dd698ea
0x6dd698ec
0x6dd698ee
0x6dd698f0
0x6dd698f2
0x6dd698f4
0x6dd698f6
0x6dd698f8
0x6dd698fa
0x6dd698fc
0x6dd698fe
0x6dd69900
0x6dd69902
0x6dd69904
0x6dd69906
0x6dd69908
0x6dd6990a
0x6dd6990c
0x6dd6990e
0x6dd69910
0x6dd69912
0x6dd69914
0x6dd69916
0x6dd69918
0x6dd6991a
0x6dd6991c
0x6dd6991e
0x6dd69920
0x6dd69922
0x6dd69924
0x6dd69926
0x6dd69928
0x6dd6992a
0x6dd6992c
0x6dd6992e
0x6dd69930
0x6dd69932
0x6dd69934
0x6dd69936
0x6dd69938
0x6dd6993a
0x6dd6993c
0x6dd6993e
0x6dd69940
0x6dd69942
0x6dd69944
0x6dd69946
0x6dd69948
0x6dd6994a
0x6dd6994c
0x6dd6994e
0x6dd69950
0x6dd69952
0x6dd69954
0x6dd69956
0x6dd69958
0x6dd6995a
0x6dd6995c
0x6dd6995e
0x6dd69960
0x6dd69962
0x6dd69964
0x6dd69966
0x6dd69968
0x6dd6996a
0x6dd6996c
0x6dd6996e
0x6dd69970
0x6dd69972
0x6dd69974
0x6dd69976
0x6dd69978
0x6dd6997a
0x6dd6997c
0x6dd6997e
0x6dd69980
0x6dd69982
0x6dd69984
0x6dd69986
0x6dd69988
0x6dd6998a
0x6dd6998c
0x6dd6998e
0x6dd69990
0x6dd69992
0x6dd69994
0x6dd69996
0x6dd69998
0x6dd6999a
0x6dd6999c
0x6dd6999e
0x6dd699a0
0x6dd699a2
0x6dd699a4
0x6dd699a6
0x6dd699a8
0x6dd699aa
0x6dd699ac
0x6dd699ae
0x6dd699b0
0x6dd699b2
0x6dd699b4
0x6dd699b6
0x6dd699b8
0x6dd699ba
0x6dd699bc
0x6dd699be
0x6dd699c0
0x6dd699c2
0x6dd699c4
0x6dd699c6
0x6dd699c8
0x6dd699ca
0x6dd699cc
0x6dd699ce
0x6dd699d0
0x6dd699d2
0x6dd699d4
0x6dd699d6
0x6dd699d8
0x6dd699da
0x6dd699dc
0x6dd699de
0x6dd699e0
0x6dd699e2
0x6dd699e4
0x6dd699e6
0x6dd699e8
0x6dd699ea
0x6dd699ec
0x6dd699ee
0x6dd699f0
0x6dd699f2
0x6dd699f4
0x6dd699f6
0x6dd699f8
0x6dd699fa
0x6dd699fc
0x6dd699fe
0x6dd69a00
0x6dd69a02
0x6dd69a04
0x6dd69a06
0x6dd69a08
0x6dd69a0a
0x6dd69a0c
0x6dd69a0e
0x6dd69a10
0x6dd69a12
0x6dd69a14
0x6dd69a16
0x6dd69a18
0x6dd69a1a
0x6dd69a1c
0x6dd69a1e
0x6dd69a20
0x6dd69a22
0x6dd69a24
0x6dd69a26
0x6dd69a28
0x6dd69a2a
0x6dd69a2c
0x6dd69a2e
0x6dd69a30
0x6dd69a32
0x6dd69a34
0x6dd69a36
0x6dd69a38
0x6dd69a3a
0x6dd69a3c
0x6dd69a3e
0x6dd69a40
0x6dd69a42
0x6dd69a44
0x6dd69a46
0x6dd69a48
0x6dd69a4a
0x6dd69a4c
0x6dd69a4e
0x6dd69a50
0x6dd69a52
0x6dd69a54
0x6dd69a56
0x6dd69a58
0x6dd69a5a
0x6dd69a5c
0x6dd69a5e
0x6dd69a60
0x6dd69a62
0x6dd69a64
0x6dd69a66
0x6dd69a68
0x6dd69a6a
0x6dd69a6c
0x6dd69a6e
0x6dd69a70
0x6dd69a72
0x6dd69a74
0x6dd69a76
0x6dd69a78
0x6dd69a7a
0x6dd69a7c
0x6dd69a7e
0x6dd69a80
0x6dd69a82
0x6dd69a84
0x6dd69a86
0x6dd69a88
0x6dd69a8a
0x6dd69a8c
0x6dd69a8e
0x6dd69a90
0x6dd69a92
0x6dd69a94
0x6dd69a96
0x6dd69a98
0x6dd69a9a
0x6dd69a9c
0x6dd69a9e
0x6dd69aa0
0x6dd69aa2
0x6dd69aa4
0x6dd69aa6
0x6dd69aa8
0x6dd69aaa
0x6dd69aac
0x6dd69aae
0x6dd69ab0
0x6dd69ab2
0x6dd69ab4
0x6dd69ab6
0x6dd69ab8
0x6dd69aba
0x6dd69abc
0x6dd69abe
0x6dd69ac0
0x6dd69ac2
0x6dd69ac4
0x6dd69ac6
0x6dd69ac8
0x6dd69aca
0x6dd69acc
0x6dd69ace
0x6dd69ad0
0x6dd69ad2
0x6dd69ad4
0x6dd69ad6
0x6dd69ad8
0x6dd69ada
0x6dd69adc
0x6dd69ade
0x6dd69ae0
0x6dd69ae2
0x6dd69ae4
0x6dd69ae6
0x6dd69ae8
0x6dd69aea
0x6dd69aec
0x6dd69aee
0x6dd69af0
0x6dd69af2
0x6dd69af4
0x6dd69af6
0x6dd69af8
0x6dd69afa
0x6dd69afc
0x6dd69afe
0x6dd69b00
0x6dd69b02
0x6dd69b04
0x6dd69b06
0x6dd69b08
0x6dd69b0a
0x6dd69b0c
0x6dd69b0e
0x6dd69b10
0x6dd69b12
0x6dd69b14
0x6dd69b16
0x6dd69b18
0x6dd69b1a
0x6dd69b1c
0x6dd69b1e
0x6dd69b20
0x6dd69b22
0x6dd69b24
0x6dd69b26
0x6dd69b28
0x6dd69b2a
0x6dd69b2c
0x6dd69b2e
0x6dd69b30
0x6dd69b32
0x6dd69b34
0x6dd69b36
0x6dd69b38
0x6dd69b3a
0x6dd69b3c
0x6dd69b3e
0x6dd69b40
0x6dd69b42
0x6dd69b44
0x6dd69b46
0x6dd69b48
0x6dd69b4a
0x6dd69b4c
0x6dd69b4e
0x6dd69b50
0x6dd69b52
0x6dd69b54
0x6dd69b56
0x6dd69b58
0x6dd69b5a
0x6dd69b5c
0x6dd69b5e
0x6dd69b60
0x6dd69b62
0x6dd69b64
0x6dd69b66
0x6dd69b68
0x6dd69b6a
0x6dd69b6c
0x6dd69b6e
0x6dd69b70
0x6dd69b72
0x6dd69b74
0x6dd69b76
0x6dd69b78
0x6dd69b7a
0x6dd69b7c
0x6dd69b7e
0x6dd69b80
0x6dd69b82
0x6dd69b84
0x6dd69b86
0x6dd69b88
0x6dd69b8a
0x6dd69b8c
0x6dd69b8e
0x6dd69b90
0x6dd69b92
0x6dd69b94
0x6dd69b96
0x6dd69b98
0x6dd69b9a
0x6dd69b9c
0x6dd69b9e
0x6dd69ba0
0x6dd69ba2
0x6dd69ba4
0x6dd69ba6
0x6dd69ba8
0x6dd69baa
0x6dd69bac
0x6dd69bae
0x6dd69bb0
0x6dd69bb2
0x6dd69bb4
0x6dd69bb6
0x6dd69bb8
0x6dd69bba
0x6dd69bbc
0x6dd69bbe
0x6dd69bc0
0x6dd69bc2
0x6dd69bc4
0x6dd69bc6
0x6dd69bc8
0x6dd69bca
0x6dd69bcc
0x6dd69bce
0x6dd69bd0
0x6dd69bd2
0x6dd69bd4
0x6dd69bd6
0x6dd69bd8
0x6dd69bda
0x6dd69bdc
0x6dd69bde
0x6dd69be0
0x6dd69be2
0x6dd69be4
0x6dd69be6
0x6dd69be8
0x6dd69bea
0x6dd69bec
0x6dd69bee
0x6dd69bf0
0x6dd69bf2
0x6dd69bf4
0x6dd69bf6
0x6dd69bf8
0x6dd69bfa
0x6dd69bfc
0x6dd69bfe
0x6dd69c00
0x6dd69c02
0x6dd69c04
0x6dd69c06
0x6dd69c08
0x6dd69c0a
0x6dd69c0c
0x6dd69c0e
0x6dd69c10
0x6dd69c12
0x6dd69c14
0x6dd69c16
0x6dd69c18
0x6dd69c1a
0x6dd69c1c
0x6dd69c1e
0x6dd69c20
0x6dd69c22
0x6dd69c24
0x6dd69c26
0x6dd69c28
0x6dd69c2a
0x6dd69c2c
0x6dd69c2e
0x6dd69c30
0x6dd69c32
0x6dd69c34
0x6dd69c36
0x6dd69c38
0x6dd69c3a
0x6dd69c3c
0x6dd69c3e
0x6dd69c40
0x6dd69c42
0x6dd69c44
0x6dd69c46
0x6dd69c48
0x6dd69c4a
0x6dd69c4c
0x6dd69c4e
0x6dd69c50
0x6dd69c52
0x6dd69c54
0x6dd69c56
0x6dd69c58
0x6dd69c5a
0x6dd69c5c
0x6dd69c5e
0x6dd69c60
0x6dd69c62
0x6dd69c64
0x6dd69c66
0x6dd69c68
0x6dd69c6a
0x6dd69c6c
0x6dd69c6e
0x6dd69c70
0x6dd69c72
0x6dd69c74
0x6dd69c76
0x6dd69c78
0x6dd69c7a
0x6dd69c7c
0x6dd69c7e
0x6dd69c80
0x6dd69c82
0x6dd69c84
0x6dd69c86
0x6dd69c88
0x6dd69c8a
0x6dd69c8c
0x6dd69c8e
0x6dd69c90
0x6dd69c92
0x6dd69c94
0x6dd69c96
0x6dd69c98
0x6dd69c9a
0x6dd69c9c
0x6dd69c9e
0x6dd69ca0
0x6dd69ca2
0x6dd69ca4
0x6dd69ca6
0x6dd69ca8
0x6dd69caa
0x6dd69cac
0x6dd69cae
0x6dd69cb0
0x6dd69cb2
0x6dd69cb4
0x6dd69cb6
0x6dd69cb8
0x6dd69cba
0x6dd69cbc
0x6dd69cbe
0x6dd69cc0
0x6dd69cc2
0x6dd69cc4
0x6dd69cc6
0x6dd69cc8
0x6dd69cca
0x6dd69ccc
0x6dd69cce
0x6dd69cd0
0x6dd69cd2
0x6dd69cd4
0x6dd69cd6
0x6dd69cd8
0x6dd69cda
0x6dd69cdc
0x6dd69cde
0x6dd69ce0
0x6dd69ce2
0x6dd69ce4
0x6dd69ce6
0x6dd69ce8
0x6dd69cea
0x6dd69cec
0x6dd69cee
0x6dd69cf0
0x6dd69cf2
0x6dd69cf4
0x6dd69cf6
0x6dd69cf8
0x6dd69cfa
0x6dd69cfc
0x6dd69cfe
0x6dd69d00
0x6dd69d02
0x6dd69d04
0x6dd69d06
0x6dd69d08
0x6dd69d0a
0x6dd69d0c
0x6dd69d0e
0x6dd69d10
0x6dd69d12
0x6dd69d14
0x6dd69d16
0x6dd69d18
0x6dd69d1a
0x6dd69d1c
0x6dd69d1e
0x6dd69d20
0x6dd69d22
0x6dd69d24
0x6dd69d26
0x6dd69d28
0x6dd69d2a
0x6dd69d2c
0x6dd69d2e
0x6dd69d30
0x6dd69d32
0x6dd69d34
0x6dd69d36
0x6dd69d38
0x6dd69d3a
0x6dd69d3c
0x6dd69d3e
0x6dd69d40
0x6dd69d42
0x6dd69d44
0x6dd69d46
0x6dd69d48
0x6dd69d4a
0x6dd69d4c
0x6dd69d4e
0x6dd69d50
0x6dd69d52
0x6dd69d54
0x6dd69d56
0x6dd69d58
0x6dd69d5a
0x6dd69d5c
0x6dd69d5e
0x6dd69d60
0x6dd69d62
0x6dd69d64
0x6dd69d66
0x6dd69d68
0x6dd69d6a
0x6dd69d6c
0x6dd69d6e
0x6dd69d70
0x6dd69d72
0x6dd69d74
0x6dd69d76
0x6dd69d78
0x6dd69d7a
0x6dd69d7c
0x6dd69d7e
0x6dd69d80
0x6dd69d82
0x6dd69d84
0x6dd69d86
0x6dd69d88
0x6dd69d8a
0x6dd69d8c
0x6dd69d8e
0x6dd69d90
0x6dd69d92
0x6dd69d94
0x6dd69d96
0x6dd69d98
0x6dd69d9a
0x6dd69d9c
0x6dd69d9e
0x6dd69da0
0x6dd69da2
0x6dd69da4
0x6dd69da6
0x6dd69da8
0x6dd69daa
0x6dd69dac
0x6dd69dae
0x6dd69db0
0x6dd69db2
0x6dd69db4
0x6dd69db6
0x6dd69db8
0x6dd69dba
0x6dd69dbc
0x6dd69dbe
0x6dd69dc0
0x6dd69dc2
0x6dd69dc4
0x6dd69dc6
0x6dd69dc8
0x6dd69dca
0x6dd69dcc
0x6dd69dce
0x6dd69dd0
0x6dd69dd2
0x6dd69dd4
0x6dd69dd6
0x6dd69dd8
0x6dd69dda
0x6dd69ddc
0x6dd69dde
0x6dd69de0
0x6dd69de2
0x6dd69de4
0x6dd69de6
0x6dd69de8
0x6dd69dea
0x6dd69dec
0x6dd69dee
0x6dd69df0
0x6dd69df2
0x6dd69df4
0x6dd69df6
0x6dd69df8
0x6dd69dfa
0x6dd69dfc
0x6dd69dfe
0x6dd69e00
0x6dd69e02
0x6dd69e04
0x6dd69e06
0x6dd69e08
0x6dd69e0a
0x6dd69e0c
0x6dd69e0e
0x6dd69e10
0x6dd69e12
0x6dd69e14
0x6dd69e16
0x6dd69e18
0x6dd69e1a
0x6dd69e1c
0x6dd69e1e
0x6dd69e20
0x6dd69e22
0x6dd69e24
0x6dd69e26
0x6dd69e28
0x6dd69e2a
0x6dd69e2c
0x6dd69e2e
0x6dd69e30
0x6dd69e32
0x6dd69e34
0x6dd69e36
0x6dd69e38
0x6dd69e3a
0x6dd69e3c
0x6dd69e3e
0x6dd69e40
0x6dd69e42
0x6dd69e44
0x6dd69e46
0x6dd69e48
0x6dd69e4a
0x6dd69e4c
0x6dd69e4e
0x6dd69e50
0x6dd69e52
0x6dd69e54
0x6dd69e56
0x6dd69e58
0x6dd69e5a
0x6dd69e5c
0x6dd69e5e
0x6dd69e60
0x6dd69e62
0x6dd69e64
0x6dd69e66
0x6dd69e68
0x6dd69e6a
0x6dd69e6c
0x6dd69e6e
0x6dd69e70
0x6dd69e72
0x6dd69e74
0x6dd69e76
0x6dd69e78
0x6dd69e7a
0x6dd69e7c
0x6dd69e7e
0x6dd69e80
0x6dd69e82
0x6dd69e84
0x6dd69e86
0x6dd69e88
0x6dd69e8a
0x6dd69e8c
0x6dd69e8e
0x6dd69e90
0x6dd69e92
0x6dd69e94
0x6dd69e96
0x6dd69e98
0x6dd69e9a
0x6dd69e9c
0x6dd69e9e
0x6dd69ea0
0x6dd69ea2
0x6dd69ea4
0x6dd69ea6
0x6dd69ea8
0x6dd69eaa
0x6dd69eac
0x6dd69eae
0x6dd69eb0
0x6dd69eb2
0x6dd69eb4
0x6dd69eb6
0x6dd69eb8
0x6dd69eba
0x6dd69ebc
0x6dd69ebe
0x6dd69ec0
0x6dd69ec2
0x6dd69ec4
0x6dd69ec6
0x6dd69ec8
0x6dd69eca
0x6dd69ecc
0x6dd69ece
0x6dd69ed0
0x6dd69ed2
0x6dd69ed4
0x6dd69ed6
0x6dd69ed8
0x6dd69eda
0x6dd69edc
0x6dd69ede
0x6dd69ee0
0x6dd69ee2
0x6dd69ee4
0x6dd69ee6
0x6dd69ee8
0x6dd69eea
0x6dd69eec
0x6dd69eee
0x6dd69ef0
0x6dd69ef2
0x6dd69ef4
0x6dd69ef6
0x6dd69ef8
0x6dd69efa
0x6dd69efc
0x6dd69efe
0x6dd69f00
0x6dd69f02
0x6dd69f04
0x6dd69f06
0x6dd69f08
0x6dd69f0a
0x6dd69f0c
0x6dd69f0e
0x6dd69f10
0x6dd69f12
0x6dd69f14
0x6dd69f16
0x6dd69f18
0x6dd69f1a
0x6dd69f1c
0x6dd69f1e
0x6dd69f20
0x6dd69f22
0x6dd69f24
0x6dd69f26
0x6dd69f28
0x6dd69f2a
0x6dd69f2c
0x6dd69f2e
0x6dd69f30
0x6dd69f32
0x6dd69f34
0x6dd69f36
0x6dd69f38
0x6dd69f3a
0x6dd69f3c
0x6dd69f3e
0x6dd69f40
0x6dd69f42
0x6dd69f44
0x6dd69f46
0x6dd69f48
0x6dd69f4a
0x6dd69f4c
0x6dd69f4e
0x6dd69f50
0x6dd69f52
0x6dd69f54
0x6dd69f56
0x6dd69f58
0x6dd69f5a
0x6dd69f5c
0x6dd69f5e
0x6dd69f60
0x6dd69f62
0x6dd69f64
0x6dd69f66
0x6dd69f68
0x6dd69f6a
0x6dd69f6c
0x6dd69f6e
0x6dd69f70
0x6dd69f72
0x6dd69f74
0x6dd69f76
0x6dd69f78
0x6dd69f7a
0x6dd69f7c
0x6dd69f7e
0x6dd69f80
0x6dd69f82
0x6dd69f84
0x6dd69f86
0x6dd69f88
0x6dd69f8a
0x6dd69f8c
0x6dd69f8e
0x6dd69f90
0x6dd69f92
0x6dd69f94
0x6dd69f96
0x6dd69f98
0x6dd69f9a
0x6dd69f9c
0x6dd69f9e
0x6dd69fa0
0x6dd69fa2
0x6dd69fa4
0x6dd69fa6
0x6dd69fa8
0x6dd69faa
0x6dd69fac
0x6dd69fae
0x6dd69fb0
0x6dd69fb2
0x6dd69fb4
0x6dd69fb6
0x6dd69fb8
0x6dd69fba
0x6dd69fbc
0x6dd69fbe
0x6dd69fc0
0x6dd69fc2
0x6dd69fc4
0x6dd69fc6
0x6dd69fc8
0x6dd69fca
0x6dd69fcc
0x6dd69fce
0x6dd69fd0
0x6dd69fd2
0x6dd69fd4
0x6dd69fd6
0x6dd69fd8
0x6dd69fda
0x6dd69fdc
0x6dd69fde
0x6dd69fe0
0x6dd69fe2
0x6dd69fe4
0x6dd69fe6
0x6dd69fe8
0x6dd69fea
0x6dd69fec
0x6dd69fee
0x6dd69ff0
0x6dd69ff2
0x6dd69ff4
0x6dd69ff6
0x6dd69ff8
0x6dd69ffa
0x6dd69ffc
0x6dd69ffe
0x6dd6a000
0x6dd6a002
0x6dd6a004
0x6dd6a006
0x6dd6a008
0x6dd6a00a
0x6dd6a00c
0x6dd6a00e
0x6dd6a010
0x6dd6a012
0x6dd6a014
0x6dd6a016
0x6dd6a018
0x6dd6a01a
0x6dd6a01c
0x6dd6a01e
0x6dd6a020
0x6dd6a022
0x6dd6a024
0x6dd6a026
0x6dd6a028
0x6dd6a02a
0x6dd6a02c
0x6dd6a02e
0x6dd6a030
0x6dd6a032
0x6dd6a034
0x6dd6a036
0x6dd6a038
0x6dd6a03a
0x6dd6a03c
0x6dd6a03e
0x6dd6a040
0x6dd6a042
0x6dd6a044
0x6dd6a046
0x6dd6a048
0x6dd6a04a
0x6dd6a04c
0x6dd6a04e
0x6dd6a050
0x6dd6a052
0x6dd6a054
0x6dd6a056
0x6dd6a058
0x6dd6a05a
0x6dd6a05c
0x6dd6a05e
0x6dd6a060
0x6dd6a062
0x6dd6a064
0x6dd6a066
0x6dd6a068
0x6dd6a06a
0x6dd6a06c
0x6dd6a06e
0x6dd6a070
0x6dd6a072
0x6dd6a074
0x6dd6a076
0x6dd6a078
0x6dd6a07a
0x6dd6a07c
0x6dd6a07e
0x6dd6a080
0x6dd6a082
0x6dd6a084
0x6dd6a086
0x6dd6a088
0x6dd6a08a
0x6dd6a08c
0x6dd6a08e
0x6dd6a090
0x6dd6a092
0x6dd6a094
0x6dd6a096
0x6dd6a098
0x6dd6a09a
0x6dd6a09c
0x6dd6a09e
0x6dd6a0a0
0x6dd6a0a2
0x6dd6a0a4
0x6dd6a0a6
0x6dd6a0a8
0x6dd6a0aa
0x6dd6a0ac
0x6dd6a0ae
0x6dd6a0b0
0x6dd6a0b2
0x6dd6a0b4
0x6dd6a0b6
0x6dd6a0b8
0x6dd6a0ba
0x6dd6a0bc
0x6dd6a0be
0x6dd6a0c0
0x6dd6a0c2
0x6dd6a0c4
0x6dd6a0c6
0x6dd6a0c8
0x6dd6a0ca
0x6dd6a0cc
0x6dd6a0ce
0x6dd6a0d0
0x6dd6a0d2
0x6dd6a0d4
0x6dd6a0d6
0x6dd6a0d8
0x6dd6a0da
0x6dd6a0dc
0x6dd6a0de
0x6dd6a0e0
0x6dd6a0e2
0x6dd6a0e4
0x6dd6a0e6
0x6dd6a0e8
0x6dd6a0ea
0x6dd6a0ec
0x6dd6a0ee
0x6dd6a0f0
0x6dd6a0f2
0x6dd6a0f4
0x6dd6a0f6
0x6dd6a0f8
0x6dd6a0fa
0x6dd6a0fc
0x6dd6a0fe
0x6dd6a100
0x6dd6a102
0x6dd6a104
0x6dd6a106
0x6dd6a108
0x6dd6a10a
0x6dd6a10c
0x6dd6a10e
0x6dd6a110
0x6dd6a112
0x6dd6a114
0x6dd6a116
0x6dd6a118
0x6dd6a11a
0x6dd6a11c
0x6dd6a11e
0x6dd6a120
0x6dd6a122
0x6dd6a124
0x6dd6a126
0x6dd6a128
0x6dd6a12a
0x6dd6a12c
0x6dd6a12e
0x6dd6a130
0x6dd6a132
0x6dd6a134
0x6dd6a136
0x6dd6a138
0x6dd6a13a
0x6dd6a13c
0x6dd6a13e
0x6dd6a140
0x6dd6a142
0x6dd6a144
0x6dd6a146
0x6dd6a148
0x6dd6a14a
0x6dd6a14c
0x6dd6a14e
0x6dd6a150
0x6dd6a152
0x6dd6a154
0x6dd6a156
0x6dd6a158
0x6dd6a15a
0x6dd6a15c
0x6dd6a15e
0x6dd6a160
0x6dd6a162
0x6dd6a164
0x6dd6a166
0x6dd6a168
0x6dd6a16a
0x6dd6a16c
0x6dd6a16e
0x6dd6a170
0x6dd6a172
0x6dd6a174
0x6dd6a176
0x6dd6a178
0x6dd6a17a
0x6dd6a17c
0x6dd6a17e
0x6dd6a180
0x6dd6a182
0x6dd6a184
0x6dd6a186
0x6dd6a188
0x6dd6a18a
0x6dd6a18c
0x6dd6a18e
0x6dd6a190
0x6dd6a192
0x6dd6a194
0x6dd6a196
0x6dd6a198
0x6dd6a19a
0x6dd6a19c
0x6dd6a19e
0x6dd6a1a0
0x6dd6a1a2
0x6dd6a1a4
0x6dd6a1a6
0x6dd6a1a8
0x6dd6a1aa
0x6dd6a1ac
0x6dd6a1ae
0x6dd6a1b0
0x6dd6a1b2
0x6dd6a1b4
0x6dd6a1b6
0x6dd6a1b8
0x6dd6a1ba
0x6dd6a1bc
0x6dd6a1be
0x6dd6a1c0
0x6dd6a1c2
0x6dd6a1c4
0x6dd6a1c6
0x6dd6a1c8
0x6dd6a1ca
0x6dd6a1cc
0x6dd6a1ce
0x6dd6a1d0
0x6dd6a1d2
0x6dd6a1d4
0x6dd6a1d6
0x6dd6a1d8
0x6dd6a1da
0x6dd6a1dc
0x6dd6a1de
0x6dd6a1e0
0x6dd6a1e2
0x6dd6a1e4
0x6dd6a1e6
0x6dd6a1e8
0x6dd6a1ea
0x6dd6a1ec
0x6dd6a1ee
0x6dd6a1f0
0x6dd6a1f2
0x6dd6a1f4
0x6dd6a1f6
0x6dd6a1f8
0x6dd6a1fa
0x6dd6a1fc
0x6dd6a1fe
0x6dd6a200
0x6dd6a202
0x6dd6a204
0x6dd6a206
0x6dd6a208
0x6dd6a20a
0x6dd6a20c
0x6dd6a20e
0x6dd6a210
0x6dd6a212
0x6dd6a214
0x6dd6a216
0x6dd6a218
0x6dd6a21a
0x6dd6a21c
0x6dd6a21e
0x6dd6a220
0x6dd6a222
0x6dd6a224
0x6dd6a226
0x6dd6a228
0x6dd6a22a
0x6dd6a22c
0x6dd6a22e
0x6dd6a230
0x6dd6a232
0x6dd6a234
0x6dd6a236
0x6dd6a238
0x6dd6a23a
0x6dd6a23c
0x6dd6a23e
0x6dd6a240
0x6dd6a242
0x6dd6a244
0x6dd6a246
0x6dd6a248
0x6dd6a24a
0x6dd6a24c
0x6dd6a24e
0x6dd6a250
0x6dd6a252
0x6dd6a254
0x6dd6a256
0x6dd6a258
0x6dd6a25a
0x6dd6a25c
0x6dd6a25e
0x6dd6a260
0x6dd6a262
0x6dd6a264
0x6dd6a266
0x6dd6a268
0x6dd6a26a
0x6dd6a26c
0x6dd6a26e
0x6dd6a270
0x6dd6a272
0x6dd6a274
0x6dd6a276
0x6dd6a278
0x6dd6a27a
0x6dd6a27c
0x6dd6a27e
0x6dd6a280
0x6dd6a282
0x6dd6a284
0x6dd6a286
0x6dd6a288
0x6dd6a28a
0x6dd6a28c
0x6dd6a28e
0x6dd6a290
0x6dd6a292
0x6dd6a294
0x6dd6a296
0x6dd6a298
0x6dd6a29a
0x6dd6a29c
0x6dd6a29e
0x6dd6a2a0
0x6dd6a2a2
0x6dd6a2a4
0x6dd6a2a6
0x6dd6a2a8
0x6dd6a2aa
0x6dd6a2ac
0x6dd6a2ae
0x6dd6a2b0
0x6dd6a2b2
0x6dd6a2b4
0x6dd6a2b6
0x6dd6a2b8
0x6dd6a2ba
0x6dd6a2bc
0x6dd6a2be
0x6dd6a2c0
0x6dd6a2c2
0x6dd6a2c4
0x6dd6a2c6
0x6dd6a2c8
0x6dd6a2ca
0x6dd6a2cc
0x6dd6a2ce
0x6dd6a2d0
0x6dd6a2d2
0x6dd6a2d4
0x6dd6a2d6
0x6dd6a2d8
0x6dd6a2da
0x6dd6a2dc
0x6dd6a2de
0x6dd6a2e0
0x6dd6a2e2
0x6dd6a2e4
0x6dd6a2e6
0x6dd6a2e8
0x6dd6a2ea
0x6dd6a2ec
0x6dd6a2ee
0x6dd6a2f0
0x6dd6a2f2
0x6dd6a2f4
0x6dd6a2f6
0x6dd6a2f8
0x6dd6a2fa
0x6dd6a2fc
0x6dd6a2fe
0x6dd6a300
0x6dd6a302
0x6dd6a304
0x6dd6a306
0x6dd6a308
0x6dd6a30a
0x6dd6a30c
0x6dd6a30e
0x6dd6a310
0x6dd6a312
0x6dd6a314
0x6dd6a316
0x6dd6a318
0x6dd6a31a
0x6dd6a31c
0x6dd6a31e
0x6dd6a320
0x6dd6a322
0x6dd6a324
0x6dd6a326
0x6dd6a328
0x6dd6a32a
0x6dd6a32c
0x6dd6a32e
0x6dd6a330
0x6dd6a332
0x6dd6a334
0x6dd6a336
0x6dd6a338
0x6dd6a33a
0x6dd6a33c
0x6dd6a33e
0x6dd6a340
0x6dd6a342
0x6dd6a344
0x6dd6a346
0x6dd6a348
0x6dd6a34a
0x6dd6a34c
0x6dd6a34e
0x6dd6a350
0x6dd6a352
0x6dd6a354
0x6dd6a356
0x6dd6a358
0x6dd6a35a
0x6dd6a35c
0x6dd6a35e
0x6dd6a360
0x6dd6a362
0x6dd6a364
0x6dd6a366
0x6dd6a368
0x6dd6a36a
0x6dd6a36c
0x6dd6a36e
0x6dd6a370
0x6dd6a372
0x6dd6a374
0x6dd6a376
0x6dd6a378
0x6dd6a37a
0x6dd6a37c
0x6dd6a37e
0x6dd6a380
0x6dd6a382
0x6dd6a384
0x6dd6a386
0x6dd6a388
0x6dd6a38a
0x6dd6a38c
0x6dd6a38e
0x6dd6a390
0x6dd6a392
0x6dd6a394
0x6dd6a396
0x6dd6a398
0x6dd6a39a
0x6dd6a39c
0x6dd6a39e
0x6dd6a3a0
0x6dd6a3a2
0x6dd6a3a4
0x6dd6a3a6
0x6dd6a3a8
0x6dd6a3aa
0x6dd6a3ac
0x6dd6a3ae
0x6dd6a3b0
0x6dd6a3b2
0x6dd6a3b4
0x6dd6a3b6
0x6dd6a3b8
0x6dd6a3ba
0x6dd6a3bc
0x6dd6a3be
0x6dd6a3c0
0x6dd6a3c2
0x6dd6a3c4
0x6dd6a3c6
0x6dd6a3c8
0x6dd6a3ca
0x6dd6a3cc
0x6dd6a3ce
0x6dd6a3d0
0x6dd6a3d2
0x6dd6a3d4
0x6dd6a3d6
0x6dd6a3d8
0x6dd6a3da
0x6dd6a3dc
0x6dd6a3de
0x6dd6a3e0
0x6dd6a3e2
0x6dd6a3e4
0x6dd6a3e6
0x6dd6a3e8
0x6dd6a3ea
0x6dd6a3ec
0x6dd6a3ee
0x6dd6a3f0
0x6dd6a3f2
0x6dd6a3f4
0x6dd6a3f6
0x6dd6a3f8
0x6dd6a3fa
0x6dd6a3fc
0x6dd6a3fe
0x6dd6a400
0x6dd6a402
0x6dd6a404
0x6dd6a406
0x6dd6a408
0x6dd6a40a
0x6dd6a40c
0x6dd6a40e
0x6dd6a410
0x6dd6a412
0x6dd6a414
0x6dd6a416
0x6dd6a418
0x6dd6a41a
0x6dd6a41c
0x6dd6a41e
0x6dd6a420
0x6dd6a422
0x6dd6a424
0x6dd6a426
0x6dd6a428
0x6dd6a42a
0x6dd6a42c
0x6dd6a42e
0x6dd6a430
0x6dd6a432
0x6dd6a434
0x6dd6a436
0x6dd6a438
0x6dd6a43a
0x6dd6a43c
0x6dd6a43e
0x6dd6a440
0x6dd6a442
0x6dd6a444
0x6dd6a446
0x6dd6a448
0x6dd6a44a
0x6dd6a44c
0x6dd6a44e
0x6dd6a450
0x6dd6a452
0x6dd6a454
0x6dd6a456
0x6dd6a458
0x6dd6a45a
0x6dd6a45c
0x6dd6a45e
0x6dd6a460
0x6dd6a462
0x6dd6a464
0x6dd6a466
0x6dd6a468
0x6dd6a46a
0x6dd6a46c
0x6dd6a46e
0x6dd6a470
0x6dd6a472
0x6dd6a474
0x6dd6a476
0x6dd6a478
0x6dd6a47a
0x6dd6a47c
0x6dd6a47e
0x6dd6a480
0x6dd6a482
0x6dd6a484
0x6dd6a486
0x6dd6a488
0x6dd6a48a
0x6dd6a48c
0x6dd6a48e
0x6dd6a490
0x6dd6a492
0x6dd6a494
0x6dd6a496
0x6dd6a498
0x6dd6a49a
0x6dd6a49c
0x6dd6a49e
0x6dd6a4a0
0x6dd6a4a2
0x6dd6a4a4
0x6dd6a4a6
0x6dd6a4a8
0x6dd6a4aa
0x6dd6a4ac
0x6dd6a4ae
0x6dd6a4b0
0x6dd6a4b2
0x6dd6a4b4
0x6dd6a4b6
0x6dd6a4b8
0x6dd6a4ba
0x6dd6a4bc
0x6dd6a4be
0x6dd6a4c0
0x6dd6a4c2
0x6dd6a4c4
0x6dd6a4c6
0x6dd6a4c8
0x6dd6a4ca
0x6dd6a4cc
0x6dd6a4ce
0x6dd6a4d0
0x6dd6a4d2
0x6dd6a4d4
0x6dd6a4d6
0x6dd6a4d8
0x6dd6a4da
0x6dd6a4dc
0x6dd6a4de
0x6dd6a4e0
0x6dd6a4e2
0x6dd6a4e4
0x6dd6a4e6
0x6dd6a4e8
0x6dd6a4ea
0x6dd6a4ec
0x6dd6a4ee
0x6dd6a4f0
0x6dd6a4f2
0x6dd6a4f4
0x6dd6a4f6
0x6dd6a4f8
0x6dd6a4fa
0x6dd6a4fc
0x6dd6a4fe
0x6dd6a500
0x6dd6a502
0x6dd6a504
0x6dd6a506
0x6dd6a508
0x6dd6a50a
0x6dd6a50c
0x6dd6a50e
0x6dd6a510
0x6dd6a512
0x6dd6a514
0x6dd6a516
0x6dd6a518
0x6dd6a51a
0x6dd6a51c
0x6dd6a51e
0x6dd6a520
0x6dd6a522
0x6dd6a524
0x6dd6a526
0x6dd6a528
0x6dd6a52a
0x6dd6a52c
0x6dd6a52e
0x6dd6a530
0x6dd6a532
0x6dd6a534
0x6dd6a536
0x6dd6a538
0x6dd6a53a
0x6dd6a53c
0x6dd6a53e
0x6dd6a540
0x6dd6a542
0x6dd6a544
0x6dd6a546
0x6dd6a548
0x6dd6a54a
0x6dd6a54c
0x6dd6a54e
0x6dd6a550
0x6dd6a552
0x6dd6a554
0x6dd6a556
0x6dd6a558
0x6dd6a55a
0x6dd6a55c
0x6dd6a55e
0x6dd6a560
0x6dd6a562
0x6dd6a564
0x6dd6a566
0x6dd6a568
0x6dd6a56a
0x6dd6a56c
0x6dd6a56e
0x6dd6a570
0x6dd6a572
0x6dd6a574
0x6dd6a576
0x6dd6a578
0x6dd6a57a
0x6dd6a57c
0x6dd6a57e
0x6dd6a580
0x6dd6a582
0x6dd6a584
0x6dd6a586
0x6dd6a588
0x6dd6a58a
0x6dd6a58c
0x6dd6a58e
0x6dd6a590
0x6dd6a592
0x6dd6a594
0x6dd6a596
0x6dd6a598
0x6dd6a59a
0x6dd6a59c
0x6dd6a59e
0x6dd6a5a0
0x6dd6a5a2
0x6dd6a5a4
0x6dd6a5a6
0x6dd6a5a8
0x6dd6a5aa
0x6dd6a5ac
0x6dd6a5ae
0x6dd6a5b0
0x6dd6a5b2
0x6dd6a5b4
0x6dd6a5b6
0x6dd6a5b8
0x6dd6a5ba
0x6dd6a5bc
0x6dd6a5be
0x6dd6a5c0
0x6dd6a5c2
0x6dd6a5c4
0x6dd6a5c6
0x6dd6a5c8
0x6dd6a5ca
0x6dd6a5cc
0x6dd6a5ce
0x6dd6a5d0
0x6dd6a5d2
0x6dd6a5d4
0x6dd6a5d6
0x6dd6a5d8
0x6dd6a5da
0x6dd6a5dc
0x6dd6a5de
0x6dd6a5e0
0x6dd6a5e2
0x6dd6a5e4
0x6dd6a5e6
0x6dd6a5e8
0x6dd6a5ea
0x6dd6a5ec
0x6dd6a5ee
0x6dd6a5f0
0x6dd6a5f2
0x6dd6a5f4
0x6dd6a5f6
0x6dd6a5f8
0x6dd6a5fa
0x6dd6a5fc
0x6dd6a5fe
0x6dd6a600
0x6dd6a602
0x6dd6a604
0x6dd6a606
0x6dd6a608
0x6dd6a60a
0x6dd6a60c
0x6dd6a60e
0x6dd6a610
0x6dd6a612
0x6dd6a614
0x6dd6a616
0x6dd6a618
0x6dd6a61a
0x6dd6a61c
0x6dd6a61e
0x6dd6a620
0x6dd6a622
0x6dd6a624
0x6dd6a626
0x6dd6a628
0x6dd6a62a
0x6dd6a62c
0x6dd6a62e
0x6dd6a630
0x6dd6a632
0x6dd6a634
0x6dd6a636
0x6dd6a638
0x6dd6a63a
0x6dd6a63c
0x6dd6a63e
0x6dd6a640
0x6dd6a642
0x6dd6a644
0x6dd6a646
0x6dd6a648
0x6dd6a64a
0x6dd6a64c
0x6dd6a64e
0x6dd6a650
0x6dd6a652
0x6dd6a654
0x6dd6a656
0x6dd6a658
0x6dd6a65a
0x6dd6a65c
0x6dd6a65e
0x6dd6a660
0x6dd6a662
0x6dd6a664
0x6dd6a666
0x6dd6a668
0x6dd6a66a
0x6dd6a66c
0x6dd6a66e
0x6dd6a670
0x6dd6a672
0x6dd6a674
0x6dd6a676
0x6dd6a678
0x6dd6a67a
0x6dd6a67c
0x6dd6a67e
0x6dd6a680
0x6dd6a682
0x6dd6a684
0x6dd6a686
0x6dd6a688
0x6dd6a68a
0x6dd6a68c
0x6dd6a68e
0x6dd6a690
0x6dd6a692
0x6dd6a694
0x6dd6a696
0x6dd6a698
0x6dd6a69a
0x6dd6a69c
0x6dd6a69e
0x6dd6a6a0
0x6dd6a6a2
0x6dd6a6a4
0x6dd6a6a6
0x6dd6a6a8
0x6dd6a6aa
0x6dd6a6ac
0x6dd6a6ae
0x6dd6a6b0
0x6dd6a6b2
0x6dd6a6b4
0x6dd6a6b6
0x6dd6a6b8
0x6dd6a6ba
0x6dd6a6bc
0x6dd6a6be
0x6dd6a6c0
0x6dd6a6c2
0x6dd6a6c4
0x6dd6a6c6
0x6dd6a6c8
0x6dd6a6ca
0x6dd6a6cc
0x6dd6a6ce
0x6dd6a6d0
0x6dd6a6d2
0x6dd6a6d4
0x6dd6a6d6
0x6dd6a6d8
0x6dd6a6da
0x6dd6a6dc
0x6dd6a6de
0x6dd6a6e0
0x6dd6a6e2
0x6dd6a6e4
0x6dd6a6e6
0x6dd6a6e8
0x6dd6a6ea
0x6dd6a6ec
0x6dd6a6ee
0x6dd6a6f0
0x6dd6a6f2
0x6dd6a6f4
0x6dd6a6f6
0x6dd6a6f8
0x6dd6a6fa
0x6dd6a6fc
0x6dd6a6fe
0x6dd6a700
0x6dd6a702
0x6dd6a704
0x6dd6a706
0x6dd6a708
0x6dd6a70a
0x6dd6a70c
0x6dd6a70e
0x6dd6a710
0x6dd6a712
0x6dd6a714
0x6dd6a716
0x6dd6a718
0x6dd6a71a
0x6dd6a71c
0x6dd6a71e
0x6dd6a720
0x6dd6a722
0x6dd6a724
0x6dd6a726
0x6dd6a728
0x6dd6a72a
0x6dd6a72c
0x6dd6a72e
0x6dd6a730
0x6dd6a732
0x6dd6a734
0x6dd6a736
0x6dd6a738
0x6dd6a73a
0x6dd6a73c
0x6dd6a73e
0x6dd6a740
0x6dd6a742
0x6dd6a744
0x6dd6a746
0x6dd6a748
0x6dd6a74a
0x6dd6a74c
0x6dd6a74e
0x6dd6a750
0x6dd6a752
0x6dd6a754
0x6dd6a756
0x6dd6a758
0x6dd6a75a
0x6dd6a75c
0x6dd6a75e
0x6dd6a760
0x6dd6a762
0x6dd6a764
0x6dd6a766
0x6dd6a768
0x6dd6a76a
0x6dd6a76c
0x6dd6a76e
0x6dd6a770
0x6dd6a772
0x6dd6a774
0x6dd6a776
0x6dd6a778
0x6dd6a77a
0x6dd6a77c
0x6dd6a77e
0x6dd6a780
0x6dd6a782
0x6dd6a784
0x6dd6a786
0x6dd6a788
0x6dd6a78a
0x6dd6a78c
0x6dd6a78e
0x6dd6a790
0x6dd6a792
0x6dd6a794
0x6dd6a796
0x6dd6a798
0x6dd6a79a
0x6dd6a79c
0x6dd6a79e
0x6dd6a7a0
0x6dd6a7a2
0x6dd6a7a4
0x6dd6a7a6
0x6dd6a7a8
0x6dd6a7aa
0x6dd6a7ac
0x6dd6a7ae
0x6dd6a7b0
0x6dd6a7b2
0x6dd6a7b4
0x6dd6a7b6
0x6dd6a7b8
0x6dd6a7ba
0x6dd6a7bc
0x6dd6a7be
0x6dd6a7c0
0x6dd6a7c2
0x6dd6a7c4
0x6dd6a7c6
0x6dd6a7c8
0x6dd6a7ca
0x6dd6a7cc
0x6dd6a7ce
0x6dd6a7d0
0x6dd6a7d2
0x6dd6a7d4
0x6dd6a7d6
0x6dd6a7d8
0x6dd6a7da
0x6dd6a7dc
0x6dd6a7de
0x6dd6a7e0
0x6dd6a7e2
0x6dd6a7e4
0x6dd6a7e6
0x6dd6a7e8
0x6dd6a7ea
0x6dd6a7ec
0x6dd6a7ee
0x6dd6a7f0
0x6dd6a7f2
0x6dd6a7f4
0x6dd6a7f6
0x6dd6a7f8
0x6dd6a7fa
0x6dd6a7fc
0x6dd6a7fe
0x6dd6a800
0x6dd6a802
0x6dd6a804
0x6dd6a806
0x6dd6a808
0x6dd6a80a
0x6dd6a80c
0x6dd6a80e
0x6dd6a810
0x6dd6a812
0x6dd6a814
0x6dd6a816
0x6dd6a818
0x6dd6a81a
0x6dd6a81c
0x6dd6a81e
0x6dd6a820
0x6dd6a822
0x6dd6a824
0x6dd6a826
0x6dd6a828
0x6dd6a82a
0x6dd6a82c
0x6dd6a82e
0x6dd6a830
0x6dd6a832
0x6dd6a834
0x6dd6a836
0x6dd6a838
0x6dd6a83a
0x6dd6a83c
0x6dd6a83e
0x6dd6a840
0x6dd6a842
0x6dd6a844
0x6dd6a846
0x6dd6a848
0x6dd6a84a
0x6dd6a84c
0x6dd6a84e
0x6dd6a850
0x6dd6a852
0x6dd6a854
0x6dd6a856
0x6dd6a858
0x6dd6a85a
0x6dd6a85c
0x6dd6a85e
0x6dd6a860
0x6dd6a862
0x6dd6a864
0x6dd6a866
0x6dd6a868
0x6dd6a86a
0x6dd6a86c
0x6dd6a86e
0x6dd6a870
0x6dd6a872
0x6dd6a874
0x6dd6a876
0x6dd6a878
0x6dd6a87a
0x6dd6a87c
0x6dd6a87e
0x6dd6a880
0x6dd6a882
0x6dd6a884
0x6dd6a886
0x6dd6a888
0x6dd6a88a
0x6dd6a88c
0x6dd6a88e
0x6dd6a890
0x6dd6a892
0x6dd6a894
0x6dd6a896
0x6dd6a898
0x6dd6a89a
0x6dd6a89c
0x6dd6a89e
0x6dd6a8a0
0x6dd6a8a2
0x6dd6a8a4
0x6dd6a8a6
0x6dd6a8a8
0x6dd6a8aa
0x6dd6a8ac
0x6dd6a8ae
0x6dd6a8b0
0x6dd6a8b2
0x6dd6a8b4
0x6dd6a8b6
0x6dd6a8b8
0x6dd6a8ba
0x6dd6a8bc
0x6dd6a8be
0x6dd6a8c0
0x6dd6a8c2
0x6dd6a8c4
0x6dd6a8c6
0x6dd6a8c8
0x6dd6a8ca
0x6dd6a8cc
0x6dd6a8ce
0x6dd6a8d0
0x6dd6a8d2
0x6dd6a8d4
0x6dd6a8d6
0x6dd6a8d8
0x6dd6a8da
0x6dd6a8dc
0x6dd6a8de
0x6dd6a8e0
0x6dd6a8e2
0x6dd6a8e4
0x6dd6a8e6
0x6dd6a8e8
0x6dd6a8ea
0x6dd6a8ec
0x6dd6a8ee
0x6dd6a8f0
0x6dd6a8f2
0x6dd6a8f4
0x6dd6a8f6
0x6dd6a8f8
0x6dd6a8fa
0x6dd6a8fc
0x6dd6a8fe
0x6dd6a900
0x6dd6a902
0x6dd6a904
0x6dd6a906
0x6dd6a908
0x6dd6a90a
0x6dd6a90c
0x6dd6a90e
0x6dd6a910
0x6dd6a912
0x6dd6a914
0x6dd6a916
0x6dd6a918
0x6dd6a91a
0x6dd6a91c
0x6dd6a91e
0x6dd6a920
0x6dd6a922
0x6dd6a924
0x6dd6a926
0x6dd6a928
0x6dd6a92a
0x6dd6a92c
0x6dd6a92e
0x6dd6a930
0x6dd6a932
0x6dd6a934
0x6dd6a936
0x6dd6a938
0x6dd6a93a
0x6dd6a93c
0x6dd6a93e
0x6dd6a940
0x6dd6a942
0x6dd6a944
0x6dd6a946
0x6dd6a948
0x6dd6a94a
0x6dd6a94c
0x6dd6a94e
0x6dd6a950
0x6dd6a952
0x6dd6a954
0x6dd6a956
0x6dd6a958
0x6dd6a95a
0x6dd6a95c
0x6dd6a95e
0x6dd6a960
0x6dd6a962
0x6dd6a964
0x6dd6a966
0x6dd6a968
0x6dd6a96a
0x6dd6a96c
0x6dd6a96e
0x6dd6a970
0x6dd6a972
0x6dd6a974
0x6dd6a976
0x6dd6a978
0x6dd6a97a
0x6dd6a97c
0x6dd6a97e
0x6dd6a980
0x6dd6a982
0x6dd6a984
0x6dd6a986
0x6dd6a988
0x6dd6a98a
0x6dd6a98c
0x6dd6a98e
0x6dd6a990
0x6dd6a992
0x6dd6a994
0x6dd6a996
0x6dd6a998
0x6dd6a99a
0x6dd6a99c
0x6dd6a99e
0x6dd6a9a0
0x6dd6a9a2
0x6dd6a9a4
0x6dd6a9a6
0x6dd6a9a8
0x6dd6a9aa
0x6dd6a9ac
0x6dd6a9ae
0x6dd6a9b0
0x6dd6a9b2
0x6dd6a9b4
0x6dd6a9b6
0x6dd6a9b8
0x6dd6a9ba
0x6dd6a9bc
0x6dd6a9be
0x6dd6a9c0
0x6dd6a9c2
0x6dd6a9c4
0x6dd6a9c6
0x6dd6a9c8
0x6dd6a9ca
0x6dd6a9cc
0x6dd6a9ce
0x6dd6a9d0
0x6dd6a9d2
0x6dd6a9d4
0x6dd6a9d6
0x6dd6a9d8
0x6dd6a9da
0x6dd6a9dc
0x6dd6a9de
0x6dd6a9e0
0x6dd6a9e2
0x6dd6a9e4
0x6dd6a9e6
0x6dd6a9e8
0x6dd6a9ea
0x6dd6a9ec
0x6dd6a9ee
0x6dd6a9f0
0x6dd6a9f2
0x6dd6a9f4
0x6dd6a9f6
0x6dd6a9f8
0x6dd6a9fa
0x6dd6a9fc
0x6dd6a9fe
0x6dd6aa00
0x6dd6aa02
0x6dd6aa04
0x6dd6aa06
0x6dd6aa08
0x6dd6aa0a
0x6dd6aa0c
0x6dd6aa0e
0x6dd6aa10
0x6dd6aa12
0x6dd6aa14
0x6dd6aa16
0x6dd6aa18
0x6dd6aa1a
0x6dd6aa1c
0x6dd6aa1e
0x6dd6aa20
0x6dd6aa22
0x6dd6aa24
0x6dd6aa26
0x6dd6aa28
0x6dd6aa2a
0x6dd6aa2c
0x6dd6aa2e
0x6dd6aa30
0x6dd6aa32
0x6dd6aa34
0x6dd6aa36
0x6dd6aa38
0x6dd6aa3a
0x6dd6aa3c
0x6dd6aa3e
0x6dd6aa40
0x6dd6aa42
0x6dd6aa44
0x6dd6aa46
0x6dd6aa48
0x6dd6aa4a
0x6dd6aa4c
0x6dd6aa4e
0x6dd6aa50
0x6dd6aa52
0x6dd6aa54
0x6dd6aa56
0x6dd6aa58
0x6dd6aa5a
0x6dd6aa5c
0x6dd6aa5e
0x6dd6aa60
0x6dd6aa62
0x6dd6aa64
0x6dd6aa66
0x6dd6aa68
0x6dd6aa6a
0x6dd6aa6c
0x6dd6aa6e
0x6dd6aa70
0x6dd6aa72
0x6dd6aa74
0x6dd6aa76
0x6dd6aa78
0x6dd6aa7a
0x6dd6aa7c
0x6dd6aa7e
0x6dd6aa80
0x6dd6aa82
0x6dd6aa84
0x6dd6aa86
0x6dd6aa88
0x6dd6aa8a
0x6dd6aa8c
0x6dd6aa8e
0x6dd6aa90
0x6dd6aa92
0x6dd6aa94
0x6dd6aa96
0x6dd6aa98
0x6dd6aa9a
0x6dd6aa9c
0x6dd6aa9e
0x6dd6aaa0
0x6dd6aaa2
0x6dd6aaa4
0x6dd6aaa6
0x6dd6aaa8
0x6dd6aaaa
0x6dd6aaac
0x6dd6aaae
0x6dd6aab0
0x6dd6aab2
0x6dd6aab4
0x6dd6aab6
0x6dd6aab8
0x6dd6aaba
0x6dd6aabc
0x6dd6aabe
0x6dd6aac0
0x6dd6aac2
0x6dd6aac4
0x6dd6aac6
0x6dd6aac8
0x6dd6aaca
0x6dd6aacc
0x6dd6aace
0x6dd6aad0
0x6dd6aad2
0x6dd6aad4
0x6dd6aad6
0x6dd6aad8
0x6dd6aada
0x6dd6aadc
0x6dd6aade
0x6dd6aae0
0x6dd6aae2
0x6dd6aae4
0x6dd6aae6
0x6dd6aae8
0x6dd6aaea
0x6dd6aaec
0x6dd6aaee
0x6dd6aaf0
0x6dd6aaf2
0x6dd6aaf4
0x6dd6aaf6
0x6dd6aaf8
0x6dd6aafa
0x6dd6aafc
0x6dd6aafe
0x6dd6ab00
0x6dd6ab02
0x6dd6ab04
0x6dd6ab06
0x6dd6ab08
0x6dd6ab0a
0x6dd6ab0c
0x6dd6ab0e
0x6dd6ab10
0x6dd6ab12
0x6dd6ab14
0x6dd6ab16
0x6dd6ab18
0x6dd6ab1a
0x6dd6ab1c
0x6dd6ab1e
0x6dd6ab20
0x6dd6ab22
0x6dd6ab24
0x6dd6ab26
0x6dd6ab28
0x6dd6ab2a
0x6dd6ab2c
0x6dd6ab2e
0x6dd6ab30
0x6dd6ab32
0x6dd6ab34
0x6dd6ab36
0x6dd6ab38
0x6dd6ab3a
0x6dd6ab3c
0x6dd6ab3e
0x6dd6ab40
0x6dd6ab42
0x6dd6ab44
0x6dd6ab46
0x6dd6ab48
0x6dd6ab4a
0x6dd6ab4c
0x6dd6ab4e
0x6dd6ab50
0x6dd6ab52
0x6dd6ab54
0x6dd6ab56
0x6dd6ab58
0x6dd6ab5a
0x6dd6ab5c
0x6dd6ab5e
0x6dd6ab60
0x6dd6ab62
0x6dd6ab64
0x6dd6ab66
0x6dd6ab68
0x6dd6ab6a
0x6dd6ab6c
0x6dd6ab6e
0x6dd6ab70
0x6dd6ab72
0x6dd6ab74
0x6dd6ab76
0x6dd6ab78
0x6dd6ab7a
0x6dd6ab7c
0x6dd6ab7e
0x6dd6ab80
0x6dd6ab82
0x6dd6ab84
0x6dd6ab86
0x6dd6ab88
0x6dd6ab8a
0x6dd6ab8c
0x6dd6ab8e
0x6dd6ab90
0x6dd6ab92
0x6dd6ab94
0x6dd6ab96
0x6dd6ab98
0x6dd6ab9a
0x6dd6ab9c
0x6dd6ab9e
0x6dd6aba0
0x6dd6aba2
0x6dd6aba4
0x6dd6aba6
0x6dd6aba8
0x6dd6abaa
0x6dd6abac
0x6dd6abae
0x6dd6abb0
0x6dd6abb2
0x6dd6abb4
0x6dd6abb6
0x6dd6abb8
0x6dd6abba
0x6dd6abbc
0x6dd6abbe
0x6dd6abc0
0x6dd6abc2
0x6dd6abc4
0x6dd6abc6
0x6dd6abc8
0x6dd6abca
0x6dd6abcc
0x6dd6abce
0x6dd6abd0
0x6dd6abd2
0x6dd6abd4
0x6dd6abd6
0x6dd6abd8
0x6dd6abda
0x6dd6abdc
0x6dd6abde
0x6dd6abe0
0x6dd6abe2
0x6dd6abe4
0x6dd6abe6
0x6dd6abe8
0x6dd6abea
0x6dd6abec
0x6dd6abee
0x6dd6abf0
0x6dd6abf2
0x6dd6abf4
0x6dd6abf6
0x6dd6abf8
0x6dd6abfa
0x6dd6abfc
0x6dd6abfe
0x6dd6ac00
0x6dd6ac02
0x6dd6ac04
0x6dd6ac06
0x6dd6ac08
0x6dd6ac0a
0x6dd6ac0c
0x6dd6ac0e
0x6dd6ac10
0x6dd6ac12
0x6dd6ac14
0x6dd6ac16
0x6dd6ac18
0x6dd6ac1a
0x6dd6ac1c
0x6dd6ac1e
0x6dd6ac20
0x6dd6ac22
0x6dd6ac24
0x6dd6ac26
0x6dd6ac28
0x6dd6ac2a
0x6dd6ac2c
0x6dd6ac2e
0x6dd6ac30
0x6dd6ac32
0x6dd6ac34
0x6dd6ac36
0x6dd6ac38
0x6dd6ac3a
0x6dd6ac3c
0x6dd6ac3e
0x6dd6ac40
0x6dd6ac42
0x6dd6ac44
0x6dd6ac46
0x6dd6ac48
0x6dd6ac4a
0x6dd6ac4c
0x6dd6ac4e
0x6dd6ac50
0x6dd6ac52
0x6dd6ac54
0x6dd6ac56
0x6dd6ac58
0x6dd6ac5a
0x6dd6ac5c
0x6dd6ac5e
0x6dd6ac60
0x6dd6ac62
0x6dd6ac64
0x6dd6ac66
0x6dd6ac68
0x6dd6ac6a
0x6dd6ac6c
0x6dd6ac6e
0x6dd6ac70
0x6dd6ac72
0x6dd6ac74
0x6dd6ac76
0x6dd6ac78
0x6dd6ac7a
0x6dd6ac7c
0x6dd6ac7e
0x6dd6ac80
0x6dd6ac82
0x6dd6ac84
0x6dd6ac86
0x6dd6ac88
0x6dd6ac8a
0x6dd6ac8c
0x6dd6ac8e
0x6dd6ac90
0x6dd6ac92
0x6dd6ac94
0x6dd6ac96
0x6dd6ac98
0x6dd6ac9a
0x6dd6ac9c
0x6dd6ac9e
0x6dd6aca0
0x6dd6aca2
0x6dd6aca4
0x6dd6aca6
0x6dd6aca8
0x6dd6acaa
0x6dd6acac
0x6dd6acae
0x6dd6acb0
0x6dd6acb2
0x6dd6acb4
0x6dd6acb6
0x6dd6acb8
0x6dd6acba
0x6dd6acbc
0x6dd6acbe
0x6dd6acc0
0x6dd6acc2
0x6dd6acc4
0x6dd6acc6
0x6dd6acc8
0x6dd6acca
0x6dd6accc
0x6dd6acce
0x6dd6acd0
0x6dd6acd2
0x6dd6acd4
0x6dd6acd6
0x6dd6acd8
0x6dd6acda
0x6dd6acdc
0x6dd6acde
0x6dd6ace0
0x6dd6ace2
0x6dd6ace4
0x6dd6ace6
0x6dd6ace8
0x6dd6acea
0x6dd6acec
0x6dd6acee
0x6dd6acf0
0x6dd6acf2
0x6dd6acf4
0x6dd6acf6
0x6dd6acf8
0x6dd6acfa
0x6dd6acfc
0x6dd6acfe
0x6dd6ad00
0x6dd6ad02
0x6dd6ad04
0x6dd6ad06
0x6dd6ad08
0x6dd6ad0a
0x6dd6ad0c
0x6dd6ad0e
0x6dd6ad10
0x6dd6ad12
0x6dd6ad14
0x6dd6ad16
0x6dd6ad18
0x6dd6ad1a
0x6dd6ad1c
0x6dd6ad1e
0x6dd6ad20
0x6dd6ad22
0x6dd6ad24
0x6dd6ad26
0x6dd6ad28
0x6dd6ad2a
0x6dd6ad2c
0x6dd6ad2e
0x6dd6ad30
0x6dd6ad32
0x6dd6ad34
0x6dd6ad36
0x6dd6ad38
0x6dd6ad3a
0x6dd6ad3c
0x6dd6ad3e
0x6dd6ad40
0x6dd6ad42
0x6dd6ad44
0x6dd6ad46
0x6dd6ad48
0x6dd6ad4a
0x6dd6ad4c
0x6dd6ad4e
0x6dd6ad50
0x6dd6ad52
0x6dd6ad54
0x6dd6ad56
0x6dd6ad58
0x6dd6ad5a
0x6dd6ad5c
0x6dd6ad5e
0x6dd6ad60
0x6dd6ad62
0x6dd6ad64
0x6dd6ad66
0x6dd6ad68
0x6dd6ad6a
0x6dd6ad6c
0x6dd6ad6e
0x6dd6ad70
0x6dd6ad72
0x6dd6ad74
0x6dd6ad76
0x6dd6ad78
0x6dd6ad7a
0x6dd6ad7c
0x6dd6ad7e
0x6dd6ad80
0x6dd6ad82
0x6dd6ad84
0x6dd6ad86
0x6dd6ad88
0x6dd6ad8a
0x6dd6ad8c
0x6dd6ad8e
0x6dd6ad90
0x6dd6ad92
0x6dd6ad94
0x6dd6ad96
0x6dd6ad98
0x6dd6ad9a
0x6dd6ad9c
0x6dd6ad9e
0x6dd6ada0
0x6dd6ada2
0x6dd6ada4
0x6dd6ada6
0x6dd6ada8
0x6dd6adaa
0x6dd6adac
0x6dd6adae
0x6dd6adb0
0x6dd6adb2
0x6dd6adb4
0x6dd6adb6
0x6dd6adb8
0x6dd6adba
0x6dd6adbc
0x6dd6adbe
0x6dd6adc0
0x6dd6adc2
0x6dd6adc4
0x6dd6adc6
0x6dd6adc8
0x6dd6adca
0x6dd6adcc
0x6dd6adce
0x6dd6add0
0x6dd6add2
0x6dd6add4
0x6dd6add6
0x6dd6add8
0x6dd6adda
0x6dd6addc
0x6dd6adde
0x6dd6ade0
0x6dd6ade2
0x6dd6ade4
0x6dd6ade6
0x6dd6ade8
0x6dd6adea
0x6dd6adec
0x6dd6adee
0x6dd6adf0
0x6dd6adf2
0x6dd6adf4
0x6dd6adf6
0x6dd6adf8
0x6dd6adfa
0x6dd6adfc
0x6dd6adfe
0x6dd6ae00
0x6dd6ae02
0x6dd6ae04
0x6dd6ae06
0x6dd6ae08
0x6dd6ae0a
0x6dd6ae0c
0x6dd6ae0e
0x6dd6ae10
0x6dd6ae12
0x6dd6ae14
0x6dd6ae16
0x6dd6ae18
0x6dd6ae1a
0x6dd6ae1c
0x6dd6ae1e
0x6dd6ae20
0x6dd6ae22
0x6dd6ae24
0x6dd6ae26
0x6dd6ae28
0x6dd6ae2a
0x6dd6ae2c
0x6dd6ae2e
0x6dd6ae30
0x6dd6ae32
0x6dd6ae34
0x6dd6ae36
0x6dd6ae38
0x6dd6ae3a
0x6dd6ae3c
0x6dd6ae3e
0x6dd6ae40
0x6dd6ae42
0x6dd6ae44
0x6dd6ae46
0x6dd6ae48
0x6dd6ae4a
0x6dd6ae4c
0x6dd6ae4e
0x6dd6ae50
0x6dd6ae52
0x6dd6ae54
0x6dd6ae56
0x6dd6ae58
0x6dd6ae5a
0x6dd6ae5c
0x6dd6ae5e
0x6dd6ae60
0x6dd6ae62
0x6dd6ae64
0x6dd6ae66
0x6dd6ae68
0x6dd6ae6a
0x6dd6ae6c
0x6dd6ae6e
0x6dd6ae70
0x6dd6ae72
0x6dd6ae74
0x6dd6ae76
0x6dd6ae78
0x6dd6ae7a
0x6dd6ae7c
0x6dd6ae7e
0x6dd6ae80
0x6dd6ae82
0x6dd6ae84
0x6dd6ae86
0x6dd6ae88
0x6dd6ae8a
0x6dd6ae8c
0x6dd6ae8e
0x6dd6ae90
0x6dd6ae92
0x6dd6ae94
0x6dd6ae96
0x6dd6ae98
0x6dd6ae9a
0x6dd6ae9c
0x6dd6ae9e
0x6dd6aea0
0x6dd6aea2
0x6dd6aea4
0x6dd6aea6
0x6dd6aea8
0x6dd6aeaa
0x6dd6aeac
0x6dd6aeae
0x6dd6aeb0
0x6dd6aeb2
0x6dd6aeb4
0x6dd6aeb6
0x6dd6aeb8
0x6dd6aeba
0x6dd6aebc
0x6dd6aebe
0x6dd6aec0
0x6dd6aec2
0x6dd6aec4
0x6dd6aec6
0x6dd6aec8
0x6dd6aeca
0x6dd6aecc
0x6dd6aece
0x6dd6aed0
0x6dd6aed2
0x6dd6aed4
0x6dd6aed6
0x6dd6aed8
0x6dd6aeda
0x6dd6aedc
0x6dd6aede
0x6dd6aee0
0x6dd6aee2
0x6dd6aee4
0x6dd6aee6
0x6dd6aee8
0x6dd6aeea
0x6dd6aeec
0x6dd6aeee
0x6dd6aef0
0x6dd6aef2
0x6dd6aef4
0x6dd6aef6
0x6dd6aef8
0x6dd6aefa
0x6dd6aefc
0x6dd6aefe
0x6dd6af00
0x6dd6af02
0x6dd6af04
0x6dd6af06
0x6dd6af08
0x6dd6af0a
0x6dd6af0c
0x6dd6af0e
0x6dd6af10
0x6dd6af12
0x6dd6af14
0x6dd6af16
0x6dd6af18
0x6dd6af1a
0x6dd6af1c
0x6dd6af1e
0x6dd6af20
0x6dd6af22
0x6dd6af24
0x6dd6af26
0x6dd6af28
0x6dd6af2a
0x6dd6af2c
0x6dd6af2e
0x6dd6af30
0x6dd6af32
0x6dd6af34
0x6dd6af36
0x6dd6af38
0x6dd6af3a
0x6dd6af3c
0x6dd6af3e
0x6dd6af40
0x6dd6af42
0x6dd6af44
0x6dd6af46
0x6dd6af48
0x6dd6af4a
0x6dd6af4c
0x6dd6af4e
0x6dd6af50
0x6dd6af52
0x6dd6af54
0x6dd6af56
0x6dd6af58
0x6dd6af5a
0x6dd6af5c
0x6dd6af5e
0x6dd6af60
0x6dd6af62
0x6dd6af64
0x6dd6af66
0x6dd6af68
0x6dd6af6a
0x6dd6af6c
0x6dd6af6e
0x6dd6af70
0x6dd6af72
0x6dd6af74
0x6dd6af76
0x6dd6af78
0x6dd6af7a
0x6dd6af7c
0x6dd6af7e
0x6dd6af80
0x6dd6af82
0x6dd6af84
0x6dd6af86
0x6dd6af88
0x6dd6af8a
0x6dd6af8c
0x6dd6af8e
0x6dd6af90
0x6dd6af92
0x6dd6af94
0x6dd6af96
0x6dd6af98
0x6dd6af9a
0x6dd6af9c
0x6dd6af9e
0x6dd6afa0
0x6dd6afa2
0x6dd6afa4
0x6dd6afa6
0x6dd6afa8
0x6dd6afaa
0x6dd6afac
0x6dd6afae
0x6dd6afb0
0x6dd6afb2
0x6dd6afb4
0x6dd6afb6
0x6dd6afb8
0x6dd6afba
0x6dd6afbc
0x6dd6afbe
0x6dd6afc0
0x6dd6afc2
0x6dd6afc4
0x6dd6afc6
0x6dd6afc8
0x6dd6afca
0x6dd6afcc
0x6dd6afce
0x6dd6afd0
0x6dd6afd2
0x6dd6afd4
0x6dd6afd6
0x6dd6afd8
0x6dd6afda
0x6dd6afdc
0x6dd6afde
0x6dd6afe0
0x6dd6afe2
0x6dd6afe4
0x6dd6afe6
0x6dd6afe8
0x6dd6afea
0x6dd6afec
0x6dd6afee
0x6dd6aff0
0x6dd6aff2
0x6dd6aff4
0x6dd6aff6
0x6dd6aff8
0x6dd6affa
0x6dd6affc
0x6dd6affe
0x6dd6affe
0x6dd6b000
0x6dd6b001
0x6dd6b064
0x6dd6b064
0x6dd6b067
0x00000000
0x00000000
0x00000000
0x00000000
0x6dd6b003
0x6dd6b003
0x6dd6b034
0x6dd6b034
0x6dd6b035
0x00000000
0x6dd6b037
0x6dd6b037
0x00000000
0x6dd6b037
0x6dd6b005
0x6dd6b005
0x6dd6b074
0x6dd6b074
0x00000000
0x6dd6b007
0x6dd6b007
0x6dd6b038
0x6dd6b038
0x6dd6b069
0x6dd6b069
0x00000000
0x6dd6b06c
0x6dd6b06c
0x6dd6b071
0x6dd6b071
0x00000000
0x6dd6b071
0x6dd6b03a
0x6dd6b03a
0x6dd6b0a5
0x6dd6b0c7
0x6dd6b0c7
0x00000000
0x6dd6b0a7
0x6dd6b0a7
0x6dd6b0aa
0x6dd6b0ac
0x6dd6b0ac
0x6dd6b0ad
0x00000000
0x6dd6b0af
0x6dd6b0af
0x00000000
0x6dd6b0b2
0x6dd6b0b2
0x6dd6b0b2
0x00000000
0x6dd6b0b2
0x6dd6b0af
0x6dd6b0ad
0x6dd6b03c
0x6dd6b03c
0x6dd6b03d
0x6dd6b0b3
0x6dd6b0b3
0x6dd6b0b4
0x00000000
0x6dd6b03f
0x6dd6b03f
0x6dd6b044
0x6dd6b075
0x6dd6b075
0x6dd6b07a
0x6dd6b07b
0x6dd6b07c
0x6dd6b07d
0x6dd6b07d
0x6dd6b07e
0x6dd6b07f
0x00000000
0x6dd6b046
0x6dd6b046
0x6dd6b0ba
0x6dd6b0ba
0x6dd6b0be
0x6dd6b0be
0x6dd6b048
0x6dd6b048
0x6dd6b04a
0x6dd6b04d
0x6dd6b0b8
0x6dd6b0b8
0x6dd6b0b8
0x00000000
0x6dd6b04f
0x6dd6b04f
0x6dd6b080
0x6dd6b080
0x6dd6b081
0x6dd6b082
0x6dd6b083
0x6dd6b085
0x6dd6b089
0x6dd6b089
0x6dd6b08b
0x6dd6b08e
0x00000000
0x6dd6b090
0x6dd6b090
0x00000000
0x6dd6b093
0x6dd6b093
0x6dd6b0b5
0x6dd6b0b5
0x6dd6b0b5
0x6dd6b0b5
0x00000000
0x6dd6b095
0x6dd6b095
0x6dd6b095
0x6dd6b097
0x6dd6b097
0x6dd6b09a
0x00000000
0x6dd6b09c
0x6dd6b09c
0x6dd6b09c
0x6dd6b0a0
0x6dd6b0a0
0x6dd6b0a0
0x6dd6b0a0
0x6dd6b09a
0x6dd6b093
0x6dd6b090
0x6dd6b052
0x6dd6b052
0x6dd6b054
0x6dd6b056
0x6dd6b056
0x6dd6b056
0x6dd6b059
0x6dd6b0cd
0x6dd6b0cd
0x6dd6b0ce
0x6dd6b0ce
0x6dd6b0d2
0x6dd6b0d2
0x6dd6b0d7
0x6dd6b0d7
0x6dd6b0d7
0x6dd6b0da
0x6dd6b0fc
0x6dd6b0fc
0x6dd6b0fd
0x00000000
0x6dd6b0ff
0x6dd6b0ff
0x00000000
0x6dd6b101
0x6dd6b101
0x00000000
0x00000000
0x00000000
0x00000000
0x6dd6b101
0x6dd6b0ff
0x6dd6b0dc
0x6dd6b0e3
0x6dd6b0e4
0x6dd6b0e9
0x6dd6b0e9
0x6dd6b0e9
0x6dd6b0eb
0x6dd6b0f0
0x6dd6b12f
0x6dd6b12f
0x6dd6b130
0x6dd6b130
0x6dd6b0f2
0x6dd6b0f2
0x6dd6b0f2
0x6dd6b0f2
0x6dd6b0f7
0x6dd6b103
0x6dd6b103
0x6dd6b134
0x00000000
0x6dd6b136
0x6dd6b136
0x00000000
0x6dd6b138
0x6dd6b138
0x6dd6b139
0x00000000
0x6dd6b13b
0x6dd6b13b
0x6dd6b140
0x00000000
0x6dd6b142
0x6dd6b142
0x6dd6b1b6
0x6dd6b1b6
0x00000000
0x6dd6b144
0x6dd6b144
0x6dd6b146
0x00000000
0x6dd6b148
0x6dd6b148
0x00000000
0x6dd6b148
0x6dd6b146
0x6dd6b142
0x6dd6b140
0x6dd6b139
0x6dd6b136
0x6dd6b105
0x6dd6b105
0x6dd6b108
0x6dd6b109
0x6dd6b10b
0x6dd6b10c
0x6dd6b10c
0x6dd6b10e
0x6dd6b10e
0x6dd6b111
0x6dd6b149
0x6dd6b149
0x6dd6b14a
0x6dd6b14d
0x6dd6b14f
0x6dd6b151
0x6dd6b151
0x6dd6b153
0x00000000
0x00000000
0x00000000
0x00000000
0x6dd6b113
0x6dd6b113
0x6dd6b115
0x6dd6b115
0x6dd6b115
0x6dd6b11b
0x6dd6b120
0x6dd6b122
0x6dd6b122
0x6dd6b123
0x6dd6b123
0x6dd6b126
0x6dd6b126
0x6dd6b155
0x6dd6b155
0x6dd6b156
0x6dd6b157
0x6dd6b15a
0x00000000
0x6dd6b15c
0x6dd6b15c
0x6dd6b15e
0x6dd6b15e
0x00000000
0x6dd6b15e
0x6dd6b128
0x6dd6b128
0x6dd6b160
0x6dd6b160
0x6dd6b1ce
0x6dd6b1ce
0x6dd6b1d7
0x6dd6b1da
0x6dd6b1db
0x6dd6b1db
0x6dd6b1df
0x6dd6b1e3
0x6dd6b1ed
0x6dd6b1ed
0x6dd6b1f0
0x6dd6b1f0
0x6dd6b162
0x6dd6b162
0x6dd6b162
0x6dd6b165
0x6dd6b165
0x6dd6b1c8
0x6dd6b1c8
0x6dd6b1c8
0x6dd6b1ca
0x6dd6b1cb
0x6dd6b1cc
0x6dd6b1cc
0x6dd6b1cd
0x6dd6b1cd
0x00000000
0x6dd6b167
0x6dd6b167
0x6dd6b168
0x6dd6b168
0x6dd6b170
0x6dd6b170
0x6dd6b170
0x6dd6b171
0x6dd6b171
0x6dd6b172
0x6dd6b173
0x6dd6b174
0x6dd6b175
0x6dd6b176
0x6dd6b179
0x6dd6b17b
0x6dd6b17b
0x6dd6b17c
0x6dd6b17c
0x6dd6b17f
0x6dd6b17f
0x6dd6b181
0x6dd6b1ff
0x6dd6b1ff
0x6dd6b183
0x6dd6b183
0x6dd6b184
0x6dd6b185
0x6dd6b188
0x6dd6b1aa
0x6dd6b1aa
0x6dd6b1ac
0x6dd6b1ac
0x6dd6b1af
0x6dd6b1af
0x6dd6b1b2
0x6dd6b1b2
0x6dd6b18a
0x6dd6b18a
0x6dd6b18c
0x6dd6b18f
0x6dd6b190
0x6dd6b190
0x6dd6b192
0x6dd6b196
0x6dd6b1b8
0x6dd6b1b8
0x6dd6b1bf
0x6dd6b1bf
0x6dd6b1c1
0x6dd6b1c2
0x6dd6b1c2
0x00000000
0x6dd6b198
0x6dd6b198
0x6dd6b19b
0x6dd6b19b
0x6dd6b19c
0x6dd6b19e
0x6dd6b1a0
0x6dd6b1a0
0x6dd6b1a1
0x6dd6b1a1
0x6dd6b216
0x6dd6b219
0x00000000
0x6dd6b1a3
0x6dd6b1a3
0x6dd6b1a4
0x6dd6b21a
0x6dd6b21a
0x6dd6b221
0x6dd6b227
0x6dd6b227
0x6dd6b227
0x6dd6b22a
0x6dd6b22b
0x6dd6b1a6
0x6dd6b1a6
0x6dd6b1a6
0x00000000
0x6dd6b1a6
0x6dd6b1a4
0x6dd6b1a1
0x6dd6b196
0x6dd6b188
0x6dd6b181
0x6dd6b165
0x6dd6b12a
0x6dd6b12a
0x6dd6b12c
0x6dd6b12d
0x6dd6b12d
0x00000000
0x6dd6b12d
0x6dd6b128
0x6dd6b126
0x6dd6b111
0x6dd6b0f9
0x6dd6b0f9
0x6dd6b0f9
0x6dd6b0fb
0x6dd6b0fb
0x00000000
0x6dd6b0fb
0x6dd6b0f7
0x6dd6b0f0
0x6dd6b05b
0x6dd6b05b
0x6dd6b062
0x6dd6b062
0x00000000
0x6dd6b062
0x6dd6b059
0x6dd6b04f
0x6dd6b04d
0x6dd6b046
0x6dd6b044
0x6dd6b03d
0x6dd6b03a
0x6dd6b009
0x6dd6b009
0x6dd6b00c
0x6dd6b00d
0x6dd6b00f
0x6dd6b017
0x6dd6b019
0x6dd6b024
0x6dd6b026
0x6dd6b027
0x6dd6b02e
0x6dd6b030
0x6dd6b031
0x6dd6b031
0x00000000
0x6dd6b031
0x6dd6b007
0x6dd6b005
0x6dd6b003
0x6dd64bcb
0x6dd64bce
0x6dd64bd1
0x6dd64bd7
0x6dd64bde
0x6dd64be5
0x6dd64bee
0x6dd64bf6
0x6dd64bfa
0x6dd64bfd
0x6dd64c03
0x6dd64c06
0x6dd64c08
0x00000000
0x6dd64c0e
0x6dd64c19
0x6dd64c19
0x6dd64c08
0x6dd64bc5
0x6dd64b22
0x6dd64afc
0x6dd64afc
0x6dd64b05
0x6dd64b05
0x6dd64a39
0x6dd64a39
0x6dd64a45
0x6dd64a45
0x6dd64a37

APIs

pthread_spin_destroy.LIBWINPTHREAD-1 ref: 6DD64A2F
GetCurrentThreadId.KERNEL32 ref: 6DD64A70
_ultoa.MSVCRT ref: 6DD64A89
OutputDebugStringA.KERNEL32 ref: 6DD64AC0
abort.MSVCRT(00000000), ref: 6DD64AC7
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,6DD65ADA,?,?,?,?,6DD66ADD), ref: 6DD64AED

Strings

Error cleaning up spin_keys for thread , xrefs: 6DD64A57, 6DD64AD2

Memory Dump Source

Source File: 00000004.00000002.787395814.000000006DD61000.00000040.00000001.01000000.0000000A.sdmp, Offset: 6DD60000, based on PE: true

Associated: 00000004.00000002.787383138.000000006DD60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787413037.000000006DD6B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787415936.000000006DD6F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787437708.000000006DD74000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787474619.000000006DDD6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787482411.000000006DDE6000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6dd60000_windowsconnect.jbxd

Similarity

API ID: CurrentDebugOutputStringThreadValue_ultoaabortpthread_spin_destroy
String ID: Error cleaning up spin_keys for thread
API String ID: 3968433069-2906507043
Opcode ID: c7fad06e4e7905b2e9ddd5e3d349302ab4b496195beee8e908eeb9b5524b273b
Instruction ID: 3191678c1949e0026f005a19fde3aae2efe0d742d4dfe2174a2ea051cad45759
Opcode Fuzzy Hash: c7fad06e4e7905b2e9ddd5e3d349302ab4b496195beee8e908eeb9b5524b273b
Instruction Fuzzy Hash: 1A21837150C381ABEB10BF78E8A872A7BF4EB8A318F400A29F594C6281D735C444C7F6

Uniqueness

Uniqueness Score: -1.00%

Function 6DD61517 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 37COMMON

Download Yara Rule

APIs

pthread_spin_lock.LIBWINPTHREAD-1 ref: 6DD61530
pthread_spin_unlock.LIBWINPTHREAD-1 ref: 6DD61555
fprintf.MSVCRT ref: 6DD61592
exit.MSVCRT ref: 6DD6159E

Strings

Assertion failed: (%s), file %s, line %d, xrefs: 6DD61587
(((barrier_t *)*barrier)->valid == LIFE_BARRIER) && (((barrier_t *)*barrier)->busy > 0), xrefs: 6DD6157F
&, xrefs: 6DD6156F

Memory Dump Source

Source File: 00000004.00000002.787395814.000000006DD61000.00000040.00000001.01000000.0000000A.sdmp, Offset: 6DD60000, based on PE: true

Associated: 00000004.00000002.787383138.000000006DD60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787413037.000000006DD6B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787415936.000000006DD6F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787437708.000000006DD74000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787474619.000000006DDD6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787482411.000000006DDE6000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6dd60000_windowsconnect.jbxd

Similarity

API ID: exitfprintfpthread_spin_lockpthread_spin_unlock
String ID: &$(((barrier_t *)*barrier)->valid == LIFE_BARRIER) && (((barrier_t *)*barrier)->busy > 0)$Assertion failed: (%s), file %s, line %d
API String ID: 2153800997-196132075
Opcode ID: 419aaca0014395b8640eb044223f20105ecfc65b27ee39da8e002c502fdabaac
Instruction ID: 98c075ad08e99c14bda6c865181c55a056ccb889a9d26fe4bf30f419091bff45
Opcode Fuzzy Hash: 419aaca0014395b8640eb044223f20105ecfc65b27ee39da8e002c502fdabaac
Instruction Fuzzy Hash: 0701E2715482A1DFCB10AF24D58975ABBE4FB46314F028818F6998B305D336A8848BE3

Uniqueness

Uniqueness Score: -1.00%

Function 6DD677B0 Relevance: 12.1, APIs: 8, Instructions: 138timethreadCOMMON

Download Yara Rule

APIs

QueryPerformanceFrequency.KERNEL32 ref: 6DD677E6
QueryPerformanceCounter.KERNEL32 ref: 6DD677FE
GetCurrentThread.KERNEL32 ref: 6DD678B9
GetThreadTimes.KERNEL32 ref: 6DD678E2
GetCurrentProcess.KERNEL32 ref: 6DD67950
GetProcessTimes.KERNEL32 ref: 6DD67979
_errno.MSVCRT ref: 6DD6798A
GetSystemTimeAsFileTime.KERNEL32 ref: 6DD679AF

Memory Dump Source

Source File: 00000004.00000002.787395814.000000006DD61000.00000040.00000001.01000000.0000000A.sdmp, Offset: 6DD60000, based on PE: true

Associated: 00000004.00000002.787383138.000000006DD60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787413037.000000006DD6B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787415936.000000006DD6F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787437708.000000006DD74000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787474619.000000006DDD6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787482411.000000006DDE6000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6dd60000_windowsconnect.jbxd

Similarity

API ID: CurrentPerformanceProcessQueryThreadTimeTimes$CounterFileFrequencySystem_errno
String ID:
API String ID: 3786581644-0
Opcode ID: 444ff45ed88dbdf23a0ad1106df193bd3af0fa9b216d30df6274d8e9d9ca6268
Instruction ID: 2909f964203b973408fef06d159f8eea452de49cbf15e9941da5158a2c5a66f8
Opcode Fuzzy Hash: 444ff45ed88dbdf23a0ad1106df193bd3af0fa9b216d30df6274d8e9d9ca6268
Instruction Fuzzy Hash: 9C51E0B5908381AFD700EF29C58466ABBF1BBC9394F05892EF89987214E335D944CF92

Uniqueness

Uniqueness Score: -1.00%

Function 6DD640A0 Relevance: 12.1, APIs: 8, Instructions: 133
COMMON

Download Yara Rule

C-Code - Quality: 49%

			E6DD640A0(void* __ecx, void* __edx, intOrPtr* _a4, intOrPtr _a8) {
				intOrPtr _v32;
				intOrPtr _v36;
				char _v40;
				signed int _v48;
				signed int _v52;
				intOrPtr _v68;
				intOrPtr _v72;
				void* __ebx;
				void* __esi;
				void* _t45;
				signed int _t47;
				signed int _t51;
				signed int _t54;
				signed int _t62;
				intOrPtr* _t64;
				intOrPtr* _t67;
				intOrPtr* _t68;
				signed int _t71;
				signed int _t73;
				signed int _t74;
				signed int _t78;
				signed int _t80;
				intOrPtr _t82;
				intOrPtr _t85;
				intOrPtr _t86;
				intOrPtr _t87;
				void* _t88;
				intOrPtr* _t89;

				_t89 = _t88 - 0x3c;
				_t68 = _a4;
				if(_t68 == 0 || _a8 == 0) {
					return 0x16;
				} else {
					_t45 = E6DD63AC0(_t68);
					if(_t45 == 0) {
						_t85 =  *_t68;
						_t86 = _t85 + 0x14;
						_v72 = _a8;
						 *_t89 = _t86;
						_t47 = E6DD63100(__edx);
						__eflags = _t47;
						if(_t47 != 0) {
							return E6DD637D0(_t68, _t68, _t47, _t85);
						} else {
							_t82 = _t85 + 0x18;
							 *_t89 = _t82;
							_v72 = _a8;
							_t51 = E6DD63100(__edx);
							_t78 = _t51;
							__eflags = _t51;
							if(_t51 != 0) {
								 *_t89 = _t86;
								_v52 = _t51;
								E6DD632E0();
								_t45 = E6DD637D0(_t68, _t68, _v52, _t85);
								goto L3;
							} else {
								__eflags =  *(_t85 + 8);
								if( *(_t85 + 8) == 0) {
									_t71 =  *(_t85 + 0x10);
									_t54 =  *(_t85 + 0xc);
									__eflags = _t71;
									if(_t71 > 0) {
										_t54 = _t54 - _t71;
										__eflags = _t54;
										 *(_t85 + 0x10) = 0;
										 *(_t85 + 0xc) = _t54;
									}
									__eflags = _t54;
									if(__eflags <= 0) {
										goto L7;
									} else {
										_v52 = _t78;
										_t87 = _t85 + 0x1c;
										 *(_t85 + 0x10) =  ~_t54;
										_v40 = 0x6dd637b0;
										_v36 = _t85;
										_v32 =  *((intOrPtr*)(E6DD65870(__eflags)));
										asm("lock or dword [esp], 0x0");
										 *((intOrPtr*)(E6DD65870(__eflags))) =  &_v40;
										asm("lock or dword [esp], 0x0");
										_t80 = _v52;
										while(1) {
											_v72 = _t82;
											 *_t89 = _t87;
											_v68 = _a8;
											_v52 = _t80;
											_t62 = E6DD62B40();
											_t80 = _v52;
											_t73 = _t62;
											__eflags =  *(_t85 + 0x10);
											if(__eflags >= 0) {
												break;
											}
											__eflags = _t73;
											if(__eflags != 0) {
												_v52 = _t73;
												_t64 = E6DD65870(__eflags);
												_t74 = _v52;
												 *_t64 = _v32;
												L21:
												_v52 = _t74;
												 *_t89 = _v36;
												_v40();
												_t78 = _v52;
											} else {
												continue;
											}
											goto L8;
										}
										_v48 = _t73;
										_v52 = _t80;
										_t67 = E6DD65870(__eflags);
										_t74 = _v48;
										_t78 = _v52;
										__eflags = _t74;
										 *_t67 = _v32;
										if(_t74 != 0) {
											goto L21;
										} else {
											 *(_t85 + 0xc) = 0;
											goto L7;
										}
									}
								} else {
									L7:
									asm("lock add dword [esi+0x8], 0x1");
								}
								L8:
								return E6DD637D0(_t68, _t68, _t78, _t85);
							}
						}
					} else {
						L3:
						return _t45;
					}
				}
			}

0x6dd640a4
0x6dd640a7
0x6dd640ad
0x6dd64134
0x6dd640b7
0x6dd640b9
0x6dd640c0
0x6dd640d0
0x6dd640d6
0x6dd640d9
0x6dd640dd
0x6dd640e0
0x6dd640e5
0x6dd640e7
0x6dd64148
0x6dd640e9
0x6dd640ed
0x6dd640f0
0x6dd640f3
0x6dd640f7
0x6dd640fc
0x6dd640fe
0x6dd64100
0x6dd64208
0x6dd6420b
0x6dd6420f
0x6dd6421a
0x00000000
0x6dd64106
0x6dd64109
0x6dd6410b
0x6dd64150
0x6dd64153
0x6dd64156
0x6dd64158
0x6dd6415a
0x6dd6415a
0x6dd6415c
0x6dd64163
0x6dd64163
0x6dd64166
0x6dd64168
0x00000000
0x6dd6416a
0x6dd6416c
0x6dd64170
0x6dd64173
0x6dd64176
0x6dd6417e
0x6dd64189
0x6dd6418d
0x6dd6419b
0x6dd6419d
0x6dd641a2
0x6dd641b4
0x6dd641b8
0x6dd641bc
0x6dd641bf
0x6dd641c3
0x6dd641c7
0x6dd641cc
0x6dd641d0
0x6dd641d5
0x6dd641d7
0x00000000
0x00000000
0x6dd641b0
0x6dd641b2
0x6dd64228
0x6dd6422c
0x6dd64235
0x6dd64239
0x6dd6423b
0x6dd6423f
0x6dd64243
0x6dd64246
0x6dd6424e
0x00000000
0x00000000
0x00000000
0x00000000
0x6dd641b2
0x6dd641d9
0x6dd641dd
0x6dd641e1
0x6dd641e6
0x6dd641ee
0x6dd641f2
0x6dd641f4
0x6dd641f6
0x00000000
0x6dd641f8
0x6dd641f8
0x00000000
0x6dd641f8
0x6dd641f6
0x6dd6410d
0x6dd6410d
0x6dd6410d
0x6dd6410d
0x6dd64112
0x6dd64120
0x6dd64120
0x6dd64100
0x6dd640c2
0x6dd640c2
0x6dd640c9
0x6dd640c9
0x6dd640c0

APIs

Part of subcall function 6DD63AC0: pthread_spin_lock.LIBWINPTHREAD-1(?,?,?,?,6DD63C32), ref: 6DD63AD8
Part of subcall function 6DD63AC0: pthread_spin_unlock.LIBWINPTHREAD-1(?,?,?,?,6DD63C32), ref: 6DD63AEA

pthread_mutex_timedlock.LIBWINPTHREAD-1 ref: 6DD640E0
pthread_mutex_timedlock.LIBWINPTHREAD-1 ref: 6DD640F7

Memory Dump Source

Source File: 00000004.00000002.787395814.000000006DD61000.00000040.00000001.01000000.0000000A.sdmp, Offset: 6DD60000, based on PE: true

Associated: 00000004.00000002.787383138.000000006DD60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787413037.000000006DD6B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787415936.000000006DD6F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787437708.000000006DD74000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787474619.000000006DDD6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787482411.000000006DDE6000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6dd60000_windowsconnect.jbxd

Similarity

API ID: pthread_mutex_timedlock$pthread_spin_lockpthread_spin_unlock
String ID:
API String ID: 2118215603-0
Opcode ID: ce5d5ac1b38ced676b9d84f3a2cb0c00e0a86fbfd5f4ca7d0dba31cf9706f34c
Instruction ID: 47256504882f5b4333e7c722a42f48f346cf436c6da633cc134c617bcbe91194
Opcode Fuzzy Hash: ce5d5ac1b38ced676b9d84f3a2cb0c00e0a86fbfd5f4ca7d0dba31cf9706f34c
Instruction Fuzzy Hash: A54149B460C7428FD314EF29D49061BFBE0AF98358F01892DF98987711D734E9498BE2

Uniqueness

Uniqueness Score: -1.00%

Function 6DD629D0 Relevance: 12.1, APIs: 8, Instructions: 99COMMON

Download Yara Rule

APIs

_pthread_rel_time_in_ms.LIBWINPTHREAD-1 ref: 6DD62A16

Part of subcall function 6DD62D00: GetSystemTimeAsFileTime.KERNEL32 ref: 6DD62D49

RtlEnterCriticalSection.NTDLL ref: 6DD62A36
RtlLeaveCriticalSection.NTDLL ref: 6DD62A46
pthread_getclean.LIBWINPTHREAD-1 ref: 6DD62A6F
pthread_getclean.LIBWINPTHREAD-1 ref: 6DD62A7F
pthread_mutex_unlock.LIBWINPTHREAD-1 ref: 6DD62A92
pthread_getclean.LIBWINPTHREAD-1 ref: 6DD62A9F
_pthread_time_in_ms_from_timespec.LIBWINPTHREAD-1 ref: 6DD62AC8

Memory Dump Source

Source File: 00000004.00000002.787395814.000000006DD61000.00000040.00000001.01000000.0000000A.sdmp, Offset: 6DD60000, based on PE: true

Associated: 00000004.00000002.787383138.000000006DD60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787413037.000000006DD6B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787415936.000000006DD6F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787437708.000000006DD74000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787474619.000000006DDD6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787482411.000000006DDE6000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6dd60000_windowsconnect.jbxd

Similarity

API ID: pthread_getclean$CriticalSectionTime$EnterFileLeaveSystem_pthread_rel_time_in_ms_pthread_time_in_ms_from_timespecpthread_mutex_unlock
String ID:
API String ID: 3334244777-0
Opcode ID: 811c4e46b8bd990d28ba72e560ab196d9e3c054cdee65570b55fab7a9a3d65af
Instruction ID: d550b1fd224ae38e3c8906762d26c81631652d3ba92490900fd063cdd767c60f
Opcode Fuzzy Hash: 811c4e46b8bd990d28ba72e560ab196d9e3c054cdee65570b55fab7a9a3d65af
Instruction Fuzzy Hash: C3314A70508781DFD720EF29C88062ABBE4AF88368F414A6DF895CB351D770D944CBE2

Uniqueness

Uniqueness Score: -1.00%

Function 6DD64C60 Relevance: 12.1, APIs: 8, Instructions: 72COMMON

Download Yara Rule

APIs

__pth_gpointer_locked.LIBWINPTHREAD-1(?,?,?,?,?,?,00000000,?,?,?,6DD658D2,?,?,?,0000001C,6DD65A6F), ref: 6DD64C6A

Part of subcall function 6DD64C20: pthread_mutex_lock.LIBWINPTHREAD-1(?,?,00000000,?,6DD64C6F,?,?,?,?,?,?,00000000,?,?,?,6DD658D2), ref: 6DD64C36
Part of subcall function 6DD64C20: pthread_mutex_unlock.LIBWINPTHREAD-1(?,?,00000000,?,6DD64C6F,?,?,?,?,?,?,00000000,?,?,?,6DD658D2), ref: 6DD64C4B

pthread_spin_lock.LIBWINPTHREAD-1 ref: 6DD64C8B
pthread_rwlock_rdlock.LIBWINPTHREAD-1 ref: 6DD64CCE
pthread_spin_unlock.LIBWINPTHREAD-1 ref: 6DD64CF2
pthread_spin_lock.LIBWINPTHREAD-1 ref: 6DD64D05
pthread_rwlock_unlock.LIBWINPTHREAD-1 ref: 6DD64D1C
pthread_spin_unlock.LIBWINPTHREAD-1 ref: 6DD64D29
pthread_spin_unlock.LIBWINPTHREAD-1 ref: 6DD64D53

Memory Dump Source

Source File: 00000004.00000002.787395814.000000006DD61000.00000040.00000001.01000000.0000000A.sdmp, Offset: 6DD60000, based on PE: true

Associated: 00000004.00000002.787383138.000000006DD60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787413037.000000006DD6B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787415936.000000006DD6F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787437708.000000006DD74000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787474619.000000006DDD6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787482411.000000006DDE6000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6dd60000_windowsconnect.jbxd

Similarity

API ID: pthread_spin_unlock$pthread_spin_lock$__pth_gpointer_lockedpthread_mutex_lockpthread_mutex_unlockpthread_rwlock_rdlockpthread_rwlock_unlock
String ID:
API String ID: 4251901166-0
Opcode ID: 89806073b60372292dfc624521dbc987a403568ed987b0fdf030bf6344a8f874
Instruction ID: 0cf4ea24f9b202388cf6e997bac64db82a972bcfd85efa34c020cc3bafe2a648
Opcode Fuzzy Hash: 89806073b60372292dfc624521dbc987a403568ed987b0fdf030bf6344a8f874
Instruction Fuzzy Hash: C5217C7094C28A8FD710BF25D894A6ABBB0BF49318F06081DE5814BB52DB35A494CBF2

Uniqueness

Uniqueness Score: -1.00%

Function 6DD65DF7 Relevance: 12.1, APIs: 8, Instructions: 53
threadinjectionsynchronizationCOMMON

Download Yara Rule

C-Code - Quality: 16%

			E6DD65DF7(void* __ebx, void* __edi, intOrPtr __ebp, intOrPtr _a4, intOrPtr _a20, intOrPtr _a204) {
				intOrPtr _t23;
				intOrPtr* _t25;

				_t23 = __ebp;
				__eax =  *(__ebx + 0x14);
				_a20 = 0x10001;
				__eax = SuspendThread( *(__ebx + 0x14));
				__esp = __esp - 4;
				_a4 = 0;
				__eax =  *(__ebx + 0x14);
				 *__esp =  *(__ebx + 0x14);
				__eax = WaitForSingleObject(??, ??);
				__esp = __esp - 8;
				if(__eax == 0x102) {
					_a4 = __edi;
					__eax =  *(__ebx + 0x14);
					 *__esp =  *(__ebx + 0x14);
					__eax = GetThreadContext(??, ??);
					__esp = __esp - 8;
					_a4 = __edi;
					__eax =  *(__ebx + 0x14);
					_a204 = L6DD65A10;
					 *__esp =  *(__ebx + 0x14);
					SetThreadContext(??, ??) =  *(__ebx + 0x20) & 0x000000ff;
					 *(__ebx + 0x24) =  *(__ebx + 0x24) & 0xfffffffe;
					__esp = __esp - 8;
					 *(__ebx + 0x20) & 0xf0 =  *(__ebx + 0x20) & 0xf0 | 0x00000005;
					 *(__ebx + 0x20) = __al;
					asm("lock add dword [0x6dd6c058], 0x1");
					__eax =  *(__ebx + 0x18);
					if(__eax != 0) {
						__eax = SetEvent(__eax);
						__esp = __esp - 4;
					}
					E6DD632E0(__ebp) =  *(__ebx + 0x14);
					__eax = ResumeThread( *(__ebx + 0x14));
					__esp = __esp - 4;
				}
				 *_t25 = _t23;
				E6DD632E0();
				return 0;
			}

0x6dd65df7
0x6dd65e00
0x6dd65e03
0x6dd65e0e
0x6dd65e14
0x6dd65e17
0x6dd65e1f
0x6dd65e22
0x6dd65e25
0x6dd65e2b
0x6dd65e33
0x6dd65e39
0x6dd65e3d
0x6dd65e40
0x6dd65e43
0x6dd65e49
0x6dd65e4c
0x6dd65e50
0x6dd65e53
0x6dd65e5e
0x6dd65e67
0x6dd65e6b
0x6dd65e6f
0x6dd65e75
0x6dd65e78
0x6dd65e7b
0x6dd65e83
0x6dd65e88
0x6dd65e8d
0x6dd65e93
0x6dd65e93
0x6dd65e9e
0x6dd65ea4
0x6dd65eaa
0x6dd65eaa
0x6dd65d4b
0x6dd65d4e
0x6dd65d5f

APIs

pthread_mutex_unlock.LIBWINPTHREAD-1 ref: 6DD65D4E
SuspendThread.KERNEL32 ref: 6DD65E0E
WaitForSingleObject.KERNEL32 ref: 6DD65E25
GetThreadContext.KERNEL32 ref: 6DD65E43
SetThreadContext.KERNEL32 ref: 6DD65E61
SetEvent.KERNEL32 ref: 6DD65E8D
pthread_mutex_unlock.LIBWINPTHREAD-1 ref: 6DD65E99
ResumeThread.KERNEL32 ref: 6DD65EA4

Memory Dump Source

Source File: 00000004.00000002.787395814.000000006DD61000.00000040.00000001.01000000.0000000A.sdmp, Offset: 6DD60000, based on PE: true

Associated: 00000004.00000002.787383138.000000006DD60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787413037.000000006DD6B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787415936.000000006DD6F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787437708.000000006DD74000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787474619.000000006DDD6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787482411.000000006DDE6000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6dd60000_windowsconnect.jbxd

Similarity

API ID: Thread$Contextpthread_mutex_unlock$EventObjectResumeSingleSuspendWait
String ID:
API String ID: 548557552-0
Opcode ID: cb309ea5d1e9191d542685169890d938d0a3a1446f7bd07b8b4bab517978e196
Instruction ID: d5a456ee2166493689f399d7b82fda275db90d878d71182a8f296a06543f8af1
Opcode Fuzzy Hash: cb309ea5d1e9191d542685169890d938d0a3a1446f7bd07b8b4bab517978e196
Instruction Fuzzy Hash: 5E11F9B15086808FDB00BF78D68966ABFF0BB45315F014A6DE895CB246D734D498CFB2

Uniqueness

Uniqueness Score: -1.00%

Function 6DD62397 Relevance: 12.1, APIs: 8, Instructions: 52
COMMON

Download Yara Rule

C-Code - Quality: 24%

			E6DD62397(void* __ebx, void* __edi, void* __esi, void* __ebp, int _a24, int _a28, int _a60) {
				void* _t17;

				_t17 = __esi;
				__eax = __ebx + 0x14;
				_a28 = __eax;
				 *__esp = __eax;
				__eax =  *0x6dd6f23c();
				__esp = __esp - 4;
				__eflags = __eax;
				__eax =  *(__ebx + 0x68);
				if(__eflags == 0) {
					 *__esp = __ebp;
					__ecx = __edi;
					__edx = 1;
					__esi = 0x10;
					__eax = E6DD61A20(__eax, __edi, 1);
					goto L1;
				} else {
					__edx =  *((intOrPtr*)(__ebx + 0x10));
					__eflags =  *((intOrPtr*)(__ebx + 8)) -  *((intOrPtr*)(__ebx + 0x10));
					if( *((intOrPtr*)(__ebx + 8)) >  *((intOrPtr*)(__ebx + 0x10))) {
						 *__esp = __ebp;
						__ecx = __edi;
						__edx = 1;
						__eax = E6DD61A20(__eax, __edi, 1);
						__eflags = __eax;
						__esi = __eax;
						__eax = 0x10;
						__esi =  ==  ? 0x10 : __esi;
						__eax = _a24;
						 *__esp = _a24;
						__eax =  *0x6dd6f1e0();
						__esp = __esp - 4;
						L1:
						return _t17;
					} else {
						__ecx = _a60;
						__edx = 1;
						 *_a60 = 0;
						__ecx = __edi;
						 *__esp = __ebp;
						__eax =  *(__ebx + 0x64);
						__ebp =  *0x6dd6f184;
						CloseHandle( *(__ebx + 0x64)) =  *(__ebx + 0x68);
						__esp = __esp - 4;
						__eax = CloseHandle( *(__ebx + 0x68));
						__esp = __esp - 4;
						__ebp = _a24;
						 *__esp = __ebp;
						__eax =  *0x6dd6f1e0();
						__esp = __esp - 4;
						 *__esp = __ebp;
						__ebp =  *0x6dd6f190;
						__eax =  *__ebp();
						__esp = __esp - 4;
						 *__esp = __edi;
						 *__ebp() = __ebx + 0x2c;
						__esp = __esp - 4;
						 *__esp = __ebx + 0x2c;
						__eax =  *__ebp();
						__esp = __esp - 4;
						 *__esp = __ebx;
						L6DD69400();
						__esp =  &(__esp[0xb]);
						__eax = __esi;
						_pop(__ebx);
						_pop(__esi);
						_pop(__edi);
						_pop(__ebp);
						return __esi;
					}
				}
			}

0x6dd62397
0x6dd623a0
0x6dd623a3
0x6dd623a7
0x6dd623aa
0x6dd623b0
0x6dd623b3
0x6dd623b5
0x6dd623b8
0x6dd624c0
0x6dd624c3
0x6dd624c5
0x6dd624ca
0x6dd624cf
0x00000000
0x6dd623be
0x6dd623be
0x6dd623c1
0x6dd623c4
0x6dd62440
0x6dd62443
0x6dd62445
0x6dd6244a
0x6dd6244f
0x6dd62451
0x6dd62453
0x6dd62458
0x6dd6245b
0x6dd6245f
0x6dd62462
0x6dd62468
0x6dd6238d
0x6dd62396
0x6dd623c6
0x6dd623c6
0x6dd623ca
0x6dd623cf
0x6dd623d5
0x6dd623d7
0x6dd623df
0x6dd623e2
0x6dd623ed
0x6dd623f0
0x6dd623f6
0x6dd623f8
0x6dd623fb
0x6dd623ff
0x6dd62402
0x6dd62408
0x6dd6240b
0x6dd6240e
0x6dd62414
0x6dd62416
0x6dd62419
0x6dd6241e
0x6dd62421
0x6dd62424
0x6dd62427
0x6dd62429
0x6dd6242c
0x6dd6242f
0x6dd62434
0x6dd62437
0x6dd62439
0x6dd6243a
0x6dd6243b
0x6dd6243c
0x6dd6243d
0x6dd6243d
0x6dd623c4

APIs

RtlTryEnterCriticalSection.NTDLL ref: 6DD623AA
RtlLeaveCriticalSection.NTDLL ref: 6DD62462

Part of subcall function 6DD61A20: RtlEnterCriticalSection.NTDLL ref: 6DD61A37
Part of subcall function 6DD61A20: ReleaseSemaphore.KERNEL32 ref: 6DD61A8E
Part of subcall function 6DD61A20: RtlLeaveCriticalSection.NTDLL ref: 6DD61A9E

CloseHandle.KERNEL32 ref: 6DD623EB
CloseHandle.KERNEL32 ref: 6DD623F6
RtlLeaveCriticalSection.NTDLL ref: 6DD62402
RtlDeleteCriticalSection.NTDLL ref: 6DD62414
RtlDeleteCriticalSection.NTDLL ref: 6DD6241C
RtlDeleteCriticalSection.NTDLL ref: 6DD62427
??3@YAXPAX@Z.MSVCRT ref: 6DD6242F

Memory Dump Source

Source File: 00000004.00000002.787395814.000000006DD61000.00000040.00000001.01000000.0000000A.sdmp, Offset: 6DD60000, based on PE: true

Associated: 00000004.00000002.787383138.000000006DD60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787413037.000000006DD6B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787415936.000000006DD6F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787437708.000000006DD74000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787474619.000000006DDD6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787482411.000000006DDE6000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6dd60000_windowsconnect.jbxd

Similarity

API ID: CriticalSection$DeleteLeave$CloseEnterHandle$??3@ReleaseSemaphore
String ID:
API String ID: 2371872607-0
Opcode ID: a6c5e95c2a33a867f4378d3c707b79faefe9ecd6bc70b5084b7f774c6d095de3
Instruction ID: 8c6b8b64c2cb63caa7a6f21b0027a7331f461a7cb8a336b775e454e2ca0c1774
Opcode Fuzzy Hash: a6c5e95c2a33a867f4378d3c707b79faefe9ecd6bc70b5084b7f774c6d095de3
Instruction Fuzzy Hash: 8C11C5B55046448FDB00BF78D58522ABBF4FB55244F01097DD98A8B20AEB34E859CB96

Uniqueness

Uniqueness Score: -1.00%

Function 6DD63100 Relevance: 10.6, APIs: 7, Instructions: 140COMMON

Download Yara Rule

APIs

_pthread_time_in_ms_from_timespec.LIBWINPTHREAD-1 ref: 6DD6311B
_pthread_time_in_ms.LIBWINPTHREAD-1 ref: 6DD63124

Part of subcall function 6DD62C50: GetSystemTimeAsFileTime.KERNEL32 ref: 6DD62C5D

Memory Dump Source

Source File: 00000004.00000002.787395814.000000006DD61000.00000040.00000001.01000000.0000000A.sdmp, Offset: 6DD60000, based on PE: true

Associated: 00000004.00000002.787383138.000000006DD60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787413037.000000006DD6B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787415936.000000006DD6F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787437708.000000006DD74000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787474619.000000006DDD6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787482411.000000006DDE6000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6dd60000_windowsconnect.jbxd

Similarity

API ID: Time$FileSystem_pthread_time_in_ms_pthread_time_in_ms_from_timespec
String ID:
API String ID: 1543282791-0
Opcode ID: bb283dfc775b5cee94c5c2076eed499411007ef17b3f2022a90d146b353115b6
Instruction ID: 8a459e44d8951a0a30299f66c4930d9a6082a837733db62ae2713e6277f41cb5
Opcode Fuzzy Hash: bb283dfc775b5cee94c5c2076eed499411007ef17b3f2022a90d146b353115b6
Instruction Fuzzy Hash: 714160717083868FDB04AF69C89072AB7F5EB86354F18843DF9588B345DB38C8458BE1

Uniqueness

Uniqueness Score: -1.00%

Function 6DD64650 Relevance: 10.6, APIs: 7, Instructions: 107
COMMON

Download Yara Rule

C-Code - Quality: 21%

			E6DD64650(intOrPtr* __eax) {
				intOrPtr _t27;
				intOrPtr _t29;
				intOrPtr _t30;
				intOrPtr _t31;
				intOrPtr _t34;
				intOrPtr _t36;
				signed int _t38;
				signed int _t39;
				intOrPtr _t44;
				intOrPtr* _t46;
				intOrPtr _t54;
				int _t55;
				signed int _t56;
				intOrPtr _t62;
				intOrPtr _t65;
				intOrPtr _t69;
				void* _t73;
				intOrPtr* _t74;
				intOrPtr* _t75;

				if(__eax == 0) {
					return __eax;
				} else {
					_t46 = __eax;
					_t74 = _t73 - 0x2c;
					_t27 =  *((intOrPtr*)(__eax + 0xb0));
					if(_t27 == 0) {
						 *_t74 = 0x6dd6a018;
						E6DD62F90();
						_t65 =  *((intOrPtr*)(_t46 + 0xb4));
						__eflags = _t65;
						if(_t65 != 0) {
							_t69 =  *0x6dd6c038;
							__eflags = _t69;
							if(_t69 != 0) {
								_t36 = _t69 - 1;
								_t62 =  *0x6dd6c03c;
								_t55 = 0;
								 *((intOrPtr*)(_t74 + 0x1c)) = _t36;
								_t54 = _t36;
								while(1) {
									_t38 = _t55 + _t54 >> 1;
									__eflags = _t65 -  *((intOrPtr*)(_t62 + 4 + _t38 * 8));
									if(__eflags == 0) {
										break;
									}
									if(__eflags < 0) {
										__eflags = _t38 - _t55;
										if(_t38 != _t55) {
											_t54 = _t38 - 1;
											goto L17;
										}
									} else {
										_t55 = _t38 + 1;
										L17:
										__eflags = _t54 - _t55;
										if(_t54 >= _t55) {
											continue;
										}
									}
									goto L4;
								}
								_t39 = _t38 + 1;
								__eflags = _t69 - _t39;
								if(_t69 > _t39) {
									_t56 = _t39 * 8;
									 *(_t74 + 8) = (_t69 - _t39) * 8;
									 *((intOrPtr*)(_t74 + 4)) = _t62 + _t56;
									 *_t74 = _t62 + _t56 - 8;
									memmove(??, ??, ??);
								}
								_t44 =  *((intOrPtr*)(_t74 + 0x1c));
								 *0x6dd6c038 = _t44;
								__eflags = _t44;
								if(_t44 == 0) {
									 *_t74 = _t62;
									L6DD69400();
									 *0x6dd6c034 = 0;
									 *0x6dd6c038 = 0;
								}
							}
						}
						L4:
						_t29 =  *((intOrPtr*)(_t46 + 0x2c));
						__eflags = _t29;
						if(_t29 != 0) {
							 *_t74 = _t29;
							L6DD69400();
						}
						_t30 =  *((intOrPtr*)(_t46 + 0x30));
						__eflags = _t30;
						if(_t30 != 0) {
							 *_t74 = _t30;
							L6DD69400();
						}
						_t31 =  *((intOrPtr*)(_t46 + 0x34));
						__eflags = _t31;
						if(_t31 != 0) {
							 *_t74 = _t31;
							L6DD69400();
						}
						_t6 = _t46 + 4; // 0x4
						 *_t46 = 0;
						 *((intOrPtr*)(_t46 + 0xb4)) = 0;
						memset(_t6 & 0xfffffffc, 0, _t46 - (_t6 & 0xfffffffc) + 0xb8 >> 2 << 2);
						_t75 = _t74 + 0xc;
						_t34 =  *0x6dd6c040;
						__eflags = _t34;
						if(_t34 == 0) {
							 *0x6dd6c040 = _t46;
							 *0x6dd6c044 = _t46;
						} else {
							 *((intOrPtr*)(_t34 + 0xb0)) = _t46;
							 *0x6dd6c040 = _t46;
						}
						 *_t75 = 0x6dd6a018;
						return E6DD632E0();
					} else {
						return _t27;
					}
				}
			}

0x6dd64652
0x6dd64770
0x6dd64658
0x6dd6465c
0x6dd6465e
0x6dd64661
0x6dd64669
0x6dd64678
0x6dd6467f
0x6dd64684
0x6dd6468a
0x6dd6468c
0x6dd64710
0x6dd64716
0x6dd64718
0x6dd6471e
0x6dd64721
0x6dd64727
0x6dd64729
0x6dd6472d
0x6dd6474b
0x6dd6474e
0x6dd64750
0x6dd64754
0x00000000
0x00000000
0x6dd64756
0x6dd64738
0x6dd6473a
0x6dd64740
0x00000000
0x6dd64740
0x6dd64758
0x6dd64758
0x6dd64743
0x6dd64743
0x6dd64745
0x00000000
0x00000000
0x6dd64745
0x00000000
0x6dd64756
0x6dd64778
0x6dd6477b
0x6dd6477d
0x6dd647b3
0x6dd647c1
0x6dd647c8
0x6dd647d0
0x6dd647d3
0x6dd647d3
0x6dd6477f
0x6dd64783
0x6dd64788
0x6dd6478a
0x6dd64790
0x6dd64793
0x6dd64798
0x6dd647a2
0x6dd647a2
0x6dd6478a
0x6dd64718
0x6dd64692
0x6dd64692
0x6dd64695
0x6dd64697
0x6dd64699
0x6dd6469c
0x6dd6469c
0x6dd646a1
0x6dd646a4
0x6dd646a6
0x6dd646a8
0x6dd646ab
0x6dd646ab
0x6dd646b0
0x6dd646b3
0x6dd646b5
0x6dd646b7
0x6dd646ba
0x6dd646ba
0x6dd646bf
0x6dd646c6
0x6dd646cc
0x6dd646e4
0x6dd646e4
0x6dd646e6
0x6dd646eb
0x6dd646ed
0x6dd64760
0x6dd64766
0x6dd646ef
0x6dd646ef
0x6dd646f5
0x6dd646f5
0x6dd646fb
0x6dd6470e
0x6dd6466b
0x6dd64672
0x6dd64672
0x6dd64669

APIs

pthread_mutex_lock.LIBWINPTHREAD-1(?,?,?,?,00000000,?,?,?,6DD65959,?,?,?,?,?,0000001C,6DD65A6F), ref: 6DD6467F
??3@YAXPAX@Z.MSVCRT ref: 6DD6469C
??3@YAXPAX@Z.MSVCRT ref: 6DD646AB
??3@YAXPAX@Z.MSVCRT ref: 6DD646BA
pthread_mutex_unlock.LIBWINPTHREAD-1(?,?,?,?,00000000,?,?,?,6DD65959,?,?,?,?,?,0000001C,6DD65A6F), ref: 6DD64702

Memory Dump Source

Source File: 00000004.00000002.787395814.000000006DD61000.00000040.00000001.01000000.0000000A.sdmp, Offset: 6DD60000, based on PE: true

Associated: 00000004.00000002.787383138.000000006DD60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787413037.000000006DD6B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787415936.000000006DD6F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787437708.000000006DD74000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787474619.000000006DDD6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787482411.000000006DDE6000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6dd60000_windowsconnect.jbxd

Similarity

API ID: ??3@$pthread_mutex_lockpthread_mutex_unlock
String ID:
API String ID: 4211330938-0
Opcode ID: d06d64cf066315536dc193957c4918890dcc268bceea01dff6c59e2cbb118704
Instruction ID: fbcd939379da61230f94406c23cf3d59f62401900786b2488c6b6be4e66b0b0c
Opcode Fuzzy Hash: d06d64cf066315536dc193957c4918890dcc268bceea01dff6c59e2cbb118704
Instruction Fuzzy Hash: 5841827160C682CBDB10FF69D4A07AA7BF5FB49344F418929E648CB205E7719544CBF1

Uniqueness

Uniqueness Score: -1.00%

Function 6DD62883 Relevance: 10.6, APIs: 7, Instructions: 98COMMON

Download Yara Rule

APIs

RtlEnterCriticalSection.NTDLL ref: 6DD628A3
RtlLeaveCriticalSection.NTDLL ref: 6DD628BC
pthread_mutex_lock.LIBWINPTHREAD-1 ref: 6DD628EA

Part of subcall function 6DD61A20: RtlEnterCriticalSection.NTDLL ref: 6DD61A37
Part of subcall function 6DD61A20: ReleaseSemaphore.KERNEL32 ref: 6DD61A8E
Part of subcall function 6DD61A20: RtlLeaveCriticalSection.NTDLL ref: 6DD61A9E

RtlLeaveCriticalSection.NTDLL ref: 6DD62913
pthread_mutex_lock.LIBWINPTHREAD-1 ref: 6DD62922

Memory Dump Source

Source File: 00000004.00000002.787395814.000000006DD61000.00000040.00000001.01000000.0000000A.sdmp, Offset: 6DD60000, based on PE: true

Associated: 00000004.00000002.787383138.000000006DD60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787413037.000000006DD6B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787415936.000000006DD6F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787437708.000000006DD74000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787474619.000000006DDD6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787482411.000000006DDE6000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6dd60000_windowsconnect.jbxd

Similarity

API ID: CriticalSection$Leave$Enterpthread_mutex_lock$ReleaseSemaphore
String ID:
API String ID: 1224211229-0
Opcode ID: 4dff76a8ba5b384ddfb6ff80a7942ba3a602da96aa61a5ce9710f99103710cb6
Instruction ID: 9646cec89766d448fe1f7d81cc34d071c1bb9cf4a1ad9031559024bb104066a3
Opcode Fuzzy Hash: 4dff76a8ba5b384ddfb6ff80a7942ba3a602da96aa61a5ce9710f99103710cb6
Instruction Fuzzy Hash: 9E4106705087858FDB10FF29C48462ABBF0FF85358F014969EDA58B245E734E945CBE2

Uniqueness

Uniqueness Score: -1.00%

Function 6DD66EF0 Relevance: 10.6, APIs: 7, Instructions: 92COMMON

Download Yara Rule

APIs

_pthread_rel_time_in_ms.LIBWINPTHREAD-1 ref: 6DD66F12

Part of subcall function 6DD62D00: GetSystemTimeAsFileTime.KERNEL32 ref: 6DD62D49

Part of subcall function 6DD66A90: pthread_mutex_lock.LIBWINPTHREAD-1 ref: 6DD66AB3

pthread_mutex_unlock.LIBWINPTHREAD-1 ref: 6DD66F5E
pthread_getclean.LIBWINPTHREAD-1 ref: 6DD66F88
pthread_getclean.LIBWINPTHREAD-1 ref: 6DD66F98
pthread_getclean.LIBWINPTHREAD-1 ref: 6DD66FCE
_errno.MSVCRT ref: 6DD67001
sem_wait.LIBWINPTHREAD-1 ref: 6DD6701B

Memory Dump Source

Source File: 00000004.00000002.787395814.000000006DD61000.00000040.00000001.01000000.0000000A.sdmp, Offset: 6DD60000, based on PE: true

Associated: 00000004.00000002.787383138.000000006DD60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787413037.000000006DD6B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787415936.000000006DD6F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787437708.000000006DD74000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787474619.000000006DDD6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787482411.000000006DDE6000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6dd60000_windowsconnect.jbxd

Similarity

API ID: pthread_getclean$Time$FileSystem_errno_pthread_rel_time_in_mspthread_mutex_lockpthread_mutex_unlocksem_wait
String ID:
API String ID: 3124810977-0
Opcode ID: 60b23a9d83d8e3e2a391f00f3eeac98732c3d975bba434be7270b1b17539ec41
Instruction ID: 7f0656968de9c967b962e4c3684ca37f3de52b45bee6de72a37e33fa52af4aed
Opcode Fuzzy Hash: 60b23a9d83d8e3e2a391f00f3eeac98732c3d975bba434be7270b1b17539ec41
Instruction Fuzzy Hash: 543135B56093419FD300AF29C48461EBBE4AF883A8F454A6DF998D7361E730D9448FE2

Uniqueness

Uniqueness Score: -1.00%

Function 6DD658B0 Relevance: 10.6, APIs: 7, Instructions: 63COMMON

Download Yara Rule

APIs

Part of subcall function 6DD64AD0: TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,6DD65ADA,?,?,?,?,6DD66ADD), ref: 6DD64AED

_longjmpex.MSVCRT ref: 6DD658E6
TlsGetValue.KERNEL32(?,?,?,0000001C,6DD65A6F,?,?,?,?,00000000,6DD65B55,?,?,?,?,6DD66ADD), ref: 6DD658F4
CloseHandle.KERNEL32(?,?,?,?,0000001C,6DD65A6F,?,?,?,?,00000000,6DD65B55,?,?,?,?), ref: 6DD6591B
_endthreadex.MSVCRT(?,?,?,?,0000001C,6DD65A6F,?,?,?,?,00000000,6DD65B55,?,?,?,?), ref: 6DD65932
CloseHandle.KERNEL32(?,?,?,?,0000001C,6DD65A6F,?,?,?,?,00000000,6DD65B55,?,?,?,?), ref: 6DD65944
TlsSetValue.KERNEL32 ref: 6DD65969
CloseHandle.KERNEL32(?,?,?,?,0000001C,6DD65A6F,?,?,?,?,00000000,6DD65B55,?,?,?,?), ref: 6DD65980

Part of subcall function 6DD64C60: __pth_gpointer_locked.LIBWINPTHREAD-1(?,?,?,?,?,?,00000000,?,?,?,6DD658D2,?,?,?,0000001C,6DD65A6F), ref: 6DD64C6A
Part of subcall function 6DD64C60: pthread_spin_lock.LIBWINPTHREAD-1 ref: 6DD64C8B
Part of subcall function 6DD64C60: pthread_rwlock_rdlock.LIBWINPTHREAD-1 ref: 6DD64CCE
Part of subcall function 6DD64C60: pthread_spin_unlock.LIBWINPTHREAD-1 ref: 6DD64CF2
Part of subcall function 6DD64C60: pthread_spin_lock.LIBWINPTHREAD-1 ref: 6DD64D05
Part of subcall function 6DD64C60: pthread_rwlock_unlock.LIBWINPTHREAD-1 ref: 6DD64D1C
Part of subcall function 6DD64C60: pthread_spin_unlock.LIBWINPTHREAD-1 ref: 6DD64D29

Memory Dump Source

Source File: 00000004.00000002.787395814.000000006DD61000.00000040.00000001.01000000.0000000A.sdmp, Offset: 6DD60000, based on PE: true

Associated: 00000004.00000002.787383138.000000006DD60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787413037.000000006DD6B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787415936.000000006DD6F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787437708.000000006DD74000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787474619.000000006DDD6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787482411.000000006DDE6000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6dd60000_windowsconnect.jbxd

Similarity

API ID: CloseHandleValue$pthread_spin_lockpthread_spin_unlock$__pth_gpointer_locked_endthreadex_longjmpexpthread_rwlock_rdlockpthread_rwlock_unlock
String ID:
API String ID: 1570456468-0
Opcode ID: d906fb7144c9cfa1d4da8c4cd65666013e34053fc02c7a82f9e15f1abe54c728
Instruction ID: b6c4eda8a54a7ec66396e2e8d5c8a93037e215139451f06a6e9beab7b9c67f2f
Opcode Fuzzy Hash: d906fb7144c9cfa1d4da8c4cd65666013e34053fc02c7a82f9e15f1abe54c728
Instruction Fuzzy Hash: 2621B3B5518781DBEB00BF64C588B2A7BF8BF09358F014899E9858B246E775D884CBF1

Uniqueness

Uniqueness Score: -1.00%

Function 6DD62AC1 Relevance: 10.6, APIs: 7, Instructions: 51COMMON

Download Yara Rule

APIs

RtlEnterCriticalSection.NTDLL ref: 6DD62A36
RtlLeaveCriticalSection.NTDLL ref: 6DD62A46
pthread_getclean.LIBWINPTHREAD-1 ref: 6DD62A6F
pthread_getclean.LIBWINPTHREAD-1 ref: 6DD62A7F
pthread_mutex_unlock.LIBWINPTHREAD-1 ref: 6DD62A92
pthread_getclean.LIBWINPTHREAD-1 ref: 6DD62A9F
_pthread_time_in_ms_from_timespec.LIBWINPTHREAD-1 ref: 6DD62AC8

Memory Dump Source

Source File: 00000004.00000002.787395814.000000006DD61000.00000040.00000001.01000000.0000000A.sdmp, Offset: 6DD60000, based on PE: true

Associated: 00000004.00000002.787383138.000000006DD60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787413037.000000006DD6B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787415936.000000006DD6F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787437708.000000006DD74000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787474619.000000006DDD6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787482411.000000006DDE6000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6dd60000_windowsconnect.jbxd

Similarity

API ID: pthread_getclean$CriticalSection$EnterLeave_pthread_time_in_ms_from_timespecpthread_mutex_unlock
String ID:
API String ID: 222663773-0
Opcode ID: cbd85dbb3df32b9e074bc332e8a2c4f88c3ec76b3686ebabb01e787ce5770c07
Instruction ID: 4c8321890ef55cf23ca592e781b5c834d97a2298a84c213daaa87b77fd464ac2
Opcode Fuzzy Hash: cbd85dbb3df32b9e074bc332e8a2c4f88c3ec76b3686ebabb01e787ce5770c07
Instruction Fuzzy Hash: A111F3B19097408FD750AF29C48421EBBF0AF88368F814A6DF99A87260D774D944CFE2

Uniqueness

Uniqueness Score: -1.00%

Function 6DD647E0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

pthread_spin_lock.LIBWINPTHREAD-1(?,?,00000000,00000004,6DD649D9,?,Error cleaning up spin_keys for thread ,?,6DD64AE5), ref: 6DD647EE
pthread_spin_unlock.LIBWINPTHREAD-1 ref: 6DD6482E
fprintf.MSVCRT ref: 6DD6488C

Strings

%p not found?!?!, xrefs: 6DD64881

Memory Dump Source

Source File: 00000004.00000002.787395814.000000006DD61000.00000040.00000001.01000000.0000000A.sdmp, Offset: 6DD60000, based on PE: true

Associated: 00000004.00000002.787383138.000000006DD60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787413037.000000006DD6B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787415936.000000006DD6F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787437708.000000006DD74000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787474619.000000006DDD6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787482411.000000006DDE6000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6dd60000_windowsconnect.jbxd

Similarity

API ID: fprintfpthread_spin_lockpthread_spin_unlock
String ID: %p not found?!?!
API String ID: 3343314966-11085004
Opcode ID: f20bf901dd99b9f97299fc0202153eeb0ddde68c67ffe976e53c024a713e97da
Instruction ID: e7b28ed278d2677226e940c10192b33802405a2672c1fcbe6a16ce35450ea610
Opcode Fuzzy Hash: f20bf901dd99b9f97299fc0202153eeb0ddde68c67ffe976e53c024a713e97da
Instruction Fuzzy Hash: B7115EB194C2D2CBDB00BF79D49462ABBF4BB0A214F02882DF5988B206D335D440CBF2

Uniqueness

Uniqueness Score: -1.00%

Function 6DD61B38 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 49threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6DD61B59
fprintf.MSVCRT ref: 6DD61B83
GetCurrentThreadId.KERNEL32 ref: 6DD61B95
fprintf.MSVCRT ref: 6DD61BC7

Strings

C%p %d %s, xrefs: 6DD61B67
C%p %d V=%0X w=%ld %s, xrefs: 6DD61BBC

Memory Dump Source

Source File: 00000004.00000002.787395814.000000006DD61000.00000040.00000001.01000000.0000000A.sdmp, Offset: 6DD60000, based on PE: true

Associated: 00000004.00000002.787383138.000000006DD60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787413037.000000006DD6B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787415936.000000006DD6F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787437708.000000006DD74000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787474619.000000006DDD6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787482411.000000006DDE6000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6dd60000_windowsconnect.jbxd

Similarity

API ID: CurrentThreadfprintf
String ID: C%p %d %s$C%p %d V=%0X w=%ld %s
API String ID: 1384477639-884133013
Opcode ID: b4de152c4abbba0517b9e9129e919f3a0841cb6fd9d0e256fc9ef8795897a08c
Instruction ID: 586ae9150d201a2c441ea706eb3d32ad9aab58f692b6f025e725b1d9c174e9cf
Opcode Fuzzy Hash: b4de152c4abbba0517b9e9129e919f3a0841cb6fd9d0e256fc9ef8795897a08c
Instruction Fuzzy Hash: F711F8B5A083409FDB50EF69D08462ABBF4FF8A250F01881DF498C7354D330A845CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 6DD67600 Relevance: 10.5, APIs: 7, Instructions: 48COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 6DD67628
OpenProcess.KERNEL32 ref: 6DD67645
CloseHandle.KERNEL32 ref: 6DD67655
_errno.MSVCRT ref: 6DD67673

Memory Dump Source

Source File: 00000004.00000002.787395814.000000006DD61000.00000040.00000001.01000000.0000000A.sdmp, Offset: 6DD60000, based on PE: true

Associated: 00000004.00000002.787383138.000000006DD60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787413037.000000006DD6B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787415936.000000006DD6F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787437708.000000006DD74000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787474619.000000006DDD6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787482411.000000006DDE6000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6dd60000_windowsconnect.jbxd

Similarity

API ID: Process$CloseCurrentHandleOpen_errno
String ID:
API String ID: 2250453136-0
Opcode ID: 89e2d96f6c5f0138f7fd02babe66bf9605fd947bf12b07e0e7bd74936ffdaff0
Instruction ID: 646a282bfdef9712dfad20564f49934e1ed7df621c050fd8b9663a800fc97346
Opcode Fuzzy Hash: 89e2d96f6c5f0138f7fd02babe66bf9605fd947bf12b07e0e7bd74936ffdaff0
Instruction Fuzzy Hash: 7C115275949786EFEB507FBCC58C61A7AB0BF06364F014628F9A187291D73484048FF2

Uniqueness

Uniqueness Score: -1.00%

Function 6DD63870 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 46threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6DD63889
printf.MSVCRT ref: 6DD638AA
GetCurrentThreadId.KERNEL32 ref: 6DD638C5
printf.MSVCRT ref: 6DD63906

Strings

RWL%p %d V=%0X B=%d r=%ld w=%ld L=%p %s, xrefs: 6DD638FF
RWL%p %d %s, xrefs: 6DD63897

Memory Dump Source

Source File: 00000004.00000002.787395814.000000006DD61000.00000040.00000001.01000000.0000000A.sdmp, Offset: 6DD60000, based on PE: true

Associated: 00000004.00000002.787383138.000000006DD60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787413037.000000006DD6B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787415936.000000006DD6F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787437708.000000006DD74000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787474619.000000006DDD6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787482411.000000006DDE6000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6dd60000_windowsconnect.jbxd

Similarity

API ID: CurrentThreadprintf
String ID: RWL%p %d %s$RWL%p %d V=%0X B=%d r=%ld w=%ld L=%p %s
API String ID: 2356641437-1971217749
Opcode ID: e1d69476662333449fe32187275cff8b9df92498236c3054dd36c7defa62ccc1
Instruction ID: 9f14d8ee706c47467fd713f101dda6cd69c5daaccd8e3aef9bb1ee83f444df4f
Opcode Fuzzy Hash: e1d69476662333449fe32187275cff8b9df92498236c3054dd36c7defa62ccc1
Instruction Fuzzy Hash: F911D3B5A083519FE700EF19D49461ABBF0AF89650F05881EF98887354D735D8498BA3

Uniqueness

Uniqueness Score: -1.00%

Function 6DD64390 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

pthread_spin_lock.LIBWINPTHREAD-1(?,?,?,Error cleaning up spin_keys for thread ,6DD649A0,?,Error cleaning up spin_keys for thread ,?,6DD64AE5), ref: 6DD6439E
pthread_spin_unlock.LIBWINPTHREAD-1 ref: 6DD643C8
pthread_mutex_init.LIBWINPTHREAD-1 ref: 6DD64408
calloc.MSVCRT ref: 6DD6441E

Strings

Error cleaning up spin_keys for thread , xrefs: 6DD64390

Memory Dump Source

Source File: 00000004.00000002.787395814.000000006DD61000.00000040.00000001.01000000.0000000A.sdmp, Offset: 6DD60000, based on PE: true

Associated: 00000004.00000002.787383138.000000006DD60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787413037.000000006DD6B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787415936.000000006DD6F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787437708.000000006DD74000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787474619.000000006DDD6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787482411.000000006DDE6000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6dd60000_windowsconnect.jbxd

Similarity

API ID: callocpthread_mutex_initpthread_spin_lockpthread_spin_unlock
String ID: Error cleaning up spin_keys for thread
API String ID: 3482582356-2906507043
Opcode ID: 45b0fce11cb7f3e1533b075f2ea77302c5ba09f83e97ae9edabed3215d760c67
Instruction ID: 668247e3a2fc214dae069971693844be01e272cb76a8372576f6170a63d9406b
Opcode Fuzzy Hash: 45b0fce11cb7f3e1533b075f2ea77302c5ba09f83e97ae9edabed3215d760c67
Instruction Fuzzy Hash: DE011BB054C394CFDB01BF64D194759BAF4AB0A718F068469E5848F306D7B598449BF2

Uniqueness

Uniqueness Score: -1.00%

Function 6DD64990 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 37
COMMON

Download Yara Rule

C-Code - Quality: 43%

			E6DD64990(void* __ecx, void* __edx, void* __ebp, void* __eflags) {
				intOrPtr _v16;
				intOrPtr* _v20;
				char* _v24;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t6;
				intOrPtr _t12;
				intOrPtr _t15;
				void* _t16;
				void* _t17;
				intOrPtr _t18;
				intOrPtr _t19;
				void* _t21;
				intOrPtr* _t22;

				_t17 = __edx;
				_t16 = __ecx;
				_t22 = _t21 - 0x10;
				_t6 = E6DD64390(0x6dd6c050, __eflags);
				_t1 = _t6 + 4; // 0x4
				_t19 = _t1;
				_t15 = _t6;
				 *_t22 = _t19;
				E6DD62F90();
				_t18 =  *0x6dd6c050;
				if(_t18 != 0) {
					__eflags = _t18 - 1;
					if(_t18 != 1) {
						 *_t22 = 2;
						_t12 =  *0x6dd6a044();
						_v16 = _t18;
						_v20 = 0x6dd6c050;
						_v24 = " once %p is %d\n";
						 *_t22 = _t12;
						fprintf(??, ??);
					}
				} else {
					E6DD64440(_t15, _t16, _t17, _t18, _t19);
					 *0x6dd6c050 = 1;
				}
				 *_t22 = _t19;
				E6DD632E0();
				_t26 = _t15;
				if(_t15 != 0) {
					E6DD647E0(_t15, _t26);
				}
				return 0;
			}

0x6dd64990
0x6dd64990
0x6dd64998
0x6dd6499b
0x6dd649a0
0x6dd649a0
0x6dd649a3
0x6dd649a5
0x6dd649a8
0x6dd649ad
0x6dd649b5
0x6dd649e8
0x6dd649eb
0x6dd649ed
0x6dd649f4
0x6dd649fa
0x6dd649fe
0x6dd64a06
0x6dd64a0e
0x6dd64a11
0x6dd64a11
0x6dd649b7
0x6dd649b7
0x6dd649bc
0x6dd649bc
0x6dd649c6
0x6dd649c9
0x6dd649ce
0x6dd649d0
0x6dd649d4
0x6dd649d4
0x6dd649e1

APIs

Part of subcall function 6DD64390: pthread_spin_lock.LIBWINPTHREAD-1(?,?,?,Error cleaning up spin_keys for thread ,6DD649A0,?,Error cleaning up spin_keys for thread ,?,6DD64AE5), ref: 6DD6439E
Part of subcall function 6DD64390: pthread_spin_unlock.LIBWINPTHREAD-1 ref: 6DD643C8
Part of subcall function 6DD64390: pthread_mutex_init.LIBWINPTHREAD-1 ref: 6DD64408
Part of subcall function 6DD64390: calloc.MSVCRT ref: 6DD6441E

pthread_mutex_lock.LIBWINPTHREAD-1(?,Error cleaning up spin_keys for thread ,?,6DD64AE5), ref: 6DD649A8
pthread_tls_init.LIBWINPTHREAD-1(?,Error cleaning up spin_keys for thread ,?,6DD64AE5), ref: 6DD649B7

Part of subcall function 6DD64440: TlsAlloc.KERNEL32(?,?,6DD649BC,?,Error cleaning up spin_keys for thread ,?,6DD64AE5), ref: 6DD64443

pthread_mutex_unlock.LIBWINPTHREAD-1(?,Error cleaning up spin_keys for thread ,?,6DD64AE5), ref: 6DD649C9
fprintf.MSVCRT ref: 6DD64A11

Strings

Error cleaning up spin_keys for thread , xrefs: 6DD64996
once %p is %d, xrefs: 6DD64A06

Memory Dump Source

Source File: 00000004.00000002.787395814.000000006DD61000.00000040.00000001.01000000.0000000A.sdmp, Offset: 6DD60000, based on PE: true

Associated: 00000004.00000002.787383138.000000006DD60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787413037.000000006DD6B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787415936.000000006DD6F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787437708.000000006DD74000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787474619.000000006DDD6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787482411.000000006DDE6000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6dd60000_windowsconnect.jbxd

Similarity

API ID: Alloccallocfprintfpthread_mutex_initpthread_mutex_lockpthread_mutex_unlockpthread_spin_lockpthread_spin_unlockpthread_tls_init
String ID: once %p is %d$Error cleaning up spin_keys for thread
API String ID: 3187950583-1049478869
Opcode ID: d92b6378fdb57f24a7958940cf58566a557c1c23409b858d867399861231bba6
Instruction ID: 1732f4164e2a71e1fb18b64b82d6d34ecbb051456eaab30e16d57cebb1f268b3
Opcode Fuzzy Hash: d92b6378fdb57f24a7958940cf58566a557c1c23409b858d867399861231bba6
Instruction Fuzzy Hash: CFF0697118C2D08BDB00BF69969532EBAF4EF49218F02481EF68447209D77594408BF2

Uniqueness

Uniqueness Score: -1.00%

Function 6DD65410 Relevance: 9.1, APIs: 6, Instructions: 110
COMMON

Download Yara Rule

C-Code - Quality: 37%

			E6DD65410(void* __edx, signed int* _a4, signed int _a8) {
				void* _v32;
				signed int* _v36;
				signed int _v52;
				signed int _v56;
				void* __ebp;
				void* _t22;
				void* _t26;
				signed int* _t36;
				signed int _t39;
				signed int _t40;
				signed int* _t41;
				signed int _t45;
				void* _t51;
				signed int _t52;
				signed int* _t54;
				void* _t56;
				signed int** _t57;

				_t57 = _t56 - 0x2c;
				_t54 = _a4;
				if(_t54 == 0) {
					return 0x16;
				} else {
					 *_t57 = 0x6dd6a01c;
					E6DD63F90();
					_t40 =  *0x6dd6c048;
					_t39 =  *0x6dd6c04c;
					if(_t40 >= _t39) {
						L7:
						__eflags = _t40;
						if(_t40 == 0) {
							L12:
							__eflags = _t39 - 0x100000;
							if(__eflags == 0) {
								L16:
								 *_t57 = 0x6dd6a01c;
								E6DD63EE0(_t40, _t55, __eflags);
								_t22 = 0xc;
								goto L6;
							} else {
								_t55 = _t39 + 1;
								_t51 =  ==  ? _t55 : _t39 + _t39;
								__eflags = _t51 - 0x100000;
								_t52 =  >  ? 0x100000 : _t51;
								_v56 = _t52 * 4;
								 *_t57 =  *0x6dd6c01c;
								_t26 = realloc(??, ??);
								__eflags = _t26;
								if(__eflags == 0) {
									goto L16;
								} else {
									_t41 = _t26 + _t39 * 4;
									_v32 = _t26;
									 *_t57 = _t41;
									_v56 = 0;
									_v52 = _t52 - _t39 << 2;
									_v36 = _t41;
									memset(??, ??, ??);
									 *0x6dd6c048 = _t55;
									 *0x6dd6c04c = _t52;
									__eflags = _a8;
									_t33 =  !=  ? _a8 : 1;
									 *0x6dd6c01c = _v32;
									 *_t54 = _t39;
									 *_v36 =  !=  ? _a8 : 1;
									 *_t57 = 0x6dd6a01c;
									E6DD63EE0(_v36, _t55, _a8);
									__eflags = 0;
									return 0;
								}
							}
						} else {
							_t36 =  *0x6dd6c01c;
							_t45 = 0;
							while(1) {
								__eflags =  *_t36;
								if(__eflags == 0) {
									break;
								}
								_t45 = _t45 + 1;
								_t36 =  &(_t36[1]);
								__eflags = _t40 - _t45;
								if(_t40 == _t45) {
									goto L12;
								} else {
									continue;
								}
								goto L17;
							}
							goto L5;
						}
					} else {
						_t45 = _t40;
						_t36 =  &(( *0x6dd6c01c)[_t40]);
						while(1) {
							_t55 =  *_t36;
							if( *_t36 == 0) {
								break;
							}
							_t45 = _t45 + 1;
							_t36 =  &(_t36[1]);
							__eflags = _t45 - _t39;
							if(__eflags == 0) {
								goto L7;
							} else {
								continue;
							}
							goto L17;
						}
						L5:
						 *_t54 = _t45;
						_t48 =  !=  ? _a8 : 1;
						 *_t36 =  !=  ? _a8 : 1;
						 *_t57 = 0x6dd6a01c;
						E6DD63EE0(_t40, _t55, _a8);
						_t22 = 0;
						L6:
						return _t22;
					}
				}
				L17:
			}

0x6dd65414
0x6dd65417
0x6dd6541d
0x6dd65574
0x6dd65423
0x6dd65423
0x6dd6542a
0x6dd6542f
0x6dd65435
0x6dd6543d
0x6dd65490
0x6dd65490
0x6dd65492
0x6dd654b8
0x6dd654b8
0x6dd654be
0x6dd65575
0x6dd65575
0x6dd6557c
0x6dd65581
0x00000000
0x6dd654c4
0x6dd654c6
0x6dd654d0
0x6dd654d3
0x6dd654d9
0x6dd654e3
0x6dd654ec
0x6dd654ef
0x6dd654f4
0x6dd654f6
0x00000000
0x6dd654f8
0x6dd654f8
0x6dd654fb
0x6dd65503
0x6dd65509
0x6dd65511
0x6dd65515
0x6dd65519
0x6dd65526
0x6dd65530
0x6dd65536
0x6dd6553d
0x6dd65542
0x6dd65548
0x6dd6554a
0x6dd6554c
0x6dd65553
0x6dd6555b
0x6dd65561
0x6dd65561
0x6dd654f6
0x6dd65494
0x6dd65494
0x6dd65499
0x6dd654aa
0x6dd654ac
0x6dd654ae
0x00000000
0x00000000
0x6dd654a0
0x6dd654a3
0x6dd654a6
0x6dd654a8
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6dd654a8
0x00000000
0x6dd654b0
0x6dd6543f
0x6dd65444
0x6dd65446
0x6dd6545a
0x6dd6545a
0x6dd6545e
0x00000000
0x00000000
0x6dd65450
0x6dd65453
0x6dd65456
0x6dd65458
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6dd65458
0x6dd65460
0x6dd65460
0x6dd6546d
0x6dd65472
0x6dd65474
0x6dd6547b
0x6dd65480
0x6dd65482
0x6dd65489
0x6dd65489
0x6dd6543d
0x00000000

APIs

pthread_rwlock_wrlock.LIBWINPTHREAD-1 ref: 6DD6542A
pthread_rwlock_unlock.LIBWINPTHREAD-1 ref: 6DD6547B

Memory Dump Source

Source File: 00000004.00000002.787395814.000000006DD61000.00000040.00000001.01000000.0000000A.sdmp, Offset: 6DD60000, based on PE: true

Associated: 00000004.00000002.787383138.000000006DD60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787413037.000000006DD6B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787415936.000000006DD6F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787437708.000000006DD74000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787474619.000000006DDD6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787482411.000000006DDE6000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6dd60000_windowsconnect.jbxd

Similarity

API ID: pthread_rwlock_unlockpthread_rwlock_wrlock
String ID:
API String ID: 2630845080-0
Opcode ID: 702e1ce3fa5ebf47b09a4bf34d7411c3666bc4d0aac837a62242bf5b46d8e6d3
Instruction ID: d7091edb9732dd54445347499c9df57a9f83e4fd7430441513447196bacc98ff
Opcode Fuzzy Hash: 702e1ce3fa5ebf47b09a4bf34d7411c3666bc4d0aac837a62242bf5b46d8e6d3
Instruction Fuzzy Hash: 8C416CB1648281CBEB10FF59C48076AB7F5EB86355F15843DE98887309E731E8848BF2

Uniqueness

Uniqueness Score: -1.00%

Function 6DD61020 Relevance: 9.1, APIs: 6, Instructions: 108sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32 ref: 6DD61057
_amsg_exit.MSVCRT ref: 6DD61085

Memory Dump Source

Source File: 00000004.00000002.787395814.000000006DD61000.00000040.00000001.01000000.0000000A.sdmp, Offset: 6DD60000, based on PE: true

Associated: 00000004.00000002.787383138.000000006DD60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787413037.000000006DD6B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787415936.000000006DD6F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787437708.000000006DD74000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787474619.000000006DDD6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787482411.000000006DDE6000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6dd60000_windowsconnect.jbxd

Similarity

API ID: Sleep_amsg_exit
String ID:
API String ID: 1015461914-0
Opcode ID: 3aa1b3e6159b66ae720139b514915afcc6d4e0d9faae5d2df3544664528cf546
Instruction ID: 1515b2fe0c40da4a69fc386dbc1b0477756b2901a2de129d4fdb1d99fb196db2
Opcode Fuzzy Hash: 3aa1b3e6159b66ae720139b514915afcc6d4e0d9faae5d2df3544664528cf546
Instruction Fuzzy Hash: DE4138B1A482C1CBEF01BF6DC58476A7BB4FB4A754F41852AE584CB241D7769480CBF2

Uniqueness

Uniqueness Score: -1.00%

Function 6DD664F0 Relevance: 9.1, APIs: 6, Instructions: 80
synchronizationCOMMON

Download Yara Rule

C-Code - Quality: 41%

			E6DD664F0(void* __ecx, void* __ebp, intOrPtr _a4, intOrPtr* _a8) {
				char _v16;
				char* _v40;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr* _t19;
				intOrPtr _t21;
				int _t22;
				void* _t23;
				void* _t24;
				intOrPtr _t25;
				intOrPtr _t28;
				intOrPtr* _t38;
				void* _t39;
				intOrPtr _t44;
				signed int _t46;
				intOrPtr _t47;
				void* _t49;
				intOrPtr* _t50;

				_t39 = __ecx;
				_t50 = _t49 - 0x20;
				_t44 = _a4;
				 *_t50 = _t44;
				_t19 = E6DD64C20();
				if(_t19 == 0) {
					L16:
					return 3;
				} else {
					_t38 = _t19;
					_t21 =  *((intOrPtr*)(_t19 + 0x14));
					if(_t21 == 0) {
						goto L16;
					} else {
						 *_t50 = _t21;
						_v40 =  &_v16;
						_t22 = GetHandleInformation(??, ??);
						_t50 = _t50 - 8;
						if(_t22 == 0) {
							goto L16;
						} else {
							_t23 = 0x16;
							_t46 =  *(_t38 + 0x24) & 0x00000004;
							if(_t46 == 0) {
								_t24 = E6DD64AD0(_t38, _t39, _t44, _t46);
								if(_t24 != 0) {
									_t46 =  *(_t24 + 0xb4);
								}
								if(_t44 == _t46) {
									_t23 = 0x24;
								} else {
									_t25 =  *((intOrPtr*)(_t38 + 0x14));
									if( *((intOrPtr*)(_t38 + 0x68)) == 0 || _t25 - 1 <= 0xfffffffd) {
										_v40 = 0xffffffff;
										 *_t50 = _t25;
										WaitForSingleObject(??, ??);
										_t25 =  *((intOrPtr*)(_t38 + 0x14));
										_t50 = _t50 - 8;
									}
									 *_t50 = _t25;
									_t47 =  *0x6dd6f184;
									CloseHandle(??);
									_t28 =  *((intOrPtr*)(_t38 + 0x18));
									_t50 = _t50 - 4;
									if(_t28 != 0) {
										 *_t50 = _t28;
										CloseHandle(??);
										_t50 = _t50 - 4;
									}
									 *((intOrPtr*)(_t38 + 0x18)) = 0;
									if(_a8 != 0) {
										 *_a8 =  *((intOrPtr*)(_t38 + 4));
									}
									_t17 = _t38 + 0x1c; // 0x1c
									 *_t50 = _t17;
									E6DD63470();
									_t18 = _t38 + 0x38; // 0x38
									E6DD64A20(_t18, _t38, _t44, _t47);
									E6DD64650(_t38);
									_t23 = 0;
								}
							}
							return _t23;
						}
					}
				}
			}

0x6dd664f0
0x6dd664f3
0x6dd664f6
0x6dd664fa
0x6dd664fd
0x6dd66504
0x6dd665e0
0x6dd665eb
0x6dd6650a
0x6dd6650a
0x6dd6650c
0x6dd66511
0x00000000
0x6dd66517
0x6dd6651b
0x6dd6651e
0x6dd66522
0x6dd66528
0x6dd6652d
0x00000000
0x6dd66533
0x6dd66536
0x6dd6653b
0x6dd6653e
0x6dd66544
0x6dd6654b
0x6dd6654d
0x6dd6654d
0x6dd66555
0x6dd665f0
0x6dd6655b
0x6dd6655e
0x6dd66563
0x6dd6656d
0x6dd66575
0x6dd66578
0x6dd6657e
0x6dd66581
0x6dd66581
0x6dd66584
0x6dd66587
0x6dd6658d
0x6dd6658f
0x6dd66592
0x6dd66597
0x6dd66599
0x6dd6659c
0x6dd6659e
0x6dd6659e
0x6dd665a5
0x6dd665ae
0x6dd665b7
0x6dd665b7
0x6dd665b9
0x6dd665bc
0x6dd665bf
0x6dd665c4
0x6dd665c7
0x6dd665ce
0x6dd665d3
0x6dd665d3
0x6dd66555
0x6dd665db
0x6dd665db
0x6dd6652d
0x6dd66511

APIs

__pth_gpointer_locked.LIBWINPTHREAD-1 ref: 6DD664FD

Part of subcall function 6DD64C20: pthread_mutex_lock.LIBWINPTHREAD-1(?,?,00000000,?,6DD64C6F,?,?,?,?,?,?,00000000,?,?,?,6DD658D2), ref: 6DD64C36
Part of subcall function 6DD64C20: pthread_mutex_unlock.LIBWINPTHREAD-1(?,?,00000000,?,6DD64C6F,?,?,?,?,?,?,00000000,?,?,?,6DD658D2), ref: 6DD64C4B

GetHandleInformation.KERNEL32 ref: 6DD66522

Part of subcall function 6DD64AD0: TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,6DD65ADA,?,?,?,?,6DD66ADD), ref: 6DD64AED

WaitForSingleObject.KERNEL32 ref: 6DD66578
CloseHandle.KERNEL32 ref: 6DD6658D
CloseHandle.KERNEL32 ref: 6DD6659C
pthread_mutex_destroy.LIBWINPTHREAD-1 ref: 6DD665BF

Memory Dump Source

Source File: 00000004.00000002.787395814.000000006DD61000.00000040.00000001.01000000.0000000A.sdmp, Offset: 6DD60000, based on PE: true

Associated: 00000004.00000002.787383138.000000006DD60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787413037.000000006DD6B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787415936.000000006DD6F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787437708.000000006DD74000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787474619.000000006DDD6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787482411.000000006DDE6000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6dd60000_windowsconnect.jbxd

Similarity

API ID: Handle$Close$InformationObjectSingleValueWait__pth_gpointer_lockedpthread_mutex_destroypthread_mutex_lockpthread_mutex_unlock
String ID:
API String ID: 3385087108-0
Opcode ID: 2a0b470429735899d0a70537146b5e32ab8814dca6e06aba06de1b03202de167
Instruction ID: c824b42cbd83c75630a86e637e14990a326fa02478a8699c936bdb0de63cda4b
Opcode Fuzzy Hash: 2a0b470429735899d0a70537146b5e32ab8814dca6e06aba06de1b03202de167
Instruction Fuzzy Hash: 0B212E716082818BEB00FF78E98566E7BE4AF45254F0145A9FD54CB249FB34D854CBF2

Uniqueness

Uniqueness Score: -1.00%

Function 6DD62760 Relevance: 9.1, APIs: 6, Instructions: 77COMMON

Download Yara Rule

APIs

RtlEnterCriticalSection.NTDLL ref: 6DD6279B
RtlLeaveCriticalSection.NTDLL ref: 6DD627AB
pthread_getclean.LIBWINPTHREAD-1 ref: 6DD627D8
pthread_getclean.LIBWINPTHREAD-1 ref: 6DD627E8
pthread_mutex_unlock.LIBWINPTHREAD-1 ref: 6DD627FF
pthread_getclean.LIBWINPTHREAD-1 ref: 6DD6280C

Memory Dump Source

Source File: 00000004.00000002.787395814.000000006DD61000.00000040.00000001.01000000.0000000A.sdmp, Offset: 6DD60000, based on PE: true

Associated: 00000004.00000002.787383138.000000006DD60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787413037.000000006DD6B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787415936.000000006DD6F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787437708.000000006DD74000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787474619.000000006DDD6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787482411.000000006DDE6000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6dd60000_windowsconnect.jbxd

Similarity

API ID: pthread_getclean$CriticalSection$EnterLeavepthread_mutex_unlock
String ID:
API String ID: 83821921-0
Opcode ID: 4f61a78ac90c1bf3433d4c5f3682806ef42567ce0db57e151c0c7cac683fbc47
Instruction ID: 5b35daf1fee7a87c149ad7f30ff37b038cfb501fba48ce74e501c26b0bb6aef5
Opcode Fuzzy Hash: 4f61a78ac90c1bf3433d4c5f3682806ef42567ce0db57e151c0c7cac683fbc47
Instruction Fuzzy Hash: B63103B09097828FD710EF29D98061EBBF0AF88358F014A2DF9959B251D731D945CFE2

Uniqueness

Uniqueness Score: -1.00%

Function 6DD63B20 Relevance: 9.1, APIs: 6, Instructions: 77
COMMON

Download Yara Rule

C-Code - Quality: 55%

			E6DD63B20(void* __eflags, intOrPtr* _a4) {
				void* _v16;
				intOrPtr* _t17;
				intOrPtr _t21;
				intOrPtr _t27;
				intOrPtr* _t32;
				intOrPtr* _t40;
				intOrPtr _t41;
				intOrPtr* _t49;
				void* _t50;
				intOrPtr* _t51;
				void* _t55;

				_t55 = __eflags;
				_t51 = _t50 - 0x24;
				 *_t51 = 0x6dd6a00c;
				E6DD64310();
				_t17 = E6DD63620(_a4,  &_v16, _t55);
				 *_t51 = 0x6dd6a00c;
				_t40 = _t17;
				E6DD64360();
				if(_t40 != 0) {
					L2:
					return _t40;
				} else {
					_t40 = _v16;
					if(_t40 != 0) {
						_t49 = _t40;
						_t21 = E6DD63710(_t40, __eflags);
						_t41 = _t21;
						__eflags = _t21;
						if(_t21 != 0) {
							L8:
							 *_a4 = _v16;
							return _t41;
						} else {
							__eflags =  *((intOrPtr*)(_t49 + 0xc)) -  *((intOrPtr*)(_t49 + 0x10));
							if( *((intOrPtr*)(_t49 + 0xc)) >  *((intOrPtr*)(_t49 + 0x10))) {
								L6:
								 *_a4 = _v16;
								_t27 = E6DD63760(_t49, 1);
								__eflags = _t27;
								_t43 =  ==  ? 0x10 : _t27;
								_t29 =  ==  ? 0x10 : _t27;
								return  ==  ? 0x10 : _t27;
							} else {
								__eflags =  *((intOrPtr*)(_t49 + 8));
								if( *((intOrPtr*)(_t49 + 8)) <= 0) {
									 *_t49 = 0xdeadb0ef;
									_t32 = E6DD63760(_t49, 0);
									_t40 = _t32;
									__eflags = _t32;
									if(_t32 == 0) {
										 *_t51 = _t49 + 0x1c;
										E6DD62340();
										 *_t51 = _t49 + 0x14;
										E6DD63470();
										 *_t51 = _t49 + 0x18;
										E6DD63470();
										 *_t49 = 0xdeadb0ef;
										 *_t51 = _v16;
										L6DD69400();
										goto L2;
									} else {
										goto L8;
									}
								} else {
									goto L6;
								}
							}
						}
					} else {
						goto L2;
					}
				}
			}

0x6dd63b20
0x6dd63b22
0x6dd63b25
0x6dd63b2c
0x6dd63b39
0x6dd63b3e
0x6dd63b45
0x6dd63b47
0x6dd63b4e
0x6dd63b58
0x6dd63b5f
0x6dd63b50
0x6dd63b50
0x6dd63b56
0x6dd63b62
0x6dd63b64
0x6dd63b69
0x6dd63b6b
0x6dd63b6d
0x6dd63bc5
0x6dd63bcd
0x6dd63bd6
0x6dd63b6f
0x6dd63b72
0x6dd63b75
0x6dd63b7e
0x6dd63b8b
0x6dd63b8f
0x6dd63b94
0x6dd63b9d
0x6dd63ba3
0x6dd63ba7
0x6dd63b77
0x6dd63b7a
0x6dd63b7c
0x6dd63bb0
0x6dd63bba
0x6dd63bbf
0x6dd63bc1
0x6dd63bc3
0x6dd63be3
0x6dd63be6
0x6dd63bee
0x6dd63bf1
0x6dd63bf9
0x6dd63bfc
0x6dd63c05
0x6dd63c0b
0x6dd63c0e
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6dd63b7c
0x6dd63b75
0x00000000
0x00000000
0x00000000
0x6dd63b56

APIs

pthread_spin_lock.LIBWINPTHREAD-1 ref: 6DD63B2C

Part of subcall function 6DD63620: pthread_spin_lock.LIBWINPTHREAD-1(?,?,?,6DD63B3E), ref: 6DD63637
Part of subcall function 6DD63620: pthread_spin_unlock.LIBWINPTHREAD-1(?,?,?,6DD63B3E), ref: 6DD6365F

pthread_spin_unlock.LIBWINPTHREAD-1 ref: 6DD63B47

Memory Dump Source

Source File: 00000004.00000002.787395814.000000006DD61000.00000040.00000001.01000000.0000000A.sdmp, Offset: 6DD60000, based on PE: true

Associated: 00000004.00000002.787383138.000000006DD60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787413037.000000006DD6B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787415936.000000006DD6F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787437708.000000006DD74000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787474619.000000006DDD6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787482411.000000006DDE6000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6dd60000_windowsconnect.jbxd

Similarity

API ID: pthread_spin_lockpthread_spin_unlock
String ID:
API String ID: 4077346669-0
Opcode ID: 6652e722caa81a3e1f40ea662f76db66596de6de61c3106816387a305efbb9e5
Instruction ID: fcbed23168730a3fe3195b00843bbb2e8f5c3882f6433b98152736b181c63b11
Opcode Fuzzy Hash: 6652e722caa81a3e1f40ea662f76db66596de6de61c3106816387a305efbb9e5
Instruction Fuzzy Hash: AE21E7B470D7868BD710EF69E88055AB7E4AB49218F05482DF98587301E775E8858BB2

Uniqueness

Uniqueness Score: -1.00%

Function 6DD61840 Relevance: 9.1, APIs: 6, Instructions: 75COMMON

Download Yara Rule

APIs

Part of subcall function 6DD614C0: pthread_spin_lock.LIBWINPTHREAD-1(?,?,?,?,6DD61852), ref: 6DD614CE
Part of subcall function 6DD614C0: pthread_spin_unlock.LIBWINPTHREAD-1(?,?,?,?,6DD61852), ref: 6DD614F3

pthread_mutex_lock.LIBWINPTHREAD-1 ref: 6DD61868
pthread_mutex_unlock.LIBWINPTHREAD-1 ref: 6DD6189F

Memory Dump Source

Source File: 00000004.00000002.787395814.000000006DD61000.00000040.00000001.01000000.0000000A.sdmp, Offset: 6DD60000, based on PE: true

Associated: 00000004.00000002.787383138.000000006DD60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787413037.000000006DD6B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787415936.000000006DD6F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787437708.000000006DD74000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787474619.000000006DDD6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787482411.000000006DDE6000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6dd60000_windowsconnect.jbxd

Similarity

API ID: pthread_mutex_lockpthread_mutex_unlockpthread_spin_lockpthread_spin_unlock
String ID:
API String ID: 967236581-0
Opcode ID: 9a8536c20706ae71b844ae5d558e9e781c944f6cf5ae49408594620819c87244
Instruction ID: 8a275600f8079278c0971440bd39a1f0d14af92b7dcf42ba88c6ee9fbfdf7dfe
Opcode Fuzzy Hash: 9a8536c20706ae71b844ae5d558e9e781c944f6cf5ae49408594620819c87244
Instruction Fuzzy Hash: 55215E72B087468FD310AF3AD88055BB7E5EF84398F05882EE985C7604EB36E445CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 6DD67110 Relevance: 9.1, APIs: 6, Instructions: 64COMMON

Download Yara Rule

APIs

_errno.MSVCRT ref: 6DD671B3

Part of subcall function 6DD66A90: pthread_mutex_lock.LIBWINPTHREAD-1 ref: 6DD66AB3

ReleaseSemaphore.KERNEL32 ref: 6DD67178
pthread_mutex_unlock.LIBWINPTHREAD-1(?,?,?,?,?,?,?,?,6DD61910), ref: 6DD6718F
pthread_mutex_unlock.LIBWINPTHREAD-1(?,?,?,?,?,?,?,?,?,?,?,6DD61910), ref: 6DD671AE
pthread_mutex_unlock.LIBWINPTHREAD-1(?,?,?,?,?,?,?,?,6DD61910), ref: 6DD671E2
_errno.MSVCRT ref: 6DD671E7

Memory Dump Source

Source File: 00000004.00000002.787395814.000000006DD61000.00000040.00000001.01000000.0000000A.sdmp, Offset: 6DD60000, based on PE: true

Associated: 00000004.00000002.787383138.000000006DD60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787413037.000000006DD6B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787415936.000000006DD6F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787437708.000000006DD74000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787474619.000000006DDD6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787482411.000000006DDE6000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6dd60000_windowsconnect.jbxd

Similarity

API ID: pthread_mutex_unlock$_errno$ReleaseSemaphorepthread_mutex_lock
String ID:
API String ID: 1829004465-0
Opcode ID: 9ded75206b3f1befbbc182514f61987420e2747c1837d0c7d10d1e0390f54797
Instruction ID: 0ce10cd7b68d4e368657a99ee844aa41ef7612e33490d905e16452e6936ed482
Opcode Fuzzy Hash: 9ded75206b3f1befbbc182514f61987420e2747c1837d0c7d10d1e0390f54797
Instruction Fuzzy Hash: A921A471A086419FC704FF39C888B0AB7E1BF85324F15C66DE8A58B795E734C844CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6DD67040 Relevance: 9.1, APIs: 6, Instructions: 52COMMON

Download Yara Rule

APIs

Part of subcall function 6DD66A90: pthread_mutex_lock.LIBWINPTHREAD-1 ref: 6DD66AB3

ReleaseSemaphore.KERNEL32 ref: 6DD67092
pthread_mutex_unlock.LIBWINPTHREAD-1 ref: 6DD670A9
pthread_mutex_unlock.LIBWINPTHREAD-1 ref: 6DD670CC
_errno.MSVCRT ref: 6DD670D1
pthread_mutex_unlock.LIBWINPTHREAD-1 ref: 6DD670F2
_errno.MSVCRT ref: 6DD670F7

Memory Dump Source

Source File: 00000004.00000002.787395814.000000006DD61000.00000040.00000001.01000000.0000000A.sdmp, Offset: 6DD60000, based on PE: true

Associated: 00000004.00000002.787383138.000000006DD60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787413037.000000006DD6B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787415936.000000006DD6F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787437708.000000006DD74000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787474619.000000006DDD6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787482411.000000006DDE6000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6dd60000_windowsconnect.jbxd

Similarity

API ID: pthread_mutex_unlock$_errno$ReleaseSemaphorepthread_mutex_lock
String ID:
API String ID: 1829004465-0
Opcode ID: c39102b22117bba50c3ff47732ee1c53b601059c97f8d53b8f081e01c54e7abb
Instruction ID: 26cca19806dd0a2ee23d8d050272808f207ef07b9a60b0d3943ab70c995d290a
Opcode Fuzzy Hash: c39102b22117bba50c3ff47732ee1c53b601059c97f8d53b8f081e01c54e7abb
Instruction Fuzzy Hash: FF110070A487419FD700BF79C889B19B7F1BF85318F15C618F4A48B292D771D8458BB2

Uniqueness

Uniqueness Score: -1.00%

Function 6DD65C20 Relevance: 9.0, APIs: 6, Instructions: 35
sleepCOMMON

Download Yara Rule

C-Code - Quality: 79%

			E6DD65C20(void* __ecx, void* __edi, void* __ebp, void* __eflags, intOrPtr _a4) {
				intOrPtr _v24;
				void* __ebx;
				void* __esi;
				void* _t4;
				intOrPtr _t9;
				void* _t13;
				intOrPtr _t17;
				void* _t18;
				void* _t19;
				intOrPtr* _t20;

				_t18 = __ebp;
				_t16 = __edi;
				_t15 = __ecx;
				_t20 = _t19 - 0x14;
				_t17 = _a4;
				_t4 = E6DD64AD0(_t13, __ecx, __edi, _t17);
				_t25 = _t17;
				if(_t17 == 0) {
					E6DD65AD0(__ecx, __edi, _t18, __eflags);
					 *_t20 = 0;
					Sleep(??);
					E6DD65AD0(_t15, __edi, _t18, __eflags);
					__eflags = 0;
					return 0;
				} else {
					E6DD65AD0(__ecx, __edi, _t18, _t25);
					_t9 =  *((intOrPtr*)(_t4 + 0x18));
					_t26 = _t9;
					if(_t9 == 0) {
						 *_t20 = _t17;
						Sleep(??);
						_t20 = _t20 - 4;
					} else {
						_v24 = _t17;
						 *_t20 = _t9;
						E6DD62DC0();
					}
					E6DD65AD0(_t15, _t16, _t18, _t26);
					return 0;
				}
			}

0x6dd65c20
0x6dd65c20
0x6dd65c20
0x6dd65c22
0x6dd65c25
0x6dd65c29
0x6dd65c2e
0x6dd65c30
0x6dd65c60
0x6dd65c65
0x6dd65c6c
0x6dd65c75
0x6dd65c7d
0x6dd65c81
0x6dd65c32
0x6dd65c34
0x6dd65c39
0x6dd65c3c
0x6dd65c3e
0x6dd65c88
0x6dd65c8b
0x6dd65c91
0x6dd65c40
0x6dd65c40
0x6dd65c44
0x6dd65c47
0x6dd65c47
0x6dd65c4c
0x6dd65c58
0x6dd65c58

APIs

Part of subcall function 6DD64AD0: TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,6DD65ADA,?,?,?,?,6DD66ADD), ref: 6DD64AED

pthread_testcancel.LIBWINPTHREAD-1 ref: 6DD65C34
pthread_testcancel.LIBWINPTHREAD-1 ref: 6DD65C4C
pthread_testcancel.LIBWINPTHREAD-1 ref: 6DD65C60
Sleep.KERNEL32 ref: 6DD65C6C
pthread_testcancel.LIBWINPTHREAD-1 ref: 6DD65C75
Sleep.KERNEL32 ref: 6DD65C8B

Part of subcall function 6DD62DC0: WaitForSingleObject.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,00000002,00000001,?,6DD63036), ref: 6DD62E1E

Memory Dump Source

Source File: 00000004.00000002.787395814.000000006DD61000.00000040.00000001.01000000.0000000A.sdmp, Offset: 6DD60000, based on PE: true

Associated: 00000004.00000002.787383138.000000006DD60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787413037.000000006DD6B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787415936.000000006DD6F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787437708.000000006DD74000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787474619.000000006DDD6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787482411.000000006DDE6000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6dd60000_windowsconnect.jbxd

Similarity

API ID: pthread_testcancel$Sleep$ObjectSingleValueWait
String ID:
API String ID: 3679766023-0
Opcode ID: 3008cca2f051b80667efa7dc5c0f4c66b07324e3f4027a855fe31f9c205e753b
Instruction ID: 4c761c024cff8ff3ba003eafae487b0b1e83e4660120542a0f49ee21058649f2
Opcode Fuzzy Hash: 3008cca2f051b80667efa7dc5c0f4c66b07324e3f4027a855fe31f9c205e753b
Instruction Fuzzy Hash: FDF06DB190C5908BE610BB78A98453F3AA0FF04218F430564F58282242EB20D88486F2

Uniqueness

Uniqueness Score: -1.00%

Function 6DD62F90 Relevance: 7.6, APIs: 5, Instructions: 108threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6DD62FD0

Memory Dump Source

Source File: 00000004.00000002.787395814.000000006DD61000.00000040.00000001.01000000.0000000A.sdmp, Offset: 6DD60000, based on PE: true

Associated: 00000004.00000002.787383138.000000006DD60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787413037.000000006DD6B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787415936.000000006DD6F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787437708.000000006DD74000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787474619.000000006DDD6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787482411.000000006DDE6000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6dd60000_windowsconnect.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: ee0ce11c10ab0fc092077075c7da8f283fbfb9a05008b903320b8f0957d9016a
Instruction ID: af1efbf939843c1da8293846324a7803810aa50deb8efb2bbcf299b542b611bf
Opcode Fuzzy Hash: ee0ce11c10ab0fc092077075c7da8f283fbfb9a05008b903320b8f0957d9016a
Instruction Fuzzy Hash: 7331A431704282CBEB117F69C9843267BB4EB81365F188579F958CF246DB35C8488BF1

Uniqueness

Uniqueness Score: -1.00%

Function 6DD63F90 Relevance: 7.6, APIs: 5, Instructions: 84
COMMON

Download Yara Rule

C-Code - Quality: 68%

			E6DD63F90(intOrPtr* _a4) {
				intOrPtr _v32;
				intOrPtr _v36;
				char _v40;
				signed int _v48;
				intOrPtr _v72;
				void* __ebx;
				void* __esi;
				void* _t26;
				signed int _t28;
				signed int _t31;
				signed int _t38;
				intOrPtr _t44;
				signed int _t45;
				signed int _t52;
				intOrPtr* _t53;
				intOrPtr _t54;
				intOrPtr* _t55;

				_t53 = _a4;
				_t26 = E6DD63AC0(_t53);
				if(_t26 == 0) {
					_t44 =  *_t53;
					_t28 = E6DD63710(_t44, __eflags);
					_t52 = _t28;
					__eflags = _t28;
					if(_t28 == 0) {
						__eflags =  *(_t44 + 8);
						if( *(_t44 + 8) != 0) {
							L7:
							asm("lock add dword [ebx+0x8], 0x1");
						} else {
							_t45 =  *(_t44 + 0x10);
							_t31 =  *(_t44 + 0xc);
							__eflags = _t45;
							if(_t45 > 0) {
								_t31 = _t31 - _t45;
								__eflags = _t31;
								 *(_t44 + 0x10) = 0;
								 *(_t44 + 0xc) = _t31;
							}
							__eflags = _t31;
							if(__eflags > 0) {
								_v40 = 0x6dd637b0;
								_t54 = _t44 + 0x18;
								 *(_t44 + 0x10) =  ~_t31;
								_v36 = _t44;
								_v32 =  *((intOrPtr*)(E6DD65870(__eflags)));
								asm("lock or dword [esp], 0x0");
								 *((intOrPtr*)(E6DD65870(__eflags))) =  &_v40;
								asm("lock or dword [esp], 0x0");
								_v48 = _t44 + 0x1c;
								while(1) {
									_v72 = _t54;
									 *_t55 = _v48;
									_t38 = E6DD62760();
									__eflags = _t38;
									if(__eflags != 0) {
										break;
									}
									__eflags =  *(_t44 + 0x10);
									if(__eflags >= 0) {
										 *((intOrPtr*)(E6DD65870(__eflags))) = _v32;
										 *(_t44 + 0xc) = 0;
										goto L7;
									} else {
										continue;
									}
									goto L8;
								}
								_v48 = _t38;
								 *((intOrPtr*)(E6DD65870(__eflags))) = _v32;
								 *_t55 = _v36;
								_v40();
								_t52 = _v48;
							} else {
								goto L7;
							}
						}
					}
					L8:
					return E6DD637D0(_t53, _t44, _t52, _t53);
				} else {
					return _t26;
				}
			}

0x6dd63f97
0x6dd63f9d
0x6dd63fa4
0x6dd63fb0
0x6dd63fb4
0x6dd63fb9
0x6dd63fbb
0x6dd63fbd
0x6dd63fc2
0x6dd63fc4
0x6dd63fe0
0x6dd63fe0
0x6dd63fc6
0x6dd63fc6
0x6dd63fc9
0x6dd63fcc
0x6dd63fce
0x6dd63fd0
0x6dd63fd0
0x6dd63fd2
0x6dd63fd9
0x6dd63fd9
0x6dd63fdc
0x6dd63fde
0x6dd64002
0x6dd6400a
0x6dd6400d
0x6dd64010
0x6dd6401b
0x6dd6401f
0x6dd6402d
0x6dd64032
0x6dd64037
0x6dd64047
0x6dd6404b
0x6dd6404f
0x6dd64052
0x6dd64057
0x6dd64059
0x00000000
0x00000000
0x6dd64043
0x6dd64045
0x6dd64089
0x6dd6408b
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6dd64045
0x6dd6405b
0x6dd64068
0x6dd6406e
0x6dd64071
0x6dd64079
0x00000000
0x00000000
0x00000000
0x6dd63fde
0x6dd63fc4
0x6dd63fe5
0x6dd63ff5
0x6dd63fad
0x6dd63fad
0x6dd63fad

Memory Dump Source

Source File: 00000004.00000002.787395814.000000006DD61000.00000040.00000001.01000000.0000000A.sdmp, Offset: 6DD60000, based on PE: true

Associated: 00000004.00000002.787383138.000000006DD60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787413037.000000006DD6B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787415936.000000006DD6F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787437708.000000006DD74000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787474619.000000006DDD6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787482411.000000006DDE6000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6dd60000_windowsconnect.jbxd

Similarity

API ID: pthread_spin_lockpthread_spin_unlock
String ID:
API String ID: 4077346669-0
Opcode ID: f54ad4bbc678c1a0bf12c15d39ca2b13ede80207cfac3e31f886f2ff22eadf4a
Instruction ID: 5283d62383b3556ea2670548faaa537f127531164ca2f141ca44c6dfdc9227f7
Opcode Fuzzy Hash: f54ad4bbc678c1a0bf12c15d39ca2b13ede80207cfac3e31f886f2ff22eadf4a
Instruction Fuzzy Hash: F03128746083428FD704EF26D48061AB7E4AF88358F05896DF9998B315EB35D905CFF1

Uniqueness

Uniqueness Score: -1.00%

Function 6DD668A0 Relevance: 7.6, APIs: 5, Instructions: 82COMMON

Download Yara Rule

APIs

__pth_gpointer_locked.LIBWINPTHREAD-1 ref: 6DD668BF

Part of subcall function 6DD64C20: pthread_mutex_lock.LIBWINPTHREAD-1(?,?,00000000,?,6DD64C6F,?,?,?,?,?,?,00000000,?,?,?,6DD658D2), ref: 6DD64C36
Part of subcall function 6DD64C20: pthread_mutex_unlock.LIBWINPTHREAD-1(?,?,00000000,?,6DD64C6F,?,?,?,?,?,?,00000000,?,?,?,6DD658D2), ref: 6DD64C4B

_mbsdup.MSVCRT ref: 6DD66901
??3@YAXPAX@Z.MSVCRT ref: 6DD6691A
IsDebuggerPresent.KERNEL32 ref: 6DD6693D
RaiseException.KERNEL32 ref: 6DD6696F

Memory Dump Source

Source File: 00000004.00000002.787395814.000000006DD61000.00000040.00000001.01000000.0000000A.sdmp, Offset: 6DD60000, based on PE: true

Associated: 00000004.00000002.787383138.000000006DD60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787413037.000000006DD6B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787415936.000000006DD6F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787437708.000000006DD74000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787474619.000000006DDD6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787482411.000000006DDE6000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6dd60000_windowsconnect.jbxd

Similarity

API ID: ??3@DebuggerExceptionPresentRaise__pth_gpointer_locked_mbsduppthread_mutex_lockpthread_mutex_unlock
String ID:
API String ID: 2070848239-0
Opcode ID: dd762f6f2bf5a0905afd3c7976a563b3307eb2814966e4c6f7e6a633f3e12f39
Instruction ID: bac93c7ab0ca516d610705fe6c05aae8d85f771a0eeb3e319e8b62904a78388a
Opcode Fuzzy Hash: dd762f6f2bf5a0905afd3c7976a563b3307eb2814966e4c6f7e6a633f3e12f39
Instruction Fuzzy Hash: 3B216071A083928BD700AF69D54471EBBF4AB85755F0145BAFD88CB345D771C844CBE2

Uniqueness

Uniqueness Score: -1.00%

Function 6DD61A20 Relevance: 7.6, APIs: 5, Instructions: 74COMMON

Download Yara Rule

APIs

RtlEnterCriticalSection.NTDLL ref: 6DD61A37
ReleaseSemaphore.KERNEL32 ref: 6DD61A8E
RtlLeaveCriticalSection.NTDLL ref: 6DD61A9E
RtlLeaveCriticalSection.NTDLL ref: 6DD61ABB
RtlLeaveCriticalSection.NTDLL ref: 6DD61AE4

Memory Dump Source

Source File: 00000004.00000002.787395814.000000006DD61000.00000040.00000001.01000000.0000000A.sdmp, Offset: 6DD60000, based on PE: true

Associated: 00000004.00000002.787383138.000000006DD60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787413037.000000006DD6B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787415936.000000006DD6F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787437708.000000006DD74000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787474619.000000006DDD6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787482411.000000006DDE6000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6dd60000_windowsconnect.jbxd

Similarity

API ID: CriticalSection$Leave$EnterReleaseSemaphore
String ID:
API String ID: 2813224205-0
Opcode ID: 8e71cd854def520a9714810e4fe8fa67321feef15f921f0351657acfd5bbdc11
Instruction ID: 2ba7fd5f7511dde7849d11fedaca17eea2dc64b0f67214921c2a130acdfab822
Opcode Fuzzy Hash: 8e71cd854def520a9714810e4fe8fa67321feef15f921f0351657acfd5bbdc11
Instruction Fuzzy Hash: A6213EB26097458FE704AF39E48572EBBF4FB89251F41093EF94AC3340D635D9488BA2

Uniqueness

Uniqueness Score: -1.00%

Function 6DD66DE0 Relevance: 7.6, APIs: 5, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 6DD66A90: pthread_mutex_lock.LIBWINPTHREAD-1 ref: 6DD66AB3

pthread_mutex_unlock.LIBWINPTHREAD-1 ref: 6DD66E31
pthread_getclean.LIBWINPTHREAD-1 ref: 6DD66E58
pthread_getclean.LIBWINPTHREAD-1 ref: 6DD66E68
pthread_getclean.LIBWINPTHREAD-1 ref: 6DD66E94
_errno.MSVCRT ref: 6DD66EC7

Memory Dump Source

Source File: 00000004.00000002.787395814.000000006DD61000.00000040.00000001.01000000.0000000A.sdmp, Offset: 6DD60000, based on PE: true

Associated: 00000004.00000002.787383138.000000006DD60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787413037.000000006DD6B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787415936.000000006DD6F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787437708.000000006DD74000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787474619.000000006DDD6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787482411.000000006DDE6000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6dd60000_windowsconnect.jbxd

Similarity

API ID: pthread_getclean$_errnopthread_mutex_lockpthread_mutex_unlock
String ID:
API String ID: 84148830-0
Opcode ID: 360eca37b1534ab0632eb2e189ae8c79ff6326f88be4f935ac7d7611262109f4
Instruction ID: e7708c2eb44a2145edfd7d7eea774c132f9f71ec0ba3e15aafd19792745b84ba
Opcode Fuzzy Hash: 360eca37b1534ab0632eb2e189ae8c79ff6326f88be4f935ac7d7611262109f4
Instruction Fuzzy Hash: DB212875508342CFD700EF68C44461EBBE0AF89768F018A5DF894AB362D734D9458FE2

Uniqueness

Uniqueness Score: -1.00%

Function 6DD69470 Relevance: 7.6, APIs: 5, Instructions: 61COMMON

Download Yara Rule

APIs

_lock.MSVCRT ref: 6DD69489
_unlock.MSVCRT ref: 6DD694B1
calloc.MSVCRT ref: 6DD694FF

Memory Dump Source

Source File: 00000004.00000002.787395814.000000006DD61000.00000040.00000001.01000000.0000000A.sdmp, Offset: 6DD60000, based on PE: true

Associated: 00000004.00000002.787383138.000000006DD60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787413037.000000006DD6B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787415936.000000006DD6F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787437708.000000006DD74000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787474619.000000006DDD6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787482411.000000006DDE6000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6dd60000_windowsconnect.jbxd

Similarity

API ID: _lock_unlockcalloc
String ID:
API String ID: 3876498383-0
Opcode ID: bc7c9211e11e7378f5e61e8f68fd5fd2ba33df29a14fefb0ae377ceaa0f091f3
Instruction ID: f513f677dcdaacbe451d41d29d2331b4325b061aec000efa2908bace0e50df34
Opcode Fuzzy Hash: bc7c9211e11e7378f5e61e8f68fd5fd2ba33df29a14fefb0ae377ceaa0f091f3
Instruction Fuzzy Hash: 592129B0608242CBD701EF28C58066A7BE5FF85314F55C669E9988B389EB74D844CBF2

Uniqueness

Uniqueness Score: -1.00%

Function 6DD64D88 Relevance: 7.6, APIs: 5, Instructions: 55
COMMON

Download Yara Rule

C-Code - Quality: 83%

			E6DD64D88(void* __eax, void* __ecx, void* __edi, void* __ebp, intOrPtr _a4) {

				if(__eax == 1) {
					_a4 = E6DD64370;
					 *__esp = 1; // executed
					__eax =  *0x6dd6f180(); // executed
					__esp = __esp - 8;
					 *0x6dd6c02c = __eax;
					__eax = 1;
					__esp =  &(__esp[4]);
					_pop(__ebx);
					_pop(__esi);
					_pop(__edi);
					return 1;
				} else {
					if(__eax == 3) {
						__eax =  *0x6dd6a020;
						if(__eax != 0xffffffff) {
							__eax = TlsGetValue(__eax);
							__esp = __esp - 4;
							__ebx = __eax;
							if(__eax != 0) {
								if(( *(__eax + 0x20) & 0x00000030) == 0) {
									__eax =  *(__eax + 0x18);
									if( *(__ebx + 0x68) != 0) {
										if(__eax != 0) {
											__eax = CloseHandle(__eax);
											__esp = __esp - 4;
										}
										_t25 = __ebx + 0x1c; // 0x1c
										__eax = _t25;
										 *(__ebx + 0x18) = 0;
										__eax = E6DD63470(_t25);
										_t27 = __ebx + 0x38; // 0x38
										_t27 = E6DD64A20(_t27, __ebx, __edi, __esi);
									} else {
										if(__eax != 0) {
											__eax = CloseHandle(__eax);
											__esp = __esp - 4;
										}
										__eax =  *(__ebx + 0xb4);
										 *(__ebx + 0x18) = 0;
										 *(__ebx + 0x68) = 1;
										if(__eax != 0) {
											__eax = E6DD64C60(__eax);
										}
										_t18 = __ebx + 0x1c; // 0x1c
										__edi = _t18;
										_t19 = __ebx + 0x38; // 0x38
										__esi = _t19;
										if(( *(__ebx + 0x24) & 0x00000004) == 0) {
											__eax = E6DD63470(__edi);
											__esi = E6DD64A20(__esi, __ebx, __edi, __esi);
										} else {
											__eax =  *(__ebx + 0x14);
											 *__ebx = 0xdeadbeef;
											if(__eax != 0) {
												__eax = CloseHandle(__eax);
												__esp = __esp - 4;
											}
											 *(__ebx + 0x14) = 0;
											__eax = E6DD63470(__edi);
											__eax = __esi;
											goto L14;
										}
									}
								} else {
									__eax =  *(__eax + 0xb4);
									if(__eax != 0) {
										__eax = E6DD64C60(__eax);
									}
									__eax =  *(__ebx + 0x14);
									if(__eax != 0) {
										 *__esp = __eax;
										__esi =  *0x6dd6f184;
										__eax = CloseHandle(??);
										__eax =  *(__ebx + 0x18);
										__esp = __esp - 4;
										if(__eax != 0) {
											__eax = CloseHandle(__eax);
											__esp = __esp - 4;
										}
										 *(__ebx + 0x18) = 0;
										 *(__ebx + 0x14) = 0;
									}
									_t9 = __ebx + 0x1c; // 0x1c
									_t9 = E6DD63470(_t9);
									_t10 = __ebx + 0x38; // 0x38
									__eax = _t10;
									L14:
									__eax = E6DD64A20(__eax, __ebx, __edi, __esi);
									__ebx = E6DD64650(__ebx);
									 *0x6dd6a020 = TlsSetValue( *0x6dd6a020, 0);
									__esp = __esp - 8;
								}
							}
						}
					}
					return 1;
				}
			}

0x6dd64d93
0x6dd64e70
0x6dd64e78
0x6dd64e7f
0x6dd64e85
0x6dd64e88
0x6dd64e8d
0x6dd64e92
0x6dd64e95
0x6dd64e96
0x6dd64e97
0x6dd64e98
0x6dd64d99
0x6dd64d9c
0x6dd64d9e
0x6dd64da6
0x6dd64dab
0x6dd64db1
0x6dd64db4
0x6dd64db8
0x6dd64dbe
0x6dd64ea3
0x6dd64ea8
0x6dd64f1a
0x6dd64f1f
0x6dd64f25
0x6dd64f25
0x6dd64f28
0x6dd64f28
0x6dd64f2b
0x6dd64f35
0x6dd64f3a
0x6dd64f3d
0x6dd64eaa
0x6dd64eac
0x6dd64eb1
0x6dd64eb7
0x6dd64eb7
0x6dd64eba
0x6dd64ec0
0x6dd64ec7
0x6dd64ed0
0x6dd64ed2
0x6dd64ed2
0x6dd64ed7
0x6dd64ed7
0x6dd64eda
0x6dd64eda
0x6dd64ee1
0x6dd64f53
0x6dd64f5a
0x6dd64ee3
0x6dd64ee3
0x6dd64ee6
0x6dd64eee
0x6dd64ef3
0x6dd64ef9
0x6dd64ef9
0x6dd64efc
0x6dd64f06
0x6dd64f0b
0x00000000
0x6dd64f0b
0x6dd64ee1
0x6dd64dc4
0x6dd64dc4
0x6dd64dcc
0x6dd64dce
0x6dd64dce
0x6dd64dd3
0x6dd64dd8
0x6dd64dda
0x6dd64ddd
0x6dd64de3
0x6dd64de5
0x6dd64de8
0x6dd64ded
0x6dd64df2
0x6dd64df4
0x6dd64df4
0x6dd64df7
0x6dd64dfe
0x6dd64dfe
0x6dd64e05
0x6dd64e0b
0x6dd64e10
0x6dd64e10
0x6dd64e13
0x6dd64e13
0x6dd64e1a
0x6dd64e2f
0x6dd64e35
0x6dd64e35
0x6dd64dbe
0x6dd64db8
0x6dd64da6
0x6dd64d85
0x6dd64d85

APIs

TlsGetValue.KERNEL32 ref: 6DD64DAB
CloseHandle.KERNEL32 ref: 6DD64DE3
CloseHandle.KERNEL32 ref: 6DD64DF2
pthread_mutex_destroy.LIBWINPTHREAD-1 ref: 6DD64E0B

Part of subcall function 6DD64C60: __pth_gpointer_locked.LIBWINPTHREAD-1(?,?,?,?,?,?,00000000,?,?,?,6DD658D2,?,?,?,0000001C,6DD65A6F), ref: 6DD64C6A
Part of subcall function 6DD64C60: pthread_spin_lock.LIBWINPTHREAD-1 ref: 6DD64C8B
Part of subcall function 6DD64C60: pthread_rwlock_rdlock.LIBWINPTHREAD-1 ref: 6DD64CCE
Part of subcall function 6DD64C60: pthread_spin_unlock.LIBWINPTHREAD-1 ref: 6DD64CF2
Part of subcall function 6DD64C60: pthread_spin_lock.LIBWINPTHREAD-1 ref: 6DD64D05
Part of subcall function 6DD64C60: pthread_rwlock_unlock.LIBWINPTHREAD-1 ref: 6DD64D1C
Part of subcall function 6DD64C60: pthread_spin_unlock.LIBWINPTHREAD-1 ref: 6DD64D29

TlsSetValue.KERNEL32 ref: 6DD64E2F
RtlAddVectoredExceptionHandler.NTDLL ref: 6DD64E7F
CloseHandle.KERNEL32 ref: 6DD64EB1
CloseHandle.KERNEL32 ref: 6DD64EF3
pthread_mutex_destroy.LIBWINPTHREAD-1 ref: 6DD64F06

Memory Dump Source

Source File: 00000004.00000002.787395814.000000006DD61000.00000040.00000001.01000000.0000000A.sdmp, Offset: 6DD60000, based on PE: true

Associated: 00000004.00000002.787383138.000000006DD60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787413037.000000006DD6B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787415936.000000006DD6F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787437708.000000006DD74000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787474619.000000006DDD6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787482411.000000006DDE6000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6dd60000_windowsconnect.jbxd

Similarity

API ID: CloseHandle$Valuepthread_mutex_destroypthread_spin_lockpthread_spin_unlock$ExceptionHandlerVectored__pth_gpointer_lockedpthread_rwlock_rdlockpthread_rwlock_unlock
String ID:
API String ID: 4009224233-0
Opcode ID: 0fc142bd338a8683913008274d060abe93b62181fccf2e9e71a2c91df7e7b868
Instruction ID: a49ada18509c9f0b7c7ed83621da8cdf9f15406b779162906cba2295941401b7
Opcode Fuzzy Hash: 0fc142bd338a8683913008274d060abe93b62181fccf2e9e71a2c91df7e7b868
Instruction Fuzzy Hash: 29110D71A0C6818BEB00FF78D5A476A7BF4AF0A314F014569E894CB256E734D855CBF2

Uniqueness

Uniqueness Score: -1.00%

Function 6DD67DA0 Relevance: 7.6, APIs: 5, Instructions: 55timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 6DD67DDF
GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,6DD613E5), ref: 6DD67DF0
GetCurrentThreadId.KERNEL32 ref: 6DD67DF8
GetTickCount.KERNEL32 ref: 6DD67E00
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,6DD613E5), ref: 6DD67E0F

Memory Dump Source

Source File: 00000004.00000002.787395814.000000006DD61000.00000040.00000001.01000000.0000000A.sdmp, Offset: 6DD60000, based on PE: true

Associated: 00000004.00000002.787383138.000000006DD60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787413037.000000006DD6B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787415936.000000006DD6F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787437708.000000006DD74000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787474619.000000006DDD6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787482411.000000006DDE6000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6dd60000_windowsconnect.jbxd

Similarity

API ID: CurrentTime$CountCounterFilePerformanceProcessQuerySystemThreadTick
String ID:
API String ID: 1445889803-0
Opcode ID: c45a9b1a752c6f293ed92c7738698e12525e588a3786cdcdae2cc2df343d93c7
Instruction ID: f00cfc42b8a235247f1e667a05cdb91f4bb6891987971786f5fd479d012c70d3
Opcode Fuzzy Hash: c45a9b1a752c6f293ed92c7738698e12525e588a3786cdcdae2cc2df343d93c7
Instruction Fuzzy Hash: BE1151B59443458FEB10EF79D48866BBBF1FB89254F015C39E444C6600EB39D44D8BE2

Uniqueness

Uniqueness Score: -1.00%

Function 6DD64771 Relevance: 7.6, APIs: 5, Instructions: 51
COMMON

Download Yara Rule

C-Code - Quality: 28%

			E6DD64771(void* __eax, void** __ebx, void* __edi, void* __ebp, void* _a4, signed int _a8, void* _a28) {
				void* _t17;
				void* _t18;
				void* _t19;
				void** _t22;
				void** _t24;
				void** _t39;
				void** _t40;

				_t24 = __ebx;
				__eax = __eax + 1;
				if(__ebp > __eax) {
					__ebp = __ebp - __eax;
					__edx = __eax * 8;
					__eax = __ebp * 8;
					_a8 = __ebp * 8;
					__eax = __edi + __edx;
					_a4 = __edi + __edx;
					__eax = __edi + __edx - 8;
					 *__esp = __edi + __edx - 8;
					__eax = memmove(??, ??, ??);
				}
				__eax = _a28;
				 *0x6dd6c038 = __eax;
				if(__eax == 0) {
					 *__esp = __edi;
					L6DD69400();
					 *0x6dd6c034 = 0;
					 *0x6dd6c038 = 0;
				}
				_t17 = _t24[0xb];
				if(_t17 != 0) {
					 *_t39 = _t17;
					L6DD69400();
				}
				_t18 = _t24[0xc];
				if(_t18 != 0) {
					 *_t39 = _t18;
					L6DD69400();
				}
				_t19 = _t24[0xd];
				if(_t19 != 0) {
					 *_t39 = _t19;
					L6DD69400();
				}
				_t4 =  &(_t24[1]); // 0x4
				 *_t24 = 0;
				_t24[0x2d] = 0;
				memset(_t4 & 0xfffffffc, 0, _t24 - (_t4 & 0xfffffffc) + 0xb8 >> 2 << 2);
				_t40 =  &(_t39[3]);
				_t22 =  *0x6dd6c040;
				if(_t22 == 0) {
					 *0x6dd6c040 = _t24;
					 *0x6dd6c044 = _t24;
				} else {
					_t22[0x2c] = _t24;
					 *0x6dd6c040 = _t24;
				}
				 *_t40 = 0x6dd6a018;
				return E6DD632E0();
			}

0x6dd64771
0x6dd64778
0x6dd6477d
0x6dd647b1
0x6dd647b3
0x6dd647ba
0x6dd647c1
0x6dd647c5
0x6dd647c8
0x6dd647cc
0x6dd647d0
0x6dd647d3
0x6dd647d3
0x6dd6477f
0x6dd64783
0x6dd6478a
0x6dd64790
0x6dd64793
0x6dd64798
0x6dd647a2
0x6dd647a2
0x6dd64692
0x6dd64697
0x6dd64699
0x6dd6469c
0x6dd6469c
0x6dd646a1
0x6dd646a6
0x6dd646a8
0x6dd646ab
0x6dd646ab
0x6dd646b0
0x6dd646b5
0x6dd646b7
0x6dd646ba
0x6dd646ba
0x6dd646bf
0x6dd646c6
0x6dd646cc
0x6dd646e4
0x6dd646e4
0x6dd646e6
0x6dd646ed
0x6dd64760
0x6dd64766
0x6dd646ef
0x6dd646ef
0x6dd646f5
0x6dd646f5
0x6dd646fb
0x6dd6470e

APIs

??3@YAXPAX@Z.MSVCRT ref: 6DD6469C
??3@YAXPAX@Z.MSVCRT ref: 6DD646AB
??3@YAXPAX@Z.MSVCRT ref: 6DD646BA
pthread_mutex_unlock.LIBWINPTHREAD-1(?,?,?,?,00000000,?,?,?,6DD65959,?,?,?,?,?,0000001C,6DD65A6F), ref: 6DD64702
??3@YAXPAX@Z.MSVCRT ref: 6DD64793
memmove.MSVCRT ref: 6DD647D3

Memory Dump Source

Source File: 00000004.00000002.787395814.000000006DD61000.00000040.00000001.01000000.0000000A.sdmp, Offset: 6DD60000, based on PE: true

Associated: 00000004.00000002.787383138.000000006DD60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787413037.000000006DD6B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787415936.000000006DD6F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787437708.000000006DD74000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787474619.000000006DDD6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787482411.000000006DDE6000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6dd60000_windowsconnect.jbxd

Similarity

API ID: ??3@$memmovepthread_mutex_unlock
String ID:
API String ID: 885880168-0
Opcode ID: 2f7dd747163791d09678e4986b036b3b18d3134b0b8279570b404793806ba008
Instruction ID: 2acc334459720168403cbcff4da8c10549e52deb029797ffe68b26af15ab04f2
Opcode Fuzzy Hash: 2f7dd747163791d09678e4986b036b3b18d3134b0b8279570b404793806ba008
Instruction Fuzzy Hash: C01118B12086828BEF10BF69D4A03A67BF5FB45358F024569EA48CB245DB35D444CBF2

Uniqueness

Uniqueness Score: -1.00%

Function 6DD64CA7 Relevance: 7.5, APIs: 5, Instructions: 45COMMON

Download Yara Rule

APIs

pthread_rwlock_rdlock.LIBWINPTHREAD-1 ref: 6DD64CCE
pthread_spin_unlock.LIBWINPTHREAD-1 ref: 6DD64CF2
pthread_spin_lock.LIBWINPTHREAD-1 ref: 6DD64D05
pthread_rwlock_unlock.LIBWINPTHREAD-1 ref: 6DD64D1C
pthread_spin_unlock.LIBWINPTHREAD-1 ref: 6DD64D29

Memory Dump Source

Source File: 00000004.00000002.787395814.000000006DD61000.00000040.00000001.01000000.0000000A.sdmp, Offset: 6DD60000, based on PE: true

Associated: 00000004.00000002.787383138.000000006DD60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787413037.000000006DD6B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787415936.000000006DD6F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787437708.000000006DD74000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787474619.000000006DDD6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787482411.000000006DDE6000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6dd60000_windowsconnect.jbxd

Similarity

API ID: pthread_spin_unlock$pthread_rwlock_rdlockpthread_rwlock_unlockpthread_spin_lock
String ID:
API String ID: 1248696315-0
Opcode ID: 2193ee6137aa96d36da3a077098e16b83d4d3ca574e26193265d2973bf34f114
Instruction ID: 38c99ecab80d84b8d8375919bde42ace3af0d25412548cc4e2771d82d7f4b531
Opcode Fuzzy Hash: 2193ee6137aa96d36da3a077098e16b83d4d3ca574e26193265d2973bf34f114
Instruction Fuzzy Hash: B311FA71948699CFD710FF24D490A69BBF0BF0A314F061859E5854BB52C735A4948FF2

Uniqueness

Uniqueness Score: -1.00%

Function 6DD66A90 Relevance: 7.5, APIs: 5, Instructions: 45COMMON

Download Yara Rule

APIs

pthread_mutex_lock.LIBWINPTHREAD-1 ref: 6DD66AB3
pthread_testcancel.LIBWINPTHREAD-1 ref: 6DD66AD8

Memory Dump Source

Source File: 00000004.00000002.787395814.000000006DD61000.00000040.00000001.01000000.0000000A.sdmp, Offset: 6DD60000, based on PE: true

Associated: 00000004.00000002.787383138.000000006DD60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787413037.000000006DD6B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787415936.000000006DD6F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787437708.000000006DD74000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787474619.000000006DDD6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787482411.000000006DDE6000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6dd60000_windowsconnect.jbxd

Similarity

API ID: pthread_mutex_lockpthread_testcancel
String ID:
API String ID: 78788923-0
Opcode ID: 4fd04002f44979340466211dbb629882201ee911c102d1df36db57bfe29f949a
Instruction ID: cd1ae25da13dc73d173be485e9491d1b2a6186b49f1eac135fb7366eb6ff14ae
Opcode Fuzzy Hash: 4fd04002f44979340466211dbb629882201ee911c102d1df36db57bfe29f949a
Instruction Fuzzy Hash: 98014F75208396CFD724BF7A848063A77E5FF86328F15C6A9F96487281D77098048BF2

Uniqueness

Uniqueness Score: -1.00%

Function 6DD64673 Relevance: 7.5, APIs: 5, Instructions: 45
COMMON

Download Yara Rule

C-Code - Quality: 21%

			E6DD64673(intOrPtr* __ebx, void* __eflags) {
				intOrPtr _t26;
				intOrPtr _t27;
				intOrPtr _t28;
				intOrPtr _t31;
				intOrPtr _t33;
				signed int _t35;
				signed int _t36;
				intOrPtr _t41;
				intOrPtr* _t42;
				intOrPtr _t49;
				int _t50;
				signed int _t51;
				intOrPtr _t56;
				intOrPtr _t57;
				intOrPtr _t59;
				intOrPtr* _t62;
				intOrPtr* _t63;

				_t42 = __ebx;
				 *_t62 = 0x6dd6a018;
				E6DD62F90();
				_t57 =  *((intOrPtr*)(__ebx + 0xb4));
				if(_t57 != 0) {
					_t59 =  *0x6dd6c038;
					__eflags = _t59;
					if(_t59 == 0) {
						goto L2;
					}
					_t33 = _t59 - 1;
					_t56 =  *0x6dd6c03c;
					_t50 = 0;
					 *((intOrPtr*)(_t62 + 0x1c)) = _t33;
					_t49 = _t33;
					while(1) {
						_t35 = _t50 + _t49 >> 1;
						__eflags = _t57 -  *((intOrPtr*)(_t56 + 4 + _t35 * 8));
						if(__eflags == 0) {
							break;
						}
						if(__eflags < 0) {
							__eflags = _t35 - _t50;
							if(_t35 == _t50) {
								goto L2;
							}
							_t49 = _t35 - 1;
							L15:
							__eflags = _t49 - _t50;
							if(_t49 < _t50) {
								goto L2;
							}
							continue;
						}
						_t50 = _t35 + 1;
						goto L15;
					}
					_t36 = _t35 + 1;
					__eflags = _t59 - _t36;
					if(_t59 > _t36) {
						_t51 = _t36 * 8;
						 *(_t62 + 8) = (_t59 - _t36) * 8;
						 *((intOrPtr*)(_t62 + 4)) = _t56 + _t51;
						 *_t62 = _t56 + _t51 - 8;
						memmove(??, ??, ??);
					}
					_t41 =  *((intOrPtr*)(_t62 + 0x1c));
					 *0x6dd6c038 = _t41;
					__eflags = _t41;
					if(_t41 == 0) {
						 *_t62 = _t56;
						L6DD69400();
						 *0x6dd6c034 = 0;
						 *0x6dd6c038 = 0;
					}
					goto L2;
				} else {
					L2:
					_t26 =  *((intOrPtr*)(_t42 + 0x2c));
					if(_t26 != 0) {
						 *_t62 = _t26;
						L6DD69400();
					}
					_t27 =  *((intOrPtr*)(_t42 + 0x30));
					if(_t27 != 0) {
						 *_t62 = _t27;
						L6DD69400();
					}
					_t28 =  *((intOrPtr*)(_t42 + 0x34));
					if(_t28 != 0) {
						 *_t62 = _t28;
						L6DD69400();
					}
					_t5 = _t42 + 4; // 0x4
					 *_t42 = 0;
					 *((intOrPtr*)(_t42 + 0xb4)) = 0;
					memset(_t5 & 0xfffffffc, 0, _t42 - (_t5 & 0xfffffffc) + 0xb8 >> 2 << 2);
					_t63 = _t62 + 0xc;
					_t31 =  *0x6dd6c040;
					if(_t31 == 0) {
						 *0x6dd6c040 = _t42;
						 *0x6dd6c044 = _t42;
					} else {
						 *((intOrPtr*)(_t31 + 0xb0)) = _t42;
						 *0x6dd6c040 = _t42;
					}
					 *_t63 = 0x6dd6a018;
					return E6DD632E0();
				}
			}

0x6dd64673
0x6dd64678
0x6dd6467f
0x6dd64684
0x6dd6468c
0x6dd64710
0x6dd64716
0x6dd64718
0x00000000
0x00000000
0x6dd6471e
0x6dd64721
0x6dd64727
0x6dd64729
0x6dd6472d
0x6dd6474b
0x6dd6474e
0x6dd64750
0x6dd64754
0x00000000
0x00000000
0x6dd64756
0x6dd64738
0x6dd6473a
0x00000000
0x00000000
0x6dd64740
0x6dd64743
0x6dd64743
0x6dd64745
0x00000000
0x00000000
0x00000000
0x6dd64745
0x6dd64758
0x00000000
0x6dd64758
0x6dd64778
0x6dd6477b
0x6dd6477d
0x6dd647b3
0x6dd647c1
0x6dd647c8
0x6dd647d0
0x6dd647d3
0x6dd647d3
0x6dd6477f
0x6dd64783
0x6dd64788
0x6dd6478a
0x6dd64790
0x6dd64793
0x6dd64798
0x6dd647a2
0x6dd647a2
0x00000000
0x6dd64692
0x6dd64692
0x6dd64692
0x6dd64697
0x6dd64699
0x6dd6469c
0x6dd6469c
0x6dd646a1
0x6dd646a6
0x6dd646a8
0x6dd646ab
0x6dd646ab
0x6dd646b0
0x6dd646b5
0x6dd646b7
0x6dd646ba
0x6dd646ba
0x6dd646bf
0x6dd646c6
0x6dd646cc
0x6dd646e4
0x6dd646e4
0x6dd646e6
0x6dd646ed
0x6dd64760
0x6dd64766
0x6dd646ef
0x6dd646ef
0x6dd646f5
0x6dd646f5
0x6dd646fb
0x6dd6470e
0x6dd6470e

APIs

pthread_mutex_lock.LIBWINPTHREAD-1(?,?,?,?,00000000,?,?,?,6DD65959,?,?,?,?,?,0000001C,6DD65A6F), ref: 6DD6467F
??3@YAXPAX@Z.MSVCRT ref: 6DD6469C
??3@YAXPAX@Z.MSVCRT ref: 6DD646AB
??3@YAXPAX@Z.MSVCRT ref: 6DD646BA
pthread_mutex_unlock.LIBWINPTHREAD-1(?,?,?,?,00000000,?,?,?,6DD65959,?,?,?,?,?,0000001C,6DD65A6F), ref: 6DD64702

Memory Dump Source

Source File: 00000004.00000002.787395814.000000006DD61000.00000040.00000001.01000000.0000000A.sdmp, Offset: 6DD60000, based on PE: true

Associated: 00000004.00000002.787383138.000000006DD60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787413037.000000006DD6B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787415936.000000006DD6F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787437708.000000006DD74000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787474619.000000006DDD6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787482411.000000006DDE6000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6dd60000_windowsconnect.jbxd

Similarity

API ID: ??3@$pthread_mutex_lockpthread_mutex_unlock
String ID:
API String ID: 4211330938-0
Opcode ID: f8e64f0948a160fb1318997ec240ff95db7515e18857617349af0d9c8e0395ce
Instruction ID: 64e245fb94f0b9b67fd98e50441d297f02de809bd753ce5e5dcbdad9b1ce09fd
Opcode Fuzzy Hash: f8e64f0948a160fb1318997ec240ff95db7515e18857617349af0d9c8e0395ce
Instruction Fuzzy Hash: 7E0129716086808BDF10BF79D4907667BE6BB45318F06456CEA889B346DB30D544CBF2

Uniqueness

Uniqueness Score: -1.00%

Function 6DD67260 Relevance: 7.5, APIs: 5, Instructions: 45COMMON

Download Yara Rule

APIs

pthread_mutex_lock.LIBWINPTHREAD-1 ref: 6DD67283
pthread_mutex_unlock.LIBWINPTHREAD-1 ref: 6DD672A0
pthread_mutex_unlock.LIBWINPTHREAD-1 ref: 6DD672B2
_errno.MSVCRT ref: 6DD672B7
_errno.MSVCRT ref: 6DD672CA

Memory Dump Source

Source File: 00000004.00000002.787395814.000000006DD61000.00000040.00000001.01000000.0000000A.sdmp, Offset: 6DD60000, based on PE: true

Associated: 00000004.00000002.787383138.000000006DD60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787413037.000000006DD6B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787415936.000000006DD6F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787437708.000000006DD74000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787474619.000000006DDD6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787482411.000000006DDE6000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6dd60000_windowsconnect.jbxd

Similarity

API ID: _errnopthread_mutex_unlock$pthread_mutex_lock
String ID:
API String ID: 1880327674-0
Opcode ID: 235981c6757eec17c7153cd25268fd74743a935022a89a25d8ad3750ebdc4a74
Instruction ID: c08162021d1effddb6b8ec2f449aace092d3ce1b070c40d80d999b458b87a955
Opcode Fuzzy Hash: 235981c6757eec17c7153cd25268fd74743a935022a89a25d8ad3750ebdc4a74
Instruction Fuzzy Hash: 26017134A0878ABFD3507F698440A26B7A4FF8A728F11461DF8A487741D730D8008BF1

Uniqueness

Uniqueness Score: -1.00%

Function 6DD664C1 Relevance: 7.5, APIs: 5, Instructions: 44
threadsleepCOMMON

Download Yara Rule

C-Code - Quality: 27%

			E6DD664C1(intOrPtr* __ebx, void* __ecx, intOrPtr* __edi, intOrPtr __esi, void* __ebp, void* __eflags, intOrPtr _a4, signed int _a8, intOrPtr* _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr* _a64) {
				intOrPtr _t23;
				intOrPtr _t25;
				intOrPtr _t36;
				intOrPtr* _t45;
				intOrPtr _t49;
				intOrPtr* _t50;
				intOrPtr _t54;
				intOrPtr* _t60;
				intOrPtr* _t62;
				intOrPtr* _t63;
				intOrPtr* _t64;
				intOrPtr* _t65;

				_t50 = __edi;
				_t45 = __ebx;
				__eax = E6DD64AD0(__ebx, __ecx, __edi, __esi);
				 *((intOrPtr*)(__edi + 0x6c)) = __eax;
				_a4 = __esi;
				_a20 = 0;
				_a16 = 4;
				_a12 = __edi;
				_a8 = E6DD64F70;
				 *_t60 = 0;
				_t23 =  *0x6dd6f25c();
				_t54 = _t23;
				if(_t23 - 1 > 0xfffffffd) {
					_t25 =  *((intOrPtr*)(__edi + 0x18));
					if(_t25 != 0) {
						 *_t60 = _t25;
						CloseHandle(??);
						_t60 = _t60 - 4;
					}
					_t16 = _t50 + 0x1c; // 0x1c
					 *_t60 = _t16;
					E6DD63470();
					E6DD64A20(_t45, _t45, _t50, _t54);
					 *((intOrPtr*)(_t50 + 0x18)) = 0;
					 *((intOrPtr*)(_t50 + 0x14)) = 0;
					if(_a64 != 0) {
						 *_a64 = 0;
					}
					E6DD64650(_t50);
					return 0xb;
				} else {
					_t49 =  *((intOrPtr*)(__edi + 0x6c));
					_t36 = 0xfffffff1;
					if(_t49 >= 0xfffffff2) {
						_t36 = 0xfffffffe;
						if(_t49 >= 0xffffffff) {
							_t36 = 0xf;
							if(_t49 <= 0xe) {
								_t36 =  <=  ? _t49 : 2;
							}
						}
					}
					_a4 = _t36;
					 *_t60 = _t54;
					SetThreadPriority(??, ??);
					_t62 = _t60 - 8;
					 *_t62 =  *((intOrPtr*)(_t50 + 0x18));
					ResetEvent(??);
					_t63 = _t62 - 4;
					if(( *(_t50 + 0x24) & 0x00000004) != 0) {
						 *((intOrPtr*)(_t50 + 0x14)) = 0;
						 *_t63 = _t54;
						ResumeThread(??);
						_t64 = _t63 - 4;
						 *_t64 = _t54;
						CloseHandle(??);
						_t65 = _t64 - 4;
					} else {
						 *((intOrPtr*)(_t50 + 0x14)) = _t54;
						 *_t63 = _t54;
						ResumeThread(??);
						_t65 = _t63 - 4;
					}
					 *_t65 = 0;
					Sleep(??);
					return 0;
				}
			}

0x6dd664c1
0x6dd664c1
0x6dd664c8
0x6dd664d0
0x6dd66374
0x6dd66378
0x6dd66380
0x6dd66388
0x6dd6638c
0x6dd66394
0x6dd6639b
0x6dd663a1
0x6dd663a9
0x6dd66468
0x6dd6646d
0x6dd6646f
0x6dd66472
0x6dd66478
0x6dd66478
0x6dd6647b
0x6dd6647e
0x6dd66481
0x6dd66488
0x6dd6648d
0x6dd66494
0x6dd664a1
0x6dd664a7
0x6dd664a7
0x6dd664af
0x6dd664c0
0x6dd663af
0x6dd663af
0x6dd663b2
0x6dd663ba
0x6dd66438
0x6dd66440
0x6dd66446
0x6dd6644e
0x6dd6645c
0x6dd6645c
0x6dd6644e
0x6dd66440
0x6dd663bc
0x6dd663c0
0x6dd663c3
0x6dd663cc
0x6dd663cf
0x6dd663d2
0x6dd663d8
0x6dd663df
0x6dd66410
0x6dd66417
0x6dd6641a
0x6dd66420
0x6dd66423
0x6dd66426
0x6dd6642c
0x6dd663e1
0x6dd663e1
0x6dd663e4
0x6dd663e7
0x6dd663ed
0x6dd663ed
0x6dd663f0
0x6dd663f7
0x6dd66409
0x6dd66409

APIs

Part of subcall function 6DD64AD0: TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,6DD65ADA,?,?,?,?,6DD66ADD), ref: 6DD64AED

_beginthreadex.MSVCRT ref: 6DD6639B
SetThreadPriority.KERNEL32 ref: 6DD663C3
ResetEvent.KERNEL32 ref: 6DD663D2
ResumeThread.KERNEL32 ref: 6DD663E7
Sleep.KERNEL32 ref: 6DD663F7
CloseHandle.KERNEL32 ref: 6DD66472
pthread_mutex_destroy.LIBWINPTHREAD-1 ref: 6DD66481

Memory Dump Source

Source File: 00000004.00000002.787395814.000000006DD61000.00000040.00000001.01000000.0000000A.sdmp, Offset: 6DD60000, based on PE: true

Associated: 00000004.00000002.787383138.000000006DD60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787413037.000000006DD6B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787415936.000000006DD6F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787437708.000000006DD74000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787474619.000000006DDD6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787482411.000000006DDE6000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6dd60000_windowsconnect.jbxd

Similarity

API ID: Thread$CloseEventHandlePriorityResetResumeSleepValue_beginthreadexpthread_mutex_destroy
String ID:
API String ID: 2616300590-0
Opcode ID: ac08d8c451e9ebfb3f7a4a280b84d31b8e2b1fc2a7669515c2f7197883c40eea
Instruction ID: 3c83620faefede4f012f821558798ede581bd26955daae483ea8232293af1112
Opcode Fuzzy Hash: ac08d8c451e9ebfb3f7a4a280b84d31b8e2b1fc2a7669515c2f7197883c40eea
Instruction Fuzzy Hash: A311C2B6418A419FD700AF38D14871EBBF0FF4A725F018A2AF995C6290D774A458CBE2

Uniqueness

Uniqueness Score: -1.00%

Function 6DD67590 Relevance: 7.5, APIs: 5, Instructions: 32COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 6DD675A8
OpenProcess.KERNEL32 ref: 6DD675C5
CloseHandle.KERNEL32 ref: 6DD675D5

Memory Dump Source

Source File: 00000004.00000002.787395814.000000006DD61000.00000040.00000001.01000000.0000000A.sdmp, Offset: 6DD60000, based on PE: true

Associated: 00000004.00000002.787383138.000000006DD60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787413037.000000006DD6B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787415936.000000006DD6F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787437708.000000006DD74000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787474619.000000006DDD6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787482411.000000006DDE6000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6dd60000_windowsconnect.jbxd

Similarity

API ID: Process$CloseCurrentHandleOpen
String ID:
API String ID: 2750122171-0
Opcode ID: 0b2653823c69a31096c7531bd37c2608f5411ceb6b6539aa31e12458505c45f8
Instruction ID: e22834008162cd4d66809d6c8b055cb8108de0fa0443f3aba2c7052f12022c38
Opcode Fuzzy Hash: 0b2653823c69a31096c7531bd37c2608f5411ceb6b6539aa31e12458505c45f8
Instruction Fuzzy Hash: DCF01D71958686AFEB007FB4C6C822A7AB0BB15345F504A68E89586145EB7880458AB2

Uniqueness

Uniqueness Score: -1.00%

Function 6DD65300 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 6DD64390: pthread_spin_lock.LIBWINPTHREAD-1(?,?,?,Error cleaning up spin_keys for thread ,6DD649A0,?,Error cleaning up spin_keys for thread ,?,6DD64AE5), ref: 6DD6439E
Part of subcall function 6DD64390: pthread_spin_unlock.LIBWINPTHREAD-1 ref: 6DD643C8
Part of subcall function 6DD64390: pthread_mutex_init.LIBWINPTHREAD-1 ref: 6DD64408
Part of subcall function 6DD64390: calloc.MSVCRT ref: 6DD6441E

pthread_mutex_lock.LIBWINPTHREAD-1 ref: 6DD6532D
pthread_mutex_unlock.LIBWINPTHREAD-1 ref: 6DD65344
fprintf.MSVCRT ref: 6DD653E8

Strings

once %p is %d, xrefs: 6DD653DD

Memory Dump Source

Source File: 00000004.00000002.787395814.000000006DD61000.00000040.00000001.01000000.0000000A.sdmp, Offset: 6DD60000, based on PE: true

Associated: 00000004.00000002.787383138.000000006DD60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787413037.000000006DD6B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787415936.000000006DD6F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787437708.000000006DD74000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787474619.000000006DDD6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787482411.000000006DDE6000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6dd60000_windowsconnect.jbxd

Similarity

API ID: callocfprintfpthread_mutex_initpthread_mutex_lockpthread_mutex_unlockpthread_spin_lockpthread_spin_unlock
String ID: once %p is %d
API String ID: 475071572-95064319
Opcode ID: 74ee54422ff611285cdc82c3b056f7b1bc73289746dab916bf1cd1e877dabb01
Instruction ID: cd53603cd48917b149e1fae217e62bc70a85eba757c187bcc931844b523dd5a9
Opcode Fuzzy Hash: 74ee54422ff611285cdc82c3b056f7b1bc73289746dab916bf1cd1e877dabb01
Instruction Fuzzy Hash: F921F5756083918FD700EF25E58072ABBE4EB89B14F06892DF99887212E775D4488BB2

Uniqueness

Uniqueness Score: -1.00%

Function 6DD67B40 Relevance: 6.1, APIs: 4, Instructions: 117timeCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6DD67A68), ref: 6DD67B73
GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6DD67A68), ref: 6DD67C00
_errno.MSVCRT ref: 6DD67C98
_errno.MSVCRT ref: 6DD67CC2

Memory Dump Source

Source File: 00000004.00000002.787395814.000000006DD61000.00000040.00000001.01000000.0000000A.sdmp, Offset: 6DD60000, based on PE: true

Associated: 00000004.00000002.787383138.000000006DD60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787413037.000000006DD6B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787415936.000000006DD6F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787437708.000000006DD74000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787474619.000000006DDD6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787482411.000000006DDE6000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6dd60000_windowsconnect.jbxd

Similarity

API ID: Time$FileSystem_errno
String ID:
API String ID: 3586254970-0
Opcode ID: d41ffc7ef2f23d7da8c665cf19db13643f93c54c938c0a564abd95a45759bb0e
Instruction ID: e042d17696b341cafd865003d92d0856c00d268300b5dee9cd4733e79b60c39c
Opcode Fuzzy Hash: d41ffc7ef2f23d7da8c665cf19db13643f93c54c938c0a564abd95a45759bb0e
Instruction Fuzzy Hash: 02416E70608745AFD304EF7DC98461ABBE6BFC8710F018A2DF99987790D774D8088BA2

Uniqueness

Uniqueness Score: -1.00%

Function 6DD62620 Relevance: 6.1, APIs: 4, Instructions: 91COMMON

Download Yara Rule

APIs

RtlEnterCriticalSection.NTDLL ref: 6DD6265E
RtlLeaveCriticalSection.NTDLL ref: 6DD62688

Memory Dump Source

Source File: 00000004.00000002.787395814.000000006DD61000.00000040.00000001.01000000.0000000A.sdmp, Offset: 6DD60000, based on PE: true

Associated: 00000004.00000002.787383138.000000006DD60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787413037.000000006DD6B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787415936.000000006DD6F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787437708.000000006DD74000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787474619.000000006DDD6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787482411.000000006DDE6000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6dd60000_windowsconnect.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 4a46a093a8920fd2c05870d4fa6f1dd40bb61684fdcf4a135422f91b2afe2726
Instruction ID: 778f9681794b8c5abdfbcf95de126067f6810c2181f1d1c0707e269aa52849e0
Opcode Fuzzy Hash: 4a46a093a8920fd2c05870d4fa6f1dd40bb61684fdcf4a135422f91b2afe2726
Instruction Fuzzy Hash: EB316CB16046418FEB10FF69E8C4666BBB0FF84368F148569ED548B24AE730D945CBE2

Uniqueness

Uniqueness Score: -1.00%

Function 6DD624E0 Relevance: 6.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

RtlEnterCriticalSection.NTDLL ref: 6DD62516
RtlLeaveCriticalSection.NTDLL ref: 6DD62540

Memory Dump Source

Source File: 00000004.00000002.787395814.000000006DD61000.00000040.00000001.01000000.0000000A.sdmp, Offset: 6DD60000, based on PE: true

Associated: 00000004.00000002.787383138.000000006DD60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787413037.000000006DD6B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787415936.000000006DD6F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787437708.000000006DD74000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787474619.000000006DDD6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787482411.000000006DDE6000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6dd60000_windowsconnect.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 01e3de1c0a65cf9e60ed7bb6ca213042d72e1f1ceb3443338e1dd5f7cfc43647
Instruction ID: 797e4a3d280ba5fa9dcfa70096387b48d3b38956e1981018d96212424e08f133
Opcode Fuzzy Hash: 01e3de1c0a65cf9e60ed7bb6ca213042d72e1f1ceb3443338e1dd5f7cfc43647
Instruction Fuzzy Hash: 52316DB1508241CFEB24EF29D8C46667BB0FB45358F048569FC558A24AF731D985CBE2

Uniqueness

Uniqueness Score: -1.00%

Function 6DD61CA0 Relevance: 6.1, APIs: 4, Instructions: 65COMMON

Download Yara Rule

APIs

_pthread_time_in_ms_from_timespec.LIBWINPTHREAD-1 ref: 6DD61CC9
_pthread_time_in_ms.LIBWINPTHREAD-1 ref: 6DD61D21
_pthread_time_in_ms.LIBWINPTHREAD-1 ref: 6DD61D36
_pthread_rel_time_in_ms.LIBWINPTHREAD-1 ref: 6DD61D78

Memory Dump Source

Source File: 00000004.00000002.787395814.000000006DD61000.00000040.00000001.01000000.0000000A.sdmp, Offset: 6DD60000, based on PE: true

Associated: 00000004.00000002.787383138.000000006DD60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787413037.000000006DD6B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787415936.000000006DD6F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787437708.000000006DD74000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787474619.000000006DDD6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787482411.000000006DDE6000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6dd60000_windowsconnect.jbxd

Similarity

API ID: _pthread_time_in_ms$_pthread_rel_time_in_ms_pthread_time_in_ms_from_timespec
String ID:
API String ID: 3736242651-0
Opcode ID: 8492a0b9b4bd5b33c1677aa46d3c7cf8a02d1f935d7da6086077cb734987257f
Instruction ID: 4998144623ca94bae94593a953648acf4cc10d17892f12b18f1c43d5232203e3
Opcode Fuzzy Hash: 8492a0b9b4bd5b33c1677aa46d3c7cf8a02d1f935d7da6086077cb734987257f
Instruction Fuzzy Hash: 5F210971A083868BC714EF29C44051BFBE1BBC8744F16492DF59497241DB30E8498BE2

Uniqueness

Uniqueness Score: -1.00%

Function 6DD63CC0 Relevance: 6.1, APIs: 4, Instructions: 59COMMON

Download Yara Rule

APIs

Part of subcall function 6DD63AC0: pthread_spin_lock.LIBWINPTHREAD-1(?,?,?,?,6DD63C32), ref: 6DD63AD8
Part of subcall function 6DD63AC0: pthread_spin_unlock.LIBWINPTHREAD-1(?,?,?,?,6DD63C32), ref: 6DD63AEA

pthread_mutex_timedlock.LIBWINPTHREAD-1 ref: 6DD63CF4
pthread_mutex_unlock.LIBWINPTHREAD-1 ref: 6DD63D0E

Memory Dump Source

Source File: 00000004.00000002.787395814.000000006DD61000.00000040.00000001.01000000.0000000A.sdmp, Offset: 6DD60000, based on PE: true

Associated: 00000004.00000002.787383138.000000006DD60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787413037.000000006DD6B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787415936.000000006DD6F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787437708.000000006DD74000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787474619.000000006DDD6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787482411.000000006DDE6000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6dd60000_windowsconnect.jbxd

Similarity

API ID: pthread_mutex_timedlockpthread_mutex_unlockpthread_spin_lockpthread_spin_unlock
String ID:
API String ID: 892596361-0
Opcode ID: e44487d0cc375c27c123928135f20965f4a8bacfcc33791cb8c9f78353a1a5a0
Instruction ID: 5c7787723ab93d18996868c8066010a6b8f4608181960a3237a8fc53785bfcbc
Opcode Fuzzy Hash: e44487d0cc375c27c123928135f20965f4a8bacfcc33791cb8c9f78353a1a5a0
Instruction Fuzzy Hash: 8B1170716097869BD300BF3A984061AF7E4FF81364F09862AF55883601DB36E855CFF2

Uniqueness

Uniqueness Score: -1.00%

Function 6DD64149 Relevance: 6.1, APIs: 4, Instructions: 57COMMON

Download Yara Rule

APIs

pthread_getclean.LIBWINPTHREAD-1 ref: 6DD64182
pthread_getclean.LIBWINPTHREAD-1 ref: 6DD64192
pthread_cond_timedwait.LIBWINPTHREAD-1 ref: 6DD641C7
pthread_getclean.LIBWINPTHREAD-1 ref: 6DD641E1

Memory Dump Source

Source File: 00000004.00000002.787395814.000000006DD61000.00000040.00000001.01000000.0000000A.sdmp, Offset: 6DD60000, based on PE: true

Associated: 00000004.00000002.787383138.000000006DD60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787413037.000000006DD6B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787415936.000000006DD6F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787437708.000000006DD74000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787474619.000000006DDD6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787482411.000000006DDE6000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6dd60000_windowsconnect.jbxd

Similarity

API ID: pthread_getclean$pthread_cond_timedwait
String ID:
API String ID: 4099121300-0
Opcode ID: 4b06e1a78eed0bf98bfa233b9421be344b20bd08fcf113f2cad41edc8ac8901c
Instruction ID: eb40a00a5f811b5b7b9ff2f9de5ff867a0c15353c3e252c50e1411903d4128ec
Opcode Fuzzy Hash: 4b06e1a78eed0bf98bfa233b9421be344b20bd08fcf113f2cad41edc8ac8901c
Instruction Fuzzy Hash: 9821AFB46087428FD314EF29C49071BBBF0BB98358F11891DE59A87721D734E9498FE2

Uniqueness

Uniqueness Score: -1.00%

Function 6DD62290 Relevance: 6.1, APIs: 4, Instructions: 57COMMON

Download Yara Rule

APIs

RtlEnterCriticalSection.NTDLL ref: 6DD622B0
RtlLeaveCriticalSection.NTDLL ref: 6DD622CC
RtlEnterCriticalSection.NTDLL ref: 6DD62309
RtlLeaveCriticalSection.NTDLL ref: 6DD62315

Memory Dump Source

Source File: 00000004.00000002.787395814.000000006DD61000.00000040.00000001.01000000.0000000A.sdmp, Offset: 6DD60000, based on PE: true

Associated: 00000004.00000002.787383138.000000006DD60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787413037.000000006DD6B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787415936.000000006DD6F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787437708.000000006DD74000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787474619.000000006DDD6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787482411.000000006DDE6000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6dd60000_windowsconnect.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 261ade5f2ce30b3d7454645c70b78bdc24495333c6d42fb25b6355ec5587d446
Instruction ID: 9ae0aae32c1ba238b047c273b19c9dfb364f32af1d07ca362d95d3d514fd7394
Opcode Fuzzy Hash: 261ade5f2ce30b3d7454645c70b78bdc24495333c6d42fb25b6355ec5587d446
Instruction Fuzzy Hash: A7110AB5A087108FC710FF39E98551ABBF0EF896A5F01492DE98887310D235E8488BE3

Uniqueness

Uniqueness Score: -1.00%

Function 6DD67A90 Relevance: 6.1, APIs: 4, Instructions: 55timeCOMMON

Download Yara Rule

APIs

FileTimeToSystemTime.KERNEL32 ref: 6DD67AED
SetSystemTime.KERNEL32 ref: 6DD67AFD
_errno.MSVCRT ref: 6DD67B18
_errno.MSVCRT ref: 6DD67B2B

Memory Dump Source

Source File: 00000004.00000002.787395814.000000006DD61000.00000040.00000001.01000000.0000000A.sdmp, Offset: 6DD60000, based on PE: true

Associated: 00000004.00000002.787383138.000000006DD60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787413037.000000006DD6B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787415936.000000006DD6F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787437708.000000006DD74000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787474619.000000006DDD6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787482411.000000006DDE6000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6dd60000_windowsconnect.jbxd

Similarity

API ID: Time$System_errno$File
String ID:
API String ID: 2046127076-0
Opcode ID: e4bd80d14b8da9506185f02ec51447b3d9eb52b4ed7d0fcb606fef97c2975c1d
Instruction ID: 55e239500cc1da416e4808072f8132ab740c3ceafd1fbe5ae072230dfc586f0f
Opcode Fuzzy Hash: e4bd80d14b8da9506185f02ec51447b3d9eb52b4ed7d0fcb606fef97c2975c1d
Instruction Fuzzy Hash: F611A335A047459FD700AF3C8D4426ABBF5BB86361F054A29E99587390E730AC048BE1

Uniqueness

Uniqueness Score: -1.00%

Function 6DD65590 Relevance: 6.1, APIs: 4, Instructions: 53COMMON

Download Yara Rule

APIs

pthread_rwlock_wrlock.LIBWINPTHREAD-1 ref: 6DD655C7
pthread_mutex_lock.LIBWINPTHREAD-1 ref: 6DD655E7
pthread_mutex_unlock.LIBWINPTHREAD-1 ref: 6DD65630
pthread_rwlock_unlock.LIBWINPTHREAD-1 ref: 6DD6563C

Memory Dump Source

Source File: 00000004.00000002.787395814.000000006DD61000.00000040.00000001.01000000.0000000A.sdmp, Offset: 6DD60000, based on PE: true

Associated: 00000004.00000002.787383138.000000006DD60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787413037.000000006DD6B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787415936.000000006DD6F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787437708.000000006DD74000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787474619.000000006DDD6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787482411.000000006DDE6000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6dd60000_windowsconnect.jbxd

Similarity

API ID: pthread_mutex_lockpthread_mutex_unlockpthread_rwlock_unlockpthread_rwlock_wrlock
String ID:
API String ID: 1134915465-0
Opcode ID: c46809bb4536fb1ac3941291c699a5ff5ea6255dd6ecebee4ac43e96ae4e80e7
Instruction ID: 9e2734c2fa82e7ffefc029bf16779a2e149210a53f2db2eabc3004f863ce21e2
Opcode Fuzzy Hash: c46809bb4536fb1ac3941291c699a5ff5ea6255dd6ecebee4ac43e96ae4e80e7
Instruction Fuzzy Hash: 88115B70A44282CBEB20FF99D480B767BB1BB82354F158569E2844B21AD7359885CBF2

Uniqueness

Uniqueness Score: -1.00%

Function 6DD63EE0 Relevance: 6.1, APIs: 4, Instructions: 53COMMON

Download Yara Rule

APIs

Part of subcall function 6DD636B0: pthread_spin_lock.LIBWINPTHREAD-1(?,?,?,?,?,6DD63EF1), ref: 6DD636BD
Part of subcall function 6DD636B0: pthread_spin_unlock.LIBWINPTHREAD-1(?,?,?,?,?,6DD63EF1), ref: 6DD636E0

pthread_mutex_lock.LIBWINPTHREAD-1 ref: 6DD63F26
pthread_mutex_unlock.LIBWINPTHREAD-1 ref: 6DD63F40

Part of subcall function 6DD63760: pthread_mutex_unlock.LIBWINPTHREAD-1(?,?,?,6DD63CB6), ref: 6DD63773
Part of subcall function 6DD63760: pthread_mutex_unlock.LIBWINPTHREAD-1(?,?,?,6DD63CB6), ref: 6DD6377D

Memory Dump Source

Source File: 00000004.00000002.787395814.000000006DD61000.00000040.00000001.01000000.0000000A.sdmp, Offset: 6DD60000, based on PE: true

Associated: 00000004.00000002.787383138.000000006DD60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787413037.000000006DD6B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787415936.000000006DD6F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787437708.000000006DD74000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787474619.000000006DDD6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787482411.000000006DDE6000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6dd60000_windowsconnect.jbxd

Similarity

API ID: pthread_mutex_unlock$pthread_mutex_lockpthread_spin_lockpthread_spin_unlock
String ID:
API String ID: 3819599913-0
Opcode ID: 13fa31f2f513eea0270b380dad55b607ccd7b8038915c9f840e8afa32da3dd88
Instruction ID: b211d0e821f33224150c17990996465f22fe8e5553f3d9db2fa902cd6575bdfd
Opcode Fuzzy Hash: 13fa31f2f513eea0270b380dad55b607ccd7b8038915c9f840e8afa32da3dd88
Instruction Fuzzy Hash: ED012171708B428B9311BF7A988052BB7F5BFD4258F19992CF59587208EB31D44A87F1

Uniqueness

Uniqueness Score: -1.00%

Function 6DD65260 Relevance: 6.1, APIs: 4, Instructions: 53COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 6DD6527B
GetProcessAffinityMask.KERNEL32 ref: 6DD65290
GetCurrentProcess.KERNEL32 ref: 6DD652CC
SetProcessAffinityMask.KERNEL32 ref: 6DD652D5

Memory Dump Source

Source File: 00000004.00000002.787395814.000000006DD61000.00000040.00000001.01000000.0000000A.sdmp, Offset: 6DD60000, based on PE: true

Associated: 00000004.00000002.787383138.000000006DD60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787413037.000000006DD6B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787415936.000000006DD6F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787437708.000000006DD74000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787474619.000000006DDD6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787482411.000000006DDE6000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6dd60000_windowsconnect.jbxd

Similarity

API ID: Process$AffinityCurrentMask
String ID:
API String ID: 1231390398-0
Opcode ID: da63c4ecc32dc78d785e19f82037df86452f681d91a69affb4ebaddc3d0bd1fa
Instruction ID: 67b5711075c936e5e89d965efa2bbfb83e97f7209507c9f9be08698fe1fd2e89
Opcode Fuzzy Hash: da63c4ecc32dc78d785e19f82037df86452f681d91a69affb4ebaddc3d0bd1fa
Instruction Fuzzy Hash: 940144B39087568BD700AFB9988466EBBF4BB89740F41493DF94893202E771D549C7E1

Uniqueness

Uniqueness Score: -1.00%

Function 6DD63D80 Relevance: 6.1, APIs: 4, Instructions: 52COMMON

Download Yara Rule

APIs

Part of subcall function 6DD63AC0: pthread_spin_lock.LIBWINPTHREAD-1(?,?,?,?,6DD63C32), ref: 6DD63AD8
Part of subcall function 6DD63AC0: pthread_spin_unlock.LIBWINPTHREAD-1(?,?,?,?,6DD63C32), ref: 6DD63AEA

pthread_mutex_trylock.LIBWINPTHREAD-1 ref: 6DD63DA8
pthread_mutex_unlock.LIBWINPTHREAD-1 ref: 6DD63DC2

Memory Dump Source

Source File: 00000004.00000002.787395814.000000006DD61000.00000040.00000001.01000000.0000000A.sdmp, Offset: 6DD60000, based on PE: true

Associated: 00000004.00000002.787383138.000000006DD60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787413037.000000006DD6B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787415936.000000006DD6F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787437708.000000006DD74000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787474619.000000006DDD6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787482411.000000006DDE6000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6dd60000_windowsconnect.jbxd

Similarity

API ID: pthread_mutex_trylockpthread_mutex_unlockpthread_spin_lockpthread_spin_unlock
String ID:
API String ID: 1963305777-0
Opcode ID: 523a5165b2678da65e33ed7d756a0a0460756e3676b8b0c042c90712437476c3
Instruction ID: 0410429b50891c765894d176ffe4d45b3ebe044a6b313b8b6ba5fd07e37d98c7
Opcode Fuzzy Hash: 523a5165b2678da65e33ed7d756a0a0460756e3676b8b0c042c90712437476c3
Instruction Fuzzy Hash: C0015271618785CBD310BF7E988452BB7E8AF80268F09892DF59587605EB35D409CBF2

Uniqueness

Uniqueness Score: -1.00%

Function 6DD63C20 Relevance: 6.1, APIs: 4, Instructions: 52COMMON

Download Yara Rule

APIs

Part of subcall function 6DD63AC0: pthread_spin_lock.LIBWINPTHREAD-1(?,?,?,?,6DD63C32), ref: 6DD63AD8
Part of subcall function 6DD63AC0: pthread_spin_unlock.LIBWINPTHREAD-1(?,?,?,?,6DD63C32), ref: 6DD63AEA

pthread_mutex_lock.LIBWINPTHREAD-1 ref: 6DD63C48
pthread_mutex_unlock.LIBWINPTHREAD-1 ref: 6DD63C62

Memory Dump Source

Source File: 00000004.00000002.787395814.000000006DD61000.00000040.00000001.01000000.0000000A.sdmp, Offset: 6DD60000, based on PE: true

Associated: 00000004.00000002.787383138.000000006DD60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787413037.000000006DD6B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787415936.000000006DD6F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787437708.000000006DD74000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787474619.000000006DDD6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787482411.000000006DDE6000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6dd60000_windowsconnect.jbxd

Similarity

API ID: pthread_mutex_lockpthread_mutex_unlockpthread_spin_lockpthread_spin_unlock
String ID:
API String ID: 967236581-0
Opcode ID: c2488e48a17e686004593d091d2cc69e7754790361af549fae8c4315625c74d7
Instruction ID: 51a26597d3bbb6a4627d7d98b26a9f7d2b5f21782b57d045676ba7db90674750
Opcode Fuzzy Hash: c2488e48a17e686004593d091d2cc69e7754790361af549fae8c4315625c74d7
Instruction Fuzzy Hash: 61019271648781CBC320BF7E9C8052BB7E4AF81368F0A892DF59487601EB35D4198BF2

Uniqueness

Uniqueness Score: -1.00%

Function 6DD64E9B Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

TlsSetValue.KERNEL32 ref: 6DD64E2F
CloseHandle.KERNEL32 ref: 6DD64EB1
CloseHandle.KERNEL32 ref: 6DD64EF3
pthread_mutex_destroy.LIBWINPTHREAD-1 ref: 6DD64F06
CloseHandle.KERNEL32 ref: 6DD64F1F
pthread_mutex_destroy.LIBWINPTHREAD-1 ref: 6DD64F35

Memory Dump Source

Source File: 00000004.00000002.787395814.000000006DD61000.00000040.00000001.01000000.0000000A.sdmp, Offset: 6DD60000, based on PE: true

Associated: 00000004.00000002.787383138.000000006DD60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787413037.000000006DD6B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787415936.000000006DD6F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787437708.000000006DD74000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787474619.000000006DDD6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787482411.000000006DDE6000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6dd60000_windowsconnect.jbxd

Similarity

API ID: CloseHandle$pthread_mutex_destroy$Value
String ID:
API String ID: 2720804228-0
Opcode ID: e233514cdbbf8731397a1fdd49d8c64c387782657fe04d90e578255edd630846
Instruction ID: fdf1127f54b97736c9a5e4c5953ada6c09a21f7a39e4b0c96b135d72fd533ef4
Opcode Fuzzy Hash: e233514cdbbf8731397a1fdd49d8c64c387782657fe04d90e578255edd630846
Instruction Fuzzy Hash: 5B11FAB160C3818BEB00FF78D69476A7BB4AF09309F014468ED559B24ADB74D859CBF2

Uniqueness

Uniqueness Score: -1.00%

Function 6DD679E0 Relevance: 6.0, APIs: 4, Instructions: 46COMMON

Download Yara Rule

APIs

clock_gettime.LIBWINPTHREAD-1 ref: 6DD67A08

Part of subcall function 6DD677B0: QueryPerformanceFrequency.KERNEL32 ref: 6DD677E6
Part of subcall function 6DD677B0: QueryPerformanceCounter.KERNEL32 ref: 6DD677FE

nanosleep.LIBWINPTHREAD-1 ref: 6DD67A2F
nanosleep.LIBWINPTHREAD-1 ref: 6DD67A63
_errno.MSVCRT ref: 6DD67A6E

Memory Dump Source

Source File: 00000004.00000002.787395814.000000006DD61000.00000040.00000001.01000000.0000000A.sdmp, Offset: 6DD60000, based on PE: true

Associated: 00000004.00000002.787383138.000000006DD60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787413037.000000006DD6B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787415936.000000006DD6F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787437708.000000006DD74000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787474619.000000006DDD6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787482411.000000006DDE6000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6dd60000_windowsconnect.jbxd

Similarity

API ID: PerformanceQuerynanosleep$CounterFrequency_errnoclock_gettime
String ID:
API String ID: 78328299-0
Opcode ID: 6c22d27624e4ad98be8bc630f734ef5a8d458647ed76a7f510880af23273f103
Instruction ID: 4e0bcb9bae53434c69614b39d3d0ec6c87e0bc6d4466cf72b0c92c19d2c0968c
Opcode Fuzzy Hash: 6c22d27624e4ad98be8bc630f734ef5a8d458647ed76a7f510880af23273f103
Instruction Fuzzy Hash: F21115B5A1D345AFC360EF29D98050BBBE0BF94350F11991DF49887709E330D9848BE2

Uniqueness

Uniqueness Score: -1.00%

Function 6DD66F71 Relevance: 6.0, APIs: 4, Instructions: 46COMMON

Download Yara Rule

APIs

pthread_getclean.LIBWINPTHREAD-1 ref: 6DD66F88
pthread_getclean.LIBWINPTHREAD-1 ref: 6DD66F98

Part of subcall function 6DD61FA0: pthread_getevent.LIBWINPTHREAD-1 ref: 6DD61FBA
Part of subcall function 6DD61FA0: ResetEvent.KERNEL32 ref: 6DD62010
Part of subcall function 6DD61FA0: pthread_testcancel.LIBWINPTHREAD-1 ref: 6DD62024

pthread_getclean.LIBWINPTHREAD-1 ref: 6DD66FCE
_errno.MSVCRT ref: 6DD67001

Memory Dump Source

Source File: 00000004.00000002.787395814.000000006DD61000.00000040.00000001.01000000.0000000A.sdmp, Offset: 6DD60000, based on PE: true

Associated: 00000004.00000002.787383138.000000006DD60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787413037.000000006DD6B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787415936.000000006DD6F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787437708.000000006DD74000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787474619.000000006DDD6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787482411.000000006DDE6000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6dd60000_windowsconnect.jbxd

Similarity

API ID: pthread_getclean$EventReset_errnopthread_geteventpthread_testcancel
String ID:
API String ID: 2513142241-0
Opcode ID: e0605f2fd97c52137435974ebeb283889ed7f6a9df6ececd80cf5ed8dc6b62b7
Instruction ID: c5a4443376283730c6d7d2ce750790c66561d839e681667584227c6000e43477
Opcode Fuzzy Hash: e0605f2fd97c52137435974ebeb283889ed7f6a9df6ececd80cf5ed8dc6b62b7
Instruction Fuzzy Hash: D911F5B5A09741DFD300AF28C48471EBBE0AF88754F814A5DF9A8D7360D770D8448BE2

Uniqueness

Uniqueness Score: -1.00%

Function 6DD648D0 Relevance: 6.0, APIs: 4, Instructions: 44COMMON

Download Yara Rule

APIs

pthread_mutex_lock.LIBWINPTHREAD-1(?,?,00000000,?,6DD64B15,?,?,?,?,?,?,?,?,?,?,?), ref: 6DD648DC
pthread_mutex_unlock.LIBWINPTHREAD-1 ref: 6DD6491C
calloc.MSVCRT ref: 6DD64947

Part of subcall function 6DD644E0: malloc.MSVCRT ref: 6DD64515

Memory Dump Source

Source File: 00000004.00000002.787395814.000000006DD61000.00000040.00000001.01000000.0000000A.sdmp, Offset: 6DD60000, based on PE: true

Associated: 00000004.00000002.787383138.000000006DD60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787413037.000000006DD6B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787415936.000000006DD6F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787437708.000000006DD74000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787474619.000000006DDD6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787482411.000000006DDE6000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6dd60000_windowsconnect.jbxd

Similarity

API ID: callocmallocpthread_mutex_lockpthread_mutex_unlock
String ID:
API String ID: 3464030426-0
Opcode ID: 6c969bcc299a4adec4a620d292308228d2d514d10ba2d97e4df7fa8716ffc637
Instruction ID: 5cde26cf7a1072edd0c52e6139c082b585c8e19b4d51e5bb517ad75e5219ac55
Opcode Fuzzy Hash: 6c969bcc299a4adec4a620d292308228d2d514d10ba2d97e4df7fa8716ffc637
Instruction Fuzzy Hash: 7201007018C3D28BEB117F6994A036A7AA4AB0B258F42403DE6948B24ADB74C504C7F2

Uniqueness

Uniqueness Score: -1.00%

Function 6DD66E43 Relevance: 6.0, APIs: 4, Instructions: 42COMMON

Download Yara Rule

APIs

pthread_getclean.LIBWINPTHREAD-1 ref: 6DD66E58
pthread_getclean.LIBWINPTHREAD-1 ref: 6DD66E68

Part of subcall function 6DD61FA0: pthread_getevent.LIBWINPTHREAD-1 ref: 6DD61FBA
Part of subcall function 6DD61FA0: ResetEvent.KERNEL32 ref: 6DD62010
Part of subcall function 6DD61FA0: pthread_testcancel.LIBWINPTHREAD-1 ref: 6DD62024

pthread_getclean.LIBWINPTHREAD-1 ref: 6DD66E94
_errno.MSVCRT ref: 6DD66EC7

Memory Dump Source

Source File: 00000004.00000002.787395814.000000006DD61000.00000040.00000001.01000000.0000000A.sdmp, Offset: 6DD60000, based on PE: true

Associated: 00000004.00000002.787383138.000000006DD60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787413037.000000006DD6B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787415936.000000006DD6F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787437708.000000006DD74000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787474619.000000006DDD6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787482411.000000006DDE6000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6dd60000_windowsconnect.jbxd

Similarity

API ID: pthread_getclean$EventReset_errnopthread_geteventpthread_testcancel
String ID:
API String ID: 2513142241-0
Opcode ID: 69839946b3fcabec7e7ff534adc6a97cdf034869b7be8635ca0957b930efc835
Instruction ID: 65462bcb63635dc765f556d531690f6467132bff7d5e9a10cf4d4191d1cb9b0e
Opcode Fuzzy Hash: 69839946b3fcabec7e7ff534adc6a97cdf034869b7be8635ca0957b930efc835
Instruction Fuzzy Hash: 4B11F774508741CFD700EF68D44421EBBE0AF89728F418A5DF8E8A7261C734D9458FE2

Uniqueness

Uniqueness Score: -1.00%

Function 6DD65D7C Relevance: 6.0, APIs: 4, Instructions: 40COMMON

Download Yara Rule

APIs

SetEvent.KERNEL32 ref: 6DD65D9F
pthread_mutex_unlock.LIBWINPTHREAD-1 ref: 6DD65DCB
_pthread_invoke_cancel.LIBWINPTHREAD-1 ref: 6DD65DD0
pthread_mutex_unlock.LIBWINPTHREAD-1 ref: 6DD65DDB

Memory Dump Source

Source File: 00000004.00000002.787395814.000000006DD61000.00000040.00000001.01000000.0000000A.sdmp, Offset: 6DD60000, based on PE: true

Associated: 00000004.00000002.787383138.000000006DD60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787413037.000000006DD6B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787415936.000000006DD6F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787437708.000000006DD74000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787474619.000000006DDD6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787482411.000000006DDE6000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6dd60000_windowsconnect.jbxd

Similarity

API ID: pthread_mutex_unlock$Event_pthread_invoke_cancel
String ID:
API String ID: 3393619686-0
Opcode ID: 2e430ec5b11f5df6705e6306e0e9457f95afe4f3a113fc8e5eb486860c84b603
Instruction ID: 382cff9b8b26e5d16fd98d4b9c5fcb144e2ff718fc28841a265ed1955e727ef2
Opcode Fuzzy Hash: 2e430ec5b11f5df6705e6306e0e9457f95afe4f3a113fc8e5eb486860c84b603
Instruction Fuzzy Hash: FB01A2B25186C08BDB11AF38C8852A97FF0AF45328F254759ECA99B1C7C734D0858BA1

Uniqueness

Uniqueness Score: -1.00%

Function 6DD68410 Relevance: 6.0, APIs: 4, Instructions: 39COMMON

Download Yara Rule

APIs

RtlEnterCriticalSection.NTDLL ref: 6DD6841E
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,6DD685DB,?,?,?,?,?,6DD67F28), ref: 6DD68445
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,6DD685DB,?,?,?,?,?,6DD67F28), ref: 6DD6844C
RtlLeaveCriticalSection.NTDLL ref: 6DD6846C

Memory Dump Source

Source File: 00000004.00000002.787395814.000000006DD61000.00000040.00000001.01000000.0000000A.sdmp, Offset: 6DD60000, based on PE: true

Associated: 00000004.00000002.787383138.000000006DD60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787413037.000000006DD6B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787415936.000000006DD6F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787437708.000000006DD74000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787474619.000000006DDD6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787482411.000000006DDE6000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6dd60000_windowsconnect.jbxd

Similarity

API ID: CriticalSection$EnterErrorLastLeaveValue
String ID:
API String ID: 682475483-0
Opcode ID: 019c9b762462c98d928645bea2df5123d7eecb9f6eebc16f404ae70315be3cf7
Instruction ID: 5074d12e810007c29f06d830f299e01073cfefc5b8c30579ba9ad0a6088e3cbe
Opcode Fuzzy Hash: 019c9b762462c98d928645bea2df5123d7eecb9f6eebc16f404ae70315be3cf7
Instruction Fuzzy Hash: 7FF081B2500681CFDB00BF7CC58862A7BB8FA46650F010468ED4447205D731A505CBF3

Uniqueness

Uniqueness Score: -1.00%

Function 6DD66431 Relevance: 6.0, APIs: 4, Instructions: 35threadsleepCOMMON

Download Yara Rule

APIs

SetThreadPriority.KERNEL32 ref: 6DD663C3
ResetEvent.KERNEL32 ref: 6DD663D2
ResumeThread.KERNEL32 ref: 6DD663E7
Sleep.KERNEL32 ref: 6DD663F7

Memory Dump Source

Source File: 00000004.00000002.787395814.000000006DD61000.00000040.00000001.01000000.0000000A.sdmp, Offset: 6DD60000, based on PE: true

Associated: 00000004.00000002.787383138.000000006DD60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787413037.000000006DD6B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787415936.000000006DD6F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787437708.000000006DD74000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787474619.000000006DDD6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787482411.000000006DDE6000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6dd60000_windowsconnect.jbxd

Similarity

API ID: Thread$EventPriorityResetResumeSleep
String ID:
API String ID: 3424743960-0
Opcode ID: 2fc332a24c0d9b3989ed0b611e9e09850155f4b975b352a7157bd94316c2d789
Instruction ID: ae5ecf4697eaa44440a5aca37b9d8b24568a2937ff179f1fa3280aa0d677b2f7
Opcode Fuzzy Hash: 2fc332a24c0d9b3989ed0b611e9e09850155f4b975b352a7157bd94316c2d789
Instruction Fuzzy Hash: C9F04FB65049418BEB107F7C954932DBBB0FF19715F00062DF996C6690D7349494CBE3

Uniqueness

Uniqueness Score: -1.00%

Function 6DD65660 Relevance: 6.0, APIs: 4, Instructions: 34COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 6DD65669

Part of subcall function 6DD64AD0: TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,6DD65ADA,?,?,?,?,6DD66ADD), ref: 6DD64AED

pthread_spin_lock.LIBWINPTHREAD-1 ref: 6DD6567E
pthread_spin_unlock.LIBWINPTHREAD-1 ref: 6DD656A2
SetLastError.KERNEL32 ref: 6DD656AA

Memory Dump Source

Source File: 00000004.00000002.787395814.000000006DD61000.00000040.00000001.01000000.0000000A.sdmp, Offset: 6DD60000, based on PE: true

Associated: 00000004.00000002.787383138.000000006DD60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787413037.000000006DD6B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787415936.000000006DD6F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787437708.000000006DD74000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787474619.000000006DDD6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787482411.000000006DDE6000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6dd60000_windowsconnect.jbxd

Similarity

API ID: ErrorLast$Valuepthread_spin_lockpthread_spin_unlock
String ID:
API String ID: 3182649391-0
Opcode ID: 59788560a35f2ee9ee321e097ab7ea89e2a2535228a00b50a5aa07fe99f422c8
Instruction ID: 64480ad71a45be897598bfd16ea5cf69e413a41211fc4bc87b976a87f30baea5
Opcode Fuzzy Hash: 59788560a35f2ee9ee321e097ab7ea89e2a2535228a00b50a5aa07fe99f422c8
Instruction Fuzzy Hash: 17F06D755082859FC740BF38D484A5A7BB5FF8A614F460468F9468B342D7309890CBF2

Uniqueness

Uniqueness Score: -1.00%

Function 6DD65A70 Relevance: 6.0, APIs: 4, Instructions: 32synchronizationCOMMON

Download Yara Rule

APIs

__pth_gpointer_locked.LIBWINPTHREAD-1(?,?,?,?,?,?,?,?,?,?,?,6DD65B55,?,?,?,?), ref: 6DD65A77

Part of subcall function 6DD64C20: pthread_mutex_lock.LIBWINPTHREAD-1(?,?,00000000,?,6DD64C6F,?,?,?,?,?,?,00000000,?,?,?,6DD658D2), ref: 6DD64C36
Part of subcall function 6DD64C20: pthread_mutex_unlock.LIBWINPTHREAD-1(?,?,00000000,?,6DD64C6F,?,?,?,?,?,?,00000000,?,?,?,6DD658D2), ref: 6DD64C4B

WaitForSingleObject.KERNEL32 ref: 6DD65AAE
pthread_mutex_unlock.LIBWINPTHREAD-1(?,?,?,?,?,?,?,?,?,?,?,?,?,6DD65B55), ref: 6DD65AC1
_pthread_invoke_cancel.LIBWINPTHREAD-1(?,?,?,?,?,?,?,?,?,?,?,?,?,6DD65B55), ref: 6DD65AC6

Memory Dump Source

Source File: 00000004.00000002.787395814.000000006DD61000.00000040.00000001.01000000.0000000A.sdmp, Offset: 6DD60000, based on PE: true

Associated: 00000004.00000002.787383138.000000006DD60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787413037.000000006DD6B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787415936.000000006DD6F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787437708.000000006DD74000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787474619.000000006DDD6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787482411.000000006DDE6000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6dd60000_windowsconnect.jbxd

Similarity

API ID: pthread_mutex_unlock$ObjectSingleWait__pth_gpointer_locked_pthread_invoke_cancelpthread_mutex_lock
String ID:
API String ID: 4257296073-0
Opcode ID: a544a99cc3b25bd34471d1c5ced8a35ef07ffffda864b88db18e67b766f2a50b
Instruction ID: 105cf804f4022ef9481c1fe8b2ff5b54c217cdd1f0c13372262db28f7a7ef9cf
Opcode Fuzzy Hash: a544a99cc3b25bd34471d1c5ced8a35ef07ffffda864b88db18e67b766f2a50b
Instruction Fuzzy Hash: 85F03AB19187928BDB10BF3889D57397BE4AB16308F464959F9848B283E730E49587F1

Uniqueness

Uniqueness Score: -1.00%

Function 6DD63A60 Relevance: 6.0, APIs: 4, Instructions: 24COMMON

Download Yara Rule

APIs

pthread_spin_lock.LIBWINPTHREAD-1(?,?,?,?,?,6DD63B15,?,?,?,?,6DD63C32), ref: 6DD63A6D
pthread_rwlock_init.LIBWINPTHREAD-1 ref: 6DD63A82

Part of subcall function 6DD63920: calloc.MSVCRT ref: 6DD63948
Part of subcall function 6DD63920: pthread_mutex_init.LIBWINPTHREAD-1(?,?,?,?,?,?,?,?,00000000,?,6DD63A87), ref: 6DD63980
Part of subcall function 6DD63920: pthread_mutex_init.LIBWINPTHREAD-1(?,?,?,?,?,?,?,?,00000000,?,6DD63A87), ref: 6DD63997
Part of subcall function 6DD63920: pthread_cond_init.LIBWINPTHREAD-1(?,?,?,?,?,?,?,?,00000000,?,6DD63A87), ref: 6DD639AE

pthread_spin_unlock.LIBWINPTHREAD-1 ref: 6DD63A90
pthread_spin_unlock.LIBWINPTHREAD-1(?,?,?,?,?,6DD63B15,?,?,?,?,6DD63C32), ref: 6DD63AAC

Memory Dump Source

Source File: 00000004.00000002.787395814.000000006DD61000.00000040.00000001.01000000.0000000A.sdmp, Offset: 6DD60000, based on PE: true

Associated: 00000004.00000002.787383138.000000006DD60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787413037.000000006DD6B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787415936.000000006DD6F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787437708.000000006DD74000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787474619.000000006DDD6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787482411.000000006DDE6000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6dd60000_windowsconnect.jbxd

Similarity

API ID: pthread_mutex_initpthread_spin_unlock$callocpthread_cond_initpthread_rwlock_initpthread_spin_lock
String ID:
API String ID: 611557388-0
Opcode ID: c9fd2f733b5d8115e328fa0e6813dc24193c55568830ff46f7cbc1413b9f9872
Instruction ID: 94777d82b877615e78f75f42d97c23e8a42150384436365229ad4453d7065cc8
Opcode Fuzzy Hash: c9fd2f733b5d8115e328fa0e6813dc24193c55568830ff46f7cbc1413b9f9872
Instruction Fuzzy Hash: 67E012B164D294C7C7007FB8688511DB6A0BB46238F85056CF2C447346D331545057F3

Uniqueness

Uniqueness Score: -1.00%

Function 6DD63BD7 Relevance: 6.0, APIs: 4, Instructions: 21COMMON

Download Yara Rule

APIs

pthread_cond_destroy.LIBWINPTHREAD-1 ref: 6DD63BE6
pthread_mutex_destroy.LIBWINPTHREAD-1 ref: 6DD63BF1

Part of subcall function 6DD63470: CloseHandle.KERNEL32(?,?,?,73B76490,6DD66D24,?,?,?,?,?,?,?,?,6DD6160A), ref: 6DD6348D
Part of subcall function 6DD63470: ??3@YAXPAX@Z.MSVCRT ref: 6DD63499

pthread_mutex_destroy.LIBWINPTHREAD-1 ref: 6DD63BFC
??3@YAXPAX@Z.MSVCRT ref: 6DD63C0E

Memory Dump Source

Source File: 00000004.00000002.787395814.000000006DD61000.00000040.00000001.01000000.0000000A.sdmp, Offset: 6DD60000, based on PE: true

Associated: 00000004.00000002.787383138.000000006DD60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787413037.000000006DD6B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787415936.000000006DD6F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787437708.000000006DD74000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787474619.000000006DDD6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787482411.000000006DDE6000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6dd60000_windowsconnect.jbxd

Similarity

API ID: ??3@pthread_mutex_destroy$CloseHandlepthread_cond_destroy
String ID:
API String ID: 3524040118-0
Opcode ID: 9516e276ec13ede196739bde5570f6dc5ce011ae301a9d6e2ab23e8445cd2457
Instruction ID: d9843202cdff257931b662bc6be8b43e026b3ecb7903824f237e519b5eeff823
Opcode Fuzzy Hash: 9516e276ec13ede196739bde5570f6dc5ce011ae301a9d6e2ab23e8445cd2457
Instruction Fuzzy Hash: F5E052B591DB848FD720BF64E484599F7F8FB44218F06492EE9C187210E735A589CAB2

Uniqueness

Uniqueness Score: -1.00%

Function 6DD68190 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 173COMMON

Download Yara Rule

Strings

Unknown pseudo relocation protocol version %d., xrefs: 6DD683F6
Unknown pseudo relocation bit size %d., xrefs: 6DD68294

Memory Dump Source

Source File: 00000004.00000002.787395814.000000006DD61000.00000040.00000001.01000000.0000000A.sdmp, Offset: 6DD60000, based on PE: true

Associated: 00000004.00000002.787383138.000000006DD60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787413037.000000006DD6B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787415936.000000006DD6F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787437708.000000006DD74000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787474619.000000006DDD6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787482411.000000006DDE6000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6dd60000_windowsconnect.jbxd

Similarity

API ID:
String ID: Unknown pseudo relocation bit size %d.$ Unknown pseudo relocation protocol version %d.
API String ID: 0-395989641
Opcode ID: f85068230e1e195d4992dfdae78d270f6ca7befd86702ba85d6fe233cdba2fde
Instruction ID: 00fac1467e5a5d136044ef2de57425abd6219379505f70de27574d5e24d72c3f
Opcode Fuzzy Hash: f85068230e1e195d4992dfdae78d270f6ca7befd86702ba85d6fe233cdba2fde
Instruction Fuzzy Hash: 7B51B372A08295CBDB00FF68C980659B7B1FF86758F128529F9559B389D330E8158BF2

Uniqueness

Uniqueness Score: -1.00%

Function 6DD653C1 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

pthread_mutex_unlock.LIBWINPTHREAD-1 ref: 6DD65344

Part of subcall function 6DD647E0: pthread_spin_lock.LIBWINPTHREAD-1(?,?,00000000,00000004,6DD649D9,?,Error cleaning up spin_keys for thread ,?,6DD64AE5), ref: 6DD647EE
Part of subcall function 6DD647E0: pthread_spin_unlock.LIBWINPTHREAD-1 ref: 6DD6482E

fprintf.MSVCRT ref: 6DD653E8

Strings

once %p is %d, xrefs: 6DD653DD

Memory Dump Source

Source File: 00000004.00000002.787395814.000000006DD61000.00000040.00000001.01000000.0000000A.sdmp, Offset: 6DD60000, based on PE: true

Associated: 00000004.00000002.787383138.000000006DD60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787413037.000000006DD6B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787415936.000000006DD6F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787437708.000000006DD74000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787474619.000000006DDD6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787482411.000000006DDE6000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6dd60000_windowsconnect.jbxd

Similarity

API ID: fprintfpthread_mutex_unlockpthread_spin_lockpthread_spin_unlock
String ID: once %p is %d
API String ID: 52179501-95064319
Opcode ID: 37a11498fa6cf2f63b33074da31d5093c940a28b1b2697ba2170010e1b2b369b
Instruction ID: 7e4d8c91d3ca02bc104e8e5dd8cc4677e3f48920bf2654c2a0aa2d0edccb39e1
Opcode Fuzzy Hash: 37a11498fa6cf2f63b33074da31d5093c940a28b1b2697ba2170010e1b2b369b
Instruction Fuzzy Hash: 8CE0E5B69087A08BC7007F65D58426DBBE0EF88B14F02881EEAD882201D73990818BE2

Uniqueness

Uniqueness Score: -1.00%

Function 6DD651A7 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6DD651B0
printf.MSVCRT ref: 6DD651D1

Strings

T%p %d %s, xrefs: 6DD651CA

Memory Dump Source

Source File: 00000004.00000002.787395814.000000006DD61000.00000040.00000001.01000000.0000000A.sdmp, Offset: 6DD60000, based on PE: true

Associated: 00000004.00000002.787383138.000000006DD60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787413037.000000006DD6B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787415936.000000006DD6F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787437708.000000006DD74000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787474619.000000006DDD6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.787482411.000000006DDE6000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6dd60000_windowsconnect.jbxd

Similarity

API ID: CurrentThreadprintf
String ID: T%p %d %s
API String ID: 2356641437-3109981362
Opcode ID: cc725f70744b0aa1d6bbc562398bb53431f45e99428844972681422c303ef048
Instruction ID: e1b70777cbe44d4776040c0b15f41b52811ef06181c83e4d65289b983162f0c8
Opcode Fuzzy Hash: cc725f70744b0aa1d6bbc562398bb53431f45e99428844972681422c303ef048
Instruction Fuzzy Hash: 89D0E2B28093009FE710AF15E04435EBBE0EB8A220F01981AE49882240D331A4458B92

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: windowsconnect.exePID: 6892, Parent PID: 796COMMON

Execution Graph

Execution Coverage:	0.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	100%
Total number of Nodes:	8
Total number of Limit Nodes:	1

Executed Functions

Function 6DEF8CA0 Relevance: 6.2, APIs: 4, Instructions: 200
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000C.00000002.791621687.000000006DE0E000.00000040.00000001.01000000.00000009.sdmp, Offset: 6DDF0000, based on PE: true

Associated: 0000000C.00000002.791560410.000000006DDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.791575656.000000006DDF1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.791601407.000000006DE06000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.791611335.000000006DE0A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.791745650.000000006DEF9000.00000004.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6ddf0000_windowsconnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6943f47d3dd6bf6259178cf2af86363b1385967325da548638b429e453fb144f
Instruction ID: bcb6c95f43dfadad12720dec364c6c89eb33082bfd5c8995f8559032b2fa1a66
Opcode Fuzzy Hash: 6943f47d3dd6bf6259178cf2af86363b1385967325da548638b429e453fb144f
Instruction Fuzzy Hash: BA5146F26583525BD3118E79CCC07A577A8EF52328B380729D5E1DB3C6EFA4580B87A1

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 6DE01CB0 Relevance: 9.5, APIs: 6, Instructions: 470
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000C.00000002.791575656.000000006DDF1000.00000040.00000001.01000000.00000009.sdmp, Offset: 6DDF0000, based on PE: true

Associated: 0000000C.00000002.791560410.000000006DDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.791601407.000000006DE06000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.791611335.000000006DE0A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.791621687.000000006DE0E000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.791745650.000000006DEF9000.00000004.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6ddf0000_windowsconnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd20149d9ec46ca3f58b53bb50c62cd0a525ac7f9aeca2ed592ac2044ff2fbcd
Instruction ID: 5c6a55186ea70ae8d20eb923f7d158062d78a8a12e71d77b0da2f67062e7058c
Opcode Fuzzy Hash: cd20149d9ec46ca3f58b53bb50c62cd0a525ac7f9aeca2ed592ac2044ff2fbcd
Instruction Fuzzy Hash: 46126E70A08706CFC711CF58C48061AB7E1BF98358F65892DF999EB351DB34E965CB82

Uniqueness

Uniqueness Score: -1.00%

Function 6DE03550 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32 ref: 6DE0359F
UnhandledExceptionFilter.KERNEL32 ref: 6DE035AF
GetCurrentProcess.KERNEL32 ref: 6DE035B8
TerminateProcess.KERNEL32 ref: 6DE035C9
abort.MSVCRT ref: 6DE035D2

Memory Dump Source

Source File: 0000000C.00000002.791575656.000000006DDF1000.00000040.00000001.01000000.00000009.sdmp, Offset: 6DDF0000, based on PE: true

Associated: 0000000C.00000002.791560410.000000006DDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.791601407.000000006DE06000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.791611335.000000006DE0A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.791621687.000000006DE0E000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.791745650.000000006DEF9000.00000004.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6ddf0000_windowsconnect.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentTerminateabort
String ID:
API String ID: 520269711-0
Opcode ID: a2861dbec58194a8436147048519bcc0562157ae403113d3fb8ab8496e1cbe72
Instruction ID: e1245f061f23bbd4a845346963a10c692fb8e935ca32cd0aec70c24491e14146
Opcode Fuzzy Hash: a2861dbec58194a8436147048519bcc0562157ae403113d3fb8ab8496e1cbe72
Instruction Fuzzy Hash: 0311E6B5904304DFDB00EFA9C185B1EBBF0BB5A304F51892DE98897300E77A9964CF92

Uniqueness

Uniqueness Score: -1.00%

Function 6DE0354C Relevance: 7.5, APIs: 5, Instructions: 47COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32 ref: 6DE0359F
UnhandledExceptionFilter.KERNEL32 ref: 6DE035AF
GetCurrentProcess.KERNEL32 ref: 6DE035B8
TerminateProcess.KERNEL32 ref: 6DE035C9
abort.MSVCRT ref: 6DE035D2

Memory Dump Source

Source File: 0000000C.00000002.791575656.000000006DDF1000.00000040.00000001.01000000.00000009.sdmp, Offset: 6DDF0000, based on PE: true

Associated: 0000000C.00000002.791560410.000000006DDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.791601407.000000006DE06000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.791611335.000000006DE0A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.791621687.000000006DE0E000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.791745650.000000006DEF9000.00000004.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6ddf0000_windowsconnect.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentTerminateabort
String ID:
API String ID: 520269711-0
Opcode ID: de34dbc6396747a02ad4f40c4acfbcf31adce1b7a3589be68ccbc33e54f05929
Instruction ID: 3e21b3109da1cdb06673d08ac026fc57dc249148d830cf2219e30b1494e9d602
Opcode Fuzzy Hash: de34dbc6396747a02ad4f40c4acfbcf31adce1b7a3589be68ccbc33e54f05929
Instruction Fuzzy Hash: AD1102B5804204CFDB00EFB9D189B197BF0AB1A304F40892DE98897300E77AA964CF92

Uniqueness

Uniqueness Score: -1.00%

Function 6DDF18D0 Relevance: 6.1, APIs: 4, Instructions: 137COMMON

Download Yara Rule

APIs

abort.MSVCRT(?), ref: 6DE04360
abort.MSVCRT(?), ref: 6DE04368
abort.MSVCRT(?), ref: 6DE04370
abort.MSVCRT(?), ref: 6DE04378

Memory Dump Source

Source File: 0000000C.00000002.791575656.000000006DDF1000.00000040.00000001.01000000.00000009.sdmp, Offset: 6DDF0000, based on PE: true

Associated: 0000000C.00000002.791560410.000000006DDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.791601407.000000006DE06000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.791611335.000000006DE0A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.791621687.000000006DE0E000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.791745650.000000006DEF9000.00000004.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6ddf0000_windowsconnect.jbxd

Similarity

API ID: abort
String ID:
API String ID: 4206212132-0
Opcode ID: 859ae535f812403ed8f693de3cfb485b576697ddb4fcf22b5e80c2ecbe3f47b2
Instruction ID: aedf7e939766c249eea5608337e7363c4032c3c707bb95b9dfe93446b5073e07
Opcode Fuzzy Hash: 859ae535f812403ed8f693de3cfb485b576697ddb4fcf22b5e80c2ecbe3f47b2
Instruction Fuzzy Hash: 6631D636F143224BF75058289A403B6B5D49BAD38AF22493AEE9DF7781EE58CC54C580

Uniqueness

Uniqueness Score: -1.00%

Function 6DE03220 Relevance: 21.2, APIs: 14, Instructions: 154
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

pthread_getspecific.LIBWINPTHREAD-1 ref: 6DE0323A
pthread_once.LIBWINPTHREAD-1 ref: 6DE0327F
pthread_mutex_lock.LIBWINPTHREAD-1 ref: 6DE0328B
pthread_mutex_unlock.LIBWINPTHREAD-1 ref: 6DE032A2

Memory Dump Source

Source File: 0000000C.00000002.791575656.000000006DDF1000.00000040.00000001.01000000.00000009.sdmp, Offset: 6DDF0000, based on PE: true

Associated: 0000000C.00000002.791560410.000000006DDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.791601407.000000006DE06000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.791611335.000000006DE0A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.791621687.000000006DE0E000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.791745650.000000006DEF9000.00000004.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6ddf0000_windowsconnect.jbxd

Similarity

API ID: pthread_getspecificpthread_mutex_lockpthread_mutex_unlockpthread_once
String ID:
API String ID: 3632289657-0
Opcode ID: a017c7a1848ffdf8f78467cbb265682fe410bd9c52a2f2be200872ffb79de625
Instruction ID: 8a81e8f0839868c8535d5c2cb2b45dfd2e9493061df95a82ba9ed1b97339f0db
Opcode Fuzzy Hash: a017c7a1848ffdf8f78467cbb265682fe410bd9c52a2f2be200872ffb79de625
Instruction Fuzzy Hash: 5F5117B46087068FD701DF65D5C095ABBE4FF89308F22C92ED9989B311EB34E865CB52

Uniqueness

Uniqueness Score: -1.00%

Function 6DE036E0 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 124
filememoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

fwrite.MSVCRT ref: 6DE0370F
vfprintf.MSVCRT ref: 6DE0372F
abort.MSVCRT ref: 6DE03734
VirtualQuery.KERNEL32 ref: 6DE037C7
VirtualProtect.KERNEL32 ref: 6DE0381D
GetLastError.KERNEL32 ref: 6DE0382A

Strings

@, xrefs: 6DE0380E
VirtualProtect failed with code 0x%x, xrefs: 6DE03830
VirtualQuery failed for %d bytes at address %p, xrefs: 6DE03857
Address %p has no image-section, xrefs: 6DE0386B
Mingw-w64 runtime failure:, xrefs: 6DE03708

Memory Dump Source

Source File: 0000000C.00000002.791575656.000000006DDF1000.00000040.00000001.01000000.00000009.sdmp, Offset: 6DDF0000, based on PE: true

Associated: 0000000C.00000002.791560410.000000006DDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.791601407.000000006DE06000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.791611335.000000006DE0A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.791621687.000000006DE0E000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.791745650.000000006DEF9000.00000004.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6ddf0000_windowsconnect.jbxd

Similarity

API ID: Virtual$ErrorLastProtectQueryabortfwritevfprintf
String ID: VirtualProtect failed with code 0x%x$ VirtualQuery failed for %d bytes at address %p$@$Address %p has no image-section$Mingw-w64 runtime failure:
API String ID: 1616349570-4164700141
Opcode ID: 5774ce59c90447269fc3a709d9c502131514e8660acbf8ead2b590cc4d07dc4e
Instruction ID: 087142c3880eee343904549fa41c55db397fb2de20e4e756b910a7c623a6b874
Opcode Fuzzy Hash: 5774ce59c90447269fc3a709d9c502131514e8660acbf8ead2b590cc4d07dc4e
Instruction Fuzzy Hash: 89416AB19083019FC700EF29D585A1AFBF4FF89358F65892EE98897314DB35D464CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 6DE02F50 Relevance: 15.2, APIs: 10, Instructions: 158
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_Unwind_GetLanguageSpecificData.LIBGCC_S_SJLJ-1 ref: 6DE02F97
_Unwind_GetRegionStart.LIBGCC_S_SJLJ-1 ref: 6DE02FB1
_Unwind_GetTextRelBase.LIBGCC_S_SJLJ-1 ref: 6DE02FE3

Memory Dump Source

Source File: 0000000C.00000002.791575656.000000006DDF1000.00000040.00000001.01000000.00000009.sdmp, Offset: 6DDF0000, based on PE: true

Associated: 0000000C.00000002.791560410.000000006DDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.791601407.000000006DE06000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.791611335.000000006DE0A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.791621687.000000006DE0E000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.791745650.000000006DEF9000.00000004.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6ddf0000_windowsconnect.jbxd

Similarity

API ID: Unwind_$BaseDataLanguageRegionSpecificStartText
String ID:
API String ID: 2117219864-0
Opcode ID: 3c328fdfaa7bd0d9365c9cc3e285dc3676f2b4b3ed09a2323a697915f5856d43
Instruction ID: d4d5b8f4f5ebd8951eda58e84f962eea003bc3204f63b7fa408987763865772c
Opcode Fuzzy Hash: 3c328fdfaa7bd0d9365c9cc3e285dc3676f2b4b3ed09a2323a697915f5856d43
Instruction Fuzzy Hash: 6751C0B180D3528BDB208F28C48475AFBE1AF56308F25C91DE9D4A7345DB7AD86DCB42

Uniqueness

Uniqueness Score: -1.00%

Function 6DDF1790 Relevance: 15.1, APIs: 10, Instructions: 51
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000C.00000002.791575656.000000006DDF1000.00000040.00000001.01000000.00000009.sdmp, Offset: 6DDF0000, based on PE: true

Associated: 0000000C.00000002.791560410.000000006DDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.791601407.000000006DE06000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.791611335.000000006DE0A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.791621687.000000006DE0E000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.791745650.000000006DEF9000.00000004.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6ddf0000_windowsconnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d17d5bfc4e2e0aa42ce316c95d413424c85c763f5203f2428c24c274dc7b5c84
Instruction ID: 11f73c7e6c76b9e4692bfc4366adb073b28fb075c34d220c4881536c8c3826fc
Opcode Fuzzy Hash: d17d5bfc4e2e0aa42ce316c95d413424c85c763f5203f2428c24c274dc7b5c84
Instruction Fuzzy Hash: E5E0F654EAA10302A100AE2576A913AEB749B7F64CFB23C2ADA04B3100AF05D938C14E

Uniqueness

Uniqueness Score: -1.00%

Function 6DDF17B0 Relevance: 13.7, APIs: 9, Instructions: 160
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000C.00000002.791575656.000000006DDF1000.00000040.00000001.01000000.00000009.sdmp, Offset: 6DDF0000, based on PE: true

Associated: 0000000C.00000002.791560410.000000006DDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.791601407.000000006DE06000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.791611335.000000006DE0A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.791621687.000000006DE0E000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.791745650.000000006DEF9000.00000004.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6ddf0000_windowsconnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b315d1a6cc20d3f1d9faf0ef10bb83445600cd96960b6e98cff38c6c630d002f
Instruction ID: 145406f7ae0c58c3c214d2d0ac45f37c31fc7ab55a0899afce1abe8675e83d11
Opcode Fuzzy Hash: b315d1a6cc20d3f1d9faf0ef10bb83445600cd96960b6e98cff38c6c630d002f
Instruction Fuzzy Hash: 4541D735F442220BF75058189A40376B6E49BBE789F32593ADE9DF3381EE58CC64C585

Uniqueness

Uniqueness Score: -1.00%

Function 6DDF1020 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 108
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32 ref: 6DDF1057
_amsg_exit.MSVCRT ref: 6DDF1085

Strings

06m, xrefs: 6DDF1115

Memory Dump Source

Source File: 0000000C.00000002.791575656.000000006DDF1000.00000040.00000001.01000000.00000009.sdmp, Offset: 6DDF0000, based on PE: true

Associated: 0000000C.00000002.791560410.000000006DDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.791601407.000000006DE06000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.791611335.000000006DE0A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.791621687.000000006DE0E000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.791745650.000000006DEF9000.00000004.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6ddf0000_windowsconnect.jbxd

Similarity

API ID: Sleep_amsg_exit
String ID: 06m
API String ID: 1015461914-3115306619
Opcode ID: fb77638c547e40a5720d4d6c06a0d33aa7627ea6e8b09d7d2c43676ca5df002e
Instruction ID: 8a2d976cc7370375e0b753411550755d1ca67dc2bdece191ce0fd844c7b6d8cc
Opcode Fuzzy Hash: fb77638c547e40a5720d4d6c06a0d33aa7627ea6e8b09d7d2c43676ca5df002e
Instruction Fuzzy Hash: 1441BFB1A18341CBE702BF58C5C172A77F5FBA6344F52862EE5948B345DB3784A1CB82

Uniqueness

Uniqueness Score: -1.00%

Function 6DDF5CB8 Relevance: 12.2, APIs: 8, Instructions: 188
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__divtf3.LIBGCC_S_SJLJ-1 ref: 6DDF5D0E
__multf3.LIBGCC_S_SJLJ-1 ref: 6DDF5D6D
__addtf3.LIBGCC_S_SJLJ-1 ref: 6DDF5DCC
__multf3.LIBGCC_S_SJLJ-1 ref: 6DDF5E4E
__addtf3.LIBGCC_S_SJLJ-1 ref: 6DDF5EA6
__divtf3.LIBGCC_S_SJLJ-1 ref: 6DDF5F14
__multf3.LIBGCC_S_SJLJ-1 ref: 6DDF5F8F
__subtf3.LIBGCC_S_SJLJ-1 ref: 6DDF5FE7

Memory Dump Source

Source File: 0000000C.00000002.791575656.000000006DDF1000.00000040.00000001.01000000.00000009.sdmp, Offset: 6DDF0000, based on PE: true

Associated: 0000000C.00000002.791560410.000000006DDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.791601407.000000006DE06000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.791611335.000000006DE0A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.791621687.000000006DE0E000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.791745650.000000006DEF9000.00000004.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6ddf0000_windowsconnect.jbxd

Similarity

API ID: __multf3$__addtf3__divtf3$__subtf3
String ID:
API String ID: 4134955765-0
Opcode ID: f3ad73b0e7dc81b78af565521272114c137faf757a2b8486b8f3777902771e13
Instruction ID: cadf920d45a5c6b8868947d8097b9489342505cb5d02dbadf9b0dd8e368cf153
Opcode Fuzzy Hash: f3ad73b0e7dc81b78af565521272114c137faf757a2b8486b8f3777902771e13
Instruction Fuzzy Hash: 94B1F6B89087818FC364CF19D180A5AFBE1BFC8754F118E2EE9D9A3310D770A9458F96

Uniqueness

Uniqueness Score: -1.00%

Function 6DDF17E0 Relevance: 12.2, APIs: 8, Instructions: 157
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000C.00000002.791575656.000000006DDF1000.00000040.00000001.01000000.00000009.sdmp, Offset: 6DDF0000, based on PE: true

Associated: 0000000C.00000002.791560410.000000006DDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.791601407.000000006DE06000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.791611335.000000006DE0A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.791621687.000000006DE0E000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.791745650.000000006DEF9000.00000004.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6ddf0000_windowsconnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd3a9a35c2ef7e11cc56f6f349e6ac9190a064b835f0b9f83e6afe5867fc408e
Instruction ID: 550a176de28bfcd1a34f5d663d0489ebc2dddea1277cd818f351d7e3793663e1
Opcode Fuzzy Hash: bd3a9a35c2ef7e11cc56f6f349e6ac9190a064b835f0b9f83e6afe5867fc408e
Instruction Fuzzy Hash: F941E635F452224BF75058289B90376B6E4DBAE38AF32593ADE8DF3381EE58CC54C580

Uniqueness

Uniqueness Score: -1.00%

Function 6DE02F8C Relevance: 12.1, APIs: 8, Instructions: 119
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_Unwind_GetLanguageSpecificData.LIBGCC_S_SJLJ-1 ref: 6DE02F97
_Unwind_GetRegionStart.LIBGCC_S_SJLJ-1 ref: 6DE02FB1
_Unwind_GetTextRelBase.LIBGCC_S_SJLJ-1 ref: 6DE02FE3

Memory Dump Source

Source File: 0000000C.00000002.791575656.000000006DDF1000.00000040.00000001.01000000.00000009.sdmp, Offset: 6DDF0000, based on PE: true

Associated: 0000000C.00000002.791560410.000000006DDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.791601407.000000006DE06000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.791611335.000000006DE0A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.791621687.000000006DE0E000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.791745650.000000006DEF9000.00000004.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6ddf0000_windowsconnect.jbxd

Similarity

API ID: Unwind_$BaseDataLanguageRegionSpecificStartText
String ID:
API String ID: 2117219864-0
Opcode ID: ca6ef267c37fb537390a95fea40c4e29d5919beab20bb1d9f0f532046b096327
Instruction ID: 699ed62f59faf1635603d9d5b5761c28eb2307dc7ff4bb91d61e2e2cc756c5be
Opcode Fuzzy Hash: ca6ef267c37fb537390a95fea40c4e29d5919beab20bb1d9f0f532046b096327
Instruction Fuzzy Hash: 2841AEB280D3528BDB108F28C48475AFBE1AB56308F25CD1DE9D4A7340DB7AE859CB42

Uniqueness

Uniqueness Score: -1.00%

Function 6DDF1810 Relevance: 10.7, APIs: 7, Instructions: 162
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

abort.MSVCRT ref: 6DE04348
abort.MSVCRT ref: 6DE04350
abort.MSVCRT ref: 6DE04358
abort.MSVCRT(?), ref: 6DE04360
abort.MSVCRT(?), ref: 6DE04368
abort.MSVCRT(?), ref: 6DE04370
abort.MSVCRT(?), ref: 6DE04378

Memory Dump Source

Source File: 0000000C.00000002.791575656.000000006DDF1000.00000040.00000001.01000000.00000009.sdmp, Offset: 6DDF0000, based on PE: true

Associated: 0000000C.00000002.791560410.000000006DDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.791601407.000000006DE06000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.791611335.000000006DE0A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.791621687.000000006DE0E000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.791745650.000000006DEF9000.00000004.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6ddf0000_windowsconnect.jbxd

Similarity

API ID: abort
String ID:
API String ID: 4206212132-0
Opcode ID: b8e1109a2b7ceb64d81bb9db10477226e6dc25c0a62780c94672dccc0ab3260d
Instruction ID: 20b652b64224c56ba8e5da357b62698bbdbe7995734a818e82946772f8bf5db4
Opcode Fuzzy Hash: b8e1109a2b7ceb64d81bb9db10477226e6dc25c0a62780c94672dccc0ab3260d
Instruction Fuzzy Hash: 1741FA36F483224BF75058289A80376B6D4DBAD389F26593AEE9DF3381EE58CC54C581

Uniqueness

Uniqueness Score: -1.00%

Function 6DDF1860 Relevance: 9.2, APIs: 6, Instructions: 150
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000C.00000002.791575656.000000006DDF1000.00000040.00000001.01000000.00000009.sdmp, Offset: 6DDF0000, based on PE: true

Associated: 0000000C.00000002.791560410.000000006DDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.791601407.000000006DE06000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.791611335.000000006DE0A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.791621687.000000006DE0E000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.791745650.000000006DEF9000.00000004.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6ddf0000_windowsconnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb6617df16cb893cd7ed10d0db765f5eccf6eacfdeaf7632a8227cd5416171f8
Instruction ID: 70a0032563fa7a265eff03c479f46cca052da681ec247fc419b6780b0b7c3e1d
Opcode Fuzzy Hash: fb6617df16cb893cd7ed10d0db765f5eccf6eacfdeaf7632a8227cd5416171f8
Instruction Fuzzy Hash: F8410A36F443220BF75058289B90376B6D4DBAD38AF22493ADE9DF3381EE59CC54C581

Uniqueness

Uniqueness Score: -1.00%

Function 6DE02500 Relevance: 9.1, APIs: 6, Instructions: 71COMMON

Download Yara Rule

APIs

pthread_once.LIBWINPTHREAD-1 ref: 6DE02522
pthread_mutex_lock.LIBWINPTHREAD-1 ref: 6DE0252E
pthread_mutex_unlock.LIBWINPTHREAD-1 ref: 6DE02564

Memory Dump Source

Source File: 0000000C.00000002.791575656.000000006DDF1000.00000040.00000001.01000000.00000009.sdmp, Offset: 6DDF0000, based on PE: true

Associated: 0000000C.00000002.791560410.000000006DDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.791601407.000000006DE06000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.791611335.000000006DE0A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.791621687.000000006DE0E000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.791745650.000000006DEF9000.00000004.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6ddf0000_windowsconnect.jbxd

Similarity

API ID: pthread_mutex_lockpthread_mutex_unlockpthread_once
String ID:
API String ID: 3726264613-0
Opcode ID: 9465f71376bdc57054ac85603a879949034b8dc09316df80a2492fba931b004c
Instruction ID: 2879c9de9f49f02fb7e98ec528372c3fbf58c3043933bda40cf7d282a1890c30
Opcode Fuzzy Hash: 9465f71376bdc57054ac85603a879949034b8dc09316df80a2492fba931b004c
Instruction Fuzzy Hash: 7321AF706092028BEB25EF28A1D562AB7E4BF2638CB72806CC9546F305DF30D871C767

Uniqueness

Uniqueness Score: -1.00%

Function 6DDF1890 Relevance: 7.7, APIs: 5, Instructions: 155COMMON

Download Yara Rule

APIs

abort.MSVCRT ref: 6DE04358
abort.MSVCRT(?), ref: 6DE04360
abort.MSVCRT(?), ref: 6DE04368
abort.MSVCRT(?), ref: 6DE04370
abort.MSVCRT(?), ref: 6DE04378

Memory Dump Source

Source File: 0000000C.00000002.791575656.000000006DDF1000.00000040.00000001.01000000.00000009.sdmp, Offset: 6DDF0000, based on PE: true

Associated: 0000000C.00000002.791560410.000000006DDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.791601407.000000006DE06000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.791611335.000000006DE0A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.791621687.000000006DE0E000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.791745650.000000006DEF9000.00000004.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6ddf0000_windowsconnect.jbxd

Similarity

API ID: abort
String ID:
API String ID: 4206212132-0
Opcode ID: 39a826f174826f22aad89f336fa9498173cd353d3f71b5281c13e2e9d46ce619
Instruction ID: 51851b55c500f04d925508e924635c1e1418f544217c55c3f8a0abe4e6200ee0
Opcode Fuzzy Hash: 39a826f174826f22aad89f336fa9498173cd353d3f71b5281c13e2e9d46ce619
Instruction Fuzzy Hash: BB41FB36F043224BF75058289A40376B6D49BED785F36493AEE9DF3381EE69CC54C581

Uniqueness

Uniqueness Score: -1.00%

Function 6DDF6053 Relevance: 7.6, APIs: 5, Instructions: 117COMMON

Download Yara Rule

APIs

__unordtf2.LIBGCC_S_SJLJ-1 ref: 6DDF4FB7
__lttf2.LIBGCC_S_SJLJ-1 ref: 6DDF4FFF
__unordtf2.LIBGCC_S_SJLJ-1 ref: 6DDF504E
__gttf2.LIBGCC_S_SJLJ-1 ref: 6DDF5099
__unordtf2.LIBGCC_S_SJLJ-1 ref: 6DDF50E8
__gttf2.LIBGCC_S_SJLJ-1 ref: 6DDF5133
__unordtf2.LIBGCC_S_SJLJ-1 ref: 6DDF5187
__floatsitf.LIBGCC_S_SJLJ-1 ref: 6DDF51AA
__unordtf2.LIBGCC_S_SJLJ-1 ref: 6DDF5237
__floatsitf.LIBGCC_S_SJLJ-1 ref: 6DDF5255
__multf3.LIBGCC_S_SJLJ-1 ref: 6DDF52DD
__multf3.LIBGCC_S_SJLJ-1 ref: 6DDF5349
__netf2.LIBGCC_S_SJLJ-1 ref: 6DDF6097
__unordtf2.LIBGCC_S_SJLJ-1 ref: 6DDF60D3
__unordtf2.LIBGCC_S_SJLJ-1 ref: 6DDF610B
__multf3.LIBGCC_S_SJLJ-1 ref: 6DDF616E
__multf3.LIBGCC_S_SJLJ-1 ref: 6DDF61EA

Memory Dump Source

Source File: 0000000C.00000002.791575656.000000006DDF1000.00000040.00000001.01000000.00000009.sdmp, Offset: 6DDF0000, based on PE: true

Associated: 0000000C.00000002.791560410.000000006DDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.791601407.000000006DE06000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.791611335.000000006DE0A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.791621687.000000006DE0E000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.791745650.000000006DEF9000.00000004.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6ddf0000_windowsconnect.jbxd

Similarity

API ID: __unordtf2$__multf3$__floatsitf__gttf2$__lttf2__netf2
String ID:
API String ID: 3166148315-0
Opcode ID: e8a7e02de4f2030d3140da2ba7fb9f8ebae3f95a0ef42c85d349928de04c776b
Instruction ID: 9915cd39c9cf2783be144d1df867e774c31efec869d90f97628dc645468b5456
Opcode Fuzzy Hash: e8a7e02de4f2030d3140da2ba7fb9f8ebae3f95a0ef42c85d349928de04c776b
Instruction Fuzzy Hash: 265108B4A087418FD360DF29C18074AFBE0BB88754F118D2EE998D3311E775E9498F92

Uniqueness

Uniqueness Score: -1.00%

Function 6DE041E0 Relevance: 7.6, APIs: 5, Instructions: 61COMMON

Download Yara Rule

APIs

_lock.MSVCRT ref: 6DE041F9
_unlock.MSVCRT ref: 6DE04221
calloc.MSVCRT ref: 6DE0426F

Memory Dump Source

Source File: 0000000C.00000002.791575656.000000006DDF1000.00000040.00000001.01000000.00000009.sdmp, Offset: 6DDF0000, based on PE: true

Associated: 0000000C.00000002.791560410.000000006DDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.791601407.000000006DE06000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.791611335.000000006DE0A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.791621687.000000006DE0E000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.791745650.000000006DEF9000.00000004.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6ddf0000_windowsconnect.jbxd

Similarity

API ID: _lock_unlockcalloc
String ID:
API String ID: 3876498383-0
Opcode ID: f8768f458ee389f683f81301db044f0bf72636460b241e859b8616a28650da8e
Instruction ID: 4bf3163a78ff71afca9ba47756d5c031d001b12cf91bbc37416b983e1c4d4c75
Opcode Fuzzy Hash: f8768f458ee389f683f81301db044f0bf72636460b241e859b8616a28650da8e
Instruction Fuzzy Hash: AB2160706082028BD701DFA8D6807697BE4FFA9314F66C66ED5989F389EF34C851CB61

Uniqueness

Uniqueness Score: -1.00%

Function 6DE03490 Relevance: 7.6, APIs: 5, Instructions: 55timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 6DE034CF
GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,6DDF13E5), ref: 6DE034E0
GetCurrentThreadId.KERNEL32 ref: 6DE034E8
GetTickCount.KERNEL32 ref: 6DE034F0
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,6DDF13E5), ref: 6DE034FF

Memory Dump Source

Source File: 0000000C.00000002.791575656.000000006DDF1000.00000040.00000001.01000000.00000009.sdmp, Offset: 6DDF0000, based on PE: true

Associated: 0000000C.00000002.791560410.000000006DDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.791601407.000000006DE06000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.791611335.000000006DE0A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.791621687.000000006DE0E000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.791745650.000000006DEF9000.00000004.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6ddf0000_windowsconnect.jbxd

Similarity

API ID: CurrentTime$CountCounterFilePerformanceProcessQuerySystemThreadTick
String ID:
API String ID: 1445889803-0
Opcode ID: 0b32749dee29623da23aceab9c5b7278d96bae925fa8c4c131b5a4e0d79c7003
Instruction ID: 19d89922c81641d1d0f0a8a4e56ed796c0a9be0ec7e7dbeb9db29ab0acb99ab1
Opcode Fuzzy Hash: 0b32749dee29623da23aceab9c5b7278d96bae925fa8c4c131b5a4e0d79c7003
Instruction Fuzzy Hash: 4D114CB59443058BCB00DF79E488A5FBBF0FB89264F118C3DE444C6200EB36D869CB92

Uniqueness

Uniqueness Score: -1.00%

Function 6DE01320 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 30memoryCOMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32 ref: 6DE0133A
VirtualProtect.KERNEL32 ref: 6DE0136A
abort.MSVCRT ref: 6DE049B0

Strings

@, xrefs: 6DE0134F

Memory Dump Source

Source File: 0000000C.00000002.791575656.000000006DDF1000.00000040.00000001.01000000.00000009.sdmp, Offset: 6DDF0000, based on PE: true

Associated: 0000000C.00000002.791560410.000000006DDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.791601407.000000006DE06000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.791611335.000000006DE0A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.791621687.000000006DE0E000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.791745650.000000006DEF9000.00000004.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6ddf0000_windowsconnect.jbxd

Similarity

API ID: Virtual$ProtectQueryabort
String ID: @
API String ID: 1854752096-2766056989
Opcode ID: ce4c5ff5efb402e3bbc5de5f764cd841fb588575d6b37cf0e208bd5f4b09273f
Instruction ID: ee90035b3aa7439a3010c8b2985a8a3766965cbf0d104370d8ed605db8ed5452
Opcode Fuzzy Hash: ce4c5ff5efb402e3bbc5de5f764cd841fb588575d6b37cf0e208bd5f4b09273f
Instruction Fuzzy Hash: 92F07FB48483459FD700EF68D28862ABBF4BB89344F508D2DE98893314E739D958CF53

Uniqueness

Uniqueness Score: -1.00%

Function 6DE02630 Relevance: 6.1, APIs: 4, Instructions: 103COMMON

Download Yara Rule

APIs

pthread_once.LIBWINPTHREAD-1 ref: 6DE0264E
pthread_mutex_lock.LIBWINPTHREAD-1 ref: 6DE0265A
pthread_mutex_unlock.LIBWINPTHREAD-1 ref: 6DE02695
pthread_mutex_unlock.LIBWINPTHREAD-1 ref: 6DE02768

Memory Dump Source

Source File: 0000000C.00000002.791575656.000000006DDF1000.00000040.00000001.01000000.00000009.sdmp, Offset: 6DDF0000, based on PE: true

Associated: 0000000C.00000002.791560410.000000006DDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.791601407.000000006DE06000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.791611335.000000006DE0A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.791621687.000000006DE0E000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.791745650.000000006DEF9000.00000004.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6ddf0000_windowsconnect.jbxd

Similarity

API ID: pthread_mutex_unlock$pthread_mutex_lockpthread_once
String ID:
API String ID: 1416322145-0
Opcode ID: cd7d5378a112cda4b11baeac46fc07d4ab978f41afa392d41675423527bc31b4
Instruction ID: 6e25a8105028d0a6bcce070fe11a8b51f2ee9edf91e99d16ea63abb4962d8394
Opcode Fuzzy Hash: cd7d5378a112cda4b11baeac46fc07d4ab978f41afa392d41675423527bc31b4
Instruction Fuzzy Hash: 97318E707053128BDB21EF69E0C0616B7F4AF65788B61852DE9489F305DF30D825CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 6DE02D70 Relevance: 6.1, APIs: 4, Instructions: 92COMMON

Download Yara Rule

APIs

pthread_getspecific.LIBWINPTHREAD-1 ref: 6DE02DDC
abort.MSVCRT ref: 6DE02E2D
_Unwind_SjLj_RaiseException.LIBGCC_S_SJLJ-1 ref: 6DE02E52

Memory Dump Source

Source File: 0000000C.00000002.791575656.000000006DDF1000.00000040.00000001.01000000.00000009.sdmp, Offset: 6DDF0000, based on PE: true

Associated: 0000000C.00000002.791560410.000000006DDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.791601407.000000006DE06000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.791611335.000000006DE0A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.791621687.000000006DE0E000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.791745650.000000006DEF9000.00000004.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6ddf0000_windowsconnect.jbxd

Similarity

API ID: ExceptionRaiseUnwind_abortpthread_getspecific
String ID:
API String ID: 2170471676-0
Opcode ID: 4cf79b51e2a596362359fc58e54ebcce63d44af8ba5f7d628c46d8362ff9d5d3
Instruction ID: d7f0780563881c6f281601580081ea9226e510a9bef745ba948f7c07c17f1c70
Opcode Fuzzy Hash: 4cf79b51e2a596362359fc58e54ebcce63d44af8ba5f7d628c46d8362ff9d5d3
Instruction Fuzzy Hash: 3C3102745093068BCB50DF24C4C065E77F4BFA4358F65981DE98997305DB30E969CB92

Uniqueness

Uniqueness Score: -1.00%

Function 6DE03126 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

_Unwind_GetIPInfo.LIBGCC_S_SJLJ-1 ref: 6DE03078
_Unwind_SetGR.LIBGCC_S_SJLJ-1 ref: 6DE030DE
_Unwind_SetGR.LIBGCC_S_SJLJ-1 ref: 6DE030FA
_Unwind_SetIP.LIBGCC_S_SJLJ-1 ref: 6DE0310A

Memory Dump Source

Source File: 0000000C.00000002.791575656.000000006DDF1000.00000040.00000001.01000000.00000009.sdmp, Offset: 6DDF0000, based on PE: true

Associated: 0000000C.00000002.791560410.000000006DDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.791601407.000000006DE06000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.791611335.000000006DE0A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.791621687.000000006DE0E000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.791745650.000000006DEF9000.00000004.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6ddf0000_windowsconnect.jbxd

Similarity

API ID: Unwind_$Info
String ID:
API String ID: 284607-0
Opcode ID: a3c2084179b1c6e9802d913630dfc32007e38162d625ac7085b996b25c167839
Instruction ID: ec24aaa74762db2accacf9e2d7d07c2029da15d4b4b77c7c710906ec4c82f1bb
Opcode Fuzzy Hash: a3c2084179b1c6e9802d913630dfc32007e38162d625ac7085b996b25c167839
Instruction Fuzzy Hash: 40216AB184D3119FD7108F28C89870AFBE0AB45308F25CD1DE8D497340DB7AE899CB42

Uniqueness

Uniqueness Score: -1.00%

Function 6DE032A9 Relevance: 6.0, APIs: 4, Instructions: 44COMMON

Download Yara Rule

APIs

calloc.MSVCRT ref: 6DE032C1
pthread_setspecific.LIBWINPTHREAD-1 ref: 6DE032E1
malloc.MSVCRT ref: 6DE03304
memcpy.MSVCRT ref: 6DE0332C
malloc.MSVCRT ref: 6DE033B3
abort.MSVCRT ref: 6DE03407

Memory Dump Source

Source File: 0000000C.00000002.791575656.000000006DDF1000.00000040.00000001.01000000.00000009.sdmp, Offset: 6DDF0000, based on PE: true

Associated: 0000000C.00000002.791560410.000000006DDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.791601407.000000006DE06000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.791611335.000000006DE0A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.791621687.000000006DE0E000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.791745650.000000006DEF9000.00000004.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6ddf0000_windowsconnect.jbxd

Similarity

API ID: malloc$abortcallocmemcpypthread_setspecific
String ID:
API String ID: 3946005423-0
Opcode ID: 6e3fa91003cb4a6c7041dddd5ac659f14806c1d2c0b2afafe0d18de820697e74
Instruction ID: 20fe10915f40fa1d0fc04ea1c3bf2c6e89bd0e5ce21da18716d027df1d57f919
Opcode Fuzzy Hash: 6e3fa91003cb4a6c7041dddd5ac659f14806c1d2c0b2afafe0d18de820697e74
Instruction Fuzzy Hash: 2C0100756047068FD701DF64D5C0A9ABBE4FF48308F12892DDD999B311EB34E925CB51

Uniqueness

Uniqueness Score: -1.00%

Function 6DE03B00 Relevance: 6.0, APIs: 4, Instructions: 39COMMON

Download Yara Rule

APIs

RtlEnterCriticalSection.NTDLL ref: 6DE03B0E
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,6DE03CCB,?,?,?,?,?,6DE03618), ref: 6DE03B35
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,6DE03CCB,?,?,?,?,?,6DE03618), ref: 6DE03B3C
RtlLeaveCriticalSection.NTDLL ref: 6DE03B5C

Memory Dump Source

Source File: 0000000C.00000002.791575656.000000006DDF1000.00000040.00000001.01000000.00000009.sdmp, Offset: 6DDF0000, based on PE: true

Associated: 0000000C.00000002.791560410.000000006DDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.791601407.000000006DE06000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.791611335.000000006DE0A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.791621687.000000006DE0E000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.791745650.000000006DEF9000.00000004.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6ddf0000_windowsconnect.jbxd

Similarity

API ID: CriticalSection$EnterErrorLastLeaveValue
String ID:
API String ID: 682475483-0
Opcode ID: b516cb70451c3b8e542ffd4ab53a5978136f9414bc75e91e187cca225400f46e
Instruction ID: 70c2a0aa49db08bb96673ca9ad3d9409827f5427b7f452e770071614972ba1a4
Opcode Fuzzy Hash: b516cb70451c3b8e542ffd4ab53a5978136f9414bc75e91e187cca225400f46e
Instruction Fuzzy Hash: 17F0AFB25007158BCB00BFB9C9C9E1ABBF8EB86608B01013CDD4457304EB35E825CBA3

Uniqueness

Uniqueness Score: -1.00%

Function 6DE03266 Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

pthread_getspecific.LIBWINPTHREAD-1 ref: 6DE0323A
pthread_once.LIBWINPTHREAD-1 ref: 6DE0327F
pthread_mutex_lock.LIBWINPTHREAD-1 ref: 6DE0328B
pthread_mutex_unlock.LIBWINPTHREAD-1 ref: 6DE032A2
calloc.MSVCRT ref: 6DE032C1
pthread_setspecific.LIBWINPTHREAD-1 ref: 6DE032E1
malloc.MSVCRT ref: 6DE03304
memcpy.MSVCRT ref: 6DE0332C
realloc.MSVCRT ref: 6DE0335D
memset.MSVCRT ref: 6DE0338A
pthread_setspecific.LIBWINPTHREAD-1 ref: 6DE0339B

Memory Dump Source

Source File: 0000000C.00000002.791575656.000000006DDF1000.00000040.00000001.01000000.00000009.sdmp, Offset: 6DDF0000, based on PE: true

Associated: 0000000C.00000002.791560410.000000006DDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.791601407.000000006DE06000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.791611335.000000006DE0A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.791621687.000000006DE0E000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.791745650.000000006DEF9000.00000004.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6ddf0000_windowsconnect.jbxd

Similarity

API ID: pthread_setspecific$callocmallocmemcpymemsetpthread_getspecificpthread_mutex_lockpthread_mutex_unlockpthread_oncerealloc
String ID:
API String ID: 2262861080-0
Opcode ID: 0c607f735c528522748d0aba89921a97c4673d4536974d14b8ab723a2e588224
Instruction ID: 499a87255d062c77ca8e6ff92e795510a4192c708fe5e7e3cc38c7cc61ad726e
Opcode Fuzzy Hash: 0c607f735c528522748d0aba89921a97c4673d4536974d14b8ab723a2e588224
Instruction Fuzzy Hash: E5F012766087068BDB016F9494C1A5AB3A4EF45308F22482DCA946B201DF71A865C793

Uniqueness

Uniqueness Score: -1.00%

Function 6DE03880 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 173COMMON

Download Yara Rule

Strings

Unknown pseudo relocation bit size %d., xrefs: 6DE03984
Unknown pseudo relocation protocol version %d., xrefs: 6DE03AE6

Memory Dump Source

Source File: 0000000C.00000002.791575656.000000006DDF1000.00000040.00000001.01000000.00000009.sdmp, Offset: 6DDF0000, based on PE: true

Associated: 0000000C.00000002.791560410.000000006DDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.791601407.000000006DE06000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.791611335.000000006DE0A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.791621687.000000006DE0E000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.791745650.000000006DEF9000.00000004.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6ddf0000_windowsconnect.jbxd

Similarity

API ID:
String ID: Unknown pseudo relocation bit size %d.$ Unknown pseudo relocation protocol version %d.
API String ID: 0-395989641
Opcode ID: 2679860c9c9bf12edd20ccc198ef342863d3c4238a944aac490fca676fcd3d32
Instruction ID: ea6ac18950e021ef0eaae24bb6bb224612ce38b41bf74ee04698cc5105f95b6f
Opcode Fuzzy Hash: 2679860c9c9bf12edd20ccc198ef342863d3c4238a944aac490fca676fcd3d32
Instruction Fuzzy Hash: E751D871D04615CBCB00EF28C880B5AB7F6FB85344F35C669DA44AB349DB31A825CB92

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: windowsconnect.exePID: 7072, Parent PID: 796COMMON

Execution Graph

Execution Coverage:	0.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	8
Total number of Limit Nodes:	1

Executed Functions

Function 6D531FC0 Relevance: 6.2, APIs: 4, Instructions: 201
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000D.00000002.865453850.000000006D531000.00000080.00000001.01000000.0000000B.sdmp, Offset: 6D510000, based on PE: true

Associated: 0000000D.00000002.865411633.000000006D510000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865417746.000000006D511000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865433993.000000006D524000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865441691.000000006D52B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865448312.000000006D530000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865459781.000000006D532000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865482049.000000006D533000.00000004.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6d510000_windowsconnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d8ba4ed6bfb77646c7be8dfc86c881e6fa4cfc92a0746176c4653a8f6eb6a4e
Instruction ID: fbf6c563afa11b0fd209dd5b43a303f2f6805beb16d6a2196b3cba56399bfbbe
Opcode Fuzzy Hash: 5d8ba4ed6bfb77646c7be8dfc86c881e6fa4cfc92a0746176c4653a8f6eb6a4e
Instruction Fuzzy Hash: 3E515C71654B635FD3298DB8CCC07A0B7A4EB42325B1A0B38D5E1CBAC6F7A4540AC7E1

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 6D521F90 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32 ref: 6D521FDF
UnhandledExceptionFilter.KERNEL32 ref: 6D521FEF
GetCurrentProcess.KERNEL32 ref: 6D521FF8
TerminateProcess.KERNEL32 ref: 6D522009
abort.MSVCRT ref: 6D522012

Memory Dump Source

Source File: 0000000D.00000002.865417746.000000006D511000.00000040.00000001.01000000.0000000B.sdmp, Offset: 6D510000, based on PE: true

Associated: 0000000D.00000002.865411633.000000006D510000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865433993.000000006D524000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865441691.000000006D52B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865448312.000000006D530000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865453850.000000006D531000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865459781.000000006D532000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865482049.000000006D533000.00000004.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6d510000_windowsconnect.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentTerminateabort
String ID:
API String ID: 520269711-0
Opcode ID: ed0b93df025bcdf4696fcb5dee713eeb4c86179b05db93f24668078b4640ac73
Instruction ID: fc8975fa11958854744981a425cb426edfedfecf649ccef08f5d940ac17ac5ea
Opcode Fuzzy Hash: ed0b93df025bcdf4696fcb5dee713eeb4c86179b05db93f24668078b4640ac73
Instruction Fuzzy Hash: 391125B9904208CFDF04EF68C14971ABBF0BB4A301F42892DE98897750E734AA48CF52

Uniqueness

Uniqueness Score: -1.00%

Function 6D521F8C Relevance: 7.5, APIs: 5, Instructions: 47COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32 ref: 6D521FDF
UnhandledExceptionFilter.KERNEL32 ref: 6D521FEF
GetCurrentProcess.KERNEL32 ref: 6D521FF8
TerminateProcess.KERNEL32 ref: 6D522009
abort.MSVCRT ref: 6D522012

Memory Dump Source

Source File: 0000000D.00000002.865417746.000000006D511000.00000040.00000001.01000000.0000000B.sdmp, Offset: 6D510000, based on PE: true

Associated: 0000000D.00000002.865411633.000000006D510000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865433993.000000006D524000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865441691.000000006D52B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865448312.000000006D530000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865453850.000000006D531000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865459781.000000006D532000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865482049.000000006D533000.00000004.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6d510000_windowsconnect.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentTerminateabort
String ID:
API String ID: 520269711-0
Opcode ID: 51840b907d619631b88b5400fad43a8b4edb50710e3548e6f6ccdf4f960404fa
Instruction ID: be44ac52c49320b68ded0364ce4dba469f3fe360bc628bfb8987d04e0babd21c
Opcode Fuzzy Hash: 51840b907d619631b88b5400fad43a8b4edb50710e3548e6f6ccdf4f960404fa
Instruction Fuzzy Hash: 2F11C5B9904208DFDF04EFA9C54975A7BF0BB0A301F42892DE94897B45E774A94CCF52

Uniqueness

Uniqueness Score: -1.00%

Function 6D5174E0 Relevance: 26.4, APIs: 12, Strings: 3, Instructions: 172
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

malloc.MSVCRT ref: 6D517546
malloc.MSVCRT ref: 6D517556
inflateInit2_.ZLIB1(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6D517B8B), ref: 6D5175B2
??3@YAXPAX@Z.MSVCRT ref: 6D5175C5
??3@YAXPAX@Z.MSVCRT ref: 6D5175D0
_read.MSVCRT ref: 6D51766C
memcpy.MSVCRT ref: 6D5176B1
inflateReset.ZLIB1(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6D517B8B), ref: 6D5176F1

Strings

out of memory, xrefs: 6D5175DC
1.2.11, xrefs: 6D51759F
8, xrefs: 6D517597

Memory Dump Source

Source File: 0000000D.00000002.865417746.000000006D511000.00000040.00000001.01000000.0000000B.sdmp, Offset: 6D510000, based on PE: true

Associated: 0000000D.00000002.865411633.000000006D510000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865433993.000000006D524000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865441691.000000006D52B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865448312.000000006D530000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865453850.000000006D531000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865459781.000000006D532000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865482049.000000006D533000.00000004.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6d510000_windowsconnect.jbxd

Similarity

API ID: ??3@inflatemalloc$Init2_Reset_readmemcpy
String ID: 1.2.11$8$out of memory
API String ID: 1546661546-4226336485
Opcode ID: dc0cbbf8031332e07ee59a30b9331a025a3592d1a112678b38763c334fc7e954
Instruction ID: d5b67bf0c5e5cbfbaa5cace6c64991f3cfa59f5e849147449b19d76e0d52f595
Opcode Fuzzy Hash: dc0cbbf8031332e07ee59a30b9331a025a3592d1a112678b38763c334fc7e954
Instruction Fuzzy Hash: 5B6118B490C741CFEB08DF2CC8C475A7BE0AF49314F524A99D8988B796E775D885CB81

Uniqueness

Uniqueness Score: -1.00%

Function 6D5168F0 Relevance: 21.2, APIs: 14, Instructions: 226
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

malloc.MSVCRT ref: 6D51690E
strlen.MSVCRT ref: 6D5169BC
malloc.MSVCRT ref: 6D5169CB
??3@YAXPAX@Z.MSVCRT ref: 6D516A99
??3@YAXPAX@Z.MSVCRT ref: 6D516AA1

Memory Dump Source

Source File: 0000000D.00000002.865417746.000000006D511000.00000040.00000001.01000000.0000000B.sdmp, Offset: 6D510000, based on PE: true

Associated: 0000000D.00000002.865411633.000000006D510000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865433993.000000006D524000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865441691.000000006D52B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865448312.000000006D530000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865453850.000000006D531000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865459781.000000006D532000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865482049.000000006D533000.00000004.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6d510000_windowsconnect.jbxd

Similarity

API ID: ??3@malloc$strlen
String ID:
API String ID: 3957344517-0
Opcode ID: 800c53236c7911bd656f773aebadf1f9b865612dc6ae09dab1e01d23badf0646
Instruction ID: 76e168cfb079181bdd5c3b9633f18d26dd49ebd25cb6f90a569fca87cf7669dd
Opcode Fuzzy Hash: 800c53236c7911bd656f773aebadf1f9b865612dc6ae09dab1e01d23badf0646
Instruction Fuzzy Hash: A4913FB051C301CFEB08DF28C99472A7BE1BB81358F118A5DD9988FA96D779C449CB92

Uniqueness

Uniqueness Score: -1.00%

Function 6D512900 Relevance: 20.0, APIs: 13, Instructions: 465
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memcpy.MSVCRT ref: 6D512A4F
memcpy.MSVCRT ref: 6D512A9F
memcpy.MSVCRT ref: 6D512AE6
memcpy.MSVCRT ref: 6D512C69

Memory Dump Source

Source File: 0000000D.00000002.865417746.000000006D511000.00000040.00000001.01000000.0000000B.sdmp, Offset: 6D510000, based on PE: true

Associated: 0000000D.00000002.865411633.000000006D510000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865433993.000000006D524000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865441691.000000006D52B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865448312.000000006D530000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865453850.000000006D531000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865459781.000000006D532000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865482049.000000006D533000.00000004.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6d510000_windowsconnect.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: 10a993d9ce49032b600e31c5dd46a8a23b89f5f363ca045ae21690d3ae47a7c6
Instruction ID: 1d5ce2ce881118ac44fab7e83e20ee6417cf4b0f0c376ba779a1ce1e812c0b13
Opcode Fuzzy Hash: 10a993d9ce49032b600e31c5dd46a8a23b89f5f363ca045ae21690d3ae47a7c6
Instruction Fuzzy Hash: 001218756087069FD728CF29C98159ABBE1FF89354F15CA2EE89897700D334E985CF82

Uniqueness

Uniqueness Score: -1.00%

Function 6D522120 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 124
filememoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

fwrite.MSVCRT ref: 6D52214F
vfprintf.MSVCRT ref: 6D52216F
abort.MSVCRT ref: 6D522174
VirtualQuery.KERNEL32 ref: 6D522207
VirtualProtect.KERNEL32 ref: 6D52225D
GetLastError.KERNEL32 ref: 6D52226A

Strings

VirtualQuery failed for %d bytes at address %p, xrefs: 6D522297
@, xrefs: 6D52224E
VirtualProtect failed with code 0x%x, xrefs: 6D522270
Mingw-w64 runtime failure:, xrefs: 6D522148
Address %p has no image-section, xrefs: 6D5222AB

Memory Dump Source

Source File: 0000000D.00000002.865417746.000000006D511000.00000040.00000001.01000000.0000000B.sdmp, Offset: 6D510000, based on PE: true

Associated: 0000000D.00000002.865411633.000000006D510000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865433993.000000006D524000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865441691.000000006D52B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865448312.000000006D530000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865453850.000000006D531000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865459781.000000006D532000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865482049.000000006D533000.00000004.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6d510000_windowsconnect.jbxd

Similarity

API ID: Virtual$ErrorLastProtectQueryabortfwritevfprintf
String ID: VirtualProtect failed with code 0x%x$ VirtualQuery failed for %d bytes at address %p$@$Address %p has no image-section$Mingw-w64 runtime failure:
API String ID: 1616349570-4164700141
Opcode ID: c42bcff98f55354577c527defbcd2aed46315750e033001db49601d89d2576ff
Instruction ID: 6f5010b8a47806ef41e7d8171c01b9b0ea2e55cd2c6b5226eaaf88097547bc03
Opcode Fuzzy Hash: c42bcff98f55354577c527defbcd2aed46315750e033001db49601d89d2576ff
Instruction Fuzzy Hash: 65418BB98183019FDB14DF68C88565AFBF0FF94354F428A1DE99887B84D330E8488F92

Uniqueness

Uniqueness Score: -1.00%

Function 6D521BA0 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 128
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

inflateInit_.ZLIB1 ref: 6D521C28

Part of subcall function 6D51B6F0: inflateReset.ZLIB1 ref: 6D51B78F

inflate.ZLIB1 ref: 6D521C8F
inflateEnd.ZLIB1 ref: 6D521CC5

Strings

8, xrefs: 6D521BF1
1.2.11, xrefs: 6D521BF9

Memory Dump Source

Source File: 0000000D.00000002.865417746.000000006D511000.00000040.00000001.01000000.0000000B.sdmp, Offset: 6D510000, based on PE: true

Associated: 0000000D.00000002.865411633.000000006D510000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865433993.000000006D524000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865441691.000000006D52B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865448312.000000006D530000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865453850.000000006D531000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865459781.000000006D532000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865482049.000000006D533000.00000004.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6d510000_windowsconnect.jbxd

Similarity

API ID: inflate$Init_Reset
String ID: 1.2.11$8
API String ID: 1091158926-810594515
Opcode ID: 77989ec42044eab4c942e7162fcbf7f6686dc5f2b369a53b7472bf180508e747
Instruction ID: 3e096355cc147f38723e2b249b7655f71597cace8e14bfae9cc39e6fc2008200
Opcode Fuzzy Hash: 77989ec42044eab4c942e7162fcbf7f6686dc5f2b369a53b7472bf180508e747
Instruction Fuzzy Hash: 9E51D2B46083029FD318DF29C580A1BBBE0BFC9758F508E2DE59897B90D771D9098B82

Uniqueness

Uniqueness Score: -1.00%

Function 6D5184F0 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 74
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

malloc.MSVCRT ref: 6D518501
malloc.MSVCRT ref: 6D51852D
deflateInit2_.ZLIB1 ref: 6D51858E

Strings

out of memory, xrefs: 6D5185D8
8>cRm, xrefs: 6D518597
8, xrefs: 6D518563
1.2.11, xrefs: 6D51856B

Memory Dump Source

Source File: 0000000D.00000002.865417746.000000006D511000.00000040.00000001.01000000.0000000B.sdmp, Offset: 6D510000, based on PE: true

Associated: 0000000D.00000002.865411633.000000006D510000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865433993.000000006D524000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865441691.000000006D52B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865448312.000000006D530000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865453850.000000006D531000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865459781.000000006D532000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865482049.000000006D533000.00000004.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6d510000_windowsconnect.jbxd

Similarity

API ID: malloc$Init2_deflate
String ID: 1.2.11$8$8>cRm$out of memory
API String ID: 3680296951-2398626637
Opcode ID: 56c0798fb23cc0fadc97899a60a1c339b9b98b4e4557865595abfe1d8ac96104
Instruction ID: 7fd3138729d298e8c2e8c26bfecdb55fdc75b61999dfb7335cab08a99f76ab34
Opcode Fuzzy Hash: 56c0798fb23cc0fadc97899a60a1c339b9b98b4e4557865595abfe1d8ac96104
Instruction Fuzzy Hash: 4F3129B45083029BEB18DF29D4C465ABFE0FF84314F528A6DD8948B78AE734C845CF82

Uniqueness

Uniqueness Score: -1.00%

Function 6D51C249 Relevance: 14.4, APIs: 7, Strings: 1, Instructions: 433COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 6D51C2DB
crc32.ZLIB1 ref: 6D51C3BF

Strings

header crc mismatch, xrefs: 6D51CE9A

Memory Dump Source

Source File: 0000000D.00000002.865417746.000000006D511000.00000040.00000001.01000000.0000000B.sdmp, Offset: 6D510000, based on PE: true

Associated: 0000000D.00000002.865411633.000000006D510000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865433993.000000006D524000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865441691.000000006D52B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865448312.000000006D530000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865453850.000000006D531000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865459781.000000006D532000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865482049.000000006D533000.00000004.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6d510000_windowsconnect.jbxd

Similarity

API ID: crc32memcpy
String ID: header crc mismatch
API String ID: 1641957252-1313727592
Opcode ID: fa45db3582e36a5beeec524ce194b50c30821542178dbf976d5258bcd064c9ab
Instruction ID: dafc083aebb62be50b7b216c8bb71bebd68def8ff876138a31f18935c925452d
Opcode Fuzzy Hash: fa45db3582e36a5beeec524ce194b50c30821542178dbf976d5258bcd064c9ab
Instruction Fuzzy Hash: CB12387460C3528FE708CF19C58072ABBE1BF89758F158A6DE9989B751D332E941CB82

Uniqueness

Uniqueness Score: -1.00%

Function 6D517780 Relevance: 14.2, APIs: 4, Strings: 4, Instructions: 166
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

inflate.ZLIB1(?,?,?,?,?,?,?,?,?,?,?,?,?,6D517B8B), ref: 6D5177AF

Strings

internal error: inflate stream corrupt, xrefs: 6D5178AB
out of memory, xrefs: 6D5178D3
compressed data error, xrefs: 6D517903
unexpected end of file, xrefs: 6D517804

Memory Dump Source

Source File: 0000000D.00000002.865417746.000000006D511000.00000040.00000001.01000000.0000000B.sdmp, Offset: 6D510000, based on PE: true

Associated: 0000000D.00000002.865411633.000000006D510000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865433993.000000006D524000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865441691.000000006D52B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865448312.000000006D530000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865453850.000000006D531000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865459781.000000006D532000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865482049.000000006D533000.00000004.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6d510000_windowsconnect.jbxd

Similarity

API ID: inflate
String ID: compressed data error$internal error: inflate stream corrupt$out of memory$unexpected end of file
API String ID: 3919641094-895915629
Opcode ID: 631a266270655419af7efac30043cc727822cafa281e73b59210f16e648ceed2
Instruction ID: 32509643d8c22da438e3482025da226ad47549da9d173a5222acc035324a61b6
Opcode Fuzzy Hash: 631a266270655419af7efac30043cc727822cafa281e73b59210f16e648ceed2
Instruction Fuzzy Hash: 78511A75A08706DBE708DF3DD98065ABBE1ABC5324F15CB2AE8A887794D730D845CB81

Uniqueness

Uniqueness Score: -1.00%

Function 6D511B90 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 98
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

deflateInit_.ZLIB1 ref: 6D511C0D

Part of subcall function 6D516260: deflateResetKeep.ZLIB1 ref: 6D51641C

deflate.ZLIB1 ref: 6D511C8A
deflateEnd.ZLIB1 ref: 6D511CA4
__stack_chk_fail.LIBSSP-0 ref: 6D511CC9
compress2.ZLIB1 ref: 6D511CFA

Strings

1.2.11, xrefs: 6D511BEE
8, xrefs: 6D511BE6

Memory Dump Source

Source File: 0000000D.00000002.865417746.000000006D511000.00000040.00000001.01000000.0000000B.sdmp, Offset: 6D510000, based on PE: true

Associated: 0000000D.00000002.865411633.000000006D510000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865433993.000000006D524000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865441691.000000006D52B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865448312.000000006D530000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865453850.000000006D531000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865459781.000000006D532000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865482049.000000006D533000.00000004.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6d510000_windowsconnect.jbxd

Similarity

API ID: deflate$Init_KeepReset__stack_chk_failcompress2
String ID: 1.2.11$8
API String ID: 2506657658-810594515
Opcode ID: 7700704ea895075641c8903b55267f28b35b2393dc0471ee7b241106070cd8ed
Instruction ID: 6d54fc14325f8448b18a9a55c02032c44290383e95ad6940ff7fe80517b8cb76
Opcode Fuzzy Hash: 7700704ea895075641c8903b55267f28b35b2393dc0471ee7b241106070cd8ed
Instruction Fuzzy Hash: E541DBB460D3029FE354CF29C980B1BBBF0BBC8758F41882DE89887740E775D8098B82

Uniqueness

Uniqueness Score: -1.00%

Function 6D517538 Relevance: 14.0, APIs: 5, Strings: 3, Instructions: 48
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

malloc.MSVCRT ref: 6D517546
malloc.MSVCRT ref: 6D517556
inflateInit2_.ZLIB1(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6D517B8B), ref: 6D5175B2

Part of subcall function 6D51B5F0: inflateReset2.ZLIB1 ref: 6D51B67A

??3@YAXPAX@Z.MSVCRT ref: 6D5175C5
??3@YAXPAX@Z.MSVCRT ref: 6D5175D0

Part of subcall function 6D517410: strlen.MSVCRT ref: 6D51745C
Part of subcall function 6D517410: strlen.MSVCRT ref: 6D517466
Part of subcall function 6D517410: malloc.MSVCRT ref: 6D517472
Part of subcall function 6D517410: strlen.MSVCRT ref: 6D517483
Part of subcall function 6D517410: strlen.MSVCRT ref: 6D51748D

??3@YAXPAX@Z.MSVCRT ref: 6D517761
??3@YAXPAX@Z.MSVCRT ref: 6D517769

Strings

out of memory, xrefs: 6D5175DC
1.2.11, xrefs: 6D51759F
8, xrefs: 6D517597

Memory Dump Source

Source File: 0000000D.00000002.865417746.000000006D511000.00000040.00000001.01000000.0000000B.sdmp, Offset: 6D510000, based on PE: true

Associated: 0000000D.00000002.865411633.000000006D510000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865433993.000000006D524000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865441691.000000006D52B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865448312.000000006D530000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865453850.000000006D531000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865459781.000000006D532000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865482049.000000006D533000.00000004.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6d510000_windowsconnect.jbxd

Similarity

API ID: ??3@strlen$malloc$inflate$Init2_Reset2
String ID: 1.2.11$8$out of memory
API String ID: 5303125-4226336485
Opcode ID: e687430a7017a9c964c55e7f3d41c0cdaa49c16efad5fd96ac3e24b76e241a4f
Instruction ID: 01fe1af07b350ce6a4d476f7e65693d79cb65ab43609986fca39a9a93acb2eac
Opcode Fuzzy Hash: e687430a7017a9c964c55e7f3d41c0cdaa49c16efad5fd96ac3e24b76e241a4f
Instruction Fuzzy Hash: 8B1128B040C704CBEB18AF68C48435A7BE0EF48318F524A5DD9949F696E779D848CF81

Uniqueness

Uniqueness Score: -1.00%

Function 6D518600 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 144
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

deflate.ZLIB1(?,?,?,?,?,?,?,?,?,?,6D519251), ref: 6D51865D
_write.MSVCRT ref: 6D5186D3
_errno.MSVCRT ref: 6D5186DC
strerror.MSVCRT ref: 6D5186EC

Strings

internal error: deflate stream corrupt, xrefs: 6D5187C0

Memory Dump Source

Source File: 0000000D.00000002.865417746.000000006D511000.00000040.00000001.01000000.0000000B.sdmp, Offset: 6D510000, based on PE: true

Associated: 0000000D.00000002.865411633.000000006D510000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865433993.000000006D524000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865441691.000000006D52B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865448312.000000006D530000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865453850.000000006D531000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865459781.000000006D532000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865482049.000000006D533000.00000004.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6d510000_windowsconnect.jbxd

Similarity

API ID: _errno_writedeflatestrerror
String ID: internal error: deflate stream corrupt
API String ID: 4283490402-3609297558
Opcode ID: 966af94301eb97d750b5aa3aad069efacf4256583fbca0e712c460e7e2fc7983
Instruction ID: 4efc74d18b995032ce93a25cf63ca709c5bc7707b569742dee6ceddbab33eb6d
Opcode Fuzzy Hash: 966af94301eb97d750b5aa3aad069efacf4256583fbca0e712c460e7e2fc7983
Instruction Fuzzy Hash: B3515E7560C3069FEB19DF28C98056D7BE2BF95364F518E29E869C7740D730DC449B42

Uniqueness

Uniqueness Score: -1.00%

Function 6D511020 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 108
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32 ref: 6D511057
_amsg_exit.MSVCRT ref: 6D511085

Strings

p Rm, xrefs: 6D511115

Memory Dump Source

Source File: 0000000D.00000002.865417746.000000006D511000.00000040.00000001.01000000.0000000B.sdmp, Offset: 6D510000, based on PE: true

Associated: 0000000D.00000002.865411633.000000006D510000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865433993.000000006D524000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865441691.000000006D52B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865448312.000000006D530000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865453850.000000006D531000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865459781.000000006D532000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865482049.000000006D533000.00000004.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6d510000_windowsconnect.jbxd

Similarity

API ID: Sleep_amsg_exit
String ID: p Rm
API String ID: 1015461914-3384286035
Opcode ID: f3f935e6e0b33a9d66524ef21a7c3a1284229638624ce1b9cf393e497e5563db
Instruction ID: a4a030b3d7ced325c26fb70ec1d60dc7e25d75baf49961302a27a7dd939c4eef
Opcode Fuzzy Hash: f3f935e6e0b33a9d66524ef21a7c3a1284229638624ce1b9cf393e497e5563db
Instruction Fuzzy Hash: F4419171A4C2428FEB059F19C884B6AB7F0FBA2745F42896DD5448BB80D736C588CB83

Uniqueness

Uniqueness Score: -1.00%

Function 6D517410 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 61
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

strlen.MSVCRT ref: 6D51745C
strlen.MSVCRT ref: 6D517466
malloc.MSVCRT ref: 6D517472
strlen.MSVCRT ref: 6D517483
strlen.MSVCRT ref: 6D51748D
??3@YAXPAX@Z.MSVCRT ref: 6D5174CB

Strings

%s%s%s, xrefs: 6D5174A6

Memory Dump Source

Source File: 0000000D.00000002.865417746.000000006D511000.00000040.00000001.01000000.0000000B.sdmp, Offset: 6D510000, based on PE: true

Associated: 0000000D.00000002.865411633.000000006D510000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865433993.000000006D524000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865441691.000000006D52B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865448312.000000006D530000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865453850.000000006D531000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865459781.000000006D532000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865482049.000000006D533000.00000004.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6d510000_windowsconnect.jbxd

Similarity

API ID: strlen$??3@malloc
String ID: %s%s%s
API String ID: 679234750-3094730333
Opcode ID: 947b7074819564987440aad55b89af88f69fa049779e0909a545a345fbfb3b0c
Instruction ID: fbcdb78931b246fd8a1aed708b1d9b20037139cc11ae3bfe4e352f01cc4d9d6a
Opcode Fuzzy Hash: 947b7074819564987440aad55b89af88f69fa049779e0909a545a345fbfb3b0c
Instruction Fuzzy Hash: A6216D7491C721CBD7289F29D88022ABBE4EF81224F024E5DDDA49BA85E771C945CF93

Uniqueness

Uniqueness Score: -1.00%

Function 6D518800 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 110
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_write.MSVCRT ref: 6D518865
_errno.MSVCRT ref: 6D51886E
strerror.MSVCRT ref: 6D518879
deflate.ZLIB1 ref: 6D5188BC

Strings

internal error: deflate stream corrupt, xrefs: 6D518960

Memory Dump Source

Source File: 0000000D.00000002.865417746.000000006D511000.00000040.00000001.01000000.0000000B.sdmp, Offset: 6D510000, based on PE: true

Associated: 0000000D.00000002.865411633.000000006D510000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865433993.000000006D524000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865441691.000000006D52B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865448312.000000006D530000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865453850.000000006D531000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865459781.000000006D532000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865482049.000000006D533000.00000004.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6d510000_windowsconnect.jbxd

Similarity

API ID: _errno_writedeflatestrerror
String ID: internal error: deflate stream corrupt
API String ID: 4283490402-3609297558
Opcode ID: 1daf95b9f6e0617c3d8222627b4a6abbc9d44004532b0678ece0197b2b2e0eee
Instruction ID: 43c177ae5f4b8973da66c82c3a04b919c3c5c7063deb9e7a8d71e4670d336086
Opcode Fuzzy Hash: 1daf95b9f6e0617c3d8222627b4a6abbc9d44004532b0678ece0197b2b2e0eee
Instruction Fuzzy Hash: 48410C74A0CB02BFE328DF29C980659BBE1BF85354F118E29D554C7B94E730E855CB82

Uniqueness

Uniqueness Score: -1.00%

Function 6D519400 Relevance: 10.6, APIs: 7, Instructions: 99
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

??3@YAXPAX@Z.MSVCRT ref: 6D519458
??3@YAXPAX@Z.MSVCRT ref: 6D51947B
_close.MSVCRT ref: 6D519486
??3@YAXPAX@Z.MSVCRT ref: 6D519499

Memory Dump Source

Source File: 0000000D.00000002.865417746.000000006D511000.00000040.00000001.01000000.0000000B.sdmp, Offset: 6D510000, based on PE: true

Associated: 0000000D.00000002.865411633.000000006D510000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865433993.000000006D524000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865441691.000000006D52B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865448312.000000006D530000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865453850.000000006D531000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865459781.000000006D532000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865482049.000000006D533000.00000004.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6d510000_windowsconnect.jbxd

Similarity

API ID: ??3@$_close
String ID:
API String ID: 1690646541-0
Opcode ID: e8b69906edcbf70ff8633603f49e1e8c5780769783fc65e5553fce37a4d4b91d
Instruction ID: 320ccbcbbb4dabf592ab12fda61721bbe3e7be68b2e6b3f93f2374cf29889d1a
Opcode Fuzzy Hash: e8b69906edcbf70ff8633603f49e1e8c5780769783fc65e5553fce37a4d4b91d
Instruction Fuzzy Hash: C1312A75A1C6218BEB189F38C8C061A77A0BF84724F124E59DDB49BB89E774DC44CF81

Uniqueness

Uniqueness Score: -1.00%

Function 6D518430 Relevance: 9.0, APIs: 6, Instructions: 50COMMON

Download Yara Rule

APIs

??3@YAXPAX@Z.MSVCRT ref: 6D518482
_close.MSVCRT ref: 6D51848D
??3@YAXPAX@Z.MSVCRT ref: 6D518497
inflateEnd.ZLIB1 ref: 6D5184B6
??3@YAXPAX@Z.MSVCRT ref: 6D5184C1
??3@YAXPAX@Z.MSVCRT ref: 6D5184CC

Memory Dump Source

Source File: 0000000D.00000002.865417746.000000006D511000.00000040.00000001.01000000.0000000B.sdmp, Offset: 6D510000, based on PE: true

Associated: 0000000D.00000002.865411633.000000006D510000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865433993.000000006D524000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865441691.000000006D52B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865448312.000000006D530000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865453850.000000006D531000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865459781.000000006D532000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865482049.000000006D533000.00000004.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6d510000_windowsconnect.jbxd

Similarity

API ID: ??3@$_closeinflate
String ID:
API String ID: 4126087673-0
Opcode ID: 8c45fb15efc3feffffb96b5d1a675af8aa0de35f8a54c665c9574fe2fce9ac0f
Instruction ID: 502608c8a8b47f712a99a649d4b1b94b1b9aa054f36ce5da19baa832b2abdb6a
Opcode Fuzzy Hash: 8c45fb15efc3feffffb96b5d1a675af8aa0de35f8a54c665c9574fe2fce9ac0f
Instruction Fuzzy Hash: D011307560C3109BDB18AF78C8C465ABBE0BF84368F424E6CDDA49B785D778DC448B82

Uniqueness

Uniqueness Score: -1.00%

Function 6D519529 Relevance: 9.0, APIs: 6, Instructions: 32COMMON

Download Yara Rule

APIs

??3@YAXPAX@Z.MSVCRT ref: 6D519458

Part of subcall function 6D517410: strlen.MSVCRT ref: 6D51745C
Part of subcall function 6D517410: strlen.MSVCRT ref: 6D517466
Part of subcall function 6D517410: malloc.MSVCRT ref: 6D517472
Part of subcall function 6D517410: strlen.MSVCRT ref: 6D517483
Part of subcall function 6D517410: strlen.MSVCRT ref: 6D51748D

??3@YAXPAX@Z.MSVCRT ref: 6D51947B
_close.MSVCRT ref: 6D519486
??3@YAXPAX@Z.MSVCRT ref: 6D519499
deflateEnd.ZLIB1 ref: 6D519536
??3@YAXPAX@Z.MSVCRT ref: 6D519541

Memory Dump Source

Source File: 0000000D.00000002.865417746.000000006D511000.00000040.00000001.01000000.0000000B.sdmp, Offset: 6D510000, based on PE: true

Associated: 0000000D.00000002.865411633.000000006D510000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865433993.000000006D524000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865441691.000000006D52B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865448312.000000006D530000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865453850.000000006D531000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865459781.000000006D532000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865482049.000000006D533000.00000004.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6d510000_windowsconnect.jbxd

Similarity

API ID: ??3@strlen$_closedeflatemalloc
String ID:
API String ID: 1295031279-0
Opcode ID: 2cec3dee41b3b60bbc53cc72cfd51a12459fd2abe5688348302a5bd584afd0eb
Instruction ID: 13e682f273746fadcfdb5c13ad34f8401f048db36a8b4bdfa8af1feabffdd79d
Opcode Fuzzy Hash: 2cec3dee41b3b60bbc53cc72cfd51a12459fd2abe5688348302a5bd584afd0eb
Instruction Fuzzy Hash: 7CF0E7B551C7148BDB18AF78D4C425EBBE0FF84318F920E6DE9A49B685D734D8488B82

Uniqueness

Uniqueness Score: -1.00%

Function 6D518524 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 39COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 6D51852D
deflateInit2_.ZLIB1 ref: 6D51858E
??3@YAXPAX@Z.MSVCRT ref: 6D5185C8
??3@YAXPAX@Z.MSVCRT ref: 6D5185D3

Strings

8>cRm, xrefs: 6D518597
8, xrefs: 6D518563
1.2.11, xrefs: 6D51856B

Memory Dump Source

Source File: 0000000D.00000002.865417746.000000006D511000.00000040.00000001.01000000.0000000B.sdmp, Offset: 6D510000, based on PE: true

Associated: 0000000D.00000002.865411633.000000006D510000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865433993.000000006D524000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865441691.000000006D52B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865448312.000000006D530000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865453850.000000006D531000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865459781.000000006D532000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865482049.000000006D533000.00000004.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6d510000_windowsconnect.jbxd

Similarity

API ID: ??3@$Init2_deflatemalloc
String ID: 1.2.11$8$8>cRm
API String ID: 3428810575-911098299
Opcode ID: b26849df9a2173e38ae531b58950e21e4e7a6e21936faf3c8e0147335730b629
Instruction ID: f9d4f5cbc8502f3818ba0683b62b2b39952596437f8c16b33b8d030333d0d9c6
Opcode Fuzzy Hash: b26849df9a2173e38ae531b58950e21e4e7a6e21936faf3c8e0147335730b629
Instruction Fuzzy Hash: 4E11C2B05093019BEB48CF29C58430ABFE0FF84344F51899ADC548B74AE379D8498F82

Uniqueness

Uniqueness Score: -1.00%

Function 6D51C414 Relevance: 7.8, APIs: 5, Instructions: 348COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 6D51BFE3

Memory Dump Source

Source File: 0000000D.00000002.865417746.000000006D511000.00000040.00000001.01000000.0000000B.sdmp, Offset: 6D510000, based on PE: true

Associated: 0000000D.00000002.865411633.000000006D510000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865433993.000000006D524000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865441691.000000006D52B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865448312.000000006D530000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865453850.000000006D531000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865459781.000000006D532000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865482049.000000006D533000.00000004.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6d510000_windowsconnect.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: 919e633f6f1ce698d59c4565c9aabeffb8a2d66014db72896b92762066917d8f
Instruction ID: 7d0a609daf2c35f319de4995704abb833d3355e9b7241c53dc6afccdd9f7ed4d
Opcode Fuzzy Hash: 919e633f6f1ce698d59c4565c9aabeffb8a2d66014db72896b92762066917d8f
Instruction Fuzzy Hash: 17E127746083028FE708CF19C580B2AFBF1BF89758F598A6DE9989B755D336D9408F42

Uniqueness

Uniqueness Score: -1.00%

Function 6D5125B0 Relevance: 7.8, APIs: 5, Instructions: 254COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 6D51260B
memcpy.MSVCRT ref: 6D512697

Memory Dump Source

Source File: 0000000D.00000002.865417746.000000006D511000.00000040.00000001.01000000.0000000B.sdmp, Offset: 6D510000, based on PE: true

Associated: 0000000D.00000002.865411633.000000006D510000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865433993.000000006D524000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865441691.000000006D52B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865448312.000000006D530000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865453850.000000006D531000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865459781.000000006D532000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865482049.000000006D533000.00000004.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6d510000_windowsconnect.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: 5a19ae901b7c81cc47195c0520d53e4f528d86baf5512689e2111843df0c2354
Instruction ID: 59da33af99fd909066a041398ade1c7a6c937aec51c4f3751518f91c45287303
Opcode Fuzzy Hash: 5a19ae901b7c81cc47195c0520d53e4f528d86baf5512689e2111843df0c2354
Instruction Fuzzy Hash: 04A19B75A083158FDB28CF29C98159EBBE2FF89314F158A2EEC9997750D730E844CB81

Uniqueness

Uniqueness Score: -1.00%

Function 6D516580 Relevance: 7.7, APIs: 5, Instructions: 222COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 6D516798
memcpy.MSVCRT ref: 6D5167B7
memcpy.MSVCRT ref: 6D5167D6
memcpy.MSVCRT ref: 6D5167F3
deflateEnd.ZLIB1 ref: 6D516873

Memory Dump Source

Source File: 0000000D.00000002.865417746.000000006D511000.00000040.00000001.01000000.0000000B.sdmp, Offset: 6D510000, based on PE: true

Associated: 0000000D.00000002.865411633.000000006D510000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865433993.000000006D524000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865441691.000000006D52B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865448312.000000006D530000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865453850.000000006D531000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865459781.000000006D532000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865482049.000000006D533000.00000004.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6d510000_windowsconnect.jbxd

Similarity

API ID: memcpy$deflate
String ID:
API String ID: 774003430-0
Opcode ID: 9aadc17068e2698c557e119c542ee57e5226239f324a5976488e9f8ba8aa8f5b
Instruction ID: e4e2ab73e66e1e68f4cf4606d550b04fe87de628923569ea213fdb4f141e6d65
Opcode Fuzzy Hash: 9aadc17068e2698c557e119c542ee57e5226239f324a5976488e9f8ba8aa8f5b
Instruction Fuzzy Hash: 06A1E9B5A083069FD708CF28C59055ABBE1FF88310F158AADED998B796D735D884CF81

Uniqueness

Uniqueness Score: -1.00%

Function 6D51E150 Relevance: 7.6, APIs: 5, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.865417746.000000006D511000.00000040.00000001.01000000.0000000B.sdmp, Offset: 6D510000, based on PE: true

Associated: 0000000D.00000002.865411633.000000006D510000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865433993.000000006D524000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865441691.000000006D52B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865448312.000000006D530000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865453850.000000006D531000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865459781.000000006D532000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865482049.000000006D533000.00000004.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6d510000_windowsconnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 704eab3333e54d9a19ec6f5e185ca79323d77a491d599bda78aba12a3d69aeab
Instruction ID: 68e248758b63c8d1656e757dece2339dd69a3ce98188d6d5302e336b8dc441c0
Opcode Fuzzy Hash: 704eab3333e54d9a19ec6f5e185ca79323d77a491d599bda78aba12a3d69aeab
Instruction Fuzzy Hash: 01514A71A097029FE758DF29CA9066ABBE1BFC4714F508A2DE899C7F50E770E8408B41

Uniqueness

Uniqueness Score: -1.00%

Function 6D522CA0 Relevance: 7.6, APIs: 5, Instructions: 61COMMON

Download Yara Rule

APIs

_lock.MSVCRT ref: 6D522CB9
_unlock.MSVCRT ref: 6D522CE1
calloc.MSVCRT ref: 6D522D2F

Memory Dump Source

Source File: 0000000D.00000002.865417746.000000006D511000.00000040.00000001.01000000.0000000B.sdmp, Offset: 6D510000, based on PE: true

Associated: 0000000D.00000002.865411633.000000006D510000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865433993.000000006D524000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865441691.000000006D52B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865448312.000000006D530000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865453850.000000006D531000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865459781.000000006D532000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865482049.000000006D533000.00000004.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6d510000_windowsconnect.jbxd

Similarity

API ID: _lock_unlockcalloc
String ID:
API String ID: 3876498383-0
Opcode ID: 3815a76f2356d9be5383f4598ff3fd9a5aad37f1edb1b5149f23d69571348036
Instruction ID: 1e3030fcde6894e352ecd9f1f00197d168477d957d5cf87a9426f008fc892def
Opcode Fuzzy Hash: 3815a76f2356d9be5383f4598ff3fd9a5aad37f1edb1b5149f23d69571348036
Instruction Fuzzy Hash: BB215E746292018FD729DF28C88071A7BE0FF85310F55CA69D498DFAD9EB34C809CB61

Uniqueness

Uniqueness Score: -1.00%

Function 6D51950C Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

??3@YAXPAX@Z.MSVCRT ref: 6D519458
??3@YAXPAX@Z.MSVCRT ref: 6D51947B
_close.MSVCRT ref: 6D519486
??3@YAXPAX@Z.MSVCRT ref: 6D519499
memset.MSVCRT ref: 6D51951F

Part of subcall function 6D518800: _write.MSVCRT ref: 6D518865
Part of subcall function 6D518800: _errno.MSVCRT ref: 6D51886E
Part of subcall function 6D518800: strerror.MSVCRT ref: 6D518879

Memory Dump Source

Source File: 0000000D.00000002.865417746.000000006D511000.00000040.00000001.01000000.0000000B.sdmp, Offset: 6D510000, based on PE: true

Associated: 0000000D.00000002.865411633.000000006D510000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865433993.000000006D524000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865441691.000000006D52B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865448312.000000006D530000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865453850.000000006D531000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865459781.000000006D532000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865482049.000000006D533000.00000004.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6d510000_windowsconnect.jbxd

Similarity

API ID: ??3@$_close_errno_writememsetstrerror
String ID:
API String ID: 1227411350-0
Opcode ID: 9fda50bc253b669a8c9960fcf5a5d36b89afca754e06f9db495efe0b59bc9533
Instruction ID: 3dc6a1d965bb022945f6fa188fe9d890a3a5b91e887917cceca2b98b1a362918
Opcode Fuzzy Hash: 9fda50bc253b669a8c9960fcf5a5d36b89afca754e06f9db495efe0b59bc9533
Instruction Fuzzy Hash: 70111CB561C7108BEB189F38D8C021A77E0BF84324F528E59E9A49B685D774DC458B82

Uniqueness

Uniqueness Score: -1.00%

Function 6D521ED0 Relevance: 7.6, APIs: 5, Instructions: 55timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 6D521F0F
GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,6D5113E5), ref: 6D521F20
GetCurrentThreadId.KERNEL32 ref: 6D521F28
GetTickCount.KERNEL32 ref: 6D521F30
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,6D5113E5), ref: 6D521F3F

Memory Dump Source

Source File: 0000000D.00000002.865417746.000000006D511000.00000040.00000001.01000000.0000000B.sdmp, Offset: 6D510000, based on PE: true

Associated: 0000000D.00000002.865411633.000000006D510000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865433993.000000006D524000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865441691.000000006D52B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865448312.000000006D530000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865453850.000000006D531000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865459781.000000006D532000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865482049.000000006D533000.00000004.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6d510000_windowsconnect.jbxd

Similarity

API ID: CurrentTime$CountCounterFilePerformanceProcessQuerySystemThreadTick
String ID:
API String ID: 1445889803-0
Opcode ID: d92a52ec3e3dac472e8cd58835fa1dfee3bb177a23bb29e0c8a098ab59da960c
Instruction ID: ad581302b88d88ba5582fc3090cb2adda3152429ccff88868a0b7ac573100b29
Opcode Fuzzy Hash: d92a52ec3e3dac472e8cd58835fa1dfee3bb177a23bb29e0c8a098ab59da960c
Instruction Fuzzy Hash: 58115EB5A053018BDB00EF79E48964BBBF0FB89265F064D39E448C6A04EB35D44C8BA2

Uniqueness

Uniqueness Score: -1.00%

Function 6D515EA0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 228COMMON

Download Yara Rule

APIs

deflateResetKeep.ZLIB1 ref: 6D5160DC
memset.MSVCRT ref: 6D51614B
deflateEnd.ZLIB1 ref: 6D51623F

Strings

8, xrefs: 6D515EC1

Memory Dump Source

Source File: 0000000D.00000002.865417746.000000006D511000.00000040.00000001.01000000.0000000B.sdmp, Offset: 6D510000, based on PE: true

Associated: 0000000D.00000002.865411633.000000006D510000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865433993.000000006D524000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865441691.000000006D52B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865448312.000000006D530000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865453850.000000006D531000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865459781.000000006D532000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865482049.000000006D533000.00000004.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6d510000_windowsconnect.jbxd

Similarity

API ID: deflate$KeepResetmemset
String ID: 8
API String ID: 1864257025-4194326291
Opcode ID: 13ad3d704391bab3f462585e0cd80502c8a71a037e924d0c9d1b1ebbab324790
Instruction ID: e3f67084fafb741efbfd8e6722a84460e4b8c4f079849e5d071305d46d3a437a
Opcode Fuzzy Hash: 13ad3d704391bab3f462585e0cd80502c8a71a037e924d0c9d1b1ebbab324790
Instruction Fuzzy Hash: 75A13AB05087018FEB18DF19C48476ABBF0BF89310F058A6DE9998BB96E775D844CF91

Uniqueness

Uniqueness Score: -1.00%

Function 6D51C8B0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 204COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 6D51BFE3

Strings

unknown header flags set, xrefs: 6D51D5CC
unknown compression method, xrefs: 6D51C923

Memory Dump Source

Source File: 0000000D.00000002.865417746.000000006D511000.00000040.00000001.01000000.0000000B.sdmp, Offset: 6D510000, based on PE: true

Associated: 0000000D.00000002.865411633.000000006D510000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865433993.000000006D524000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865441691.000000006D52B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865448312.000000006D530000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865453850.000000006D531000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865459781.000000006D532000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865482049.000000006D533000.00000004.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6d510000_windowsconnect.jbxd

Similarity

API ID: memcpy
String ID: unknown compression method$unknown header flags set
API String ID: 3510742995-1514342171
Opcode ID: 6940d1edd31692258c185f7c8d9e26b9247b77e733d4acedbf49311ecd1a0e10
Instruction ID: f016f6d1b231889fad89ceaa98f8a4c57346ddb1596e863d6c3a31985e466dbf
Opcode Fuzzy Hash: 6940d1edd31692258c185f7c8d9e26b9247b77e733d4acedbf49311ecd1a0e10
Instruction Fuzzy Hash: 2B9114746083028FE748CF19C580A2AFBF1BF89758F548A6EE8989B755D331D941CF82

Uniqueness

Uniqueness Score: -1.00%

Function 6D516260 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 170COMMON

Download Yara Rule

APIs

deflateResetKeep.ZLIB1 ref: 6D51641C

Strings

8, xrefs: 6D516283

Memory Dump Source

Source File: 0000000D.00000002.865417746.000000006D511000.00000040.00000001.01000000.0000000B.sdmp, Offset: 6D510000, based on PE: true

Associated: 0000000D.00000002.865411633.000000006D510000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865433993.000000006D524000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865441691.000000006D52B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865448312.000000006D530000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865453850.000000006D531000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865459781.000000006D532000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865482049.000000006D533000.00000004.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6d510000_windowsconnect.jbxd

Similarity

API ID: KeepResetdeflate
String ID: 8
API String ID: 4137869106-4194326291
Opcode ID: ff1bbe7d88bebed18ca30f63fba6194b96dcb48f7680e91f9f3f7119b87d6386
Instruction ID: c554ba576ae793c1ca9b416345161c4e3677562fea89aefc0f099d9caf2f2a7c
Opcode Fuzzy Hash: ff1bbe7d88bebed18ca30f63fba6194b96dcb48f7680e91f9f3f7119b87d6386
Instruction Fuzzy Hash: 2F8129B05087018FE718CF19C48476A7BE0BF48314F568AADD8998FB96E775D848CF91

Uniqueness

Uniqueness Score: -1.00%

Function 6D517AD0 Relevance: 6.1, APIs: 4, Instructions: 126COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 6D517B09

Memory Dump Source

Source File: 0000000D.00000002.865417746.000000006D511000.00000040.00000001.01000000.0000000B.sdmp, Offset: 6D510000, based on PE: true

Associated: 0000000D.00000002.865411633.000000006D510000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865433993.000000006D524000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865441691.000000006D52B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865448312.000000006D530000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865453850.000000006D531000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865459781.000000006D532000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865482049.000000006D533000.00000004.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6d510000_windowsconnect.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: e19ac94c149f224073e36df34accd4881cecd058f95085004258a25007877e56
Instruction ID: c0d6055d92ec7bf0753fe6a62a2956a827349a3917c00c9da2a7d3100c3a80d9
Opcode Fuzzy Hash: e19ac94c149f224073e36df34accd4881cecd058f95085004258a25007877e56
Instruction Fuzzy Hash: D3412675A0D316CBEB08DF2DD88021ABBE5BFD4614F118E6DE8948B745E770DD488B82

Uniqueness

Uniqueness Score: -1.00%

Function 6D5194A7 Relevance: 6.1, APIs: 4, Instructions: 68COMMON

Download Yara Rule

APIs

??3@YAXPAX@Z.MSVCRT ref: 6D519458
??3@YAXPAX@Z.MSVCRT ref: 6D51947B
_close.MSVCRT ref: 6D519486
??3@YAXPAX@Z.MSVCRT ref: 6D519499

Memory Dump Source

Source File: 0000000D.00000002.865417746.000000006D511000.00000040.00000001.01000000.0000000B.sdmp, Offset: 6D510000, based on PE: true

Associated: 0000000D.00000002.865411633.000000006D510000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865433993.000000006D524000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865441691.000000006D52B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865448312.000000006D530000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865453850.000000006D531000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865459781.000000006D532000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865482049.000000006D533000.00000004.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6d510000_windowsconnect.jbxd

Similarity

API ID: ??3@$_close
String ID:
API String ID: 1690646541-0
Opcode ID: 0ffbe5a1e39a0a6201ab3960e889636b59f5dc481c4e94e10677f69f29b23e46
Instruction ID: 5a0357107af6a5f2713f6cd28de2380b5deec9c90f366ec8987f31bd863ae0c4
Opcode Fuzzy Hash: 0ffbe5a1e39a0a6201ab3960e889636b59f5dc481c4e94e10677f69f29b23e46
Instruction Fuzzy Hash: 79213AB5A0C6218BEB189F38C8C075A77A1BF84324F124E59DD74AB789E774DC45CB81

Uniqueness

Uniqueness Score: -1.00%

Function 6D51954B Relevance: 6.0, APIs: 4, Instructions: 44COMMON

Download Yara Rule

APIs

Part of subcall function 6D518800: _write.MSVCRT ref: 6D518865
Part of subcall function 6D518800: _errno.MSVCRT ref: 6D51886E
Part of subcall function 6D518800: strerror.MSVCRT ref: 6D518879

??3@YAXPAX@Z.MSVCRT ref: 6D519458
??3@YAXPAX@Z.MSVCRT ref: 6D51947B
_close.MSVCRT ref: 6D519486
??3@YAXPAX@Z.MSVCRT ref: 6D519499

Memory Dump Source

Source File: 0000000D.00000002.865417746.000000006D511000.00000040.00000001.01000000.0000000B.sdmp, Offset: 6D510000, based on PE: true

Associated: 0000000D.00000002.865411633.000000006D510000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865433993.000000006D524000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865441691.000000006D52B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865448312.000000006D530000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865453850.000000006D531000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865459781.000000006D532000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865482049.000000006D533000.00000004.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6d510000_windowsconnect.jbxd

Similarity

API ID: ??3@$_close_errno_writestrerror
String ID:
API String ID: 2713693248-0
Opcode ID: e47e2a2599008cda9cd4bd127d4ef3cfc575fa358e86097cc02dcb9c6b9fc58d
Instruction ID: e8ae1477a00692023a8553faddd384f749e2e1993a787ef99facf846ab4d0d18
Opcode Fuzzy Hash: e47e2a2599008cda9cd4bd127d4ef3cfc575fa358e86097cc02dcb9c6b9fc58d
Instruction Fuzzy Hash: 84010CB561C7108BEB18AF38D8C061A77A0BF81324F524F68EA749B6C5D774DC458B81

Uniqueness

Uniqueness Score: -1.00%

Function 6D522540 Relevance: 6.0, APIs: 4, Instructions: 39COMMON

Download Yara Rule

APIs

RtlEnterCriticalSection.NTDLL ref: 6D52254E
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,6D52270B,?,?,?,?,?,6D522058), ref: 6D522575
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,6D52270B,?,?,?,?,?,6D522058), ref: 6D52257C
RtlLeaveCriticalSection.NTDLL ref: 6D52259C

Memory Dump Source

Source File: 0000000D.00000002.865417746.000000006D511000.00000040.00000001.01000000.0000000B.sdmp, Offset: 6D510000, based on PE: true

Associated: 0000000D.00000002.865411633.000000006D510000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865433993.000000006D524000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865441691.000000006D52B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865448312.000000006D530000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865453850.000000006D531000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865459781.000000006D532000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865482049.000000006D533000.00000004.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6d510000_windowsconnect.jbxd

Similarity

API ID: CriticalSection$EnterErrorLastLeaveValue
String ID:
API String ID: 682475483-0
Opcode ID: 61da1a5856a14ae68ed4ed0726781d8a4de7faa1cb846c83b8f67d09f1504081
Instruction ID: 51b02463ca96a04dd43690b8183b26c18ea01b9a14c811bdd72f386692e8743d
Opcode Fuzzy Hash: 61da1a5856a14ae68ed4ed0726781d8a4de7faa1cb846c83b8f67d09f1504081
Instruction Fuzzy Hash: A2F0A475A003118BCF107FA8C4C965A7BB4BF45254F064528ED444BB48E730E94CCBA3

Uniqueness

Uniqueness Score: -1.00%

Function 6D51BDAB Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 384COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 6D51BFE3

Strings

incorrect length check, xrefs: 6D51C6C0

Memory Dump Source

Source File: 0000000D.00000002.865417746.000000006D511000.00000040.00000001.01000000.0000000B.sdmp, Offset: 6D510000, based on PE: true

Associated: 0000000D.00000002.865411633.000000006D510000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865433993.000000006D524000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865441691.000000006D52B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865448312.000000006D530000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865453850.000000006D531000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865459781.000000006D532000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865482049.000000006D533000.00000004.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6d510000_windowsconnect.jbxd

Similarity

API ID: memcpy
String ID: incorrect length check
API String ID: 3510742995-3870113482
Opcode ID: 6334fb486134a92cb62149f485e47c1ed0eba5bdbb024ba435a251329e3e12d9
Instruction ID: f1c7c24f1305a273aa90261f2f3767212badc7f33aaec9b0e9537e5f5796601c
Opcode Fuzzy Hash: 6334fb486134a92cb62149f485e47c1ed0eba5bdbb024ba435a251329e3e12d9
Instruction Fuzzy Hash: E2F17A75A087128FE748CF19C48062AF7E1BFC8754F458AAEE8989B755D330EA44CF81

Uniqueness

Uniqueness Score: -1.00%

Function 6D517E80 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 296COMMON

Download Yara Rule

Strings

out of room to push characters, xrefs: 6D518218

Memory Dump Source

Source File: 0000000D.00000002.865417746.000000006D511000.00000040.00000001.01000000.0000000B.sdmp, Offset: 6D510000, based on PE: true

Associated: 0000000D.00000002.865411633.000000006D510000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865433993.000000006D524000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865441691.000000006D52B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865448312.000000006D530000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865453850.000000006D531000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865459781.000000006D532000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865482049.000000006D533000.00000004.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6d510000_windowsconnect.jbxd

Similarity

API ID:
String ID: out of room to push characters
API String ID: 0-1607023399
Opcode ID: 007a4ca78b4370b41a50a1652e1107ff7c60d891bc431067b370a75f5cacc7e6
Instruction ID: 68cea79873d83866c872b8ab23a1204f465b3f6047ac8a179c8965a1ba938b2a
Opcode Fuzzy Hash: 007a4ca78b4370b41a50a1652e1107ff7c60d891bc431067b370a75f5cacc7e6
Instruction Fuzzy Hash: 07B19435B0C6129BEB28CE3CCCC06667BE1BF45354F158A58D954CFA49E731D844CB92

Uniqueness

Uniqueness Score: -1.00%

Function 6D51343C Relevance: 5.4, APIs: 4, Instructions: 430COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.865417746.000000006D511000.00000040.00000001.01000000.0000000B.sdmp, Offset: 6D510000, based on PE: true

Associated: 0000000D.00000002.865411633.000000006D510000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865433993.000000006D524000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865441691.000000006D52B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865448312.000000006D530000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865453850.000000006D531000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865459781.000000006D532000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865482049.000000006D533000.00000004.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6d510000_windowsconnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fdbb1d5ce0fad2aef4baabe0d7ed73f42ee54f52b3828f1e8202132b94240752
Instruction ID: 96a05bf7d4c259b997d862c2ea79745c0313a436e1021c82faf4069f00931a87
Opcode Fuzzy Hash: fdbb1d5ce0fad2aef4baabe0d7ed73f42ee54f52b3828f1e8202132b94240752
Instruction Fuzzy Hash: 14123875A087098FEB24CF29C49069AB7F1BF48354F158A2EEC9997701D335E985CF81

Uniqueness

Uniqueness Score: -1.00%

Function 6D5222C0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 173COMMON

Download Yara Rule

Strings

Unknown pseudo relocation bit size %d., xrefs: 6D5223C4
Unknown pseudo relocation protocol version %d., xrefs: 6D522526

Memory Dump Source

Source File: 0000000D.00000002.865417746.000000006D511000.00000040.00000001.01000000.0000000B.sdmp, Offset: 6D510000, based on PE: true

Associated: 0000000D.00000002.865411633.000000006D510000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865433993.000000006D524000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865441691.000000006D52B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865448312.000000006D530000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865453850.000000006D531000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865459781.000000006D532000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865482049.000000006D533000.00000004.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6d510000_windowsconnect.jbxd

Similarity

API ID:
String ID: Unknown pseudo relocation bit size %d.$ Unknown pseudo relocation protocol version %d.
API String ID: 0-395989641
Opcode ID: c15e091cfb75df177077ef00f0e6788403f22e29e53139e7ae11d80c7a2056f4
Instruction ID: b4c354e9b411c3959de07df49cfe5f7c4f004f1698328805848ebefa2a14c223
Opcode Fuzzy Hash: c15e091cfb75df177077ef00f0e6788403f22e29e53139e7ae11d80c7a2056f4
Instruction Fuzzy Hash: 9951F539A242168BCF28CF68C88079E77F1BB85354F068919D9459BF88D730A95DCBD3

Uniqueness

Uniqueness Score: -1.00%

Function 6D516D00 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 34COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 6D516D15

Part of subcall function 6D5168F0: malloc.MSVCRT ref: 6D51690E
Part of subcall function 6D5168F0: ??3@YAXPAX@Z.MSVCRT ref: 6D516AA1

??3@YAXPAX@Z.MSVCRT ref: 6D516D4E

Strings

<fd:%d>, xrefs: 6D516D24

Memory Dump Source

Source File: 0000000D.00000002.865417746.000000006D511000.00000040.00000001.01000000.0000000B.sdmp, Offset: 6D510000, based on PE: true

Associated: 0000000D.00000002.865411633.000000006D510000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865433993.000000006D524000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865441691.000000006D52B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865448312.000000006D530000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865453850.000000006D531000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865459781.000000006D532000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.865482049.000000006D533000.00000004.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6d510000_windowsconnect.jbxd

Similarity

API ID: ??3@malloc
String ID: <fd:%d>
API String ID: 3530088491-558891604
Opcode ID: ed5ff236ec2e52b562c02ebe77f8728b7d1f71fc60333b7252d79c39c1492071
Instruction ID: 6b51e15942d0e374e34358e7cd9a029105acba28a923d8d272dfb780bf48c7b3
Opcode Fuzzy Hash: ed5ff236ec2e52b562c02ebe77f8728b7d1f71fc60333b7252d79c39c1492071
Instruction Fuzzy Hash: 64F0BEB1A0C3215BEB146F6CA88015BB7E0AB80668F424E6DE8D897380D734CC45CBD2

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	To disguise the source of malicious traffic, adversaries may chain together multiple proxies. Typically, a defender will be able to identify the last proxy traffic traversed before it enters their network; the defender may or may not be able to identify any previous proxies before the last-hop proxy. This technique makes identifying the original source of the malicious traffic even more difficult by requiring the defender to trace malicious traffic through several proxies to identify its source.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Network protocol analysis
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 25hBQ7XDkh.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: BitRat

Yara Overview

Initial Sample

Memory Dumps

Unpacked PEs

Sigma Overview

Jbx Signature Overview

AV Detection

Cryptography

Bitcoin Miner

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\ea242c1c\tor\data\state (copy)

C:\Users\user\AppData\Local\ea242c1c\tor\data\state.tmp

C:\Users\user\AppData\Local\ea242c1c\tor\libcrypto-1_1.dll

C:\Users\user\AppData\Local\ea242c1c\tor\libevent-2-1-6.dll

C:\Users\user\AppData\Local\ea242c1c\tor\libgcc_s_sjlj-1.dll

C:\Users\user\AppData\Local\ea242c1c\tor\libssl-1_1.dll

C:\Users\user\AppData\Local\ea242c1c\tor\libssp-0.dll

C:\Users\user\AppData\Local\ea242c1c\tor\libwinpthread-1.dll

C:\Users\user\AppData\Local\ea242c1c\tor\torrc

C:\Users\user\AppData\Local\ea242c1c\tor\windowsconnect.exe

C:\Users\user\AppData\Local\ea242c1c\tor\zlib1.dll

Static File Info

General

File Icon

Windows Analysis Report
25hBQ7XDkh.exe

Function 006909DF Relevance: 7.6, APIs: 5, Instructions: 62
threadCOMMON

Function 006A47A0 Relevance: 4.7, APIs: 3, Instructions: 186
COMMONLIBRARYCODE

Function 0069092B Relevance: 3.0, APIs: 2, Instructions: 38
threadCOMMON

Function 0069C2D2 Relevance: 1.5, APIs: 1, Instructions: 39
memoryCOMMONLIBRARYCODE

Function 0069CC9E Relevance: 1.5, APIs: 1, Instructions: 32
memoryCOMMONLIBRARYCODE

Function 00690682 Relevance: 4.6, APIs: 3, Instructions: 78
COMMONLIBRARYCODE

Function 006A043C Relevance: 4.5, APIs: 3, Instructions: 20
COMMONLIBRARYCODE

Function 006AF18E Relevance: 19.6, APIs: 13, Instructions: 114
COMMONLIBRARYCODE

Function 006A4125 Relevance: 10.7, APIs: 7, Instructions: 152
fileCOMMONLIBRARYCODE

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a connection proxy to direct network traffic between systems or act as an intermediary for network communications to a command and control server to avoid direct connections to their infrastructure. Many tools exist that enable traffic redirection through proxies or port redirection, including HTRAN , ZXProxy, and ZXPortMap. Adversaries use these types of proxies to manage command and control communications, reduce the number of simultaneous outbound network connections, provide resiliency in the face of connection loss, or to ride over existing trusted communications paths between victims to avoid suspicion. Adversaries may chain together multiple proxies to further disguise the source of malicious traffic.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre